V1.00.128.2025.06.03
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
@@ -0,0 +1,21 @@
|
||||
---
|
||||
gitea: none
|
||||
include_toc: true
|
||||
---
|
||||
|
||||
# 1. RFC I-D draft-weidner-catalog-rr-ext
|
||||
|
||||
**Centurion Intelligence Consulting Agency Information Security Standard**<br>
|
||||
*RFC I-D draft-weidner-catalog-rr-ext*<br>
|
||||
**Master Version**: 1.00<br>
|
||||
**Build**: V1.00.128.2025.06.03<br>
|
||||
|
||||
# 2. DNSSEC Status
|
||||
|
||||
This is an auto-generated overview of the DNSSEC status of `coresecret.dev` at the time of the last human-initiated push event.
|
||||
|
||||
|
||||
|
||||
---
|
||||
**[no tracking | no logging | no advertising | no profiling | no bullshit](https://coresecret.eu/)**
|
||||
<!-- vim: set number et ts=2 sw=2 sts=2 ai tw=128 ft=markdown -->
|
||||
@@ -0,0 +1,318 @@
|
||||
---
|
||||
gitea: none
|
||||
include_toc: true
|
||||
---
|
||||
|
||||
# 1. RFC I-D draft-weidner-catalog-rr-ext
|
||||
|
||||
**Centurion Intelligence Consulting Agency Information Security Standard**<br>
|
||||
*RFC I-D draft-weidner-catalog-rr-ext*<br>
|
||||
**Master Version**: 1.00<br>
|
||||
**Build**: V1.00.128.2025.06.03<br>
|
||||
|
||||
# 2. TLS Audit
|
||||
|
||||
This is a TLS Audit of the ``git.coresecret.dev`` Webserver.
|
||||
|
||||
````text
|
||||
#####################################################################
|
||||
testssl.sh version 3.2rc4 from https://testssl.sh/dev/
|
||||
(6746fa5 2025-04-18 13:17:50)
|
||||
|
||||
This program is free software. Distribution and modification under
|
||||
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
|
||||
|
||||
Please file bugs @ https://testssl.sh/bugs/
|
||||
#####################################################################
|
||||
|
||||
Using OpenSSL 1.0.2-bad (Mar 28 2025) [~179 ciphers]
|
||||
on kali:./bin/openssl.Linux.x86_64
|
||||
|
||||
Start 2025-06-02 18:04:19 -->> 152.53.110.40:443 (coresecret.dev) <<--
|
||||
|
||||
Further IP addresses: 2a0a:4cc0:80:330f:152:53:110:40
|
||||
rDNS (152.53.110.40): git.coresecret.dev.
|
||||
Service detected: HTTP
|
||||
|
||||
Testing protocols via sockets except NPN+ALPN
|
||||
|
||||
SSLv2 not offered (OK)
|
||||
SSLv3 not offered (OK)
|
||||
TLS 1 not offered
|
||||
TLS 1.1 not offered
|
||||
TLS 1.2 offered (OK)
|
||||
TLS 1.3 offered (OK): final
|
||||
NPN/SPDY not offered
|
||||
ALPN/HTTP2 h2, http/1.1 (offered)
|
||||
|
||||
Testing for server implementation bugs
|
||||
|
||||
No bugs found.
|
||||
|
||||
Testing cipher categories
|
||||
|
||||
NULL ciphers (no encryption) not offered (OK)
|
||||
Anonymous NULL Ciphers (no authentication) not offered (OK)
|
||||
Export ciphers (w/o ADH+NULL) not offered (OK)
|
||||
LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK)
|
||||
Triple DES Ciphers / IDEA not offered
|
||||
Obsoleted CBC ciphers (AES, ARIA etc.) not offered
|
||||
Strong encryption (AEAD ciphers) with no FS not offered
|
||||
Forward Secrecy strong encryption (AEAD ciphers) offered (OK)
|
||||
|
||||
|
||||
Testing server's cipher preferences
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
SSLv2
|
||||
-
|
||||
SSLv3
|
||||
-
|
||||
TLSv1
|
||||
-
|
||||
TLSv1.1
|
||||
-
|
||||
TLSv1.2 (server order)
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 448 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 448 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
TLSv1.3 (server order)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH 448 AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 448 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
|
||||
Has server cipher order? yes (OK) -- TLS 1.3 and below
|
||||
|
||||
|
||||
Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4
|
||||
|
||||
FS is offered (OK) , ciphers follow (client/browser support is important here)
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH 448 AESGCM 256 TLS_AES_256_GCM_SHA384 available
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 448 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256 available
|
||||
xcc14 ECDHE-ECDSA-CHACHA20-POLY1305-OLD ECDH ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256_OLD not a/v
|
||||
xcc13 ECDHE-RSA-CHACHA20-POLY1305-OLD ECDH ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256_OLD not a/v
|
||||
xcc15 DHE-RSA-CHACHA20-POLY1305-OLD DH ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256_OLD not a/v
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 521 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 available
|
||||
xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 not a/v
|
||||
xc028 ECDHE-RSA-AES256-SHA384 ECDH AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 not a/v
|
||||
xc024 ECDHE-ECDSA-AES256-SHA384 ECDH AES 256 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 not a/v
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA not a/v
|
||||
xc00a ECDHE-ECDSA-AES256-SHA ECDH AES 256 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA not a/v
|
||||
xa3 DHE-DSS-AES256-GCM-SHA384 DH AESGCM 256 TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 not a/v
|
||||
x9f DHE-RSA-AES256-GCM-SHA384 DH AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 not a/v
|
||||
xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 not a/v
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 448 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 available
|
||||
xccaa DHE-RSA-CHACHA20-POLY1305 DH ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 not a/v
|
||||
xc0af ECDHE-ECDSA-AES256-CCM8 ECDH AESCCM8 256 TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 not a/v
|
||||
xc0ad ECDHE-ECDSA-AES256-CCM ECDH AESCCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_CCM not a/v
|
||||
xc0a3 DHE-RSA-AES256-CCM8 DH AESCCM8 256 TLS_DHE_RSA_WITH_AES_256_CCM_8 not a/v
|
||||
xc09f DHE-RSA-AES256-CCM DH AESCCM 256 TLS_DHE_RSA_WITH_AES_256_CCM not a/v
|
||||
x6b DHE-RSA-AES256-SHA256 DH AES 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 not a/v
|
||||
x6a DHE-DSS-AES256-SHA256 DH AES 256 TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 not a/v
|
||||
x39 DHE-RSA-AES256-SHA DH AES 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA not a/v
|
||||
x38 DHE-DSS-AES256-SHA DH AES 256 TLS_DHE_DSS_WITH_AES_256_CBC_SHA not a/v
|
||||
xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 not a/v
|
||||
xc073 ECDHE-ECDSA-CAMELLIA256-SHA384 ECDH Camellia 256 TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 not a/v
|
||||
xc4 DHE-RSA-CAMELLIA256-SHA256 DH Camellia 256 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 not a/v
|
||||
xc3 DHE-DSS-CAMELLIA256-SHA256 DH Camellia 256 TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 not a/v
|
||||
x88 DHE-RSA-CAMELLIA256-SHA DH Camellia 256 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA not a/v
|
||||
x87 DHE-DSS-CAMELLIA256-SHA DH Camellia 256 TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA not a/v
|
||||
xc043 DHE-DSS-ARIA256-CBC-SHA384 DH ARIA 256 TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384 not a/v
|
||||
xc045 DHE-RSA-ARIA256-CBC-SHA384 DH ARIA 256 TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384 not a/v
|
||||
xc049 ECDHE-ECDSA-ARIA256-CBC-SHA384 ECDH ARIA 256 TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384 not a/v
|
||||
xc04d ECDHE-RSA-ARIA256-CBC-SHA384 ECDH ARIA 256 TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384 not a/v
|
||||
xc053 DHE-RSA-ARIA256-GCM-SHA384 DH ARIAGCM 256 TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 not a/v
|
||||
xc057 DHE-DSS-ARIA256-GCM-SHA384 DH ARIAGCM 256 TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384 not a/v
|
||||
xc05d ECDHE-ECDSA-ARIA256-GCM-SHA384 ECDH ARIAGCM 256 TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 not a/v
|
||||
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 not a/v
|
||||
xc07d - DH CamelliaGCM 256 TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 not a/v
|
||||
xc081 - DH CamelliaGCM 256 TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384 not a/v
|
||||
xc087 - ECDH CamelliaGCM 256 TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 not a/v
|
||||
xc08b - ECDH CamelliaGCM 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 not a/v
|
||||
x1301 TLS_AES_128_GCM_SHA256 any AESGCM 128 TLS_AES_128_GCM_SHA256 not a/v
|
||||
x1304 TLS_AES_128_CCM_SHA256 any AESCCM 128 TLS_AES_128_CCM_SHA256 not a/v
|
||||
x1305 TLS_AES_128_CCM_8_SHA256 any AESCCM8 128 TLS_AES_128_CCM_8_SHA256 not a/v
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 not a/v
|
||||
xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 not a/v
|
||||
xc027 ECDHE-RSA-AES128-SHA256 ECDH AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 not a/v
|
||||
xc023 ECDHE-ECDSA-AES128-SHA256 ECDH AES 128 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 not a/v
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA not a/v
|
||||
xc009 ECDHE-ECDSA-AES128-SHA ECDH AES 128 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA not a/v
|
||||
xa2 DHE-DSS-AES128-GCM-SHA256 DH AESGCM 128 TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 not a/v
|
||||
x9e DHE-RSA-AES128-GCM-SHA256 DH AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 not a/v
|
||||
xc0ae ECDHE-ECDSA-AES128-CCM8 ECDH AESCCM8 128 TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 not a/v
|
||||
xc0ac ECDHE-ECDSA-AES128-CCM ECDH AESCCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_CCM not a/v
|
||||
xc0a2 DHE-RSA-AES128-CCM8 DH AESCCM8 128 TLS_DHE_RSA_WITH_AES_128_CCM_8 not a/v
|
||||
xc09e DHE-RSA-AES128-CCM DH AESCCM 128 TLS_DHE_RSA_WITH_AES_128_CCM not a/v
|
||||
x67 DHE-RSA-AES128-SHA256 DH AES 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 not a/v
|
||||
x40 DHE-DSS-AES128-SHA256 DH AES 128 TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 not a/v
|
||||
x33 DHE-RSA-AES128-SHA DH AES 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA not a/v
|
||||
x32 DHE-DSS-AES128-SHA DH AES 128 TLS_DHE_DSS_WITH_AES_128_CBC_SHA not a/v
|
||||
xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 not a/v
|
||||
xc072 ECDHE-ECDSA-CAMELLIA128-SHA256 ECDH Camellia 128 TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 not a/v
|
||||
xbe DHE-RSA-CAMELLIA128-SHA256 DH Camellia 128 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 not a/v
|
||||
xbd DHE-DSS-CAMELLIA128-SHA256 DH Camellia 128 TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 not a/v
|
||||
x9a DHE-RSA-SEED-SHA DH SEED 128 TLS_DHE_RSA_WITH_SEED_CBC_SHA not a/v
|
||||
x99 DHE-DSS-SEED-SHA DH SEED 128 TLS_DHE_DSS_WITH_SEED_CBC_SHA not a/v
|
||||
x45 DHE-RSA-CAMELLIA128-SHA DH Camellia 128 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA not a/v
|
||||
x44 DHE-DSS-CAMELLIA128-SHA DH Camellia 128 TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA not a/v
|
||||
xc042 DHE-DSS-ARIA128-CBC-SHA256 DH ARIA 128 TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256 not a/v
|
||||
xc044 DHE-RSA-ARIA128-CBC-SHA256 DH ARIA 128 TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256 not a/v
|
||||
xc048 ECDHE-ECDSA-ARIA128-CBC-SHA256 ECDH ARIA 128 TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256 not a/v
|
||||
xc04c ECDHE-RSA-ARIA128-CBC-SHA256 ECDH ARIA 128 TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256 not a/v
|
||||
xc052 DHE-RSA-ARIA128-GCM-SHA256 DH ARIAGCM 128 TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 not a/v
|
||||
xc056 DHE-DSS-ARIA128-GCM-SHA256 DH ARIAGCM 128 TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256 not a/v
|
||||
xc05c ECDHE-ECDSA-ARIA128-GCM-SHA256 ECDH ARIAGCM 128 TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 not a/v
|
||||
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 not a/v
|
||||
xc07c - DH CamelliaGCM 128 TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 not a/v
|
||||
xc080 - DH CamelliaGCM 128 TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256 not a/v
|
||||
xc086 - ECDH CamelliaGCM 128 TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 not a/v
|
||||
xc08a - ECDH CamelliaGCM 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 not a/v
|
||||
|
||||
Elliptic curves offered: secp384r1 secp521r1 X448
|
||||
TLS 1.2 sig_algs offered: RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||
TLS 1.3 sig_algs offered: RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
|
||||
Testing server defaults (Server Hello)
|
||||
|
||||
TLS extensions (standard) "server name/#0" "max fragment length/#1" "status request/#5" "supported_groups/#10" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16" "extended master secret/#23" "supported versions/#43" "key share/#51"
|
||||
"renegotiation info/#65281"
|
||||
Session Ticket RFC 5077 hint no -- no lifetime advertised
|
||||
SSL Session ID support yes
|
||||
Session Resumption Tickets no, ID: yes
|
||||
TLS clock skew Random values, no fingerprinting possible
|
||||
Certificate Compression none
|
||||
Client Authentication none
|
||||
Signature Algorithm SHA256 with RSA
|
||||
Server key size RSA 4096 bits (exponent is 65537)
|
||||
Server key usage Digital Signature, Key Encipherment
|
||||
Server extended key usage TLS Web Server Authentication, TLS Web Client Authentication
|
||||
Serial 1230B34459C6F27FA9BCD2 (OK: length 11)
|
||||
Fingerprints SHA1 1A8BD98862771602E7DD46B742FB66D6C03E622E
|
||||
SHA256 76B6FFCE607D8514F676C286C7C76B90F5B7AE7D041631F2EF2F0079AF8D24AC
|
||||
Common Name (CN) coresecret.dev
|
||||
subjectAltName (SAN) coresecret.dev git.coresecret.dev lab.coresecret.dev run.coresecret.dev www.coresecret.dev
|
||||
Trust (hostname) Ok via SAN and CN (same w/o SNI)
|
||||
Chain of trust Ok
|
||||
EV cert (experimental) no
|
||||
Certificate Validity (UTC) 174 >= 60 days (2025-05-28 09:56 --> 2025-11-23 22:59)
|
||||
ETS/"eTLS", visibility info not present
|
||||
In pwnedkeys.com DB not in database
|
||||
Certificate Revocation List http://crl.buypass.no/crl/BPClass2CA5.crl, not revoked
|
||||
OCSP URI http://ocsp.buypass.com, not revoked
|
||||
OCSP stapling offered, not revoked
|
||||
OCSP must staple extension --
|
||||
DNS CAA RR (experimental) not offered
|
||||
Certificate Transparency yes (certificate extension)
|
||||
Certificates provided 2
|
||||
Issuer Buypass Class 2 CA 5 (Buypass AS-983163327 from NO)
|
||||
Intermediate cert validity #1: ok > 40 days (2027-05-23 12:57). Buypass Class 2 CA 5 <-- Buypass Class 2 Root CA
|
||||
Intermediate Bad OCSP (exp.) Ok
|
||||
|
||||
|
||||
Testing HTTP header response @ "/"
|
||||
|
||||
HTTP Status Code 301 Moved Permanently, redirecting to "https://git.coresecret.dev"
|
||||
HTTP clock skew 0 sec from localtime
|
||||
Strict Transport Security 730 days=63072000 s, includeSubDomains, preload
|
||||
Public Key Pinning --
|
||||
Server banner nginx
|
||||
Application banner --
|
||||
Cookie(s) (none issued at "/") -- maybe better try target URL of 30x
|
||||
Security headers X-Frame-Options: SAMEORIGIN
|
||||
X-Content-Type-Options: nosniff
|
||||
Expect-CT: max-age=86400, enforce
|
||||
Permissions-Policy: interest-cohort=()
|
||||
Cross-Origin-Opener-Policy: same-origin
|
||||
Cross-Origin-Resource-Policy: same-origin
|
||||
Cross-Origin-Embedder-Policy: require-corp
|
||||
X-XSS-Protection: 1; mode=block
|
||||
Permissions-Policy: interest-cohort=()
|
||||
Referrer-Policy: same-origin
|
||||
Cache-Control: no-cache
|
||||
Reverse Proxy banner --
|
||||
|
||||
|
||||
Testing vulnerabilities
|
||||
|
||||
Heartbleed (CVE-2014-0160) not vulnerable (OK), no heartbeat extension
|
||||
CCS (CVE-2014-0224) not vulnerable (OK)
|
||||
Ticketbleed (CVE-2016-9244), experiment. not vulnerable (OK), no session ticket extension
|
||||
ROBOT Server does not support any cipher suites that use RSA key transport
|
||||
Secure Renegotiation (RFC 5746) supported (OK)
|
||||
Secure Client-Initiated Renegotiation not vulnerable (OK)
|
||||
CRIME, TLS (CVE-2012-4929) not vulnerable (OK)
|
||||
BREACH (CVE-2013-3587) no gzip/deflate/compress/br HTTP compression (OK) - only supplied "/" tested
|
||||
POODLE, SSL (CVE-2014-3566) not vulnerable (OK), no SSLv3 support
|
||||
TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered
|
||||
SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK)
|
||||
FREAK (CVE-2015-0204) not vulnerable (OK)
|
||||
DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK)
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=76B6FFCE607D8514F676C286C7C76B90F5B7AE7D041631F2EF2F0079AF8D24AC
|
||||
LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1
|
||||
LUCKY13 (CVE-2013-0169), experimental not vulnerable (OK)
|
||||
Winshock (CVE-2014-6321), experimental not vulnerable (OK)
|
||||
RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK)
|
||||
|
||||
|
||||
Running client simulations (HTTP) via sockets
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) No connection
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 384 bit ECDH (P-384)
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 384 bit ECDH (P-384)
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 384 bit ECDH (P-384)
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 384 bit ECDH (P-384)
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 384 bit ECDH (P-384)
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 384 bit ECDH (P-384)
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 384 bit ECDH (P-384)
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 521 bit ECDH (P-521)
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 521 bit ECDH (P-521)
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 No connection
|
||||
IE 11 Win 8.1 No connection
|
||||
IE 11 Win Phone 8.1 No connection
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 384 bit ECDH (P-384)
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 384 bit ECDH (P-384)
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 384 bit ECDH (P-384)
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 384 bit ECDH (P-384)
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 521 bit ECDH (P-521)
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 521 bit ECDH (P-521)
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 521 bit ECDH (P-521)
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 448 bit ECDH (X448)
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 521 bit ECDH (P-521)
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 448 bit ECDH (X448)
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 448 bit ECDH (X448)
|
||||
go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 521 bit ECDH (P-521)
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 521 bit ECDH (P-521)
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 521 bit ECDH (P-521)
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 448 bit ECDH (X448)
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 448 bit ECDH (X448)
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 448 bit ECDH (X448)
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 521 bit ECDH (P-521)
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 521 bit ECDH (P-521)
|
||||
|
||||
|
||||
Rating (experimental)
|
||||
|
||||
Rating specs (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009q from 2020-01-30)
|
||||
Specification documentation https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||
Protocol Support (weighted) 100 (30)
|
||||
Key Exchange (weighted) 100 (30)
|
||||
Cipher Strength (weighted) 100 (40)
|
||||
Final Score 100
|
||||
Overall Grade A+
|
||||
|
||||
Done 2025-06-02 18:05:51 [ 95s] -->> 152.53.110.40:443 (coresecret.dev) <<--
|
||||
````
|
||||
|
||||
---
|
||||
**[no tracking | no logging | no advertising | no profiling | no bullshit](https://coresecret.eu/)**
|
||||
<!-- vim: set number et ts=2 sw=2 sts=2 ai tw=128 ft=markdown -->
|
||||
@@ -0,0 +1,21 @@
|
||||
---
|
||||
gitea: none
|
||||
include_toc: true
|
||||
---
|
||||
|
||||
# 1. RFC I-D draft-weidner-catalog-rr-ext
|
||||
|
||||
**Centurion Intelligence Consulting Agency Information Security Standard**<br>
|
||||
*RFC I-D draft-weidner-catalog-rr-ext*<br>
|
||||
**Master Version**: 1.00<br>
|
||||
**Build**: V1.00.128.2025.06.03<br>
|
||||
|
||||
# 2. Centurion Net - Developer Branch Overview
|
||||
|
||||
This is an automatically generated overview of the secure ``Centurion Net`` Developer Branch.
|
||||
|
||||
|
||||
|
||||
---
|
||||
**[no tracking | no logging | no advertising | no profiling | no bullshit](https://coresecret.eu/)**
|
||||
<!-- vim: set number et ts=2 sw=2 sts=2 ai tw=128 ft=markdown -->
|
||||
@@ -0,0 +1,27 @@
|
||||
---
|
||||
gitea: none
|
||||
include_toc: true
|
||||
---
|
||||
|
||||
# 1. RFC I-D draft-weidner-catalog-rr-ext
|
||||
|
||||
**Centurion Intelligence Consulting Agency Information Security Standard**<br>
|
||||
*RFC I-D draft-weidner-catalog-rr-ext*<br>
|
||||
**Master Version**: 1.00<br>
|
||||
**Build**: V1.00.128.2025.06.03<br>
|
||||
|
||||
# 2. Contributing / participating
|
||||
|
||||
Contributing / participating is always welcome!
|
||||
|
||||
Please note the following:
|
||||
|
||||
* If you have something new and/or bigger that you like to contribute, better open an issue first before you get frustrated.
|
||||
* Please **one** pull request per feature or bug fix or improvement. Please do not mix issues.
|
||||
* Documentation pays off in the long run. So please document your code, and the pull request and/or commit message.
|
||||
|
||||
For questions, open an issue. Thanks for reading this!
|
||||
|
||||
---
|
||||
**[no tracking | no logging | no advertising | no profiling | no bullshit](https://coresecret.eu/)**
|
||||
<!-- vim: set number et ts=2 sw=2 sts=2 ai tw=128 ft=markdown -->
|
||||
@@ -0,0 +1,29 @@
|
||||
---
|
||||
gitea: none
|
||||
include_toc: true
|
||||
---
|
||||
|
||||
# 1. RFC I-D draft-weidner-catalog-rr-ext
|
||||
|
||||
**Centurion Intelligence Consulting Agency Information Security Standard**<br>
|
||||
*RFC I-D draft-weidner-catalog-rr-ext*<br>
|
||||
**Master Version**: 1.00<br>
|
||||
**Build**: V1.00.128.2025.06.03<br>
|
||||
|
||||
# 2. Credits
|
||||
|
||||
## 2.2. Authors
|
||||
|
||||
## 2.3. Contributors
|
||||
|
||||
### X
|
||||
|
||||
I would like to express my sincere gratitude to Mr., Who-wants-to-live-forever, for his gracious support and insightful and profound criticism.
|
||||
|
||||
### Ζ
|
||||
|
||||
* Zimnol, André H.; Private Contributor
|
||||
|
||||
---
|
||||
**[no tracking | no logging | no advertising | no profiling | no bullshit](https://coresecret.eu/)**
|
||||
<!-- vim: set number et ts=2 sw=2 sts=2 ai tw=128 ft=markdown -->
|
||||
@@ -0,0 +1,123 @@
|
||||
# SPDX-License-Identifier: CC0-1.0
|
||||
|
||||
Creative Commons Legal Code
|
||||
|
||||
CC0 1.0 Universal
|
||||
|
||||
CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
|
||||
LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
|
||||
ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
|
||||
INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
|
||||
REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
|
||||
PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
|
||||
THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
|
||||
HEREUNDER.
|
||||
|
||||
Statement of Purpose
|
||||
|
||||
The laws of most jurisdictions throughout the world automatically confer
|
||||
exclusive Copyright and Related Rights (defined below) upon the creator
|
||||
and subsequent owner(s) (each and all, an "owner") of an original work of
|
||||
authorship and/or a database (each, a "Work").
|
||||
|
||||
Certain owners wish to permanently relinquish those rights to a Work for
|
||||
the purpose of contributing to a commons of creative, cultural and
|
||||
scientific works ("Commons") that the public can reliably and without fear
|
||||
of later claims of infringement build upon, modify, incorporate in other
|
||||
works, reuse and redistribute as freely as possible in any form whatsoever
|
||||
and for any purposes, including without limitation commercial purposes.
|
||||
These owners may contribute to the Commons to promote the ideal of a free
|
||||
culture and the further production of creative, cultural and scientific
|
||||
works, or to gain reputation or greater distribution for their Work in
|
||||
part through the use and efforts of others.
|
||||
|
||||
For these and/or other purposes and motivations, and without any
|
||||
expectation of additional consideration or compensation, the person
|
||||
associating CC0 with a Work (the "Affirmer"), to the extent that he or she
|
||||
is an owner of Copyright and Related Rights in the Work, voluntarily
|
||||
elects to apply CC0 to the Work and publicly distribute the Work under its
|
||||
terms, with knowledge of his or her Copyright and Related Rights in the
|
||||
Work and the meaning and intended legal effect of CC0 on those rights.
|
||||
|
||||
1. Copyright and Related Rights. A Work made available under CC0 may be
|
||||
protected by copyright and related or neighboring rights ("Copyright and
|
||||
Related Rights"). Copyright and Related Rights include, but are not
|
||||
limited to, the following:
|
||||
|
||||
i. the right to reproduce, adapt, distribute, perform, display,
|
||||
communicate, and translate a Work;
|
||||
ii. moral rights retained by the original author(s) and/or performer(s);
|
||||
iii. publicity and privacy rights pertaining to a person's image or
|
||||
likeness depicted in a Work;
|
||||
iv. rights protecting against unfair competition in regards to a Work,
|
||||
subject to the limitations in paragraph 4(a), below;
|
||||
v. rights protecting the extraction, dissemination, use and reuse of data
|
||||
in a Work;
|
||||
vi. database rights (such as those arising under Directive 96/9/EC of the
|
||||
European Parliament and of the Council of 11 March 1996 on the legal
|
||||
protection of databases, and under any national implementation
|
||||
thereof, including any amended or successor version of such
|
||||
directive); and
|
||||
vii. other similar, equivalent or corresponding rights throughout the
|
||||
world based on applicable law or treaty, and any national
|
||||
implementations thereof.
|
||||
|
||||
2. Waiver. To the greatest extent permitted by, but not in contravention
|
||||
of, applicable law, Affirmer hereby overtly, fully, permanently,
|
||||
irrevocably and unconditionally waives, abandons, and surrenders all of
|
||||
Affirmer's Copyright and Related Rights and associated claims and causes
|
||||
of action, whether now known or unknown (including existing as well as
|
||||
future claims and causes of action), in the Work (i) in all territories
|
||||
worldwide, (ii) for the maximum duration provided by applicable law or
|
||||
treaty (including future time extensions), (iii) in any current or future
|
||||
medium and for any number of copies, and (iv) for any purpose whatsoever,
|
||||
including without limitation commercial, advertising or promotional
|
||||
purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
|
||||
member of the public at large and to the detriment of Affirmer's heirs and
|
||||
successors, fully intending that such Waiver shall not be subject to
|
||||
revocation, rescission, cancellation, termination, or any other legal or
|
||||
equitable action to disrupt the quiet enjoyment of the Work by the public
|
||||
as contemplated by Affirmer's express Statement of Purpose.
|
||||
|
||||
3. Public License Fallback. Should any part of the Waiver for any reason
|
||||
be judged legally invalid or ineffective under applicable law, then the
|
||||
Waiver shall be preserved to the maximum extent permitted taking into
|
||||
account Affirmer's express Statement of Purpose. In addition, to the
|
||||
extent the Waiver is so judged Affirmer hereby grants to each affected
|
||||
person a royalty-free, non transferable, non sublicensable, non exclusive,
|
||||
irrevocable and unconditional license to exercise Affirmer's Copyright and
|
||||
Related Rights in the Work (i) in all territories worldwide, (ii) for the
|
||||
maximum duration provided by applicable law or treaty (including future
|
||||
time extensions), (iii) in any current or future medium and for any number
|
||||
of copies, and (iv) for any purpose whatsoever, including without
|
||||
limitation commercial, advertising or promotional purposes (the
|
||||
"License"). The License shall be deemed effective as of the date CC0 was
|
||||
applied by Affirmer to the Work. Should any part of the License for any
|
||||
reason be judged legally invalid or ineffective under applicable law, such
|
||||
partial invalidity or ineffectiveness shall not invalidate the remainder
|
||||
of the License, and in such case Affirmer hereby affirms that he or she
|
||||
will not (i) exercise any of his or her remaining Copyright and Related
|
||||
Rights in the Work or (ii) assert any associated claims and causes of
|
||||
action with respect to the Work, in either case contrary to Affirmer's
|
||||
express Statement of Purpose.
|
||||
|
||||
4. Limitations and Disclaimers.
|
||||
|
||||
a. No trademark or patent rights held by Affirmer are waived, abandoned,
|
||||
surrendered, licensed or otherwise affected by this document.
|
||||
b. Affirmer offers the Work as-is and makes no representations or
|
||||
warranties of any kind concerning the Work, express, implied,
|
||||
statutory or otherwise, including without limitation warranties of
|
||||
title, merchantability, fitness for a particular purpose, non
|
||||
infringement, or the absence of latent or other defects, accuracy, or
|
||||
the present or absence of errors, whether or not discoverable, all to
|
||||
the greatest extent permissible under applicable law.
|
||||
c. Affirmer disclaims responsibility for clearing rights of other persons
|
||||
that may apply to the Work or any use thereof, including without
|
||||
limitation any person's Copyright and Related Rights in the Work.
|
||||
Further, Affirmer disclaims responsibility for obtaining any necessary
|
||||
consents, permissions or other rights required for any use of the
|
||||
Work.
|
||||
d. Affirmer understands and acknowledges that Creative Commons is not a
|
||||
party to this document and has no duty or obligation with respect to
|
||||
this CC0 or use of the Work.
|
||||
@@ -0,0 +1,256 @@
|
||||
# SPDX-License-Identifier: EUPL-1.2
|
||||
|
||||
EUPL-1.2
|
||||
|
||||
EUROPEAN UNION PUBLIC LICENCE v. 1.2
|
||||
EUPL © the European Union 2007, 2016
|
||||
|
||||
This European Union Public Licence (the 'EUPL') applies to the Work (as defined below) which is provided under the
|
||||
terms of this Licence. Any use of the Work, other than as authorised under this Licence is prohibited (to the extent such
|
||||
a use is covered by a right of the copyright holder of the Work).
|
||||
|
||||
The Work is provided under the terms of this Licence when the Licensor (as defined below) has placed the following
|
||||
notice immediately following the copyright notice for the Work:
|
||||
|
||||
Licensed under the EUPL
|
||||
|
||||
or has expressed by any other means his willingness to license under the EUPL.
|
||||
|
||||
1.Definitions
|
||||
|
||||
In this Licence, the following terms have the following meaning:
|
||||
|
||||
— 'The Licence':this Licence.
|
||||
|
||||
— 'The Original Work':the work or software distributed or communicated by the Licensor under this Licence, available
|
||||
as Source Code and also as Executable Code as the case may be.
|
||||
|
||||
— 'Derivative Works':the works or software that could be created by the Licensee, based upon the Original Work or
|
||||
modifications thereof. This Licence does not define the extent of modification or dependence on the Original Work
|
||||
required in order to classify a work as a Derivative Work; this extent is determined by copyright law applicable in
|
||||
the country mentioned in Article 15.
|
||||
|
||||
— 'The Work':the Original Work or its Derivative Works.
|
||||
|
||||
— 'The Source Code':the human-readable form of the Work, which is the most convenient for people to study and
|
||||
modify.
|
||||
|
||||
— 'The Executable Code':any code, which has generally been compiled and, which is meant to be interpreted by
|
||||
a computer as a program.
|
||||
|
||||
— 'The Licensor':the natural or legal person that distributes or communicates the Work under the Licence.
|
||||
|
||||
— 'Contributor(s)':any natural or legal person who modifies the Work under the Licence, or otherwise contributes to
|
||||
the creation of a Derivative Work.
|
||||
|
||||
— 'The Licensee' or 'You':any natural or legal person who makes any usage of the Work under the terms of the
|
||||
Licence.
|
||||
|
||||
— 'Distribution' or 'Communication':any act of selling, giving, lending, renting, distributing, communicating,
|
||||
transmitting, or otherwise making available, online, or offline, copies of the Work or providing access to its essential
|
||||
functionalities at the disposal of any other natural or legal person.
|
||||
|
||||
2.Scope of the rights granted by the Licence
|
||||
|
||||
The Licensor hereby grants You a worldwide, royalty-free, non-exclusive, sublicensable licence to do the following, for
|
||||
the duration of copyright vested in the Original Work:
|
||||
|
||||
— use the Work in any circumstances and for all usage,
|
||||
|
||||
— reproduce the Work,
|
||||
|
||||
— modify the Work and make Derivative Works based upon the Work,
|
||||
|
||||
— communicate to the public, including the right to make available or display the Work or copies thereof to the public
|
||||
and perform publicly, as the case may be, the Work,
|
||||
|
||||
— distribute the Work or copies thereof,
|
||||
|
||||
— lend and rent the Work or copies thereof,
|
||||
|
||||
— sublicense rights in the Work or copies thereof.
|
||||
|
||||
Those rights can be exercised on any media, supports, and formats, whether now known or later invented, as far as the
|
||||
applicable law permits so.
|
||||
|
||||
In the countries where moral rights apply, the Licensor waives his right to exercise his moral right to the extent allowed
|
||||
by law in order to make effective the licence of the economic rights here above listed.
|
||||
|
||||
The Licensor grants to the Licensee royalty-free, non-exclusive usage rights to any patents held by the Licensor, to the
|
||||
extent necessary to make use of the rights granted on the Work under this Licence.
|
||||
|
||||
3.Communication of the Source Code
|
||||
|
||||
The Licensor may provide the Work either in its Source Code form or as Executable Code. If the Work is provided as
|
||||
Executable Code, the Licensor provides in addition a machine-readable copy of the Source Code of the Work along with
|
||||
each copy of the Work that the Licensor distributes or indicates, in a notice following the copyright notice attached to
|
||||
the Work, a repository where the Source Code is easily and freely accessible for as long as the Licensor continues to
|
||||
distribute or communicate the Work.
|
||||
|
||||
4.Limitations on copyright
|
||||
|
||||
Nothing in this Licence is intended to deprive the Licensee of the benefits from any exception or limitation to the
|
||||
exclusive rights of the rights owners in the Work, to the exhaustion of those rights or of other applicable limitations
|
||||
thereto.
|
||||
|
||||
5.Obligations of the Licensee
|
||||
|
||||
The grant of the rights mentioned above is subject to some restrictions and obligations imposed on the Licensee. Those
|
||||
obligations are the following:
|
||||
|
||||
Attribution right: The Licensee shall keep intact all copyright, patent or trademarks notices and all notices that refer to
|
||||
the Licence and to the disclaimer of warranties. The Licensee must include a copy of such notices, and a copy of the
|
||||
Licence with every copy of the Work he/she distributes or communicates. The Licensee must cause any Derivative Work
|
||||
to carry prominent notices stating that the Work has been modified and the date of modification.
|
||||
|
||||
Copyleft clause: If the Licensee distributes or communicates copies of the Original Works or Derivative Works, this
|
||||
Distribution or Communication will be done under the terms of this Licence or of a later version of this Licence unless
|
||||
the Original Work is expressly distributed only under this version of the Licence — for example, by communicating
|
||||
'EUPL v. 1.2 only'. The Licensee (becoming Licensor) cannot offer or impose any additional terms or conditions on the
|
||||
Work or Derivative Work that alter or restrict the terms of the Licence.
|
||||
|
||||
Compatibility clause: If the Licensee Distributes or Communicates Derivative Works or copies thereof based upon both
|
||||
the Work and another work licensed under a Compatible Licence, this Distribution or Communication can be done
|
||||
under the terms of this Compatible Licence. For the sake of this clause, 'Compatible Licence' refers to the licences listed
|
||||
in the appendix attached to this Licence. Should the Licensee's obligations under the Compatible Licence conflict with
|
||||
his/her obligations under this Licence, the obligations of the Compatible Licence shall prevail.
|
||||
|
||||
The provision of Source Code: When distributing or communicating copies of the Work, the Licensee will provide
|
||||
a machine-readable copy of the Source Code or indicate a repository where this Source will be easily and freely available
|
||||
for as long as the Licensee continues to distribute or communicate the Work.
|
||||
Legal Protection: This Licence does not grant permission to use the trade names, trademarks, service marks, or names
|
||||
of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and
|
||||
reproducing the content of the copyright notice.
|
||||
|
||||
6.Chain of Authorship
|
||||
|
||||
The original Licensor warrants that the copyright in the Original Work granted hereunder is owned by him/her or
|
||||
licensed to him/her and that he/she has the power and authority to grant the Licence.
|
||||
|
||||
Each Contributor warrants that the copyright in the modifications he/she brings to the Work is owned by him/her or
|
||||
licensed to him/her and that he/she has the power and authority to grant the Licence.
|
||||
|
||||
Each time You accept the Licence, the original Licensor and subsequent Contributors grant You a licence to their contributions
|
||||
to the Work, under the terms of this Licence.
|
||||
|
||||
7.Disclaimer of Warranty
|
||||
|
||||
The Work is a work in progress, which is continuously improved by numerous Contributors. It is not finished work
|
||||
and may therefore contain defects or 'bugs' inherent to this type of development.
|
||||
|
||||
For the above reason, the Work is provided under the Licence on an 'as is' basis and without warranties of any kind
|
||||
concerning the Work, including without limitation merchantability, fitness for a particular purpose, absence of defects or
|
||||
errors, accuracy, non-infringement of intellectual property rights other than copyright as stated in Article 6 of this
|
||||
Licence.
|
||||
|
||||
This disclaimer of warranty is an essential part of the Licence and a condition for the grant of any rights to the Work.
|
||||
|
||||
8.Disclaimer of Liability
|
||||
|
||||
Except in the cases of wilful misconduct or damages directly caused to natural persons, the Licensor will in no event be
|
||||
liable for any direct or indirect, material or moral, damages of any kind, arising out of the Licence or of the use of the
|
||||
Work, including without limitation, damages for loss of goodwill, work stoppage, computer failure or malfunction, loss
|
||||
of data, or any commercial damage, even if the Licensor has been advised of the possibility of such damage. However,
|
||||
the Licensor will be liable under statutory product liability laws as far as such laws apply to the Work.
|
||||
|
||||
9.Additional agreements
|
||||
|
||||
While distributing the Work, You may choose to conclude an additional agreement, defining obligations or services
|
||||
consistent with this Licence. However, if accepting obligations, You may act only on your own behalf and on your sole
|
||||
responsibility, not on behalf of the original Licensor or any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against such a Contributor by
|
||||
the fact You have accepted any warranty or additional liability.
|
||||
|
||||
10.Acceptance of the Licence
|
||||
|
||||
The provisions of this Licence can be accepted by clicking on an icon 'I agree' placed under the bottom of a window
|
||||
displaying the text of this Licence or by affirming consent in any other similar way, in accordance with the rules of
|
||||
applicable law. Clicking on that icon indicates your clear and irrevocable acceptance of this Licence and all of its terms
|
||||
and conditions.
|
||||
|
||||
Similarly, you irrevocably accept this Licence and all of its terms and conditions by exercising any rights granted to You
|
||||
by Article 2 of this Licence, such as the use of the Work, the creation by You of a Derivative Work or the Distribution
|
||||
or Communication by You of the Work or copies thereof.
|
||||
|
||||
11.Information to the public
|
||||
|
||||
In case of any Distribution or Communication of the Work by means of electronic communication by You (for example,
|
||||
by offering to download the Work from a remote location) the distribution channel or media (for example, a website)
|
||||
must at least provide to the public the information requested by the applicable law regarding the Licensor, the Licence,
|
||||
and the way it may be accessible, concluded, stored, and reproduced by the Licensee.
|
||||
|
||||
12.Termination of the Licence
|
||||
|
||||
The Licence and the rights granted hereunder will terminate automatically upon any breach by the Licensee of the terms
|
||||
of the Licence.
|
||||
|
||||
Such a termination will not terminate the licences of any person who has received the Work from the Licensee under
|
||||
the Licence, provided such persons remain in full compliance with the Licence.
|
||||
|
||||
13.Miscellaneous
|
||||
|
||||
Without prejudice of Article 9 above, the Licence represents the complete agreement between the Parties as to the
|
||||
Work.
|
||||
|
||||
If any provision of the Licence is invalid or unenforceable under applicable law, this will not affect the validity or
|
||||
enforceability of the Licence as a whole. Such provision will be construed or reformed so as necessary to make it valid
|
||||
and enforceable.
|
||||
|
||||
The European Commission may publish other linguistic versions or new versions of this Licence or updated versions of
|
||||
the Appendix, so far this is required and reasonable, without reducing the scope of the rights granted by the Licence.
|
||||
New versions of the Licence will be published with a unique version number.
|
||||
|
||||
All linguistic versions of this Licence, approved by the European Commission, have identical value. Parties can take
|
||||
advantage of the linguistic version of their choice.
|
||||
|
||||
14.Jurisdiction
|
||||
|
||||
Without prejudice to specific agreement between parties,
|
||||
|
||||
— any litigation resulting from the interpretation of this License, arising between the European Union institutions,
|
||||
bodies, offices, or agencies, as a Licensor, and any Licensee, will be subject to the jurisdiction of the Court of Justice
|
||||
of the European Union, as laid down in article 272 of the Treaty on the Functioning of the European Union,
|
||||
|
||||
— any litigation arising between other parties and resulting from the interpretation of this License will be subject to
|
||||
the exclusive jurisdiction of the competent court where the Licensor resides or conducts its primary business.
|
||||
|
||||
15.Applicable Law
|
||||
|
||||
Without prejudice to specific agreement between parties,
|
||||
|
||||
— this Licence shall be governed by the law of the European Union Member State where the Licensor has his seat,
|
||||
resides, or has his registered office
|
||||
|
||||
— this licence shall be governed by Belgian law if the Licensor has no seat, residence, or registered office inside
|
||||
a European Union Member State.
|
||||
|
||||
|
||||
Appendix
|
||||
|
||||
'Compatible Licences' according to Article 5 EUPL are:
|
||||
|
||||
— GNU General Public License (GPL) v. 2, v. 3
|
||||
|
||||
— GNU Affero General Public License (AGPL) v. 3
|
||||
|
||||
— Open Software License (OSL) v. 2.1, v. 3.0
|
||||
|
||||
— Eclipse Public License (EPL) v. 1.0
|
||||
|
||||
— CeCILL v. 2.0, v. 2.1
|
||||
|
||||
— Mozilla Public Licence (MPL) v. 2
|
||||
|
||||
— GNU Lesser General Public Licence (LGPL) v. 2.1, v. 3
|
||||
|
||||
— Creative Commons Attribution-ShareAlike v. 3.0 Unported (CC BY-SA 3.0) for works other than software
|
||||
|
||||
— European Union Public Licence (EUPL) v. 1.1, v. 1.2
|
||||
|
||||
— Québec Free and Open-Source Licence — Reciprocity (LiLiQ-R) or Strong Reciprocity (LiLiQ-R+).
|
||||
|
||||
The European Commission may update this Appendix to later versions of the above licences without producing
|
||||
a new version of the EUPL, as long as they provide the rights granted in Article 2 of this Licence and protect the
|
||||
covered Source Code from exclusive appropriation.
|
||||
|
||||
All other changes or additions to this Appendix require the production of a new EUPL version.
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 179 KiB |
@@ -0,0 +1,155 @@
|
||||
// SPDX-Version: 3.0
|
||||
// SPDX-CreationInfo: 2025-06-03; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
// SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
|
||||
// SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
// SPDX-FileCopyrightText: 2024–2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
// SPDX-FileType: SOURCE
|
||||
// SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
// SPDX-Comment: This file is part of the CISS.debian.installer.secure framework.
|
||||
// SPDX-PackageName: CISS.debian.live.builder
|
||||
// SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
digraph CISS_debian_live_builder {
|
||||
// -----------------------------
|
||||
// General settings
|
||||
// -----------------------------
|
||||
graph [
|
||||
fontsize=10,
|
||||
splines=ortho,
|
||||
rankdir=LR,
|
||||
nodesep=0.6,
|
||||
ranksep=0.8
|
||||
];
|
||||
node [fontname="Helvetica"];
|
||||
|
||||
// -----------------------------
|
||||
// KNOTS: Internet clouds (NOT in a cluster)
|
||||
// -----------------------------
|
||||
InternetLeft [shape=oval, style=filled, fillcolor=lightblue, label="Internet"];
|
||||
InternetTLS [shape=oval, style=filled, fillcolor=lightblue, label="TLS/HTTPS"];
|
||||
|
||||
// -----------------------------
|
||||
// KNOTS: Jump Host (integrated into cluster_overall)
|
||||
// -----------------------------
|
||||
Jump_Host [shape=diamond, style=filled, fillcolor=green, label="Jump Host"];
|
||||
|
||||
// -----------------------------
|
||||
// KNOTS: Hidden master (in cluster_hm)
|
||||
// -----------------------------
|
||||
Hidden_Master [shape=cylinder, style=filled, fillcolor=lavender, label="Hidden-Master"];
|
||||
|
||||
// -----------------------------
|
||||
// KNOTS: Nameserver (in cluster_ns)
|
||||
// -----------------------------
|
||||
ns00 [shape=cylinder, style=filled, fillcolor=lightyellow, label="ns00.eddns.eu"];
|
||||
ns01 [shape=cylinder, style=filled, fillcolor=lightyellow, label="ns01.eddns.eu"];
|
||||
ns02 [shape=cylinder, style=filled, fillcolor=lightyellow, label="ns02.eddns.de"];
|
||||
ns03 [shape=cylinder, style=filled, fillcolor=lightyellow, label="ns03.eddns.de"];
|
||||
ns_anchor [shape=point, style=invis, width=0]; // unsichtbarer Anker für DNSSEC-Pfeile
|
||||
|
||||
// -----------------------------
|
||||
// KNOTS: B-Server (in cluster_B_small & cluster_B_big)
|
||||
// -----------------------------
|
||||
git [shape=cylinder, style=filled, fillcolor="#FFCCCC", label="git.coresecret.dev"];
|
||||
run [shape=cylinder, style=filled, fillcolor="#FFCCCC", label="run.coresecret.dev"];
|
||||
lab [shape=cylinder, style=filled, fillcolor="#FFCCCC", label="lab.coresecret.dev"];
|
||||
b_small_anchor [shape=point, style=invis, width=0]; // Anker für kleines B-Cluster
|
||||
b_big_anchor [shape=point, style=invis, width=0]; // Anker für großes B-Cluster
|
||||
|
||||
// -----------------------------
|
||||
// KNOTS: "cloud.e2ee.li" (in cluster_cloud)
|
||||
// -----------------------------
|
||||
cloud [shape=cylinder, style=filled, fillcolor="#FFCCCC", label="cloud.e2ee.li"];
|
||||
cloud_anchor [shape=point, style=invis, width=0]; // Anker für cloud-Cluster
|
||||
|
||||
// -----------------------------
|
||||
// CLUSTER: Entire system (except Internet clouds)
|
||||
// -----------------------------
|
||||
subgraph cluster_overall {
|
||||
label="SSH-Pub-Key, 2FA, No-Root-Login, aes256-gcm@openssh.com, (No ChaCha) only";
|
||||
style=solid;
|
||||
color=red;
|
||||
|
||||
// ---- Integrate jump host into outer rectangle ----
|
||||
Jump_Host;
|
||||
|
||||
// ---- Cluster: name server group ----
|
||||
subgraph cluster_ns {
|
||||
label="";
|
||||
style=dashed;
|
||||
color=red;
|
||||
ns00;
|
||||
ns01;
|
||||
ns02;
|
||||
ns03;
|
||||
ns_anchor;
|
||||
}
|
||||
|
||||
// ---- Cluster: Hidden-Master ----
|
||||
subgraph cluster_hm {
|
||||
label="";
|
||||
style=dashed;
|
||||
color=red;
|
||||
Hidden_Master;
|
||||
}
|
||||
|
||||
// ---- Cluster: TLS/HTTPS group (contains B-Cluster and cloud) ----
|
||||
subgraph cluster_tls_group {
|
||||
label="TLSv1.2 || TLSv1.3 ECDHE-RSA-AES256-GCM-SHA384 ECDH 448 AESGCM 256 & ECDHE-RSA-CHACHA20-POLY1305 ECDH 448 ChaCha20 256";
|
||||
style=dashed;
|
||||
color=red;
|
||||
|
||||
// ---- Cluster: Outer rectangle around all B nodes (lab + small rectangle) ----
|
||||
subgraph cluster_B_big {
|
||||
label="";
|
||||
style=dashed;
|
||||
color=red;
|
||||
lab;
|
||||
b_big_anchor;
|
||||
|
||||
// ---- Cluster: B a) and c) (small rectangle around git and run) ----
|
||||
subgraph cluster_B_small {
|
||||
label="";
|
||||
style=dashed;
|
||||
color=red;
|
||||
git;
|
||||
run;
|
||||
b_small_anchor;
|
||||
}
|
||||
}
|
||||
|
||||
// ---- Cluster: "cloud.e2ee.li" ----
|
||||
subgraph cluster_cloud {
|
||||
label="HA: LVM on RAID6 on dm-crypt incl. dm-integrity";
|
||||
style=dashed;
|
||||
color=red;
|
||||
cloud;
|
||||
cloud_anchor;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// -----------------------------
|
||||
// EDGES
|
||||
// -----------------------------
|
||||
// Left: Internet → Jump Host
|
||||
InternetLeft -> Jump_Host [color=green];
|
||||
|
||||
// Jump Host → Hidden-Master
|
||||
Jump_Host -> Hidden_Master [color=green];
|
||||
|
||||
// Hidden-Master → Name servers (each green with the label “HMAC SHA512”)
|
||||
Hidden_Master -> ns00 [color=green, label="HMAC SHA512"];
|
||||
Hidden_Master -> ns01 [color=green, label="HMAC SHA512"];
|
||||
Hidden_Master -> ns02 [color=green, label="HMAC SHA512"];
|
||||
Hidden_Master -> ns03 [color=green, label="HMAC SHA512"];
|
||||
|
||||
// Red arrows “DNSSEC” from name server cluster (ns_anchor) → B cluster (b_big_anchor)
|
||||
ns_anchor -> b_big_anchor [color=red, label="DNSSEC"];
|
||||
// Red arrow “DNSSEC” from nameserver cluster (ns_anchor) → cloud cluster (cloud_anchor)
|
||||
ns_anchor -> cloud_anchor [color=red, label="DNSSEC"];
|
||||
|
||||
// Red arrows from TLS Internet → B-Cluster and cloud
|
||||
InternetTLS -> b_big_anchor [color=red];
|
||||
InternetTLS -> cloud_anchor [color=red];
|
||||
}
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 107 KiB |
Reference in New Issue
Block a user