According to this article on itsfoss.com nftables should replace iptables after updating from 20.04 to 20.10. In my case not only is iptables still installed, but also nftables is missing.
Does it imply that the update process has failed and there might be other components missing? Is it much of an issue from security point of view?
I'd like to ask if there's a way to lower SSL security level to 1 on Ubuntu 20.04, since I'm receiving:
141A318A:SSL routines:tls_process_ske_dhe:dh key too small
when trying to curl the website.
Curl works if I add --ciphers 'DEFAULT:!DH' parameter, however, I am not able to fetch a website via my client app written in C#. The website also works when opened via browser.
According to bugs.launchpad.net the Ubuntu team set higher SSL security level on purpose.
In several places I came across an information that changing CipherString = DEFAULT@SECLEVEL=2 to 1 in openssl.cnf helps, but my config file did not have such a line at all and adding it had no effect.
I do not control the website server, so I am not able to change its security configuration.
Any ideas? Would installing some older openSSL package help?
Thanks in advance
EDIT: As for changes to my config file, I've added the following at the end:
system_default = system_default_sect
[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=1
Output from openssl version -a:
OpenSSL 1.1.1f 31 Mar 2020 built on: Mon Apr 20 11:53:50 2020 UTC
platform: debian-amd64
options: bn(64,64) rc4(16x,int) des(int) blowfish(ptr)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -Wa,
--noexecstack -g -O2 -fdebug-prefix-map=/build/openssl-P_ODHM/openssl-1.1.1f=.
-fstack-protector-strong -Wformat -Werror=format-security
-DOPENSSL_TLS_SECURITY_LEVEL=2 -DOPENSSL_USE_NODELETE
-DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ
-DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT
-DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m
-DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM
-DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM
-DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG
-Wdate-time -D_FORTIFY_SOURCE=2
OPENSSLDIR: "/usr/lib/ssl" ENGINESDIR:
"/usr/lib/x86_64-linux-gnu/engines-1.1" Seeding source: os-specific