Improve security of TLS/SSL connections by increasing bit size of Diffie-Hellman parameters

Diffie–Hellman key exchange is the secure method that keys are exchanged at the initial TLS/SSL connection; e.g. a HTTPS connection between a web browser and a web server. It is an important component to maximising forward secrecy.

By default, v16.0+ TurnKey Linux servers generate a Diffie–Hellman parameters file with a bit size of 1024 on firstboot. That should be sufficient to protect against most FREAK and/or Logjam attacks. However, as noted in RFC 8270:

[...] the minimum value of 1024 bits is insufficient to protect against state-sponsored actors and any organization with enough computing resources [...]

TurnKey default to 1024 bits; 2048+ bits recommended

As such, to ensure protection from attack by highly resourced attackers (e.g. a nation-state) a minimum of 2048 bits is recommended. Generating a DH group of 2048 (or higher) is particularly CPU intensive and can take a long time; especially on a low spec Cloud server, VPS or low spec hardware. Hence why we default to using 1024 bits (rather than the recommended 2048).

However, a new Diffie-Hellman group of 2048 bits can be generated fairly easily (you'll just need to be a bit patient). If you are particularly concerned about the security of your connection then a bit size of 4096 is even better, but it will likely take hours, perhaps even days if running on low spec hardware.

Regenerate dhparams file

You can easily regenerate the Diffie-Hellman parameters file (/etc/ssl/private/dhparams.pem by default) for self signed TLS/SSL certificates, or Let's Encrypt certificates that have been generated via the Confconsole Let's Encrypt plugin. It can be done via the Confconsole DH parameters regeneration plugin. Or can be done via commandline.

Please note that if you are using some other method to include or generate your SSL/TLS certificate(s)/key(s) then hopefully you know what to do and how to do it! If you're unsure, please feel free to ask in the forums. Please document how your SSL/TLS certs are set up.

The Confconsole plugin defaults to running it in a dtach session. But if you are doing it via commandline (unless you are connecting via a physical terminal), it's best to generate the new file within a dtach (or screen or tmux) session explicitly. If you do that, then even if your SSH session gets disconnected, the process will complete. For example; to generate a new Diffie-Hellman parameters file of 2048 bits within a dtach session:

dtach -c /tmp/regen-dhparams turnkey-make-ssl-cert --dh-params-only --dh-bits 2048

By default, that will open a new dtach session and run the turnkey-make-ssl-cert command. If you wish to disconnect you can close the SSH session and the command will continue to run. Alternatively, you can exit out of the dtach session with <Ctrl><\> (double check that your SSH client passes that key combo through). If you wish to reattach to the session (likely it will just be a blank screen, unless it's finished) then do that like this:

dtach -a /tmp/regen-dhparams

Restart services

Once that is complete, you'll also need to restart the webservices that are using the DH params file. E.g. to restart Apache and Stunnel for both Webmin and Webshell:

systemctl restart apache2
systemctl restart stunnel4@webmin
systemctl restart stunnel4@shellinabox

If you're not 100% sure which service(s) you need to restart and want to be on the safe side, then a reboot is a good option.