Certbot Cloudflare DNS Challenge error --dns-cloudflare-credentials

When certbot is showing you the error "certbot: error: unrecognized arguments: --dns-cloudflare-credentials" you might find the following helpful:

Problem

root@linlxc033:~#
root@linlxc033:~# certbot certonly --dns-cloudflare --dns-cloudflare-credentials /root/tls/certbot/cloudflare-api.key --preferred-challenges dns-01 -d "somedomain.com" -d "*.somedomain.com"
usage:
  certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

Certbot can obtain and install HTTPS/TLS/SSL certificates.  By default,
it will attempt to use a webserver both for obtaining and installing the
certificate.
certbot: error: unrecognized arguments: --dns-cloudflare-credentials /root/tls/certbot/cloudflare-api.key
root@linlxc033:~#
root@linlxc033:~#


Solution

Install the required package. This is the solution if you have installed python3-certbot as an apt package:

sudo apt -y install python3-certbot-dns-cloudflare

This is the solution if you have installed certbot as a snap:

sudo snap set certbot trust-plugin-with-root=ok
sudo snap install certbot-dns-cloudflare

Example

root@linlxc033:~#
root@linlxc033:~# sudo apt -y install python3-certbot-dns-cloudflare
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
[...]
root@linlxc033:~#
root@linlxc033:~# sudo snap set certbot trust-plugin-with-root=ok
root@linlxc033:~# sudo snap install certbot-dns-cloudflare
certbot-dns-cloudflare 2.8.0 from Certbot Project (certbot-eff✓) installed
root@linlxc033:~#
root@linlxc033:~#
root@linlxc033:~# certbot certonly --dns-cloudflare --dns-cloudflare-credentials /root/tls/certbot/cloudflare-api.key --preferred-challenges dns-01 -d "somedomain.com" -d "*.somedomain.com"
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for somedomain.com and *.somedomain.com   
Unsafe permissions on credentials configuration file: /root/tls/certbot/cloudflare-api.key
Waiting 10 seconds for DNS changes to propagate

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/somedomain.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/somedomain.com/privkey.pem
This certificate expires on 2024-08-04.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
root@linlxc033:~#
root@linlxc033:~#


Almost perfect protection for websites and other services - Mutual TLS

Its hard to secure your IT services and applications. The list of possible attacks is long, as shown in the Mitre Att&ck framework, the OWASP lists and so on.

What helps drastically reducing the attack surface is to use mutual TLS (explanations see https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/ or https://en.wikipedia.org/wiki/Mutual_authentication#mTLS or https://www.youtube.com/watch?v=x7B5CwcxCDI or https://www.ietf.org/rfc/rfc5246.txt) for authentication to establish access to your service/application. If you use certificates to authenticate your clients before accessing the first byte to of your service/application, you stop attacks at OSI layer 5. The attackers cant reach OSI layer 6 and 7 which  contain the most vulnerabilites and weaknesses by far.

I've asked ChatGPT to make a list to compare regular web applications with web applications, which use mutual TLS:

Attack Type	Regular Web Application	Secured Web Application (Mutual TLS)	Mitre ATT&CK Tactic(s)
Cross-Site Scripting (XSS)	Vulnerable	Protected	Initial Access, Execution, Persistence
SQL Injection	Vulnerable	Protected	Collection, Credential Access, Execution
Cross-Site Request Forgery (CSRF)	Vulnerable	Protected	Initial Access, Collection
Session Hijacking	Vulnerable	Protected	Collection, Credential Access
Brute Force Attacks	Vulnerable	Protected	Credential Access, Execution
Clickjacking	Vulnerable	Protected	Collection, Defense Evasion
Directory Traversal	Vulnerable	Protected	Collection, Exfiltration
File Upload Vulnerabilities	Vulnerable	Protected	Execution, Collection
LDAP Injection	Vulnerable	Protected	Collection, Credential Access
Man-in-the-Middle (MitM) Attacks	Vulnerable	Protected	Collection, Credential Access, Execution
Remote File Inclusion	Vulnerable	Protected	Execution, Collection
XML External Entity (XXE) Injection	Vulnerable	Protected	Collection, Credential Access
Security Misconfigurations	Vulnerable	Way less vulnerable	Defense Evasion, Discovery
HTTP Header Injection	Vulnerable	Protected	Defense Evasion, Execution
DDoS Attacks	Vulnerable	Way less vulnerable	Impact
API Security Issues	Vulnerable	Protected	Collection, Credential Access, Execution
HTTP Parameter Pollution	Vulnerable	Protected	Defense Evasion, Execution
Session Sidejacking	Vulnerable	Protected	Credential Access, Collection
Social Engineering Attacks	Vulnerable	Protected	Collection, Defense Evasion
Cross-Site Tracing (XST)	Vulnerable	Protected	Credential Access, Collection
Fuzzing Attacks	Vulnerable	Protected	Execution, Defense Evasion
Cryptanalysis	Vulnerable	Way less vulnerable	Collection, Credential Access
Reverse Engineering	Vulnerable	Protected	Collection, Credential Access
Subdomain Takeover	Vulnerable	Protected	Initial Access, Collection
Session Token Theft	Vulnerable	Protected	Credential Access, Collection
Vulnerabilies/0days	Vulnerable	Way less vulnerable	Initial Access
Broken Object Level Authorization (BOLA)	Vulnerable	Protected	Credential Access, Authorization
Improper Rate Limiting	Vulnerable	Way less vulnerable	Defense Evasion, Impact
Insecure Direct Object References (IDOR)	Vulnerable	Protected	Collection, Credential Access
Insufficient Logging and Monitoring	Vulnerable	Way less vulnerable	Discovery, Defense Evasion
Insecure Deserialization	Vulnerable	Protected	Execution, Defense Evasion
Lack of Resources and Rate Limiting	Vulnerable	Protected	Defense Evasion, Impact
Mass Assignment	Vulnerable	Protected	Credential Access, Collection
Insecure Cryptographic Storage	Vulnerable	Vulnerable	Collection, Credential Access
Use of Components with Known Vulnerabilities	Vulnerable	Way less vulnerable	Collection, Execution
Unvalidated Redirects and Forwards	Vulnerable	Protected	Defense Evasion, Initial Access
XML External Entity (XXE) Injection	Vulnerable	Protected	Collection, Credential Access

Caution: This is a simplified point of view - it is only focusing on the inital access. Mutual TLS certificate based authentication make the initial access for attackers almost impossible. Therefore most attacks are not possible anymore without the attackers gets his hands on a client certificate with its private key. However your IT stack is still vulnerable to OSI layer 1-5 attacks as well as e.g. to vulnerabilities within OpenSSL, LibreSSL etc.

Decrypt TLS sessions of Chrome & Firefox

How to decrypt TLS Sessions of browsers like Chrome and Firefox without Man-in-the-Middle MitM/Adversary-in-the-Middle AitM (Att&ck T1557) like ARP Cache Poisoning, DNS Spoofing, LLMNR/NBT-NS Poisoning and SMB Relay, DHCP Spoofing, Proxy, burp, PAC, WPAD, etc:

This is a silent way to debug issues. However your EDR/SIEM/logings solution should check for SSLKEYLOGFILE entries in your environment variables because this is a silent way to break TLS without informing the user.

Use the SSLKEYLOGFILE in your environmentvariables of your windows, linux or macos system.

Windows

Simply create an environmentvariable called SSLKEYLOGFILE and set the value of the path to the text-file, in which the TLS private keys should be saved:

Linux

Simply create an environmentvariable called SSLKEYLOGFILE and set the value of the path to the text-file, in which the TLS private keys should be saved:

export SSLKEYLOGFILE=$HOME/tlsprivatekeys.txt

Decrypt TLS sessions with Wireshark

1. Open the wireshark prefecenses
2. Go to TLS 
3. Select your SSLKEYLOGFILE text file as (Pre)-Master-Secret filename as shown in the following screenshot:
   

Apache2 wont start due to missing dhparam.pem

If your apache2 on linux system (in this case ubuntu 20) does not start due to "'dhparam.pem' does not exist or is empty", because you might have changed your letencrypt certbot from http to dns in order to get a wildcard certificate, then the error might look like this:

Example:

user@ubuntu:/etc/apache2/sites-available#
user@ubuntu:/etc/apache2/sites-available# systemctl status apache2.service
● apache2.service - The Apache HTTP Server
     Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Sun 2021-06-01 21:51:33 CET; 13s ago
       Docs: https://httpd.apache.org/docs/2.4/
    Process: 542668 ExecStart=/usr/sbin/apachectl start (code=exited, status=1/FAILURE)

Jun 01 21:51:33 *yourdomain.tld* systemd[1]: Starting The Apache HTTP Server...
Jun 01 21:51:33 *yourdomain.tld* apachectl[542686]: AH00526: Syntax error on line 70 of /etc/apache2/sites-enabled/*yourdomain.tld*.conf:
Jun 01 21:51:33 *yourdomain.tld* apachectl[542686]: SSLOpenSSLConfCmd: file '/etc/letsencrypt/live/*yourdomain.tld*/dhparam.pem' does not exist or is empty
Jun 01 21:51:33 *yourdomain.tld* apachectl[542668]: Action 'start' failed.
Jun 01 21:51:33 *yourdomain.tld* apachectl[542668]: The Apache error log may have more information.
Jun 01 21:51:33 *yourdomain.tld* systemd[1]: apache2.service: Control process exited, code=exited, status=1/FAILURE
Jun 01 21:51:33 *yourdomain.tld* systemd[1]: apache2.service: Failed with result 'exit-code'.
Jun 01 21:51:33 *yourdomain.tld* systemd[1]: Failed to start The Apache HTTP Server.
user@ubuntu:/etc/apache2/sites-available#
user@ubuntu:/etc/apache2/sites-available#

Solution

To solve this issue, you have to create the missing dhparam.pem file. This is used as a Diffie-Hellman group, which is used in negotiating Perfect Forward Secrecy with clients.

sudo openssl dhparam -out /etc/letsencrypt/live/*yourdomain.tld*/dhparam.pem 2048

Example: 

user@ubuntu:/etc/apache2/sites-available#
user@ubuntu:/etc/apache2/sites-available# sudo openssl dhparam -out /etc/apache2/sites-enabled/*yourdomain.tld*/dhparam.pem 2048
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
...................+...........+.............+......
....................................................
.+.............................+....................
....................................................
...........................[...]..................++*
user@ubuntu:/etc/apache2/sites-available#

Monitor Nextclouds API XML via PRTG with Powershell

In order to monitor your Nextcloud API (XML) via PRTG, you can use the following steps: 

https://github.com/flostyen/PRTGScripts/tree/master/PRTG-NextCloud-Status which is a fork of https://github.com/freaky-media/PRTGScripts/blob/master/PRTG-NextCloud-Status/ (I simply added TLSv1.2 support and adjusted the howto guide, all the work was done from freaky-media 😊)

1. Installation in PRTG

1.1 Copy the PS1 File to your PRTG server in the path C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML. If you want to monitoring nextcloud systems from your PRTG remote probes, copy the script to the remote probe.

1.2 Create the following lookup files NextCloudMessageLookup.ovl, NextCloudStatusCodeLookup.ovl, NextCloudStatusLookup.ovl into your PRTG installation folder C:\Program Files (x86)\PRTG Network Monitor\lookups\custom

1.3 Reload Lookups:
PRTG GUI -> Setup -> System Administration -> Administrative Tools -> Load Lookups and File Lists -> Go! Button

2. Configuration in PRTG

2.1 Add the sensor "EXE/Script Advanced"  

2.2 Change the sensor name

2.3 Choose in the powershell script PRTG_NextCloud.ps1.

2.4 Add parameter -NCusername *AnExtraNCAdminUser* -NCpassword *StrongPassSentence* -NCURL *YourNCFQDN*

 Result

 

Hardening FortiGate connection to FortiAnalyzer

The FortiGate uses OFTP (Fortinets proprietary Optimized Fabric Transfer Protocol, not Odette File Transfer Protocol) to transfer data between FortiGates and FortiAnalyzer. For encryption SSLv3 or TLS is used. In order to harden the connection, use the following commands:

Cfg for FortiAnalyzer 

 1. Set TLS to minimum version 1.2:


2. Change FAZ certificate to one using the correct FQDN from your/a public CA:



Debugging can be done using the fowlloing commands:

Oftpd daemon test usage:   diagnose test application oftpd <integer>

• 1: show PID
• 2: show statistics and state
• 3: show connected device name and IP
• 4: show detailed session state
• 5: show oftp request statistics
• 6: show cmdb device cache
• 7: show logfwd thread stats
• 8: show tasklist statistics
• 9: show unreg dev cache
• 10: log cluster bridge stats
• 20: show forticlent end-user stats
• 21: rebuild forticlient end-user avatar table
• 90: reload un-reg device tree
• 99: restart daemon

FAZ looks like this:

(global)# get

dh-params           : 8192

enc-algorithm       : high

fgfm-ssl-protocol   : tlsv1.2

oftp-ssl-protocol   : tlsv1.2

ssl-low-encryption  : disable

ssl-protocol        : tlsv1.2

ssl-static-key-ciphers: disable

webservice-proto    : tlsv1.2

Cfg for FortiGate

1. Change TLS ciphers to high:

config log fortianalyzer setting

    set enc-algorithm high

end

2. Change Global TLS-Settings

config system global

    set ssl-static-key-ciphers disable

    set dh-params 8192

    set strong-crypto enable

end

Which SSL/TLS settings, Algorithms and Methods to use

Recommended Server Encryption Methods

• Hash-Algorithms: SHA3, SHA2-512, SHA2-384, SHA2-256, Poly1305
• Symmetric Encryption Algorithms: AES-GCM-256, AES-GCM-128, ChaCha20
• Key-Exchange-Methods: ECDHE, DHE-4096Bit, Diffie-Hellman group 24 (Modular exponentiation group with a 2048-bit modulus and 256-bit prime order subgroup), 521 bit elliptic curve (DH-Group 21), 384 bit elliptic curve (DH-Group 19), 256 bit elliptic curve (DH-Group 19), DHE-2048Bit (DH-Group 14)
• Certificate-Keys: EC 256Bit, RSA-4096Bit, RSA-2048Bit,
• Certificate Signing: ECDSA, RSA
• Encryption-Protocols: TLS 1.3, TLS 1.2
• Webserver Downgrade attack prevention: TLS_FALLBACK_SCSV, Strict Transport Security (HSTS)
• Password Hashing Algorithms: Argon2, scrypt, bcrypt, PBKDF2

    Source: F5

List of Recommended TLS-Ciphers:

Very secure:

TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)

Secure:

TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f)
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
TLS_RSA_WITH_AES_256_GCM_SHA384 (0x9d)
TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c)
TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d)

High Compatibility but still secure:

TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f)
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
TLS_RSA_WITH_AES_256_GCM_SHA384 (0x9d)
TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c)
TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d)
TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c)
TLS_RSA_WITH_AES_256_CBC_SHA (0x35)
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)