secureserver

README

Go secureserver

Out-of-the-box, Go is a fully capable HTTP/HTTPS server. However, it is not configured correctly to avoid malicious clients, timeouts, or even simple SSL auto setup with LetsEncrypt.org.

This repository exists to help go developers launch a secure, simple HTTPS server.

This configuration blocks major attacks like:

• BEAST attack
• POODLE (SSLv3)
• POODLE (TLS)
• Heartbleed
• CRIME
• FUBAR
• OpenSSL CCS vulnerability (CVE-2014-0224)
• OpenSSL Padding Oracle vulnerability

Achieving forward secrecy and low server load are a focus.

Reading

• https://blog.bracebin.com/achieving-perfect-ssl-labs-score-with-go
• https://blog.gopheracademy.com/advent-2016/exposing-go-on-the-internet/
• https://blog.cloudflare.com/the-complete-guide-to-golang-net-http-timeouts/
• https://cipherli.st/
• https://wiki.mozilla.org/Security/Server_Side_TLS

Install

go get github.com/xeoncross/secureserver

Demo Server

You can quickly run a test HTTP/HTTPS server like so:

package main

import (
  "github.com/xeoncross/secureserver"
)

func main() {
  domain := "example.com"
  HSTS := false // enable/disable HSTS
  secureserver.RunHTTPRedirectServer()
  secureserver.RunDemoHTTPSServer(domain, HSTS) // blocks
}

Usage

package main

import (
  "github.com/xeoncross/secureserver"
)

func main() {
  domain := "example.com"
  secureserver.RunHTTPRedirectServer()
  s := secureserver.GetHTTPSServer(domain)

  mux := http.NewServeMux()
  mux.HandleFunc("/", func(w http.ResponseWriter, req *http.Request) {
    w.Header().Add("Strict-Transport-Security", "max-age=63072000; includeSubDomains")
    w.Write([]byte("This is an example server on " + domain + ".\n"))
  })

  s.Handler = mux

  log.Fatal(s.ListenAndServeTLS("", ""))
}

Todo

• Implement support for graceful shutdown

Contributions Required

To serve a source of information about current Go best-practices; pull requests, issues, and documentation are welcome.

Documentation

Index

• Variables
• func GetCertificate(domain string) autocert.Manager
• func GetHTTPSServer(domain string) (s *http.Server)
• func RunDemoHTTPSServer(domain string, HSTS bool) (s *http.Server)
• func RunHTTPRedirectServer() (s *http.Server)
• func TLSConfig(domain string) *tls.Config

Variables

var CipherSuites = []uint16{
	tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
	tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
	tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
	tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,

	tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
	tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
}

CipherSuites without known attacks or extreme CPU usage https://golang.org/src/crypto/tls/cipher_suites.go#L75

var Curves = []tls.CurveID{

	tls.CurveP256,
}

Curves without known attacks or extreme CPU usage https://golang.org/src/crypto/tls/common.go#L542

Functions

func GetCertificate

func GetCertificate(domain string) autocert.Manager

GetCertificate using autocert

func GetHTTPSServer

func GetHTTPSServer(domain string) (s *http.Server)

GetHTTPSServer fully secured

func RunDemoHTTPSServer

func RunDemoHTTPSServer(domain string, HSTS bool) (s *http.Server)

RunDemoHTTPSServer to demo a working example

func RunHTTPRedirectServer

func RunHTTPRedirectServer() (s *http.Server)

RunHTTPRedirectServer to send all HTTP traffic to HTTPS

func TLSConfig

func TLSConfig(domain string) *tls.Config

TLSConfig for including autocert manager