Using Elastic Load Balancing / Eucalyptus Load Balancing Usage Examples
Parent topic: Eucalyptus Load Balancing Usage Examples

Adding and Editing Predefined Security Policies

This topic describes how to add and edit ELB security policies.

Default ELB policies are stored as JSON files in the /etc/eucalyptus/cloud.d/elb-security-policy directory. You can add or edit policy files here, and the changes will take effect when the CLC is restarted.

  1. Copy one of the ELB policy files to a new file and edit the file. You must change the PolicyName attribute to a new name, with the name ending in a date. For example:
    ELBSecurityPolicy-2015-09
    The policy file with the most recent date appended to the name will be used as the default policy when users create HTTPS/SSL listeners.
    The following is an example of an ELB policy file. You can modify this file and save it with a new filename in the /etc/eucalyptus/cloud.d/elb-security-policy directory. 
    {
    "PolicyAttributeDescriptions": [
        {
            "AttributeName": "Protocol-SSLv2",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "Protocol-TLSv1",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "Protocol-SSLv3",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "Protocol-TLSv1.1",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "Protocol-TLSv1.2",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "Server-Defined-Cipher-Order",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "ECDHE-ECDSA-AES128-GCM-SHA256",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "ECDHE-RSA-AES128-GCM-SHA256",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "ECDHE-ECDSA-AES128-SHA256",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "ECDHE-RSA-AES128-SHA256",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "ECDHE-ECDSA-AES128-SHA",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "ECDHE-RSA-AES128-SHA",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "DHE-RSA-AES128-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "ECDHE-ECDSA-AES256-GCM-SHA384",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "ECDHE-RSA-AES256-GCM-SHA384",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "ECDHE-ECDSA-AES256-SHA384",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "ECDHE-RSA-AES256-SHA384",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "ECDHE-RSA-AES256-SHA",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "ECDHE-ECDSA-AES256-SHA",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "AES128-GCM-SHA256",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "AES128-SHA256",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "AES128-SHA",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "AES256-GCM-SHA384",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "AES256-SHA256",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "AES256-SHA",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "DHE-DSS-AES128-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "CAMELLIA128-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "EDH-RSA-DES-CBC3-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DES-CBC3-SHA",
            "AttributeValue": "true"
        },
        {
            "AttributeName": "ECDHE-RSA-RC4-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "RC4-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "ECDHE-ECDSA-RC4-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DHE-DSS-AES256-GCM-SHA384",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DHE-RSA-AES256-GCM-SHA384",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DHE-RSA-AES256-SHA256",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DHE-DSS-AES256-SHA256",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DHE-RSA-AES256-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DHE-DSS-AES256-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DHE-RSA-CAMELLIA256-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DHE-DSS-CAMELLIA256-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "CAMELLIA256-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "EDH-DSS-DES-CBC3-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DHE-DSS-AES128-GCM-SHA256",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DHE-RSA-AES128-GCM-SHA256",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DHE-RSA-AES128-SHA256",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DHE-DSS-AES128-SHA256",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DHE-RSA-CAMELLIA128-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DHE-DSS-CAMELLIA128-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "ADH-AES128-GCM-SHA256",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "ADH-AES128-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "ADH-AES128-SHA256",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "ADH-AES256-GCM-SHA384",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "ADH-AES256-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "ADH-AES256-SHA256",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "ADH-CAMELLIA128-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "ADH-CAMELLIA256-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "ADH-DES-CBC3-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "ADH-DES-CBC-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "ADH-RC4-MD5",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "ADH-SEED-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DES-CBC-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DHE-DSS-SEED-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DHE-RSA-SEED-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "EDH-DSS-DES-CBC-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "EDH-RSA-DES-CBC-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "IDEA-CBC-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "RC4-MD5",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "SEED-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DES-CBC3-MD5",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "DES-CBC-MD5",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "RC2-CBC-MD5",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "PSK-AES256-CBC-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "PSK-3DES-EDE-CBC-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "KRB5-DES-CBC3-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "KRB5-DES-CBC3-MD5",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "PSK-AES128-CBC-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "PSK-RC4-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "KRB5-RC4-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "KRB5-RC4-MD5",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "KRB5-DES-CBC-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "KRB5-DES-CBC-MD5",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "EXP-EDH-RSA-DES-CBC-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "EXP-EDH-DSS-DES-CBC-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "EXP-ADH-DES-CBC-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "EXP-DES-CBC-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "EXP-RC2-CBC-MD5",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "EXP-KRB5-RC2-CBC-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "EXP-KRB5-DES-CBC-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "EXP-KRB5-RC2-CBC-MD5",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "EXP-KRB5-DES-CBC-MD5",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "EXP-ADH-RC4-MD5",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "EXP-RC4-MD5",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "EXP-KRB5-RC4-SHA",
            "AttributeValue": "false"
        },
        {
            "AttributeName": "EXP-KRB5-RC4-MD5",
            "AttributeValue": "false"
        }
    ],
    "PolicyName": "ELBSecurityPolicy-2015-05",
    "PolicyTypeName": "SSLNegotiationPolicyType"
}
  2. Using a text editor, change the PolicyName attribute. For example:
    "PolicyName": "ELBSecurityPolicy-2015-05"
  3. Once you've edited and saved the JSON file, restart the CLC.
  4. Once the CLC has restarted, use the eulb-describe-lb-policies command to verify that your new policy is listed.
    For example:

    POLICY	ELBSample-AppCookieStickinessPolicy	AppCookieStickinessPolicyType
POLICY	ELBSample-LBCookieStickinessPolicy	LBCookieStickinessPolicyType
POLICY	ELBSecurityPolicy-2014-10	SSLNegotiationPolicyType
POLICY	ELBSecurityPolicy-2015-02	SSLNegotiationPolicyType
POLICY	ELBSecurityPolicy-2011-08	SSLNegotiationPolicyType
POLICY	ELBSecurityPolicy-2015-05	SSLNegotiationPolicyType
POLICY	ELBSecurityPolicy-2014-01	SSLNegotiationPolicyType
POLICY	MyNewELBSecurityPolicy-2015-09	SSLNegotiationPolicyType
You can now use your new security policy using the eulb-create-lb-policy command. For more information, see Updating the SSL Negotiation Configuration.
Parent topic: Eucalyptus Load Balancing Usage Examples
Copyright: © 2018 Eucalyptus Cloud
x