[ACCUMULO-3317] Change Jetty configuration to disallow SSLv3

• Type: Sub-task
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 1.5.0, 1.5.1, 1.5.2, 1.6.0, 1.6.1
• Fix Version/s: 1.5.3, 1.6.2, 1.7.0
• Component/s: monitor
• Assignee: Josh Elser
• Reporter: Sean Busbey
• Created: 07/Nov/14 18:19
• Updated: 12/Nov/14 22:25
• Resolved: 07/Nov/14 23:32

Description

Any Jetty use should disallow SSLv3, e.g. the Monitor.

Notes from thread:

Jetty:
http://stackoverflow.com/questions/26382540/how-to-disable-the-sslv3-protocol-in-jetty-to-prevent-poodle-attack

Testing the monitor for SSLv3 downgrade, given host monitor.example.com on port 12345

curl -vvv --sslv3 https://monitor.example.com:12345/