Harden TLS server settings (#1367)

* Lower HTTP timeout settings.

  In an effort to provide a more resilient web server, timeouts are more strictly enforced by the Kolide HTTP server (regardless of whether or not you're using the built-in TLS termination). If your Kolide environment is particularly latent and you observe requests timing out, contact us at [help@kolide.co](mailto:help@kolide.co).

* Harden TLS server settings.

  For customers using Kolide's built-in TLS server (if the `server.tls` configuration is `true`), the server was hardened to only accept modern cipher suites as recommended by [Mozilla](https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility).

CHANGELOG.md

@@ -1,3 +1,11 @@
+* Lower HTTP timeout settings.
+
+  In an effort to provide a more resilient web server, timeouts are more strictly enforced by the Kolide HTTP server (regardless of whether or not you're using the built-in TLS termination). If your Kolide environment is particularly latent and you observe requests timing out, contact us at [help@kolide.co](mailto:help@kolide.co).
+
+* Harden TLS server settings.
+
+  For customers using Kolide's built-in TLS server (if the `server.tls` configuration is `true`), the server was hardened to only accept modern cipher suites as recommended by [Mozilla](https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility).
+
 * Improve the mechanism used to calculate whether or not hosts are online.
 
   Previously, hosts were categorized as "online" if they had been seen within the past 30 minutes. To make the "online" status more representative of reality, hosts are marked "online" if the Kolide server has heard from them within two times the lowest polling interval as described by the Kolide-managed osquery configuration. For example, if you've configured osqueryd to check-in with Kolide every 10 seconds, only hosts that Kolide has heard from within the last 20 seconds will be marked "online".

cli/serve.go

@@ -1,6 +1,7 @@
 package cli
 
 import (
+	"crypto/tls"
 	"net/http"
 	"os"
 	"os/signal"
@@ -156,8 +157,13 @@ the way that the kolide server works.
 			r.Handle("/", frontendHandler)
 
 			srv := &http.Server{
-				Addr:    config.Server.Address,
-				Handler: r,
+				Addr:              config.Server.Address,
+				Handler:           r,
+				ReadTimeout:       25 * time.Second,
+				WriteTimeout:      40 * time.Second,
+				ReadHeaderTimeout: 5 * time.Second,
+				IdleTimeout:       5 * time.Minute,
+				MaxHeaderBytes:    1 << 18, // 0.25 MB (262144 bytes)
 			}
 			errs := make(chan error, 2)
 			go func() {
@@ -166,6 +172,25 @@ the way that the kolide server works.
 					errs <- srv.ListenAndServe()
 				} else {
 					logger.Log("transport", "https", "address", config.Server.Address, "msg", "listening")
+					srv.TLSConfig = &tls.Config{
+						// Causes servers to use Go's default ciphersuite preferences,
+						// which are tuned to avoid attacks. Does nothing on clients.
+						PreferServerCipherSuites: true,
+						// Only use curves which have assembly implementations
+						CurvePreferences: []tls.CurveID{
+							tls.CurveP256,
+							tls.X25519,
+						},
+						MinVersion: tls.VersionTLS12,
+						CipherSuites: []uint16{
+							tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+							tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+							tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
+							tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
+							tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+							tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+						},
+					}
 					errs <- srv.ListenAndServeTLS(
 						config.Server.Cert,
 						config.Server.Key,