240db4e2a7
Some checks failed
Server CI / Postgres (shard 0) (push) Has been skipped
Server CI / Postgres (shard 3) (push) Has been skipped
BuildEnv Docker Image / build-image (push) Failing after 4s
BuildEnv Docker Image / build-image-fips (push) Failing after 4s
Migration Review & Release Notes / Generate migration review & release notes (push) Failing after 3s
Server CI / Build Environment (push) Failing after 3s
Server CI / Postgres (shard 1) (push) Has been skipped
Tools CI / check-style (mattermost-govet) (push) Failing after 4s
Server CI / Postgres (shard 2) (push) Has been skipped
Tools CI / check-style (mmgotool) (push) Failing after 3s
Server CI / Elasticsearch v8 Compatibility (push) Has been skipped
Server CI / OpenSearch v2 Compatibility (push) Has been skipped
Server CI / Postgres FIPS (shard 0) (push) Has been skipped
Tools CI / Test (mattermost-govet) (push) Failing after 3s
Server CI / Postgres FIPS (shard 1) (push) Has been skipped
Server CI / Postgres FIPS (shard 2) (push) Has been skipped
Tools CI / Test (mmgotool) (push) Failing after 3s
Server CI / Postgres FIPS (shard 3) (push) Has been skipped
Server CI / Run mmctl tests (push) Has been skipped
Server CI / Run mmctl tests (FIPS) (push) Has been skipped
Server CI / Merge Postgres Test Results (push) Has been skipped
Server CI / Merge Postgres FIPS Test Results (push) Has been skipped
Server CI / Check backport migrations (push) Has been skipped
Server CI / Check generated files (push) Has been skipped
Server CI / check-style (push) Has been skipped
Server CI / Vet API (push) Has been skipped
Server CI / Build mattermost server app (push) Has been skipped
Server CI / Server CI Complete (push) Failing after 2s
Server CI / Server CI Artifacts (push) Has been skipped
Server CI / Sentry Upload (push) Has been skipped
Server CI / Server CI Report (push) Failing after 5m1s
Server CI Nightly Race / Race Detector (push) Has been skipped
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (javascript) (push) Has been cancelled
Webapp CI Cache Warm / Warm Webapp node_modules Cache (push) Has been cancelled
E2E CI Cache Warm / Warm E2E npm Registry Cache (push) Has been cancelled
API / build (push) Has been cancelled
Web App CI / check-types (push) Has been cancelled
Web App CI / check-lint (push) Has been cancelled
Web App CI / check-i18n (push) Has been cancelled
Web App CI / check-external-links (push) Has been cancelled
Web App CI / test (platform) (push) Has been cancelled
Web App CI / test (mattermost-redux) (push) Has been cancelled
Web App CI / test (channels shard 1/4) (push) Has been cancelled
Web App CI / test (channels shard 2/4) (push) Has been cancelled
Web App CI / test (channels shard 3/4) (push) Has been cancelled
Web App CI / test (channels shard 4/4) (push) Has been cancelled
Web App CI / upload-coverage (push) Has been cancelled
Web App CI / build (push) Has been cancelled
YAML Lint / yamllint (push) Has been cancelled
Push mirrored docker images / cd/Push mirrored docker images (push) Has been cancelled
docs-cd / Build and deploy docs (push) Has been cancelled
Docs CI / build (push) Has been cancelled
E2E Cache Warm: Cypress deps / Warm Cypress deps cache (push) Has been cancelled
Scorecards supply-chain security / Scorecard analysis (push) Has been cancelled
Server CI Weekly / Postgres FIPS (push) Has been skipped
Server CI Weekly / Run mmctl tests (FIPS) (push) Has been skipped
Server CI Weekly / Postgres with binary parameters (push) Has been skipped
Server CI Weekly / Build Environment (push) Failing after 1s
Server CI Nightly Race / Build Environment (push) Failing after 1s
Server CI Cache Warm / Warm Go Module and Build Cache (push) Failing after 2s
51 lines
4.7 KiB
Plaintext
51 lines
4.7 KiB
Plaintext
---
|
||
title: "Encryption options"
|
||
---
|
||
<PlanAvailability slug="all-commercial" />
|
||
|
||
Mattermost provides encryption-in-transit and encryption-at-rest capabilities. This page guides you through setting up appropriate encryption security.
|
||
|
||
Encryption is not required for GDPR, although it can be used as an additional safeguard against data breach.
|
||
|
||
## Encryption-in-transit
|
||
|
||
Mattermost supports TLS encryption including AES-256 with 2048-bit RSA on all data transmissions between Mattermost client applications and the Mattermost server. You may either set up TLS on the Mattermost Server or install a proxy such as NGINX and set up TLS on the proxy. Refer to our [configuration guide for more details](/deployment-guide/server/setup-tls).
|
||
|
||
Connections to Active Directory/LDAP can [optionally be secured with TLS or stunnel](/administration-guide/configure/authentication-configuration-settings#adldap-port).
|
||
|
||
Connections to calls are secured with a combination of:
|
||
|
||
> - TLS: The existing WebSocket channel is used to secure the signaling path.
|
||
> - DTLS v1.2 (mandatory): Used for initial key exchange. Supports `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256` and `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA` algorithms.
|
||
> - SRTP (mandatory): Used to encrypt all media packets (i.e. those containing voice or screen share). Supports `AEAD_AES_128_GCM` and `AES128_CM_HMAC_SHA1_80` algorithms.
|
||
|
||
## Gossip encryption
|
||
|
||
In a High Availability mode, Mattermost supports encryption of cluster data in-transit when using the gossip protocol, which is based on principles outlined in the [SWIM protocol developed by researchers at Cornell University](https://www.cs.cornell.edu/projects/Quicksilver/public_pdfs/SWIM.pdf). The gossip protocol is a communication mechanism in distributed systems where nodes randomly exchange information to ensure data consistency across the network. It is decentralized, scalable, and fault-tolerant, making it ideal for systems with numerous nodes. Information is spread in a manner similar to social gossip, with nodes periodically "gossiping" updates to random peers until the network converges to a consistent state. Widely used in distributed databases, blockchain networks, and peer-to-peer systems, the protocol is simple to implement and resilient to node failures. However, it can suffer from redundancy and propagation delays in large networks.
|
||
|
||
From Mattermost v10.11, [gossip encryption](/administration-guide/configure/environment-configuration-settings#enable-gossip-encryption) is enabled by default for new deployments while existing deployments maintain their current configuration.
|
||
|
||
The encryption uses AES-256 by default, and it is not configurable. However, it is possible to manually set the value in the `Systems` table for the `ClusterEncryptionKey` row. A key is a byte array converted to base64. It can be set to a length of 16, 24, or 32 bytes to select AES-128, AES-192, or AES-256 respectively.
|
||
|
||
## Encryption-at-rest
|
||
|
||
Encryption-at-rest is available for messages via hardware and software disk encryption solutions applied to the Mattermost database, which resides on its own server within your infrastructure. To enable end user search and compliance reporting of message histories, Mattermost does not offer encryption within the database.
|
||
|
||
Both the database and file storage can be secured using software or hardware disk encryption solutions. Full-disk encryption methods such as LUKS (Linux), BitLocker (Windows), or database-specific solutions like Transparent Data Encryption (TDE) can be employed. Integration with external encrypted storage systems is supported.
|
||
|
||
Additionally, encryption-at-rest is available for files stored via hardware and software disk encryption solutions applied to the server used for local/network storage or S3-compatible storage.
|
||
|
||
### Database
|
||
|
||
See the [PostgreSQL](https://www.postgresql.org/docs/10/encryption-options.html) database documentation for details on encryption options at the disk level.
|
||
|
||
### File storage
|
||
|
||
For local storage, NFS, or S3-compatible storage, encryption-at-rest is available for files stored via hardware and software disk encryption solutions applied to the server.
|
||
|
||
For Amazon’s proprietary S3 system, encryption-at-rest is available via [server-side encryption with Amazon S3-managed keys](/administration-guide/configure/environment-configuration-settings#enable-server-side-encryption-for-amazon-s3) in Mattermost enterprise-badge.
|
||
|
||
## SAML encryption support
|
||
|
||
SAML assertion encryption is configured alongside the rest of your identity provider settings rather than at the infrastructure layer. See [supported SAML encryption methods](/administration-guide/configure/authentication-configuration-settings#supported-saml-encryption-methods) in the authentication configuration settings.
|