security [ARCHIVED] May 2014

security@lists.fedoraproject.org

15 participants
35 discussions

[Secure Coding] master: Marked guide as draft (caf2443)
by Eric Christensen 30 May '14

30 May '14

Repository : http://git.fedorahosted.org/git/?p=secure-coding.git On branch : master >--------------------------------------------------------------- commit caf2443da90df86562bbf9c64f1bdf7b52aabfb8 Author: Eric Christensen <echriste(a)redhat.com> Date: Thu May 29 14:53:03 2014 -0400 Marked guide as draft >--------------------------------------------------------------- Securing_TLS/en-US/Securing_TLS.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/Securing_TLS/en-US/Securing_TLS.xml b/Securing_TLS/en-US/Securing_TLS.xml index 9aa9582..4f9d5ea 100644 --- a/Securing_TLS/en-US/Securing_TLS.xml +++ b/Securing_TLS/en-US/Securing_TLS.xml @@ -3,7 +3,7 @@ <!ENTITY % BOOK_ENTITIES SYSTEM "Securing_TLS.ent"> %BOOK_ENTITIES; ]> -<book> +<book status="draft"> <xi:include href="Book_Info.xml" xmlns:xi="http://www.w3.org/2001/XInclude" />  <xi:include href="mod_ssl.xml" xmlns:xi="http://www.w3.org/2001/XInclude" />

1 0

[Secure Coding] master: Merge branch 'master' of git+ssh://git.fedorahosted.org/git/secure-coding (547d801)
by Eric Christensen 29 May '14

29 May '14

Repository : http://git.fedorahosted.org/git/?p=secure-coding.git On branch : master >--------------------------------------------------------------- commit 547d8017443dc8f27cde63a6026bf8b0d2ff2770 Merge: e9907e4 c0c8caa Author: Eric Christensen <echriste(a)redhat.com> Date: Thu May 29 11:53:43 2014 -0400 Merge branch 'master' of git+ssh://git.fedorahosted.org/git/secure-coding >--------------------------------------------------------------- Securing_TLS/en-US/mod_ssl.xml | 15 ++++++++++++--- 1 files changed, 12 insertions(+), 3 deletions(-) diff --git a/Securing_TLS/en-US/mod_ssl.xml b/Securing_TLS/en-US/mod_ssl.xml index 3441d0a..365b0bb 100644 --- a/Securing_TLS/en-US/mod_ssl.xml +++ b/Securing_TLS/en-US/mod_ssl.xml @@ -22,7 +22,8 @@ Listen 443 https </screen> This specifies the port that httpd should listen to for SSL/TLS traffic. Port 443 is the standard port for https. - +</para> +<para> <screen> # Pseudo Random Number Generator (PRNG): # Configure one or more sources to seed the PRNG of the @@ -39,10 +40,18 @@ SSLRandomSeed connect builtin #SSLRandomSeed startup file:/dev/random 512 #SSLRandomSeed connect file:/dev/random 512 #SSLRandomSeed connect file:/dev/urandom 512 +#SSLRandomSeed connect exec:/usr/local/bin/rand 16 </screen> -The random number generator is very important for cryptology and this is where those settings get established. By default the pseudo-random number generator is defined here although if you have another source of random data you can put that here. - +The random number generator is very important for cryptology and this is where those settings get established. By default the pseudo-random number generator is configured here although if you have another source of random data you can specify it here. +</para> +<para> +For Linux systems, the quality of entropy provided by <literal>/dev/urandom</literal> is very high so we recommend its use for both <literal>startup</literal> and <literal>connect</literal>. The number of bytes read should be left at 256 for <literal>startup</literal> as it has minimal impact on performance, and set to 32 for the <literal>connect</literal> use (256 bits). This provides enough entropy for both internal operation and for ServerRandom value in TLS (which is limited to 256 bits). +</para> +<para> +In cases where the system on which <literal>mod_ssl</literal> is running is slow and doesn't have a hardware random number generator, we highly recommend to set the values to the ones quoted in the above example. +</para> +<para> <screen> # Use "SSLCryptoDevice" to enable any supported hardware # accelerators. Use "openssl engine -v" to list supported

1 0

[Secure Coding] master: Started OpenSSL chapter and added it to the guide for testing (e9907e4)
by Eric Christensen 29 May '14

29 May '14

Repository : http://git.fedorahosted.org/git/?p=secure-coding.git On branch : master >--------------------------------------------------------------- commit e9907e4c0b79788616f86f75f7ac40b0fa5813b4 Author: Eric Christensen <echriste(a)redhat.com> Date: Thu May 29 11:53:01 2014 -0400 Started OpenSSL chapter and added it to the guide for testing >--------------------------------------------------------------- Securing_TLS/en-US/OpenSSL.xml | 49 ++++++++++++++++++---------------- Securing_TLS/en-US/Securing_TLS.xml | 1 + 2 files changed, 27 insertions(+), 23 deletions(-) diff --git a/Securing_TLS/en-US/OpenSSL.xml b/Securing_TLS/en-US/OpenSSL.xml index 36febc1..115c8e9 100644 --- a/Securing_TLS/en-US/OpenSSL.xml +++ b/Securing_TLS/en-US/OpenSSL.xml @@ -3,31 +3,34 @@ <!ENTITY % BOOK_ENTITIES SYSTEM "Securing_TLS.ent"> %BOOK_ENTITIES; ]> -<chapter id="chap-Fedora_Security_Team-Securing_TLS-Test_Chapter"> - <title>Test Chapter</title> +<chapter id="chap-Fedora_Security_Team-Securing_TLS-OpenSSL"> + <title>OpenSSL</title> <para> - This is a test paragraph + <application>OpenSSL</application> is a popular and powerful open source toolkit for implementing SSL and TLS. It's used to add SSL and TLS encryption to other popular software like <application>Apache</application>, <application>dovecot</application>, and <application>ejabberd</application>. </para> - <section id="sect-Fedora_Security_Team-Securing_TLS-Test_Chapter-Test_Section_1"> - <title>Test Section 1</title> - <para> - This is a test paragraph in a section - </para> + <section id="sect-Fedora_Security_Team-Securing_TLS-OpenSSL-Cipher_Categories"> + <title>Cipher Categories</title> + <para><application>OpenSSL</application> groups cipher suites together into easy to define sets that make it easy to implement encryption that makes sense for individual systems. These sets include <literal>HIGH</literal>, <literal>MEDIUM</literal>, <literal>LOW</literal>, <literal>EXPORT</literal>, and <literal>DEFAULT</literal>. By utilizing one, or a combination, of these sets in configuration files, the systems administrator can define many ciphers at once.</para> + <section id="sect-Fedora_Security_Team-Securing_TLS-OpenSSL-Cipher_Categories-High"> + <title>High Ciphers</title> + <para /> + </section> + <section id="sect-Fedora_Security_Team-Securing_TLS-OpenSSL-Cipher_Categories-Medium"> + <title>Medium Ciphers</title> + <para /> + </section> + <section id="sect-Fedora_Security_Team-Securing_TLS-OpenSSL-Cipher_Categories-Low"> + <title>Low Ciphers</title> + <para /> + </section> + <section id="sect-Fedora_Security_Team-Securing_TLS-OpenSSL-Cipher_Categories-Export"> + <title>Export Ciphers</title> + <para /> + </section> + <section id="sect-Fedora_Security_Team-Securing_TLS-OpenSSL-Cipher_Categories-Default"> + <title>Default Ciphers</title> + <para /> + </section> </section> - - <section id="sect-Fedora_Security_Team-Securing_TLS-Test_Chapter-Test_Section_2"> - <title>Test Section 2</title> - <para> - This is a test paragraph in Section 2 - <orderedlist> - <listitem> - <para> - This is a test listitem. - </para> - </listitem> - </orderedlist> - </para> - </section> - </chapter> diff --git a/Securing_TLS/en-US/Securing_TLS.xml b/Securing_TLS/en-US/Securing_TLS.xml index b9a8245..9aa9582 100644 --- a/Securing_TLS/en-US/Securing_TLS.xml +++ b/Securing_TLS/en-US/Securing_TLS.xml @@ -7,6 +7,7 @@ <xi:include href="Book_Info.xml" xmlns:xi="http://www.w3.org/2001/XInclude" />  <xi:include href="mod_ssl.xml" xmlns:xi="http://www.w3.org/2001/XInclude" /> + <xi:include href="OpenSSL.xml" xmlns:xi="http://www.w3.org/2001/XInclude" /> <xi:include href="Revision_History.xml" xmlns:xi="http://www.w3.org/2001/XInclude" /> <index /> </book>

1 0

[Secure Coding] master: Added productnumber back in until I can figure out how to remove it and still make the guide build (41d933e)
by Eric Christensen 29 May '14

29 May '14

Repository : http://git.fedorahosted.org/git/?p=secure-coding.git On branch : master >--------------------------------------------------------------- commit 41d933e2dbbca83c48221f71a07c4a200bc088fc Author: Eric Christensen <echriste(a)redhat.com> Date: Thu May 29 11:05:58 2014 -0400 Added productnumber back in until I can figure out how to remove it and still make the guide build >--------------------------------------------------------------- Securing_TLS/en-US/Book_Info.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/Securing_TLS/en-US/Book_Info.xml b/Securing_TLS/en-US/Book_Info.xml index 4d11e8a..5a3fa53 100644 --- a/Securing_TLS/en-US/Book_Info.xml +++ b/Securing_TLS/en-US/Book_Info.xml @@ -7,7 +7,7 @@ <title>Securing TLS</title> <subtitle>Securing data-in-transit using the latest recommendations for SSL and TLS implementations.</subtitle> <productname>Fedora Security Team</productname> - <productnumber></productnumber> + <productnumber>1</productnumber> <edition>1</edition> <pubsnumber>0</pubsnumber> <abstract>

1 0

[Secure Coding] master: Updated abstract and description (7c3af12)
by Eric Christensen 29 May '14

29 May '14

Repository : http://git.fedorahosted.org/git/?p=secure-coding.git On branch : master >--------------------------------------------------------------- commit 7c3af12ea267af51a2fade8215da8512cd165d06 Author: Eric Christensen <echriste(a)redhat.com> Date: Wed May 28 22:41:13 2014 -0400 Updated abstract and description >--------------------------------------------------------------- Securing_TLS/en-US/Book_Info.xml | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Securing_TLS/en-US/Book_Info.xml b/Securing_TLS/en-US/Book_Info.xml index 25fe7f3..4d11e8a 100644 --- a/Securing_TLS/en-US/Book_Info.xml +++ b/Securing_TLS/en-US/Book_Info.xml @@ -5,14 +5,14 @@ ]> <bookinfo id="book-Fedora_Security_Team-Securing_TLS-Securing_TLS"> <title>Securing TLS</title> - <subtitle>Enter a short description here.</subtitle> + <subtitle>Securing data-in-transit using the latest recommendations for SSL and TLS implementations.</subtitle> <productname>Fedora Security Team</productname> - <productnumber>0.1</productnumber> + <productnumber></productnumber> <edition>1</edition> <pubsnumber>0</pubsnumber> <abstract> <para> - A short overview and summary of the book's subject and purpose, traditionally no more than one paragraph long. Note: the abstract will appear in the front matter of your book and will also be placed in the description field of the book's RPM spec file. + This book describes a recommended way of configuring SSL and TLS circuits to protect data being passed across the network. This includes web, email, and authentication encryption for data in transit. </para> </abstract> <corpauthor>

1 0

[Secure Coding] master: Added copyright owner (167374c)
by Eric Christensen 29 May '14

29 May '14

Repository : http://git.fedorahosted.org/git/?p=secure-coding.git On branch : master >--------------------------------------------------------------- commit 167374cdff18691cae3371135b5e0ebce67065ba Author: Eric Christensen <echriste(a)redhat.com> Date: Wed May 28 22:35:46 2014 -0400 Added copyright owner >--------------------------------------------------------------- Securing_TLS/en-US/Securing_TLS.ent | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/Securing_TLS/en-US/Securing_TLS.ent b/Securing_TLS/en-US/Securing_TLS.ent index 2d97459..588958a 100644 --- a/Securing_TLS/en-US/Securing_TLS.ent +++ b/Securing_TLS/en-US/Securing_TLS.ent @@ -1,4 +1,4 @@ <!ENTITY PRODUCT "Fedora Security Team"> <!ENTITY BOOKID "Securing_TLS"> <!ENTITY YEAR "2014"> -<!ENTITY HOLDER "| You need to change the HOLDER entity in the en-US/Securing_TLS.ent file |"> +<!ENTITY HOLDER "Red Hat, Inc. and contributors">

1 0

[Secure Coding] master: Fixed the Rev Hx for initial creation (f62a564)
by Eric Christensen 29 May '14

29 May '14

Repository : http://git.fedorahosted.org/git/?p=secure-coding.git On branch : master >--------------------------------------------------------------- commit f62a5642404f5db9b45186b9ea56cef362f63840 Author: Eric Christensen <echriste(a)redhat.com> Date: Wed May 28 22:34:31 2014 -0400 Fixed the Rev Hx for initial creation >--------------------------------------------------------------- Securing_TLS/en-US/Revision_History.xml | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Securing_TLS/en-US/Revision_History.xml b/Securing_TLS/en-US/Revision_History.xml index 5a763c2..b127a5e 100644 --- a/Securing_TLS/en-US/Revision_History.xml +++ b/Securing_TLS/en-US/Revision_History.xml @@ -11,9 +11,9 @@ <revnumber>0.0-0</revnumber> <date>Wed May 28 2014</date> <author> - <firstname>Enter your first name here.</firstname> - <surname>Enter your surname here.</surname> - <email>Enter your email address here.</email> + <firstname>Eric</firstname> + <surname>Christensen</surname> + <email>sparks(a)redhat.com</email> </author> <revdescription> <simplelist>

1 0

[Secure Coding] master: Added myself to the author list (0c41b02)
by Eric Christensen 29 May '14

29 May '14

Repository : http://git.fedorahosted.org/git/?p=secure-coding.git On branch : master >--------------------------------------------------------------- commit 0c41b02783a5e941234a86892cfd9804d05aaefb Author: Eric Christensen <echriste(a)redhat.com> Date: Wed May 28 22:33:34 2014 -0400 Added myself to the author list >--------------------------------------------------------------- Securing_TLS/en-US/Author_Group.xml | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Securing_TLS/en-US/Author_Group.xml b/Securing_TLS/en-US/Author_Group.xml index 7d106ea..cad768f 100644 --- a/Securing_TLS/en-US/Author_Group.xml +++ b/Securing_TLS/en-US/Author_Group.xml @@ -5,13 +5,13 @@ ]> <authorgroup> <author> - <firstname>Enter your first name here.</firstname> - <surname>Enter your surname here.</surname> + <firstname>Eric</firstname> + <surname>Christensen</surname> <affiliation> - <orgname>Enter your organisation's name here.</orgname> - <orgdiv>Enter your organisational division here.</orgdiv> + <orgname>Red Hat</orgname> + <orgdiv>Product Security</orgdiv> </affiliation> - <email>Enter your email address here.</email> + <email>sparks(a)redhat.com</email> </author> </authorgroup>

1 0

[Secure Coding] master: Finished annotating the ssl.conf file example (6f16df3)
by Eric Christensen 29 May '14

29 May '14

Repository : http://git.fedorahosted.org/git/?p=secure-coding.git On branch : master >--------------------------------------------------------------- commit 6f16df3295fb37742f42c99c959382b05a7aca01 Author: Eric Christensen <echriste(a)redhat.com> Date: Wed May 28 22:31:48 2014 -0400 Finished annotating the ssl.conf file example >--------------------------------------------------------------- Securing_TLS/en-US/mod_ssl.xml | 15 +++++++++++++++ 1 files changed, 15 insertions(+), 0 deletions(-) diff --git a/Securing_TLS/en-US/mod_ssl.xml b/Securing_TLS/en-US/mod_ssl.xml index ac246ce..3441d0a 100644 --- a/Securing_TLS/en-US/mod_ssl.xml +++ b/Securing_TLS/en-US/mod_ssl.xml @@ -86,8 +86,17 @@ The setting everyone seems to care about. What symmetric ciphers will your webs # compromised, captures of past or future traffic must be # considered compromised, too. #SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5 +</screen> + +These are settings that are for those that want speed over security. If you are concerned with processor time for decrypting data you can comment out the above <literal>SSLCipherSuite</literal> line and use this one. It is highly recommended that you remove the <literal>RC4-SHA</literal> as RC4 should no longer be used. The prioritization of <literal>AES128-SHA</literal> above all other ciphers means that the hardware accelerator will be most efficient with most clients. + +<screen> #SSLHonorCipherOrder on +</screen> + +This should be uncommented and used no matter your configuration for security or speed. This setting makes the client connect to the first cipher they can which makes for the most secure or fastest (depending on your settings) happen more often. +<screen> # Server Certificate: # Point SSLCertificateFile at a PEM encoded certificate. If # the certificate is encrypted, then you will be prompted for a @@ -116,7 +125,11 @@ SSLCertificateKeyFile /etc/pki/tls/private/localhost.key # certificates for client authentication or alternatively one # huge file containing all of them (file must be PEM encoded) #SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt +</screen> + +These are where your certificates live. You may have to update the name of the certificate and key files but the files should live in the directories provided. +<screen> # Client Authentication (Type): # Client certificate verification type and depth. Types are # none, optional, require and optional_no_ca. Depth is a @@ -125,6 +138,8 @@ SSLCertificateKeyFile /etc/pki/tls/private/localhost.key #SSLVerifyClient require #SSLVerifyDepth 10 </screen> + +These are settings for requiring certificate authentication from the client as well. Use this to add additional security to your site by validating certificates on the client side. </para> </section> </chapter>

1 0

[Secure Coding] master: Started working on explaining the mod_ssl config file. (25f7118)
by Eric Christensen 29 May '14

29 May '14

Repository : http://git.fedorahosted.org/git/?p=secure-coding.git On branch : master >--------------------------------------------------------------- commit 25f7118e6ddbfa22c3086aee4e9d908c5f6a45de Author: Eric Christensen <echriste(a)redhat.com> Date: Wed May 28 16:28:20 2014 -0400 Started working on explaining the mod_ssl config file. >--------------------------------------------------------------- Securing_TLS/en-US/Securing_TLS.xml | 4 +- Securing_TLS/en-US/mod_ssl.xml | 147 +++++------------------------------ 2 files changed, 23 insertions(+), 128 deletions(-) diff --git a/Securing_TLS/en-US/Securing_TLS.xml b/Securing_TLS/en-US/Securing_TLS.xml index 2e80080..b9a8245 100644 --- a/Securing_TLS/en-US/Securing_TLS.xml +++ b/Securing_TLS/en-US/Securing_TLS.xml @@ -5,8 +5,8 @@ ]> <book> <xi:include href="Book_Info.xml" xmlns:xi="http://www.w3.org/2001/XInclude" /> - <xi:include href="Preface.xml" xmlns:xi="http://www.w3.org/2001/XInclude" /> - <xi:include href="Chapter.xml" xmlns:xi="http://www.w3.org/2001/XInclude" /> + + <xi:include href="mod_ssl.xml" xmlns:xi="http://www.w3.org/2001/XInclude" /> <xi:include href="Revision_History.xml" xmlns:xi="http://www.w3.org/2001/XInclude" /> <index /> </book> diff --git a/Securing_TLS/en-US/mod_ssl.xml b/Securing_TLS/en-US/mod_ssl.xml index b656bd3..ac246ce 100644 --- a/Securing_TLS/en-US/mod_ssl.xml +++ b/Securing_TLS/en-US/mod_ssl.xml @@ -11,33 +11,19 @@ <section id="sect-Fedora_Security_Team-Securing_TLS-mod_ssl-configuration"> <title>Configuration</title> <para> - <application>mod_ssl</application>'s configuration file, by default, appears as such: + <application>mod_ssl</application>'s configuration file, by default, has mostly sane settings. Below we'll talk about portions of the configuration that are important. + </para> + <para> <screen> # # When we also provide SSL we have to listen to the # the HTTPS port in addition. # Listen 443 https +</screen> +This specifies the port that httpd should listen to for SSL/TLS traffic. Port 443 is the standard port for https. -## -## SSL Global Context -## -## All SSL configuration in this context applies both to -## the main server and all SSL-enabled virtual hosts. -## - -# Pass Phrase Dialog: -# Configure the pass phrase gathering process. -# The filtering dialog program (`builtin' is a internal -# terminal dialog) has to provide the pass phrase on stdout. -SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog - -# Inter-Process Session Cache: -# Configure the SSL Session Cache: First the mechanism -# to use and second the expiring timeout (in seconds). -SSLSessionCache shmcb:/run/httpd/sslcache(512000) -SSLSessionCacheTimeout 300 - +<screen> # Pseudo Random Number Generator (PRNG): # Configure one or more sources to seed the PRNG of the # SSL library. The seed data should be of good random quality. @@ -53,8 +39,11 @@ SSLRandomSeed connect builtin #SSLRandomSeed startup file:/dev/random 512 #SSLRandomSeed connect file:/dev/random 512 #SSLRandomSeed connect file:/dev/urandom 512 +</screen> -# +The random number generator is very important for cryptology and this is where those settings get established. By default the pseudo-random number generator is defined here although if you have another source of random data you can put that here. + +<screen> # Use "SSLCryptoDevice" to enable any supported hardware # accelerators. Use "openssl engine -v" to list supported # engine names. NOTE: If you enable an accelerator and the @@ -63,37 +52,29 @@ SSLRandomSeed connect builtin # SSLCryptoDevice builtin #SSLCryptoDevice ubsec +</screen> -## -## SSL Virtual Host Context -## - -<VirtualHost _default_:443> - -# General setup for the virtual host, inherited from global configuration -#DocumentRoot "/var/www/html" -#ServerName www.example.com:443 - -# Use separate log files for the SSL virtual host; note that LogLevel -# is not inherited from httpd.conf. -ErrorLog logs/ssl_error_log -TransferLog logs/ssl_access_log -LogLevel warn - -# SSL Engine Switch: -# Enable/Disable SSL for this virtual host. -SSLEngine on +Many processors have cryptographic accelerators that help with complex ciphers such as AES. In fact, most hardware accelerators are specifically designed to increase the speed of AES-128 (see below where we talk about speed optimization). Unless you have a specific accelerator in your system this default setting should be okay. +<screen> # SSL Protocol support: # List the enable protocol levels with which clients will be able to # connect. Disable SSLv2 access by default: SSLProtocol all -SSLv2 +</screen> +Here's where the really important settings begin (well, they are all important). SSLProtocol allows you to set which protocols to use (e.g. SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2). The default setting <literal>all -SSLv2</literal> means that all the protocols will be supported except SSLv2. You could go in and individually specify the individual protocols but this setting makes it future-proof. When TLSv1.3 is released and supported by OpenSSL you won't have to change anything; your system will automatically start supporting TLSv1.3. Unless you have a good reason to do so it's recommended that you leave this setting the way it is. + +<screen> # SSL Cipher Suite: # List the ciphers that the client is permitted to negotiate. # See the mod_ssl documentation for a complete list. SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5 +</screen> +The setting everyone seems to care about. What symmetric ciphers will your webserver will use is determined here. The default setting should probably be hardened a bit by removing <literal>MEDIUM</literal> from the list. All current operating systems and browsers support <literal>HIGH</literal> ciphers which offer the best protection. The <literal>!aNULL</literal> removes unauthenticated cipher options and the <literal>!MD5</literal> removed any cipher that utilizes the <literal>MD5</literal> hash which is quite weak and should be avoided. + +<screen> # Speed-optimized SSL Cipher configuration: # If speed is your main concern (on busy HTTPS servers e.g.), # you might want to force clients to specific, performance @@ -143,92 +124,6 @@ SSLCertificateKeyFile /etc/pki/tls/private/localhost.key # issuer chain before deciding the certificate is not valid. #SSLVerifyClient require #SSLVerifyDepth 10 - -# Access Control: -# With SSLRequire you can do per-directory access control based -# on arbitrary complex boolean expressions containing server -# variable checks and other lookup directives. The syntax is a -# mixture between C and Perl. See the mod_ssl documentation -# for more details. -#<Location /> -#SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \ -# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \ -# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \ -# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \ -# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \ -# or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/ -#</Location> - -# SSL Engine Options: -# Set various options for the SSL engine. -# o FakeBasicAuth: -# Translate the client X.509 into a Basic Authorisation. This means that -# the standard Auth/DBMAuth methods can be used for access control. The -# user name is the `one line' version of the client's X.509 certificate. -# Note that no password is obtained from the user. Every entry in the user -# file needs this password: `xxj31ZMTZzkVA'. -# o ExportCertData: -# This exports two additional environment variables: SSL_CLIENT_CERT and -# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the -# server (always existing) and the client (only existing when client -# authentication is used). This can be used to import the certificates -# into CGI scripts. -# o StdEnvVars: -# This exports the standard SSL/TLS related `SSL_* ' environment variables. -# Per default this exportation is switched off for performance reasons, -# because the extraction step is an expensive operation and is usually -# useless for serving static content. So one usually enables the -# exportation for CGI and SSI requests only. -# o StrictRequire: -# This denies access when "SSLRequireSSL" or "SSLRequire" applied even -# under a "Satisfy any" situation, i.e. when it applies access is denied -# and no other module can change it. -# o OptRenegotiate: -# This enables optimized SSL connection renegotiation handling when SSL -# directives are used in per-directory context. -#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire -<Files ~ "\.(cgi|shtml|phtml|php3?)$"> - SSLOptions +StdEnvVars -</Files%#62; -<Directory "/var/www/cgi-bin"> - SSLOptions +StdEnvVars -</Directory> - -# SSL Protocol Adjustments: -# The safe and default but still SSL/TLS standard compliant shutdown -# approach is that mod_ssl sends the close notify alert but doesn't wait for -# the close notify alert from client. When you need a different shutdown -# approach you can use one of the following variables: -# o ssl-unclean-shutdown: -# This forces an unclean shutdown when the connection is closed, i.e. no -# SSL close notify alert is send or allowed to received. This violates -# the SSL/TLS standard but is needed for some brain-dead browsers. Use -# this when you receive I/O errors because of the standard approach where -# mod_ssl sends the close notify alert. -# o ssl-accurate-shutdown: -# This forces an accurate shutdown when the connection is closed, i.e. a -# SSL close notify alert is send and mod_ssl waits for the close notify -# alert of the client. This is 100% SSL/TLS standard compliant, but in -# practice often causes hanging connections with brain-dead browsers. Use -# this only for browsers where you know that their SSL implementation -# works correctly. -# Notice: Most problems of broken clients are also related to the HTTP -# keep-alive facility, so you usually additionally want to disable -# keep-alive for those clients, too. Use variable "nokeepalive" for this. -# Similarly, one has to force some clients to use HTTP/1.0 to workaround -# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and -# "force-response-1.0" for this. -BrowserMatch "MSIE [2-5]" \ - nokeepalive ssl-unclean-shutdown \ - downgrade-1.0 force-response-1.0 - -# Per-Server Logging: -# The home of a custom SSL log file. Use this when you want a -# compact non-error SSL logfile on a virtual host basis. -CustomLog logs/ssl_request_log \ - "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" - -</VirtualHost> </screen> </para> </section>

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

security [ARCHIVED] May 2014