Apache SSL/TLS Security Settings - Revision history

IVSWikiBlue at 19:03, 16 January 2020

2020-01-16T19:03:49Z

← Older revision		Revision as of 19:03, 16 January 2020
Line 4:		Line 4:
	# Comment out this line by placing a '''#''' at the beginning of the line.		# Comment out this line by placing a '''#''' at the beginning of the line.
	# Add the following lines below the line that you just commented out:		# Add the following lines below the line that you just commented out:
	<pre>SSLProtocol ALL -SSLv2 -SSLv3		<pre>SSLProtocol ALL -SSLv2 -SSLv3 -TLSv1
	SSLHonorCipherOrder On		SSLHonorCipherOrder On
	SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS</pre>		SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS</pre>
Line 13:		Line 13:
	# Scroll to the bottom of the file.		# Scroll to the bottom of the file.
	# Add the following lines:		# Add the following lines:
	<pre>SSLProtocol ALL -SSLv2 -SSLv3		<pre>SSLProtocol ALL -SSLv2 -SSLv3 -TLSv1
	SSLHonorCipherOrder On		SSLHonorCipherOrder On
	SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS</pre>		SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS</pre>

IVSWikiBlue at 17:10, 24 April 2019

2019-04-24T17:10:17Z

← Older revision		Revision as of 17:10, 24 April 2019
Line 9:		Line 9:
	# Type '''CTRL-X''' and then press Enter to exit.		# Type '''CTRL-X''' and then press Enter to exit.
	# Enter '''Y''' to save changes.		# Enter '''Y''' to save changes.
	# Do not change the name and press ~~enter~~ to save the changes.		# Do not change the name and press Enter to save the changes.
	# Type in the following, and then press Enter: <pre>sudo nano /etc/apache2/apache2.conf</pre>		# Type in the following, and then press Enter: <pre>sudo nano /etc/apache2/apache2.conf</pre>
	# Scroll to the bottom of the file.		# Scroll to the bottom of the file.

IVSWikiBlue at 17:08, 24 April 2019

2019-04-24T17:08:44Z

← Older revision		Revision as of 17:08, 24 April 2019
Line 18:		Line 18:
	# Type '''CTRL-X''' and then press Enter to exit.		# Type '''CTRL-X''' and then press Enter to exit.
	# Enter '''Y''' to save changes.		# Enter '''Y''' to save changes.
	# Do not change the name, and press ~~'''~~Enter~~'''~~ to save the changes.		# Do not change the name, and press Enter to save the changes.
	# Type in the following, and then press Enter: <pre>sudo service apache2 restart</pre>		# Type in the following, and then press Enter: <pre>sudo service apache2 restart</pre>

IVSWikiBlue at 17:06, 24 April 2019

2019-04-24T17:06:05Z

← Older revision		Revision as of 17:06, 24 April 2019
Line 7:		Line 7:
	SSLHonorCipherOrder On		SSLHonorCipherOrder On
	SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS</pre>		SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS</pre>
	# ~~Press~~ '''CTRL-X''' to exit.		# Type '''CTRL-X''' and then press Enter to exit.
	# Enter '''Y''' to save changes.		# Enter '''Y''' to save changes.
	# Do not change the name and press enter to save the changes.		# Do not change the name and press enter to save the changes.

IVSWikiBlue at 17:04, 24 April 2019

2019-04-24T17:04:13Z

← Older revision		Revision as of 17:04, 24 April 2019
Line 1:		Line 1:
	# Connect to the server via ssh or access the shell via the console.		# Connect to the server via ssh or access the shell via the console.
	# Type ~~'''~~sudo nano /etc/apache2/sites-enabled/default-ssl.conf~~'''.~~		# Type in the following, and then press Enter: <pre>sudo nano /etc/apache2/sites-enabled/default-ssl.conf</pre>
	# Locate the line in the file ~~'''~~SSLProtocol ALL -SSLv2~~'''.~~		# Locate the line in the file <pre>SSLProtocol ALL -SSLv2</pre>
	# Comment out this line by placing a '''#''' at the beginning of the line.		# Comment out this line by placing a '''#''' at the beginning of the line.
	# Add the following lines below the line that you just commented out:		# Add the following lines below the line that you just commented out:
	~~#: '''~~SSLProtocol ALL -SSLv2 -SSLv3~~'''~~		<pre>SSLProtocol ALL -SSLv2 -SSLv3
	~~#: '''~~SSLHonorCipherOrder On~~'''~~		SSLHonorCipherOrder On
	~~#: '''~~SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS~~'''~~		SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS</pre>
	# Press '''CTRL-X''' to exit.		# Press '''CTRL-X''' to exit.
	# Enter '''Y''' to save changes.		# Enter '''Y''' to save changes.
	# Do not change the name and press enter to save the changes.		# Do not change the name and press enter to save the changes.
	# Type ~~'''~~sudo nano /etc/apache2/apache2.conf~~'''.~~		# Type in the following, and then press Enter: <pre>sudo nano /etc/apache2/apache2.conf</pre>
	# Scroll to the bottom of the file.		# Scroll to the bottom of the file.
	# Add the following lines:		# Add the following lines:
	~~#: '''~~SSLProtocol ALL -SSLv2 -SSLv3~~'''~~		<pre>SSLProtocol ALL -SSLv2 -SSLv3
	~~#: '''~~SSLHonorCipherOrder On~~'''~~		SSLHonorCipherOrder On
	~~#: '''~~SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS~~'''~~		SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS</pre>
	# ~~Press~~ '''CTRL-X''' to exit.		# Type '''CTRL-X''' and then press Enter to exit.
	# Enter '''Y''' to save changes.		# Enter '''Y''' to save changes.
	# Do not change the name, and press '''Enter''' to save the changes.		# Do not change the name, and press '''Enter''' to save the changes.
	# Type ~~'''~~sudo service apache2 restart~~'''.~~		# Type in the following, and then press Enter: <pre>sudo service apache2 restart</pre>

	You can verify the active ciphers by running the following command:		You can verify the active ciphers by running the following command:

	~~'''~~nmap -sV --script ssl-enum-ciphers -p 443 <host>~~'''~~		<pre>nmap -sV --script ssl-enum-ciphers -p 443 <host></pre>

IVSWikiBlue at 14:28, 22 April 2019

2019-04-22T14:28:02Z

IVSWikiBlue at 15:16, 22 January 2018

2018-01-22T15:16:13Z

@@ Line 4: / Line 4: @@
 # Comment out this line by placing a '''#''' at the beginning of the line.
 # Add the following lines below the line that you just commented out:
 #: '''SSLProtocol ALL -SSLv2 -SSLv3'''
 #: '''SSLHonorCipherOrder On'''
@@ Line 11: / Line 20: @@
 # Do not change the name and press enter to save the changes.
 # Type '''sudo service apache2 restart'''

IVSWikiBlue: Created page with "# Connect to the server via ssh or access the shell via the console. # Type '''sudo nano /etc/apache2/sites-enabled/default-ssl.conf''' # Locate the line in the file '''SSLPro..."

2018-01-03T17:24:02Z

Created page with "# Connect to the server via ssh or access the shell via the console. # Type '''sudo nano /etc/apache2/sites-enabled/default-ssl.conf''' # Locate the line in the file '''SSLPro..."

New page

# Connect to the server via ssh or access the shell via the console.
# Type '''sudo nano /etc/apache2/sites-enabled/default-ssl.conf'''
# Locate the line in the file '''SSLProtocol ALL -SSLv2'''
# Comment out this line by placing a '''#''' at the beginning of the line.
# Add the following lines below the line that you just commented out:
#: '''SSLProtocol ALL -SSLv2 -SSLv3'''
#: '''SSLHonorCipherOrder On'''
#: '''SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS'''
# Press '''CTRL-X''' to exit
# Enter '''Y''' to save changes.
# Do not change the name and press enter to save the changes.
# Type '''sudo service apache2 restart'''

← Older revision		Revision as of 14:28, 22 April 2019
Line 1:		Line 1:
	# Connect to the server via ssh or access the shell via the console.		# Connect to the server via ssh or access the shell via the console.
	# Type '''sudo nano /etc/apache2/sites-enabled/default-ssl.conf'''		# Type '''sudo nano /etc/apache2/sites-enabled/default-ssl.conf'''.
	# Locate the line in the file '''SSLProtocol ALL -SSLv2'''		# Locate the line in the file '''SSLProtocol ALL -SSLv2'''.
	# Comment out this line by placing a '''#''' at the beginning of the line.		# Comment out this line by placing a '''#''' at the beginning of the line.
	# Add the following lines below the line that you just commented out:		# Add the following lines below the line that you just commented out:
Line 7:		Line 7:
	#: '''SSLHonorCipherOrder On'''		#: '''SSLHonorCipherOrder On'''
	#: '''SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS'''		#: '''SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS'''
	# Press '''CTRL-X''' to exit		# Press '''CTRL-X''' to exit.
	# Enter '''Y''' to save changes.		# Enter '''Y''' to save changes.
	# Do not change the name and press enter to save the changes.		# Do not change the name and press enter to save the changes.
	# Type '''sudo nano /etc/apache2/apache2.conf'''		# Type '''sudo nano /etc/apache2/apache2.conf'''.
	# Scroll to the bottom of the file.		# Scroll to the bottom of the file.
	# Add the following lines:		# Add the following lines:
Line 16:		Line 16:
	#: '''SSLHonorCipherOrder On'''		#: '''SSLHonorCipherOrder On'''
	#: '''SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS'''		#: '''SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS'''
	# Press '''CTRL-X''' to exit		# Press '''CTRL-X''' to exit.
	# Enter '''Y''' to save changes.		# Enter '''Y''' to save changes.
	# Do not change the name and press ~~enter~~ to save the changes.		# Do not change the name, and press '''Enter''' to save the changes.
	# Type '''sudo service apache2 restart'''		# Type '''sudo service apache2 restart'''.

	You can verify the active ciphers by running the following command:		You can verify the active ciphers by running the following command:

	'''nmap -sV --script ssl-enum-ciphers -p 443 <host>'''		'''nmap -sV --script ssl-enum-ciphers -p 443 <host>'''