Apache SSL/TLS Security Settings: Difference between revisions

From IVS Wiki
Jump to navigation Jump to search
← Older edit
No edit summary
No edit summary
 
(5 intermediate revisions by the same user not shown)
Line 1: Line 1:
# Connect to the server via ssh or access the shell via the console.
# Connect to the server via ssh or access the shell via the console.
# Type '''sudo nano /etc/apache2/sites-enabled/default-ssl.conf'''
# Type in the following, and then press Enter: <pre>sudo nano /etc/apache2/sites-enabled/default-ssl.conf</pre>
# Locate the line in the file '''SSLProtocol ALL -SSLv2'''
# Locate the line in the file <pre>SSLProtocol ALL -SSLv2</pre>
# Comment out this line by placing a '''#''' at the beginning of the line.
# Comment out this line by placing a '''#''' at the beginning of the line.
# Add the following lines below the line that you just commented out:
# Add the following lines below the line that you just commented out:
#: '''SSLProtocol ALL -SSLv2 -SSLv3'''
<pre>SSLProtocol ALL -SSLv2 -SSLv3 -TLSv1
#: '''SSLHonorCipherOrder On'''
SSLHonorCipherOrder On
#: '''SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS'''
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS</pre>
# Press '''CTRL-X''' to exit
# Type '''CTRL-X''' and then press Enter to exit.
# Enter '''Y''' to save changes.
# Enter '''Y''' to save changes.
# Do not change the name and press enter to save the changes.
# Do not change the name and press Enter to save the changes.
# Type '''sudo nano /etc/apache2/apache2.conf'''
# Type in the following, and then press Enter: <pre>sudo nano /etc/apache2/apache2.conf</pre>
# Scroll to the bottom of the file.
# Scroll to the bottom of the file.
# Add the following lines:
# Add the following lines:
#: '''SSLProtocol ALL -SSLv2 -SSLv3'''
<pre>SSLProtocol ALL -SSLv2 -SSLv3 -TLSv1
#: '''SSLHonorCipherOrder On'''
SSLHonorCipherOrder On
#: '''SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS'''
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS</pre>
# Press '''CTRL-X''' to exit
# Type '''CTRL-X''' and then press Enter to exit.
# Enter '''Y''' to save changes.
# Enter '''Y''' to save changes.
# Do not change the name and press enter to save the changes.
# Do not change the name, and press Enter to save the changes.
# Type '''sudo service apache2 restart'''
# Type in the following, and then press Enter: <pre>sudo service apache2 restart</pre>


You can verify the active ciphers by running the following command:
You can verify the active ciphers by running the following command:


'''nmap -sV --script ssl-enum-ciphers -p 443 <host>'''
<pre>nmap -sV --script ssl-enum-ciphers -p 443 <host></pre>

Latest revision as of 19:03, 16 January 2020

  1. Connect to the server via ssh or access the shell via the console.
  2. Type in the following, and then press Enter: 
    sudo nano /etc/apache2/sites-enabled/default-ssl.conf
  3. Locate the line in the file 
    SSLProtocol ALL -SSLv2
  4. Comment out this line by placing a # at the beginning of the line.
  5. Add the following lines below the line that you just commented out:
SSLProtocol ALL -SSLv2 -SSLv3 -TLSv1
SSLHonorCipherOrder On
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
  1. Type CTRL-X and then press Enter to exit.
  2. Enter Y to save changes.
  3. Do not change the name and press Enter to save the changes.
  4. Type in the following, and then press Enter: 
    sudo nano /etc/apache2/apache2.conf
  5. Scroll to the bottom of the file.
  6. Add the following lines:
SSLProtocol ALL -SSLv2 -SSLv3 -TLSv1
SSLHonorCipherOrder On
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
  1. Type CTRL-X and then press Enter to exit.
  2. Enter Y to save changes.
  3. Do not change the name, and press Enter to save the changes.
  4. Type in the following, and then press Enter: 
    sudo service apache2 restart

You can verify the active ciphers by running the following command: 

nmap -sV --script ssl-enum-ciphers -p 443 <host>
Retrieved from "https://ivs.help/wiki/index.php?title=Apache_SSL/TLS_Security_Settings&oldid=4165"