Apache SSL/TLS Security Settings: Difference between revisions

From IVS Wiki
Jump to navigation Jump to search
Newer edit →
Created page with "# Connect to the server via ssh or access the shell via the console. # Type '''sudo nano /etc/apache2/sites-enabled/default-ssl.conf''' # Locate the line in the file '''SSLPro..."
 
No edit summary
Line 4: Line 4:
# Comment out this line by placing a '''#''' at the beginning of the line.
# Comment out this line by placing a '''#''' at the beginning of the line.
# Add the following lines below the line that you just commented out:
# Add the following lines below the line that you just commented out:
#: '''SSLProtocol ALL -SSLv2 -SSLv3'''
#: '''SSLHonorCipherOrder On'''
#: '''SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS'''
# Press '''CTRL-X''' to exit
# Enter '''Y''' to save changes.
# Do not change the name and press enter to save the changes.
# Type '''sudo nano /etc/apache2/apache2.conf'''
# Scroll to the bottom of the file.
# Add the following lines:
#: '''SSLProtocol ALL -SSLv2 -SSLv3'''
#: '''SSLProtocol ALL -SSLv2 -SSLv3'''
#: '''SSLHonorCipherOrder On'''
#: '''SSLHonorCipherOrder On'''
Line 11: Line 20:
# Do not change the name and press enter to save the changes.
# Do not change the name and press enter to save the changes.
# Type '''sudo service apache2 restart'''
# Type '''sudo service apache2 restart'''
You can verify the active ciphers by running the following command:
'''nmap -sV --script ssl-enum-ciphers -p 443 <host>'''

Revision as of 15:16, 22 January 2018

  1. Connect to the server via ssh or access the shell via the console.
  2. Type sudo nano /etc/apache2/sites-enabled/default-ssl.conf
  3. Locate the line in the file SSLProtocol ALL -SSLv2
  4. Comment out this line by placing a # at the beginning of the line.
  5. Add the following lines below the line that you just commented out:
    SSLProtocol ALL -SSLv2 -SSLv3
    SSLHonorCipherOrder On
    SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
  6. Press CTRL-X to exit
  7. Enter Y to save changes.
  8. Do not change the name and press enter to save the changes.
  9. Type sudo nano /etc/apache2/apache2.conf
  10. Scroll to the bottom of the file.
  11. Add the following lines:
    SSLProtocol ALL -SSLv2 -SSLv3
    SSLHonorCipherOrder On
    SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
  12. Press CTRL-X to exit
  13. Enter Y to save changes.
  14. Do not change the name and press enter to save the changes.
  15. Type sudo service apache2 restart

You can verify the active ciphers by running the following command:

nmap -sV --script ssl-enum-ciphers -p 443 <host>

Retrieved from "https://ivs.help/wiki/index.php?title=Apache_SSL/TLS_Security_Settings&oldid=2138"