Difference between revisions of "Apache SSL/TLS Security Settings"

From IVS Wiki
Jump to: navigation, search
(Created page with "# Connect to the server via ssh or access the shell via the console. # Type '''sudo nano /etc/apache2/sites-enabled/default-ssl.conf''' # Locate the line in the file '''SSLPro...")
 
Line 4: Line 4:
 
# Comment out this line by placing a '''#''' at the beginning of the line.
 
# Comment out this line by placing a '''#''' at the beginning of the line.
 
# Add the following lines below the line that you just commented out:
 
# Add the following lines below the line that you just commented out:
 +
#: '''SSLProtocol ALL -SSLv2 -SSLv3'''
 +
#: '''SSLHonorCipherOrder On'''
 +
#: '''SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS'''
 +
# Press '''CTRL-X''' to exit
 +
# Enter '''Y''' to save changes.
 +
# Do not change the name and press enter to save the changes.
 +
# Type '''sudo nano /etc/apache2/apache2.conf'''
 +
# Scroll to the bottom of the file.
 +
# Add the following lines:
 
#: '''SSLProtocol ALL -SSLv2 -SSLv3'''
 
#: '''SSLProtocol ALL -SSLv2 -SSLv3'''
 
#: '''SSLHonorCipherOrder On'''
 
#: '''SSLHonorCipherOrder On'''
Line 11: Line 20:
 
# Do not change the name and press enter to save the changes.
 
# Do not change the name and press enter to save the changes.
 
# Type '''sudo service apache2 restart'''
 
# Type '''sudo service apache2 restart'''
 +
 +
You can verify the active ciphers by running the following command:
 +
 +
'''nmap -sV --script ssl-enum-ciphers -p 443 <host>'''

Revision as of 09:16, 22 January 2018

  1. Connect to the server via ssh or access the shell via the console.
  2. Type sudo nano /etc/apache2/sites-enabled/default-ssl.conf
  3. Locate the line in the file SSLProtocol ALL -SSLv2
  4. Comment out this line by placing a # at the beginning of the line.
  5. Add the following lines below the line that you just commented out:
    SSLProtocol ALL -SSLv2 -SSLv3
    SSLHonorCipherOrder On
    SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
  6. Press CTRL-X to exit
  7. Enter Y to save changes.
  8. Do not change the name and press enter to save the changes.
  9. Type sudo nano /etc/apache2/apache2.conf
  10. Scroll to the bottom of the file.
  11. Add the following lines:
    SSLProtocol ALL -SSLv2 -SSLv3
    SSLHonorCipherOrder On
    SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
  12. Press CTRL-X to exit
  13. Enter Y to save changes.
  14. Do not change the name and press enter to save the changes.
  15. Type sudo service apache2 restart

You can verify the active ciphers by running the following command:

nmap -sV --script ssl-enum-ciphers -p 443 <host>

Retrieved from "https://ipivs.info/wiki/index.php?title=Apache_SSL/TLS_Security_Settings&oldid=2138"