Difference between revisions of "Apache SSL/TLS Security Settings"
IVSWikiBlue (talk | contribs) |
IVSWikiBlue (talk | contribs) |
||
| Line 1: | Line 1: | ||
# Connect to the server via ssh or access the shell via the console. | # Connect to the server via ssh or access the shell via the console. | ||
| − | # Type | + | # Type in the following, and then press Enter: <pre>sudo nano /etc/apache2/sites-enabled/default-ssl.conf</pre> |
| − | # Locate the line in the file | + | # Locate the line in the file <pre>SSLProtocol ALL -SSLv2</pre> |
# Comment out this line by placing a '''#''' at the beginning of the line. | # Comment out this line by placing a '''#''' at the beginning of the line. | ||
# Add the following lines below the line that you just commented out: | # Add the following lines below the line that you just commented out: | ||
| − | + | <pre>SSLProtocol ALL -SSLv2 -SSLv3 | |
| − | + | SSLHonorCipherOrder On | |
| − | + | SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS</pre> | |
# Press '''CTRL-X''' to exit. | # Press '''CTRL-X''' to exit. | ||
# Enter '''Y''' to save changes. | # Enter '''Y''' to save changes. | ||
# Do not change the name and press enter to save the changes. | # Do not change the name and press enter to save the changes. | ||
| − | # Type | + | # Type in the following, and then press Enter: <pre>sudo nano /etc/apache2/apache2.conf</pre> |
# Scroll to the bottom of the file. | # Scroll to the bottom of the file. | ||
# Add the following lines: | # Add the following lines: | ||
| − | + | <pre>SSLProtocol ALL -SSLv2 -SSLv3 | |
| − | + | SSLHonorCipherOrder On | |
| − | + | SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS</pre> | |
| − | # | + | # Type '''CTRL-X''' and then press Enter to exit. |
# Enter '''Y''' to save changes. | # Enter '''Y''' to save changes. | ||
# Do not change the name, and press '''Enter''' to save the changes. | # Do not change the name, and press '''Enter''' to save the changes. | ||
| − | # Type | + | # Type in the following, and then press Enter: <pre>sudo service apache2 restart</pre> |
You can verify the active ciphers by running the following command: | You can verify the active ciphers by running the following command: | ||
| − | + | <pre>nmap -sV --script ssl-enum-ciphers -p 443 <host></pre> | |
Revision as of 11:04, 24 April 2019
- Connect to the server via ssh or access the shell via the console.
- Type in the following, and then press Enter:
sudo nano /etc/apache2/sites-enabled/default-ssl.conf
- Locate the line in the file
SSLProtocol ALL -SSLv2
- Comment out this line by placing a # at the beginning of the line.
- Add the following lines below the line that you just commented out:
SSLProtocol ALL -SSLv2 -SSLv3 SSLHonorCipherOrder On SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
- Press CTRL-X to exit.
- Enter Y to save changes.
- Do not change the name and press enter to save the changes.
- Type in the following, and then press Enter:
sudo nano /etc/apache2/apache2.conf
- Scroll to the bottom of the file.
- Add the following lines:
SSLProtocol ALL -SSLv2 -SSLv3 SSLHonorCipherOrder On SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
- Type CTRL-X and then press Enter to exit.
- Enter Y to save changes.
- Do not change the name, and press Enter to save the changes.
- Type in the following, and then press Enter:
sudo service apache2 restart
You can verify the active ciphers by running the following command:
nmap -sV --script ssl-enum-ciphers -p 443 <host>
