Template /etc/httpd/conf.d/ssl.conf

[dnutan (Marc)]

IIRC some settings are templated in other drop-in files under /etc/httpd/conf.d/

Like you I’d also prefer a more secure default configuration, as of now it follows upstream defaults. It was discussed in the past:

More secure SSL CipherSuites

Continuing the discussion from Letsencrypt certificate produces SSL error: NethServer Version: v7 Module: ssl I would propose to change the CipherSuites in /etc/httpd/conf.d/ssl.conf and /etc/httpd/admin-conf/httpd.conf and disabling SSL3 in the former: SSLProtocol all -SSLv2 -SSLv3 SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128…

Webserver not as safe as expected?

SSLv3 is disabled in httpd-admin instance, but not in httpd. We use SSL configuration from upstream, you can freely change the /etc/httpd/conf.d/ssl.conf configuration file. Probably you hit this bug (check for the workaround inside the issue itself): Maybe it’s related to not very secure cipher suits. You can change it using: config setprop httpd SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH signal-event nethserver-httpd-update Said this, we choose to stay complia…

Webserver not as safe as expected?

httpd-admin on port 980/https is publicly available from the internet. The main httpd instance on port 443/https has the upstream default. It is not secured with the state-of-the-art settings, I think because the default config file does not change during the release life cycle. The CentOS sysadmin knows it and fixes httpd configuration properly. In NethServer our sysadmin is the template system. I think in this specific case the follow upstream default rule does not fit properly. Let’s fix t…

Nethserver and TLS/SSLv3

I was following a discussion on another server platform I use, and an issue about TLS and accepted ciphers and protocols… When I decided to investigate what protocols and ciphers my Nethserver advertises: [root@neth ~]# nmap --script ssl-enum-ciphers -p 465 127.0.0.1 Starting Nmap 5.51 ( http://nmap.org ) at 2015-06-17 07:44 CDT Nmap scan report for localhost (127.0.0.1) Host is up (0.00013s latency). PORT STATE SERVICE 465/tcp open smtps | ssl-enum-ciphers: | SSLv3 | Ciphers (30) |…

The NethServer server is a winner even if not perfect

Many ICT administrators and executives looking for compensation for the Microsoft TMG (ISA) server. In the framework of a professional discussion with my colleagues, we selected three candidates IPFire, IPCop and pfSense. We have recently begun pfSense but it is rather problematic. Unfortunately, we was did not know NethServer : Now we using for testing NethServer in full operation in a small company (about 50 employees). NethServer works well. If we succeed with developers NethServ…

Disabling SSLv2, SSLv3, and other tweaks wanted

NethServer Version: v7 Module: v7-rc2 I currently have a webserver and Nextcloud accessible across the internet. I noticed that default settings in Apache and NextCloud have some concerns, such as using SSLv2 and SSLv3 (Poodle Vulnerability in SSLv3), and the RC4 cipher by default, which I would like to disable. I previously had a webserver running on Arch Linux, and used SSL Server Test to find and help close vunerabilities. A simple edit of relevant config files was all it took to close th…

NethServer distro is installed with the support of weak ciphers

Continuing the discussion from The NethServer server is a winner even if not perfect:

Hardening ssl - Qualys analysis

The httpd/SSLCipherSuite prop has been changed to that value on 6.7 release. The new default value comes from upstream. This entire story is on http://dev.nethserver.org/issues/3246 To customize it config setprop httpd SSLCipherSuite signal-event nethserver-httpd-update

The developers manual describes how to change the SSLCipherSuite db property.