Monday, January 7, 2008

Apache, restrict connections to SSL 3.0 and ensure strong encryption

For my Apache I wanted disable SSL 2.0 as recommended by Nessus rules 20007 , and to disable weak SSL ciphers as recommended by Nessus rule 26928.

When looking around I found a nice description at Novell:

  • Use only High and Medium security cipher suites, such as RC4 and RSA.
  • Remove from consideration any ciphers that do not authenticate, such as Anonymous Diffie-Hellman (ADH) ciphers.
  • Use SSL 3.0, and disable SSL 2.0.
  • Disable the Low, Export, and Null cipher suites.
So for Apache I did the following:
Open the /etc/httpd/conf/httpd.conf file in a text editor, then locate the SSLCipherSuite directive in the Virtual Hosts section:
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

Modify the plus (+) to a minus (-) in front of the ciphers you want to disable and make sure there is a ! (not) before ADH:
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:-eNULL

I will check Nessus scan output after the changes.

No comments: