Differences

This shows you the differences between two versions of the page.

--- linux_wiki:apache_http_server [2018/02/22 23:10]
billdozor [ssl.conf]
+++ linux_wiki:apache_http_server [2018/03/23 16:10]
billdozor [SSL Verification]
@@ Line 112: / Line 112: @@
   * Default: NameVirtualHost *:80 (and commented out)
-Disable Trace/Track (a XSS Vulnerability)
+Security Configs
 <code bash>
+##-- Security --##
+#- Information Disclosure -#
+ServerTokens Prod
+ServerSignature Off
+# FileETag: File attributes used to create the ETag HTTP response header for static files
+FileETag -INode +MTime +Size
+#- Web Application Security -#
+# Trace/Track - disabled for security purposes
 TraceEnable Off
+# Cross-Frame Scripting prevention (click jacking)
+# DENY = Deny all attempts to frame the page
+Header always append X-Frame-Options DENY
+# Cross Site Scripting protection
+Header set X-XSS-Protection "1; mode=block"
+Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
+##-- End of Security Settings --##
 </code>
@@ Line 133: / Line 152: @@
 Protocol and Ciphers
 <code bash>
-SSLProtocol TLSv1.2 +TLSv1.1 +TLSv1
+SSLProtocol TLSv1.2
-SSLCipherSuite HIGH:!DHE:!EDH:!RC4:!ADH:!MEDIUM
+SSLCipherSuite HIGH:!MEDIUM:!3DES:!ADH:!AECDH:!DHE:!EDH:!RC4
 </code>
   * Default SSLProtocol: all -SSLv2
@@ Line 144: / Line 163: @@
 </code>
-==== SSL Verification ====
-Check what ciphers will be used given an Apache config
+----
-<code bash>
-openssl ciphers -v 'HIGH:!DHE:!EDH:!RC4:!ADH:!MEDIUM'
-</code>
-Verify server offered ciphers
+===== Other Security Settings =====
-<code bash>
-sslscan --no-failed 10.1.2.3:443
+Other important security settings.
-</code>
-  * Look for "Supported Server Cipher(s)" and "Preferred Server Cipher(s)"
+==== Redirect HTTP to HTTPS ====
+Redirect all HTTP to HTTPS<code bash><VirtualHost *:80>
+  ServerName example.com
+  <IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteCond %{HTTPS} off
+    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
+  </IfModule>
+</VirtualHost></code>
+----
+==== HSTS ====
+Enabling HTTPS Strict Transport Security (HSTS).
+Add the strict transport security header to the listening HTTPS host section
+<code bash># Optionally load the headers module:
+LoadModule headers_module modules/mod_headers.so
+<VirtualHost *:443>
+    Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"
+</VirtualHost></code>
+  * max-age=63072000 -> Tell web browsers to connect to the site using HTTPS only for two years. Countdown is reset each time the site is visited.
 ----