Table of Contents
Advertisement
For more information about SSL 3.0, see
on page
118.
10.7.2 Configuring the SSL Cipher Suites for the Apache
Server
To restrict connections to SSL 3.0 and to ensure strong encryption, we strongly recommend the
following configuration for the Apache server's SSL cipher suite settings.
Use only High and Medium security cipher suites, such as RC4 and RSA.
Remove from consideration any ciphers that do not authenticate, such as Anonymous Diffie-
Hellman (ADH) ciphers.
Use SSL 3.0, and disable SSL 2.0.
Disable the Low, Export, and Null cipher suites.
To set these parameters, modify the aliases in the OpenSSL* ciphers command (the SSLCipherSuite
directive) in the
1 Stop the Apache server: At a terminal console, enter
/etc/init.d/apache2 stop
2 Open the
SSLCipherSuite directive in the Virtual Hosts section:
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
3 Modify the plus (
there is a
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:-eNULL
4 Save your changes.
5 Start the Apache server: At a terminal console, enter
/etc/init.d/apache2 start
For more information about configuring strong SSL/TLS security solutions, see
Encryption: How-To (http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html)
site.
10.7.3 Configuring the Web Admin Server for SSL
Communications with the Enterprise Server
By default, the Web Browser is configured to communicate with the iFolder Web Admin server via
SSL and to the iFolder Enterprise server via non-SSL. For most deployments, this setting should not
be changed as the Web Admin server is configured in the same iFolder Enterprise server for
performance reasons and iFolder uses HTTP BASIC for authentication, which means passwords are
sent to the server in the clear. If the iFolder deployment is in large scale and the Web Admin server
is on a different machine than the iFolder enterprise server, an Administrator could reconfigure to
enable SSL between the Web Admin Server and the iFolder Enterprise Server, which would increase
the security for communications between the two servers.
138 OES 2 SP1: Novell iFolder 3.7 Administration Guide
/etc/apache2/vhosts.d/vhost-ssl.conf
/etc/apache2/vhosts.d/vhost-ssl.conf
) to a minus (
) in front of the ciphers you want to disable and make sure
+
-
(not) before ADH:
!
Section 9.11.1, "Using SSL for Secure Communications,"
file.
file in a text editor, then locate the
SSL/TLS Strong
on the Apache.org Web
Advertisement
Table of Contents
