Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in

  FAQ | Search | Memberlist | Usergroups | Statistics | Profile | Log in to check your private messages | Log in | Register

Disabling weak ssl ciphers in apache [solved]
 View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
gr0x0rd
Guru
Guru


Joined: 12 Aug 2006
Posts: 311
PostPosted: Tue Mar 09, 2010 6:52 pm    Post subject: Disabling weak ssl ciphers in apache [solved] Reply with quote
Hello all,

I'm going through the fun task of making one of my servers PCI compliant so it can begin processing electronic payments.

One of the conditions was to eliminate SSLv2 support; this was easy enough, in my /etc/apache2/httpd.conf I simply added
Code:
SSLProtocol -all +TLSv1 +SSLv3
However, after running an SSL check (such as the one at serversniff.net) I noticed that the server was still allowing weak 56 and 40 bit ciphers.

After some RTFM and a few examples around the web, I added the following directive:
Code:
SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
However... my server is still supporting those weak ciphers. In fact, apache doesn't seem to change its behavior, no matter what I put in this line, almost like it's being ignored entirely.

Any ideas? I'm running apache 2.2.14-r1 and openssl 0.9.8l-r2.

Thanks as always.
_________________
~g
emerge -FML...

Last edited by gr0x0rd on Wed Mar 10, 2010 1:49 am; edited 1 time in total
Back to top
View user's profile Send private message
gr0x0rd
Guru
Guru


Joined: 12 Aug 2006
Posts: 311
PostPosted: Wed Mar 10, 2010 1:49 am    Post subject: Reply with quote
The problem was the line was being overridden by a line in

/etc/apache2/vhosts.d/00_default_ssl_vhost.conf

Where the SSLCipherSuite directive is already provided by the gentoo devs... ;)

Hopefully this helps anyone else that runs into the issue.
_________________
~g
emerge -FML...
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



 Links: forums.gentoo.org | www.gentoo.org | bugs.gentoo.org | wiki.gentoo.org | forum-mods@gentoo.org

Copyright 2001-2025 Gentoo Foundation, Inc. Designed by Kyle Manna © 2003; Style derived from original subSilver theme. | Hosting by Gossamer Threads Inc. © | Powered by phpBB 2.0.23-gentoo-p11 © 2001, 2002 phpBB Group
Privacy Policy