Differences between revisions 3 and 4

httpd security Tips (Centos6,7,8)

1. /etc/httpd/conf/httpd.conf の DocumentRootの直前ぐらいに以下を追記する

ServerTokens Prod
ServerSignature Off
TraceEnable Off
# httproxy
RequestHeader unset Proxy
Header unset X-Powered-By
# Click Jack
Header append X-FRAME-OPTIONS "SAMEORIGIN"
# XSS
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options nosniff
#

2. /etc/httpd/conf.d/ssl.conf 中、SSLCipherSuite のところは

https://mozilla.github.io/server-side-tls/ssl-config-generator/

に httpd の version と openssl のversion を入力すると suggestionが出てくるのでそれをコピペする。例えば CentOS 8.0.1905 の場合は

httpd-2.4.37
openssl-1.1.1

なので上記を入れると https://ssl-config.mozilla.org/#server=apache&server-version=2.4.37&config=intermediate&openssl-version=1.1.1 となるので、以下を　/etc/httpd/conf.d/ssl.conf 中に入れる。

SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder     off
SSLSessionTickets       off

-  ⇤ ← Revision 3 as of 2019-09-27 06:42:42 → 
  Size: 1766
  Editor: TakashiIchihara
  Comment:
+   ← Revision 4 as of 2019-09-27 06:43:54 → ⇥
  Size: 2204
  Editor: TakashiIchihara
  Comment:
-Deletions are marked like this.
+Additions are marked like this.
 Line 43:
-となる。
+となるので、以下を　/etc/httpd/conf.d/ssl.conf 中に入れる。

{{{
SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder     off
SSLSessionTickets       off

}}}

Diff for "httpd-security"

httpd security Tips (Centos6,7,8)