Package: apache2 Version: 2.4.10-5 Severity: important Tags: patch Here's a patch for the sample TLS configuration which follows Mozilla's intermediate compatibility config:
https://wiki.mozilla.org/Security/Server_Side_TLS#Apache It makes Apache pick the best possible ciphers (for example, giving users forward secrecy) and also recommends turning on HSTS to defeat sslstrip attacks. Also note that it disables SSLv3 to fix the POODLE attack discovered this week. Francois
diff --git a/debian/config-dir/sites-available/default-ssl.conf b/debian/config-dir/sites-available/default-ssl.conf index 432b965..6aaf5f2 100644 --- a/debian/config-dir/sites-available/default-ssl.conf +++ b/debian/config-dir/sites-available/default-ssl.conf @@ -24,6 +24,22 @@ # Enable/Disable SSL for this virtual host. SSLEngine on + # Mozilla's recommended intermediate compatibility cipher list + # https://wiki.mozilla.org/Security/Server_Side_TLS#Apache + SSLProtocol all -SSLv2 -SSLv3 + SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA + SSLHonorCipherOrder on + SSLCompression off + + # OCSP Stapling + #SSLUseStapling on + #SSLStaplingResponderTimeout 5 + #SSLStaplingReturnResponderErrors off + #SSLStaplingCache shmcb:/var/run/ocsp(128000) + + # Enable this if your want HSTS (recommended) + #Header add Strict-Transport-Security "max-age=15768000" + # A self-signed (snakeoil) certificate can be created by installing # the ssl-cert package. See # /usr/share/doc/apache2/README.Debian.gz for more info.
