Bugzilla – Attachment 106645 Details for
Bug 25948
Clean up apache protocols and ciphers
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 25948: Clean up apache-site-https a little
Bug-25948-Clean-up-apache-site-https-a-little.patch (text/plain), 3.69 KB, created by
Mark Tompsett
on 2020-07-07 21:28:36 UTC
(
hide
)
Description:
Bug 25948: Clean up apache-site-https a little
Filename:
MIME Type:
Creator:
Mark Tompsett
Created:
2020-07-07 21:28:36 UTC
Size:
3.69 KB
patch
obsolete
>From 7863ed1f85673fc0626181e7af8b05f9b1778d44 Mon Sep 17 00:00:00 2001 >From: Mark Tompsett <mtompset@hotmail.com> >Date: Tue, 7 Jul 2020 17:04:21 -0400 >Subject: [PATCH] Bug 25948: Clean up apache-site-https a little > >- removed ECDHE-RSA-AES256-SHA384, as it downgrades to CBC use > https://ciphersuite.info/cs/TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384/ >- added DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256 >- added ECDHE-ECDSA-AES256-SHA384 >- removed cut-off ECDHE-RSA-SA- and ECDHE-RSA-AES >- made OPAC and Intranet sections match >- removed TLSv1 > https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html > https://blogs.windows.com/msedgedev/2020/03/31/tls-1-0-tls-1-1-schedule-update-edge-ie11/ > https://www.entrustdatacard.com/blog/2018/november/deprecating-tls >- did not remove TLSv1.1 as this would break support for older browsers > probably still in use. >- did not add TLSv1.3 as it depends on OS used and version of openSSL if > it is supported or not. > >This may break support for some things, but nothing semi-current. I >don't care about ie 11 on windows 8.1 phones, or safari 6-8. > >Also, people using letsencrypt.org should look into using a DNS CAA record >for their opac site URL, issued by letsencrypt.org with flags set to 0. > >This affects the installation using: >sudo koha-create --letsencrypt --create-db instance > >BEFORE using this command recently, I needed to disable the >000-default site, and had to create a directory >/usr/share/koha/intranet/htdocs/.well-known/acme-challenge >which I also softlinked from >/usr/share/koha/opac/htdocs/.well-known/acme-challenge to >the intranet one. >--- > debian/templates/apache-site-https.conf.in | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > >diff --git a/debian/templates/apache-site-https.conf.in b/debian/templates/apache-site-https.conf.in >index 196a415b8e..863925a846 100644 >--- a/debian/templates/apache-site-https.conf.in >+++ b/debian/templates/apache-site-https.conf.in >@@ -12,10 +12,10 @@ > # OPAC > <VirtualHost *:80> #https > # SSLEngine on >-# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 >+# SSLProtocol -all +TLSv1.2 +TLSv1.1 > # SSLCompression off > # SSLHonorCipherOrder on >-# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA- >+# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256" > # SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem > # SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem > # SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem >@@ -39,10 +39,10 @@ > # Intranet > <VirtualHost *:80> #https > # SSLEngine on >-# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 >+# SSLProtocol -all +TLSv1.2 +TLSv1.1 > # SSLCompression off > # SSLHonorCipherOrder on >-# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES >+# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256" > # SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem > # SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem > # SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 25948
: 106645