Ubuntu
apache2 package

harden default ssl settings

Bug #1358305 reported by Christoph_vW
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
apache2 (Ubuntu)
Fix Released
Medium
Unassigned

Bug Description

Apache 2 default ssl configuration should be hardened to get better overall ssl security

my proposal:

/etc/apache2/mods-available/ssl.conf

SSLHonorCipherOrder on
SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA256:DHE-RSA-DES-CBC3-SHA:DHE-RSA-AES128-SHA:DES-CBC3-SHA

SSLProtocol all -SSLv2 -SSLv3

SSLUseStapling on
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off
SSLStaplingCache shmcb:/var/run/ocsp(128000)

Revision history for this message
Robie Basak (racb) wrote :

Thank you for taking the time to report this bug and helping to make Ubuntu better.

This sort of change should be coordinated with Debian. Please could you check behaviour on Debian (sid), and if appropriate then file a bug there?

tags: added: needs-upstream-report
Changed in apache2 (Ubuntu):
importance: Undecided → Medium
Revision history for this message
Pierre Schweitzer (pierre-jean-schweitzer) wrote :

Disabling SSLv3 is WIP on Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=765347

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package apache2 - 2.4.10-8ubuntu2

---------------
apache2 (2.4.10-8ubuntu2) vivid; urgency=medium

  * Allow "triggers-awaited" and "triggers-pending" states in addition to
    "installed" when determining whether to defer actions or process
    deferred actions (LP: #1393832).
 -- Colin Watson <email address hidden> Wed, 26 Nov 2014 11:31:44 +0000

Changed in apache2 (Ubuntu):
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.