How to Properly Secure SSL/TLS Apache Settings against Heartbleed Poodle (TLS) Poodle (SSLv3) FREAK BEAST CRIME -

How to Properly Secure SSL/TLS Apache Settings against Heartbleed Poodle (TLS) Poodle (SSLv3) FREAK BEAST CRIME

Many users still are not aware but simply patching OpenSSL does not secure you against many known and easy to exploit attacks that will render your encryption useless by an attacker.

Use the following setings in /etc/httpd/conf.d/ssl.conf
 

SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !CAMELLIA !SEED !3DES !RC4 !aNULL !eNULL !LOW !MD5 !EXP !PSK !SRP !DSS"
SSLProtocol -all +TLSv1.2 -SSLv3 -SSLv2

The above passed all tests on RapidSSL https://cryptoreport.rapidssl.com/checker/views/certCheck.jsp

Vulnerabilities checked:
  • Heartbleed
  • Poodle (TLS)
  • Poodle (SSLv3)
  • FREAK
  • BEAST
  • CRIME

Essentially what the above does is disable all known exploitable/weak ciphers and forces only TLS1.2 which is the only known secure version of TLS at this moment.  The settings above protect you against the listed vulnerabilities (just make sure you have a recent enough OpenSSL version that does support TLS 1.2, older distributions such as Centos 5 do not).


  • MySQL Adding New Field to Existing Database Table
  • MySQL Cannot Update/Write to any database table solution
  • Centos How To Update to Glibc 2.14 Plus
  • php remove last letters of string
  • MySQL Maximum INT Size Truncation Issue/Warning
  • MySQL How To Add New Field Column To Existing Table
  • mysql how to reset passwords with a few commands
  • htaccess apache how deny/allow to block or allow by IP address
  • PHP geoip.so fatal error Solution
  • Syntax error on line 221 of /etc/httpd/conf/httpd.conf: Syntax error on line 6 of /etc/httpd/conf.d/php.conf: Cannot load /etc/httpd/modules/libphp5.so into server: /etc/httpd/modules/libphp5.so: cannot open shared object file: No such file or direct
  • GCC 5 on Centos 6 - How To Install
  • bash find line and replace howto
  • How To Create Apache htpasswd file
  • possible SYN flooding on ctid 42131, port 80. Sending cookies. - Solution
  • Linux last command show login by IP instead of hostname
  • Install Windows From a Linux TFTP Server instead of using WDS Solution
  • How To Secure Samba NMBD/SMBD to bind to a specific IP address
  • tftp: client does not accept options - solution if you are using UEFI PXEBoot disable it!
  • Linux how to view video card make and exact model
  • Authentication refused: bad ownership or modes for directory /home/user SSH Public Key Authentication Failed Solution