Novell IFOLDER 3.7 - SECURITY ADMINISTRATION, Administration Manual

Page: 118 / 216

118 OES 2 SP1: Novell iFolder 3.7 Administration Guide
no
vd
ocx
(e
n)
13
Ma
y 20
09
Š
Section 9.11.2, “Configuring the SSL Cipher Suites for the Apache Server,” on page 118
Š
Section 9.11.3, “Configuring the Enterprise Server for SSL Communications with the LDAP
Server,” on page 119
Š
Section 9.11.4, “Configuring the Enterprise Server for SSL Communications with the iFolder
Client,” on page 119
Š
Section 9.11.5, “Configuring the Enterprise Server for SSL Communications with the Web
Access Server and Web Admin Server,” on page 120
Š Section 9.11.6, “Configuring an SSL Certificate for the Enterprise Server,” on page 120
For information about configuring SSL traffic for the iFolder Web access server, see Section 13.5,
“Securing Web Access Server Communications,” on page 159 .
9.11.1 Using SSL for Secure Communications
In a default deployment, the iFolder 3 enterprise server uses SSL 3.0 for secure communications
between components as shown in the following table.
iFolder uses the SSL 3.0 protocol instead of SSL 2.0 because it provides authentication, encryption,
integrity, and non-repudiation services for network communications. During the SSL handshake, the
server negotiates the cipher suite to use, establishes and shares a session key between client and
server, authenticates the server to the user, and authenticates the user to the server.
The key exchange method defines how the shared secret symmetric cryptography key used for
application data transfer will be agreed upon by client and server. SSL 2.0 uses only RSA key
exchange, while SSL 3.0 supports a choice of key exchange algorithms, including the RC4 and RSA
key exchange, when certificates are used, and Diffie-Hellman key exchange for exchanging keys
without certificates and without prior communication between client and server. SSL 3.0 also
supports certificate chains, which allows certificate messages to contain multiple certificates and
support certificate hierarchies.
9.11.2 Configuring the SSL Cipher Suites for the Apache
Server
To restrict connections to SSL 3.0 and to ensure strong encryption, we strongly recommend the
following configuration for the Apache server’s SSL cipher suite settings.
Š Use only High and Medium security cipher suites, such as RC4 and RSA.
Š
Remove from consideration any ciphers that do not authenticate, such as Anonymous Diffie-
Hellman (ADH) ciphers.
Š Use SSL 3.0, and disable SSL 2.0.
Š
Disable the Low, Export, and Null cipher suites.
iFolder Component Web Access Server LDAP Server Client Web Browser
Enterprise Server
Yes Yes Yes yes