Novell IFOLDER 3.7 - SECURITY ADMINISTRATION, Administration Manual

Page: 119 / 216

Managing an iFolder Enterprise Server 119
no
vd
ocx
(e
n)
13
Ma
y 20
09
To set these parameters, modify the aliases in the OpenSSL* ciphers command (the SSLCipherSuite
directive) in the
/etc/apache2/vhosts.d/vhost-ssl.conf
file.
1
Stop the Apache server: At a terminal console, enter
/etc/init.d/apache2 stop
2 Open the
/etc/httpd/conf/httpd.conf
file in a text editor, then locate the SSLCipherSuite
directive in the Virtual Hosts section:
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+LOW:+SSLv2:+EXP:+eNULL
3 Modify the plus (
+
) to a minus (
-
) in front of the ciphers you want to disable and make sure
there is a
!
(not) before ADH:
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:-eNULL
4 Save your changes.
5 Start the Apache server: At a terminal console, enter
/etc/init.d/apache2 start
For more information about configuring strong SSL/TLS security solutions, see SSL/TLS Strong
Encryption: How-To (http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html) on the Apache.org Web
site.
9.11.3 Configuring the Enterprise Server for SSL
Communications with the LDAP Server
By default, the iFolder enterprise server is configured to communicate via SSL with the LDAP
Server. For most deployments, this setting should not be changed. If the LDAP server is on the same
machine as the enterprise server, communications do not need to be secured with SSL.
1
Log in to Web Admin.
2 Click System in the Web Admin console to open the System page.
3 Select Enable SSL to enable LDAP SSL communication.
9.11.4 Configuring the Enterprise Server for SSL
Communications with the iFolder Client
By default, the iFolder enterprise server is not configured to require SSL. If set to use SSL, all
iFolder client communication to the server is encrypted using the SSL protocol. In most
deployments, this setting should not be changed because iFolder uses HTTP BASIC for
authentication, which means passwords are sent to the server in the clear. Without SSL encryption,
the iFolder data is also sent in the clear.
1
Stop the Apache server: At a terminal console, enter
/etc/init.d/apache2 stop
2 Go to
/opt/novell/ifolder3/bin
and run
simias-server-setup
3 Select
Yes
for the
Enable SSL
option.
4 Start Apache: At a terminal console, enter
/etc/init.d/apache2 start