Novell IFOLDER 3.7 - SECURITY ADMINISTRATION, Administration Manual

Page: 160 / 216

160 OES 2 SP1: Novell iFolder 3.7 Administration Guide
no
vd
ocx
(e
n)
13
Ma
y 20
09
To set these parameters, modify the aliases in the OpenSSL* ciphers command (the SSLCipherSuite
directive) in the
/etc/apache2/vhosts.d/vhost-ssl.conf
file.
1
Stop the Apache server: At a terminal console, enter
/etc/init.d/apache2 stop
2 Open the
/etc/apache2/vhosts.d/vhost-ssl.conf
file in a text editor, then locate the
SSLCipherSuite directive in the Virtual Hosts section:
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+LOW:+SSLv2:+EXP:+eNULL
3 Modify the plus (
+
) to a minus (
-
) in front of the ciphers you want to disable and make sure
there is a
!
(not) before ADH:
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:-eNULL
4 Save your changes.
5 Start the Apache server: At a terminal console, enter
/etc/init.d/apache2 start
For more information about configuring strong SSL/TLS security solutions, see SSL/TLS Strong
Encryption: How-To (http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html) on the Apache.org Web
site.
13.5.3 Configuring the Web Access Server for SSL
Communications with the Enterprise Server
The setting is stored in the
/opt/novell/ifolder3/lib/simias/webaccess/Web.config
file
under the following tag:
<add key="SimiasUrl" value="https://localhost" />
<add key="SimiasCert" value=< raw certificate data in base 64 encoding > />
If you disable SSL between Web Access server and the enterprise server and if the two servers are
on different machines, you must also disable the iFolder server SSL requirement. Because the
enterprise SSL setting also controls the traffic between the enterprise server and the client, all Web
traffic between servers and between the clients and the enterprise server would be insecure.
IMPORTANT: Do not disable SSL on the Web Access server if the two servers are on different
machines.
If the two servers are running on the same machine and you want to disable SSL, rerun the YaST
configuration, and specify
http://localhost
as the URL for the enterprise server. By default, the
Web Browser is configured to communicate with the iFolder Web Access server via SSL and to the
iFolder Enterprise server via non-SSL. iFolder uses HTTP BASIC for authentication, which means
passwords are sent to the server in the clear. If the iFolder deployment is in large scale and the Web
Access server is on a different machine than the iFolder enterprise server, an Administrator could
reconfigure to enable SSL between the Web Access Server and the iFolder Enterprise Server, which
would increase the security for communications between the two servers. This is a recommended
setting