Sun Microsystems Netscape Enterprise Server, Administrator'S Manual

Page: 75 / 532

Chapter 3, Setting Administration Preferences 75
Specifying Log File Options
In the domestic version of Enterprise Server, the Stronger Ciphers option
presents a choice of 168, 128, or 56-bit secret keysize restriction, or no
restriction. In the export version, this option presents a choice of 56-bit secret
keysize or no restriction. For both versions, a filename to be served when the
restriction is not met can be specified. If no filename is specified, Enterprise
Server returns a “Forbidden” status.
If you select a restriction that is not consistent with the current cipher settings
under Security Preferences, Enterprise Server displays a popup dialog that
warns that you need to enable ciphers with larger secret keysizes.
The implementation of the keysize restriction is now based on an NSAPI
PathCheck
directive, rather than Service
fn=key-toosmall
. This directive
is:
PathCheck fn="ssl-check" [secret-keysize=<nbits>] [bong-file=<filename>]
where
<nbits>
is the minimum number of bits required in the secret key, and
<filename>
is the name of a file (not a URI) to be served if the restriction is
not met.
This function returns
REQ_NOACTION
if SSL is not enabled, or if the
secret-
keysize
parameter is not specified. If the secret keysize for the current
session is less than the specified
secret-keysize
, the function returns
REQ_ABORTED
with a status of
PROTOCOL_FORBIDDEN
if
bong-file
is not
specified, or else
REQ_PROCEED
, and the “path” variable is set to the
bong-
file <filename>
. Also, when a keysize restriction is not met, the SSL session
cache entry for the current session is invalidated, so that a full SSL handshake
will occur the next time the same client connects to the server.
Note
The Stronger Ciphers form removes any Service
fn=key-toosmall
directives
that it finds in an object when it adds a PathCheck
fn=ssl-check
.
For more information, see “The Enforce Strong Security Requirements Page,” in
the online help.
Specifying Log File Options
Log files can help you monitor your server’s activity. You can use these logs to
monitor your server and troubleshoot problems.