EndRun Sonoma D12, Руководство пользователя

Страница: 64 / 172

S o n o m a U s e r M a n u a l 48
C H A P T E R F I V E
Configure Certificate and Key
For SSL it is recommended, but not required, that new certificates and keys are generated and
installed on the Apache web server with mod_ssl. The factory configured, self-signed certificate is
located in /etc/httpd/server.crt , and the key in /etc/httpd/server.key . After creating new certificates and
private keys, they will need to be saved in /boot/etc/httpd/server.crt and /boot/etc/httpd/server.key . To
generate a new certificate and key, issue these commands:
cd /boot/etc/httpd
openssl req -new -x509 -nodes -out server.crt -keyout server.key
The two files will be created in the /boot/etc/httpd directory. You must reboot the Sonoma for them
to take effect. An excellent book which describes operation and configuration of the various HTTPS
directives and SSL configuration is:
Professional Apache , Wainwright, Wrox Press, 1999.
NTP
You can configure your NTP clients for secure MD5 authentication. See Chapter 3 - NTP, Unix-like
Platforms: MD5 Authenticated NTP Client Setup
or
Chapter 3 - NTP, Windows: MD5 Authenti-
cated NTP Client Setup . You can also restrict NTP query access. See Restrict Query Access - NTP
in this chapter.
Network Security
Vulnerabilities
EndRun addresses major network security vulnerabilities that affect Sonoma at the top of this web-
page:
http://www.endruntechnologies.com/fsb.htm
This Application Note describes best practices to secure your time server and mitigate many network
security vulnerabilities:
http://www.endruntechnologies.com/pdf/AppNoteSecurity.pdf