Novell IFOLDER 3.7 - SECURITY ADMINISTRATION, Руководство администратора

Страница: 138 / 216

138 OES 2 SP1: Novell iFolder 3.7 Administration Guide
no
vd
ocx
(e
n)
13
Ma
y 20
09
For more information about SSL 3.0, see Section 9.11.1, “Using SSL for Secure Communications,”
on page 118 .
10.7.2 Configuring the SSL Cipher Suites for the Apache
Server
To restrict connections to SSL 3.0 and to ensure strong encryption, we strongly recommend the
following configuration for the Apache server’s SSL cipher suite settings.
Š
Use only High and Medium security cipher suites, such as RC4 and RSA.
Š
Remove from consideration any ciphers that do not authenticate, such as Anonymous Diffie-
Hellman (ADH) ciphers.
Š Use SSL 3.0, and disable SSL 2.0.
Š
Disable the Low, Export, and Null cipher suites.
To set these parameters, modify the aliases in the OpenSSL* ciphers command (the SSLCipherSuite
directive) in the
/etc/apache2/vhosts.d/vhost-ssl.conf
file.
1 Stop the Apache server: At a terminal console, enter
/etc/init.d/apache2 stop
2
Open the
/etc/apache2/vhosts.d/vhost-ssl.conf
file in a text editor, then locate the
SSLCipherSuite directive in the Virtual Hosts section:
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+LOW:+SSLv2:+EXP:+eNULL
3 Modify the plus (
+
) to a minus (
-
) in front of the ciphers you want to disable and make sure
there is a
!
(not) before ADH:
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:-eNULL
4
Save your changes.
5 Start the Apache server: At a terminal console, enter
/etc/init.d/apache2 start
For more information about configuring strong SSL/TLS security solutions, see SSL/TLS Strong
Encryption: How-To (http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html) on the Apache.org Web
site.
10.7.3 Configuring the Web Admin Server for SSL
Communications with the Enterprise Server
By default, the Web Browser is configured to communicate with the iFolder Web Admin server via
SSL and to the iFolder Enterprise server via non-SSL. For most deployments, this setting should not
be changed as the Web Admin server is configured in the same iFolder Enterprise server for
performance reasons and iFolder uses HTTP BASIC for authentication, which means passwords are
sent to the server in the clear. If the iFolder deployment is in large scale and the Web Admin server
is on a different machine than the iFolder enterprise server, an Administrator could reconfigure to
enable SSL between the Web Admin Server and the iFolder Enterprise Server, which would increase
the security for communications between the two servers.