From bf912852598e35a2ccfbecd629f00fa57b4b6e4e Mon Sep 17 00:00:00 2001 From: Mariusz Mazur Date: Sun, 27 Oct 2002 12:58:21 +0000 Subject: [PATCH] - a2 Changed files: apache-mod_ssl.conf -> 1.3 --- apache-mod_ssl.conf | 237 ++++++++++++++++++++++++++++++++++++++------ 1 file changed, 205 insertions(+), 32 deletions(-) diff --git a/apache-mod_ssl.conf b/apache-mod_ssl.conf index 795a3c3..1cabdbb 100644 --- a/apache-mod_ssl.conf +++ b/apache-mod_ssl.conf @@ -1,19 +1,40 @@ -LoadModule ssl_module lib/apache/libssl.so -AddModule mod_ssl.c - -##-------------------------------------------------------------------------- -## Add additional SSL configuration directives which provide a -## robust default configuration: virtual server on port 443 -## which speaks SSL. -##-------------------------------------------------------------------------- -## -## SSL Support -## -## When we also provide SSL we have to listen to the -## standard HTTP port (see above) and to the HTTPS port -## +LoadModule ssl_module lib/apache/mod_ssl.so + + +# +# This is the Apache server configuration file providing SSL support. +# It contains the configuration directives to instruct the server how to +# serve pages over an https connection. For detailing information about these +# directives see +# +# For the moment, see for this info. +# The documents are still being prepared from material donated by the +# modssl project. +# +# Do NOT simply read the instructions in here without understanding +# what they do. They're here only as hints or reminders. If you are unsure +# consult the online docs. You have been warned. +# +# + +# Until documentation is completed, please check http://www.modssl.org/ +# for additional config examples and module docmentation. Directives +# and features of mod_ssl are largely unchanged from the mod_ssl project +# for Apache 1.3. + +# +# When we also provide SSL we have to listen to the +# standard HTTP port (see above) and to the HTTPS port +# Listen 443 +# +# Dynamic Shared Object (DSO) Support +# +# To be able to use the functionality of a module which was built as a DSO you +# ErrorLog logs/dummy-host.example.com-error_log +# CustomLog logs/dummy-host.example.com-access_log common + ## ## SSL Global Context ## @@ -34,22 +55,29 @@ AddType application/x-pkcs7-crl .crl SSLPassPhraseDialog builtin # Inter-Process Session Cache: -# Configure the SSL Session Cache: First either `none' -# or `dbm:/path/to/file' for the mechanism to use and -# second the expiring timeout (in seconds). +# Configure the SSL Session Cache: First the mechanism +# to use and second the expiring timeout (in seconds). #SSLSessionCache none -#SSLSessionCache dbm:logs/ssl_scache -SSLSessionCache shm:/var/run/ssl_scache(512000) +#SSLSessionCache shmht:logs/ssl_scache(512000) +#SSLSessionCache shmcb:logs/ssl_scache(512000) +SSLSessionCache dbm:/var/log/httpd/ssl_scache SSLSessionCacheTimeout 300 # Semaphore: -# Configure the path to the mutual explusion semaphore the +# Configure the path to the mutual exclusion semaphore the # SSL engine uses internally for inter-process synchronization. -SSLMutex file:/var/run/ssl_mutex +SSLMutex file:logs/ssl_mutex # Pseudo Random Number Generator (PRNG): # Configure one or more sources to seed the PRNG of the # SSL library. The seed data should be of good random quality. +# WARNING! On some platforms /dev/random blocks if not enough entropy +# is available. This means you then cannot use the /dev/random device +# because it would lead to very long connection times (as long as +# it requires to make more entropy available). But usually those +# platforms additionally provide a /dev/urandom device which doesn't +# block. So, if available, use this one instead. Read the mod_ssl User +# Manual for more details. SSLRandomSeed startup builtin SSLRandomSeed connect builtin #SSLRandomSeed startup file:/dev/random 512 @@ -67,28 +95,173 @@ SSLRandomSeed connect builtin SSLLog /var/log/httpd/ssl_engine_log SSLLogLevel info +## +## SSL Virtual Host Context +## + + +# General setup for the virtual host +DocumentRoot "/home/services/httpd/html" +ServerName new.host.name:443 +ServerAdmin you@your.address +ErrorLog /var/log/httpd/error_log +TransferLog /var/log/httpd/access_log + +# SSL Engine Switch: +# Enable/Disable SSL for this virtual host. SSLEngine on -#SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL -SSLCertificateFile /etc/httpd/server.crt -SSLCertificateKeyFile /etc/httpd/server.key -#SSLCertificateChainFile /etc/httpd/conf/ssl.crt/ca.crt -#SSLCACertificatePath /etc/httpd/conf/ssl.crt -#SSLCACertificateFile /etc/httpd/conf/ssl.crt/ca-bundle.crt -#SSLCARevocationPath /etc/httpd/conf/ssl.crl -#SSLCARevocationFile /etc/httpd/conf/ssl.crl/ca-bundle.crl + +# SSL Cipher Suite: +# List the ciphers that the client is permitted to negotiate. +# See the mod_ssl documentation for a complete list. +SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL + +# Server Certificate: +# Point SSLCertificateFile at a PEM encoded certificate. If +# the certificate is encrypted, then you will be prompted for a +# pass phrase. Note that a kill -HUP will prompt again. A test +# certificate can be generated with `make certificate' under +# built time. Keep in mind that if you've both a RSA and a DSA +# certificate you can configure both in parallel (to also allow +# the use of DSA ciphers, etc.) +SSLCertificateFile /etc/httpd/ssl/server.crt +#SSLCertificateFile /etc/httpd/ssl/server-dsa.crt + +# Server Private Key: +# If the key is not combined with the certificate, use this +# directive to point at the key file. Keep in mind that if +# you've both a RSA and a DSA private key you can configure +# both in parallel (to also allow the use of DSA ciphers, etc.) +SSLCertificateKeyFile /etc/httpd/ssl/server.key +#SSLCertificateKeyFile /etc/httpd/ssl/server-dsa.key + +# Server Certificate Chain: +# Point SSLCertificateChainFile at a file containing the +# concatenation of PEM encoded CA certificates which form the +# certificate chain for the server certificate. Alternatively +# the referenced file can be the same as SSLCertificateFile +# when the CA certificates are directly appended to the server +# certificate for convinience. +#SSLCertificateChainFile /etc/httpd/ssl/ca.crt + +# Certificate Authority (CA): +# Set the CA certificate verification path where to find CA +# certificates for client authentication or alternatively one +# huge file containing all of them (file must be PEM encoded) +# Note: Inside SSLCACertificatePath you need hash symlinks +# to point to the certificate files. Use the provided +# Makefile to update the hash symlinks after changes. +#SSLCACertificatePath /etc/httpd/ssl +#SSLCACertificateFile /etc/httpd/ssl/ca-bundle.crt + +# Certificate Revocation Lists (CRL): +# Set the CA revocation path where to find CA CRLs for client +# authentication or alternatively one huge file containing all +# of them (file must be PEM encoded) +# Note: Inside SSLCARevocationPath you need hash symlinks +# to point to the certificate files. Use the provided +# Makefile to update the hash symlinks after changes. +#SSLCARevocationPath /etc/httpd/ssl +#SSLCARevocationFile /etc/httpd/ssl/ca-bundle.crl + +# Client Authentication (Type): +# Client certificate verification type and depth. Types are +# none, optional, require and optional_no_ca. Depth is a +# number which specifies how deeply to verify the certificate +# issuer chain before deciding the certificate is not valid. #SSLVerifyClient require #SSLVerifyDepth 10 +# Access Control: +# With SSLRequire you can do per-directory access control based +# on arbitrary complex boolean expressions containing server +# variable checks and other lookup directives. The syntax is a +# mixture between C and Perl. See the mod_ssl documentation +# for more details. +# +#SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \ +# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \ +# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \ +# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \ +# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \ +# or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/ +# + +# SSL Engine Options: +# Set various options for the SSL engine. +# o FakeBasicAuth: +# Translate the client X.509 into a Basic Authorisation. This means that +# the standard Auth/DBMAuth methods can be used for access control. The +# user name is the `one line' version of the client's X.509 certificate. +# Note that no password is obtained from the user. Every entry in the user +# file needs this password: `xxj31ZMTZzkVA'. +# o ExportCertData: +# This exports two additional environment variables: SSL_CLIENT_CERT and +# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the +# server (always existing) and the client (only existing when client +# authentication is used). This can be used to import the certificates +# into CGI scripts. +# o StdEnvVars: +# This exports the standard SSL/TLS related `SSL_*' environment variables. +# Per default this exportation is switched off for performance reasons, +# because the extraction step is an expensive operation and is usually +# useless for serving static content. So one usually enables the +# exportation for CGI and SSI requests only. +# o CompatEnvVars: +# This exports obsolete environment variables for backward compatibility +# to Apache-SSL 1.x, mod_ssl 2.0.x, Sioux 1.0 and Stronghold 2.x. Use this +# to provide compatibility to existing CGI scripts. +# o StrictRequire: +# This denies access when "SSLRequireSSL" or "SSLRequire" applied even +# under a "Satisfy any" situation, i.e. when it applies access is denied +# and no other module can change it. +# o OptRenegotiate: +# This enables optimized SSL connection renegotiation handling when SSL +# directives are used in per-directory context. #SSLOptions +FakeBasicAuth +ExportCertData +CompatEnvVars +StrictRequire - + SSLOptions +StdEnvVars - + SSLOptions +StdEnvVars -SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown + +# SSL Protocol Adjustments: +# The safe and default but still SSL/TLS standard compliant shutdown +# approach is that mod_ssl sends the close notify alert but doesn't wait for +# the close notify alert from client. When you need a different shutdown +# approach you can use one of the following variables: +# o ssl-unclean-shutdown: +# This forces an unclean shutdown when the connection is closed, i.e. no +# SSL close notify alert is send or allowed to received. This violates +# the SSL/TLS standard but is needed for some brain-dead browsers. Use +# this when you receive I/O errors because of the standard approach where +# mod_ssl sends the close notify alert. +# o ssl-accurate-shutdown: +# This forces an accurate shutdown when the connection is closed, i.e. a +# SSL close notify alert is send and mod_ssl waits for the close notify +# alert of the client. This is 100% SSL/TLS standard compliant, but in +# practice often causes hanging connections with brain-dead browsers. Use +# this only for browsers where you know that their SSL implementation +# works correctly. +# Notice: Most problems of broken clients are also related to the HTTP +# keep-alive facility, so you usually additionally want to disable +# keep-alive for those clients, too. Use variable "nokeepalive" for this. +# Similarly, one has to force some clients to use HTTP/1.0 to workaround +# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and +# "force-response-1.0" for this. +SetEnvIf User-Agent ".*MSIE.*" \ + nokeepalive ssl-unclean-shutdown \ + downgrade-1.0 force-response-1.0 + +# Per-Server Logging: +# The home of a custom SSL log file. Use this when you want a +# compact non-error SSL logfile on a virtual host basis. CustomLog /var/log/httpd/ssl_request_log \ "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" + + + -- 2.44.0