Category: Apache

Score An “A” On SSLLabs Server Test

April 13, 2014

Want an A on the SSLLabs server test? https://www.ssllabs.com/ssltest/ For Plesk create a file here:

/etc/httpd/conf.d/zz050-psa-disable-weak-ssl-ciphers.conf

1	/etc/httpd/conf.d/zz050-psa-disable-weak-ssl-ciphers.conf

and add the following:

SSLProtocol all -TLSv1 -SSLv2
SSLHonorCipherOrder on
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \
EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 \
EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"

SSLProtocol all -TLSv1 -SSLv2

SSLHonorCipherOrder on

SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \

EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 \

EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"

For WHM/CPanel do this: a. go to Service Configuration -> Apache Configuration -> Global Configuration and set “SSL Cipher Suite” to:

+ECDHE:+DHE:HIGH:!DHE-RSA-AES128-SHA:!ECDHE-RSA-AES128-SHA:!MD5:!ADH:!aNULL:!eNULL:!EXP

1	+ECDHE:+DHE:HIGH:!DHE-RSA-AES128-SHA:!ECDHE-RSA-AES128-SHA:!MD5:!ADH:!aNULL:!eNULL:!EXP

b. go to Service Configuration -> Apache Configuration -> Include Editor -> Pre Main Include and add the following lines:

SSLHonorCipherOrder On
SSLProtocol ALL -TLSv1 -SSLv2
# CVE-2011-3389
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown

SSLHonorCipherOrder On

SSLProtocol ALL -TLSv1 -SSLv2

# CVE-2011-3389

SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown

For a standalone Apache server try these:

SSLProtocol all -TLSv1 -SSLv2
SSLHonorCipherOrder on
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \
EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 \
EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"

SSLProtocol all -TLSv1 -SSLv2

SSLHonorCipherOrder on

SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \

EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 \

EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"

For Nginx try these lines:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \
EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 \
EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_prefer_server_ciphers on;

ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \

EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 \

EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";

If you get capped at a B due to TLS Compression support you can add:

SSLCompression off

1	SSLCompression off

For older Apache versions this setting may not be available. In this case you can edit the init script (/etc/init.d/httpd) and add this line:

export OPENSSL_NO_DEFAULT_ZLIB=1

1	export OPENSSL_NO_DEFAULT_ZLIB=1

Qualys has a blog post on this subject which provided the Apache and Nginx configs: https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy This forum post provided the WHM/Cpanel config: http://forums.cpanel.net/f185/cpanel-openssl-1-0-1c-higher-332001-p3.html#post1561101

Block wp-login.php On Single Site In WordPress Multisite

April 4, 2014

Take the case where you have a WordPress multi-site with many domains pointing to a single virtual host. When the site gets hit with a wp-login.php attack you want to password protect the wp-login.php script but just for the targeted site … not for every site in the multisite. Here’s the .htaccess rules to accomplish this:

SetEnvIfNoCase Host "acme.com" requireauth=1
SetEnvIfNoCase Host "widgets.com" requireauth=1

<Files ~ "^wp-login.php">
    AuthType Basic
    AuthName "******** ATTENTION - To login please enter username 'admin' and password 'letmein' ********"
    AuthUserFile /etc/httpd/conf/wplogin.htpasswd
    AuthBasicProvider file

    Require valid-user
    Order deny,allow
    Deny from all
    Allow from env=!requireauth
    Satisfy any
</Files>

SetEnvIfNoCase Host "acme.com" requireauth=1

SetEnvIfNoCase Host "widgets.com" requireauth=1

AuthType Basic

AuthName "******** ATTENTION - To login please enter username 'admin' and password 'letmein' ********"

AuthUserFile /etc/httpd/conf/wplogin.htpasswd

AuthBasicProvider file

Require valid-user

Order deny,allow

Deny from all

Allow from env=!requireauth

Satisfy any

</Files>

We set an environment variable based on the Host header and then require login from requests with the matching environment variable.

Remove Authentication From A Subfolder

March 8, 2014

Let’s say you have a directory that is password protected:

<Directory /var/www/vhosts/mysite.com/httpdocs>
AuthName "Login Required"
AuthType Basic
AuthUserFile /etc/httpd/conf/.htpasswd
Require valid-user
</Directory>

AuthName "Login Required"

AuthType Basic

AuthUserFile /etc/httpd/conf/.htpasswd

Require valid-user

</Directory>

Now you want to remove the password protection from a sub-folder like:

/var/www/vhosts/mysite.com/httpdocs/public

1	/var/www/vhosts/mysite.com/httpdocs/public

This can be accomplished by adding another Directory block like this:

<Directory /var/www/vhosts/mysite.com/httpdocs/public>
Allow from all
Satisfy any
</Directory>

Allow from all

Satisfy any

</Directory>

Apache mod_fcgi on CentOS 6.4

February 6, 2014

There are a lot of tutorials on how to install mod_fcgi with suexec out there but many are incomplete, outdated or just don’t work. One that does work is here: http://www.howtoforge.com/how-to-set-up-apache2-with-mod_fcgid-and-php5-on-centos-6.2

Log X-Forwarded-For Headers

October 17, 2013

If your Apache instance is behind a proxy or load balancer then you’ll need to setup a custom log format to capture the X-Forwarded-For header so that you logs include the IP address of the client:

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxycombined

1	LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxycombined

Reliable Penguin provides managed web hosting, systems administration, website and server migrations, and expert consulting.

Recent Updates

Fixing WP‑CLI “eval()’d code” Parse Errors on PHP 8.4 During “wp db import”

Force a 404 With a CloudFront Function (Always)

HTTP Basic Auth Is Dead

WordPress 6.8 Speculative Loading Can Break HTTP Basic Auth

Zero‑Trust for WordPress Admin with Cloudflare Access (Email One‑Time Codes)

Category: Apache

Score An “A” On SSLLabs Server Test

Block wp-login.php On Single Site In WordPress Multisite

Remove Authentication From A Subfolder

Apache mod_fcgi on CentOS 6.4

Log X-Forwarded-For Headers

Recent Updates

Categories

Get a free consultation from Reliable Penguin