mirror of
https://github.com/apache/httpd.git
synced 2025-08-11 13:22:44 +03:00
7fc3e62474
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@91874 13f79535-47bb-0310-9956-ffa450edef68
326 lines
10 KiB
Plaintext
326 lines
10 KiB
Plaintext
|
|
#use "ssl_template.inc" title="HowTo" tag=howto num=5
|
|
|
|
<page_prev name="Compatibility" url="ssl_compat.html">
|
|
<page_next name="F.A.Q. List" url="ssl_faq.html">
|
|
|
|
#use wml::std::toc style=nbsp
|
|
|
|
<quotation width=200 author="Standard textbook cookie">
|
|
``The solution of this problem is trivial
|
|
and is left as an exercise for the reader.''
|
|
</quotation>
|
|
|
|
<p>
|
|
<table cellspacing=0 cellpadding=0 border=0>
|
|
<tr valign=bottom>
|
|
<td>
|
|
|
|
<big H>ow to solve particular security constraints for an SSL-aware webserver
|
|
is not always obvious because of the coherences between SSL, HTTP and Apache's
|
|
way of processing requests. This chapter gives instructions on how to solve
|
|
such typical situations. Treat is as a first step to find out the final
|
|
solution, but always try to understand the stuff before you use it. Nothing is
|
|
worse than using a security solution without knowing its restrictions and
|
|
coherences.
|
|
|
|
</td>
|
|
<td>
|
|
|
|
</td>
|
|
<td>
|
|
|
|
<div align=right>
|
|
<table cellspacing=0 cellpadding=5 border=0 bgcolor="#ccccff" width=300>
|
|
<tr>
|
|
<td bgcolor="#333399">
|
|
<font face="Arial,Helvetica" color="#ccccff">
|
|
<b>Table Of Contents</b>
|
|
</font>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<font face="Arial,Helvetica" size=-1>
|
|
<toc>
|
|
</font>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
|
|
# container tag for layouting a question
|
|
<define-tag howto endtag=required>
|
|
<preserve ref>
|
|
<preserve toc>
|
|
<set-var %attributes>
|
|
<p>
|
|
<li><toc_h3 alt="<get-var toc>"></toc_h3>
|
|
<a name="<get-var ref>"></a>
|
|
<strong id="howto">%body</strong>\
|
|
|
|
[<a href="http://www.modssl.org/docs/2.8/ssl_howto.html#<get-var ref>"><b>L</b></a>]
|
|
<p>
|
|
<restore toc>
|
|
<restore ref>
|
|
</define-tag>
|
|
|
|
<define-tag config endtag=required>
|
|
<preserve file>
|
|
<set-var %attributes>
|
|
<ifeq "<get-var file>" "" <set-var file="httpd.conf">>
|
|
<box header="<font face="Arial,Helvetica" color="#999999"><get-var file></font>"
|
|
bdwidth=1 bdcolor="#cccccc" bgcolor="#ffffff" fgcolor="#000000">
|
|
<pre>
|
|
%body
|
|
</pre>
|
|
</box>\
|
|
<restore file>
|
|
</define-tag>
|
|
|
|
<h2>Cipher Suites and Enforced Strong Security</h2>
|
|
|
|
<ul>
|
|
|
|
<howto ref="cipher-sslv2" toc="SSLv2 only server">
|
|
How can I create a real SSLv2-only server?
|
|
</howto>
|
|
|
|
The following creates an SSL server which speaks only the SSLv2 protocol and
|
|
its ciphers.
|
|
|
|
<p>
|
|
<config>
|
|
SSLProtocol -all +SSLv2
|
|
SSLCipherSuite SSLv2:+HIGH:+MEDIUM:+LOW:+EXP
|
|
</config>
|
|
|
|
<howto ref="cipher-strong" toc="strong encryption only server">
|
|
How can I create an SSL server which accepts strong encryption only?
|
|
</howto>
|
|
|
|
The following enables only the seven strongest ciphers:
|
|
|
|
<p>
|
|
<config>
|
|
SSLProtocol all
|
|
SSLCipherSuite HIGH:MEDIUM
|
|
</config>
|
|
|
|
<howto ref="cipher-sgc" toc="server gated cryptography">
|
|
How can I create an SSL server which accepts strong encryption only,
|
|
but allows export browsers to upgrade to stronger encryption?
|
|
</howto>
|
|
|
|
This facility is called Server Gated Cryptography (SGC) and details you can
|
|
find in the <code>README.GlobalID</code> document in the mod_ssl distribution.
|
|
In short: The server has a Global ID server certificate, signed by a special
|
|
CA certificate from Verisign which enables strong encryption in export
|
|
browsers. This works as following: The browser connects with an export cipher,
|
|
the server sends its Global ID certificate, the browser verifies it and
|
|
subsequently upgrades the cipher suite before any HTTP communication takes
|
|
place. The question now is: How can we allow this upgrade, but enforce strong
|
|
encryption. Or in other words: Browser either have to initially connect with
|
|
strong encryption or have to upgrade to strong encryption, but are not allowed
|
|
to keep the export ciphers. The following does the trick:
|
|
|
|
<p>
|
|
<config>
|
|
\# allow all ciphers for the inital handshake,
|
|
\# so export browsers can upgrade via SGC facility
|
|
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
|
|
<Directory /usr/local/apache/htdocs>
|
|
\# but finally deny all browsers which haven't upgraded
|
|
SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128
|
|
</Directory>
|
|
</config>
|
|
|
|
<howto ref="cipher-perdir" toc="stronger per-directory requirements">
|
|
How can I create an SSL server which accepts all types of ciphers in general,
|
|
but requires a strong ciphers for access to a particular URL?
|
|
</howto>
|
|
|
|
Obviously you cannot just use a server-wide <code>SSLCipherSuite</code> which
|
|
restricts the ciphers to the strong variants. But mod_ssl allows you to
|
|
reconfigure the cipher suite in per-directory context and automatically forces
|
|
a renegotiation of the SSL parameters to meet the new configuration. So, the
|
|
solution is:
|
|
|
|
<p>
|
|
<config>
|
|
\# be liberal in general
|
|
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
|
|
<Location /strong/area>
|
|
\# but https://hostname/strong/area/ and below requires strong ciphers
|
|
SSLCipherSuite HIGH:MEDIUM
|
|
</Location>
|
|
</config>
|
|
|
|
</ul>
|
|
|
|
<h2>Client Authentication and Access Control</h2>
|
|
|
|
<ul>
|
|
|
|
<howto ref="auth-simple" toc="simple certificate-based client authentication">
|
|
How can I authenticate clients based on certificates when I know all my
|
|
clients?
|
|
</howto>
|
|
|
|
When you know your user community (i.e. a closed user group situation), as
|
|
it's the case for instance in an Intranet, you can use plain certificate
|
|
authentication. All you have to do is to create client certificates signed by
|
|
your own CA certificate <code>ca.crt</code> and then verifiy the clients
|
|
against this certificate.
|
|
|
|
<p>
|
|
<config>
|
|
\# require a client certificate which has to be directly
|
|
\# signed by our CA certificate in ca.crt
|
|
SSLVerifyClient require
|
|
SSLVerifyDepth 1
|
|
SSLCACertificateFile conf/ssl.crt/ca.crt
|
|
</config>
|
|
|
|
<howto ref="auth-selective" toc="selective certificate-based client authentication">
|
|
How can I authenticate my clients for a particular URL based on certificates
|
|
but still allow arbitrary clients to access the remaining parts of the server?
|
|
</howto>
|
|
|
|
For this we again use the per-directory reconfiguration feature of mod_ssl:
|
|
|
|
<p>
|
|
<config>
|
|
SSLVerifyClient none
|
|
SSLCACertificateFile conf/ssl.crt/ca.crt
|
|
<Location /secure/area>
|
|
SSLVerifyClient require
|
|
SSLVerifyDepth 1
|
|
</Location>
|
|
</config>
|
|
|
|
<howto ref="auth-particular" toc="particular certificate-based client authentication">
|
|
How can I authenticate only particular clients for a some URLs based
|
|
on certificates but still allow arbitrary clients to access the remaining
|
|
parts of the server?
|
|
</howto>
|
|
|
|
The key is to check for various ingredients of the client certficate. Usually
|
|
this means to check the whole or part of the Distinguished Name (DN) of the
|
|
Subject. For this two methods exists: The <code>mod_auth</code> based variant
|
|
and the <code>SSLRequire</code> variant. The first method is good when the
|
|
clients are of totally different type, i.e. when their DNs have no common
|
|
fields (usually the organisation, etc.). In this case you've to establish a
|
|
password database containing <em>all</em> clients. The second method is better
|
|
when your clients are all part of a common hierarchy which is encoded into the
|
|
DN. Then you can match them more easily.
|
|
|
|
<p>
|
|
The first method:
|
|
|
|
<p>
|
|
<config file="/usr/local/apache/conf/httpd.conf">
|
|
SSLVerifyClient none
|
|
<Directory /usr/local/apache/htdocs/secure/area>
|
|
SSLVerifyClient require
|
|
SSLVerifyDepth 5
|
|
SSLCACertificateFile conf/ssl.crt/ca.crt
|
|
SSLCACertificatePath conf/ssl.crt
|
|
SSLOptions +FakeBasicAuth
|
|
SSLRequireSSL
|
|
AuthName "Snake Oil Authentication"
|
|
AuthType Basic
|
|
AuthUserFile /usr/local/apache/conf/httpd.passwd
|
|
require valid-user
|
|
</Directory>
|
|
</config>
|
|
|
|
<p>
|
|
<config file="/usr/local/apache/conf/httpd.passwd">
|
|
/C=DE/L=Munich/O=Snake Oil, Ltd./OU=Staff/CN=Foo:xxj31ZMTZzkVA
|
|
/C=US/L=S.F./O=Snake Oil, Ltd./OU=CA/CN=Bar:xxj31ZMTZzkVA
|
|
/C=US/L=L.A./O=Snake Oil, Ltd./OU=Dev/CN=Quux:xxj31ZMTZzkVA
|
|
</config>
|
|
|
|
<p>
|
|
The second method:
|
|
|
|
<p>
|
|
<config>
|
|
SSLVerifyClient none
|
|
<Directory /usr/local/apache/htdocs/secure/area>
|
|
SSLVerifyClient require
|
|
SSLVerifyDepth 5
|
|
SSLCACertificateFile conf/ssl.crt/ca.crt
|
|
SSLCACertificatePath conf/ssl.crt
|
|
SSLOptions +FakeBasicAuth
|
|
SSLRequireSSL
|
|
SSLRequire %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." and \\
|
|
%{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"}
|
|
</Directory>
|
|
</config>
|
|
|
|
<howto ref="auth-intranet" toc="intranet vs. internet authentication"> How can
|
|
I require HTTPS with strong ciphers and either basic authentication or client
|
|
certificates for access to a subarea on the Intranet website for clients
|
|
coming from the Internet but still allow plain HTTP access for clients on the
|
|
Intranet?
|
|
</howto>
|
|
|
|
Let us assume the Intranet can be distinguished through the IP network
|
|
192.160.1.0/24 and the subarea on the Intranet website has the URL
|
|
<tt>/subarea</tt>. Then configure the following outside your HTTPS virtual
|
|
host (so it applies to both HTTPS and HTTP):
|
|
|
|
<p>
|
|
<config>
|
|
SSLCACertificateFile conf/ssl.crt/company-ca.crt
|
|
|
|
<Directory /usr/local/apache/htdocs>
|
|
\# Outside the subarea only Intranet access is granted
|
|
Order deny,allow
|
|
Deny from all
|
|
Allow from 192.168.1.0/24
|
|
</Directory>
|
|
|
|
<Directory /usr/local/apache/htdocs/subarea>
|
|
\# Inside the subarea any Intranet access is allowed
|
|
\# but from the Internet only HTTPS + Strong-Cipher + Password
|
|
\# or the alternative HTTPS + Strong-Cipher + Client-Certificate
|
|
|
|
\# If HTTPS is used, make sure a strong cipher is used.
|
|
\# Additionally allow client certs as alternative to basic auth.
|
|
SSLVerifyClient optional
|
|
SSLVerifyDepth 1
|
|
SSLOptions +FakeBasicAuth +StrictRequire
|
|
SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128
|
|
|
|
\# Force clients from the Internet to use HTTPS
|
|
RewriteEngine on
|
|
RewriteCond %{REMOTE_ADDR} !^192\.168\.1\.[0-9]+$
|
|
RewriteCond %{HTTPS} !=on
|
|
RewriteRule .* - [F]
|
|
|
|
\# Allow Network Access and/or Basic Auth
|
|
Satisfy any
|
|
|
|
\# Network Access Control
|
|
Order deny,allow
|
|
Deny from all
|
|
Allow 192.168.1.0/24
|
|
|
|
\# HTTP Basic Authentication
|
|
AuthType basic
|
|
AuthName "Protected Intranet Area"
|
|
AuthUserFile conf/protected.passwd
|
|
Require valid-user
|
|
</Directory>
|
|
</config>
|
|
|
|
</ul>
|
|
|