Skip to main content

Secure SSL

openssl


 ./config --prefix=/usr/local/newopenssl

 curl ssl

./configure --prefix=/opt/curlssl --with-ssl=/usr/local/newopenssl --enable-http --enable-ftp LDFLAGS=-L/usr/local/newopenssl/lib CPPFLAGS=-I/usr/local/newopenssl/include


root@server [~]# cat /var/cpanel/easy/apache/rawopts/Apache2_4
--with-ssl=/usr/local/newopenssl/bin
LDFLAGS=-L/usr/local/newopenssl/lib
CPPFLAGS=-I/usr/local/newopenssl/include
root@server [~]# cat /var/cpanel/easy/apache/rawopts/all_php5
--with-openssl=/usr/local/newopenssl
--with-curl=/opt/curlssl


whm>apache configuration> global
 cipher suite

 ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-D


whm>apache configuration> pre virtualhost include>

SSLHonorCipherOrder On

Comments

Post a Comment

Popular posts from this blog

Modsecurity block rule for XMLRPC and wp-login attack

SecAction phase:1,nolog,pass,initcol:ip=%{REMOTE_ADDR},initcol:user=%{REMOTE_ADDR},id:5000134  <Locationmatch "/wp-login.php">  SecRule user:bf_block "@gt 0" "deny,status:401,log,id:5000135,msg:'ip address blocked for 5 minutes, more than 10 login attempts in 3 minutes.'"  SecRule RESPONSE_STATUS "^302" "phase:5,t:none,nolog,pass,setvar:ip.bf_counter=0,id:5000136"  SecRule RESPONSE_STATUS "^200" "phase:5,chain,t:none,nolog,pass,setvar:ip.bf_counter=+1,deprecatevar:ip.bf_counter=1/180,id:5000137"  SecRule ip:bf_counter "@gt 10" "t:none,setvar:user.bf_block=1,expirevar:user.bf_block=300,setvar:ip.bf_counter=0"  </Locationmatch>  SecAction phase:1,nolog,pass,initcol:ip=%{REMOTE_ADDR},initcol:user=%{REMOTE_ADDR},id:5000234  <Locationmatch "/xmlrpc.php">  SecRule user:bf_block "@gt 0" "deny,status:401,log,id:5000235,msg:'ip address blocked for 5 m...
Post a Comment
Read more

Apache tuning documentation

Apache bench marking ======================= Things or checklist to be considered before the test     CPU: avoid power-saving mode. cpufreq-set -g performance.     File descriptors: raise the limit to (at least) the number of concurrent connections you wish to handle, using ulimit -n in your shell, or setrlimit(RLIMIT_NOFILE) in your server. Beware, some systems forbid you to raise the limit, you might need to investigate a bit to find how to unlock it.     Disable the logs of your server (you do not want to lose time logging thousands of requests instead of answering them).     Raise /proc/sys/net/somaxconn to the number of concurrent connections you want to handle. To understand why this is necessary, read the technical report or the excellent paper Measuring the Capacity of a Web Server (Banga and Druschel, Usenix 97). More on the fascinating topic of the accept() queue can be found in accept()able Strategies for Im...
Post a Comment
Read more

Fix the permission and ownership

Usage ./scripts user1 user2 user3 You can also run a server-wide loop like this: for i in `ls -A /var/cpanel/users` ; do ./scripts $i ; done  code =========== #!/bin/bash if [ "$#" -lt "1" ];then echo "Must specify user" exit; fi USER=$@ for user in $USER do HOMEDIR=$(egrep "^${user}:" /etc/passwd | cut -d: -f6) if [ ! -f /var/cpanel/users/$user ]; then echo "$user user file missing, likely an invalid user" elif [ "$HOMEDIR" == "" ];then echo "Couldn't determine home directory for $user" else echo "Setting ownership for user $user" chown -R $user:$user $HOMEDIR chmod 711 $HOMEDIR chown $user:nobody $HOMEDIR/public_html $HOMEDIR/.htpasswds chown $user:mail $HOMEDIR/etc $HOMEDIR/etc/*/shadow $HOMEDIR/etc/*/passwd echo "Setting permissions for user $USER" find $HOMEDIR -type f -exec chmod 644 {} \; -print find $HOMEDIR -type d -exec chmod 755 {} \; -print find $HOMEDIR ...
Post a Comment
Read more