Apache Hardening - Revision history

Drn@ecs.soton.ac.uk: Updated supported ciphers to remove weak ones

2025-09-09T12:06:58Z

Updated supported ciphers to remove weak ones

← Older revision		Revision as of 12:06, 9 September 2025
Line 37:		Line 37:
	Recommended SSL protocols and ciphers will change over time as new protocols/ciphers become available and older ones become considered as weak. You want to make sure that you are using the strongest protocols and ciphers but if you only use these then some browsers may not be able to access you EPrints repositories. Ensuring the correct balance is important. The following lines should be added to your archive's HTTPS virtualhost (i.e. in the archive's ''ssl/securevhost.conf''):		Recommended SSL protocols and ciphers will change over time as new protocols/ciphers become available and older ones become considered as weak. You want to make sure that you are using the strongest protocols and ciphers but if you only use these then some browsers may not be able to access you EPrints repositories. Ensuring the correct balance is important. The following lines should be added to your archive's HTTPS virtualhost (i.e. in the archive's ''ssl/securevhost.conf''):
	SSLHonorCipherOrder on		SSLHonorCipherOrder on
	SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1		SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
	SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM~~-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128~~-SHA256		SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
	However, over time some of these protocols or ciphers may come to be considered weak. You should periodically check you EPrints repository on https://www.ssllabs.com/ssltest/. If you get an A grade or above then your protocol/cipher choice is still OK. (To get an A+ grade you need [[#HTTP Strict Transfer Protocol (HSTS)\|HSTS]] enabled). If you get less than an A grade, the report produced should tell you which protcols and ciphers you need to disable and possibly which newer one you should enable.		However, over time some of these protocols or ciphers may come to be considered weak. You should periodically check you EPrints repository on https://www.ssllabs.com/ssltest/. If you get an A grade or above then your protocol/cipher choice is still OK. (To get an A+ grade you need [[#HTTP Strict Transfer Protocol (HSTS)\|HSTS]] enabled). If you get less than an A grade, the report produced should tell you which protcols and ciphers you need to disable and possibly which newer one you should enable.

Drn@ecs.soton.ac.uk at 12:11, 23 August 2022

2022-08-23T12:11:57Z

← Older revision		Revision as of 12:11, 23 August 2022
Line 1:		Line 1:
	There are various ways that Apache configuration can be hardened to make it more secure. The suggested configuration changes below are informed by https://securityheaders.com/ Much of this is quite generic and could be applied to an web host not just an EPrints repository but some needs be be specifically configured for an EPrints repository.		There are various ways that Apache configuration can be hardened to make it more secure. The suggested configuration changes below are informed by https://securityheaders.com/ Much of this is quite generic and could be applied to any web host not just an EPrints repository but some needs be be specifically configured for an EPrints repository.

	== HTTP Strict Transport Security (HSTS) ==		== HTTP Strict Transport Security (HSTS) ==

Drn@ecs.soton.ac.uk: /* X-Content-Type-Options (MIME Sniffing) */

2022-08-23T12:09:09Z

X-Content-Type-Options (MIME Sniffing)

← Older revision		Revision as of 12:09, 23 August 2022
Line 49:		Line 49:

	== X-Content-Type-Options (MIME Sniffing) ==		== X-Content-Type-Options (MIME Sniffing) ==
			EPrints repository software allows a wide range of different types of file to be uploaded but this can be restricted. However, MIME sniffing can be used to assist getting round this restriction, allowing files to be presented under a different MIME type so they can uploaded when otherwise would not be permitted. Such uploaded files may then be used to facilitate cross-site scripting (XSS) attacks. To prevent MIME sniffing the following line should be used:
			Header set X-Content-Type-Options "nosniff"
			Like with other Apache hardening configuration, this should be added to a file under the Apache configuration directory, so it is applied to all virtualhosts.

	[[Category:Howto]]		[[Category:Howto]]

Drn@ecs.soton.ac.uk: /* SSL Session Tickets and Compression */

2022-08-23T12:01:47Z

SSL Session Tickets and Compression

← Older revision		Revision as of 12:01, 23 August 2022
Line 41:		Line 41:
	However, over time some of these protocols or ciphers may come to be considered weak. You should periodically check you EPrints repository on https://www.ssllabs.com/ssltest/. If you get an A grade or above then your protocol/cipher choice is still OK. (To get an A+ grade you need [[#HTTP Strict Transfer Protocol (HSTS)\|HSTS]] enabled). If you get less than an A grade, the report produced should tell you which protcols and ciphers you need to disable and possibly which newer one you should enable.		However, over time some of these protocols or ciphers may come to be considered weak. You should periodically check you EPrints repository on https://www.ssllabs.com/ssltest/. If you get an A grade or above then your protocol/cipher choice is still OK. (To get an A+ grade you need [[#HTTP Strict Transfer Protocol (HSTS)\|HSTS]] enabled). If you get less than an A grade, the report produced should tell you which protcols and ciphers you need to disable and possibly which newer one you should enable.

	== SSL Session Tickets and Compression ==		== Disabling SSL Session Tickets and Compression ==
			On top of using strong SSL protocols and ciphers, disabling SSL session tickets and compression can further improve security. As SSL session tickets can last a long time, this makes then vulnerable to being cracked. Apache recommends if you use session tickets that your restart the webserver regularly (i.e. daily). This is not ideal and far outweighs the small efficiency benefit over using SSL session IDs, so the simplest solution is to disable. Using SSL compression may give a small performance improvement but has various security issues TLS (SSL) compression is not used by most modern browsers due to potential information leakage, so it is easiest just to turn this off as well.

			To disable both SSL session tickets and compression you need to add the following two lines to your EPrints repository archive's ''ssl/securevhost.conf'':
			SSLSessionTickets off
			SSLCompression off

	== X-Content-Type-Options (MIME Sniffing) ==		== X-Content-Type-Options (MIME Sniffing) ==

	[[Category:Howto]]		[[Category:Howto]]

Drn@ecs.soton.ac.uk: /* SSL Protocols and Ciphers */

2022-08-23T11:48:11Z

SSL Protocols and Ciphers

← Older revision		Revision as of 11:48, 23 August 2022
Line 35:		Line 35:

	== SSL Protocols and Ciphers ==		== SSL Protocols and Ciphers ==
	Recommended SSL protocols and ciphers will change over time as new protocols/ciphers become available and older ones become considered as weak. You want to make sure that you are using the strongest protocols and ciphers but if you only use these then some browsers may not be able to access you EPrints repositories.		Recommended SSL protocols and ciphers will change over time as new protocols/ciphers become available and older ones become considered as weak. You want to make sure that you are using the strongest protocols and ciphers but if you only use these then some browsers may not be able to access you EPrints repositories. Ensuring the correct balance is important. The following lines should be added to your archive's HTTPS virtualhost (i.e. in the archive's ''ssl/securevhost.conf''):
			SSLHonorCipherOrder on
			SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
			SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
			However, over time some of these protocols or ciphers may come to be considered weak. You should periodically check you EPrints repository on https://www.ssllabs.com/ssltest/. If you get an A grade or above then your protocol/cipher choice is still OK. (To get an A+ grade you need [[#HTTP Strict Transfer Protocol (HSTS)\|HSTS]] enabled). If you get less than an A grade, the report produced should tell you which protcols and ciphers you need to disable and possibly which newer one you should enable.

	== SSL Session Tickets and Compression ==		== SSL Session Tickets and Compression ==

Drn@ecs.soton.ac.uk: /* SSL Protocols and Ciphers */

2022-08-23T11:39:42Z

SSL Protocols and Ciphers

← Older revision		Revision as of 11:39, 23 August 2022
Line 35:		Line 35:

	== SSL Protocols and Ciphers ==		== SSL Protocols and Ciphers ==
			Recommended SSL protocols and ciphers will change over time as new protocols/ciphers become available and older ones become considered as weak. You want to make sure that you are using the strongest protocols and ciphers but if you only use these then some browsers may not be able to access you EPrints repositories.

	== SSL Session Tickets and Compression ==		== SSL Session Tickets and Compression ==

Drn@ecs.soton.ac.uk: /* Content Security Policy */

2022-08-23T11:39:19Z

Content Security Policy

← Older revision		Revision as of 11:39, 23 August 2022
Line 26:		Line 26:

	== Content Security Policy ==		== Content Security Policy ==
	Content Security Policies are one of the more complex aspects to configure in Apache. There purpose is to cover where aspects of the page (e.g. JavaScript, CSS, images, fonts, etc.) can be provided. Also it covers how they can be provided, mainly in the case of JavaScript whether they can be inline or evaluated scripts. EPrints repository software currently uses some inline scripts, so the benefits of the Content Security Policy are limited due to this. However, EPrints repository software development is working towards eliminating use of inline JavaScript, so that a more secure Content Security Policy can be used. At present the following policy is recommended. It should work for vanilla EPrints repositories that only use common Bazaar plugins (e.g. IRStats2, etc.):		Content Security Policies are one of the more complex aspects to configure in Apache. There purpose is to cover from where aspects of the page (e.g. JavaScript, CSS, images, fonts, etc.) can be provided. Also, it covers how they can be provided, mainly in the case of JavaScript whether they can be inline or evaluated scripts. EPrints repository software currently uses some inline scripts, so the benefits of the Content Security Policy are limited due to this. However, EPrints repository software development is working towards eliminating use of inline JavaScript, so that a more secure Content Security Policy can be used. At present the following policy is recommended. It should work for vanilla EPrints repositories that only use common Bazaar plugins (e.g. IRStats2, etc.):
	Header set Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline' www.google.com www.gstatic.com; connect-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline' www.gstatic.com; base-uri 'self'; form-action 'self'; font-src 'self'		Header set Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline' www.google.com www.gstatic.com; connect-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline' www.gstatic.com; base-uri 'self'; form-action 'self'; font-src 'self'
	Like other Apache hardening configuration, this is best added to a file under Apache configuration directory so it is applied to all virtualhosts. However, if you are running other websites that do no have inline ~~or evaluated~~ JavaScript, it may be better to add this line inside the HTTP and HTTPS virtualhosts for the EPrints repository in their archive's ''cfg/apachevhost.conf'' and ''ssl/securevhost.conf'' configurations.		Like other Apache hardening configuration, this is best added to a file under Apache configuration directory so it is applied to all virtualhosts. However, if you are running other websites that do no have inline JavaScript, it may be better to add this line inside the HTTP and HTTPS virtualhosts for the EPrints repository in their archive's ''cfg/apachevhost.conf'' and ''ssl/securevhost.conf'' configurations.

	The policy above currently only ~~included~~ '' 'unsafe-inline' '' needed for inline JavaScript. It has been reported that sometimes EPrints repositories will use evaluated JavaScript, so it may be necessary to add '' 'unsafe-eval' '' to the ''script-src'' section.		The policy above currently only includes '' 'unsafe-inline' '' needed for inline JavaScript. It has been reported that sometimes EPrints repositories will use evaluated JavaScript, so it may be necessary to add '' 'unsafe-eval' '' to the ''script-src'' section.

	It is to be expected that many bespoke modifications or addition of Bazaar plugins will lead to you needing to update your Content Security Policy. In particular if ~~you rebenading~~ your repository, as this will commonly use CSS, JavaScript, images and fonts from remote hosts.		It is to be expected that many bespoke modifications or addition of Bazaar plugins will lead to you needing to update your Content Security Policy. In particular if your rebranding your repository, as this will commonly use CSS, JavaScript, images and fonts from remote hosts.

	== SSL Protocols and Ciphers ==		== SSL Protocols and Ciphers ==

Drn@ecs.soton.ac.uk: /* Content Security Policy */

2022-08-23T11:24:30Z

Content Security Policy

← Older revision		Revision as of 11:24, 23 August 2022
Line 26:		Line 26:

	== Content Security Policy ==		== Content Security Policy ==
	Content Security Policies are one of the more complex aspects to configure in Apache. There purpose is to cover where aspects of the page (e.g. JavaScript, CSS, images, fonts, etc.) can be provided. Also it covers how they can be provided, mainly in the case of JavaScript whether they can be inline or evaluated scripts. EPrints currently uses some inline scripts, so the benefits of the Content Security Policy are limited due to this. However, EPrints repository software development ~~team are~~ working towards eliminating use of inline JavaScript, so that a more secure Content Security Policy can be used. At present the following policy is recommended. It should ~~would~~ for vanilla EPrints repositories that only use common Bazaar plugins (e.g. IRStats2, etc.):		Content Security Policies are one of the more complex aspects to configure in Apache. There purpose is to cover where aspects of the page (e.g. JavaScript, CSS, images, fonts, etc.) can be provided. Also it covers how they can be provided, mainly in the case of JavaScript whether they can be inline or evaluated scripts. EPrints repository software currently uses some inline scripts, so the benefits of the Content Security Policy are limited due to this. However, EPrints repository software development is working towards eliminating use of inline JavaScript, so that a more secure Content Security Policy can be used. At present the following policy is recommended. It should work for vanilla EPrints repositories that only use common Bazaar plugins (e.g. IRStats2, etc.):
	Header set Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline' www.google.com www.gstatic.com; connect-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline' www.gstatic.com; base-uri 'self'; form-action 'self'; font-src 'self'		Header set Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline' www.google.com www.gstatic.com; connect-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline' www.gstatic.com; base-uri 'self'; form-action 'self'; font-src 'self'
	Like other Apache hardening configuration, this is best added to a file under Apache configuration directory so it is applied to all virtualhosts. However, if you are running other websites that do no have inline or evaluated JavaScript, it may be better to add this line inside the HTTP and HTTPS virtualhosts for the EPrints repository in their archive's ''cfg/apachevhost.conf'' and ''ssl/securevhost.conf'' configurations.		Like other Apache hardening configuration, this is best added to a file under Apache configuration directory so it is applied to all virtualhosts. However, if you are running other websites that do no have inline or evaluated JavaScript, it may be better to add this line inside the HTTP and HTTPS virtualhosts for the EPrints repository in their archive's ''cfg/apachevhost.conf'' and ''ssl/securevhost.conf'' configurations.

	The policy above currently only included '' 'unsafe-inline' '' needed for inline JavaScript. It has been reported that sometimes EPrints repositories will use evaluated JavaScript, so it may be necessary to add '' 'unsafe-eval' '' to the ''script-src'' section.		The policy above currently only included '' 'unsafe-inline' '' needed for inline JavaScript. It has been reported that sometimes EPrints repositories will use evaluated JavaScript, so it may be necessary to add '' 'unsafe-eval' '' to the ''script-src'' section.

			It is to be expected that many bespoke modifications or addition of Bazaar plugins will lead to you needing to update your Content Security Policy. In particular if you rebenading your repository, as this will commonly use CSS, JavaScript, images and fonts from remote hosts.

	== SSL Protocols and Ciphers ==		== SSL Protocols and Ciphers ==

Drn@ecs.soton.ac.uk: /* Content Security Policy */

2022-08-23T11:20:59Z

Content Security Policy

← Older revision		Revision as of 11:20, 23 August 2022
Line 26:		Line 26:

	== Content Security Policy ==		== Content Security Policy ==
			Content Security Policies are one of the more complex aspects to configure in Apache. There purpose is to cover where aspects of the page (e.g. JavaScript, CSS, images, fonts, etc.) can be provided. Also it covers how they can be provided, mainly in the case of JavaScript whether they can be inline or evaluated scripts. EPrints currently uses some inline scripts, so the benefits of the Content Security Policy are limited due to this. However, EPrints repository software development team are working towards eliminating use of inline JavaScript, so that a more secure Content Security Policy can be used. At present the following policy is recommended. It should would for vanilla EPrints repositories that only use common Bazaar plugins (e.g. IRStats2, etc.):
			Header set Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline' www.google.com www.gstatic.com; connect-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline' www.gstatic.com; base-uri 'self'; form-action 'self'; font-src 'self'
			Like other Apache hardening configuration, this is best added to a file under Apache configuration directory so it is applied to all virtualhosts. However, if you are running other websites that do no have inline or evaluated JavaScript, it may be better to add this line inside the HTTP and HTTPS virtualhosts for the EPrints repository in their archive's ''cfg/apachevhost.conf'' and ''ssl/securevhost.conf'' configurations.

			The policy above currently only included '' 'unsafe-inline' '' needed for inline JavaScript. It has been reported that sometimes EPrints repositories will use evaluated JavaScript, so it may be necessary to add '' 'unsafe-eval' '' to the ''script-src'' section.

	== SSL Protocols and Ciphers ==		== SSL Protocols and Ciphers ==

Drn@ecs.soton.ac.uk: /* Content Type Options */ updated title

2022-08-23T09:44:13Z

Content Type Options: updated title

← Older revision		Revision as of 09:44, 23 August 2022
Line 31:		Line 31:
	== SSL Session Tickets and Compression ==		== SSL Session Tickets and Compression ==

	== Content Type Options ==		== X-Content-Type-Options (MIME Sniffing) ==

	[[Category:Howto]]		[[Category:Howto]]