3

I know that there are some Questions around here that comes along with this Topic. But I really don't know what I can do anymore.

So here's the point:

  • I am using Apache 2.2.22 on OpenSuse 12.3.
  • The SSLProtocol option is in my ssl.conf
  • I have tried out all of this options:

    SSLProtocol ALL -SSLv2 -SSLv3 
    ----------
    SSLProtocol +TLSv1 -SSLv2 -SSLv3
    ----------
    SSLProtocol TLSv1
    ----------
    SSLProtocol -ALL TLSv1
    ----------
    

But what ever I try, still all Protocol are available...

Why can't I disable it?

Edit: So i have tried so much out that i want to recap it:
I only have one declaration of SSLProtocol and it doesn't matter where I put it (in my vhost conf or my ssl-default conf).
I know that it is loaded, because the denying of all protocols with the option "-all" works fine. The denying of a special protocol doesn't work (like the option -SSLv3). If one protocol is allowed, every protocol is available (for example with "SSLProtocol TLSv1 -SSLv2 -SSLv3" or "SSLProtocol -all TLSv1" every protocol is available!).
Some ideas?

  • Have you reloaded/restarted apache after each config stage? Enabled debugging? What do the logs tell you? – Shadur Oct 27 '14 at 9:51
  • I have restarted apache every time and I don't know what the logs should say? For me it looks normal but i will set the log level to debug and check again Edit: still the same with log level debug... – manderda Oct 27 '14 at 10:28
  • How do you know they are available? If you try connecting with "openssl s_client -ssl3 -host [your ip] -port 443" You will get "routines:SSL3_GET_RECORD:wrong version number if its not supported. If it's supported you will see a certificate and much more. – Thomas K Oct 27 '14 at 11:29
  • 1
    Do you have more than one ssl.conf on your server? Are there separate SSL entries for vhosts? – Sree Oct 27 '14 at 12:32
  • 1
    Have you tried with "-ALL" in lower case? In httpd.apache.org/docs/2.2/ssl/ssl_howto.html the syntax is in lower case for SSLProtocol and upper case for SSLCipherSuite. – Thomas K Oct 27 '14 at 12:34
2

I just solved this myself with the POODLE exploit.

For OpenSuSE only, add the following into your /etc/apache2/ssl-global.conf

<IfDefine SSL>
<IfDefine !NOSSL>
<IfModule mod_ssl.c>
  #Your other stuff
  SSLProtocol All -SSLv2 -SSLv3
</IfModule>
</IfDefine>
</IfDefine>

Save, exit, and restart apache with the following rcapache2 restart

If there are still any problems let me know.

  • I have already tried that... – manderda Oct 27 '14 at 14:05
  • @manderda, What tool are you using to check that SSLv3 is still present? – SailorCire Oct 27 '14 at 14:07
  • as I said before: I am checking my Server with SSLLabs.com and with "openssl s_client -connect website:443 -quiet -ssl2" – manderda Oct 27 '14 at 14:16
  • @manderda what is in the respective vhosts and in httpd.conf? Your original question explicitly mentions ssl.conf while the default for OpenSuSE is to use ssl-global.conf – SailorCire Oct 27 '14 at 14:22
  • I do mean the ssl-global.conf. Sorry for that misstake – manderda Oct 27 '14 at 14:41
0

Looks like your SSLProtocol ... gets loaded after your SSL site.

You can check if this is the case with:

strace httpd -t 2>&1 | egrep 'open\("\/etc\/(apache(2|)|httpd)\/.*\.conf'

don't know how opensuse implements apache2, maybe use apache2 -t instead of httpd -t.

If your SSL conf is below your SITE conf or or the config which contains your SITE definition, the config does not apply to your SITE conf.

You have two options then:

  1. make sure SSL conf is loaded before your SITE conf.
  2. implement SSLProtocol ... in your SITE conf/SITE definition.
  • With Site conf you mean where my VirtualHost is defined? I dont have a site.conf file... – manderda Oct 27 '14 at 14:10
  • Yep. Take SITE conf and SITE definition as synonyms here – xx4h Oct 27 '14 at 14:12
  • okay, my ssl conf is loaded before my site conf. SSLv2 and SSLv3 still available. – manderda Oct 27 '14 at 14:14
  • Maybe it's overwritten globally by another conf file (inside a VirtualHost only applies to the VirtualHost itself). grep -Ri SSLProtocol /etc/httpd (or maybe /etc/apache2). – xx4h Oct 27 '14 at 14:16
  • 1
    Just append SSLProtocol ... to the VirtualHost and check if that works. – xx4h Oct 27 '14 at 14:19
0

Try this

SSLProtocol -ALL +TLSv1

Instead of

SSLProtocol ALL -SSLv2 -SSLv3 
----------
SSLProtocol +TLSv1 -SSLv2 -SSLv3
----------
SSLProtocol TLSv1
----------
SSLProtocol -ALL TLSv1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.