0

I searched all over but could not find an easy way to upgrade Apache without recompiling. I installed httpd24 from this instructions but could not figure out how to replace httpd with httpd24.

Is there a way to update repositories and use yum to handle Apache upgrade?

Being a production server, I would like to keep things straightforward so that security patches can be automatically applied.

I was able to upgrade OpenSSL to version 1.1.0.

What prompted me to upgrade: I want the server to be up to date with security. I am also working towards a A+ score at www.ssllabs.com/ssltest/. I am currently at A. I see these 2 messages: This site works only in browsers with SNI support. and Client does not support DH parameters > 1024 bits. DHParameters (4096) is created in the server but...

SSLOpenSSLConfCmd DHParameters "/etc/ssl/certs/dhparam.pem"

...does not work in Apache 2.4.6 and I do not want to add it to site ssl certificate as it gets updated automatically by Let's Encrypt.

  • I don't think that "Client does not support DH parameters > 1024 bits" is the reason to not get A+. Allowing DH parameters <= 1024 bits is insecure and your server would be insecurely used by such clients. This should result in less than A rating. – rudimeier Sep 21 '16 at 17:15
0

Red Hat/CentOS often makes updates to software by backporting those changes into previous version (i.e. it updates the current version but doesn't change the actual version number). httpd-2.4.6 is the latest available 'version' of httpd for CentOS 7.

Checking the announcements list, the latest update for httpd on CentOS 7 is CESA-2016:1422.

Follow the links, in particular, go to the corresponding Red Hat errata, then down to the CVE section for 1353755. If you read through the bugzilla report, you will see that these latest fixes have been applied to httpd-2.4.6.40 for Red Hat/CentOS. It also mentions that ASF plans to address the issues in 2.4.24.

The latest Apache httpd is 2.4.23. Given that, if you are running httpd-2.4.6-40 on CentOS 7, you have the latest and greatest version of httpd for CentOS 7.

0

RE: getting A+ at www.ssllabs.com/ssltest/ I was missing this option:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

So, to get A+ score add all of these params to /etc/httpd/conf/httpd.conf

SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder on
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.