Bug 1274890 - mod_ssl config: tighten defaults
mod_ssl config: tighten defaults
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: httpd (Show other bugs)
All Linux
unspecified Severity urgent
: rc
: ---
Assigned To: Luboš Uhliarik
Maryna Nalbandian
Lenka Špačková
: 1388068 1428434 1457785 1492637 (view as bug list)
Depends On:
Blocks: 1203710 1298243 1420851 1465904 1466370 1473733 1492637
  Show dependency treegraph
Reported: 2015-10-23 14:49 EDT by Pat Riehecky
Modified: 2018-02-19 11:30 EST (History)
15 users (show)

See Also:
Fixed In Version: httpd-2.4.6-7a9.el7
Doc Type: Release Note
Doc Text:
`SSLv3` disabled in *mod_ssl* To improve the security of SSL/TLS connections, the default configuration of the *httpd mod_ssl* module has been changed to disable support for the `SSLv3` protocol, and to restrict the use of certain cryptographic cipher suites. This change will affect only fresh installations of the _mod_ssl_ package, so existing users should manually change the SSL configuration as required. Any SSL clients attempting to establish connections using `SSLv3`, or using a cipher suite based on `DES` or `RC4`, will be denied in the new default configuration. To allow such insecure connections, modify the `SSLProtocol` and `SSLCipherSuite` directives in the `/etc/httpd/conf.d/ssl.conf` file.
Story Points: ---
Clone Of: 1274876
: 1492637 (view as bug list)
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Pat Riehecky 2015-10-23 14:49:10 EDT
Verified on default EL7

+++ This bug was initially created as a clone of Bug #1274876 +++

Description of problem:
The default configuration of mod_ssl in EL5 permits SSLv3 connections.  Per CVE-2014-3566 this protocol is known to be a security risk.

Version-Release number of selected component (if applicable):mod_ssl-2.2.3-87

How reproducible:100%

Steps to Reproduce:
1.Install apache with mod_ssl
2.enable connections to port 443 via apache mod_ssl using the default config
3.test a SSLv3 connection

Actual results:
SSLv3 connections are permitted

Expected results:
Since SSLv3 has known security issues, I expected it to be disabled by default.

Additional info:
Comment 3 Jim Lyle 2015-12-11 10:36:58 EST
Potention Patch:

--- SOURCES/ssl.conf    2015-10-30 10:26:57.000000000 -0500
+++ SOURCES/ssl.conf    2015-10-30 10:27:12.000000000 -0500
@@ -96,8 +96,8 @@ SSLEngine on
 #   SSL Protocol support:
 # List the enable protocol levels with which clients will be able to
-# connect.  Disable SSLv2 access by default:
-SSLProtocol all -SSLv2
+# connect.  Disable SSLv2/v3 access by default:
+SSLProtocol all -SSLv2 -SSLv3
 #   SSL Cipher Suite:
 # List the ciphers that the client is permitted to negotiate.
Comment 4 Luboš Uhliarik 2016-12-06 06:09:41 EST
*** Bug 1388068 has been marked as a duplicate of this bug. ***
Comment 6 Joe Orton 2017-07-13 11:44:45 EDT
*** Bug 1457785 has been marked as a duplicate of this bug. ***
Comment 7 Joe Orton 2017-07-13 11:45:15 EDT
*** Bug 1428434 has been marked as a duplicate of this bug. ***
Comment 11 Branislav Náter 2017-11-01 12:06:43 EDT
*** Bug 1492637 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.