Ttyjfyk

How do I find out the mythology and history of my Fortress?

Circuit to "zoom in" on mV fluctuations of a DC signal?

Around usage results

How come Sam didn't become Lord of Horn Hill?

How to tell that you are a giant?

How do I make this wiring inside cabinet safer? (Pic)

How could we fake a moon landing now?

Using et al. for a last / senior author rather than for a first author

What would be the ideal power source for a cybernetic eye?

What is homebrew?

Why are there no cargo aircraft with "flying wing" design?

Extracting terms with certain heads in a function

Can anything be seen from the center of the Boötes void? How dark would it be?

What is the meaning of the simile “quick as silk”?

Withdrew £2800, but only £2000 shows as withdrawn on online banking; what are my obligations?

Is the Standard Deduction better than Itemized when both are the same amount?

Can a new player join a group only when a new campaign starts?

What is the longest distance a player character can jump in one leap?

What does the "x" in "x86" represent?

For a new assistant professor in CS, how to build/manage a publication pipeline

Integration Help

Why wasn't DOSKEY integrated with COMMAND.COM?

If a VARCHAR(MAX) column is included in an index, is the entire value always stored in the index page(s)?

How does the math work when buying airline miles?

allowing and banning cipher-suites apache2.2

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;

-1

There is a list of banned and recommended cipher-suites that I need to add to ssl.conf file, and I'm facing some problem when trying to configure it:

I need to ban all ECDH* and allow 15 cipher-suites starting with ECDHE*, such as ECDHE-RSA-AES128-SHA256.

How to configure it to work?

apache-httpd configuration ssl

share|improve this question

edited 9 hours ago

Bar

asked 10 hours ago

BarBar

509

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What was done until now?
  
  – Rui F Ribeiro
  9 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What do you mean? until now I didn't need to ban ECDH as written in the question...
  
  – Bar
  9 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  downvoted for 0 research work.
  
  – Rui F Ribeiro
  9 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I saw that each ECDHE* from the list should be written. However, I wanted to see if there's another solution because the list is long.
  
  – Bar
  9 hours ago
  

  
  
  
  

add a comment | 

-1

There is a list of banned and recommended cipher-suites that I need to add to ssl.conf file, and I'm facing some problem when trying to configure it:

I need to ban all ECDH* and allow 15 cipher-suites starting with ECDHE*, such as ECDHE-RSA-AES128-SHA256.

How to configure it to work?

apache-httpd configuration ssl

share|improve this question

edited 9 hours ago

Bar

asked 10 hours ago

BarBar

509

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What was done until now?
  
  – Rui F Ribeiro
  9 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What do you mean? until now I didn't need to ban ECDH as written in the question...
  
  – Bar
  9 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  downvoted for 0 research work.
  
  – Rui F Ribeiro
  9 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I saw that each ECDHE* from the list should be written. However, I wanted to see if there's another solution because the list is long.
  
  – Bar
  9 hours ago
  

  
  
  
  

add a comment | 

There is a list of banned and recommended cipher-suites that I need to add to ssl.conf file, and I'm facing some problem when trying to configure it:

I need to ban all ECDH* and allow 15 cipher-suites starting with ECDHE*, such as ECDHE-RSA-AES128-SHA256.

How to configure it to work?

apache-httpd configuration ssl

share|improve this question

edited 9 hours ago

Bar

asked 10 hours ago

BarBar

509

share|improve this question

edited 9 hours ago

Bar

asked 10 hours ago

BarBar

509

share|improve this question

edited 9 hours ago

Bar

asked 10 hours ago

BarBar

509

asked 10 hours ago

BarBar

509

asked 10 hours ago

BarBar

509

1 Answer
1

active

oldest

votes

0

So it seems that you know the syntax of the config file but just don't want to fiddle around with the huge list of ciphers: a text editing problem.

The list of ECDHE* ciphers is given by the shell command

openssl ciphers | tr ":" "n" | grep ^ECDHE | tr "n" ":" | sed 's/:$//'

You didn't say what you wanted to do with ciphers whose names don't start with ECDH* but by changing the argument to grep in the above you can get any sort of cipher list you want and concatenate them in your text editor as needed. So to get a list of AES ciphers but not the AES128* ones you'd say ^AES[^1]

That said, there might still be some manual fiddling to do as the order of the ciphers in the list can be important. You can, and probably should, specify that the server shall try the ciphers in the order that they are in the enabling list.

share|improve this answer

answered 8 hours ago

NadreckNadreck

1759

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f513030%2fallowing-and-banning-cipher-suites-apache2-2%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

0

So it seems that you know the syntax of the config file but just don't want to fiddle around with the huge list of ciphers: a text editing problem.

The list of ECDHE* ciphers is given by the shell command

openssl ciphers | tr ":" "n" | grep ^ECDHE | tr "n" ":" | sed 's/:$//'

You didn't say what you wanted to do with ciphers whose names don't start with ECDH* but by changing the argument to grep in the above you can get any sort of cipher list you want and concatenate them in your text editor as needed. So to get a list of AES ciphers but not the AES128* ones you'd say ^AES[^1]

That said, there might still be some manual fiddling to do as the order of the ciphers in the list can be important. You can, and probably should, specify that the server shall try the ciphers in the order that they are in the enabling list.

share|improve this answer

answered 8 hours ago

NadreckNadreck

1759

add a comment | 

0

So it seems that you know the syntax of the config file but just don't want to fiddle around with the huge list of ciphers: a text editing problem.

The list of ECDHE* ciphers is given by the shell command

openssl ciphers | tr ":" "n" | grep ^ECDHE | tr "n" ":" | sed 's/:$//'

You didn't say what you wanted to do with ciphers whose names don't start with ECDH* but by changing the argument to grep in the above you can get any sort of cipher list you want and concatenate them in your text editor as needed. So to get a list of AES ciphers but not the AES128* ones you'd say ^AES[^1]

That said, there might still be some manual fiddling to do as the order of the ciphers in the list can be important. You can, and probably should, specify that the server shall try the ciphers in the order that they are in the enabling list.

share|improve this answer

answered 8 hours ago

NadreckNadreck

1759

add a comment | 

So it seems that you know the syntax of the config file but just don't want to fiddle around with the huge list of ciphers: a text editing problem.

The list of ECDHE* ciphers is given by the shell command

openssl ciphers | tr ":" "n" | grep ^ECDHE | tr "n" ":" | sed 's/:$//'

You didn't say what you wanted to do with ciphers whose names don't start with ECDH* but by changing the argument to grep in the above you can get any sort of cipher list you want and concatenate them in your text editor as needed. So to get a list of AES ciphers but not the AES128* ones you'd say ^AES[^1]

That said, there might still be some manual fiddling to do as the order of the ciphers in the list can be important. You can, and probably should, specify that the server shall try the ciphers in the order that they are in the enabling list.

share|improve this answer

answered 8 hours ago

NadreckNadreck

1759

openssl ciphers | tr ":" "n" | grep ^ECDHE | tr "n" ":" | sed 's/:$//'

share|improve this answer

answered 8 hours ago

NadreckNadreck

1759

answered 8 hours ago

NadreckNadreck

1759

answered 8 hours ago

NadreckNadreck

1759