Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Can't disable SSLv3 in Apache + mod_nss
Top Forums UNIX for Dummies Questions & Answers Can't disable SSLv3 in Apache + mod_nss Post 302954909 by gacanepa on Saturday 12th of September 2015 09:31:34 PM
Old 09-12-2015
RedHat Can't disable SSLv3 in Apache + mod_nss
Hi everyone,

I am trying to implement TLS through mod_nss in Apache (RHEL 7). As per the documentation, I have installed mod_nss and removed mod_ssl.

I have followed the steps outlined in the documentation (see above link), especially making sure that the NSSProtocol directive reads as follows (according to the docs, this disables all SSL and TLS protocol versions except TLS version 1 and higher):

Code:
NSSProtocol TLSv1.0,TLSv1.1

Then I restarted Apache and tested whether SSLv3 is enabled:
Code:
openssl s_client -connect localhost:443 -ssl3

which returns (output has been truncated for brevity):

Code:
[root@box1 ~]# openssl s_client -connect localhost:443 -ssl3
CONNECTED(00000003)
139894684407712:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:339:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 7 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol  : SSLv3
Cipher    : 0000
Session-ID: 
Session-ID-ctx: 
Master-Key: 
Key-Arg   : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
Start Time: 1442107224
Timeout   : 7200 (sec)
Verify return code: 0 (ok)
---
[root@box1 ~]#

As you can see, the handshake completes (as indicated by SSL handshake has read 5 bytes and written 7 bytes) so that makes me doubt that SSLv3 has been actually disabled.

I have spent countless hours searching for a solution but everything I've been able to found tells me how to disable SSLv3 through mod_ssl, not mod_nss.

Any ideas or clarifications will be more than welcome.
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Disable X

Im sure this is somthing easy to do but i just can not figure it out where and how would i take X out of the boot for hp ux 11 i looked in the man's and nothing so maybe sombody could throw me a bone... thanks BB (8 Replies)
Discussion started by: bbutler3295
8 Replies

2. UNIX for Dummies Questions & Answers

disable su

i have this unix version "unix v/386" and i want to disable su kindly help me (2 Replies)
Discussion started by: sak900354
2 Replies

3. Solaris

How to disable SU right

Anyone know how to disable SU right for a particular user in Solaris 8 (4 Replies)
Discussion started by: civic2005
4 Replies

4. Shell Programming and Scripting

How to disable Enable/Disable Tab Key

Hi All, I have bash script, so what is sintax script in bash for Enable and Disable Tab Key. Thanks for your help.:( Thanks, Rico (1 Reply)
Discussion started by: carnegiex
1 Replies

5. Solaris

How disable alom?

hello guys.... I'm newbie in solaris server / os, anybody know how disable alom server v240. thank u (9 Replies)
Discussion started by: yanto85
9 Replies

6. Solaris

Printer always disable itself

Hi, I am using solaris 10, 1 of the printers encounter some issue and it is always disable itself and dont know why? any idea how to make it auto enable back to normal? is there any configuration or scripts?? kindly advise me. thanks. (2 Replies)
Discussion started by: freshmeat
2 Replies

7. Solaris

Problem compiling mod_nss for Apache2.2 Solaris 10

Following this guide for Solaris 9. Updated it for the nspr-4.6.4 and nss-3.11.4. Here is my configure command in the mod_nss 1.0.8 dir: ./configure --with-apxs=/usr/local/apache2/bin/apxs --with-nss=/usr/local/nss-3.11.4/ --with-nspr=/usr/local/nspr-4.6.4/ And here is the error... (2 Replies)
Discussion started by: LittleLebowski
2 Replies

8. Red Hat

SSL/TLS renegotiation DoS -how to disable? Is it advisable to disable?

Hi all Expertise, I have following issue to solve, SSL / TLS Renegotiation DoS (low) 222.225.12.13 Ease of Exploitation Moderate Port 443/tcp Family Miscellaneous Following is the problem description:------------------ Description The remote service encrypts traffic using TLS / SSL and... (2 Replies)
Discussion started by: manalisharmabe
2 Replies

9. Web Development

Apache module development on apache 2.2

Hi, I'm new to developing modules for Apache. I understand the basics now and can develop something simple which allows a 'GET' request to happen, but what I want to do is actually 'POST' information to my site. I know the basic POST Request works and I can see that it is post by looking at... (2 Replies)
Discussion started by: fishman2001
2 Replies

10. Red Hat

Process not running: /opt/java15/jdk/bin/java -classpath /opt/apache/apache-ant-1.7.0-mod/lib/ant-la

Have no idea on what the below error message is: Process not running: /opt/java15/jdk/bin/java -classpath /opt/apache/apache-ant-1.7.0-mod/lib/ant-launcher.jar org.apache.tools.ant.launch.Launcher -buildfile build.xml dist. Any help? (3 Replies)
Discussion started by: gull05
3 Replies

LEARN ABOUT SUNOS

apache

apache(1M)						  System Administration Commands						apache(1M)

NAME

       apache - Apache hypertext transfer protocol server overview

DESCRIPTION

	apache	consists  of a main server daemon, loadable server modules, some additional support utilities, configuration files, and documenta-
       tion.

FILES

       The apache HTTPD server is integrated with Solaris.

       The following files specify the installation locations for apache:

       /etc/apache	       Contains server configuration files.

			       A newly-installed server must be manually configured before use. Typically this involves copying httpd.conf-example
			       to the httpd.conf file and making local configuration adjustments.

       /usr/apache/bin	       Contains the httpd executable as well as other utility programs.

       /usr/apache/htdocs      Contains  the  Apache  manual  in HTML format. This documentation is accessible by way of a link on the server test
			       page that gets installed upon fresh installation.

       /usr/apache/include     Contains the Apache header files, which are needed for building various optional server extensions with apxs(8)

       /usr/apache/jserv       Contains documention for the mod_jserv java servlet module. Documention can be read with a web  browser	using  the
			       url:

			       file:/usr/apache/jserv/docs/index.html

       /usr/apache/libexec     Contains loadable modules (DSOs) supplied with the server. Any modules which are added using apxs(8)are also copied
			       into this directory.

       /usr/apache/man	       Contains man pages for the server, utility programs, and mod_perl.

			       Add this directory to your MANPATH to read the Apache man pages. See NOTES.

       /usr/apache/perl5       Contains the modules and library files used by the mod_perl extension to Apache.

       /var/apache/cgi-bin     Default location for the CGI scripts.

			       This can be changed by altering the httpd.conf file and restarting the server.

       /var/apache/htdocs      Default document root.

			       This can be changed by altering the httpd.conf file and restarting the server.

       /var/apache/icons       Icons used by the server.

			       This normally shouldn't need to be changed.

       /var/apache/logs        Contains server log files.

			       The formats, names, and locations of the files in this directory can be altered by various configuration directives
			       in the httpd.conf file.

       /var/apache/proxy       Directory used to cache pages if the caching feature of mod_proxy is enabled in the httpd.conf file.

			       The location of the cache can also be changed by changing the proxy configuration in the httpd.conf file.

ATTRIBUTES

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE	     |	    ATTRIBUTE VALUE	   |
       +-----------------------------+-----------------------------+
       |Availability		     |SUNWapchr 		   |
       +-----------------------------+-----------------------------+
       |			     |SUNWapchu 		   |
       +-----------------------------+-----------------------------+
       |			     |SUNWapchd 		   |
       +-----------------------------+-----------------------------+

SEE ALSO

       attributes(5)

       http://www.apache.org

NOTES

       In addition to the documentation and man pages included with Solaris, more information is available at http://www.apache.org

       The  Apache  man pages are provided with the programming modules. To view the manual pages for the Apache modules with the man command, add
       /usr/apache/man to the MANPATH environment  variable. See man(1) for  more information. Running catman(1M) on the Apache  manual  pages	is
       not supported.

SunOS 5.10							    8 Aug 2000								apache(1M)
All times are GMT -4. The time now is 07:27 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy