tweaking security of IdP deployment

[IAM David Bantz]

SSLv3 is disabled in tomcat 6.0.16 by replacing
        sslProtocol="TLS"
        sslEnabledProtocols="TLSv1.1,TLSv1.2"
with
        sslProtocols="TLSv1,TLSv1.1,TLSv1.2"
in the Connector statement in tomcat's ~/conf/server.xml
(though, as Chris Bongarats noted, support for 1.1 and 1.2 depends on JDK
later than my 1.6).

Thanks for the pointers.

David Bantz

On Fri, Dec 12, 2014 at 12:24 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 12/12/14, 8:32 PM, "IAM David Bantz" <dabantz at alaska.edu> wrote:
>
>
>
> >My IdP is running in tomcat 6.0.16-0 [updated SSL libraries
> >mod_ssl.x86_64 1:2.2.3-91.el5,  openssl.i686  0.9.8e-31.el5_11,
> >openssl.x86_64  0.9.8e-31.el5_11 and java-sun.x86_64
> >1.6.0.45-1jpp.1.el5_9 ].
>
> OpenSSL isn't relevant, and Java 6 is EOL. So you'd start by moving to
> Java 7.
>
> >Removing older ciphers this way is effective (they don't show up in SSL
> >Labs test), but SSL Labs test still indicates support for SSL 3 and not
> >TLS 1.2 (nor 1.1 for that matter).
>
> I would ask Tomcat's list how to disable SSLv3 for certain if that isn't
> doing it.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141212/e9e70636/attachment.html