<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div></div>Sure, do it. No concerns.<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><div><br></div><div>Here's some other stuff you can do if you have an Apache proxy in the way. Most can probably be done in Jetty as well.</div><div><br></div><div># Make your default virtual host reject all requests. Only respond if there is</div><div># a correct Host: header. This makes a lot of lame scanners go away.</div><div><div>NameVirtualHost *:443</div><div><VirtualHost *:443></div><div> ServerName default</div><div> SSLEngine on</div><div> <Location /></div><div> Order deny,allow</div><div> Deny from all</div><div># possibly Allow from your authorized scanner/pen tester</div><div> </Location></div></div><div></VirtualHost></div><div><VirtualHost *:443></div><div><div><span style="background-color: rgba(255, 255, 255, 0);">ServerName <a href="http://login.carleton.edu">login.carleton.edu</a></span></div><div><span style="background-color: rgba(255, 255, 255, 0);">SSLEngine on</span></div></div><div><span style="background-color: rgba(255, 255, 255, 0);"># normal config only within this vhost...</span></div><div><br></div><div><div> # 6 month HSTS, tell modern browsers not to use plaintext http transport.</div><div> Header set Strict-Transport-Security "max-age=15768000; includeSubDomains"</div><div> # Prevents wrapping your site in an IFRAME, mitigating clickjacking attacks.</div><div> Header set X-Frame-Options "deny"</div><div><span style="background-color: rgba(255, 255, 255, 0);"> # This stops I.E. from going into "I.E. 7 compatibility mode" which may have security</span></div><div><span style="background-color: rgba(255, 255, 255, 0);"> # or html display bugs. Assumes you don't have web designers "optimize for I.E."</span></div><div> Header set X-UA-Compatible "IE=edge"</div><div> # Tells I.E. not to override the server's MIME Content-Type and execute text/plain</div><div> # or image/gif as HTML/JavaScript, which can open XSS possibilities. </div><div> Header set X-Content-Type-Options "nosniff"</div><div> # Tells older I.E. to look for and block reflected XSS. Most modern browsers have</div><div> # something similar on BY DEFAULT now.</div><div> Header set X-XSS-Protection "1; mode=block"</div><div> # Tell browsers to remember *both* your public key and your CA's public key. If</div><div> # *both* change, assume MITM attack and refuse to connect.</div><div> # <a href="https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning">https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning</a></div><div> # <a href="https://projects.dm.id.lv/s/pkp-online/calculator.html">https://projects.dm.id.lv/s/pkp-online/calculator.html</a></div><div> Header set Public-Key-Pins 'pin-sha256="+5MKBBhIf1NMVk2zyvtcSrsMUY+23Jbxrgsasy+lJtI="; pin-sha256="9mfYTsf5flM+gC8TTFkkaZp0QootIRChM0qetgyNp7Y="; max-age=5184000; includeSubDomains'</div><div> # Server enforced HttpOnly;Secure on all cookies.</div><div> # You can set this at the application layer in shib3/jetty9, but for shib2/tomcat it</div><div> # was easier to do it in Apache.</div><div> # Credit <a href="http://stackoverflow.com/a/11660223">http://stackoverflow.com/a/11660223</a></div><div> Header edit Set-Cookie "(?i)^((?:(?!;\s?HttpOnly).)+)$" "$1; HttpOnly"</div><div> Header edit Set-Cookie "(?i)^((?:(?!;\s?Secure).)+)$" "$1; Secure"</div><div> # Even if bad guys find a way to inject <script> tags, instruct</div><div> # modern browsers not to use images, xss, css from remote sites or</div><div> # misguided/evil Chrome plugins. Alas, shib2 requires "unsafe-inline."</div><div> <Location /></div><div> Header set Content-Security-Policy "connect-src 'self' <a href="https://login.carleton.edu">https://login.carleton.edu</a>; script-src 'self' <a href="https://login.carleton.edu">https://login.carleton.edu</a> <a href="https://*.duosecurity.com">https://*.duosecurity.com</a>; style-src 'self' 'unsafe-inline' <a href="https://login.carleton.edu">https://login.carleton.edu</a> <a href="https://*.duosecurity.com">https://*.duosecurity.com</a>; report-uri <a href="https://csp">https://csp</a> <a href="http://reports.carleton.edu/">reports.carleton.edu/</a>"</div><div> </Location></div><div> <Location /idp></div><div> Header set Content-Security-Policy "connect-src 'self' <a href="https://login.carleton.edu">https://login.carleton.edu</a>; script-src 'self' <a href="https://login.carleton.edu">https://login.carleton.edu</a> <a href="https://*.duosecurity.com">https://*.duosecurity.com</a> 'unsafe-inline'; style-src 'self' 'unsafe-inline' <a href="https://login.carleton.edu">https://login.carleton.edu</a> <a href="https://*.duosecurity.com">https://*.duosecurity.com</a>; report-uri <a href="https://cspreports.carleton.edu/">https://cspreports.carleton.edu/</a>"</div><div> </Location></div></div></body></html>