Openssl加固配置.docxVIP

Openssl加固配置Lvb整理ApacheSSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDHSSLProtocol All -SSLv2 -SSLv3SSLHonorCipherOrder OnHeader always set Strict-Transport-Security max-age includeSubdomains; preloadHeader always set X-Frame-Options DENYHeader always set X-Content-Type-Options nosniff# Requires Apache = 2.4SSLCompression off SSLSessionTickets OffSSLUseStapling on SSLStaplingCache shmcb:logs/stapling-cache(150000) nginxssl_protocols TLSv1 TLSv1.1 TLSv1.2;ssl_prefer_server_ciphers on;ssl_ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH;ssl_ecdh_curve secp384r1; # Requires nginx = 1.1.0ssl_session_cache shared:SSL:10m;ssl_session_tickets off; # Requires nginx = 1.5.9ssl_stapling on; # Requires nginx = 1.3.7ssl_stapling_verify on; # Requires nginx = 1.3.7resolver $DNS-IP-1 $DNS-IP-2 valid=300s;resolver_timeout 5s;add_header Strict-Transport-Security max-age includeSubdomains; preload;add_header X-Frame-Options DENY;add_header X-Content-Type-Options nosniff;Lighttpdssl.honor-cipher-order = enablessl.cipher-list = EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDHssl.use-compression = disablesetenv.add-response-header = ( Strict-Transport-Security = max-age includeSubdomains; preload, X-Frame-Options = DENY, X-Content-Type-Options = nosniff)ssl.use-sslv2 = disablessl.use-sslv3 = disablehaproxyglobal ssl-default-bind-options no-sslv3 no-tls-tickets force-tlsv12 ssl-default-bind-ciphers AES128+EECDH:AES128+EDHfrontend http-in mode http option httplog option forwardfor option http-server-close option httpclose bind 0:80 redirect scheme https code 301 if !{ ssl_fc }frontend https-in option httplog option forwardfor option http-server-close option httpclose rspadd Strict-Transport-Security:\ max-age\ includeSubdomains;\ preload rspadd X-Frame-Options:\ DENY bind 0:443 ssl crt /etc/haproxy/haproxy.pem ciphers AES128+EECDH:AES128+EDH force-tlsv12 no-sslv