From dd610ce84fa09937008a0e5b8d5c89dfa80b0b75 Mon Sep 17 00:00:00 2001 From: Aaron Andersen Date: Thu, 7 Feb 2019 14:05:44 -0500 Subject: [PATCH 1/3] nixos/httpd: disable TLSv1 by default for better security --- nixos/modules/services/web-servers/apache-httpd/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/web-servers/apache-httpd/default.nix b/nixos/modules/services/web-servers/apache-httpd/default.nix index bb962334786..b520996bbc1 100644 --- a/nixos/modules/services/web-servers/apache-httpd/default.nix +++ b/nixos/modules/services/web-servers/apache-httpd/default.nix @@ -639,8 +639,8 @@ in sslProtocols = mkOption { type = types.str; - default = "All -SSLv2 -SSLv3"; - example = "All -SSLv2 -SSLv3 -TLSv1"; + default = "All -SSLv2 -SSLv3 -TLSv1"; + example = "All -SSLv2 -SSLv3"; description = "Allowed SSL/TLS protocol versions."; }; } From 70be5b6bb2b65821db34b4b6146666b9c38dac51 Mon Sep 17 00:00:00 2001 From: Aaron Andersen Date: Thu, 7 Feb 2019 14:13:45 -0500 Subject: [PATCH 2/3] nixos/httpd: disable HTTP TRACE method by default --- nixos/modules/services/web-servers/apache-httpd/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/services/web-servers/apache-httpd/default.nix b/nixos/modules/services/web-servers/apache-httpd/default.nix index b520996bbc1..f9385a70a3c 100644 --- a/nixos/modules/services/web-servers/apache-httpd/default.nix +++ b/nixos/modules/services/web-servers/apache-httpd/default.nix @@ -376,6 +376,8 @@ let Include ${httpd}/conf/extra/httpd-multilang-errordoc.conf Include ${httpd}/conf/extra/httpd-languages.conf + TraceEnable off + ${if enableSSL then sslConf else ""} # Fascist default - deny access to everything. From 1bec75301bd9d15c2ee0be4c587bc652f65df582 Mon Sep 17 00:00:00 2001 From: Aaron Andersen Date: Thu, 7 Feb 2019 14:25:55 -0500 Subject: [PATCH 3/3] nixos/httpd: don't advertise php --- nixos/modules/services/web-servers/apache-httpd/default.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/nixos/modules/services/web-servers/apache-httpd/default.nix b/nixos/modules/services/web-servers/apache-httpd/default.nix index f9385a70a3c..eebb1c413fa 100644 --- a/nixos/modules/services/web-servers/apache-httpd/default.nix +++ b/nixos/modules/services/web-servers/apache-httpd/default.nix @@ -686,6 +686,9 @@ in '' ; Needed for PHP's mail() function. sendmail_path = sendmail -t -i + + ; Don't advertise PHP + expose_php = off '' + optionalString (!isNull config.time.timeZone) '' ; Apparently PHP doesn't use $TZ.