Merge pull request #55410 from aanderse/apache-defaults

nixos/httpd: improve security in configuration file
This commit is contained in:
Silvan Mosberger 2019-02-18 03:27:18 +01:00 committed by GitHub
commit a3f85f0dc0
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -376,6 +376,8 @@ let
Include ${httpd}/conf/extra/httpd-multilang-errordoc.conf Include ${httpd}/conf/extra/httpd-multilang-errordoc.conf
Include ${httpd}/conf/extra/httpd-languages.conf Include ${httpd}/conf/extra/httpd-languages.conf
TraceEnable off
${if enableSSL then sslConf else ""} ${if enableSSL then sslConf else ""}
# Fascist default - deny access to everything. # Fascist default - deny access to everything.
@ -639,8 +641,8 @@ in
sslProtocols = mkOption { sslProtocols = mkOption {
type = types.str; type = types.str;
default = "All -SSLv2 -SSLv3"; default = "All -SSLv2 -SSLv3 -TLSv1";
example = "All -SSLv2 -SSLv3 -TLSv1"; example = "All -SSLv2 -SSLv3";
description = "Allowed SSL/TLS protocol versions."; description = "Allowed SSL/TLS protocol versions.";
}; };
} }
@ -684,6 +686,9 @@ in
'' ''
; Needed for PHP's mail() function. ; Needed for PHP's mail() function.
sendmail_path = sendmail -t -i sendmail_path = sendmail -t -i
; Don't advertise PHP
expose_php = off
'' + optionalString (!isNull config.time.timeZone) '' '' + optionalString (!isNull config.time.timeZone) ''
; Apparently PHP doesn't use $TZ. ; Apparently PHP doesn't use $TZ.