Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking for some recommendations for securing a server against SSLstrip. Anyone have any suggestions?

share|improve this question
    
Isn't SSLstrip really an attack against clients? I am not sure there really is anything you can do to protect people connecting to you. –  Zoredache Feb 11 '11 at 2:32
    
wouldn't this be securitybeta material? –  Jacob Feb 11 '11 at 2:55
add comment

3 Answers

up vote 2 down vote accepted

SSLstrip's target is not the server but the session between the user and the hijacked hop. It preys on the users' inabilities to discern between a real SSL session and a lookalike. The best mitigation, then, is making sure your users are aware of what a proper SSL connection to your website looks like: https://, don't rely on the favicon "padlock", etc.

Unfortunately, since the trouble is largely on the client side, there is not a lot you can do on the server side to fix your users' naivety. You can put some notes on your login/CC page itself directing users to check for a proper SSL connection, but who is to say that that won't be stripped out by an attacker?

One option is to use something like NoScript (or HSTS as agl mentioned).

I like to set browser.identity.ssl_domain_display to 2 in Firefox to make the SSL pages way more obvious and set network.IDN_show_punycode to true to avoid homograph attacks.

Again, these are things which have to be done on the client side, and not guaranteed to be done by your users! Assume at least some of your users don't care and will click through anything.

share|improve this answer
add comment

HSTS is what you want. It allows you to specify that your site should always be accessed over HTTPS and it's supported by Chrome and Firefox 4. (And, with the NoScript extension, Firefox 3 too.)

See http://dev.chromium.org/sts

share|improve this answer
add comment
  1. Force SSL on all critical pages (preferably using an EV SSL certificate and preferably on all pages - Like PayPal - so there aren't any http pages that can be injected)

  2. Educate your visitors so they know something is fishy if they receive an SSL error or switch to a different domain

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.