Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Looking at thc-ssl-dos, it only affects SSL enabled web sites with renegotiations enabled.

I have been checking a few servers and have the following questions;

First; renegotiations are disabled by default on my Apache installations, so in what scenarios would I enable it?

Secondly; I have a dev box with a few vhosts on it, how can I enabled it (for the default site only) so I can test the effectiveness of this attack? I'm running apache2 on Debian squeeze.

Thank you.

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

SSL/TLS Renegotiations were enabled by default but many linux distros released patched versions of Apache that disabled renegotiations. You need to check the version number and changelog for your Apache distribution to be sure.

Assuming you are using a version that has renegotiations disabled, you can re-enable it by setting SSLInsecureRenegotiation on in your apache config.

share|improve this answer
add comment

Apache 2.2.15 or greater running with OpenSSL 0.9.8l or lower disables client-initiated renegotiation completely, no way to turn it on.

With OpenSSL 0.9.8m in Apache 2.2.15 or greater, you have a couple things going on:

  • The new secure renegotiation standard from RFC 5746 is enabled by default.
  • The old renegotiation protocol is disabled by default, but can be re-enabled if desired for clients that don't support the new standard via the SSLInsecureRenegotiation On directive.

From the little digging that I've done on this issue, it's unclear to me whether the type of renegotiation in use (the new, "secure" kind or the old standard) has a bearing on whether the attack is successful - it may work just on one or the other, or on both.

As far as the scenarios that it needs to be enabled for, I believe that client certificate authentication is the main use case.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.