Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The use of SSLv3.0/TLSv1.0 in combination with certain encryption techniques (CBC block ciphers) may allow for an attacker to predict the so-called Initialization Vector of subsequent SSL packets. Using this information the attacker can access the secure session of another user. This attack, named BEAST (Browser Exploit Against SSL/TLS), is aimed at the user’s browser and not at the web server. Nevertheless, it is possible to take countermeasures at the server side as well to prevent a successful attack.

The complete solution to this problem is disabling or deprioritizing the support for vulnerable encryption ciphers (CBC block ciphers) when using SSLv3.0/TLSv1.0. Commonly, this can be achieved by prioritizing RC4 ciphers in the cipher negotiation process.

For Apache web servers that support SSLv3.0/TLSv1.0 this can be configured by adding the following configuration:

SSLProtocol All –SSlv2
SSLHonorCipherOrder On
SSLCipherSuite RC4-SHA:HIGH:!ADH

For Apache web servers that support SSLv3.1/TLSv1.1 and higher, it is recommended to use the following configuration:

SSLProtocol All –SSlv2
SSLHonorCipherOrder On  
SSLCipherSuite ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM

As far as I know, JBoss 7 is based on a version of Apache that supports SSLv3.1/TLSv1.1 (maybe I am wrong), so the second alternative can be applied to JBoss 7.

My question is: Where/How should I configure it?

share|improve this question
    
I consulted but it is not clear. I found how to configure this in the Apache manual but not in JBoss. Can you help? –  Tony Sep 12 '12 at 12:31

1 Answer 1

I am not sure if this could be applied directly to JBOSS unless you want to front end Apache as a web server to JBOSS. Please look at the following feature request to address this issue and it hasnt been adressed yet since the issue is still open. https://issues.jboss.org/browse/AS7-5501.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.