Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I read about the CRIME attack against TLS Compression (CVE-2012-4929, CRIME is a successor to the BEAST attack against ssl & tls), and I want to protect my webservers against this attack by disabling SSL Compression, which was added to Apache 2.2.22 (See Bug 53219).

I am running Scientific Linux 6.3, which ships with httpd-2.2.15. Security fixes for upstream versions of httpd 2.2 should be backported to this version.

# rpm -q httpd
httpd-2.2.15-15.sl6.1.x86_64

# httpd -V
Server version: Apache/2.2.15 (Unix)
Server built:   Feb 14 2012 09:47:14
Server's Module Magic Number: 20051115:24
Server loaded:  APR 1.3.9, APR-Util 1.3.9
Compiled using: APR 1.3.9, APR-Util 1.3.9

I tried SSLCompression off in my configuration, but that results in the following error message:

# /etc/init.d/httpd restart
Stopping httpd:                                            [  OK  ]
Starting httpd: Syntax error on line 147 of /etc/httpd/httpd.conf:
Invalid command 'SSLCompression', perhaps misspelled or defined by a module not included in the server configuration
                                                           [FAILED]

Is it possible to disable SSLCompression with this version of Apache Webserver?

share|improve this question

1 Answer 1

up vote 12 down vote accepted

On March 4, 2013, Red Hat provided updated OpenSSL packages which address this issue. You can receive them through your normal update channels.

The original answer was:


Red Hat has not provided an updated package which provides this functionality, though there is a workaround available. Edit the /etc/sysconfig/httpd file and add this line to it:

export OPENSSL_NO_DEFAULT_ZLIB=1

Then restart Apache:

service httpd restart

This will cause OpenSSL, which provides crypto functions for Apache, to not offer compression.

share|improve this answer
    
What about mod_deflate? Shouldn't that be disabled as well? –  sjbotha Mar 7 '13 at 20:06
    
No, that's irrelevant. –  Michael Hampton Mar 7 '13 at 20:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.