AnsweredAssumed Answered

Please help me with disabling RC4 issue in Apache

Question asked by Bciar Chahedeh on May 3, 2018
Latest reply on May 4, 2018 by Rob Moss

Like • Show 0 Likes0
Comment • 11

Hello, everyone. Nice to meet you.

SSL Server Test: www.digitura.biz (Powered by Qualys SSL Labs)

I have a trouble because of RC4 in my apache server in centos.

Apache 2.4.6

OpenSSL 1.0.2

SSLProtocol ALL -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2
SSLHonorCipherOrder On
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4
SSLCompression off

Here is the content of my httpd.conf file about this problem.

Please help me.

Thanks and Warm Regards.

Rob Moss May 4, 2018 5:59 AM

Correct Answer

Nailed it. You need to edit the SSLCipherSuite line in /etc/httpd/conf.d/ssl.conf instead of the one in /etc/httpd/httpd.conf.

On CentOS, Amazon Linux and many other distributions, you're not supposed to make any changes to /etc/httpd/httpd.conf.

See the reply in context

No one else had this question

Outcomes

j-mailor May 4, 2018 12:17 AM

SSLCipherSuite looks fine to me, there is !RC4 included.

Did you:

a) Restart Apache server after setting !RC4 in SSLCipherSuite? If no, then restart Apache server.

b) Is there any other server (gateway, proxy, load balancer...) in front of your Apache that is accessed from internet? If yes, then you also need to check the setting of additional "gateway" like server.

By the way, SSLProtocol setting looks strange to me. It should not influence your RC4 problem, but setting it like that is strage:

"ALL -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2" <== ALL already includes +TLSv1.2

use:

"-ALL +TLSv1.2" <=== I have this setting on my server to only allow TLSv1.2. This is in my humble opinion the easiest to read.

or:

"-SSLv2 -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2"

"ALL -SSLv2 -SSLv3 -TLSv1 -TLSv1.1"

Actions

Bciar Chahedeh @ j-mailor on May 4, 2018 5:45 AM

Thanks, j-mailor.

I followed your instruction, but RC4 is still enabled.

Please help me.

Actions

Rob Moss May 4, 2018 1:12 AM

You're on Google Cloud Platform, so I'm guessing you're probably using a GCP Load Balancer. In that case, you'll want to read this:

Using SSL Policies | Compute Engine Documentation | Google Cloud

The SSLProtocols variant you currently have is OK, but "ALL -SSLv2 -SSLv3 -TLSv1 -TLSv1.1" makes slightly more sense. Don't use "-ALL +TLSv1.2" or you'll have to add in TLS 1.3 support at a later date manually.

The other possibility as far as cipher suites is concerned is that you're editing the wrong file. Try this command:

grep -RH SSLCipherSuites /etc/httpd/conf*

You may well find site-specific cipher suite entries in a file in /etc/httpd/conf.d.

1 person found this helpful

Actions

Bciar Chahedeh @ Rob Moss on May 4, 2018 5:44 AM

Thanks, Rob.

I created SSL Policy in my google cloud platform and used grep -RH SSLCipherSuites /etc/httpd/conf* command, but still RC4 is existing.

Please help me.

Actions

Rob Moss @ Bciar Chahedeh on May 4, 2018 5:47 AM

Are you using a GCP Load Balancer? What was the output from the grep command?

Actions

Bciar Chahedeh @ Rob Moss on May 4, 2018 5:49 AM

I used grep command on my CentOS terminal and result was no message.

So restarted my apache.

Actions

Rob Moss @ Bciar Chahedeh on May 4, 2018 5:53 AM

Argh. Sorry. Typo, I added an extra "s". Try:

grep -RH SSLCipherSuite /etc/httpd/conf*

Actions

Bciar Chahedeh @ Rob Moss on May 4, 2018 5:55 AM

I got this result, Mr.Rob.

/etc/httpd/conf/httpd.conf:SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4
/etc/httpd/conf.d/ssl.conf:SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA
/etc/httpd/conf.d/ssl.conf:# to the SSLCipherSuite list, and enable SSLHonorCipherOrder.
/etc/httpd/conf.d/ssl.conf:#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5

Now what should I do?

Actions

Rob Moss @ Bciar Chahedeh on May 4, 2018 5:59 AM

Nailed it. You need to edit the SSLCipherSuite line in /etc/httpd/conf.d/ssl.conf instead of the one in /etc/httpd/httpd.conf.

On CentOS, Amazon Linux and many other distributions, you're not supposed to make any changes to /etc/httpd/httpd.conf.

Actions

Bciar Chahedeh @ Rob Moss on May 4, 2018 6:06 AM

Wow!! GREAT!!

It is disabled!

Thank you very very much, Mr.Rob.

You are the best in this world.

How can I help you with your reputation?

I will not forget you when I succeed in my current business.

Actions

Rob Moss @ Bciar Chahedeh on May 4, 2018 6:07 AM

You're welcome, and yes, I am.

Actions

11 Replies

j-mailor May 4, 2018 12:17 AM
Mark Correct
Correct Answer
SSLCipherSuite looks fine to me, there is !RC4 included.

Did you:
a) Restart Apache server after setting !RC4 in SSLCipherSuite? If no, then restart Apache server.
b) Is there any other server (gateway, proxy, load balancer...) in front of your Apache that is accessed from internet? If yes, then you also need to check the setting of additional "gateway" like server.

By the way, SSLProtocol setting looks strange to me. It should not influence your RC4 problem, but setting it like that is strage:
"ALL -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2" <== ALL already includes +TLSv1.2
use:
"-ALL +TLSv1.2" <=== I have this setting on my server to only allow TLSv1.2. This is in my humble opinion the easiest to read.
or:
"-SSLv2 -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2"
or
"ALL -SSLv2 -SSLv3 -TLSv1 -TLSv1.1"
Like • Show 0 Likes0
Actions
- Bciar Chahedeh @ j-mailor on May 4, 2018 5:45 AM
  Mark Correct
  Correct Answer
  Thanks, j-mailor.
  I followed your instruction, but RC4 is still enabled.
  Please help me.
  Like • Show 0 Likes0
  Actions
Rob Moss May 4, 2018 1:12 AM
Mark Correct
Correct Answer
You're on Google Cloud Platform, so I'm guessing you're probably using a GCP Load Balancer. In that case, you'll want to read this:

Using SSL Policies | Compute Engine Documentation | Google Cloud

The SSLProtocols variant you currently have is OK, but "ALL -SSLv2 -SSLv3 -TLSv1 -TLSv1.1" makes slightly more sense. Don't use "-ALL +TLSv1.2" or you'll have to add in TLS 1.3 support at a later date manually.

The other possibility as far as cipher suites is concerned is that you're editing the wrong file. Try this command:

grep -RH SSLCipherSuites /etc/httpd/conf*

You may well find site-specific cipher suite entries in a file in /etc/httpd/conf.d.
1 person found this helpful
Like • Show 0 Likes0
Actions
- Bciar Chahedeh @ Rob Moss on May 4, 2018 5:44 AM
  Mark Correct
  Correct Answer
  Thanks, Rob.
  I created SSL Policy in my google cloud platform and used grep -RH SSLCipherSuites /etc/httpd/conf* command, but still RC4 is existing.
  Please help me.
  Like • Show 0 Likes0
  Actions
  - Rob Moss @ Bciar Chahedeh on May 4, 2018 5:47 AM
    Mark Correct
    Correct Answer
    Are you using a GCP Load Balancer? What was the output from the grep command?
    Like • Show 0 Likes0
    Actions
    - Bciar Chahedeh @ Rob Moss on May 4, 2018 5:49 AM
      Mark Correct
      Correct Answer
      I used grep command on my CentOS terminal and result was no message.
      So restarted my apache.
      Like • Show 0 Likes0
      Actions
      - Rob Moss @ Bciar Chahedeh on May 4, 2018 5:53 AM
        Mark Correct
        Correct Answer
        Argh. Sorry. Typo, I added an extra "s". Try:
        
        grep -RH SSLCipherSuite /etc/httpd/conf*
        Like • Show 0 Likes0
        Actions
        Bciar Chahedeh @ Rob Moss on May 4, 2018 5:55 AM
        Mark Correct
        Correct Answer
        I got this result, Mr.Rob.
        /etc/httpd/conf/httpd.conf:SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4
        /etc/httpd/conf.d/ssl.conf:SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA
        /etc/httpd/conf.d/ssl.conf:# to the SSLCipherSuite list, and enable SSLHonorCipherOrder.
        /etc/httpd/conf.d/ssl.conf:#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5
        
        Now what should I do?
        Like • Show 0 Likes0
        Actions
        Rob Moss @ Bciar Chahedeh on May 4, 2018 5:59 AM
        Unmark Correct
        Correct Answer
        Nailed it. You need to edit the SSLCipherSuite line in /etc/httpd/conf.d/ssl.conf instead of the one in /etc/httpd/httpd.conf.
        
        On CentOS, Amazon Linux and many other distributions, you're not supposed to make any changes to /etc/httpd/httpd.conf.
        Like • Show 2 Likes2
        Actions
        Bciar Chahedeh @ Rob Moss on May 4, 2018 6:06 AM
        Mark Correct
        Correct Answer
        Wow!! GREAT!!
        It is disabled!
        Thank you very very much, Mr.Rob.
        You are the best in this world.
        How can I help you with your reputation?
        I will not forget you when I succeed in my current business.
        Like • Show 2 Likes2
        Actions
        Rob Moss @ Bciar Chahedeh on May 4, 2018 6:07 AM
        Mark Correct
        Correct Answer
        You're welcome, and yes, I am.
        Like • Show 2 Likes2
        Actions

Please help me with disabling RC4 issue in Apache

Outcomes

Related Content

Recommended Content