Author: rcritten
Update of /cvs/dirsec/mod_nss/docs In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv21038/docs
Modified Files: mod_nss.html Log Message: Add proxy support to mod_nss. Most of the changes are related to adding new configuration directives. For the others we need to initialize an NSS socket differently whether we will be acting as a client or a server.
Index: mod_nss.html =================================================================== RCS file: /cvs/dirsec/mod_nss/docs/mod_nss.html,v retrieving revision 1.8 retrieving revision 1.9 diff -u -r1.8 -r1.9 --- mod_nss.html 16 Sep 2005 13:07:37 -0000 1.8 +++ mod_nss.html 29 Sep 2005 19:35:44 -0000 1.9 @@ -1,4 +1,6 @@ <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> +<html> +<head> <!-- Copyright 2001-2005 The Apache Software Foundation
@@ -13,8 +15,6 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and --> -<html> -<head> <meta content="text/html; charset=ISO-8859-1" http-equiv="content-type"> <title>mod_nss</title> @@ -32,25 +32,18 @@ <a href="#Environment">Environment Variables</a><br> <a href="#Database_Management">Database Management</a><br> <a href="#SSLv2">Why is SSLv2 disabled?</a><br> -<br> +<a href="#FAQ">Frequently Asked Questions</a><br> <h1><a name="Introduction"></a>Introduction</h1> The <a href="http://www.modssl.org/">mod_ssl</a> package was created in April 1998 by <a href="mailto:rse@engelschall.com">Ralf S. Engelschall</a> and was originally derived from the <a href="http://www.apache-ssl.org/">Apache-SSL</a> package developed by <a - href="mailto:ben@algroup.co.uk">Ben Laurie</a>. It stays under a -BSD-style -license which is equivalent to the license used by <a - href="http://www.apache.org/%22%3EThe Apache Group</a> for the Apache -webserver -itself. This means, in short, that you are free to use it both for -commercial -and non-commercial purposes as long as you retain the authors' -copyright -notices and give the proper credit. -<br> + href="mailto:ben@algroup.co.uk">Ben Laurie</a>. It is licensed under +the <a href="http://www.apache.org/licenses/" class="external" + title="http://www.apache.org/licenses/" rel="nofollow">Apache 2.0 +license</a><span class="urlexpansion">.<br> <br> -mod_nss is based directly on the mod_ssl package from Apache +</span>mod_nss is based directly on the mod_ssl package from Apache 2.0.54. It is a conversion from using OpenSSL calls to using <a href="http://www.mozilla.org/projects/security/pki/nss/">NSS</a> calls instead.<br> @@ -94,6 +87,20 @@ </td> </tr> <tr> + <td style="vertical-align: top;">--with-nss-inc=PATH<br> + </td> + <td style="vertical-align: top;">The file system path to the NSS +include directory (e.g. /usr/local/include/nss3)<br> + </td> + </tr> + <tr> + <td style="vertical-align: top;">--with-nss-lib=PATH<br> + </td> + <td style="vertical-align: top;">The file system path to the NSS +lib directory (e.g. /usr/local/lib)<br> + </td> + </tr> + <tr> <td style="vertical-align: top;">--with-nspr=[PATH]<br> </td> <td style="vertical-align: top;">The file system path of the NSPR @@ -101,6 +108,20 @@ PATH/include, etc.</td> </tr> <tr> + <td style="vertical-align: top;">--with-nspr-inc=PATH<br> + </td> + <td style="vertical-align: top;">The file system path to the NSPR +include directory (e.g. /usr/local/include/nspr4)<br> + </td> + </tr> + <tr> + <td style="vertical-align: top;">--with-nspr-lib=PATH<br> + </td> + <td style="vertical-align: top;">The file system path to the NSPR +lib directory (e.g. /usr/local/lib)<br> + </td> + </tr> + <tr> <td style="vertical-align: top;">--with-apxs=[PATH]<br> </td> <td style="vertical-align: top;">The location of the apxs binary @@ -117,7 +138,7 @@ </table> <br> If --with-nss or --with-nspr are not passed configure will look -for the mozilla-[nss|nspr]-devel packages and use the libraries with +for the [nss|nspr]-devel packages and use the libraries with that if found.<br> <br> It is strongly recommended that the mozilla.org version be used.<br> @@ -371,12 +392,12 @@ included in the NSSCipherSuite entry are automatically disabled. The allowable ciphers are:<br> <ul> -<li>rsa_3des_sha</li> -<li>rsa_des_sha</li> -<li>fips_3des_sha</li> -<li>fips_des_sha</li> -<li>rsa_des_56_sha</li> -<li>fortezza</li> + <li>rsa_3des_sha</li> + <li>rsa_des_sha</li> + <li>fips_3des_sha</li> + <li>fips_des_sha</li> + <li>rsa_des_56_sha</li> + <li>fortezza</li> </ul> <span style="font-weight: bold;"><br> </span>FIPS is disabled by default.<br> @@ -404,7 +425,8 @@ A space-separated list of the SSL ciphers used, with the prefix <code>+</code> to enable or <code>-</code> to disable.<br> <br> -All ciphers are disabled by default. The SSLv2 ciphers cannot be enabled because +All ciphers are disabled by default. The SSLv2 ciphers cannot be +enabled because <a href="#SSLv2">SSLv2</a> is not allowed in mod_nss.<br> <br> Available ciphers are:<br> @@ -622,7 +644,7 @@ <code>NSSNickname Server-Cert</code><br> <code>NSSNickname "This contains a space"</code><br> <br> -NSSEnforceValidCerts<br> +<big><big>NSSEnforceValidCerts</big></big><br> <br> By default mod_nss will not start up if the server certificate is not valid. This means that if the certificate has @@ -636,7 +658,7 @@ <br> <code>NSSEnforceValidCerts on</code><br> <br> -NSSVerifyClient<br> +<big><big>NSSVerifyClient</big></big><br> <br> Determines whether Client Certificate Authentication will be requested or required. This may be set in a @@ -646,18 +668,17 @@ requested from the client.<br> <br> Available options are:<br> - <ul> <li><code>none</code>: no client certificate is required or requested<br> - </li> - <li>code>optional</code>: a client + </li> + <li>code>optional: a client certificate is requested but if one is not available, the connection may continue.<br> - </li> + </li> <li><code>require</code>: a valid client certificate is required for the connection to continue.<br> - </li> + </li> </ul> The mod_ssl option <code>option_no_ca</code> is not supported.<br> @@ -732,7 +753,45 @@ may be restricted (or allowed) based on any number of variables such as components of the client certificate, the remote IP address, etc.<br> <br> -<code>NSSRequire</code><br> +<span style="font-weight: bold;">Example</span><br> +<br> +<code>NSSRequire<br> +</code><br> +<big><big>NSSProxyEngine</big></big><br> +<br> +Enables or disables mod_nss HTTPS support for mod_proxy.<br> +<br> +<span style="font-weight: bold;">Example</span><br> +<br> +<code>NSSProxyEngine on</code><br> +<br> +<big><big>NSSProxyProtocol</big></big><br> +<br> +Specifies the SSL protocols that may be used in proxy connections. The +syntax is identical to NSSProtocol.<br> +<br> +<span style="font-weight: bold;">Example</span><br> +<br> +<code>NSSProxyProtocol SSLv3<br> +</code><br> +<big><big>NSSProxyCipherSuite</big></big><br> +<br> +Specifies the SSL ciphers available for proxy connections. They syntax +is identical to NSSCipherSuite.<br> +<br> +<span style="font-weight: bold;">Example</span><br> +<br> +<code>NSSProxyCipherSuite ++rsa_3des_sha,-rsa_null_md5,-rsa_null_sha,+rsa_rc4_128_md5</code><br> +<br> +<big><big>NSSProxyNickname</big></big><br> +<br> +The nickname of the client certificate to send if the remote server +requests client authentication.<br> +<br> +<span style="font-weight: bold;">Example</span><br> +<br> +<code>NSSProxyNickname beta</code><br> <h1><a name="Environment"></a>Environment Variables</h1> Quite a few environment variables (for CGI and SSI) may be set depending on the NSSOptions configuration. It can be expensive to set @@ -1121,10 +1180,53 @@ <code>% certutil -V -n Server-Cert -u V -d .<br> certutil: certificate is valid</code><br> <h1><a name="SSLv2"></a>Why is SSLv2 disabled?</h1> -All major browsers (Firefox, Internet Explorer, Mozilla, Netscape, Opera, and -Safari) support SSL 3 and TLS so there is no need for a web server to support +All major browsers (Firefox, Internet Explorer, Mozilla, Netscape, +Opera, and +Safari) support SSL 3 and TLS so there is no need for a web server to +support SSL 2. There are some known attacks against SSL 2 that are handled by -SSL 3/TLS. SSL2 also doesn't support useful features like client authentication. +SSL 3/TLS. SSL2 also doesn't support useful features like client +authentication. +<br> +<h1><a name="FAQ"></a>Frequently Asked Questions</h1> +Q. Does mod_nss support mod_proxy?<br> <br> +A. In order to use the mod_nss proxy support you will need to build +your own mod_proxy by applying a patch found in bug <a + href="http://issues.apache.org/bugzilla/show_bug.cgi?id=36468%22%3E36468</a>. +The patch is needed so we can compare the hostname contained in the +remote certificate with the hostname you meant to visit. This prevents +man-in-the-middle attacks.<br> +<br> +You also have to change the SSL functions that mod_proxy looks to use. +You'll need to apply this patch:<br> +<br> +<code>1038,1039c1038,1039<br> +< APR_DECLARE_OPTIONAL_FN(int, ssl_proxy_enable, (conn_rec *));<br> +< APR_DECLARE_OPTIONAL_FN(int, ssl_engine_disable, (conn_rec *));<br> +---<br> +> APR_DECLARE_OPTIONAL_FN(int, nss_proxy_enable, (conn_rec *));<br> +> APR_DECLARE_OPTIONAL_FN(int, nss_engine_disable, (conn_rec *));<br> +1041,1042c1041,1042<br> +< static APR_OPTIONAL_FN_TYPE(ssl_proxy_enable) *proxy_ssl_enable = +NULL;<br> +< static APR_OPTIONAL_FN_TYPE(ssl_engine_disable) *proxy_ssl_disable += NULL;<br> +---<br> +> static APR_OPTIONAL_FN_TYPE(nss_proxy_enable) *proxy_ssl_enable = +NULL;<br> +> static APR_OPTIONAL_FN_TYPE(nss_engine_disable) *proxy_ssl_disable += NULL;<br> +1069,1070c1069,1070<br> +< proxy_ssl_enable = +APR_RETRIEVE_OPTIONAL_FN(ssl_proxy_enable);<br> +< proxy_ssl_disable = +APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable);<br> +---<br> +> proxy_ssl_enable = +APR_RETRIEVE_OPTIONAL_FN(nss_proxy_enable);<br> +> proxy_ssl_disable = +APR_RETRIEVE_OPTIONAL_FN(nss_engine_disable);<br> +</code><br> </body> </html>
389-commits@lists.fedoraproject.org
-
Doctor Conrad