{"id":3075,"date":"2014-05-28T21:29:30","date_gmt":"2014-05-28T13:29:30","guid":{"rendered":"http:\/\/rmohan.com\/?p=3075"},"modified":"2014-05-28T22:50:52","modified_gmt":"2014-05-28T14:50:52","slug":"add-http-strict-transport-security-in-apache-nginx","status":"publish","type":"post","link":"https:\/\/mohan.sg\/?p=3075","title":{"rendered":"Add HTTP Strict Transport Security in Apache &#038; Nginx"},"content":{"rendered":"<p>HSTS (HTTP Strict Transport Security) is a security protocol that force the use of SSL in the comunication between the web browser and the web server. This standard is recently approved (2 october 2012) by the IETF, but the first draft was released in 2010 and it was implemented in some sites like Paypal, Android market, DEF CON website\u2026 The motivation of HSTS is to mitigate the SSLStrip attacks, introduced by Moxie Marlinspike in Black Hat conference 2009. SSLStrip consist in a https session hijacking, forcing a https connection becomes a normal http allowing to the attacker read all data sent from the victim. Basically it follows three steps:<\/p>\n<ul>\n<li>Victim establishes a HTTP connection with attacker machine.<\/li>\n<li>The attacker transforms the http traffic from the victim to https.<\/li>\n<li>The attacker establishes the https connection with the real web server.<\/li>\n<\/ul>\n<p>Configuring HSTS the web server informs to the web browser that connections to the site should always use SSL. Actually the web browser that supports the HSTS headers are Google chrome from 4.0.211.0 version, Firefox from 4 version and Opera from 12 version.<br \/>\nHSTS has a limitation resides in the initial request from the web browser and can be exploited by an attacker, for this reason it\u2019s important to setup a high value for the HSTS expiration value.<\/p>\n<p><strong>Apache implementation<\/strong><\/p>\n<p>&#8211; Load the mod_headers module to allow modify the http headers:<\/p>\n<div>\n<div id=\"highlighter_424736\" class=\"syntaxhighlighter  bash\">\n<table border=\"0\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td class=\"gutter\">\n<div class=\"line number1 index0 alt2\">1<\/div>\n<\/td>\n<td class=\"code\">\n<div class=\"container\">\n<div class=\"line number1 index0 alt2\"><code class=\"bash comments\"># vi \/etc\/httpd\/conf\/httpd.conf<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<div>\n<div id=\"highlighter_316935\" class=\"syntaxhighlighter  bash\">\n<table border=\"0\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td class=\"gutter\">\n<div class=\"line number1 index0 alt2\">1<\/div>\n<\/td>\n<td class=\"code\">\n<div class=\"container\">\n<div class=\"line number1 index0 alt2\"><code class=\"bash plain\">LoadModule headers_module modules<\/code><code class=\"bash plain\">\/mod_headers<\/code><code class=\"bash plain\">.so<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<p>&#8211; Add in our vhost statement or in your main apache config file, the next line with an expiration of 6 months including the requests for all the subdomains:<\/p>\n<div>\n<div id=\"highlighter_457034\" class=\"syntaxhighlighter  bash\">\n<table border=\"0\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td class=\"gutter\">\n<div class=\"line number1 index0 alt2\">1<\/div>\n<\/td>\n<td class=\"code\">\n<div class=\"container\">\n<div class=\"line number1 index0 alt2\"><code class=\"bash plain\">Header add Strict-Transport-Security <\/code><code class=\"bash string\">\"max-age=15768000;includeSubDomains\"<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<p><strong>Nginx implementation<\/strong><\/p>\n<div>\n<div id=\"highlighter_280037\" class=\"syntaxhighlighter  bash\">\n<table border=\"0\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td class=\"gutter\">\n<div class=\"line number1 index0 alt2\">1<\/div>\n<\/td>\n<td class=\"code\">\n<div class=\"container\">\n<div class=\"line number1 index0 alt2\"><code class=\"bash plain\">add_header Strict-Transport-Security max-age=15768000;includeSubDomains<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<p><strong>Capturing HTTP headers from the server with tcpdump<\/strong><\/p>\n<div>\n<div id=\"highlighter_593445\" class=\"syntaxhighlighter  bash\">\n<table border=\"0\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td class=\"gutter\">\n<div class=\"line number1 index0 alt2\">1<\/div>\n<div class=\"line number2 index1 alt1\">2<\/div>\n<div class=\"line number3 index2 alt2\">3<\/div>\n<div class=\"line number4 index3 alt1\">4<\/div>\n<div class=\"line number5 index4 alt2\">5<\/div>\n<div class=\"line number6 index5 alt1\">6<\/div>\n<div class=\"line number7 index6 alt2\">7<\/div>\n<div class=\"line number8 index7 alt1\">8<\/div>\n<div class=\"line number9 index8 alt2\">9<\/div>\n<div class=\"line number10 index9 alt1\">10<\/div>\n<div class=\"line number11 index10 alt2\">11<\/div>\n<div class=\"line number12 index11 alt1\">12<\/div>\n<div class=\"line number13 index12 alt2\">13<\/div>\n<div class=\"line number14 index13 alt1\">14<\/div>\n<div class=\"line number15 index14 alt2\">15<\/div>\n<\/td>\n<td class=\"code\">\n<div class=\"container\">\n<div class=\"line number1 index0 alt2\"><code class=\"bash comments\"># tcpdump -vvvs 1024 -l -A host monitor.local<\/code><\/div>\n<div class=\"line number2 index1 alt1\"><\/div>\n<div class=\"line number3 index2 alt2\"><code class=\"bash plain\">$p... ..HTTP<\/code><code class=\"bash plain\">\/1<\/code><code class=\"bash plain\">.1 200 OK<\/code><\/div>\n<div class=\"line number4 index3 alt1\"><code class=\"bash plain\">Date: Tue, 09 Oct 2012 18:33:36 GMT<\/code><\/div>\n<div class=\"line number5 index4 alt2\"><code class=\"bash plain\">Server: Apache<\/code><code class=\"bash plain\">\/2<\/code><code class=\"bash plain\">.2.15 (CentOS)<\/code><\/div>\n<div class=\"line number6 index5 alt1\"><code class=\"bash plain\">X-Powered-By: PHP<\/code><code class=\"bash plain\">\/5<\/code><code class=\"bash plain\">.3.3<\/code><\/div>\n<div class=\"line number7 index6 alt2\"><code class=\"bash plain\">Expires: Thu, 19 Nov 1981 08:52:00 GMT<\/code><\/div>\n<div class=\"line number8 index7 alt1\"><code class=\"bash plain\">Last-Modified: Tue, 09 Oct 2012 18:33:36 GMT<\/code><\/div>\n<div class=\"line number9 index8 alt2\"><code class=\"bash plain\">Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0<\/code><\/div>\n<div class=\"line number10 index9 alt1\"><code class=\"bash plain\">Pragma: no-cache<\/code><\/div>\n<div class=\"line number11 index10 alt2\"><code class=\"bash plain\">P3P: CP=<\/code><code class=\"bash string\">\"CAO PSA OUR\"<\/code><\/div>\n<div class=\"line number12 index11 alt1\"><code class=\"bash plain\">Strict-Transport-Security: max-age=15768000<\/code><\/div>\n<div class=\"line number13 index12 alt2\"><code class=\"bash plain\">Content-Length: 1468<\/code><\/div>\n<div class=\"line number14 index13 alt1\"><code class=\"bash plain\">Connection: close<\/code><\/div>\n<div class=\"line number15 index14 alt2\"><code class=\"bash plain\">Content-Type: text<\/code><code class=\"bash plain\">\/html<\/code><code class=\"bash plain\">; charset=UTF-8<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<p>HTTP Strict Transport Security or HSTS is a new security feature in browsers that enables you tell the browser \u201calways use SSL when accessing this site\u201d.<\/p>\n<p>Mozilla has a good blog post explaining HSTS, so I won\u2019t try to replicate that here, but I\u2019d just like to make it clear that if you have a site that should always use SSL, be it Drupal or Django or any other system, this is definitely something you should get set up.<\/p>\n<p>Good examples of these are webmail, server administration and monitoring tools and general admin backends. If you are running a large Drupal-site, you should perhaps consider restricting admin-access to a SSL-protected subdomain.<\/p>\n<p>Currently, it is only supported in Chrome 4 and above, and Firefox 4 beta 5 and beyond, but hopefully the other browser makers will catch up soon. Its fully backwards compatible, in that it will have no effect if the browser does not support HSTS.<\/p>\n<p>How to use it<\/p>\n<p>Setting it up is very simple. In your Apache VHost, where you do your SSL config, just add this line:<\/p>\n<p>Header add Strict-Transport-Security &#8220;max-age=15768000&#8221;<br \/>\nThis will tell the browser to remember that this site is SSL\/HTTPS only for the next 6 months. During that time it will simply rewrite any and all requests to that site to use HTTPS instead of HTTP without ever communicating insecurely with the server.<\/p>\n<p>If you use nginx, the syntax is subtly different. Adding this to the server section does the trick:<\/p>\n<p>add_header Strict-Transport-Security max-age=15768000;<br \/>\nKeep your redirects<\/p>\n<p>An important point is that HSTS only works after the user has received the header via HTTPS. So you will still need to have a redirect from your HTTP-site to HTTPS, also for supporting browsers that still do not understand HSTS.<\/p>\n<p>This is easily accomplished using Apache\u2019s mod_rewrite:<br \/>\nRewriteEngine On<br \/>\nRewriteCond %{HTTPS} off<br \/>\nRewriteRule (.*) https:\/\/%{HTTP_HOST}%{REQUEST_URI}<\/p>\n<p>Thus, with a few lines of configuration, you can make the web a safer place to be for your users. So, what are you waiting for?<\/p>\n","protected":false},"excerpt":{"rendered":"<p>HSTS (HTTP Strict Transport Security) is a security protocol that force the use of SSL in the comunication between the web browser and the web server. This standard is recently approved (2 october 2012) by the IETF, but the first draft was released in 2010 and it was implemented in some sites like Paypal, Android [&#8230;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/3075"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3075"}],"version-history":[{"count":2,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/3075\/revisions"}],"predecessor-version":[{"id":3077,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/3075\/revisions\/3077"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3075"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3075"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3075"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}