New Topic

cPanel & WHM Feature Requests Topic Web Servers

Category Web Servers

Tags apache, ssl cipher, ssl, HTTPS, CPANEL-4845

SSLHonorCipherOrder on Apache

Ходоренко Михаил shared this idea ago

Open Discussion

Please add support for SSLHonorCipherOrder on Apache config (WHM -> Apache Configuration -> Global Configuration )

http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslhonorcipherorder

I like this idea 0

Best Answer

benny@cpanel.net ●

Thanks for your interest in improving cPanel and WHM. This request does have an internal case, but has not yet been scheduled for inclusion in the product.

In the meantime, you can make these additions in the Pre Main include through WHM »Service Configuration »Apache Configuration »Include Editor.

Replies (2)

benny@cpanel.net ● ●

Thanks for your interest in improving cPanel and WHM. This request does have an internal case, but has not yet been scheduled for inclusion in the product.

In the meantime, you can make these additions in the Pre Main include through WHM »Service Configuration »Apache Configuration »Include Editor.

Reply URL

ciao70 ●

There are news about this feature?

URL

ciao70 ●

Hello cPanelTabby,

The request was opened 4 years ago

It seems like a reasonable time for any update :)

URL

Karl Austin ●

Symptomatic of wider issues I'm afraid.

URL

ciao70 ●

I have activated manually

SSLHonorCipherOrder On

In the Pre Main include through WHM »Service Configuration »Apache Configuration »Include Editor.

https://documentation.cpanel.net/display/84Docs/Include+Editor

Work

URL

Karl Austin ●

Surely this one isn't exactly a biggie to add?

It's an important security feature, as some older devices will negotiate SSL ciphers that don't support forward secrecy unless you force them to by using the servers cipher order. Yes it's easy to add yourself, but it should be there by default.

cPanel should be striving to be as secure as possible out of the box and it requiring effort to weaken it, not the other way around, starting weak and requiring effort to make it passably secure.

Reply URL

benny@cpanel.net ●

I completely understand your point of view, and hear your feedback here. Without a team scoping out the work it's hard to know how much time and testing would be needed (some of the smallest requests can scope out to be a full sprint's worth of work for a feature team), but as soon as there's anything to add here we'll be back!

URL

Karl Austin ●

I appreciate what you're saying about some features, but I'm not buying it with this one. You have a system for bringing forward configurable options for Apache and writing them to the config file and then placing them in to the template. You're already advising people that they can do this manually. The testing is pretty straight forward and easily verifiable in terms of correct working and automating it.

If this took a full sprint, someone wants to be sprinting for the door and a new job when they cross the finish line :)

URL

Karl Austin ●

This is a little bit silly now. I know we have the feature request system for a reason, but it's absolutely nuts that something that affects end user security has been sat here for over a year - yes I know it doesn't have many votes, but I'd put that down to a great number of cPanel users having no clue that this is actually a problem. It's crazy that we're adding what amounts to fluff, at the expense of security for end users.

URL

benny@cpanel.net ●

I do understand your point of view, but this request hasn't gotten much traction internally. I'm guessing that's because you can easily add the setting through the existing WHM interface.

If that changes or if it gets picked up by an internal team, I'll make sure we update things here.

URL

Karl Austin ●

Appreciate that it's easy to add via includes editor - but how many people don't know this? How many don't know that it's an issue? How many 1000s of domains is that?

Unfortunately this speaks volumes to me, and not in a positive way. cPanel IMHO has a responsibility to the wider internet community to ship in as secure a configuration as it possible - for the server and end users. If admins willingly chose to weaken it, then they probably have a good well researched reason to do so. It's 2017 now, "no one is interested internally" is something you should be ashamed of stating.

Perhaps it's about time that there was someone internally that is interested in these kind of issues? It's not just this one issue, take for example the new "Symlink Protection Option" - It's off by default, yet FollowSymlinks & SymLinksIfOwnerMatch are both on by default, so Symlink protection is needed. Wrongly or not, there are admins out there that have no idea that screen exists, let alone what any of the options mean on there.

Apologies for taking this off-track, but this is indicative of wider issues :/

URL