(date updated 22 January 2019)
Please note that TLS cipher recommendations change as new threats are discovered. We recommend to use Mozilla SSL Configuration Generator to generate the list of ciphers.
When using Mozilla SSL Configuration Generator please select Apache server and Modern profile
As the root user edit the following file with the vi or nano editors:
vi /etc/httpd/conf.d/ssl.conf
Find and replace the following line: Note: It may line wrap and appear to be several lines
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS:!RSA
With(note always get the latest cipher list from Mozilla SSL Configuration Generator):
SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
Additionally Replace the line
SSLProtocol all -SSLv3 -TLSv1
with
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
After saving the file restart apache
systemctl restart httpd
NAA provides legacy protocol adaptors i.e you can access any storage using FTP, FTPS and SFTP. FTP provider is unencrypted protocol. Disable FTP, FTPS and SFTP service depending on your security policy. For compatibility SFTP and FTPS support a wide range of encryption protocols and ciphers. For a locked down NAA deployment we recommend disabling CloudFTP service
As root
systemctl stop cloudftp systemctl disable cloudftp
The icons directory is listed , this is not a security risk but some scanning tools can mark it as security risk.
As root remove the following file
rm /etc/httpd/conf.d/autoindex.conf systemctl restart httpd