YunoHost/doc
1
0
Fork 0
mirror of https://github.com/YunoHost/doc.git synced 2024-09-03 20:06:26 +02:00
Code Issues Projects Releases Packages Wiki Activity

Update setting name + improve explanation about the settings

Browse source
This commit is contained in:
Alexandre Aubin 2019-03-23 18:25:59 +01:00 • committed by GitHub
parent f97330bcd7
commit c260eb83e8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
security.md
View file

@ -148,17 +148,18 @@ systemctl restart ssh
### Change cipher compatibility configuration
The default TLS configuration for services tend to offer a good compatibility to support old devices. You can tune this policy for specific services like SSH or NGINX. For NGINX you can choose to use what Mozilla call a 'modern' configuration. A modern configuration will be more secure but if you loose the connectivity from your devices it will be ueseless.
Once you have changed a policy you can always revert the setting if that doesn't feet your environment.
The default TLS configuration for services tend to offer a good compatibility to support old devices. You can tune this policy for specific services like SSH and NGINX. By default, the NGINX configuration follows the [intermediate compatibility recommendation](https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29) from Mozilla. You can choose to switch to the 'modern' configuration which uses more recent security recommendations, but decreases the compatibility, which may be an issue for your users and visitors using older devices. More details about the compatibility can be found on [this page](https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility).
Changing the compatibility level is not definitive and can be reverted if it doesn't feet your environment.
**On your server**, change the policy for NGINX
```bash
sudo yunohost settings set security.ciphers.compatibility -v modern
sudo yunohost settings set security.nginx.compatibility -v modern
```
**On your server**, change the policy for SSH
```bash
sudo yunohost settings set service.ssh.ciphers.compatibility -v modern
sudo yunohost settings set service.ssh.compatibility -v modern
```
### Disable YunoHost API