· 8 years ago · Apr 23, 2018, 07:18 AM
1These are notes for web team
2
3Our web responsibility - Point of contact - Container is running - Soure code is replace / Fixed
4 - video.mil13.ex - Tambet - False - False
5 - helpdesk.telco13.ex - Tambet - False - False
6 - blog.telco13.ex - Tambet - False - False
7 - jobs.telco13.ex - Tambet - False - False
8 - githab.telco13.ex - Tambet - False - False
9 - tinder.telco13.ex - Tambet - False - False
10 - crisis.mil13.ex - Märt - False - False
11 - asterisk.mil13.ex - Märt - False - False
12 - intranet.ops.mil13.ex - Märt - False - False
13 - mail.telco13.ex - Märt - False - False
14 - www.telco13.ex - Artur - True - False
15 - blog.mil13.ex - Artur - False - False
16 - forum.mil13.ex - Artur - False - False
17 - www.mil13.ex - Vaik - False - False
18 - gallery13.ex - Vaik - False - False
19 - pdns1.telco13.ex - Taavi - True - True
20 - pdns2.telco13.ex - Taavi - True - True
21 - rtr-mgmnt.telco13.ex - Taavi - False - False
22 - rtr-mgmt.telco13.ex - Taavi - False - False
23
24Things to remember:
25 1) Remove sql users
26 2) Craete new sql user for web app with proper rights
27 3) If possible download all libs and sources from the internet again and use the same db
28
29Task list:
30 1) Dockerize the application mark container is running to true
31 2) Clean up the soruce code and database structures and mark source code is replaced / fixed as true
32
33
34Backups: https://drive.google.com/drive/folders/17PRdK0ji60EuffTx8jAS9kFi5HF31AaD?usp=sharing
35
361 Day goals -
371) Assign owner to each machine
382) Copy all the contents and relevant files to further analysis and dockerization
393) Get familiar with system business logic
40
412. day goals
421) Make sure scheme descrbied in scheme works
43
44Scheme
451. Dockerize the application
461.1 Download all soruce code again (or diff against version)
471.2 Update to latest non breakable change
482. Make ansible script to deploy the application
49
50
51IMPORTANT FOR ALL
52Please change all admin passwords and mark them here
53
54Domain - Website adminstrator link - username - password
55http://forum.mil13.ex/ - http://forum.mil13.ex/ (login as user) - admin - 4DWOPkCnQPVBp5B4Cicp
56http://telco13.ex - http://telco13.ex/admin - admin - coVagWgeRUTyPWHMna6a
57http://mail.telco13.ex - http://mail.telco13.ex/admin - admin@telco13.ex - dkRxwF953apF8HsrUZqw - ADMIN WILL ALSO BE DISABLED AND STARTED UP ONLY IF SOMEONE COMPLAINS
58http://blog.mil13.ex - http://blog.mil13.ex/admin - admin - 7r885oJGfifL6xMvMdsm
59http://
60
61
62
63Docker notes
64root@docker1:/# find / -iname Dockerfile
65/root/jobsboard/jobsboard/Dockerfile
66/root/jobsboard/anginx/Dockerfile
67/root/helpdesk/helpdesk/Dockerfile
68/root/blog/worldpress/Dockerfile
69/usr/share/docker-ce/contrib/desktop-integration/chromium/Dockerfile
70/usr/share/docker-ce/contrib/desktop-integration/gparted/Dockerfile
71
72root@docker2:/# find / -iname Dockerfile
73/root/tinder/tinder/Dockerfile
74/root/githab/githab/Dockerfile
75/root/githab/postgres/Dockerfile
76/usr/share/docker-ce/contrib/desktop-integration/chromium/Dockerfile
77/usr/share/docker-ce/contrib/desktop-integration/gparted/Dockerfile
78
79Docker swarm can be disabled, no services running in swarm mode:
80root@docker1:~/jobsboard/anginx# docker service ls
81ID NAME MODE REPLICAS IMAGE
82root@docker1:~/jobsboard/anginx# docker service ls
83ID NAME MODE REPLICAS IMAGE
84Portainer not needed
85
86root@docker1:~/jobsboard/jobsboard# docker ps -a
87CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS
88 NAMES
89bfd4d20148fe anginx "nginx -g 'daemon ..." 9 hours ago Up 9 hours 151.216.13.43:80->80/tcp, 2a07:1182:13:3::43:80->80/tcp, 151.216.13.43:443->443/tcp, 2a07:1182:13:3::43:443->443/tcp
90 jobsboard_nginx_1
918a595cab9183 portainer/portainer "/portainer" 9 hours ago Up 9 hours 151.216.13.43:9000->9000/tcp, 2a07:1182:13:3::43:9000->9000/tcp
92 jobsboard_portainer_1
931eebe060500d jobsboard "/bin/sh -c 'sed -..." 9 hours ago Up 9 hours 151.216.13.43:3000->3000/tcp, 2a07:1182:13:3::43:3000->3000/tcp
94 jobsboard_jobsboard_1
951acec26e5c34 mongo:3.4 "docker-entrypoint..." 9 hours ago Up 9 hours 151.216.13.43:27017->27017/tcp, 2a07:1182:13:3::43:27017->27017/tcp
96 jobsboard_mongo_1
9772d6c1d7af54 helpdesk:Latest "docker-php-entryp..." 9 hours ago Up 9 hours 151.216.13.41:80->80/tcp, 2a07:1182:13:3::41:80->80/tcp, 151.216.13.41:443->443/tcp, 2a07:1182:13:3::41:443->443/tcp
98 helpdesk_helpdesk_1
99fb2362b7a9ac adminer "entrypoint.sh doc..." 9 hours ago Up 9 hours 151.216.13.41:8080->8080/tcp, 2a07:1182:13:3::41:8080->8080/tcp
100 helpdesk_adminer_1
101291f6491af5a redis "docker-entrypoint..." 9 hours ago Up 9 hours 6379/tcp
102 helpdesk_redis_1
103724e09ddd817 mysql "docker-entrypoint..." 9 hours ago Up 9 hours 151.216.13.41:3306->3306/tcp, 2a07:1182:13:3::41:3306->3306/tcp
104 helpdesk_mysql_1
105da338f1c97d4 vimagick/vsftpd "vsftpd /etc/vsftp..." 9 hours ago Up 9 hours 151.216.13.42:20-21->20-21/tcp, 2a07:1182:13:3::42:20-21->20-21/tcp, 151.216.13.42:30000-30100->30000-30100/tcp, 2a07:1182:13:3::4
1062:30000-30100->30000-30100/tcp blog_vsftpd_1
107b7e493791b3c worldpress "/entrypoint.sh ap..." 9 hours ago Up 9 hours 151.216.13.42:80->80/tcp, 2a07:1182:13:3::42:80->80/tcp, 151.216.13.42:443->443/tcp, 2a07:1182:13:3::42:443->443/tcp
108 blog_worldpress_1
109bb9dbb58595f mysql:5.7.21 "docker-entrypoint..." 9 hours ago Up 9 hours 151.216.13.42:3306->3306/tcp, 2a07:1182:13:3::42:3306->3306/tcp
110 blog_mysql_1
111
112oot@docker2:/# docker ps -a
113CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
114efcfe472bb73 mysql:5.7.21 "docker-entrypoint..." 9 hours ago Up 9 hours 151.216.13.45:3306->3306/tcp, 2a07:1182:13:3::45:3306->3306/tcp tinder_mysql_
1151
11604c17218b461 tinder "/bin/sh -c 'sed -..." 9 hours ago Up 9 hours 151.216.13.45:80->80/tcp, 2a07:1182:13:3::45:80->80/tcp, 151.216.13.45:443->443/tcp, 2a07:1182:13:3::45:443->443/tcp tinder_tinder
117_1
1180e09def5278c postgresql:latest "docker-entrypoint..." 9 hours ago Up 9 hours 151.216.13.44:5432->5432/tcp, 2a07:1182:13:3::44:5432->5432/tcp githab_postgr
119esql_1
120d683c6e348f1 gitea "/opt/gitea/gitea web" 9 hours ago Up 9 hours 151.216.13.44:22->22/tcp, 2a07:1182:13:3::44:22->22/tcp, 3000/tcp githab_gitea_
1211
1228fa09ca84bb9 nginx "nginx -g 'daemon ..." 9 hours ago Up 9 hours 151.216.13.44:80->80/tcp, 2a07:1182:13:3::44:80->80/tcp, 151.216.13.44:443->443/tcp, 2a07:1182:13:3::44:443->443/tcp githab_nginx_
1231
124
125docker upgrade to latest
126preferrably use overlay2 storage driver
127
128root@docker1:~/volumedumps# echo "nameserver 151.216.13.35" >> /etc/resolv.conf
129root@docker1:~/volumedumps# echo "nameserver 151.216.13.34" >> /etc/resolv.conf
130root@docker2:~/volumedumps# echo "nameserver 151.216.13.35" >> /etc/resolv.conf
131root@docker2:~/volumedumps# echo "nameserver 151.216.13.34" >> /etc/resolv.conf
132
133dump all docker volumes on host
134for VOLUME in $(docker volume ls|grep -v VOLUME); do
135docker run -it --rm --name dump-volume --volume ${VOLUME}:/volume:ro --volume $(pwd)/${VOLUME}_dump:/dump busybox /bin/sh -c "cp -a /volume/. /dump/"; done
136
137Swarm unecesary, no services running on it
138docker swarm leave -f
139
140
141root@video:/var/www/html# ls
142index.html no-video.png src style.css video.js
143root@video:/var/www/html# python -m SimpleHTTPServer
144Serving HTTP on 0.0.0.0 port 8000 ...
145151.216.29.13 - - [17/Apr/2018 14:18:32] "GET / HTTP/1.1" 200 -
146151.216.29.13 - - [17/Apr/2018 14:18:32] code 404, message File not found
147151.216.29.13 - - [17/Apr/2018 14:18:32] "GET /video.js/video-js.css HTTP/1.1" 404 -
148151.216.29.13 - - [17/Apr/2018 14:18:32] "GET /style.css HTTP/1.1" 200 -
149
150
151
152
153
154pdns1.telco13.ex
155Mysql listening on all interfaces
156tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 1030/mysqld
157Should replace apache with nginx
158remove poweradmin /var/www/html/poweradmin/
159install newest poweradmin
160
161tell linux team if neccesary to change configs in pdns
162
163mysql & poweradmin can be moved to container.
164Maybe move pdns server also? ask linux team
165
166create script that removes all grants and adds only neccesary grants.
167also change admin password in poweradmin db
168
169
170
171
172rtr-mgmt.telcoxx.ex
173
174check cipher list
175 ssl.cipher-list = "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS"
176
177goodwill router management system. has some python wrappers. have to analyze them with https://github.com/ebranca/owasp-pysec/
178
179python2-django-1.6.11.7-1.el7.noarch check this
180
181
182
183
184
185documents.int.telco13.ex
186tcp6 0 0 :::3306 :::* LISTEN 1316/mysqld
187grants
188web@%
189root@%
1901. Upgrade ProjectSend if possible
1912. clean alll includes and install new ones
192/var/www/html/includes/Google/Oauth2/ install new plain oauth
193Turn off: Auto approve new accounts
194Enable: When a system user uploads files
195change php mailing to smtp
196Limit file types uploading to Clients only!!!
197Disable html, html, php uploading
198
199
200linOTP.int.telco13.ex
201reinstall the following packages:
202 ii python-paste 1.7.5.1-6 all tools for using a Web Server Gateway Interface stack
203ii python-pastedeploy 1.5.2-1 all load, configure, and compose WSGI applications and servers
204ii python-pastedeploy-tpl 1.5.2-1 all load, configure, and compose WSGI applications and servers - templates
205ii python-pastescript 1.7.5-3 all serving web applications, creating file layouts for Python packages
206
207
208
209
210
211www.telco13.ex
2121) Apache listening on all interfaces. - tcp6 0 0 :::3306 :::* LISTEN 1241/mysqld
2132) Wierd escaping ./auth.php:673: $an = $conn->Execute('SELECT username, email FROM users WHERE username = '.$conn->qstr($username).' or email = '.$conn->qstr($email).''); (sqli)
2143) Smarty 3.1.21 (2014 version) please upgrade to latest
2154) htaccess overwritten in /var/www/html/admin/htprotect.php
2165) /var/www/html/admin/buddy plugin seems to be a backdoor
2176) Clear temporay files in production! ( It has probably backdoored items)
2187) FILE: /var/www/html/libs/SmartyBC.class.php eval tag
2198) XSS in post commeting
220
221TODO if done:
222 1) Enable captcha in http://www.telco13.ex/admin/protect.php
223 2) Manually approve new users - http://www.telco13.ex/admin/register.php
224
225
226forum.mil13.ex
227
228TODO If done;
2291) Disable no captcha plugin (and others)
2302) Approve users, + confirm needed
231
232
233blog.mil13.ex
2341) Users have staff access, need to removed
235
236
237
238
239
240mail.telco13.ex
241
242Active Internet connections (only servers)
243Proto Recv-Q Send-Q Local Address Foreign Address State
244tcp 0 0 localhost:10023 *:* LISTEN
245tcp 0 0 localhost:10025 *:* LISTEN
246tcp 0 0 localhost:10026 *:* LISTEN
247tcp 0 0 *:submission *:* LISTEN
248tcp 0 0 localhost:11211 *:* LISTEN
249tcp 0 0 localhost:10222 *:* LISTEN
250tcp 0 0 *:http *:* LISTEN
251tcp 0 0 *:urd *:* LISTEN
252tcp 0 0 *:ssh *:* LISTEN
253tcp 0 0 *:smtp *:* LISTEN
254tcp 0 0 localhost:8891 *:* LISTEN
255tcp 0 0 *:https *:* LISTEN
256tcp 0 0 localhost:8893 *:* LISTEN
257tcp 0 0 *:sieve *:* LISTEN
258tcp 0 0 *:imaps *:* LISTEN
259tcp 0 0 *:pop3s *:* LISTEN
260tcp6 0 0 [::]:submission [::]:* LISTEN
261tcp6 0 0 [::]:http [::]:* LISTEN
262tcp6 0 0 [::]:urd [::]:* LISTEN
263tcp6 0 0 [::]:munin [::]:* LISTEN
264tcp6 0 0 [::]:ssh [::]:* LISTEN
265tcp6 0 0 [::]:smtp [::]:* LISTEN
266tcp6 0 0 [::]:https [::]:* LISTEN
267tcp6 0 0 [::]:sieve [::]:* LISTEN
268tcp6 0 0 [::]:imaps [::]:* LISTEN
269tcp6 0 0 [::]:pop3s [::]:* LISTEN
270
271Notes:
2721) nginx already exists, apache is not used. Replace nginx configuration with defaults.
2732) Roundcube running at https://mail.telco13.ex. Remove Roundcube 1.3.3 and reinstall 1.3.6. Full reinstall.
274- Roundcube plugins: html5_notifier, archive, zipdownload, password, managesieve, jqueryui, persistent_login, carddav
275- Change des_key in roundcube config
276- Clear /home/user-data/mail/roundcube.sqlite table "sessions" - DELETE * FROM sessions;
277
2783) Mail-in-a-Box running at https://mail.telco13.ex/admin
279- DISABLE WEB INTERFACE / system service
280-
2814) Munin running at https://mail.telco13.ex/admin/munin/
282- DISABLE
2835) Nextcloud at https://mail.telco13.ex/cloud/
284- DISABLE
285- /home/user-data/owncloud/config.php change passwordsalt and secret
2866) z-push running at https://mail.telco13.ex/caldav, https://mail.telco13.ex/carddav, https://mail.telco13.ex/webdav
287- config USE_X_FORWARDED_FOR_HEADER=true (nginx proxies this)
288- config LOGAUTHFAIL = true
289- disable?
2907) mil13.ex configured in nginx, default html page - not a problem?
291
292Required services:
293 Webmail HTTP, Webmail HTTPS (also IMAPs, POP3s, SMTP, SMTPS, SSH)
294
295Required actions:
296 - Docker
297 - Clean nginx
298 - Clean roundcube (delete /usr/local/lib/roundcubemail, reconfigure mailinabox setup/webmail.sh; remove hash check, run webmail.sh)
299 - (Disable everything except Roundcube (disable Mail-in-a-Box, Munin, Nextcloud, z-push?))
300 - Change passwords @ sqlite db /home/user-data/mail/users.sqlite table users
301 - Check databases
302 - /var/tmp/roundcubemail chmod 640
303 - max body length 2k, url string limit
304
305crisis.mil13.ex
306
307Proto Recv-Q Send-Q Local Address Foreign Address State
308tcp 0 0 *:ssh *:* LISTEN
309tcp6 0 0 [::]:ssh [::]:* LISTEN
310tcp6 0 0 [::]:https [::]:* LISTEN
311tcp6 0 0 [::]:mysql [::]:* LISTEN
312tcp6 0 0 [::]:http [::]:* LISTEN
313
3141) MySQL
315- Listens on all interfaces
316- Has users that should not be there (system)
317
3182) Delete /var/www/html/backup directory (contains full backup as a zip file)
3193) Web service
320- Disable adminer.php
321- Check if default.jpg is backdoored
322- Replace apache with nginx
323- Restrict php
324
325Required services: HTTP, HTTPS (also SSH)
326
327Required actions:
328- MySQL set to listen only on localhost
329- Remove adminer.php
330- Delete MySQL users (system)
331- Restrict MySQL user "crisis" access
332- Change MySQL root password
333- Change MySQL debian-sys-maint password, also in /etc/mysql/debian.cnf
334- Change MySQL "crisis" password
335- Remove users that are not listed
336- Patch php code for injections
337 - max body length 2k, url string limit
338
339intranet.ops.mil13.ex (accessible currently only from 10.0.113.26)
340root@intranet:~# netstat -l
341Active Internet connections (only servers)
342Proto Recv-Q Send-Q Local Address Foreign Address State
343tcp 0 0 *:ssh *:* LISTEN
344tcp6 0 0 [::]:ssh [::]:* LISTEN
345tcp6 0 0 [::]:https [::]:* LISTEN
346tcp6 0 0 [::]:mysql [::]:* LISTEN
347tcp6 0 0 [::]:http [::]:* LISTEN
348
3491) Replace Apache with nginx
3502) MySQL listens on all interfaces
3513)
352
353Required actions:
354- MySQL listen only on localhost
355- Change MySQL debian-sys-maint password, also in /etc/mysql/debian.cnf
356- Remove unnecessary MySQL users
357- Restrict all other users
358- Remove all users that are not related to White Team
359 - max body length 2k, url string limit
360
361asterisk.mil13.ex
362- MySQL listens on all interfaces (Linux team will close)
363- FreePBX software running and needed; check accesses and code /var/www/html
364- Apache running, replace with nginx; apache config at /etc/httpd/httpd.conf
365- Check FreePBX users against allowed user list
366 - max body length 2k, url string limit
367
368
369Ãœldised asjad:
370 eemalda phpmyadmin
371 IPv6 liidesel kuulab imelik ssh teenus (somekinda beacon??)
372 Mysql bind'i localhostiga ja eemalda üleliigsed kasutajad.
373
374gallery.mil13.ex
375Apache ussitab (IPv6 443 pordil)
376Piwigo
377MYSQL root on paroolita (UPDATE `user` SET `authentication_string` = PASSWORD('lisaparool') WHERE `user`.`Host` = 'localhost' AND `user`.`User` = 'root';)
378mysql> select * from piwigo_users;
379+-----+------------------+------------------------------------+-----------------------------------------+
380| id | username | password | mail_address |
381+-----+------------------+------------------------------------+-----------------------------------------+
382| 1 | admin | $P$GaXezvWHXmNz35xmn5sg6glAmSVEz21 | admin@mil13.ex |
383| 2 | guest | NULL | NULL |
384| 4 | gt | $P$GA4YWFv//dfR5WMhBDUBQ87EOuVfC7/ | gt@mil13.ex |
385| 5 | scoringbot | $P$GCT4TqqCcW3FBb.6B56QDlrV7JaSmR1 | scoringbot@mil13.ex |
386| 6 | web-mil.blondie | $P$G7HwEU8cCVgLzJTh.7KCJ8BPztxd9m. | blondie.user@mil13.ex |
387| 7 | web-mil.taylor | $P$GVc6raJgwUcfZgd6uNGTm0BdlY.W.h0 | taylor.swift@mil13.ex |
388| 8 | web-mil.martin | $P$Gs4Ve.j6MwzhZ3A84pF6DI192kBDOG/ | martin.king@mil13.ex |
389| 9 | web-telco.mary | $P$GsmDeNeL58tM2lvPJsWLDriFnbRQld/ | mary.magdalene@telco13.ex |
390| 10 | web-telco.steve | $P$G7RfxHzRqH/naNBMSRNJ.rHD9cJ9S./ | steve.jobs@telco13.ex |
391| 11 | web-telco.babe | $P$GysccBOvdkPlM3riJ.WZ7IW.m88pZ1. | babe.ruth@telco13.ex |
392| 15 | westcotta | $P$GUuW8swcAholxPGtVKE9KnDqpyKoSV. | westcotta@nisi.ca |
393| 16 | atortor | $P$GDk.VOSAesujafej.T4PrTVfKf1OzE1 | a.tortor.Nunc@nisi.ca
394.............and so on.......eemalda kõik teised
395Script /usr/local/bin/statistics.sh on vast hilisemaks shelli saamiseks.
396
397
398www\.mil13.ex
399Wordpress 4.9.5 (peaks pakihalduriga uue paigldama)
400faili õigused on liiga lubavad, muuda sellisteks:
401 root directory /var/www/wordpress/ 0755
402wp-includes/ /var/www/wordpress/wp-includes 0755
403.htaccess /var/www/wordpress/.htaccess 0644
404wp-admin/index.php /var/www/wordpress/wp-admin/index.php 0644
405wp-admin/js/ /var/www/wordpress/wp-admin/js/ 0755
406wp-content/themes/ /var/www/wordpress/wp-content/themes 0755
407wp-content/plugins/ /var/www/wordpress/wp-content/plugins 0755
408wp-admin/ /var/www/wordpress/wp-admin 0755
409wp-content/ /var/www/wordpress/wp-content 0755
410wp-config.php /var/www/wordpress/wp-config.php 0644
411CMSis kasutaja old.admin
412web-mil.blondie ja web-mil.taylor on Administraatorite rollides(?)
413
414
415
416
417
418
419
420nginx image
421
422env
423
424
425if env https > add https conf
426default add http conf
427
428
429HTTPS_ENABLED=true/false (default false)
430HTTPS_PORT= (default )
431HTTPS_CERT=
432HTTPS_KEY=
433HTTP_PORT
434PROXY_BACKEND
435PROXY_BACKEND_PORT
436SERVER_NAME
437ADD_HEADER_X=
438HTTP_TO_HTTPS_REDIRECT=true/false (redirect)
439MOD_SECURITY_MODE = DetectionOnly/On
440LIMIT_RATE
441MAX_BODY_SIZE
442
443cipher list üle vaadata
444
445
446
447
448
449
450
451
452
453
454
455
456nginx add headers:
457max body size = 2kb (default 2k, setable via env)
458limit rate = 5kb/s (default 5kb/s, setable via env)
459
460
461
462
463
464 ssl on;
465 ssl_certificate /etc/letsencrypt/live/ennusta.eu/fullchain.pem;
466 ssl_certificate_key /etc/letsencrypt/live/ennusta.eu/privkey.pem;
467 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
468 ssl_prefer_server_ciphers on;
469 ssl_dhparam /etc/letsencrypt/live/ennusta.eu/dhparam.pem;
470 ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
471 ssl_session_timeout 1d;
472 ssl_session_cache shared:SSL:50m;
473 ssl_stapling on;
474 ssl_stapling_verify on;
475 add_header X-Content-Type-Options nosniff;
476 add_header X-XSS-Protection "1; mode=block";
477 add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
478 add_header X-Frame-Options "SAMEORIGIN";