SSLCipherSuite에서 비활성화되었음에도 불구하고 Nessus 스캔에서는 EDH-RSA-DES-CBC3-SHA가 활성화되어 있음을 계속 찾습니다.

Question

나는 서버 보안에 관해서는 완전한 초보자이지만 내 문제를 적절하게 설명하려고 노력할 것입니다.

EDH-RSA-DES-CBC3-SHAnessus 스캔을 통과하기 위해 Mac 서버에서 Apache TLS 종료를 위한 암호 제품군을 비활성화하려고 하는데 계속 실패하는 것처럼 보이는 스캔을 제외하고 모두 통과할 수 있었습니다 . 나는 주위를 둘러 보았지만 이에 대한 답을 찾을 수없는 것 같습니다. 내 서버의 conf 파일은 다음과 같습니다. 이것은 다른 블로그를 찾아본 결과이지만 작동하지 않는 것 같습니다.

Library/Server/Web/Config/apache2/sites/0000_any_443_www.mySite.com.conf:

<VirtualHost 127.0.0.1:34580>
ServerName http://mysitte.com:80
ServerAdmin [email protected]
DocumentRoot "/Library/Server/Web/Data/Sites/Default/myfoler"
DirectoryIndex index.html index.php default.html
CustomLog /var/log/apache2/access_log combinedvhost
ErrorLog /var/log/apache2/error_log
<IfModule mod_ssl.c>
    SSLEngine Off
    SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"
    SSLProtocol -all +TLSv1.1 +TLSv1.2
    SSLProxyEngine On
    SSLProxyProtocol -all +TLSv1.1 +TLSv1.2
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerName off
</IfModule>
<Directory "/Library/Server/Web/Data/Sites/Default/myfolder">
    Options All -Indexes -ExecCGI -Includes +MultiViews
    AllowOverride None
    <IfModule mod_dav.c>
        DAV Off
    </IfModule>
    <IfDefine !WEBSERVICE_ON>
        Require all denied
        ErrorDocument 403 /customerror/websitesoff403.html
    </IfDefine>
</Directory>

테스트를 실행해보니

Testing ECDHE-ECDSA-DES-CBC3-SHA...NO (sslv3 alert handshake failure)
Testing SRP-DSS-3DES-EDE-CBC-SHA...NO (no ciphers available)
Testing SRP-RSA-3DES-EDE-CBC-SHA...NO (no ciphers available)
Testing SRP-3DES-EDE-CBC-SHA...NO (no ciphers available)
Testing EDH-RSA-DES-CBC3-SHA...YES !!!!!!!!!!!!(This is failling)
Testing EDH-DSS-DES-CBC3-SHA...NO (sslv3 alert handshake failure)
Testing DH-RSA-DES-CBC3-SHA...NO (sslv3 alert handshake failure)
Testing DH-DSS-DES-CBC3-SHA...NO (sslv3 alert handshake failure)
Testing AECDH-DES-CBC3-SHA...NO (sslv3 alert handshake failure)
Testing ADH-DES-CBC3-SHA...NO (sslv3 alert handshake failure)
Testing ECDH-RSA-DES-CBC3-SHA...NO (sslv3 alert handshake failure)
Testing ECDH-ECDSA-DES-CBC3-SHA...NO (sslv3 alert handshake failure)
Testing DES-CBC3-SHA...YES
Testing PSK-3DES-EDE-CBC-SHA...NO (no ciphers available)
Testing ECDHE-RSA-NULL-SHA...NO (sslv3 alert handshake failure)
Testing ECDHE-ECDSA-NULL-SHA...NO (sslv3 alert handshake failure)
Testing AECDH-NULL-SHA...NO (sslv3 alert handshake failure)
Testing ECDH-RSA-NULL-SHA...NO (sslv3 alert handshake failure)
Testing ECDH-ECDSA-NULL-SHA...NO (sslv3 alert handshake failure)
Testing NULL-SHA256...NO (sslv3 alert handshake failure)