perfSONAR User Q&A and Other Discussion

[hito <>]

Hello.


We were told by BNL cybersecurity that Perfsonar instance at BNL is not
sufficiently secure to "pass" their test (test for all xxx.gov
sites).    After changing our ssl.conf, we managed to pass it.  Maybe,
this setting should be implemented everywhere or at least advertised for
those sites.   It is noted here that our change will allow the access to
this host from only fairly new client (ssl) only. 

The change we have made in ssl.conf is the following.

======

Header always set Strict-Transport-Security "max-age=31536000;"

SSLProtocol -ALL +TLSv1.2

SSLCipherSuite 
ECDH+AESGCM:ECDH+CHACHA20:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!aNULL:!MD5:!DSS:!RSA

SSLCACertificateFile /etc/pki/CA/certs/incommon-rsa-server-ca.crt  
<<<   this file should be included in the PerfSonar distribution. 

=====

thanks,

Hiro