Changeset e9ef72c in mod_gnutls for doc

Timestamp:

Jun 20, 2016, 2:51:01 PM (2 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, upstream

Children:

743e31f

Parents:

5a5032f

git-author:

Thomas Klute <thomas2.klute@…> (06/20/16 13:29:13)

git-committer:

Thomas Klute <thomas2.klute@…> (06/20/16 14:51:01)

Message:

Disable GnuTLSSessionTickets by default as described in handbook

The handbook clearly states that the default value for
GnuTLSSessionTickets is "off", but the actual setting in post config
was the opposite (which matched mod_ssl behavior). The code has been
changed to match documentation.

Additionally the handbook has been expanded regarding session ticket
use and security. The comment about the cache timeout being used for
session ticket expiration has been removed for being plainly wrong.

File:

• doc/mod_gnutls_manual.mdwn (modified) (2 diffs)

doc/mod_gnutls_manual.mdwn

@@ -133 +133 @@
 
 To avoid storing data for TLS session resumption it is allowed to
-provide client with a ticket, to use on return.  Use for servers with
-limited storage, and don't combine with GnuTLSCache. For a pool of
-servers this option is not recommended since the tickets are unique
-for the issuing server only.
-
+provide client with a ticket, to use on return. Tickets are an
+alternative to using a session cache, mostly used for busy servers
+with limited storage. For a pool of servers this option is not
+recommended since the tickets are bound to the issuing server only.
+
+If this option is set in the global configuration, virtual hosts
+without a `GnuTLSSessionTickets` setting will use the global setting.
+
+*Warning:* Currently the master key that protects the tickets is
+generated only on server start, and there is no mechanism to roll over
+the key. If session tickets are enabled it is highly recommened to
+restart the server regularly to protect past sessions in case an
+attacker gains access to server memory.
 
 `GnuTLSCertificateFile`
@@ -685 +693 @@
      # This could also be 'Listen *:443',
      # just like '*:80' is common for non-https
-     # No caching. Enable session tickets. Timeout is still used for
-     # ticket expiration.
-     GnuTLSCacheTimeout 600
      # This tells apache, that for this IP/Port combination, we want to use
      # Name Based Virtual Hosting. In the case of Server Name Indication,