Securing client server communications using TLS

Even though lot of websites have moved to secure protocols to provide their services like, e-commerce and social networking sites, but many a times the security protocols are not implemented correctly in their servers allowing hackers or crackers to break the secure protocol using the loopholes in the implementation of these secure protocols.

Below are few recommendations to implement Transport Layer Security (TLS) on popular internet servers to provide sufficiently secure transmissions of data between the server and the client, over the internet. Please note all the below examples are for servers which were built with OpenSSL TLS library.

Apache 2.4 webserver

Apache uses the configuration file apache2.conf or virtual host conf file to specify TLS related details.

To configure Apache to use TLS, provide the below directives in the apache2.conf file.

Provide the below directives in the <virtual host>.conf file. Also please ensure your certificate key is of 2048 bits or more for better security.

Provide the below directive in the <virtual host>.conf for the host listening to unsecure port 80 to redirect all unsecure traffic to the secure URL.

The above directive only applies if you allow unsecure http traffic on port 80 through the below configuration in the virtual host conf file.

<VirtualHost *:80>

Redirect permanent / https://www.yourdomain.com/

</VirtualHost *:80>

Provide the below directive to enforce HTTP Strict Transport Security in the virtual host.

The above directive to force web browsers to connect to your web server on HTTPS protocol only, even if unsecure protocol HTTP is used in the address bar. This prevents man-in-the-middle (MITM) hijacking of your HTTPS session during the initial redirection from unsecure HTTP to HTTPS session.

To enable OCSP stapling on Apache web server put the below directive in the main configuration file namely apache2.conf (not in the virtual host configuration file)

Online Certificate Status Protocol (OCSP) stapling frees the web browser of your client from checking the revocation status of the SSL certificate presented by your Apache web browser as the server itself sends the response on behalf of the CA authority.

Postfix SMTP server

Postfix works both as a server and a client to receive and send mails respectively. Though sending and receiving mail can be done securely or unsecurely depending upon whether the remote server (to which you are sending or receiving mail from) supports TLS or not, but authenticating valid users who can send mail through your server i.e. relay mail through your server must be done securely. Unsecure transmission of authentication tokens like username and password can lead to someone getting hold of that information while in transit and using it to send emails on your behalf or for spamming. Authentication can be secured in Postfix by using the below directives in Postfix configuration files. I assume users connect to Postfix submission port 587 to send or relay emails through client software like Outlook or Thunderbird and smtp port 25 is closed for relay.

Put the below directives in master.cf file to use TLS for authentication.

You also need the below directives in the main.cf file. Please ensure your certificate key is of 2048 bits or more for better security.

To send secure emails using TLS use the below directives in main.cf file. The below directive falls back to unsecure email if the remote server does not have TLS capability.

To receive secure email using TLS use the below directives in main.cf file. The below directive falls back to unsecure email if the remote server does not have TLS capability. Please note that below directives start with smtpd and not smtp as above.

Courier IMAP server

A lot of email traffic on the internet is served by IMAP servers. Many webmail clients, standalone email clients like Outlook, Thunderbird and mobile mail applications use IMAP internally to fetch email from user mailboxes and show it to users. So securing IMAP server is as important as securing a SMTP server. The below configuration will make the Courier IMAP server use TLS for both authentication and for tranfering mails from the user mailbox to the webmail or standalone client.

Add or uncomment and edit the below directives in the imapd-ssl configuration file as shown below.

Comment out the below directive as shown. This will allow the IMAP server to accept TLS connections on standard IMAP port 143 using STARTTLS instead of using the dedicated SSL port 993.

OpenLDAP server

Securing OpenLDAP server is of prime importance for any organization and for individuals because LDAP servers provide authentication and authorization services to it's people. Any compromise of the OpenLDAP server can lead to a major breach of security and data theft and can cost any organization huge amount of money.

OpenLDAP provide both SSL and TLS security but we will focus on TLS as it's the preferred way to secure communication between the server and the client. OpenLDAP supports STARTTLS on the standard LDAP port 389 which allows the client to upgrade the insecure connection on the port to an encrypted one without connecting to another dedicated SSL port.

If you are using olc files for configuration, add the following attributes under DN cn=config using a ldif file.

The ldap.conf counterparts for the above attributes are