HTTP Strict Transport Security
HTTP Strict Transport Security (HSTS) is a policy mechanism that helps to protect websites against man-in-the-middle attacks such as protocol downgrade attacks and cookie hijacking.
Uyuni allows enabling HSTS, to enable it for a Uyuni Server:
-
Create new configuration file in
/etc/apache2/conf.d/<filename>.conf
, for example/etc/apache2/conf.d/zz-spacewalk-www-custom.conf
. -
Add line
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
-
Restart Apache with
systemctl restart apache2
To enable it for Uyuni Proxies:
-
Create new configuration file in
/etc/apache2/conf.d/<filename>.conf
, for example/etc/apache2/conf.dz/zz-spacewalk-proxy-custom.conf
. -
Add line
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
-
Restart Apache with
systemctl restart apache2
When naming the new config file |
When HSTS is enabled while using the default SSL certificate generated by Uyuni or a self-signed certificate, browsers will refuse to connect with HTTPS unless the CA used to sign such certificates is trusted by the browser.
If you are using the SSL certificate generated by Uyuni, you can trust it by importing the file located at |