Installation de dokuwiki

Liste des plugins:

Pour le wysiwg Prosemirror a évaluer.

Ou encore CGK editor

Installation de wallabag

Au 08/2020 wallabag n'est pas compatible PHP 7.4 (je crois sur wallabag 2.3 et il faut attendre la 2.4.

Un petit bug qui traine : https://github.com/wallabag/wallabag/issues/2768

Et la solution

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

Hardening TLS Apache2

Hardening de base : https://wiki.debian.org/Apache/Hardening

Evaluation de base : https://www.ssllabs.com/ssltest/analyze.html?d=alban.montaigu.io&s=163.172.180.167

La partie hardening TLS : https://httpd.apache.org/docs/trunk/ssl/ssl_howto.html

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
SSLHonorCipherOrder on
SSLCompression off
SSLSessionTickets off

Activation DNS CAA : https://blog.qualys.com/product-tech/2017/03/13/caa-mandated-by-cabrowser-forum

Autre tuto intéressant : https://community.bitnami.com/t/howto-a-on-all-tests-at-ssllabs-com-with-apache-2-4-xx/67885 mais a priori trop violent pour les vieux matériels

Activation hsts aussi : https://www.justegeek.fr/activer-len-tete-hsts-sur-apache-pour-proteger-son-site-web/?cn-reloaded=1

nano /etc/apache2/conf-enabled/security.com
ServerTokens Prod
ServerSignature Off
Header set X-Content-Type-Options: "nosniff"
Header set X-Frame-Options: "sameorigin"
# HSTS
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Aller plus loin dans les resultats SSLabs : https://community.bitnami.com/t/howto-a-on-all-tests-at-ssllabs-com-with-apache-2-4-xx/67885

Une piste pour améliorer la compliance : https://developer.mozilla.org/fr/docs/Web/Security/Public_Key_Pinning

Une autre poste encore : https://gist.github.com/GAS85/42a5469b32659a0aecc60fa2d4990308

''openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096''

Pinning : https://gist.github.com/GAS85/a668b941f84c621a15ff581ae968e4cb

''cat /etc/letsencrypt/live/alban.montaigu.io/cert.pem | openssl x509 -pubkey | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | base64
''

Aussi a voir ca :

https://community.letsencrypt.org/t/how-to-get-100-on-ssllabs-com-with-nginx/114196

https://community.letsencrypt.org/t/howto-a-with-all-100-s-on-ssl-labs-test-using-nginx-mainline-stable/55033

https://serverfault.com/questions/877774/trying-to-get-100-in-ssllabs-com-key-exchange/877784

https://itigloo.com/2017/02/21/how-to-get-an-a-rating-with-100-score-on-the-ssllabs-test-with-apache/