chown -R root:root / etc/kubernetes/pki/ Audit: check_files_owner_in_dir.sh /node/etc/kubernetes/ssl Expected Result: 'true' is equal to 'true' Audit Script: #!/usr/bin/env bash # This script is chmod -R 644 /etc/ kubernetes/pki/*.crt Audit: check_files_permissions.sh /node/etc/kubernetes/ssl/!(*key).pe m Expected Result: 'true' is equal to 'true' Audit Script: #!/usr/bin/env bash # This on the master node. For example, chmod -R 600 /etc/ kubernetes/ssl/*key.pem Audit: check_files_permissions.sh /node/etc/kubernetes/ssl/*key.pem 600 Expected Result: 'true' is equal to 'true' Audit

绑定指定地址与端口 配置文件 配置片段 缓存指南 内容协商 动态共享对象(DSO) 环境变量 日志文件 从 URL 映射到文件系 统 性能调谐 安全技巧 服务器全局配置 SSL/TLS 加密 执行 CGI 前的用户切 换(suEXEC) URL 改写指南 虚拟主机 指引/教程 认证，授权与访问控制 CGI 与动态内容 .htaccess 文件 服务器端插入(SSI) To enable SSL support, you should edit httpd.conf to include the relevant mod_ssl directives and then use apachectl start to start the server. An example configuration to activate mod_ssl has been included included in conf/extra/httpd-ssl.conf. The default setting of UseCanonicalName is now Off. If you did not have this directive in your config file, you can add UseCanonicalName On to retain the old behavior

绑定指定地址与端口 配置文件 配置片段 缓存指南 内容协商 动态共享对象(DSO) 环境变量 日志文件 从 URL 映射到文件系 统 性能调谐 安全技巧 服务器全局配置 SSL/TLS 加密 执行 CGI 前的用户切 换(suEXEC) URL 改写指南 虚拟主机 指引/教程 认证，授权与访问控制 CGI 与动态内容 .htaccess 文件 服务器端插入(SSI) To enable SSL support, you should edit httpd.conf to include the relevant mod_ssl directives and then use apachectl start to start the server. An example configuration to activate mod_ssl has been included included in conf/extra/httpd-ssl.conf. The default setting of UseCanonicalName is now Off. If you did not have this directive in your config file, you can add UseCanonicalName On to retain the old behavior

绑定指定地址与端口 配置文件 配置片段 缓存指南 内容协商 动态共享对象(DSO) 环境变量 日志文件 从 URL 映射到文件系 统 性能调谐 安全技巧 服务器全局配置 SSL/TLS 加密 执行 CGI 前的用户切 换(suEXEC) URL 改写指南 虚拟主机 指引/教程 认证，授权与访问控制 CGI 与动态内容 .htaccess 文件 服务器端插入(SSI) To enable SSL support, you should edit httpd.conf to include the relevant mod_ssl directives and then use apachectl start to start the server. An example configuration to activate mod_ssl has been included included in conf/extra/httpd-ssl.conf. The default setting of UseCanonicalName is now Off. If you did not have this directive in your config file, you can add UseCanonicalName On to retain the old behavior

绑定指定地址与端口 配置文件 配置片段 缓存指南 内容协商 动态共享对象(DSO) 环境变量 日志文件 从 URL 映射到文件系 统 性能调谐 安全技巧 服务器全局配置 SSL/TLS 加密 执行 CGI 前的用户切 换(suEXEC) URL 改写指南 虚拟主机 指引/教程 认证，授权与访问控制 CGI 与动态内容 .htaccess 文件 服务器端插入(SSI) To enable SSL support, you should edit httpd.conf to include the relevant mod_ssl directives and then use apachectl start to start the server. An example configuration to activate mod_ssl has been included included in conf/extra/httpd-ssl.conf. The default setting of UseCanonicalName is now Off. If you did not have this directive in your config file, you can add UseCanonicalName On to retain the old behavior

. . . . . . . . 164 5 Apache SSL/TLS Encryption 167 5.1 Apache SSL/TLS Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 5.2 SSL/TLS Strong Encryption: An Introduction . . . . . . . . . . . . . . . . . 169 5.3 SSL/TLS Strong Encryption: Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 5.4 SSL/TLS Strong Encryption: How-To . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182 5.5 SSL/TLS Strong Encryption: FAQ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 6 Guides, Tutorials, and HowTos 203 6

. . . . . . . . 143 5 Apache SSL/TLS Encryption 145 5.1 Apache SSL/TLS Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 5.2 SSL/TLS Strong Encryption: An Introduction . . . . . . . . . . . . . . . . . 147 5.3 SSL/TLS Strong Encryption: Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 5.4 SSL/TLS Strong Encryption: How-To . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 5.5 SSL/TLS Strong Encryption: FAQ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 6 Guides, Tutorials, and HowTos 179 6

绑定指定地址与端口 配置文件 配置片段 缓存指南 内容协商 动态共享对象(DSO) 环境变量 日志文件 从 URL 映射到文件系 统 性能调谐 安全技巧 服务器全局配置 SSL/TLS 加密 执行 CGI 前的用户切 换(suEXEC) URL 改写指南 虚拟主机 指引/教程 认证，授权与访问控制 CGI 与动态内容 .htaccess 文件 服务器端插入(SSI) To enable SSL support, you should edit httpd.conf to include the relevant mod_ssl directives and then use apachectl start to start the server. An example configuration to activate mod_ssl has been included included in conf/extra/httpd-ssl.conf. The default setting of UseCanonicalName is now Off. If you did not have this directive in your config file, you can add UseCanonicalName On to retain the old behavior

. . . . . . . . 177 5 Apache SSL/TLS Encryption 181 5.1 Apache SSL/TLS Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182 5.2 SSL/TLS Strong Encryption: An Introduction . . . . . . . . . . . . . . . . . 183 5.3 SSL/TLS Strong Encryption: Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 5.4 SSL/TLS Strong Encryption: How-To . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 5.5 SSL/TLS Strong Encryption: FAQ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200 6 Guides, Tutorials, and HowTos 213 6

. . . . . . . . 177 5 Apache SSL/TLS Encryption 181 5.1 Apache SSL/TLS Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182 5.2 SSL/TLS Strong Encryption: An Introduction . . . . . . . . . . . . . . . . . 183 5.3 SSL/TLS Strong Encryption: Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 5.4 SSL/TLS Strong Encryption: How-To . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 5.5 SSL/TLS Strong Encryption: FAQ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200 6 Guides, Tutorials, and HowTos 213 6