ReadyNAS 4.1.x Frontview (as shipped) security configuration issues.

[fooboo]

So I've been going through various bits of my infrastructure testing security configs, so on a whim I decided to test my Readynas NV running 4.1.14 using testssl.sh. 

Naturally, it identified some issues. I'm hoping that Netgear will consider incorporating the following since they are just config changes for 4.1.15

I went through and tested the following and now it's relatively more secure from an apache config standpoint. We could start getting crazy and adding stuff like XFO etc. but the following below should be a good start and disables bad ciphers and protocols. 

So PLEASE PLEASE PLEASE consider adding this for the next release. And thanks for supporting such an old device all these years.

SSLProtocol all -SSLv2 -SSLv3

SSLCipherSuite HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-RSA-DES-CBC3-SHA:!DES-CBC3-SHA

SSLHonorCipherOrder on

Header always set Strict-Transport-Security "max-age=15768000"

[DaneA]

Hi fooboo,

I suggest you to kindly post your concern as feature request on the Idea Exchange for Storage here.  Be reminded that adding kudos to the ideas posted will help.  The post that has more kudos will be subject for review by the ReadyNAS development team and might be considered to be added in the future functionality of the product.

Cheers,

DaneA
NETGEAR Community Team

[fooboo]

Ok,

Submitted here as requested.

https://community.netgear.com/t5/Idea-Exchange-for-Storage/Please-update-Raidiator-4-1-x-security-co...