HSTS configuration on UTM

For the WebAdmin HSTS is used since UTM Release 9.508 (if I am correct). To which features relates your question?

Best regards 

Alex 

Mainly I am looking to understand how the UTM provide HSTS protection with the WAF module.

Mainly I am looking to understand how the UTM provide HSTS protection with the WAF module.

Hi Morris,

from what I know you have to edit 

/var/storage/chroot-reverseproxy/usr/apache/conf/reverseproxy.conf

on every entry which matches <VirtualHost IP:443>

add the line

Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"

To activate the change use

/var/mdw/scripts/reverseproxy restart

PS ! Please be aware that such changes can be loss of support entitlement !

Best regards 

Alex 

Is there any recommended documentation?

Not as far as I know. Two things more for that topic. Every config change via gui will revert that setting made in shell. And the second, I think HSTS is passed through by WAF if the server you specified in WAF already supports HSTS. One example I've myself.

BR