IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Configure 389ds with "default" cipher suite

Browse Source 
nsSSLCiphers: "default" provides only secure ciphers that should be used when
connecting to DS

https://fedorahosted.org/freeipa/ticket/5684

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
This commit is contained in:
Martin Basti
2016-03-03 17:39:34 +01:00
parent bbad720138
commit 3c4a8c8932
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
install/updates/20-sslciphers.update
View File

@@ -1,6 +1,6 @@
# change configured ciphers # change configured ciphers
# the result of this update will be that all ciphers # the result of this update will be that default ciphers
# provided by NSS which ar not weak will be enabled # provided by DS which are not weak will be enabled
dn: cn=encryption,cn=config dn: cn=encryption,cn=config
only:nsSSL3Ciphers: +all only:nsSSL3Ciphers: default
addifnew:allowWeakCipher: off addifnew:allowWeakCipher: off

4
ipaserver/install/dsinstance.py
View File

@@ -777,7 +777,7 @@ class DsInstance(service.Service):
conn.do_simple_bind(DN(('cn', 'directory manager')), self.dm_password) conn.do_simple_bind(DN(('cn', 'directory manager')), self.dm_password)
mod = [(ldap.MOD_REPLACE, "nsSSLClientAuth", "allowed"), mod = [(ldap.MOD_REPLACE, "nsSSLClientAuth", "allowed"),
(ldap.MOD_REPLACE, "nsSSL3Ciphers", "+all"), (ldap.MOD_REPLACE, "nsSSL3Ciphers", "default"),
(ldap.MOD_REPLACE, "allowWeakCipher", "off")] (ldap.MOD_REPLACE, "allowWeakCipher", "off")]
conn.modify_s(DN(('cn', 'encryption'), ('cn', 'config')), mod) conn.modify_s(DN(('cn', 'encryption'), ('cn', 'config')), mod)
@@ -1241,7 +1241,7 @@ class DsInstance(service.Service):
conn.do_external_bind('root') conn.do_external_bind('root')
mod = [(ldap.MOD_REPLACE, "nsSSLClientAuth", "allowed"), mod = [(ldap.MOD_REPLACE, "nsSSLClientAuth", "allowed"),
(ldap.MOD_REPLACE, "nsSSL3Ciphers", "+all"), (ldap.MOD_REPLACE, "nsSSL3Ciphers", "default"),
(ldap.MOD_REPLACE, "allowWeakCipher", "off")] (ldap.MOD_REPLACE, "allowWeakCipher", "off")]
conn.modify_s(DN(('cn', 'encryption'), ('cn', 'config')), mod) conn.modify_s(DN(('cn', 'encryption'), ('cn', 'config')), mod)