IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

For Fedora and RHEL use system-wide crypto policy for mod_ssl

Browse Source 
Drop the SSLProtocol directive for Fedora and RHEL systems. mod_ssl
will use crypto policies for the set of protocols.

For Debian systems configure a similar set of protocols for what
was previously configured, but do it in a different way. Rather than
iterating the allowed protocols just include the ones not allowed.

Fixes: https://pagure.io/freeipa/issue/7667

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This commit is contained in:
Rob Crittenden 2019-05-23 10:45:26 -04:00 committed by Christian Heimes
parent b2acd65013
commit c484d79ecf
4 changed files with 19 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ipaplatform/base/tasks.py
View File

@ -246,6 +246,10 @@ class BaseTaskNamespace:
"""Configure WSGI for correct Python version""" """Configure WSGI for correct Python version"""
raise NotImplementedError() raise NotImplementedError()
def configure_httpd_protocol(self):
"""Configure TLS protocols in Apache"""
raise NotImplementedError()
def is_fips_enabled(self): def is_fips_enabled(self):
return False return False

7
ipaplatform/debian/tasks.py
View File

@ -10,7 +10,9 @@ from __future__ import absolute_import
from ipaplatform.base.tasks import BaseTaskNamespace from ipaplatform.base.tasks import BaseTaskNamespace
from ipaplatform.redhat.tasks import RedHatTaskNamespace from ipaplatform.redhat.tasks import RedHatTaskNamespace
from ipaplatform.paths import paths
from ipapython import directivesetter
from ipapython import ipautil from ipapython import ipautil
class DebianTaskNamespace(RedHatTaskNamespace): class DebianTaskNamespace(RedHatTaskNamespace):
@ -69,6 +71,11 @@ class DebianTaskNamespace(RedHatTaskNamespace):
# Debian doesn't require special mod_wsgi configuration # Debian doesn't require special mod_wsgi configuration
pass pass
def configure_httpd_protocol(self):
directivesetter.set_directive(paths.HTTPD_SSL_CONF,
'SSLProtocol',
'all -SSLv3', False)
def setup_httpd_logging(self): def setup_httpd_logging(self):
# Debian handles httpd logging differently # Debian handles httpd logging differently
pass pass

6
ipaplatform/redhat/tasks.py
View File

@ -589,6 +589,12 @@ class RedHatTaskNamespace(BaseTaskNamespace):
self.systemd_daemon_reload() self.systemd_daemon_reload()
def configure_httpd_protocol(self):
"""Drop SSLProtocol directive and let crypto policy handle it"""
directivesetter.set_directive(paths.HTTPD_SSL_CONF,
'SSLProtocol',
None, False)
def set_hostname(self, hostname): def set_hostname(self, hostname):
ipautil.run([paths.BIN_HOSTNAMECTL, 'set-hostname', hostname]) ipautil.run([paths.BIN_HOSTNAMECTL, 'set-hostname', hostname])

6
ipaserver/install/httpinstance.py
View File

@ -123,7 +123,7 @@ class HTTPInstance(service.Service):
self.step("disabling nss.conf", self.disable_nss_conf) self.step("disabling nss.conf", self.disable_nss_conf)
self.step("configuring mod_ssl certificate paths", self.step("configuring mod_ssl certificate paths",
self.configure_mod_ssl_certs) self.configure_mod_ssl_certs)
self.step("setting mod_ssl protocol list to TLSv1.0 - TLSv1.2", self.step("setting mod_ssl protocol list",
self.set_mod_ssl_protocol) self.set_mod_ssl_protocol)
self.step("configuring mod_ssl log directory", self.step("configuring mod_ssl log directory",
self.set_mod_ssl_logdir) self.set_mod_ssl_logdir)
@ -244,9 +244,7 @@ class HTTPInstance(service.Service):
open(paths.HTTPD_NSS_CONF, 'w').close() open(paths.HTTPD_NSS_CONF, 'w').close()
def set_mod_ssl_protocol(self): def set_mod_ssl_protocol(self):
directivesetter.set_directive(paths.HTTPD_SSL_CONF, tasks.configure_httpd_protocol()
'SSLProtocol',
'+TLSv1 +TLSv1.1 +TLSv1.2', False)
def set_mod_ssl_logdir(self): def set_mod_ssl_logdir(self):
tasks.setup_httpd_logging() tasks.setup_httpd_logging()