IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Configure 389ds with "default" cipher suite

Browse Source 
nsSSLCiphers: "default" provides only secure ciphers that should be used when
connecting to DS

https://fedorahosted.org/freeipa/ticket/5684

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
This commit is contained in:
Martin Basti 2016-03-03 17:39:34 +01:00
parent abe3abb466
commit dd86f83c96
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
install/updates/20-sslciphers.update
View File

@ -1,6 +1,6 @@
# change configured ciphers
# the result of this update will be that all ciphers
# provided by NSS which ar not weak will be enabled
# the result of this update will be that default ciphers
# provided by DS which are not weak will be enabled
dn: cn=encryption,cn=config
only:nsSSL3Ciphers: +all
only:nsSSL3Ciphers: default
addifnew:allowWeakCipher: off

4
ipaserver/install/dsinstance.py
View File

@ -777,7 +777,7 @@ class DsInstance(service.Service):
conn.do_simple_bind(DN(('cn', 'directory manager')), self.dm_password)
mod = [(ldap.MOD_REPLACE, "nsSSLClientAuth", "allowed"),
(ldap.MOD_REPLACE, "nsSSL3Ciphers", "+all"),
(ldap.MOD_REPLACE, "nsSSL3Ciphers", "default"),
(ldap.MOD_REPLACE, "allowWeakCipher", "off")]
conn.modify_s(DN(('cn', 'encryption'), ('cn', 'config')), mod)
@ -1240,7 +1240,7 @@ class DsInstance(service.Service):
conn.do_external_bind('root')
mod = [(ldap.MOD_REPLACE, "nsSSLClientAuth", "allowed"),
(ldap.MOD_REPLACE, "nsSSL3Ciphers", "+all"),
(ldap.MOD_REPLACE, "nsSSL3Ciphers", "default"),
(ldap.MOD_REPLACE, "allowWeakCipher", "off")]
conn.modify_s(DN(('cn', 'encryption'), ('cn', 'config')), mod)