IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-01-26 16:16:31 -06:00
Code Issues Packages Projects Releases Wiki Activity

Don't use weak ciphers for client HTTPS connections

Browse Source 
https://pagure.io/freeipa/issue/6730

Reviewed-By: Martin Basti <mbasti@redhat.com>
This commit is contained in:
Stanislav Laznicka 2017-02-23 14:31:50 +01:00 committed by Tomas Krizek
parent 61cd4372e1
commit fda22c3344
No known key found for this signature in database
GPG Key ID: 22A2A94B5E49415A
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ipalib/constants.py
View File

@ -296,3 +296,6 @@ TLS_VERSIONS = [
"tls1.2"
]
TLS_VERSION_MINIMAL = "tls1.0"
# high ciphers without RC4, MD5, TripleDES, pre-shared key
# and secure remote password
TLS_HIGH_CIPHERS = "HIGH:!aNULL:!eNULL:!MD5:!RC4:!3DES:!PSK:!SRP"

6
ipalib/util.py
View File

@ -52,7 +52,7 @@ except ImportError:
from ipalib import errors, messages
from ipalib.constants import (
DOMAIN_LEVEL_0,
TLS_VERSIONS, TLS_VERSION_MINIMAL
TLS_VERSIONS, TLS_VERSION_MINIMAL, TLS_HIGH_CIPHERS
)
from ipalib.text import _
from ipapython.ssh import SSHPublicKey
@ -303,6 +303,10 @@ def create_https_connection(
ssl.OP_SINGLE_ECDH_USE
)
# high ciphers without RC4, MD5, TripleDES, pre-shared key
# and secure remote password
ctx.set_ciphers(TLS_HIGH_CIPHERS)
# pylint: enable=no-member
# set up the correct TLS version flags for the SSL context
for version in TLS_VERSIONS: