Commit 29b1f970 authored by Adam Lewenberg's avatar Adam Lewenberg
Browse files

version release/001.021

parent bd178f67

NEWS

+5 −0
Original line number Diff line number Diff line 
release/001.021 (2017-06-07)



    Change parameter from "apache::debian::disable_TLS10R4" to

    "apache::debian::disable_TLS10RC4". (adamhl).



release/001.020 (2017-06-06)



    Add apache::debian::disable_TLS10R4 parameter so that TLS1.0/RC4 can

manifests/debian.pp

+7 −7
Original line number Diff line number Diff line
@@ -8,11 +8,11 @@ 
# configured.  Create a completely new class to support it to make the

# transition clearer.

#

# $disable_TLS10R4 disables TLSv1.0 protocol AND the RC4-based cipher suites.

# $disable_TLS10RC4 disables TLSv1.0 protocol AND the RC4-based cipher suites.



# Releases wheezy and older

class apache::debian::old(

  $disable_TLS10R4 = false

  $disable_TLS10RC4 = false

){

  exec { 'a2dissite 000-default':

    command => 'a2dissite 000-default',
@@ -50,10 +50,10 @@ class apache::debian::old( 


# Releases jessie and newer



# Set $disable_TLS10R4 to true to disable the TLS1.0 protocol.

# Set $disable_TLS10RC4 to true to disable the TLS1.0 protocol.



class apache::debian::new(

  $disable_TLS10R4 = false

  $disable_TLS10RC4 = false

){

  # Note: the readlink executable comes from the coreutils package.

  exec { 'a2dissite 000-default.conf':
@@ -91,15 +91,15 @@ class apache::debian::new( 
}



class apache::debian (

  $disable_TLS10R4 = false

  $disable_TLS10RC4 = false

){

  if ($lsbdistcodename == 'wheezy') {

    class { 'apache::debian::old':

      disable_TLS10R4 => $disable_TLS10R4

      disable_TLS10RC4 => $disable_TLS10RC4

    }

  } else {

    class { 'apache::debian::new':

      disable_TLS10R4 => $disable_TLS10R4

      disable_TLS10RC4 => $disable_TLS10RC4

    }

  }

}

templates/etc/apache2/conf.d/ssl-strength.erb

+1 −1
Original line number Diff line number Diff line
@@ -4,7 +4,7 @@ 
# enabled and we don't want users to negotiate DES encryption or other

# weak encryption protocols.

<%

  if (@disable_TLS10R4) then

  if (@disable_TLS10RC4) then

    TLS10 = ' -TLSv1'

    RC4   = '!RC4:'

-%>