Commit 4d2a3961 authored by Lonlone Lee's avatar Lonlone Lee
Browse files

Merge branch 'tls11' into 'master' 

Added disable TLSv1.1 functionality

See merge request !1
parents 6cce4b76 1ab451ef

manifests/debian.pp

+3 −0
Original line number Diff line number Diff line
@@ -15,6 +15,7 @@ 


class apache::debian (

  $disable_TLS10RC4 = false,

  $disable_TLS11RC4 = false,

  $disable_3DES     = false,

){

  # Almost every Apache server uses SSL and even if a server does not use it, it
@@ -24,11 +25,13 @@ class apache::debian ( 
  if ($lsbdistcodename == 'wheezy') {

    class { 'apache::debian::old':

      disable_TLS10RC4 => $disable_TLS10RC4,

      disable_TLS11RC4 => $disable_TLS11RC4,

      disable_3DES     => $disable_3DES,

    }

  } else {

    class { 'apache::debian::new':

      disable_TLS10RC4 => $disable_TLS10RC4,

      disable_TLS11RC4 => $disable_TLS11RC4,

      disable_3DES     => $disable_3DES,

    }

  }

manifests/debian/new.pp

+1 −0
Original line number Diff line number Diff line
@@ -2,6 +2,7 @@ 


class apache::debian::new(

  $disable_TLS10RC4 = false,

  $disable_TLS11RC4 = false,

  $disable_3DES     = false,

){

  # Note: the readlink executable comes from the coreutils package.

manifests/debian/old.pp

+1 −0
Original line number Diff line number Diff line 
# Releases wheezy and older

class apache::debian::old(

  $disable_TLS10RC4 = false,

  $disable_TLS11RC4 = false,

  $disable_3DES     = false,

){

  exec { 'a2dissite 000-default':

templates/etc/apache2/conf.d/ssl-strength.erb

+6 −1
Original line number Diff line number Diff line
@@ -9,7 +9,12 @@ 
    RC4   = '!RC4:'

-%>

#

# Disabling TLS1.0 and RC4 due to issues with RC4 and the BEAST attack.

# Disabling TLS and RC4 due to issues with RC4 and the BEAST attack.

<%

  elsif (@disable_TLS11RC4) then

    TLS10 = ' -TLSv1 -TLSv1.1 '

    RC4   = '!RC4:'

-%>

<%

  else

    TLS10 = ''