Commit 6b3a509b authored by Adam Lewenberg's avatar Adam Lewenberg
Browse files

add disable 3DES support

parent 5010287d

NEWS

+5 −0
Original line number Diff line number Diff line 
release/001.023 (2017-11-08)



    Add "apache::debian::disable_3DES" parameter to disable DES and

    3DES. Also reorganize class files a bit. (adamhl)



release/001.022 (2017-11-02)



    Add include_webauth parameter to give folks the option of not

manifests/debian.pp

+9 −83
Original line number Diff line number Diff line
@@ -9,97 +9,23 @@ 
# transition clearer.

#

# $disable_TLS10RC4 disables TLSv1.0 protocol AND the RC4-based cipher suites.



# Releases wheezy and older

class apache::debian::old(

  $disable_TLS10RC4 = false

){

  exec { 'a2dissite 000-default':

    command => 'a2dissite 000-default',

    onlyif  => 'readlink /etc/apache2/sites-enabled/000-default | grep sites-available/default',

    path    => '/bin:/usr/bin:/usr/sbin',

    require => Package['apache'],

  }



  # Disable weak SSL ciphers.

  file { '/etc/apache2/conf.d/ssl-strength':

    content => template('apache/etc/apache2/conf.d/ssl-strength.erb'),

    require => Package['apache'],

    notify  => Service['apache'],

  }



  # Replace the default Apache security configuration file with one that

  # suppresses most information disclosure about the server.

  file { '/etc/apache2/conf.d/security':

    source  => 'puppet:///modules/apache/etc/apache2/conf.d/security',

    require => Package['apache'],

    notify  => Service['apache'],

  }



  # Support /server-status for all virtual hosts, but only from localhost.

  apache::module { 'status':

    ensure  => present,

    require => File['/etc/apache2/mods-available/status.conf'],

  }

  file { '/etc/apache2/mods-available/status.conf':

    source  => 'puppet:///modules/apache/etc/apache2/mods-available/status.conf',

    require => Package['apache'],

    notify  => Service['apache'],

  }

}



# Releases jessie and newer



# Set $disable_TLS10RC4 to true to disable the TLS1.0 protocol.



class apache::debian::new(

  $disable_TLS10RC4 = false

){

  # Note: the readlink executable comes from the coreutils package.

  exec { 'a2dissite 000-default.conf':

    command => 'a2dissite 000-default.conf',

    onlyif  => 'readlink /etc/apache2/sites-enabled/000-default.conf',

    path    => '/bin:/usr/bin:/usr/sbin',

    require => Package['apache'],

  }



  # Disable weak SSL ciphers.

  apache::conf { 'ssl-strength.conf':

    ensure  => present,

    content => template('apache/etc/apache2/conf.d/ssl-strength.erb'),

  }



  # Replace the default Apache security configuration file with one that

  # suppresses most information disclosure about the server.

  apache::conf { 'security.conf':

    ensure => present,

    source => 'puppet:///modules/apache/etc/apache2/conf.d/security',

    require => Package['apache'],

    notify  => Service['apache'],

  }



  # Support /server-status for all virtual hosts, but only from localhost.

  apache::module { 'status':

    ensure  => present,

    require => File['/etc/apache2/mods-available/status.conf'],

  }

  file { '/etc/apache2/mods-available/status.conf':

    source  => 'puppet:///modules/apache/etc/apache2/mods-available/status.conf',

    require => Package['apache'],

    notify  => Service['apache'],

  }

}

#

# $disable_3DES: if set to true will disable all DES- and 3DES-based

#   ciphers. See also https://www.openssl.org/blog/blog/2016/08/24/sweet32/



class apache::debian (

  $disable_TLS10RC4 = false

  $disable_TLS10RC4 = false,

  $disable_3DES     = false,

){

  if ($lsbdistcodename == 'wheezy') {

    class { 'apache::debian::old':

      disable_TLS10RC4 => $disable_TLS10RC4

      disable_TLS10RC4 => $disable_TLS10RC4,

      disable_3DES     => $disable_3DES,

    }

  } else {

    class { 'apache::debian::new':

      disable_TLS10RC4 => $disable_TLS10RC4

      disable_TLS10RC4 => $disable_TLS10RC4,

      disable_3DES     => $disable_3DES,

    }

  }

}

manifests/debian/new.pp

0 → 100644
+40 −0
Original line number Diff line number Diff line 
# Releases jessie and newer



class apache::debian::new(

  $disable_TLS10RC4 = false,

  $disable_3DES     = false,

){

  # Note: the readlink executable comes from the coreutils package.

  exec { 'a2dissite 000-default.conf':

    command => 'a2dissite 000-default.conf',

    onlyif  => 'readlink /etc/apache2/sites-enabled/000-default.conf',

    path    => '/bin:/usr/bin:/usr/sbin',

    require => Package['apache'],

  }



  # Disable weak SSL ciphers.

  apache::conf { 'ssl-strength.conf':

    ensure  => present,

    content => template('apache/etc/apache2/conf.d/ssl-strength.erb'),

  }



  # Replace the default Apache security configuration file with one that

  # suppresses most information disclosure about the server.

  apache::conf { 'security.conf':

    ensure => present,

    source => 'puppet:///modules/apache/etc/apache2/conf.d/security',

    require => Package['apache'],

    notify  => Service['apache'],

  }



  # Support /server-status for all virtual hosts, but only from localhost.

  apache::module { 'status':

    ensure  => present,

    require => File['/etc/apache2/mods-available/status.conf'],

  }

  file { '/etc/apache2/mods-available/status.conf':

    source  => 'puppet:///modules/apache/etc/apache2/mods-available/status.conf',

    require => Package['apache'],

    notify  => Service['apache'],

  }

}

manifests/debian/old.pp

0 → 100644
+38 −0
Original line number Diff line number Diff line 
# Releases wheezy and older

class apache::debian::old(

  $disable_TLS10RC4 = false,

  $disable_3DES     = false,

){

  exec { 'a2dissite 000-default':

    command => 'a2dissite 000-default',

    onlyif  => 'readlink /etc/apache2/sites-enabled/000-default | grep sites-available/default',

    path    => '/bin:/usr/bin:/usr/sbin',

    require => Package['apache'],

  }



  # Disable weak SSL ciphers.

  file { '/etc/apache2/conf.d/ssl-strength':

    content => template('apache/etc/apache2/conf.d/ssl-strength.erb'),

    require => Package['apache'],

    notify  => Service['apache'],

  }



  # Replace the default Apache security configuration file with one that

  # suppresses most information disclosure about the server.

  file { '/etc/apache2/conf.d/security':

    source  => 'puppet:///modules/apache/etc/apache2/conf.d/security',

    require => Package['apache'],

    notify  => Service['apache'],

  }



  # Support /server-status for all virtual hosts, but only from localhost.

  apache::module { 'status':

    ensure  => present,

    require => File['/etc/apache2/mods-available/status.conf'],

  }

  file { '/etc/apache2/mods-available/status.conf':

    source  => 'puppet:///modules/apache/etc/apache2/mods-available/status.conf',

    require => Package['apache'],

    notify  => Service['apache'],

  }

}

templates/etc/apache2/conf.d/ssl-strength.erb

+13 −1
Original line number Diff line number Diff line
@@ -16,5 +16,17 @@ 
    RC4   = ''

  end

-%>

<%

  if (@disable_3DES) then

    DES3 = '!3DES:'

-%>

#

# Disabling DES and 3DES (aka Triple DES).

# See also https://www.openssl.org/blog/blog/2016/08/24/sweet32/

<%

  else

    DES3 = ''

  end

-%>

SSLProtocol all -SSLv2 -SSLv3<%= TLS10 %>

SSLCipherSuite !eNULL:!aNULL:HIGH:MEDIUM:!ADH:!SSLv2:<%= RC4 %>@STRENGTH
 
SSLCipherSuite !eNULL:!aNULL:HIGH:MEDIUM:!ADH:!SSLv2:<%= RC4 %><%= DES3 %>@STRENGTH