Commit 925ae23c authored by Adam Lewenberg's avatar Adam Lewenberg
Browse files

add option to disable TLSv1.0

parent 895d94d9

files/etc/filter-syslog/apache

+4 −0
Original line number Diff line number Diff line
@@ -13,3 +13,7 @@ httpd: /^GSSAPI Error: The (referenced )?context has expired / 
# Log messages from Red Hat from normal Apache startup and shutdown.

httpd:   /^httpd (startup|shutdown|-HUP) succeeded$/

httpd:   /^GSSAPI Error: Miscellaneous failure \(Ticket expired\)$/



# Innocuous errors starting with Apache 2.4

apache2: /^\d+ INFO XMLTooling.Config : xmltooling \S+ library shutdown complete$/

apache2: /^\d+ INFO XMLTooling.Config : xmltooling \S+ library initialization complete$/

manifests/debian.pp

+7 −3
Original line number Diff line number Diff line
@@ -45,7 +45,11 @@ class apache::debian::old { 


# Releases jessie and newer



class apache::debian::new {

# Set $disable_TLS10 to true to disable the TLS1.0 protocol.



class apache::debian::new(

  $disable_TLS10 = false

){

  # Note: the readlink executable comes from the coreutils package.

  exec { 'a2dissite 000-default.conf':

    command => 'a2dissite 000-default.conf',
@@ -57,7 +61,7 @@ class apache::debian::new { 
  # Disable weak SSL ciphers.

  apache::conf { 'ssl-strength.conf':

    ensure  => present,

    source => 'puppet:///modules/apache/etc/apache2/conf.d/ssl-strength',

    content => template('apache/etc/apache2/conf.d/ssl-strength.erb'),

  }



  # Replace the default Apache security configuration file with one that

templates/etc/apache2/conf.d/ssl-strength.erb

0 → 100644
+18 −0
Original line number Diff line number Diff line 
# /etc/apache2/conf.d/ssl-strength -- Disable weak SSL ciphers.

#

# Disable SSLv2 and weak SSL ciphers.  Nessus scans warn if these are

# enabled and we don't want users to negotiate DES encryption or other

# weak encryption protocols.

<%

  if (@disable_TLS10) then

    TLS10 = ' -TLSv1'

-%>

#

# Disabling TLS1.0 due to issues with RC4 and the BEAST attack.

<%

  else

    TLS10 = ''

  end

-%>

SSLProtocol all -SSLv2 -SSLv3<%= TLS10 %>

SSLCipherSuite !eNULL:!aNULL:HIGH:MEDIUM:!ADH:!SSLv2:@STRENGTH