Commit e6fbac9d authored by Adam Lewenberg's avatar Adam Lewenberg
Browse files

also disable RC4

parent 22f39b9a

manifests/debian.pp

+2 −0
Original line number Diff line number Diff line
@@ -7,6 +7,8 @@ 
# Jessie is a significant change to the way that apache servers are

# configured.  Create a completely new class to support it to make the

# transition clearer.

#

# $disable_TLS10 disables TLSv1.0 protocol AND the RC4-based cipher suites.



# Releases wheezy and older

class apache::debian::old(

templates/etc/apache2/conf.d/ssl-strength.erb

+4 −2
Original line number Diff line number Diff line
@@ -6,13 +6,15 @@ 
<%

  if (@disable_TLS10) then

    TLS10 = ' -TLSv1'

    RC4   = '!RC4:'

-%>

#

# Disabling TLS1.0 due to issues with RC4 and the BEAST attack.

# Disabling TLS1.0 and RC4 due to issues with RC4 and the BEAST attack.

<%

  else

    TLS10 = ''

    RC4   = ''

  end

-%>

SSLProtocol all -SSLv2 -SSLv3<%= TLS10 %>

SSLCipherSuite !eNULL:!aNULL:HIGH:MEDIUM:!ADH:!SSLv2:@STRENGTH
 
SSLCipherSuite !eNULL:!aNULL:HIGH:MEDIUM:!ADH:!SSLv2:<%= RC4 %>@STRENGTH