Commit f364d0c4 authored by Adam Lewenberg's avatar Adam Lewenberg
Browse files

release/001.016

parent e6fbac9d

NEWS

+4 −0
Original line number Diff line number Diff line 
release/001.016 (2016-01-28)



    Add new option in debian class to diable TLSv1.0 and RC4 (adamhl).



release/001.015 (2015-12-14)



    Changes to comodo.pp to support CentOS (jlent)

manifests/debian.pp

+4 −4
Original line number Diff line number Diff line
@@ -8,11 +8,11 @@ 
# configured.  Create a completely new class to support it to make the

# transition clearer.

#

# $disable_TLS10 disables TLSv1.0 protocol AND the RC4-based cipher suites.

# $disable_TLS10R4 disables TLSv1.0 protocol AND the RC4-based cipher suites.



# Releases wheezy and older

class apache::debian::old(

  $disable_TLS10 = false

  $disable_TLS10R4 = false

){

  exec { 'a2dissite 000-default':

    command => 'a2dissite 000-default',
@@ -49,10 +49,10 @@ class apache::debian::old( 


# Releases jessie and newer



# Set $disable_TLS10 to true to disable the TLS1.0 protocol.

# Set $disable_TLS10R4 to true to disable the TLS1.0 protocol.



class apache::debian::new(

  $disable_TLS10 = false

  $disable_TLS10R4 = false

){

  # Note: the readlink executable comes from the coreutils package.

  exec { 'a2dissite 000-default.conf':

templates/etc/apache2/conf.d/ssl-strength.erb

+1 −1
Original line number Diff line number Diff line
@@ -4,7 +4,7 @@ 
# enabled and we don't want users to negotiate DES encryption or other

# weak encryption protocols.

<%

  if (@disable_TLS10) then

  if (@disable_TLS10R4) then

    TLS10 = ' -TLSv1'

    RC4   = '!RC4:'

-%>