Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

Unify all ssl cipher suite configurations

Browse source 
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
This commit is contained in:
Patrick Uiterwijk 2016-08-30 19:36:53 +00:00
parent 215c38198e
commit f1dd7a7432
34 changed files with 69 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

5
files/httpd/newvirtualhost.conf.j2
View file

@ -15,13 +15,12 @@
# SSL Protocol support: # SSL Protocol support:
# List the enable protocol levels with which clients will be able to # List the enable protocol levels with which clients will be able to
# connect. Disable SSLv2 access by default: # connect. Disable SSLv2 access by default:
SSLProtocol all -SSLv2 SSLProtocol {{ ssl_protocols }}
# SSL Cipher Suite: # SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate. # List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list. # See the mod_ssl documentation for a complete list.
#SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW SSLCipherSuite {{ ssl_ciphers }}
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
# Server Certificate: # Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate. If # Point SSLCertificateFile at a PEM encoded certificate. If

4
files/lists-dev/apache.conf.j2
View file

@ -11,7 +11,7 @@
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
#SSLCertificateChainFile /etc/pki/tls/cert.pem #SSLCertificateChainFile /etc/pki/tls/cert.pem
SSLHonorCipherOrder On SSLHonorCipherOrder On
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK SSLCipherSuite {{ ssl_ciphers }}
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2 SSLProtocol {{ ssl_protocols }}
</VirtualHost> </VirtualHost>

2
roles/batcave/tasks/main.yml
View file

@ -252,7 +252,7 @@
- httpd - httpd
- name: install web server config for batcave (main config) - name: install web server config for batcave (main config)
copy: src=infrastructure.fedoraproject.org.conf dest=/etc/httpd/conf.d/infrastructure.fedoraproject.org.conf mode=0644 template: src=infrastructure.fedoraproject.org.conf.j2 dest=/etc/httpd/conf.d/infrastructure.fedoraproject.org.conf mode=0644
tags: tags:
- batcave - batcave
- config - config

4
roles/batcave/files/infrastructure.fedoraproject.org.conf → roles/batcave/templates/infrastructure.fedoraproject.org.conf.j2
View file

@ -121,8 +121,8 @@ ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
# https://fedorahosted.org/fedora-infrastructure/ticket/4101#comment:14 # https://fedorahosted.org/fedora-infrastructure/ticket/4101#comment:14
# If you change the protocols or cipher suites, you should probably update # If you change the protocols or cipher suites, you should probably update
# modules/squid/files/squid.conf-el6 too, to keep it in sync. # modules/squid/files/squid.conf-el6 too, to keep it in sync.
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2 SSLProtocol {{ ssl_protocols }}
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK SSLCipherSuite {{ ssl_ciphers }}
# robots location # robots location
Alias /robots.txt /srv/web/robots.txt.lockbox01 Alias /robots.txt /srv/web/robots.txt.lockbox01

2
roles/copr/frontend/tasks/main.yml
View file

@ -44,7 +44,7 @@
- config - config
- name: install copr-frontend ssl vhost for production - name: install copr-frontend ssl vhost for production
copy: src="httpd/coprs_ssl.conf" dest="/etc/httpd/conf.d/copr_ssl.conf" template: src="httpd/coprs_ssl.conf.j2" dest="/etc/httpd/conf.d/copr_ssl.conf"
when: not devel when: not devel
tags: tags:
- config - config

8
roles/copr/frontend/files/httpd/coprs_ssl.conf → roles/copr/frontend/templates/httpd/coprs_ssl.conf
View file

@ -1,8 +1,8 @@
<VirtualHost *:443> <VirtualHost *:443>
SSLEngine on SSLEngine on
SSLProtocol all -SSLv2 -SSLv3 SSLProtocol {{ ssl_protocols }}
# Use secure TLSv1.1 and TLSv1.2 ciphers # Use secure TLSv1.1 and TLSv1.2 ciphers
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:RC4-SHA:AES128-SHA:HIGH:!aNULL:!MD5 SSLCipherSuite {{ ssl_ciphers }}
SSLHonorCipherOrder on SSLHonorCipherOrder on
Header always add Strict-Transport-Security "max-age=15768000; preload" Header always add Strict-Transport-Security "max-age=15768000; preload"
@ -44,9 +44,9 @@
<VirtualHost *:443> <VirtualHost *:443>
SSLEngine on SSLEngine on
SSLProtocol all -SSLv2 -SSLv3 SSLProtocol {{ ssl_protocols }}
# Use secure TLSv1.1 and TLSv1.2 ciphers # Use secure TLSv1.1 and TLSv1.2 ciphers
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:RC4-SHA:AES128-SHA:HIGH:!aNULL:!MD5 SSLCipherSuite {{ ssl_ciphers }}
SSLHonorCipherOrder on SSLHonorCipherOrder on
Header always add Strict-Transport-Security "max-age=15768000; preload" Header always add Strict-Transport-Security "max-age=15768000; preload"

2
roles/distgit/tasks/main.yml
View file

@ -274,7 +274,7 @@
# -- Lookaside Cache ------------------------------------- # -- Lookaside Cache -------------------------------------
# This is the annex to Dist Git, where we host source tarballs. # This is the annex to Dist Git, where we host source tarballs.
- name: install the Lookaside Cache httpd configs - name: install the Lookaside Cache httpd configs
copy: src={{item}} dest=/etc/httpd/conf.d/pkgs.fedoraproject.org/{{item}} template: src={{item}} dest=/etc/httpd/conf.d/pkgs.fedoraproject.org/{{item}}
with_items: with_items:
- lookaside.conf - lookaside.conf
- lookaside-upload.conf - lookaside-upload.conf

3
roles/distgit/files/lookaside-upload.conf → roles/distgit/templates/lookaside-upload.conf
View file

@ -28,7 +28,8 @@ SSLCryptoDevice builtin
SSLCACertificateFile conf/cacert.pem SSLCACertificateFile conf/cacert.pem
SSLCARevocationFile /etc/pki/tls/crl.pem SSLCARevocationFile /etc/pki/tls/crl.pem
SSLCipherSuite RSA:!EXPORT:!DH:!LOW:!NULL:+MEDIUM:+HIGH SSLProtocol {{ ssl_protocols }}
SSLCipherSuite {{ ssl_ciphers }}
# Must be 'optional' everywhere in order to have POST operations work to upload.cgi # Must be 'optional' everywhere in order to have POST operations work to upload.cgi
SSLVerifyClient optional SSLVerifyClient optional

0
roles/distgit/files/lookaside.conf → roles/distgit/templates/lookaside.conf
View file

2
roles/download/tasks/main.yml
View file

@ -68,7 +68,7 @@
copy: src="{{private}}/files/httpd/wildcard-2014.fedoraproject.org.intermediate.cert" dest=/etc/pki/tls/certs/wildcard-2014.fedoraproject.org.intermediate.cert owner=root group=root mode=0644 copy: src="{{private}}/files/httpd/wildcard-2014.fedoraproject.org.intermediate.cert" dest=/etc/pki/tls/certs/wildcard-2014.fedoraproject.org.intermediate.cert owner=root group=root mode=0644
- name: Configure httpd dl main conf - name: Configure httpd dl main conf
copy: src=httpd/dl.fedoraproject.org.conf dest=/etc/httpd/conf.d/dl.fedoraproject.org.conf template: src=httpd/dl.fedoraproject.org.conf dest=/etc/httpd/conf.d/dl.fedoraproject.org.conf
notify: notify:
- reload httpd - reload httpd

4
roles/download/files/httpd/dl.fedoraproject.org.conf → roles/download/templates/httpd/dl.fedoraproject.org.conf
View file

@ -24,8 +24,8 @@
# If you change the protocols or cipher suites, you should probably update # If you change the protocols or cipher suites, you should probably update
# modules/squid/files/squid.conf-el6 too, to keep it in sync. # modules/squid/files/squid.conf-el6 too, to keep it in sync.
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2 SSLProtocol {{ ssl_protocols }}
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK SSLCipherSuite {{ ssl_ciphers }}
Include "conf.d/dl.fedoraproject.org/*.conf" Include "conf.d/dl.fedoraproject.org/*.conf"
</VirtualHost> </VirtualHost>

4
roles/graphite/grafana/templates/grafana.conf
View file

@ -19,8 +19,8 @@
SSLCertificateKeyFile /etc/letsencrypt/live/grafana.cloud.fedoraproject.org/privkey.pem SSLCertificateKeyFile /etc/letsencrypt/live/grafana.cloud.fedoraproject.org/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/grafana.cloud.fedoraproject.org/fullchain.pem SSLCertificateChainFile /etc/letsencrypt/live/grafana.cloud.fedoraproject.org/fullchain.pem
SSLHonorCipherOrder On SSLHonorCipherOrder On
SSLCipherSuite RC4-SHA:AES128-SHA:ALL:!ADH:!EXP:!LOW:!MD5:!SSLV2:!NULL SSLCipherSuite {{ ssl_ciphers }}
SSLProtocol ALL -SSLv2 SSLProtocol {{ ssl_protocols }}
ProxyPass / http://localhost:3000/ ProxyPass / http://localhost:3000/
ProxyPassReverse / http://localhost:3000/ ProxyPassReverse / http://localhost:3000/

4
roles/graphite/graphite/templates/graphite-web.conf
View file

@ -37,8 +37,8 @@
SSLCertificateKeyFile /etc/letsencrypt/live/graphite.cloud.fedoraproject.org/privkey.pem SSLCertificateKeyFile /etc/letsencrypt/live/graphite.cloud.fedoraproject.org/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/graphite.cloud.fedoraproject.org/fullchain.pem SSLCertificateChainFile /etc/letsencrypt/live/graphite.cloud.fedoraproject.org/fullchain.pem
SSLHonorCipherOrder On SSLHonorCipherOrder On
SSLCipherSuite RC4-SHA:AES128-SHA:ALL:!ADH:!EXP:!LOW:!MD5:!SSLV2:!NULL SSLCipherSuite {{ ssl_ciphers }}
SSLProtocol ALL -SSLv2 SSLProtocol {{ ssl_protocols }}
ProxyPass / http://graphite.cloud.fedoraproject.org/ ProxyPass / http://graphite.cloud.fedoraproject.org/
ProxyPassReverse / http://graphite.cloud.fedoraproject.org/ ProxyPassReverse / http://graphite.cloud.fedoraproject.org/

4
roles/httpd/templates/website.conf.j2
View file

@ -42,8 +42,8 @@
# https://fedorahosted.org/fedora-infrastructure/ticket/4101#comment:14 # https://fedorahosted.org/fedora-infrastructure/ticket/4101#comment:14
# If you change the protocols or cipher suites, you should probably update # If you change the protocols or cipher suites, you should probably update
# modules/squid/files/squid.conf-el6 too, to keep it in sync. # modules/squid/files/squid.conf-el6 too, to keep it in sync.
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2 SSLProtocol {{ ssl_protocols }}
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK SSLCipherSuite {{ ssl_ciphers }}
Include "conf.d/{{ name }}/*.conf" Include "conf.d/{{ name }}/*.conf"
</VirtualHost> </VirtualHost>

4
roles/httpd/website/templates/website.conf
View file

@ -42,8 +42,8 @@
# https://fedorahosted.org/fedora-infrastructure/ticket/4101#comment:14 # https://fedorahosted.org/fedora-infrastructure/ticket/4101#comment:14
# If you change the protocols or cipher suites, you should probably update # If you change the protocols or cipher suites, you should probably update
# modules/squid/files/squid.conf-el6 too, to keep it in sync. # modules/squid/files/squid.conf-el6 too, to keep it in sync.
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2 SSLProtocol {{ ssl_protocols }}
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK SSLCipherSuite {{ ssl_ciphers }}
{% if sslonly %} {% if sslonly %}
Header always add Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" Header always add Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"

2
roles/infinote/tasks/main.yml
View file

@ -21,7 +21,7 @@
- config - config
- name: Setup basic apache config - name: Setup basic apache config
copy: src=infinote.fedoraproject.org.conf dest=/etc/httpd/conf.d/infinote.fedoraproject.org.conf template: src=infinote.fedoraproject.org.conf dest=/etc/httpd/conf.d/infinote.fedoraproject.org.conf
tags: tags:
- infinote - infinote
- config - config

4
roles/infinote/files/infinote.fedoraproject.org.conf → roles/infinote/templates/infinote.fedoraproject.org.conf
View file

@ -82,8 +82,8 @@ ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
# https://fedorahosted.org/fedora-infrastructure/ticket/4101#comment:14 # https://fedorahosted.org/fedora-infrastructure/ticket/4101#comment:14
# If you change the protocols or cipher suites, you should probably update # If you change the protocols or cipher suites, you should probably update
# modules/squid/files/squid.conf-el6 too, to keep it in sync. # modules/squid/files/squid.conf-el6 too, to keep it in sync.
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2 SSLProtocol {{ ssl_protocols }}
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK SSLCipherSuite {{ ssl_ciphers }}
# robots location # robots location
Alias /robots.txt /srv/web/robots.txt.lockbox01 Alias /robots.txt /srv/web/robots.txt.lockbox01

4
roles/keyserver/tasks/main.yml
View file

@ -43,12 +43,12 @@
- config - config
- name: /etc/httpd/conf.d/sks.conf - name: /etc/httpd/conf.d/sks.conf
copy: src="sks.conf" dest=/etc/httpd/conf.d/sks.conf owner=root group=root mode=0644 template: src="sks.conf" dest=/etc/httpd/conf.d/sks.conf owner=root group=root mode=0644
tags: tags:
- config - config
- name: /etc/httpd/conf.d/ssl.conf - name: /etc/httpd/conf.d/ssl.conf
copy: src="ssl.conf" dest=/etc/httpd/conf.d/ssl.conf owner=root group=root mode=0644 template: src="ssl.conf" dest=/etc/httpd/conf.d/ssl.conf owner=root group=root mode=0644
tags: tags:
- config - config

8
roles/keyserver/files/sks.conf → roles/keyserver/templates/sks.conf
View file

@ -56,8 +56,8 @@ NameVirtualHost *:443
SSLCertificateFile /etc/pki/tls/wildcard-2014.fedoraproject.org.cert SSLCertificateFile /etc/pki/tls/wildcard-2014.fedoraproject.org.cert
SSLCertificateChainFile /etc/pki/tls/wildcard-2014.fedoraproject.org.intermediate.cert SSLCertificateChainFile /etc/pki/tls/wildcard-2014.fedoraproject.org.intermediate.cert
SSLCertificateKeyFile /etc/pki/tls/wildcard-2014.fedoraproject.org.key SSLCertificateKeyFile /etc/pki/tls/wildcard-2014.fedoraproject.org.key
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2 SSLProtocol {{ ssl_protocols }}
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK SSLCipherSuite {{ ssl_ciphers }}
ProxyPass / http://localhost:11371/ ProxyPass / http://localhost:11371/
ProxyPassReverse / http://localhost:11371/ ProxyPassReverse / http://localhost:11371/
@ -73,8 +73,8 @@ NameVirtualHost *:443
SSLEngine on SSLEngine on
SSLCertificateFile /etc/pki/tls/keys_fedoraproject_org.crt.pem SSLCertificateFile /etc/pki/tls/keys_fedoraproject_org.crt.pem
SSLCertificateKeyFile /etc/pki/tls/keys_fedoraproject_org.key SSLCertificateKeyFile /etc/pki/tls/keys_fedoraproject_org.key
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2 SSLProtocol {{ ssl_protocols }}
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK SSLCipherSuite {{ ssl_ciphers }}
ProxyPass / http://localhost:11371/ ProxyPass / http://localhost:11371/
ProxyPassReverse / http://localhost:11371/ ProxyPassReverse / http://localhost:11371/

4
roles/keyserver/files/ssl.conf → roles/keyserver/templates/ssl.conf
View file

@ -92,12 +92,12 @@ SSLEngine on
# SSL Protocol support: # SSL Protocol support:
# List the enable protocol levels with which clients will be able to # List the enable protocol levels with which clients will be able to
# connect. Disable SSLv2 access by default: # connect. Disable SSLv2 access by default:
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2 SSLProtocol {{ ssl_protocols }}
# SSL Cipher Suite: # SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate. # List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list. # See the mod_ssl documentation for a complete list.
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK SSLCipherSuite {{ ssl_ciphers }}
# Server Certificate: # Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate. If # Point SSLCertificateFile at a PEM encoded certificate. If

4
roles/koji_hub/tasks/main.yml
View file

@ -297,7 +297,7 @@
when: env == "staging" when: env == "staging"
- name: koji staging ssl config - name: koji staging ssl config
copy: src=koji-ssl.conf.stg dest=/etc/httpd/conf.d/ssl.conf template: src=koji-ssl.conf.stg dest=/etc/httpd/conf.d/ssl.conf
tags: tags:
- config - config
- koji_hub - koji_hub
@ -305,7 +305,7 @@
when: env == "staging" when: env == "staging"
- name: koji ssl config - name: koji ssl config
copy: src=koji-ssl.conf dest=/etc/httpd/conf.d/ssl.conf template: src=koji-ssl.conf dest=/etc/httpd/conf.d/ssl.conf
tags: tags:
- config - config
- koji_hub - koji_hub

4
roles/koji_hub/files/koji-ssl.conf → roles/koji_hub/templates/koji-ssl.conf
View file

@ -72,12 +72,12 @@ SSLEngine on
# SSL Protocol support: # SSL Protocol support:
# List the enable protocol levels with which clients will be able to # List the enable protocol levels with which clients will be able to
# connect. Disable SSLv2 access by default: # connect. Disable SSLv2 access by default:
SSLProtocol all -SSLv2 SSLProtocol {{ ssl_protocols }}
# SSL Cipher Suite: # SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate. # List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list. # See the mod_ssl documentation for a complete list.
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5 SSLCipherSuite {{ ssl_ciphers }}
# Speed-optimized SSL Cipher configuration: # Speed-optimized SSL Cipher configuration:
# If speed is your main concern (on busy HTTPS servers e.g.), # If speed is your main concern (on busy HTTPS servers e.g.),

4
roles/koji_hub/files/koji-ssl.conf.arm → roles/koji_hub/templates/koji-ssl.conf.arm
View file

@ -72,12 +72,12 @@ SSLEngine on
# SSL Protocol support: # SSL Protocol support:
# List the enable protocol levels with which clients will be able to # List the enable protocol levels with which clients will be able to
# connect. Disable SSLv2 access by default: # connect. Disable SSLv2 access by default:
SSLProtocol all -SSLv2 SSLProtocol {{ ssl_protocols }}
# SSL Cipher Suite: # SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate. # List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list. # See the mod_ssl documentation for a complete list.
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5 SSLCipherSuite {{ ssl_ciphers }}
# Speed-optimized SSL Cipher configuration: # Speed-optimized SSL Cipher configuration:
# If speed is your main concern (on busy HTTPS servers e.g.), # If speed is your main concern (on busy HTTPS servers e.g.),

4
roles/koji_hub/files/koji-ssl.conf.ppc → roles/koji_hub/templates/koji-ssl.conf.ppc
View file

@ -72,12 +72,12 @@ SSLEngine on
# SSL Protocol support: # SSL Protocol support:
# List the enable protocol levels with which clients will be able to # List the enable protocol levels with which clients will be able to
# connect. Disable SSLv2 access by default: # connect. Disable SSLv2 access by default:
SSLProtocol all -SSLv2 SSLProtocol {{ ssl_protocols }}
# SSL Cipher Suite: # SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate. # List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list. # See the mod_ssl documentation for a complete list.
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5 SSLCipherSuite {{ ssl_ciphers }}
# Speed-optimized SSL Cipher configuration: # Speed-optimized SSL Cipher configuration:
# If speed is your main concern (on busy HTTPS servers e.g.), # If speed is your main concern (on busy HTTPS servers e.g.),

4
roles/koji_hub/files/koji-ssl.conf.s390 → roles/koji_hub/templates/koji-ssl.conf.s390
View file

@ -72,12 +72,12 @@ SSLEngine on
# SSL Protocol support: # SSL Protocol support:
# List the enable protocol levels with which clients will be able to # List the enable protocol levels with which clients will be able to
# connect. Disable SSLv2 access by default: # connect. Disable SSLv2 access by default:
SSLProtocol all -SSLv2 SSLProtocol {{ ssl_protocols }}
# SSL Cipher Suite: # SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate. # List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list. # See the mod_ssl documentation for a complete list.
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5 SSLCipherSuite {{ ssl_ciphers }}
# Speed-optimized SSL Cipher configuration: # Speed-optimized SSL Cipher configuration:
# If speed is your main concern (on busy HTTPS servers e.g.), # If speed is your main concern (on busy HTTPS servers e.g.),

7
roles/koji_hub/files/koji-ssl.conf.stg → roles/koji_hub/templates/koji-ssl.conf.stg
View file

@ -72,12 +72,12 @@ SSLEngine on
# SSL Protocol support: # SSL Protocol support:
# List the enable protocol levels with which clients will be able to # List the enable protocol levels with which clients will be able to
# connect. Disable SSLv2 access by default: # connect. Disable SSLv2 access by default:
SSLProtocol all -SSLv2 SSLProtocol {{ ssl_protocols }}
# SSL Cipher Suite: # SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate. # List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list. # See the mod_ssl documentation for a complete list.
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5 SSLCipherSuite {{ ssl_ciphers }}
# Speed-optimized SSL Cipher configuration: # Speed-optimized SSL Cipher configuration:
# If speed is your main concern (on busy HTTPS servers e.g.), # If speed is your main concern (on busy HTTPS servers e.g.),
@ -89,8 +89,7 @@ SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
# have perfect forward secrecy - if the server's key is # have perfect forward secrecy - if the server's key is
# compromised, captures of past or future traffic must be # compromised, captures of past or future traffic must be
# considered compromised, too. # considered compromised, too.
#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5 SSLHonorCipherOrder on
#SSLHonorCipherOrder on
# Server Certificate: # Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate. If # Point SSLCertificateFile at a PEM encoded certificate. If

6
roles/people/tasks/main.yml
View file

@ -20,11 +20,15 @@
- packages - packages
- people - people
- name: install main httpd config
template: src=people.conf dest=/etc/httpd/conf.d/people.conf
tags:
- people
- name: install httpd config - name: install httpd config
copy: src={{item}} dest=/etc/httpd/conf.d/{{item}} copy: src={{item}} dest=/etc/httpd/conf.d/{{item}}
with_items: with_items:
- cgit.conf - cgit.conf
- people.conf
- ssl.conf - ssl.conf
- userdir.conf - userdir.conf
tags: tags:

4
roles/people/files/people.conf → roles/people/templates/people.conf
View file

@ -31,8 +31,8 @@ NameVirtualHost *:80
SSLCertificateKeyFile /etc/pki/tls/private/wildcard-2014.fedorapeople.org.key SSLCertificateKeyFile /etc/pki/tls/private/wildcard-2014.fedorapeople.org.key
SSLCertificateChainFile /etc/pki/tls/certs/wildcard-2014.fedorapeople.org.intermediate.cert SSLCertificateChainFile /etc/pki/tls/certs/wildcard-2014.fedorapeople.org.intermediate.cert
SSLHonorCipherOrder On SSLHonorCipherOrder On
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA SSLCipherSuite {{ ssl_ciphers }}
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2 SSLProtocol {{ ssl_protocols }}
Header always add Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" Header always add Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"

5
roles/phabricator/templates/phabricator.conf.j2
View file

@ -16,13 +16,12 @@
# SSL Protocol support: # SSL Protocol support:
# List the enable protocol levels with which clients will be able to # List the enable protocol levels with which clients will be able to
# connect. Disable SSLv2 access by default: # connect. Disable SSLv2 access by default:
SSLProtocol all -SSLv2 SSLProtocol {{ ssl_protocols }}
# SSL Cipher Suite: # SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate. # List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list. # See the mod_ssl documentation for a complete list.
#SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW SSLCipherSuite {{ ssl_ciphers }}
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
# Server Certificate: # Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate. If # Point SSLCertificateFile at a PEM encoded certificate. If

2
roles/planet/tasks/main.yml
View file

@ -30,7 +30,7 @@
- planet_server - planet_server
- name: copy the planet http config file - name: copy the planet http config file
copy: src=planet.conf dest=/etc/httpd/conf.d/planet.conf template: src=planet.conf dest=/etc/httpd/conf.d/planet.conf
tags: tags:
- planet_server - planet_server

4
roles/planet/files/planet.conf → roles/planet/templates/planet.conf
View file

@ -65,8 +65,8 @@
SSLCertificateKeyFile /etc/pki/tls/private/planet.fedoraproject.org.key SSLCertificateKeyFile /etc/pki/tls/private/planet.fedoraproject.org.key
SSLCertificateChainFile /etc/pki/tls/certs/wildcard-2014.fedorapeople.org.intermediate.cert SSLCertificateChainFile /etc/pki/tls/certs/wildcard-2014.fedorapeople.org.intermediate.cert
SSLHonorCipherOrder On SSLHonorCipherOrder On
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK SSLProtocol {{ ssl_protocols }}
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2 SSLCipherSuite {{ ssl_ciphers }}
DocumentRoot "/srv/planet/site/" DocumentRoot "/srv/planet/site/"

4
roles/taskotron/ssl-taskotron/templates/ssl.conf.j2
View file

@ -76,12 +76,12 @@ SSLEngine on
# SSL Protocol support: # SSL Protocol support:
# List the enable protocol levels with which clients will be able to # List the enable protocol levels with which clients will be able to
# connect. Disable SSLv2 access by default: # connect. Disable SSLv2 access by default:
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2 SSLProtocol {{ ssl_protocols }}
# SSL Cipher Suite: # SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate. # List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list. # See the mod_ssl documentation for a complete list.
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5 SSLCipherSuite {{ ssl_ciphers }}
# Speed-optimized SSL Cipher configuration: # Speed-optimized SSL Cipher configuration:
# If speed is your main concern (on busy HTTPS servers e.g.), # If speed is your main concern (on busy HTTPS servers e.g.),

4
roles/taskotron/ssl-taskotron/templates/ssl.conf.rhel.j2
View file

@ -92,12 +92,12 @@ SSLEngine on
# SSL Protocol support: # SSL Protocol support:
# List the enable protocol levels with which clients will be able to # List the enable protocol levels with which clients will be able to
# connect. Disable SSLv2 access by default: # connect. Disable SSLv2 access by default:
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2 SSLProtocol {{ ssl_protocols }}
# SSL Cipher Suite: # SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate. # List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list. # See the mod_ssl documentation for a complete list.
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW SSLCipherSuite {{ ssl_ciphers }}
# Server Certificate: # Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate. If # Point SSLCertificateFile at a PEM encoded certificate. If

3
vars/global.yml
View file

@ -46,6 +46,9 @@ centos66_x86_64: CentOS-6-x86_64-GenericCloud-20141129_01
rhel70_x86_64: rhel-guest-image-7.0-20140930.0.x86_64 rhel70_x86_64: rhel-guest-image-7.0-20140930.0.x86_64
rhel66_x86_64: rhel-guest-image-6.6-20141222.0.x86_64 rhel66_x86_64: rhel-guest-image-6.6-20141222.0.x86_64
ssl_protocols: "-All +TLSv1 +TLSv1.1 +TLSv1.2"
ssl_ciphers: "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK"
# Set a default hostname base to transient. Override in host vars or command line. # Set a default hostname base to transient. Override in host vars or command line.
hostbase: transient hostbase: transient
global_pkgs_inst: ['bind-utils', 'mailx', 'nc', 'openssh-clients', global_pkgs_inst: ['bind-utils', 'mailx', 'nc', 'openssh-clients',