From a5debf58b36d40dc011e1d921875de86474c29e2 Mon Sep 17 00:00:00 2001
From: Arthur Lutz <arthur.lutz@logilab.fr>
Date: Fri, 17 Aug 2018 19:41:40 +0200
Subject: [PATCH] 207 configure ssl (#218)
* [ssl] [debian] manage ssl.conf with pillars
* [apache] make cyphersuite a list
* [apache/ssl] switch back to strings, lists merge is not good
---
apache/files/Debian/ssl.conf.jinja | 86 ++++++++++++++++++++++++++++++
apache/mod_ssl.sls | 8 +++
pillar.example | 6 +++
3 files changed, 100 insertions(+)
create mode 100644 apache/files/Debian/ssl.conf.jinja
diff --git a/apache/files/Debian/ssl.conf.jinja b/apache/files/Debian/ssl.conf.jinja
new file mode 100644
index 0000000..e31946d
--- /dev/null
+++ b/apache/files/Debian/ssl.conf.jinja
@@ -0,0 +1,86 @@
+<IfModule mod_ssl.c>
+
+ # Pseudo Random Number Generator (PRNG):
+ # Configure one or more sources to seed the PRNG of the SSL library.
+ # The seed data should be of good random quality.
+ # WARNING! On some platforms /dev/random blocks if not enough entropy
+ # is available. This means you then cannot use the /dev/random device
+ # because it would lead to very long connection times (as long as
+ # it requires to make more entropy available). But usually those
+ # platforms additionally provide a /dev/urandom device which doesn't
+ # block. So, if available, use this one instead. Read the mod_ssl User
+ # Manual for more details.
+ #
+ SSLRandomSeed startup builtin
+ SSLRandomSeed startup file:/dev/urandom 512
+ SSLRandomSeed connect builtin
+ SSLRandomSeed connect file:/dev/urandom 512
+
+ ##
+ ## SSL Global Context
+ ##
+ ## All SSL configuration in this context applies both to
+ ## the main server and all SSL-enabled virtual hosts.
+ ##
+
+ #
+ # Some MIME-types for downloading Certificates and CRLs
+ #
+ AddType application/x-x509-ca-cert .crt
+ AddType application/x-pkcs7-crl .crl
+
+ # Pass Phrase Dialog:
+ # Configure the pass phrase gathering process.
+ # The filtering dialog program (`builtin' is a internal
+ # terminal dialog) has to provide the pass phrase on stdout.
+ SSLPassPhraseDialog exec:/usr/share/apache2/ask-for-passphrase
+
+ # Inter-Process Session Cache:
+ # Configure the SSL Session Cache: First the mechanism
+ # to use and second the expiring timeout (in seconds).
+ # (The mechanism dbm has known memory leaks and should not be used).
+ #SSLSessionCache dbm:${APACHE_RUN_DIR}/ssl_scache
+ SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
+ SSLSessionCacheTimeout 300
+
+ # Semaphore:
+ # Configure the path to the mutual exclusion semaphore the
+ # SSL engine uses internally for inter-process synchronization.
+ # (Disabled by default, the global Mutex directive consolidates by default
+ # this)
+ #Mutex file:${APACHE_LOCK_DIR}/ssl_mutex ssl-cache
+
+
+ # SSL Cipher Suite:
+ # List the ciphers that the client is permitted to negotiate. See the
+ # ciphers(1) man page from the openssl package for list of all available
+ # options.
+ # Enable only secure ciphers:
+ {# default from https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29 #}
+ SSLCipherSuite {{ salt['pillar.get']('apache:ssl:SSLCipherSuite', 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS') }}
+
+ # SSL server cipher order preference:
+ # Use server priorities for cipher algorithm choice.
+ # Clients may prefer lower grade encryption. You should enable this
+ # option if you want to enforce stronger encryption, and can afford
+ # the CPU cost, and did not override SSLCipherSuite in a way that puts
+ # insecure ciphers first.
+ # Default: Off
+ SSLHonorCipherOrder {{ salt['pillar.get']('apache:ssl:SSLHonorCipherOrder', 'On') }}
+
+ # The protocols to enable.
+ # Available values: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2
+ # SSL v2 is no longer supported
+ SSLProtocol {{ salt['pillar.get']('apache:ssl:SSLProtocol', 'all -SSLv2 -SSLv3') }}
+
+ # Allow insecure renegotiation with clients which do not yet support the
+ # secure renegotiation protocol. Default: Off
+ #SSLInsecureRenegotiation on
+
+ # Whether to forbid non-SNI clients to access name based virtual hosts.
+ # Default: Off
+ #SSLStrictSNIVHostCheck On
+
+</IfModule>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
diff --git a/apache/mod_ssl.sls b/apache/mod_ssl.sls
index e11557d..45667f9 100644
--- a/apache/mod_ssl.sls
+++ b/apache/mod_ssl.sls
@@ -15,6 +15,14 @@ a2enmod mod_ssl:
- watch_in:
- module: apache-restart
+/etc/apache2/mods-available/ssl.conf:
+ file.managed:
+ - source: salt://apache/files/{{ salt['grains.get']('os_family') }}/ssl.conf.jinja
+ - template: jinja
+ - mode: 644
+ - watch_in:
+ - module: apache-restart
+
{% elif grains['os_family']=="RedHat" %}
mod_ssl:
diff --git a/pillar.example b/pillar.example
index 5eb5cf2..4bf2a51 100644
--- a/pillar.example
+++ b/pillar.example
@@ -300,6 +300,12 @@ apache:
# where Full conveys the most information, and Prod the least.
ServerTokens: Prod
+ # [debian only] configure mod_ssl
+ ssl:
+ SSLCipherSuite: 'HIGH:!aNULL'
+ SSLHonorCipherOrder: 'Off'
+ SSLProtocol: 'all -SSLv3'
+
# ``apache.mod_remoteip`` formula additional configuration:
mod_remoteip:
RemoteIPHeader: X-Forwarded-For
--
GitLab