]> git.donarmstrong.com Git - dsa-puppet.git/commitdiff
Disable DH ciphersuites on wheezy
authorPeter Palfrader <peter@palfrader.org>
Sun, 24 May 2015 07:45:18 +0000 (09:45 +0200)
committerPeter Palfrader <peter@palfrader.org>
Sun, 24 May 2015 07:45:29 +0000 (09:45 +0200)
modules/apache2/templates/puppet-config.erb

index d754b1241608cc3a4b9e7b1e60e5601f4a6c1e19..fca5a8b4428a160fa86b1d7d2946137f188d433f 100644 (file)
@@ -4,5 +4,9 @@
 
   # this is a list that seems suitable as of 2014-10, when running wheezy.  It
   # probably requires re-visiting regularly.
-  SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!eNULL:!LOW:!MD5:!EXP:!RC4:!SEED:!DSS
+  <% if @lsbmajdistrelease <= '7' -%>
+    SSLCipherSuite ECDH+AESGCM:ECDH+AES256:ECDH+AES128:ECDH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!eNULL:!LOW:!MD5:!EXP:!RC4:!SEED:!DSS
+  <% else -%>
+    SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!eNULL:!LOW:!MD5:!EXP:!RC4:!SEED:!DSS
+  <% end -%>
 </IfModule>