From b2a383c3f6d04206e8bae15f34022d691720d0c0 Mon Sep 17 00:00:00 2001 From: Peter Palfrader Date: Sun, 24 May 2015 09:45:18 +0200 Subject: [PATCH] Disable DH ciphersuites on wheezy --- modules/apache2/templates/puppet-config.erb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/modules/apache2/templates/puppet-config.erb b/modules/apache2/templates/puppet-config.erb index d754b1241..fca5a8b44 100644 --- a/modules/apache2/templates/puppet-config.erb +++ b/modules/apache2/templates/puppet-config.erb @@ -4,5 +4,9 @@ # this is a list that seems suitable as of 2014-10, when running wheezy. It # probably requires re-visiting regularly. - SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!eNULL:!LOW:!MD5:!EXP:!RC4:!SEED:!DSS + <% if @lsbmajdistrelease <= '7' -%> + SSLCipherSuite ECDH+AESGCM:ECDH+AES256:ECDH+AES128:ECDH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!eNULL:!LOW:!MD5:!EXP:!RC4:!SEED:!DSS + <% else -%> + SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!eNULL:!LOW:!MD5:!EXP:!RC4:!SEED:!DSS + <% end -%> -- 2.20.1