modules/apache2/templates/puppet-config.erb

   1 <IfModule mod_ssl.c>
   2   SSLProtocol all -SSLv2 -SSLv3
   3   SSLHonorCipherOrder On
   4
   5   # this is a list that seems suitable as of 2014-10, when running wheezy.  It
   6   # probably requires re-visiting regularly.
   7   # 2017-07-02
   8   #  https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=apache-2.4.18&openssl=1.0.1p&hsts=no&profile=intermediate
   9   #  https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=apache-2.4.25&openssl=1.0.1p&hsts=no&profile=intermediate
  10   #  https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=apache-2.4.25&openssl=1.1.0&hsts=no&profile=intermediate
  11   SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
  12
  13   SSLUseStapling On
  14
  15   # the default size is 32k, but we make it 1M.
  16   # | If more than a few SSL certificates are used for the server
  17   # |
  18   # | OCSP responses are stored in the SSL stapling cache. While the
  19   # | responses are typically a few hundred to a few thousand bytes in size,
  20   # | mod_ssl supports OCSP responses up to around 10K bytes in size. With more
  21   # | than a few certificates, the stapling cache size (32768 bytes in the
  22   # | example above) may need to be increased. Error message AH01929 will be
  23   # | logged in case of an error storing a response.
  24   # [ https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html#ocspstapling ]
  25
  26   SSLStaplingCache shmcb:${APACHE_RUN_DIR}/ssl_stapling(1048576)
  27   SSLStaplingReturnResponderErrors off
  28   SSLStaplingResponderTimeout 5
  29   SSLStaplingFakeTryLater off
  30 </IfModule>
  31
  32 <IfModule mod_autoindex.c>
  33   IndexOptions SuppressDescription
  34 </IfModule>
  35
  36 BufferedLogs On