diff options
| author | Martin Basti <mbasti@redhat.com> | 2016-03-03 17:39:34 +0100 |
|---|---|---|
| committer | Martin Basti <mbasti@redhat.com> | 2016-03-09 10:04:58 +0100 |
| commit | dd86f83c96961390f756e35496447d6aeae64df6 (patch) | |
| tree | cb743f6370eaa2534d2d505343a702f390cbfc3d | |
| parent | abe3abb46699428038cd77f13b814de69fd7d0a2 (diff) | |
| download | freeipa-dd86f83c96961390f756e35496447d6aeae64df6.tar.gz freeipa-dd86f83c96961390f756e35496447d6aeae64df6.tar.xz freeipa-dd86f83c96961390f756e35496447d6aeae64df6.zip | |
Configure 389ds with "default" cipher suite
nsSSLCiphers: "default" provides only secure ciphers that should be used when
connecting to DS
https://fedorahosted.org/freeipa/ticket/5684
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
| -rw-r--r-- | install/updates/20-sslciphers.update | 6 | ||||
| -rw-r--r-- | ipaserver/install/dsinstance.py | 4 |
2 files changed, 5 insertions, 5 deletions
diff --git a/install/updates/20-sslciphers.update b/install/updates/20-sslciphers.update index b0c952f49..978a44ba4 100644 --- a/install/updates/20-sslciphers.update +++ b/install/updates/20-sslciphers.update @@ -1,6 +1,6 @@ # change configured ciphers -# the result of this update will be that all ciphers -# provided by NSS which ar not weak will be enabled +# the result of this update will be that default ciphers +# provided by DS which are not weak will be enabled dn: cn=encryption,cn=config -only:nsSSL3Ciphers: +all +only:nsSSL3Ciphers: default addifnew:allowWeakCipher: off diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py index 0c54b01da..741dda91f 100644 --- a/ipaserver/install/dsinstance.py +++ b/ipaserver/install/dsinstance.py @@ -777,7 +777,7 @@ class DsInstance(service.Service): conn.do_simple_bind(DN(('cn', 'directory manager')), self.dm_password) mod = [(ldap.MOD_REPLACE, "nsSSLClientAuth", "allowed"), - (ldap.MOD_REPLACE, "nsSSL3Ciphers", "+all"), + (ldap.MOD_REPLACE, "nsSSL3Ciphers", "default"), (ldap.MOD_REPLACE, "allowWeakCipher", "off")] conn.modify_s(DN(('cn', 'encryption'), ('cn', 'config')), mod) @@ -1240,7 +1240,7 @@ class DsInstance(service.Service): conn.do_external_bind('root') mod = [(ldap.MOD_REPLACE, "nsSSLClientAuth", "allowed"), - (ldap.MOD_REPLACE, "nsSSL3Ciphers", "+all"), + (ldap.MOD_REPLACE, "nsSSL3Ciphers", "default"), (ldap.MOD_REPLACE, "allowWeakCipher", "off")] conn.modify_s(DN(('cn', 'encryption'), ('cn', 'config')), mod) |