Diederik has uploaded a new change for review.
https://gerrit.wikimedia.org/r/111969
Change subject: Enabling TLSv1.1 and TLSv1.2 on misc Apache services
......................................................................
Enabling TLSv1.1 and TLSv1.2 on misc Apache services
see also RT 2517
Change-Id: Ia9058d2df5543ae0a6cb59737613127af412ec2e
---
M modules/apache/templates/vhost-proxy.conf.erb
M modules/bugzilla/templates/apache/bugzilla.wikimedia.org.erb
M modules/gitblit/templates/git.wikimedia.org.erb
M modules/ishmael/templates/apache/ishmael.wikimedia.org.erb
M templates/apache/generic_vhost.erb
M templates/apache/sites/etherpad_lite.wikimedia.org.erb
M templates/apache/sites/ganglia.wikimedia.org.erb
M templates/apache/sites/gerrit.wikimedia.org.erb
M templates/apache/sites/icinga.wikimedia.org.erb
M templates/apache/sites/planet-language.erb
M templates/apache/sites/planet.erb
M templates/apache/sites/racktables.wikimedia.org.erb
M templates/apache/sites/smokeping.wikimedia.org.erb
M templates/apache/sites/stats.wikimedia.org.erb
M templates/apache/sites/wikistats.erb
M templates/apache/sites/wikitech.wikimedia.org.erb
16 files changed, 19 insertions(+), 19 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/69/111969/1
diff --git a/modules/apache/templates/vhost-proxy.conf.erb
b/modules/apache/templates/vhost-proxy.conf.erb
index 437ebe6..93d3546 100644
--- a/modules/apache/templates/vhost-proxy.conf.erb
+++ b/modules/apache/templates/vhost-proxy.conf.erb
@@ -2,7 +2,7 @@
<VirtualHost <%= vhost_name %>:<%= port %>>
<% if ssl == true %>
SSLEngine on
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile <%= ssl_path %>/certs/pl.cert
diff --git a/modules/bugzilla/templates/apache/bugzilla.wikimedia.org.erb
b/modules/bugzilla/templates/apache/bugzilla.wikimedia.org.erb
index 43e43ae..a8d3930 100644
--- a/modules/bugzilla/templates/apache/bugzilla.wikimedia.org.erb
+++ b/modules/bugzilla/templates/apache/bugzilla.wikimedia.org.erb
@@ -49,7 +49,7 @@
ServerName bugs.wikimedia.org
Redirect permanent / https://<%=
scope.lookupvar('bugzilla::apache::svc_name') %>/
SSLEngine On
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile /etc/ssl/certs/<%=
scope.lookupvar('bugzilla::apache::svc_name') %>.pem
@@ -65,7 +65,7 @@
ServerName <%= scope.lookupvar('bugzilla::apache::svc_name') %>
DocumentRoot <%= scope.lookupvar('bugzilla::apache::docroot') %>
SSLEngine On
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile /etc/ssl/certs/<%=
scope.lookupvar('bugzilla::apache::svc_name') %>.pem
@@ -178,7 +178,7 @@
ServerName <%= scope.lookupvar('bugzilla::apache::attach_svc_name') %>
DocumentRoot <%= scope.lookupvar('bugzilla::apache::docroot') %>
SSLEngine On
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile /etc/ssl/certs/<%=
scope.lookupvar('bugzilla::apache::attach_svc_name') %>.pem
diff --git a/modules/gitblit/templates/git.wikimedia.org.erb
b/modules/gitblit/templates/git.wikimedia.org.erb
index db76fe5..098677a 100644
--- a/modules/gitblit/templates/git.wikimedia.org.erb
+++ b/modules/gitblit/templates/git.wikimedia.org.erb
@@ -44,7 +44,7 @@
ServerName <%= host %>
SSLEngine on
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile /etc/ssl/certs/<%= ssl_cert %>.pem
diff --git a/modules/ishmael/templates/apache/ishmael.wikimedia.org.erb
b/modules/ishmael/templates/apache/ishmael.wikimedia.org.erb
index 795736a..7bdc5d0 100644
--- a/modules/ishmael/templates/apache/ishmael.wikimedia.org.erb
+++ b/modules/ishmael/templates/apache/ishmael.wikimedia.org.erb
@@ -7,7 +7,7 @@
<VirtualHost *:443>
ServerName <%= @site_name %>
SSLEngine On
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile /etc/ssl/private/star.wikimedia.org.pem
diff --git a/templates/apache/generic_vhost.erb
b/templates/apache/generic_vhost.erb
index f70cd45..bdc889a 100644
--- a/templates/apache/generic_vhost.erb
+++ b/templates/apache/generic_vhost.erb
@@ -58,7 +58,7 @@
ServerAdmin <%= server_admin %>
SSLEngine on
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile <%= certfile %>
diff --git a/templates/apache/sites/etherpad_lite.wikimedia.org.erb
b/templates/apache/sites/etherpad_lite.wikimedia.org.erb
index 477f88f..0eae93a 100644
--- a/templates/apache/sites/etherpad_lite.wikimedia.org.erb
+++ b/templates/apache/sites/etherpad_lite.wikimedia.org.erb
@@ -56,7 +56,7 @@
<% end -%>
SSLEngine on
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile <%= etherpad_ssl_cert %>
diff --git a/templates/apache/sites/ganglia.wikimedia.org.erb
b/templates/apache/sites/ganglia.wikimedia.org.erb
index 9c9c22a..734b4e7 100644
--- a/templates/apache/sites/ganglia.wikimedia.org.erb
+++ b/templates/apache/sites/ganglia.wikimedia.org.erb
@@ -26,7 +26,7 @@
ServerAdmin [email protected]
SSLEngine on
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile <%= ganglia_ssl_cert %>
diff --git a/templates/apache/sites/gerrit.wikimedia.org.erb
b/templates/apache/sites/gerrit.wikimedia.org.erb
index 5cfafac..46ca824 100644
--- a/templates/apache/sites/gerrit.wikimedia.org.erb
+++ b/templates/apache/sites/gerrit.wikimedia.org.erb
@@ -47,7 +47,7 @@
ServerName <%= host %>
SSLEngine on
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile /etc/ssl/certs/<%= ssl_cert %>.pem
diff --git a/templates/apache/sites/icinga.wikimedia.org.erb
b/templates/apache/sites/icinga.wikimedia.org.erb
index 7dcfd53..c711afc 100644
--- a/templates/apache/sites/icinga.wikimedia.org.erb
+++ b/templates/apache/sites/icinga.wikimedia.org.erb
@@ -20,7 +20,7 @@
ServerAlias neon.wikimedia.org
ServerAdmin [email protected]
SSLEngine On
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile /etc/ssl/private/icinga.wikimedia.org.pem
@@ -70,7 +70,7 @@
<VirtualHost *:443>
ServerName icinga-admin.wikimedia.org
SSLEngine On
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile /etc/ssl/private/star.wikimedia.org.pem
diff --git a/templates/apache/sites/planet-language.erb
b/templates/apache/sites/planet-language.erb
index 6ae5477..45090f1 100644
--- a/templates/apache/sites/planet-language.erb
+++ b/templates/apache/sites/planet-language.erb
@@ -15,7 +15,7 @@
ServerName <%= @name %>.planet.<%=
scope.lookupvar('misc::planet-venus::planet_domain_name') %>
SSLEngine on
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile /etc/ssl/certs/star.planet.<%=
scope.lookupvar('misc::planet-venus::planet_domain_name') %>.pem
diff --git a/templates/apache/sites/planet.erb
b/templates/apache/sites/planet.erb
index e2b4d50..c06d3fb 100644
--- a/templates/apache/sites/planet.erb
+++ b/templates/apache/sites/planet.erb
@@ -4,7 +4,7 @@
<VirtualHost *:443>
ServerName planet.<%=
scope.lookupvar('misc::planet-venus::planet_domain_name') %>
SSLEngine on
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile /etc/ssl/certs/star.planet.<%=
scope.lookupvar('misc::planet-venus::planet_domain_name') %>.pem
diff --git a/templates/apache/sites/racktables.wikimedia.org.erb
b/templates/apache/sites/racktables.wikimedia.org.erb
index 3ce2540..1f68224 100644
--- a/templates/apache/sites/racktables.wikimedia.org.erb
+++ b/templates/apache/sites/racktables.wikimedia.org.erb
@@ -18,7 +18,7 @@
ServerName <%= racktables_host %>
SSLEngine on
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile <%= racktables_ssl_cert %>
diff --git a/templates/apache/sites/smokeping.wikimedia.org.erb
b/templates/apache/sites/smokeping.wikimedia.org.erb
index db751eb..d388b16 100644
--- a/templates/apache/sites/smokeping.wikimedia.org.erb
+++ b/templates/apache/sites/smokeping.wikimedia.org.erb
@@ -37,7 +37,7 @@
ServerName <%= smokeping_host %>
SSLEngine on
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile <%= smokeping_ssl_cert %>
diff --git a/templates/apache/sites/stats.wikimedia.org.erb
b/templates/apache/sites/stats.wikimedia.org.erb
index 4d4a9d5..34d7570 100644
--- a/templates/apache/sites/stats.wikimedia.org.erb
+++ b/templates/apache/sites/stats.wikimedia.org.erb
@@ -78,7 +78,7 @@
RewriteRule ^(.*)$ https://stats.wikimedia.org$1 [R=301,L]
SSLEngine on
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile /etc/ssl/certs/stats.wikimedia.org.pem
diff --git a/templates/apache/sites/wikistats.erb
b/templates/apache/sites/wikistats.erb
index 57a1f76..9e66c3f 100644
--- a/templates/apache/sites/wikistats.erb
+++ b/templates/apache/sites/wikistats.erb
@@ -37,7 +37,7 @@
ServerName <%= wikistats_host %>
SSLEngine on
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile <%= wikistats_ssl_cert %>
diff --git a/templates/apache/sites/wikitech.wikimedia.org.erb
b/templates/apache/sites/wikitech.wikimedia.org.erb
index f39672e..35d547d 100644
--- a/templates/apache/sites/wikitech.wikimedia.org.erb
+++ b/templates/apache/sites/wikitech.wikimedia.org.erb
@@ -40,7 +40,7 @@
ServerName <%= controller_hostname %>
SSLEngine on
- SSLProtocol -ALL +SSLv3 +TLSv1
+ SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
SSLCertificateFile /etc/ssl/certs/<%= certificate %>.pem
--
To view, visit https://gerrit.wikimedia.org/r/111969
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ia9058d2df5543ae0a6cb59737613127af412ec2e
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Diederik <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
