Bug 1491363

Created from redmine issue http://projects.theforeman.org/issues/20546

Upstream bug assigned to None

Moving this bug to POST for triage into Satellite 6 since the upstream issue http://projects.theforeman.org/issues/20546 has been resolved.

Build : Satellite 6.3.0 snap27

I able able to use the exposed parameters
puppet::server::passenger::ssl_protocol: "ALL -SSLv3 -TLSv1 -TLSv1.1"
puppet::server::passenger::ssl_cipher: "..."

[root@sgi-uv20-01 ~]# cat /etc/foreman-installer/custom-hiera.yaml | grep puppet
# installer puppet modules that might not be exposed to users directly through

puppet::server::passenger::ssl_protocol: 'ALL -SSLv3 -TLSv1 -TLSv1.1'
puppet::server::passenger::ssl_cipher: 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA'

satellite-installer 
Installing             Done                                               [100%] [................................................................................................................................]
  Success!


But the changes are reflected into a different file in 6.3

cat /etc/httpd/conf.d/25-puppet.conf | grep SSL

  RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
  RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
  RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e
  ## SSL directives
  SSLEngine on
  SSLCertificateFile      "/var/lib/puppet/ssl/certs/sgi-.pem"
  SSLCertificateKeyFile   "/var/lib/puppet/ssl/private_keys/sgi-.pem"
  SSLCertificateChainFile "/var/lib/puppet/ssl/ca/ca_crt.pem"
  SSLProtocol             ALL -SSLv3 -TLSv1 -TLSv1.1
  SSLCipherSuite          EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
  SSLHonorCipherOrder     on
  SSLVerifyClient         optional
  SSLCACertificateFile    "/var/lib/puppet/ssl/ca/ca_crt.pem"
  SSLCARevocationFile     "/var/lib/puppet/ssl/ca/ca_crl.pem"
  SSLVerifyDepth          1
  SSLCARevocationCheck    "chain"
  SSLOptions +StdEnvVars +ExportCertData

I don't see the SSL parameter in /etc/httpd/conf.d/05-foreman-ssl.conf anymore.
Is this expected?

puppet::server::passenger::* are settings only for the puppet vhost. The foreman vhost itself doesn't expose the SSL protocols or ciphers. For that we rely on the Apache wide defaults. They can be overridden using the apache::mod::ssl_{cipher,protocol} keys in hiera.

In hindsight we should have used undef as defaults in the puppet vhost (rather than explicit values) but here we are now needing duplicated values. Given the puppet passenger setup is deprecated and only used on Puppet 3 we're unlikely to fix this. Puppet 4 uses puppetserver which is a standalone Java server and uses a different format to specify ciphers and protocols.

It might be good to verify the puppetserver ciphers are secure as well. The protocol is limited to TLSv1.2 by default, but I'm not sure sure if the ciphers allow the best available ones.

On puppet 4 with snap30 


 cat /etc/foreman-installer/custom-hiera.yaml | grep puppetserver
puppet::server::puppetserver::server_ssl_protocols: ['TLSv1.2',]
puppet::server::puppetserver::server_cipher_suites: ['TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384','TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384','TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384','TLS_RSA_WITH_AES_256_GCM_SHA384']

Before installer run:
cat /etc/puppetlabs/puppetserver/conf.d/puppetserver.conf | grep ssl -C 10
    # specified in the Puppet Server HOCON-formatted auth.conf (if false).
    use-legacy-auth-conf: false

    # (optional) enable or disable environment class cache
    environment-class-cache-enabled: false
}

# settings related to HTTP client requests made by Puppet Server
http-client: {
    # A list of acceptable protocols for making HTTP requests
    ssl-protocols: [
        TLSv1.2,
    ]

    # A list of acceptable cipher suites for making HTTP requests
    cipher-suites: [
        TLS_RSA_WITH_AES_256_CBC_SHA256,
        TLS_RSA_WITH_AES_256_CBC_SHA,
        TLS_RSA_WITH_AES_128_CBC_SHA256,
        TLS_RSA_WITH_AES_128_CBC_SHA,
    ]


satellite-installer 
Installing             Done                                               [100%] [................................................................................................................................]
  Success!

cat /etc/puppetlabs/puppetserver/conf.d/puppetserver.conf | grep ssl -C 10
    # specified in the Puppet Server HOCON-formatted auth.conf (if false).
    use-legacy-auth-conf: false

    # (optional) enable or disable environment class cache
    environment-class-cache-enabled: false
}

# settings related to HTTP client requests made by Puppet Server
http-client: {
    # A list of acceptable protocols for making HTTP requests
    ssl-protocols: [
        TLSv1.2,
    ]

    # A list of acceptable cipher suites for making HTTP requests
    cipher-suites: [
        TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,
        TLS_RSA_WITH_AES_256_GCM_SHA384,
    ]

Build : Satellite 6.2.14 snap1

I able able to use the exposed parameters
puppet::server::passenger::ssl_protocol: "..."
puppet::server::passenger::ssl_cipher: "..."


[root@ibm-x3650-01 ~]# cat /etc/foreman-installer/custom-hiera.yaml | grep puppet
# installer puppet modules that might not be exposed to users directly through
# Consult the full module documentation on http://forge.puppetlabs.com,
# or the actual puppet classes themselves, to discover options to configure.
puppet::server::passenger::ssl_protocol: 'ALL -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2'
puppet::server::passenger::ssl_cipher: '!aNULL:!eNULL:!LOW:!DES:!3DES:!RC4:!MD5:!EXP:!PSK:!SRP:!DSS:!ADH:HIGH'


[root@ibm-x3650-01 ~]# satellite-installer 
Installing             Done                                               [100%] [...............................................................................................................................]
  Success!
  * Satellite is running at https://sat-host
  * To install additional capsule on separate machine continue by running:

      capsule-certs-generate --capsule-fqdn "$CAPSULE" --certs-tar "~/$CAPSULE-certs.tar"

  The full log is at /var/log/foreman-installer/satellite.log


[root@ibm-x3650-01 ~]# cat /etc/httpd/conf.d/25-puppet.conf | grep SSL
  RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
  RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
  RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e
  ## SSL directives
  SSLEngine on
  SSLCertificateFile      "/var/lib/puppet/ssl/certs/sat-host.pem"
  SSLCertificateKeyFile   "/var/lib/puppet/ssl/private_keys/sat-host.pem"
  SSLCertificateChainFile "/var/lib/puppet/ssl/ca/ca_crt.pem"
  SSLCACertificatePath    "/etc/pki/tls/certs"
  SSLCACertificateFile    "/var/lib/puppet/ssl/ca/ca_crt.pem"
  SSLCARevocationFile     "/var/lib/puppet/ssl/ca/ca_crl.pem"
  SSLCARevocationCheck    "chain"
  SSLProtocol             ALL -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2
  SSLCipherSuite          !aNULL:!eNULL:!LOW:!DES:!3DES:!RC4:!MD5:!EXP:!PSK:!SRP:!DSS:!ADH:HIGH
  SSLHonorCipherOrder     on
  SSLVerifyClient         optional
  SSLVerifyDepth          1
  SSLOptions +StdEnvVars +ExportCertData

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:0273