Description of problem: The Capsule configuration triggers an RedHat Insights Action "Man-in-the-middle attack exposed via httpd when using SSLv3" aka POODLE The /etc/httpd/conf.d/05-pulp-https.conf cofniguration file does not disable the SSLv3: [crash/LI] root@li-lc-1589:~# grep -R SSLProto /etc/httpd/ /etc/httpd/conf.d/05-pulp-https.conf: SSLProtocol all -SSLv2 /etc/httpd/conf.d/25-puppet.conf: SSLProtocol ALL -SSLv2 -SSLv3 /etc/httpd/conf.modules.d/ssl.conf: SSLProtocol all -SSLv2 -SSLv3 Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. Register Capsule to RedHat Insights 2. Check Actions for Capsule hosts 3. Actual results: Open Insights Security Actions for the Capsule Expected results: RedHat Insights shows no Actions Additional info:
Upstream this was fixed in https://github.com/Katello/puppet-pulp/commit/145cfadc0b53204514938f839e116778084e5311 and released as puppet-pulp 3.5.0. It wasn't part of the original katello 3.2 which shipped puppet-pulp 3.4.0
This should already be in sat 6.3.
Can you update the target milestone to match it will be included?
Peter, it's not yet clear in what version this will land in. Right now the plan is to deliver it in future Satellite 6.3 release.
Verified on Satellite 6.3 Snap 19. As there currently is no easy way for Satellite 6.3 installed from scratch to register to RHAI, I have installed a Sat 6.2 server, registered it to prod, and then upgraded to Satellite 6.3. RHAI for Sat 6.2 Capsule server shows action as described in the initial report. After upgrade and refresh of RHAI data, there is no action for the Sat 6.3 Capsule server required. On the Capsule server SSLv3 is disabled: $ grep -R SSLProto /etc/httpd/ /etc/httpd/conf.d/05-pulp-https.conf: SSLProtocol all -SSLv2 -SSLv3 /etc/httpd/conf.d/25-puppet.conf: SSLProtocol ALL -SSLv2 -SSLv3 /etc/httpd/conf.d/ssl.conf: SSLProtocol all -SSLv2 -SSLv3 VERIFIED
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:0336