Bug 1491363 - Puppet vhost should allow setting SSLProtocols and SSLCipherSuite using parameters
Summary: Puppet vhost should allow setting SSLProtocols and SSLCipherSuite using param...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Installer
Version: 6.2.0
Hardware: Unspecified
OS: Unspecified
high
high vote
Target Milestone: Unspecified
Assignee: Ewoud Kohl van Wijngaarden
QA Contact: Sanket Jagtap
URL:
Whiteboard:
Depends On:
Blocks: 1353215 1541321 1545876
TreeView+ depends on / blocked
 
Reported: 2017-09-13 15:00 UTC by Evgeni Golov
Modified: 2022-07-09 09:22 UTC (History)
10 users (show)

Fixed In Version: foreman-installer-1.11.0.17-1
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1530690 (view as bug list)
Environment:
Last Closed: 2018-02-05 13:54:34 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Foreman Issue Tracker 20546 0 Normal Closed Puppet vhost should allow setting SSLProtocols and SSLCipherSuite using parameters 2020-11-10 11:31:39 UTC
Red Hat Bugzilla 1290510 1 None None None 2022-03-13 13:59:29 UTC
Red Hat Product Errata RHSA-2018:0273 0 normal SHIPPED_LIVE Important: Red Hat Satellite 6 security, bug fix, and enhancement update 2018-02-08 00:35:29 UTC

Internal Links: 1290510

Description Evgeni Golov 2017-09-13 15:00:07 UTC
These are currently hard coded in the manifest

Comment 1 Evgeni Golov 2017-09-13 15:00:12 UTC
Created from redmine issue http://projects.theforeman.org/issues/20546

Comment 2 Evgeni Golov 2017-09-13 15:00:16 UTC
Upstream bug assigned to None

Comment 4 Satellite Program 2017-09-13 16:17:27 UTC
Moving this bug to POST for triage into Satellite 6 since the upstream issue http://projects.theforeman.org/issues/20546 has been resolved.

Comment 12 Sanket Jagtap 2017-12-12 12:32:26 UTC
Build : Satellite 6.3.0 snap27

I able able to use the exposed parameters
puppet::server::passenger::ssl_protocol: "ALL -SSLv3 -TLSv1 -TLSv1.1"
puppet::server::passenger::ssl_cipher: "..."

[root@sgi-uv20-01 ~]# cat /etc/foreman-installer/custom-hiera.yaml | grep puppet
# installer puppet modules that might not be exposed to users directly through

puppet::server::passenger::ssl_protocol: 'ALL -SSLv3 -TLSv1 -TLSv1.1'
puppet::server::passenger::ssl_cipher: 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA'

satellite-installer 
Installing             Done                                               [100%] [................................................................................................................................]
  Success!


But the changes are reflected into a different file in 6.3

cat /etc/httpd/conf.d/25-puppet.conf | grep SSL

  RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
  RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
  RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e
  ## SSL directives
  SSLEngine on
  SSLCertificateFile      "/var/lib/puppet/ssl/certs/sgi-.pem"
  SSLCertificateKeyFile   "/var/lib/puppet/ssl/private_keys/sgi-.pem"
  SSLCertificateChainFile "/var/lib/puppet/ssl/ca/ca_crt.pem"
  SSLProtocol             ALL -SSLv3 -TLSv1 -TLSv1.1
  SSLCipherSuite          EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
  SSLHonorCipherOrder     on
  SSLVerifyClient         optional
  SSLCACertificateFile    "/var/lib/puppet/ssl/ca/ca_crt.pem"
  SSLCARevocationFile     "/var/lib/puppet/ssl/ca/ca_crl.pem"
  SSLVerifyDepth          1
  SSLCARevocationCheck    "chain"
  SSLOptions +StdEnvVars +ExportCertData

I don't see the SSL parameter in /etc/httpd/conf.d/05-foreman-ssl.conf anymore.
Is this expected?

Comment 13 Ewoud Kohl van Wijngaarden 2017-12-12 13:32:36 UTC
puppet::server::passenger::* are settings only for the puppet vhost. The foreman vhost itself doesn't expose the SSL protocols or ciphers. For that we rely on the Apache wide defaults. They can be overridden using the apache::mod::ssl_{cipher,protocol} keys in hiera.

In hindsight we should have used undef as defaults in the puppet vhost (rather than explicit values) but here we are now needing duplicated values. Given the puppet passenger setup is deprecated and only used on Puppet 3 we're unlikely to fix this. Puppet 4 uses puppetserver which is a standalone Java server and uses a different format to specify ciphers and protocols.

It might be good to verify the puppetserver ciphers are secure as well. The protocol is limited to TLSv1.2 by default, but I'm not sure sure if the ciphers allow the best available ones.

Comment 14 Sanket Jagtap 2017-12-28 08:56:52 UTC
On puppet 4 with snap30 


 cat /etc/foreman-installer/custom-hiera.yaml | grep puppetserver
puppet::server::puppetserver::server_ssl_protocols: ['TLSv1.2',]
puppet::server::puppetserver::server_cipher_suites: ['TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384','TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384','TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384','TLS_RSA_WITH_AES_256_GCM_SHA384']

Before installer run:
cat /etc/puppetlabs/puppetserver/conf.d/puppetserver.conf | grep ssl -C 10
    # specified in the Puppet Server HOCON-formatted auth.conf (if false).
    use-legacy-auth-conf: false

    # (optional) enable or disable environment class cache
    environment-class-cache-enabled: false
}

# settings related to HTTP client requests made by Puppet Server
http-client: {
    # A list of acceptable protocols for making HTTP requests
    ssl-protocols: [
        TLSv1.2,
    ]

    # A list of acceptable cipher suites for making HTTP requests
    cipher-suites: [
        TLS_RSA_WITH_AES_256_CBC_SHA256,
        TLS_RSA_WITH_AES_256_CBC_SHA,
        TLS_RSA_WITH_AES_128_CBC_SHA256,
        TLS_RSA_WITH_AES_128_CBC_SHA,
    ]


satellite-installer 
Installing             Done                                               [100%] [................................................................................................................................]
  Success!

cat /etc/puppetlabs/puppetserver/conf.d/puppetserver.conf | grep ssl -C 10
    # specified in the Puppet Server HOCON-formatted auth.conf (if false).
    use-legacy-auth-conf: false

    # (optional) enable or disable environment class cache
    environment-class-cache-enabled: false
}

# settings related to HTTP client requests made by Puppet Server
http-client: {
    # A list of acceptable protocols for making HTTP requests
    ssl-protocols: [
        TLSv1.2,
    ]

    # A list of acceptable cipher suites for making HTTP requests
    cipher-suites: [
        TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,
        TLS_RSA_WITH_AES_256_GCM_SHA384,
    ]

Comment 15 Sanket Jagtap 2018-01-10 13:28:40 UTC
Build : Satellite 6.2.14 snap1

I able able to use the exposed parameters
puppet::server::passenger::ssl_protocol: "..."
puppet::server::passenger::ssl_cipher: "..."


[root@ibm-x3650-01 ~]# cat /etc/foreman-installer/custom-hiera.yaml | grep puppet
# installer puppet modules that might not be exposed to users directly through
# Consult the full module documentation on http://forge.puppetlabs.com,
# or the actual puppet classes themselves, to discover options to configure.
puppet::server::passenger::ssl_protocol: 'ALL -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2'
puppet::server::passenger::ssl_cipher: '!aNULL:!eNULL:!LOW:!DES:!3DES:!RC4:!MD5:!EXP:!PSK:!SRP:!DSS:!ADH:HIGH'


[root@ibm-x3650-01 ~]# satellite-installer 
Installing             Done                                               [100%] [...............................................................................................................................]
  Success!
  * Satellite is running at https://sat-host
  * To install additional capsule on separate machine continue by running:

      capsule-certs-generate --capsule-fqdn "$CAPSULE" --certs-tar "~/$CAPSULE-certs.tar"

  The full log is at /var/log/foreman-installer/satellite.log


[root@ibm-x3650-01 ~]# cat /etc/httpd/conf.d/25-puppet.conf | grep SSL
  RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
  RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
  RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e
  ## SSL directives
  SSLEngine on
  SSLCertificateFile      "/var/lib/puppet/ssl/certs/sat-host.pem"
  SSLCertificateKeyFile   "/var/lib/puppet/ssl/private_keys/sat-host.pem"
  SSLCertificateChainFile "/var/lib/puppet/ssl/ca/ca_crt.pem"
  SSLCACertificatePath    "/etc/pki/tls/certs"
  SSLCACertificateFile    "/var/lib/puppet/ssl/ca/ca_crt.pem"
  SSLCARevocationFile     "/var/lib/puppet/ssl/ca/ca_crl.pem"
  SSLCARevocationCheck    "chain"
  SSLProtocol             ALL -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2
  SSLCipherSuite          !aNULL:!eNULL:!LOW:!DES:!3DES:!RC4:!MD5:!EXP:!PSK:!SRP:!DSS:!ADH:HIGH
  SSLHonorCipherOrder     on
  SSLVerifyClient         optional
  SSLVerifyDepth          1
  SSLOptions +StdEnvVars +ExportCertData

Comment 18 errata-xmlrpc 2018-02-05 13:54:34 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:0273


Note You need to log in before you can comment on or make changes to this bug.