Red Hat Bugzilla – Bug 1544995
Satellite installer should enable options to allow me to secure the SSLProtocols used by Tomcat
Last modified: 2018-04-13 09:53:40 EDT
Description of problem: In the Satellite use case, the server.xml file for Tomcat is configured/managed via puppet. I would like the sslProtocols & sslEnabledProtocols values to be exposed as puppet parameters so that I can override them with custom hiera.
*** Bug 1477666 has been marked as a duplicate of this bug. ***
Build: Satellite 6.3.1 snap1 grep candlepin /etc/foreman-installer/custom-hiera.yaml candlepin::tls_versions: ['1.2', '1.3'] [root@sgi-uv20-01 ~]# grep /etc/ Display all 273 possibilities? (y or n) [root@sgi-uv20-01 ~]# grep ssl /etc/tomcat/server.xml sslProtocols="TLSv1.2" sslEnabledProtocols="TLSv1.2" [root@sgi-uv20-01 ~]# satellite-installer Installing Done [100%] [................................................................................................................................] Success! * Satellite is running at https://sat-host * To install an additional Capsule on separate machine continue by running: capsule-certs-generate --foreman-proxy-fqdn "$CAPSULE" --certs-tar "/root/$CAPSULE-certs.tar" * To upgrade an existing 6.2 Capsule to 6.3: Please see official documentation for steps and parameters to use when upgrading a 6.2 Capsule to 6.3. The full log is at /var/log/foreman-installer/satellite.log [root@sgi-uv20-01 ~]# grep ssl /etc/tomcat/server.xml sslProtocols="TLSv1.2,TLSv1.3" sslEnabledProtocols="TLSv1.2,TLSv1.3"
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:1126