Files
@ 8d272d91d3d2
Branch filter:
Location: majic-ansible-roles/roles/common/molecule/default/prepare.yml - annotation
8d272d91d3d2
2.4 KiB
text/x-yaml
MAR-165: Deploy Diffie-Helman parameters for LDAP server in the ldap_server role:
- Not relevant for Debian Strech because of a bug in the OpenLDAP
version it ships with.
- This should allow use of DHE ciphers with LDAP server.
- Generated DH parameters only help pick one of the parameters from
RFC-7919 (based on the size of generated ones).
- Make the cipher test lists distro-specific due to differences
between supported algorithms in respective GnuTLS versions.
- Not relevant for Debian Strech because of a bug in the OpenLDAP
version it ships with.
- This should allow use of DHE ciphers with LDAP server.
- Generated DH parameters only help pick one of the parameters from
RFC-7919 (based on the size of generated ones).
- Make the cipher test lists distro-specific due to differences
between supported algorithms in respective GnuTLS versions.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 | 1640ad5b4cac 1640ad5b4cac b1caa3b3c7ad b1caa3b3c7ad b1caa3b3c7ad b1caa3b3c7ad b1caa3b3c7ad b1caa3b3c7ad b1caa3b3c7ad b1caa3b3c7ad b1caa3b3c7ad b46fe4ab1956 b1caa3b3c7ad b1caa3b3c7ad b1caa3b3c7ad b1caa3b3c7ad b1caa3b3c7ad b1caa3b3c7ad b1caa3b3c7ad ca784c26d35c 1640ad5b4cac 1640ad5b4cac 6b8b1d4c9061 1640ad5b4cac 1640ad5b4cac 1640ad5b4cac e75d5d4fba3b 6b8b1d4c9061 6b8b1d4c9061 1640ad5b4cac 1640ad5b4cac 6b8b1d4c9061 1640ad5b4cac 1640ad5b4cac 1640ad5b4cac 1640ad5b4cac 6b8b1d4c9061 6b8b1d4c9061 1640ad5b4cac 1640ad5b4cac 1640ad5b4cac 1640ad5b4cac 1640ad5b4cac 40b5747adcb3 0b7b153fc6a9 0b7b153fc6a9 0b7b153fc6a9 0b7b153fc6a9 0b7b153fc6a9 0b7b153fc6a9 0b7b153fc6a9 0b7b153fc6a9 0b7b153fc6a9 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 325b9d16a72b 63b4a5ca9bff 63b4a5ca9bff 63b4a5ca9bff 63b4a5ca9bff 63b4a5ca9bff 63b4a5ca9bff 63b4a5ca9bff 63b4a5ca9bff 63b4a5ca9bff 63b4a5ca9bff 63b4a5ca9bff 63b4a5ca9bff 63b4a5ca9bff 63b4a5ca9bff 63b4a5ca9bff 63b4a5ca9bff 63b4a5ca9bff 63b4a5ca9bff fd4a0b8e06e6 fd4a0b8e06e6 63b4a5ca9bff 40b5747adcb3 40b5747adcb3 40b5747adcb3 40b5747adcb3 b46fe4ab1956 b46fe4ab1956 b46fe4ab1956 b46fe4ab1956 | ---
- name: Set-up fixtures
hosts: localhost
connection: local
gather_facts: false
tasks:
- name: Initialise CA hierarchy
command: "gimmecert init --ca-hierarchy-depth 2"
args:
creates: ".gimmecert/ca/level1.cert.pem"
chdir: "tests/data/"
- name: Set-up link to generated X.509 material
file:
src: ".gimmecert"
dest: "tests/data/x509"
state: link
- name: Prepare
hosts: all
gather_facts: false
tasks:
- name: Install python for Ansible
raw: test -e /usr/bin/python3 || (apt -y update && apt install -y python3-minimal)
become: true
changed_when: false
- hosts: all
become: true
tasks:
- name: Update all caches to avoid errors due to missing remote archives
apt:
update_cache: true
changed_when: false
- name: Install net-tools for running Testinfra host.socket tests
apt:
name: net-tools
state: present
- hosts: helper
become: true
tasks:
- name: Install apt-cacher-ng
apt:
name: apt-cacher-ng
state: present
- hosts: client
become: true
tasks:
- name: Install tool for testing TCP connectivity
apt:
name: hping3
state: present
- name: Set-up /etc/hosts with entries for all servers
lineinfile:
path: /etc/hosts
regexp: "^{{ item.key }}"
line: "{{ item.key }} {{ item.value }}"
owner: root
group: root
mode: 0644
state: present
with_dict:
10.31.127.11: parameters-mandatory-stretch64
10.31.127.12: parameters-optional-stretch64
10.31.127.21: parameters-mandatory-buster64
10.31.127.22: parameters-optional-buster64
- hosts: parameters-mandatory,parameters-optional
become: true
tasks:
- name: Install tool for testing TCP connectivity
apt:
name: hping3
state: present
- name: Set-up /etc/hosts with entries for all servers
lineinfile:
path: /etc/hosts
regexp: "^{{ item.key }}"
line: "{{ item.key }} {{ item.value }}"
owner: root
group: root
mode: 0644
state: present
with_dict:
10.31.127.3: client1
10.31.127.4: client2
- hosts: parameters-mandatory,parameters-optional
become: true
tasks:
- name: Remove the ss utility (see https://github.com/philpep/testinfra/pull/320)
file:
path: "/bin/ss"
state: absent
|