majic-ansible-roles Changeset

Changeset - 069c78425a29

Parent rev.

Child rev.

[Not reviewed]

0 3 0

Branko Majic (branko) - 3 years ago 2021-01-14 23:50:26
branko@majic.rs

MAR-151: Use 2048-bit DH parameter for IMAP server under Debian 10 Buster:

- Deploy a statically-generated DH parameter.
- Set-up DH parameter configuration based on Debian version.
- Implemented test for newly-generated file.

3 files changed with 37 insertions and 0 deletions:

roles/mail_server/molecule/default/tests/test_default.py

roles/mail_server/tasks/main.yml

roles/mail_server/templates/99-local.conf.j2

0 comments (0 inline, 0 general)

roles/mail_server/molecule/default/tests/test_default.py

➞

Show inline comments

@@ @@ -401,6 +401,27 @@ def test_smtp_server_uses_correct_dh_parameters(host): @@
     assert used_dhparam == expected_dhparam
 def test_imap_server_dh_parameter_file(host):
     """
     Tests if the Diffie-Hellman parameter file has been generated
     correctly.
     """
     hostname = host.run('hostname').stdout.strip()
     dhparam_file_path = '/etc/ssl/private/%s_imap.dh.pem' % hostname
     with host.sudo():
         dhparam_file = host.file(dhparam_file_path)
         assert dhparam_file.is_file
         assert dhparam_file.user == 'root'
         assert dhparam_file.group == 'root'
         assert dhparam_file.mode == 0o640
         dhparam_info = host.run("openssl dhparam -noout -text -in %s", dhparam_file_path)
         assert "DH Parameters: (2048 bit)" in dhparam_info.stdout
 def test_imap_server_uses_correct_dh_parameters(host):
     """
     Tests if the IMAP server uses correct Diffie-Hellman parameters.

roles/mail_server/tasks/main.yml

➞

Show inline comments

@@ @@ -89,6 +89,16 @@ @@
   notify:
     - Restart Dovecot
 - name: Generate the IMAP server Diffie-Hellman parameter
   openssl_dhparam:
     owner: root
     group: root
     mode: 0640
     path: "/etc/ssl/private/{{ ansible_fqdn }}_imap.dh.pem"
     size: 2048
   notify:
     - Restart Dovecot
 - name: Deploy configuration files for checking certificate validity via cron
   copy:
     content: "/etc/ssl/certs/{{ ansible_fqdn }}_{{ item }}.pem"

roles/mail_server/templates/99-local.conf.j2

➞

Show inline comments

@@ @@ -31,7 +31,13 @@ service auth { @@
 # TLS configuration.
 ssl_cert = </etc/ssl/certs/{{ ansible_fqdn }}_imap.pem
 ssl_key = </etc/ssl/private/{{ ansible_fqdn }}_imap.key
 {% if ansible_distribution_release == "stretch" %}
 ssl_dh_parameters_length = 2048
 {% elif ansible_distribution_release == "buster" %}
 ssl_dh=</etc/ssl/private/{{ inventory_hostname }}_imap.dh.pem
 {% else %}
 {{ unsupported_distribution_release }}
 {% endif %}
 ssl_protocols = {{ mail_server_tls_protocols | join(' ') }}
 ssl_cipher_list = {{ mail_server_tls_ciphers }}
 ssl = required

0 comments (0 inline, 0 general)