majic-ansible-roles Changeset

Changeset - 4e121413ca5c

Parent rev.

Child rev.

[Not reviewed]

0 3 0

Branko Majic (branko) - 4 years ago 2020-05-18 21:09:08
branko@majic.rs

MAR-153: Use 2048-bit Diffie-Helman parameters for IMAP server in the mail_server role.

3 files changed with 19 insertions and 1 deletions:

roles/mail_server/molecule/default/prepare.yml

roles/mail_server/molecule/default/tests/test_default.py

roles/mail_server/templates/99-local.conf.j2

0 comments (0 inline, 0 general)

roles/mail_server/molecule/default/prepare.yml

➞

Show inline comments

@@ @@ -18,6 +18,11 @@ @@
         update_cache: true
       changed_when: false
     - name: Install tools for testing
       apt:
         name: gnutls-bin
         state: present
 - hosts: stretch
   become: true
   tasks:

roles/mail_server/molecule/default/tests/test_default.py

➞

Show inline comments

@@ @@ -388,7 +388,8 @@ def test_smtp_server_uses_correct_dh_parameters(host): @@
     with host.sudo():
         expected_dhparam = host.file('/etc/ssl/private/%s_smtp.dh.pem' % hostname).content_string.rstrip()
     connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=smtp --port 25 --priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' --verbose localhost")
     connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=smtp --port 25 "
                           "--priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' --verbose localhost")
     output = connection.stdout
     begin_marker = "-----BEGIN DH PARAMETERS-----"
@@ @@ -396,3 +397,14 @@ def test_smtp_server_uses_correct_dh_parameters(host): @@
     used_dhparam = output[output.find(begin_marker):output.find(end_marker) + len(end_marker)]
     assert used_dhparam == expected_dhparam
 def test_imap_server_uses_correct_dh_parameters(host):
     """
     Tests if the IMAP server uses correct Diffie-Helman parameters.
     """
     connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=imap --port 143 "
                           "--priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' localhost")
     assert " - Using prime: 2048 bits" in connection.stdout

roles/mail_server/templates/99-local.conf.j2

➞

Show inline comments

@@ @@ -31,6 +31,7 @@ service auth { @@
 # TLS configuration.
 ssl_cert = </etc/ssl/certs/{{ ansible_fqdn }}_imap.pem
 ssl_key = </etc/ssl/private/{{ ansible_fqdn }}_imap.key
 ssl_dh_parameters_length = 2048
 ssl_protocols = {{ mail_server_tls_protocols | join(' ') }}
 ssl_cipher_list = {{ mail_server_tls_ciphers }}
 ssl = required

0 comments (0 inline, 0 general)