majic-ansible-roles Changeset

Changeset - c92d79571cf9

Parent rev.

Child rev.

[Not reviewed]

0 6 0

Branko Majic (branko) - 4 years ago 2020-05-19 16:38:08
branko@majic.rs

MAR-153: Use custom Diffie-Helman parameters for XMPP server in the web_server role.

6 files changed with 80 insertions and 0 deletions:

roles/xmpp_server/molecule/default/prepare.yml

roles/xmpp_server/molecule/default/tests/test_default.py

roles/xmpp_server/molecule/default/tests/test_mandatory.py

roles/xmpp_server/molecule/default/tests/test_optional.py

roles/xmpp_server/tasks/main.yml

roles/xmpp_server/templates/prosody.cfg.lua.j2

0 comments (0 inline, 0 general)

roles/xmpp_server/molecule/default/prepare.yml

➞

Show inline comments

@@ @@ -18,6 +18,11 @@ @@
         update_cache: true
       changed_when: false
     - name: Install tools for testing
       apt:
         name: gnutls-bin
         state: present
 - hosts: stretch
   become: true
   tasks:

roles/xmpp_server/molecule/default/tests/test_default.py

➞

Show inline comments

@@ @@ -123,6 +123,28 @@ def test_firewall_configuration_file(host): @@
         assert config.group == 'root'
         assert config.mode == 0o640
 def test_xmpp_server_dh_parameters_file(host):
     """
     Tests if the Diffie-Helman parameter file has been generated
     correctly.
     """
     fqdn = host.run('hostname -f').stdout.strip()
     dhparam_file_path = '/etc/ssl/private/%s_xmpp.dh.pem' % fqdn
     with host.sudo():
         dhparam_file = host.file(dhparam_file_path)
         assert dhparam_file.is_file
         assert dhparam_file.user == 'root'
         assert dhparam_file.group == 'prosody'
         assert dhparam_file.mode == 0o640
         dhparam_info = host.run("openssl dhparam -noout -text -in %s", dhparam_file_path)
         assert "DH Parameters: (2048 bit)" in dhparam_info.stdout
 # @TODO: Tests which were not implemented due to lack of out-of-box tools:
+#
 # - Proxy capability.

roles/xmpp_server/molecule/default/tests/test_mandatory.py

➞

Show inline comments

@@ @@ -81,3 +81,24 @@ def test_correct_prosody_package_installed(host): @@
     """
     assert host.package('prosody-0.10').is_installed
 def test_xmpp_server_uses_correct_dh_parameters(host):
     """
     Tests if the HTTP server uses the generated Diffie-Helman parameter.
     """
     fqdn = host.run('hostname -f').stdout.strip()
     with host.sudo():
         expected_dhparam = host.file('/etc/ssl/private/%s_xmpp.dh.pem' % fqdn).content_string.rstrip()
     connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=xmpp --port 5222 "
                           "--priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' --verbose domain1")
     output = connection.stdout
     begin_marker = "-----BEGIN DH PARAMETERS-----"
     end_marker = "-----END DH PARAMETERS-----"
     used_dhparam = output[output.find(begin_marker):output.find(end_marker) + len(end_marker)]
     assert used_dhparam == expected_dhparam

roles/xmpp_server/molecule/default/tests/test_optional.py

➞

Show inline comments

@@ @@ -87,3 +87,24 @@ def test_correct_prosody_package_installed(host): @@
     """
     assert host.package('prosody-0.9').is_installed
 def test_xmpp_server_uses_correct_dh_parameters(host):
     """
     Tests if the HTTP server uses the generated Diffie-Helman parameter.
     """
     fqdn = host.run('hostname -f').stdout.strip()
     with host.sudo():
         expected_dhparam = host.file('/etc/ssl/private/%s_xmpp.dh.pem' % fqdn).content_string.rstrip()
     connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=xmpp --port 5222 "
                           "--priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' --verbose domain2")
     output = connection.stdout
     begin_marker = "-----BEGIN DH PARAMETERS-----"
     end_marker = "-----END DH PARAMETERS-----"
     used_dhparam = output[output.find(begin_marker):output.find(end_marker) + len(end_marker)]
     assert used_dhparam == expected_dhparam

roles/xmpp_server/tasks/main.yml

➞

Show inline comments

@@ @@ -57,6 +57,16 @@ @@
   notify:
     - Restart Prosody
 - name: Generate the XMPP server Diffie-Helman parameter
   openssl_dhparam:
     owner: root
     group: prosody
     mode: 0640
     path: "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.dh.pem"
     size: 2048
   notify:
     - Restart Prosody
 - name: Deploy configuration file for checking certificate validity via cron
   copy:
     content: "/etc/ssl/certs/{{ ansible_fqdn }}_xmpp.pem"

roles/xmpp_server/templates/prosody.cfg.lua.j2

➞

Show inline comments

@@ @@ -44,6 +44,7 @@ allow_registration = false; @@
 ssl = {
   key = "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.key";
   certificate = "/etc/ssl/certs/{{ ansible_fqdn }}_xmpp.pem";
   dhparam = "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.dh.pem";
+}
 -- Ports on which to have direct TLS/SSL.

0 comments (0 inline, 0 general)