Chapter 7. Disabling Weak Encryption
You might want to change the encryption settings for Satellite depending on the security requirements of your infrastructure or to fix vulnerabilities quickly. Use the following sections to disable weak SSL encryption and 64-bit cipher suites.
7.1. Disabling Weak SSL 2.0 and SSL 3.0 Encryption
If your Satellite fails Nessus scans because of SSL vulnerabilities, or your security infrastructure requires that you disable SSL 2.0 and SSL 3.0, you can edit the /etc/foreman-installer/custom-hiera.yaml
file to remove weak encryption.
Disabling Weak SSL 2.0 and SSL 3.0 Encryption for Satellite
To disable weak encryption for Satellite, complete the following steps:
Open the
/etc/foreman-installer/custom-hiera.yaml
file for editing:# vi /etc/foreman-installer/custom-hiera.yaml
Add the following entries:
# Foreman Proxy foreman_proxy::tls_disabled_versions: [ '1.1' ] # Dynflow foreman_proxy::plugin::dynflow::tls_disabled_versions: [ '1.1' ] # Passenger puppet::server::passenger::ssl_protocol: 'ALL -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2' # Apache apache::mod::ssl::ssl_protocol: [ 'ALL' , '-SSLv3' , '-TLSv1' , '-TLSv1.1' , '+TLSv1.2' ] # Tomcat / Candlepin candlepin::tls_versions: [ '1.2' ] # QPID Dispatch foreman_proxy_content::qpid_router_ssl_protocols: [ 'TLSv1.2' ] foreman_proxy_content::qpid_router_ssl_ciphers: 'ALL:!aNULL:+HIGH:-SSLv3:!IDEA-CBC-SHA' # PULP pulp::ssl_protocol: "ALL -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2"
Rerun the
satellite-installer
tool with no arguments:# satellite-installer --scenario satellite
Restart Katello services:
# katello-service restart
Disabling Weak SSL 2.0 and SSL 3.0 Encryption for Capsule
To disable weak encryption for Capsule, complete the following steps:
Open the
/etc/foreman-installer/custom-hiera.yaml
file for editing:# vi /etc/foreman-installer/custom-hiera.yaml
Add the following entries:
# Foreman Proxy foreman_proxy::tls_disabled_versions: [ '1.1' ] # Dynflow foreman_proxy::plugin::dynflow::tls_disabled_versions: [ '1.1' ] # Passenger puppet::server::passenger::ssl_protocol: 'ALL -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2' # Apache apache::mod::ssl::ssl_protocol: [ 'ALL' , '-SSLv3' , '-TLSv1' , '-TLSv1.1' , '+TLSv1.2' ] # QPID Dispatch foreman_proxy_content::qpid_router_ssl_protocols: [ 'TLSv1.2' ] foreman_proxy_content::qpid_router_ssl_ciphers: 'ALL:!aNULL:+HIGH:-SSLv3:!IDEA-CBC-SHA' # PULP pulp::ssl_protocol: "ALL -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2"
Rerun the
satellite-installer
tool with no arguments:# satellite-installer --scenario capsule
Restart Katello services:
# katello-service restart
7.2. Disabling 64-bit Block Size Cipher Suites (SWEET32)
If you want to update your cipher suites for Satellite, you can edit the ciphers and then add your changes to the /etc/foreman-installer/custom-hiera.yaml
file to make these changes persistent.
You can use the following procedure to update your cipher suite.
Until BZ#1586271 is resolved, you might want to disable SSL 64-bit Block Size Cipher Suites (SWEET32). However, you can also use this procedure to update other ciphers and make these changes persistent.
The minimum browser requirements for the following Ciphers is Firefox 27.
Open the
/etc/httpd/conf.d/ssl.conf
Apache configuration file for editing:# vi /etc/httpd/conf.d/ssl.conf
Update the values of
SSLCipherSuite
parameter:SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
Restart the httpd service:
# systemctl restart httpd
To make the change persistent across different satellite-installer executions, open the
/etc/foreman-installer/custom-hiera.yaml
file for editing:# vi /etc/foreman-installer/custom-hiera.yaml
Add the following entry for
apache
:apache::mod::ssl::ssl_cipher: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
Run the
satellite-installer
tool to add the changes to the Apache configuration:# satellite-installer -S satellite