Christian Heimes
90a75f0d43
HTTPS connections from IPA framework and bind named instance now use system-wide crypto-policies on Fedora. For HTTPS the 'DEFAULT' crypto policy also includes unnecessary ciphers for PSK, SRP, aDSS and 3DES. Since these ciphers are not used by freeIPA, they are explicitly excluded. See: https://bugzilla.redhat.com/show_bug.cgi?id=1179925 See: https://bugzilla.redhat.com/show_bug.cgi?id=1179220 Fixes: https://pagure.io/freeipa/issue/4853 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
51 lines
1.4 KiB
Python
51 lines
1.4 KiB
Python
#
|
|
# Copyright (C) 2015 FreeIPA Contributors see COPYING for license
|
|
#
|
|
|
|
'''
|
|
This base platform module exports platform dependant constants.
|
|
'''
|
|
|
|
|
|
class BaseConstantsNamespace(object):
|
|
DS_USER = 'dirsrv'
|
|
DS_GROUP = 'dirsrv'
|
|
HTTPD_USER = "apache"
|
|
HTTPD_GROUP = "apache"
|
|
GSSPROXY_USER = "root"
|
|
IPA_DNS_PACKAGE_NAME = "freeipa-server-dns"
|
|
KDCPROXY_USER = "kdcproxy"
|
|
NAMED_USER = "named"
|
|
NAMED_GROUP = "named"
|
|
PKI_USER = 'pkiuser'
|
|
PKI_GROUP = 'pkiuser'
|
|
# ntpd init variable used for daemon options
|
|
NTPD_OPTS_VAR = "OPTIONS"
|
|
# quote used for daemon options
|
|
NTPD_OPTS_QUOTE = "\""
|
|
ODS_USER = "ods"
|
|
ODS_GROUP = "ods"
|
|
# nfsd init variable used to enable kerberized NFS
|
|
SECURE_NFS_VAR = "SECURE_NFS"
|
|
SELINUX_BOOLEAN_ADTRUST = {
|
|
'samba_portmapper': 'on',
|
|
}
|
|
SELINUX_BOOLEAN_HTTPD = {
|
|
'httpd_can_network_connect': 'on',
|
|
'httpd_manage_ipa': 'on',
|
|
'httpd_run_ipa': 'on',
|
|
'httpd_dbus_sssd': 'on',
|
|
}
|
|
SSSD_USER = "sssd"
|
|
# sql (new format), dbm (old format)
|
|
NSS_DEFAULT_DBTYPE = 'dbm'
|
|
# WSGI module override, only used on Fedora
|
|
MOD_WSGI_PYTHON2 = None
|
|
MOD_WSGI_PYTHON3 = None
|
|
# high ciphers without RC4, MD5, TripleDES, pre-shared key, secure
|
|
# remote password, and DSA cert authentication.
|
|
TLS_HIGH_CIPHERS = "HIGH:!aNULL:!eNULL:!MD5:!RC4:!3DES:!PSK:!SRP:!aDSS"
|
|
|
|
|
|
constants = BaseConstantsNamespace()
|