foo.sh/ansible
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ldap_server: Drop TLS 1.2 support

Browse source
This commit is contained in:
Timo Makinen 2022-10-31 00:51:31 +00:00
parent 84f8add38a
commit f17ae819fa
2 changed files with 2 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
roles/ldap_server/meta/main.yml
View file

@ -1,7 +1,5 @@
--- ---
dependencies: dependencies:
- {role: dhparams}
- {role: kerberos} - {role: kerberos}
- {role: ldap} - {role: ldap}
- {role: saslauthd} - {role: saslauthd}

6
roles/ldap_server/templates/slapd.conf.j2
View file

@ -45,11 +45,9 @@ moduleload constraint.la
TLSCertificateFile {{ tls_certs }}/{{ ldap_server_cert }}.crt TLSCertificateFile {{ tls_certs }}/{{ ldap_server_cert }}.crt
TLSCertificateKeyFile {{ tls_private }}/{{ ldap_server_cert }}.key TLSCertificateKeyFile {{ tls_private }}/{{ ldap_server_cert }}.key
TLSCACertificatePath /etc/openldap/certs TLSCACertificatePath /etc/openldap/certs
TLSDHParamFile {{ tls_certs }}/ffdhe3072.pem TLSVerifyClient allow
TLSVerifyClient try
TLSECName prime256v1 TLSECName prime256v1
TLSCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 TLSProtocolMin 3.4
TLSProtocolMin 3.3
# force hostname to get kerberos working correctly behind proxies # force hostname to get kerberos working correctly behind proxies
sasl-host ldap.foo.sh sasl-host ldap.foo.sh