In I4456bc1a0056da051947977a26dd6d57c549e421 we hardened Keystone's
Apache SSL settings. In order to keep all Apache SSL settings uniformly
configured, we also need to update Horizon's settings and centralize
where we define the cipher suite that the server supports and the
preferred protocol versions.
We also explicitly disable SSLCompression even though we tend to only
test against versions of Apache that have this off by default. If
someone uses a version after 2.2.24 or uses 2.4.3, they would otherwise
have to explicitly turn this off. Preferring security by default, we
disable it explicitly to prevent insecure installations anywhere.
We also document how users can override specific service SSL settings in
the event one service needs to support older clients that require
certain protocols or ciphers. For example, it's very plausible that an
organization may need to enable RC4 and SSLv3 for Horizon since their
users are still using XP and an old version of Internet Explorer.
Reviewed: https:/ /review. openstack. org/171838 /git.openstack. org/cgit/ stackforge/ os-ansible- deployment/ commit/ ?id=f2c5ffe7b19 2b547f54b5da7f5 5b4be16890360a
Committed: https:/
Submitter: Jenkins
Branch: master
commit f2c5ffe7b192b54 7f54b5da7f55b4b e16890360a
Author: Ian Cordasco <email address hidden>
Date: Wed Apr 8 17:12:37 2015 -0500
Genericize how we update SSL settings for Apache
In I4456bc1a0056da 051947977a26dd6 d57c549e421 we hardened Keystone's
Apache SSL settings. In order to keep all Apache SSL settings uniformly
configured, we also need to update Horizon's settings and centralize
where we define the cipher suite that the server supports and the
preferred protocol versions.
We also explicitly disable SSLCompression even though we tend to only
test against versions of Apache that have this off by default. If
someone uses a version after 2.2.24 or uses 2.4.3, they would otherwise
have to explicitly turn this off. Preferring security by default, we
disable it explicitly to prevent insecure installations anywhere.
We also document how users can override specific service SSL settings in
the event one service needs to support older clients that require
certain protocols or ciphers. For example, it's very plausible that an
organization may need to enable RC4 and SSLv3 for Horizon since their
users are still using XP and an old version of Internet Explorer.
Related-Bug: 1437481 083253847d6e11f 85e9d6d2e84
Change-Id: I85843452935710