YunoHost/yunohost
1
0
Fork 0
mirror of https://github.com/YunoHost/yunohost.git synced 2024-09-03 20:06:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

Simplify setting usage in regenconf hooks

Browse source
This commit is contained in:
Alexandre Aubin 2019-03-22 16:31:45 +01:00
parent fee79820e0
commit dcff10f6f8
5 changed files with 5 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
data/hooks/conf_regen/03-ssh
View file

@ -24,13 +24,10 @@ do_pre_regen() {
fi
# Support different strategy for security configurations
if [[ -n "$(yunohost settings get 'service.ssh.compatibility')" ]]; then
ssh_ciphers_compatibility="$(yunohost settings get 'service.ssh.compatibility')"
fi
export compatibility="$(yunohost settings get 'service.ssh.compatibility')"
export ssh_keys
export ipv6_enabled
export ssh_ciphers_compatibility
ynh_render_template "sshd_config" "${pending_dir}/etc/ssh/sshd_config"
}

6
data/hooks/conf_regen/15-nginx
View file

@ -37,11 +37,7 @@ do_pre_regen() {
domain_list=$(sudo yunohost domain list --output-as plain --quiet)
# Support different strategy for security configurations
if [[ -n "$(yunohost settings get 'security.nginx.compatibility')" ]]; then
security_ciphers_compatibility="$(yunohost settings get 'security.nginx.compatibility')"
fi
export security_ciphers_compatibility
export compatibility="$(yunohost settings get 'security.nginx.compatibility')"
# add domain conf files
for domain in $domain_list; do

2
data/templates/nginx/plain/yunohost_admin.conf
View file

@ -20,7 +20,7 @@ server {
ssl_session_timeout 5m;
ssl_session_cache shared:SSL:50m;
{% if security_ciphers_compatibility == "modern" %}
{% if compatibility == "modern" %}
# Ciphers with modern compatibility
# https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.6.2&openssl=1.0.1t&hsts=yes&profile=modern
# Uncomment the following to use modern ciphers, but remove compatibility with some old clients (android < 5.0, Internet Explorer < 10, ...)

2
data/templates/nginx/server.tpl.conf
View file

@ -29,7 +29,7 @@ server {
ssl_session_timeout 5m;
ssl_session_cache shared:SSL:50m;
{% if security_ciphers_compatibility == "modern" %}
{% if compatibility == "modern" %}
# Ciphers with modern compatibility
# https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.6.2&openssl=1.0.1t&hsts=yes&profile=modern
# The following configuration use modern ciphers, but remove compatibility with some old clients (android < 5.0, Internet Explorer < 10, ...)

2
data/templates/ssh/sshd_config
View file

@ -15,7 +15,7 @@ HostKey {{ key }}{% endfor %}
# https://infosec.mozilla.org/guidelines/openssh
# ##############################################
{% if ssh_ciphers_compatibility == "intermediate" %}
{% if compatibility == "intermediate" %}
KexAlgorithms diffie-hellman-group-exchange-sha256
Ciphers aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512,hmac-sha2-256