Skip to content

Commit 0218f54

Browse files
DevoKunDevoKun
committed
Per PCI-DSSv3 requirements: Disabled Apache TRACE, disabled Apache server signature, set Apache server tokens to Prod, disabled default Apache mods and configs, disabled Apache mod_status. Also did some code cleanup after testing with Ubuntu 14.04.2
1 parent be55095 commit 0218f54

File tree

3 files changed

+74
-67
lines changed

3 files changed

+74
-67
lines changed

‎manifests/master.pp‎

Lines changed: 61 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -58,50 +58,50 @@
5858
# }
5959
#
6060
class puppet::master (
61-
$user_id = undef,
62-
$group_id = undef,
63-
$modulepath = $::puppet::params::modulepath,
64-
$manifest = $::puppet::params::manifest,
65-
$external_nodes = undef,
66-
$node_terminus = undef,
67-
$hiera_config = $::puppet::params::hiera_config,
68-
$environmentpath = $::puppet::params::environmentpath,
69-
$environments = $::puppet::params::environments,
70-
$reports = store,
71-
$storeconfigs = false,
72-
$storeconfigs_dbserver = $::puppet::params::storeconfigs_dbserver,
73-
$storeconfigs_dbport = $::puppet::params::storeconfigs_dbport,
74-
$certname = $::fqdn,
75-
$autosign = false,
76-
$reporturl = undef,
77-
$puppet_ssldir = $::puppet::params::puppet_ssldir,
78-
$puppet_docroot = $::puppet::params::puppet_docroot,
79-
$puppet_vardir = $::puppet::params::puppet_vardir,
80-
$puppet_passenger_port = $::puppet::params::puppet_passenger_port,
81-
$puppet_passenger_ssl_protocol = $::puppet::params::puppet_passenger_ssl_protocol
82-
$puppet_passenger_ssl_cipher = $::puppet::params::puppet_passenger_ssl_cipher
83-
$puppet_passenger_tempdir = false,
84-
$puppet_passenger_cfg_addon = '',
85-
$puppet_master_package = $::puppet::params::puppet_master_package,
86-
$puppet_master_service = $::puppet::params::puppet_master_service,
87-
$version = 'present',
88-
$apache_serveradmin = $::puppet::params::apache_serveradmin,
89-
$pluginsync = true,
90-
$parser = $::puppet::params::parser,
91-
$puppetdb_startup_timeout = '60',
92-
$puppetdb_strict_validation = $::puppet::params::puppetdb_strict_validation,
93-
$dns_alt_names = ['puppet'],
94-
$digest_algorithm = $::puppet::params::digest_algorithm,
95-
$generate_ssl_certs = true,
96-
$strict_variables = undef,
97-
$puppetdb_version = 'present',
98-
$always_cache_features = false,
99-
$passenger_max_pool_size = $::processorcount,
100-
$passenger_high_performance = on,
101-
$passenger_max_requests = 10000,
102-
$passenger_stat_throttle_rate = 30,
103-
$serialization_format = undef,
104-
$serialization_package = undef,
61+
$user_id = undef,
62+
$group_id = undef,
63+
$modulepath = $::puppet::params::modulepath,
64+
$manifest = $::puppet::params::manifest,
65+
$external_nodes = undef,
66+
$node_terminus = undef,
67+
$hiera_config = $::puppet::params::hiera_config,
68+
$environmentpath = $::puppet::params::environmentpath,
69+
$environments = $::puppet::params::environments,
70+
$reports = store,
71+
$storeconfigs = false,
72+
$storeconfigs_dbserver = $::puppet::params::storeconfigs_dbserver,
73+
$storeconfigs_dbport = $::puppet::params::storeconfigs_dbport,
74+
$certname = $::fqdn,
75+
$autosign = false,
76+
$reporturl = undef,
77+
$puppet_ssldir = $::puppet::params::puppet_ssldir,
78+
$puppet_docroot = $::puppet::params::puppet_docroot,
79+
$puppet_vardir = $::puppet::params::puppet_vardir,
80+
$puppet_passenger_port = $::puppet::params::puppet_passenger_port,
81+
$puppet_passenger_ssl_protocol = $::puppet::params::puppet_passenger_ssl_protocol,
82+
$puppet_passenger_ssl_cipher = $::puppet::params::puppet_passenger_ssl_cipher,
83+
$puppet_passenger_tempdir = false,
84+
$puppet_passenger_cfg_addon = '',
85+
$puppet_master_package = $::puppet::params::puppet_master_package,
86+
$puppet_master_service = $::puppet::params::puppet_master_service,
87+
$version = 'present',
88+
$apache_serveradmin = $::puppet::params::apache_serveradmin,
89+
$pluginsync = true,
90+
$parser = $::puppet::params::parser,
91+
$puppetdb_startup_timeout = '60',
92+
$puppetdb_strict_validation = $::puppet::params::puppetdb_strict_validation,
93+
$dns_alt_names = ['puppet'],
94+
$digest_algorithm = $::puppet::params::digest_algorithm,
95+
$generate_ssl_certs = true,
96+
$strict_variables = undef,
97+
$puppetdb_version = 'present',
98+
$always_cache_features = false,
99+
$passenger_max_pool_size = $::processorcount,
100+
$passenger_high_performance = on,
101+
$passenger_max_requests = 10000,
102+
$passenger_stat_throttle_rate = 30,
103+
$serialization_format = undef,
104+
$serialization_package = undef,
105105
) inherits puppet::params {
106106

107107
anchor { 'puppet::master::begin': }
@@ -140,21 +140,23 @@
140140

141141
Anchor['puppet::master::begin'] ->
142142
class {'puppet::passenger':
143-
puppet_passenger_port => $puppet_passenger_port,
144-
puppet_docroot => $puppet_docroot,
145-
apache_serveradmin => $apache_serveradmin,
146-
puppet_conf => $::puppet::params::puppet_conf,
147-
puppet_ssldir => $puppet_ssldir,
148-
certname => $certname,
149-
conf_dir => $::puppet::params::confdir,
150-
dns_alt_names => join($dns_alt_names,','),
151-
generate_ssl_certs => $generate_ssl_certs,
152-
puppet_passenger_tempdir => $puppet_passenger_tempdir,
153-
config_addon => $puppet_passenger_cfg_addon,
154-
passenger_max_pool_size => $passenger_max_pool_size,
155-
passenger_high_performance => $passenger_high_performance,
156-
passenger_max_requests => $passenger_max_requests,
157-
passenger_stat_throttle_rate => $passenger_stat_throttle_rate,
143+
puppet_passenger_port => $puppet_passenger_port,
144+
puppet_passenger_ssl_protocol => $puppet_passenger_ssl_protocol,
145+
puppet_passenger_ssl_cipher => $puppet_passenger_ssl_cipher,
146+
puppet_docroot => $puppet_docroot,
147+
apache_serveradmin => $apache_serveradmin,
148+
puppet_conf => $::puppet::params::puppet_conf,
149+
puppet_ssldir => $puppet_ssldir,
150+
certname => $certname,
151+
conf_dir => $::puppet::params::confdir,
152+
dns_alt_names => join($dns_alt_names,','),
153+
generate_ssl_certs => $generate_ssl_certs,
154+
puppet_passenger_tempdir => $puppet_passenger_tempdir,
155+
config_addon => $puppet_passenger_cfg_addon,
156+
passenger_max_pool_size => $passenger_max_pool_size,
157+
passenger_high_performance => $passenger_high_performance,
158+
passenger_max_requests => $passenger_max_requests,
159+
passenger_stat_throttle_rate => $passenger_stat_throttle_rate,
158160

159161
} ->
160162
Anchor['puppet::master::end']

‎manifests/params.pp‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,8 @@
3535
$classfile = '$statedir/classes.txt'
3636
$package_provider = undef # falls back to system default
3737

38-
$puppet_passenger_ssl_protocol = 'TLSv1.2',
39-
#$puppet_passenger_ssl_protocol = 'ALL -SSLv2 -SSLv3',
38+
$puppet_passenger_ssl_protocol = 'TLSv1.2'
4039
$puppet_passenger_ssl_cipher = 'AES256+EECDH:AES256+EDH'
41-
#$puppet_passenger_ssl_cipher = 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK',
4240

4341
# Only used when environments == directory
4442
$environmentpath = "${confdir}/environments"

‎manifests/passenger.pp‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -50,24 +50,31 @@
5050
$passenger_max_requests = 0,
5151
$passenger_stat_throttle_rate = 10,
5252
){
53-
#include apache
53+
5454
class { 'apache':
55+
default_mods => false,
56+
default_confd_files => false,
57+
default_vhost => false,
5558
server_tokens => 'Prod',
5659
server_signature => 'Off',
5760
trace_enable => 'Off',
58-
} ### class
61+
}
62+
63+
apache::mod { 'access_compat': }
64+
apache::mod { 'status': package_ensure => 'absent' }
65+
5966
include puppet::params
6067
class { 'apache::mod::passenger':
6168
passenger_max_pool_size => $passenger_max_pool_size,
6269
passenger_high_performance => $passenger_high_performance,
6370
passenger_max_requests => $passenger_max_requests,
6471
passenger_stat_throttle_rate => $passenger_stat_throttle_rate,
6572
}
66-
#include apache::mod::ssl
67-
apache::mod::ssl {
73+
74+
class { 'apache::mod::ssl':
6875
ssl_protocol => [$puppet_passenger_ssl_protocol],
6976
ssl_cipher => $puppet_passenger_ssl_cipher,
70-
} ### Apache::Mod::Ssl defaults
77+
}
7178

7279
if $::osfamily == 'redhat' {
7380
file { '/var/lib/puppet/reports':

0 commit comments

Comments
 (0)