Skip to content

Commit 425ce45

Browse files
stephenrjohnsonstephenrjohnson
committed
Merge pull request #116 from DevoKun/master
Changes required for PCI-DSSv3 compliance.
2 parents 78783da + 629eb45 commit 425ce45

File tree

14 files changed

+174
-107
lines changed

14 files changed

+174
-107
lines changed

‎manifests/master.pp‎

Lines changed: 61 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -58,48 +58,50 @@
5858
# }
5959
#
6060
class puppet::master (
61-
$user_id = undef,
62-
$group_id = undef,
63-
$modulepath = $::puppet::params::modulepath,
64-
$manifest = $::puppet::params::manifest,
65-
$external_nodes = undef,
66-
$node_terminus = undef,
67-
$hiera_config = $::puppet::params::hiera_config,
68-
$environmentpath = $::puppet::params::environmentpath,
69-
$environments = $::puppet::params::environments,
70-
$reports = store,
71-
$storeconfigs = false,
72-
$storeconfigs_dbserver = $::puppet::params::storeconfigs_dbserver,
73-
$storeconfigs_dbport = $::puppet::params::storeconfigs_dbport,
74-
$certname = $::fqdn,
75-
$autosign = false,
76-
$reporturl = undef,
77-
$puppet_ssldir = $::puppet::params::puppet_ssldir,
78-
$puppet_docroot = $::puppet::params::puppet_docroot,
79-
$puppet_vardir = $::puppet::params::puppet_vardir,
80-
$puppet_passenger_port = $::puppet::params::puppet_passenger_port,
81-
$puppet_passenger_tempdir = false,
82-
$puppet_passenger_cfg_addon = '',
83-
$puppet_master_package = $::puppet::params::puppet_master_package,
84-
$puppet_master_service = $::puppet::params::puppet_master_service,
85-
$version = 'present',
86-
$apache_serveradmin = $::puppet::params::apache_serveradmin,
87-
$pluginsync = true,
88-
$parser = $::puppet::params::parser,
89-
$puppetdb_startup_timeout = '60',
90-
$puppetdb_strict_validation = $::puppet::params::puppetdb_strict_validation,
91-
$dns_alt_names = ['puppet'],
92-
$digest_algorithm = $::puppet::params::digest_algorithm,
93-
$generate_ssl_certs = true,
94-
$strict_variables = undef,
95-
$puppetdb_version = 'present',
96-
$always_cache_features = false,
97-
$passenger_max_pool_size = $::processorcount,
98-
$passenger_high_performance = on,
99-
$passenger_max_requests = 10000,
100-
$passenger_stat_throttle_rate = 30,
101-
$serialization_format = undef,
102-
$serialization_package = undef,
61+
$user_id = undef,
62+
$group_id = undef,
63+
$modulepath = $::puppet::params::modulepath,
64+
$manifest = $::puppet::params::manifest,
65+
$external_nodes = undef,
66+
$node_terminus = undef,
67+
$hiera_config = $::puppet::params::hiera_config,
68+
$environmentpath = $::puppet::params::environmentpath,
69+
$environments = $::puppet::params::environments,
70+
$reports = store,
71+
$storeconfigs = false,
72+
$storeconfigs_dbserver = $::puppet::params::storeconfigs_dbserver,
73+
$storeconfigs_dbport = $::puppet::params::storeconfigs_dbport,
74+
$certname = $::fqdn,
75+
$autosign = false,
76+
$reporturl = undef,
77+
$puppet_ssldir = $::puppet::params::puppet_ssldir,
78+
$puppet_docroot = $::puppet::params::puppet_docroot,
79+
$puppet_vardir = $::puppet::params::puppet_vardir,
80+
$puppet_passenger_port = $::puppet::params::puppet_passenger_port,
81+
$puppet_passenger_ssl_protocol = $::puppet::params::puppet_passenger_ssl_protocol,
82+
$puppet_passenger_ssl_cipher = $::puppet::params::puppet_passenger_ssl_cipher,
83+
$puppet_passenger_tempdir = false,
84+
$puppet_passenger_cfg_addon = '',
85+
$puppet_master_package = $::puppet::params::puppet_master_package,
86+
$puppet_master_service = $::puppet::params::puppet_master_service,
87+
$version = 'present',
88+
$apache_serveradmin = $::puppet::params::apache_serveradmin,
89+
$pluginsync = true,
90+
$parser = $::puppet::params::parser,
91+
$puppetdb_startup_timeout = '60',
92+
$puppetdb_strict_validation = $::puppet::params::puppetdb_strict_validation,
93+
$dns_alt_names = ['puppet'],
94+
$digest_algorithm = $::puppet::params::digest_algorithm,
95+
$generate_ssl_certs = true,
96+
$strict_variables = undef,
97+
$puppetdb_version = 'present',
98+
$always_cache_features = false,
99+
$passenger_max_pool_size = $::processorcount,
100+
$passenger_high_performance = on,
101+
$passenger_max_requests = 10000,
102+
$passenger_stat_throttle_rate = 30,
103+
$serialization_format = undef,
104+
$serialization_package = undef,
103105
) inherits puppet::params {
104106

105107
anchor { 'puppet::master::begin': }
@@ -138,21 +140,23 @@
138140

139141
Anchor['puppet::master::begin'] ->
140142
class {'puppet::passenger':
141-
puppet_passenger_port => $puppet_passenger_port,
142-
puppet_docroot => $puppet_docroot,
143-
apache_serveradmin => $apache_serveradmin,
144-
puppet_conf => $::puppet::params::puppet_conf,
145-
puppet_ssldir => $puppet_ssldir,
146-
certname => $certname,
147-
conf_dir => $::puppet::params::confdir,
148-
dns_alt_names => join($dns_alt_names,','),
149-
generate_ssl_certs => $generate_ssl_certs,
150-
puppet_passenger_tempdir => $puppet_passenger_tempdir,
151-
config_addon => $puppet_passenger_cfg_addon,
152-
passenger_max_pool_size => $passenger_max_pool_size,
153-
passenger_high_performance => $passenger_high_performance,
154-
passenger_max_requests => $passenger_max_requests,
155-
passenger_stat_throttle_rate => $passenger_stat_throttle_rate,
143+
puppet_passenger_port => $puppet_passenger_port,
144+
puppet_passenger_ssl_protocol => $puppet_passenger_ssl_protocol,
145+
puppet_passenger_ssl_cipher => $puppet_passenger_ssl_cipher,
146+
puppet_docroot => $puppet_docroot,
147+
apache_serveradmin => $apache_serveradmin,
148+
puppet_conf => $::puppet::params::puppet_conf,
149+
puppet_ssldir => $puppet_ssldir,
150+
certname => $certname,
151+
conf_dir => $::puppet::params::confdir,
152+
dns_alt_names => join($dns_alt_names,','),
153+
generate_ssl_certs => $generate_ssl_certs,
154+
puppet_passenger_tempdir => $puppet_passenger_tempdir,
155+
config_addon => $puppet_passenger_cfg_addon,
156+
passenger_max_pool_size => $passenger_max_pool_size,
157+
passenger_high_performance => $passenger_high_performance,
158+
passenger_max_requests => $passenger_max_requests,
159+
passenger_stat_throttle_rate => $passenger_stat_throttle_rate,
156160

157161
} ->
158162
Anchor['puppet::master::end']

‎manifests/params.pp‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@
3535
$classfile = '$statedir/classes.txt'
3636
$package_provider = undef # falls back to system default
3737

38+
$puppet_passenger_ssl_protocol = 'TLSv1.2'
39+
$puppet_passenger_ssl_cipher = 'AES256+EECDH:AES256+EDH'
40+
3841
# Only used when environments == directory
3942
$environmentpath = "${confdir}/environments"
4043

‎manifests/passenger.pp‎

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@
3434
class puppet::passenger(
3535
$generate_ssl_certs = true,
3636
$puppet_passenger_port,
37+
$puppet_passenger_ssl_protocol,
38+
$puppet_passenger_ssl_cipher,
3739
$puppet_passenger_tempdir = false,
3840
$puppet_docroot,
3941
$apache_serveradmin,
@@ -48,15 +50,31 @@
4850
$passenger_max_requests = 0,
4951
$passenger_stat_throttle_rate = 10,
5052
){
51-
include apache
53+
54+
class { 'apache':
55+
default_mods => false,
56+
default_confd_files => false,
57+
default_vhost => false,
58+
server_tokens => 'Prod',
59+
server_signature => 'Off',
60+
trace_enable => 'Off',
61+
}
62+
63+
apache::mod { 'access_compat': }
64+
apache::mod { 'status': package_ensure => 'absent' }
65+
5266
include puppet::params
5367
class { 'apache::mod::passenger':
5468
passenger_max_pool_size => $passenger_max_pool_size,
5569
passenger_high_performance => $passenger_high_performance,
5670
passenger_max_requests => $passenger_max_requests,
5771
passenger_stat_throttle_rate => $passenger_stat_throttle_rate,
5872
}
59-
include apache::mod::ssl
73+
74+
class { 'apache::mod::ssl':
75+
ssl_protocol => [$puppet_passenger_ssl_protocol],
76+
ssl_cipher => $puppet_passenger_ssl_cipher,
77+
}
6078

6179
if $::osfamily == 'redhat' {
6280
file { '/var/lib/puppet/reports':
@@ -121,8 +139,8 @@
121139
ssl_chain => "${puppet_ssldir}/ca/ca_crt.pem",
122140
ssl_ca => "${puppet_ssldir}/ca/ca_crt.pem",
123141
ssl_crl => "${puppet_ssldir}/ca/ca_crl.pem",
124-
ssl_protocol => 'ALL -SSLv2 -SSLv3',
125-
ssl_cipher => 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK',
142+
ssl_protocol => $::puppet::params::ssl_protocol,
143+
ssl_cipher => $::puppet::params::ssl_cipher,
126144
ssl_honorcipherorder => 'On',
127145
ssl_verify_client => 'optional',
128146
ssl_verify_depth => '1',

‎manifests/repo/puppetlabs.pp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
if($::osfamily == 'Debian') {
88
Apt::Source {
99
location => 'http://apt.puppetlabs.com',
10-
key => '4BD6EC30',
10+
key => '47B320EB4C7C375AA9DAE1A01054B7A24BD6EC30',
1111
key_content => template('puppet/pgp.key'),
1212
}
1313
apt::source { 'puppetlabs': repos => 'main' }

‎spec/classes/puppet_passenger_spec.rb‎

Lines changed: 29 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,20 @@
33
describe 'puppet::passenger', :type => :class do
44
let (:params) do
55
{
6-
:puppet_passenger_port => '8140',
7-
:puppet_docroot => '/etc/puppet/rack/public/',
8-
:apache_serveradmin => 'root',
9-
:puppet_conf => '/etc/puppet/puppet.conf',
10-
:puppet_ssldir => '/var/lib/puppet/ssl',
11-
:certname => 'test.test.com',
12-
:conf_dir => '/etc/puppet',
13-
:dns_alt_names => 'puppet',
14-
:passenger_max_pool_size => '4',
15-
:passenger_high_performance => true,
16-
:passenger_max_requests => '1000',
17-
:passenger_stat_throttle_rate => '30',
6+
:puppet_passenger_port => '8140',
7+
:puppet_passenger_ssl_protocol => 'TLSv1.2',
8+
:puppet_passenger_ssl_cipher => 'AES256+EECDH:AES256+EDH',
9+
:puppet_docroot => '/etc/puppet/rack/public/',
10+
:apache_serveradmin => 'root',
11+
:puppet_conf => '/etc/puppet/puppet.conf',
12+
:puppet_ssldir => '/var/lib/puppet/ssl',
13+
:certname => 'test.test.com',
14+
:conf_dir => '/etc/puppet',
15+
:dns_alt_names => 'puppet',
16+
:passenger_max_pool_size => '4',
17+
:passenger_high_performance => true,
18+
:passenger_max_requests => '1000',
19+
:passenger_stat_throttle_rate => '30',
1820
}
1921
end
2022
context 'on Debian' do
@@ -107,19 +109,21 @@
107109
end
108110
let (:params) do
109111
{
110-
:puppet_passenger_port => '8140',
111-
:puppet_docroot => '/etc/puppet/rack/public/',
112-
:apache_serveradmin => 'root',
113-
:puppet_conf => '/etc/puppet/puppet.conf',
114-
:puppet_ssldir => '/var/lib/puppet/ssl',
115-
:certname => 'test.test.com',
116-
:conf_dir => '/etc/puppet',
117-
:dns_alt_names => ['puppet'],
118-
:puppet_passenger_tempdir => '/tmp/passenger',
119-
:passenger_max_pool_size => '4',
120-
:passenger_high_performance => true,
121-
:passenger_max_requests => '1000',
122-
:passenger_stat_throttle_rate => '30',
112+
:puppet_passenger_port => '8140',
113+
:puppet_passenger_ssl_protocol => 'TLSv1.2',
114+
:puppet_passenger_ssl_cipher => 'AES256+EECDH:AES256+EDH',
115+
:puppet_docroot => '/etc/puppet/rack/public/',
116+
:apache_serveradmin => 'root',
117+
:puppet_conf => '/etc/puppet/puppet.conf',
118+
:puppet_ssldir => '/var/lib/puppet/ssl',
119+
:certname => 'test.test.com',
120+
:conf_dir => '/etc/puppet',
121+
:dns_alt_names => ['puppet'],
122+
:puppet_passenger_tempdir => '/tmp/passenger',
123+
:passenger_max_pool_size => '4',
124+
:passenger_high_performance => true,
125+
:passenger_max_requests => '1000',
126+
:passenger_stat_throttle_rate => '30',
123127
}
124128
end
125129
it {

‎spec/classes/puppet_repo_puppetlabs_spec.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,12 @@
1414
should contain_apt__source('puppetlabs').with(
1515
:repos => 'main',
1616
:location => 'http://apt.puppetlabs.com',
17-
:key => '4BD6EC30'
17+
:key => '47B320EB4C7C375AA9DAE1A01054B7A24BD6EC30'
1818
)
1919
should contain_apt__source('puppetlabs-deps').with(
2020
:repos => 'dependencies',
2121
:location => 'http://apt.puppetlabs.com',
22-
:key => '4BD6EC30'
22+
:key => '47B320EB4C7C375AA9DAE1A01054B7A24BD6EC30'
2323
)
2424
end
2525
end

‎templates/config.erb‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
####################################################################
2+
####################################################################
3+
##
4+
## File controlled by Puppet Module puppet::master
5+
## Any changes you make will be overwritten.
6+
##
7+
####################################################################
8+
####################################################################
9+
110
# a config.ru, for use with every rack-compatible webserver.
211
# SSL needs to be handled outside this, though.
312

‎templates/etc/default/puppet.erb‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,13 @@
1-
# Only used on debian. Defaults for puppet - sourced by /etc/init.d/puppet
1+
####################################################################
2+
####################################################################
3+
##
4+
## File controlled by Puppet Module puppet::master
5+
## Any changes you make will be overwritten.
6+
##
7+
####################################################################
8+
####################################################################
9+
10+
# Only used on Debian. Defaults for puppet - sourced by /etc/init.d/puppet
211

312
# Start puppet on boot?
413
START=<%= @startonboot %>

‎templates/etc/sysconfig/puppet.erb‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
####################################################################
2+
####################################################################
3+
##
4+
## File controlled by Puppet Module puppet::master
5+
## Any changes you make will be overwritten.
6+
##
7+
####################################################################
8+
####################################################################
9+
110
# The puppetmaster server
211
PUPPET_SERVER=<%= @puppet_server %>
312

‎templates/puppet_passenger.conf.erb‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
####################################################################
2+
####################################################################
3+
##
4+
## File controlled by Puppet Module puppet::master
5+
## Any changes you make will be overwritten.
6+
##
7+
####################################################################
8+
####################################################################
9+
110
PassengerHighPerformance on
211
PassengerPoolIdleTime 1500
312
# PassengerMaxRequests 1000

0 commit comments

Comments
 (0)