pool/apache2
SHA256
4
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 322488 from Apache

Browse Source 
- Fixup libdir in installed files (forwarded request 322437 from Andreas_Schwab)

OBS-URL: https://build.opensuse.org/request/show/322488
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2?expand=0&rev=112
This commit is contained in:
Dominique Leuenberger 2015-08-14 12:45:53 +00:00 committed by Git OBS Bridge
commit e36bdd5646
4 changed files with 25 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
apache2-ssl-global.conf
View File

@ -77,8 +77,7 @@
# SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list.
# https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy
SSLCipherSuite EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
# SSLHonorCipherOrder
# If SSLHonorCipherOrder is disabled, then the client's preferences

14
apache2.changes
View File

@ -1,3 +1,17 @@
-------------------------------------------------------------------
Thu Aug 13 13:04:00 UTC 2015 - schwab@suse.de
- Fixup libdir in installed files
-------------------------------------------------------------------
Tue Aug 11 15:52:42 UTC 2015 - kstreitova@suse.com
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
disable export cipher suites and deploy Ephemeral Elliptic-Curve
Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
generate a strong and unique Diffie Hellman Group and append it
to the server certificate file [bnc#931723], [CVE-2015-4000]
-------------------------------------------------------------------
Wed Jul 29 06:22:59 UTC 2015 - pgajdos@suse.com

7
apache2.spec
View File

@ -578,6 +578,13 @@ cat > %{buildroot}/%{sysconfdir}/uid.conf <<-EOF
Group %{httpdgroup}
EOF
# fixup libdir
%if "%{_lib}" != "lib64"
sed -e 's/lib64/%{_lib}/' -i \
%{buildroot}/%{sysconfdir}/loadmodule.conf \
%{buildroot}/%{_var}/adm/fillup-templates/sysconfig.%{name}
%endif
# remove configuration for mpms which have not been built
mpm_confs="$(awk '/IfModule .*\.c/ {print $2}' %{buildroot}/%{sysconfdir}/server-tuning.conf | cut -d. -f1 | tr '\n' ' ')"
for mpm_conf in $mpm_confs; do

3
gensslcert
View File

@ -193,6 +193,9 @@ if [ $? -ne 0 ]; then
myexit $LINENO $?
fi
echo;myecho generating dhparams and appending it to the server certificate file...
openssl dhparam 2048 >> $sslcrtdir/${name}server.crt
exit 0