0

We need to disable TLS_RSA_WITH_AES_256_GCM_SHA384 running on port 8008 and 9090 .

Below processes are running on ports 8008 and 9090 respectively -

ruby /usr/bin/smart_proxy_dynflow_core -d -p /var/run/foreman-proxy/smart_proxy_dynflow_core.pid

ruby /usr/share/foreman-proxy/bin/smart-proxy --no-daemonize

Below is the configuration file of /etc/foreman-installer/custom-hiera.yaml

Foreman Proxy

foreman_proxy::tls_disabled_versions: [ '1.1' ]
foreman_proxy::ssl_disabled_ciphers: ['TLS_RSA_WITH_RC4_128_MD5', 'TLS_RSA_WITH_RC4_128_SHA', 'AES128-SHA256', 'AES256-SHA256', 'AES128-SHA', 'AES256-SHA', 'AES128-GCM-SHA256', 'AES256-GCM-SHA256', 'TLS_RSA_WITH_AES_256_GCM_SHA384', 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256', 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384', 'TLS_RSA_WITH_AES_256_GCM_SHA384']

Dynflow

foreman_proxy::plugin::dynflow::tls_disabled_versions: [ '1.1' ]
foreman_proxy::plugin::dynflow::ssl_disabled_ciphers: ['AES128-SHA256', 'AES256-SHA256', 'AES128-SHA', 'AES256-SHA', 'AES128-GCM-SHA256', 'AES256-GCM-SHA256', 'TLS_RSA_WITH_AES_256_GCM_SHA384', 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256', 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384', 'TLS_RSA_WITH_AES_256_GCM_SHA384']

Apache

apache::mod::ssl::ssl_protocol: [ 'ALL' , '-SSLv3' , '-TLSv1' , '-TLSv1.1' , '+TLSv1.2' ]
apache::mod::ssl::ssl_cipher: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256

Tomcat / Candlepin

candlepin::tls_versions: [ '1.2' ]

QPID Dispatch

foreman_proxy_content::qpid_router_ssl_protocols: [ 'TLSv1.2' ]
foreman_proxy_content::qpid_router_ssl_ciphers: 'ALL:!aNULL:+HIGH:-SSLv3:!IDEA-CBC-SHA'

PULP

pulp::ssl_protocol: "ALL -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2"
Michael Hampton
  • 244,070
  • 43
  • 506
  • 972
Biswajit
  • 1
  • 1

2 Answers2

0

I had the same issue on Satellite 6.7.2. You might need to restart that service which controls ruby processes, so it can re-read the configuration

systemctl restart smart_proxy_dynflow_core.service
Andrew Schulman
  • 8,811
  • 21
  • 32
  • 47
user618167
  • 1
0

I'm pretty sure when you change the custom-hiera.yml file, you need to re-run the satellite-installer command to get those settings in to the various components. Red Hat Satellite Installation

Brad
  • 1