summaryrefslogtreecommitdiff
path: root/puppet/modules
diff options
context:
space:
mode:
authorMicah Anderson <micah@leap.se>2013-10-03 13:16:43 -0400
committerMicah Anderson <micah@leap.se>2013-10-03 13:50:14 -0400
commit56f7b18d03f5ea337a68d653b422834c9283cfab (patch)
tree9ce32bf1809ff3a00135f4bf1744ea618db7c8ee /puppet/modules
parentf531ec536a55d756262329f516f1b3bdccf4f0b4 (diff)
It turns out postfix's variable for 1024bit DH parameters can actually take a file of arbitrary length (#4012)
Neither Postfix nor OpenSSL actually care about the size of the prime in "smtpd_tls_dh1024_param_file". You can make it 2048 bits Change-Id: Id60deec93547e7df6dfc414209afaf9d53c710b5
Diffstat (limited to 'puppet/modules')
-rw-r--r--puppet/modules/site_postfix/manifests/mx/tls.pp14
1 files changed, 9 insertions, 5 deletions
diff --git a/puppet/modules/site_postfix/manifests/mx/tls.pp b/puppet/modules/site_postfix/manifests/mx/tls.pp
index 9122a974..5e399f5c 100644
--- a/puppet/modules/site_postfix/manifests/mx/tls.pp
+++ b/puppet/modules/site_postfix/manifests/mx/tls.pp
@@ -25,17 +25,21 @@ class site_postfix::mx::tls {
include site_config::packages::gnutls
+ # Note, the file name is called dh_1024.pem, but we are generating 2048bit dh
+ # parameters Neither Postfix nor OpenSSL actually care about the size of the
+ # prime in "smtpd_tls_dh1024_param_file". You can make it 2048 bits
+
exec { 'certtool-postfix-gendh-1024':
- command => 'certtool --generate-dh-params --bits=1024 --outfile=/etc/postfix/dh_1024.pem',
+ command => 'certtool --generate-dh-params --bits=2048 --outfile=/etc/postfix/smtpd_tls_dh_param.pem',
user => root,
group => root,
- creates => '/etc/postfix/dh_1024.pem',
+ creates => '/etc/postfix/smtpd_tls_dh_param.pem',
require => Package['gnutls-bin']
}
# Make sure the dh params file has correct ownership and mode
file {
- '/etc/postfix/dh_1024.pem':
+ '/etc/postfix/smtpd_tls_dh_param.pem':
owner => root,
group => root,
mode => '0600',
@@ -43,8 +47,8 @@ class site_postfix::mx::tls {
}
postfix::config { 'smtpd_tls_dh1024_param_file':
- value => '/etc/postfix/dh_1024.pem',
- require => File['/etc/postfix/dh_1024.pem']
+ value => '/etc/postfix/smtpd_tls_dh_param.pem',
+ require => File['/etc/postfix/smtpd_tls_dh_param.pem']
}
}