summaryrefslogtreecommitdiff
path: root/puppet
AgeCommit message (Collapse)Author
2014-04-02Force satellite hosts that only speak to relayhost to have aMicah Anderson
smtp_tls_security_level of 'encrypt', so it is not optional (#1902) Change-Id: I61ad0823e3eb8df6c224767d63f0911dcba42a16
2014-04-02Update TLS apache vhost TLS configuration (#5137):Micah Anderson
. We want to allow for TLS1.2 to be enabled (supported in wheezy) . Explicitly disable SSLCompression. This aids in protecting against the BREACH attack: see http://breachattack.com), and SPDY version 3 is vulnerable to the CRIME attack when compression is on . Switch the cipher suites to match https://wiki.mozilla.org/Security/Server_Side_TLS#Apache for these reasons: . Prefer PFS, with ECDHE first then DHE (TLS 1.2, not many implementations support this, and there are no known attacks). . Prefer AES128 to AES256 because the key schedule in AES256 is considered weaker, and maybe AES128 is more resistant to timing attacks . Prefer AES to RC4. BEAST attacks on AES are mitigated in >=TLS1.1, and difficult in TLS1.0. They are not in RC4, and likely to become more dangerous . RC4 is on the path to removal, but still present for backward compatibility Change-Id: I99a7f0ebf2ac438f075835d1cb38f63080321043
2014-04-02Fix for satellite hosts that are unable to contact their relayhostMicah Anderson
because the DNS lookup is either impossible (.local domain), or incorrect (certain openstack/amazon/piston cloud configurations create this setup when the relayhost is in the same cluster as the satellite). Fixes #5225 Change-Id: Ifbc201678f2c0e97ee0e12bbf1c7f71d035d45c1
2014-04-02Merge branch '5359_design_docs' into 0.6varac
2014-04-02Merge pull request #20 from elijh/feature/openvpn-configvarac
allow ability to customize openvpn security options
2014-04-02couch design docs should be always deployed, not only on update of the ↵varac
design docs json files (Feature #5359)
2014-04-01Include all the ips that are allowed to send mail through the relay inMicah Anderson
the mynetworks parameter. Previously we only allowed other mx servers to relay to each other, but this prevents system mail from non-mx nodes from getting out. Fixes "Helo command rejected: You are not in domain bitmask.net (in reply to RCPT TO command))" (#5343) Change-Id: I5e204958cb235808eedc3a1724fb2dc6c7a5b73b
2014-03-31Merge branch 'feature/static_site' of https://github.com/elijh/leap_platform ↵kwadronaut
into elijh-feature/static_site Conflicts: puppet/modules/site_config/manifests/packages/base.pp
2014-03-26Merge branch '0.6' of ssh://code.leap.se/leap_platform into 0.6varac
2014-03-26Merge branch '5018_dont_remove_dev_packages_on_couch_node' into 0.6varac
2014-03-25couch node: same packages removed on every (second ?) puppetrun (Feature #5018)varac
2014-03-25 ignore openvpn TLS initialization errors (Feature #5374)varac
2014-03-24modules/site_static: part 2 - apacheelijah
2014-03-24fixes #5360 adds admin@ as reserved address + lintingkwadronaut
2014-03-23modules/site_static: part 1 - amberelijah
2014-03-20allow ability to customize openvpn security stuff: tls-cipher, auth, and ↵elijah
cipher config options.
2014-03-19Merge branch '5306_ignore_tapicero_PreconditionFailed' into 0.6varac
2014-03-19Merge branch '4798_automatic_compaction' into 0.6varac
2014-03-13catch errors when tapicero fails to create a userdb (Feature #5306)varac
2014-03-13Merge branch '5324_nagios_logging' into 0.6varac
2014-03-13deploy automatic compaction via platform (Feature #4798)varac
2014-03-13Dont't archive nagios logs, use logrotate for it (Feature #5324)varac
2014-03-13Dont't archive nagios logs (#5324)varac
2014-03-13removed trailing whitespaces in nagios.cfgvarac
2014-03-12check if soledad is working (Feature #5239)varac
2014-03-12Merge remote-tracking branch 'irregulator/bug/5241' into 0.6Micah Anderson
2014-03-12Indentation fix.irregulator
2014-03-12DirPortFrontPage serves a static webpage only when Tor node is exit.irregulator
See leap.se/code/issues/5241
2014-03-05updated submodule rubygems (#3827)varac
2014-03-05updated submodule rubygems (#3827)varac
2014-03-05use the right package dependencies for site_check_mk::agent class and subclassesvarac
2014-03-04remove trailing whitespaces from logwatch config filesvarac
2014-03-04updated submodule check_mkvarac
2014-03-04use curly brackets for variables in check_leap_mx.sh output, see ↵varac
https://review.leap.se/r/160/#comment156
2014-03-04don't use storedconfigs for check_mk, requires current check_mk module (#5253)varac
2014-03-04fix duplicate declarations in /etc/nagios3/conf.d/ on first deploy (Bug #5129)varac
2014-03-04fix check_mk resource dependencies (Bug #5145)varac
2014-03-04ignore bigcouch 'Shutting down group server' error (#5246)varac
2014-03-04ignore failing creation of user-dbs by tapicero, see #5168varac
2014-03-04watch syslog for stunnel issues on couch nodesvarac
2014-03-04ignore stunnel 'Connection refused' errors that happen too often until we ↵varac
fix #5218
2014-03-04ignore 'epmd: got partial packet only on file descriptor' (#5244)varac
2014-03-03ignore "Uncaught error in HTTP request: {exit, normal}" error (#5226)varac
2014-03-03move generic syslog patterns to the end of syslog.cfg so we can ignore ↵varac
patterns first
2014-03-03ignore stunnel pattern "Peer suddenly disconnected" (#5218)varac
2014-03-03check syslog for bigcouch error "epmd: got partial packet only on file ↵varac
descriptor"
2014-03-03check soledad.log also for Upper case pattern 'Error'varac
2014-03-03check syslog for bigcouch restartsvarac
2014-03-03check leap_mx (Feature #5175)varac
2014-03-03check soledad.log for 'Timing out client:'varac
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-05 16:21:20 +0000