f2c5ffe7b1
In I4456bc1a0056da051947977a26dd6d57c549e421 we hardened Keystone's Apache SSL settings. In order to keep all Apache SSL settings uniformly configured, we also need to update Horizon's settings and centralize where we define the cipher suite that the server supports and the preferred protocol versions. We also explicitly disable SSLCompression even though we tend to only test against versions of Apache that have this off by default. If someone uses a version after 2.2.24 or uses 2.4.3, they would otherwise have to explicitly turn this off. Preferring security by default, we disable it explicitly to prevent insecure installations anywhere. We also document how users can override specific service SSL settings in the event one service needs to support older clients that require certain protocols or ciphers. For example, it's very plausible that an organization may need to enable RC4 and SSLv3 for Horizon since their users are still using XP and an old version of Internet Explorer. Related-Bug: 1437481 Change-Id: I85843452935710083253847d6e11f85e9d6d2e84
54 lines
2.1 KiB
YAML
54 lines
2.1 KiB
YAML
---
|
|
# Copyright 2014, Rackspace US, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
## Glance Options
|
|
# Set default_store to "swift" if using Cloud Files or swift backend
|
|
glance_default_store: file
|
|
glance_notification_driver: noop
|
|
|
|
# `internalURL` will cause glance to speak to swift via ServiceNet, use
|
|
# `publicURL` to communicate with swift over the public network
|
|
glance_swift_store_endpoint_type: internalURL
|
|
|
|
|
|
## Nova
|
|
# Uncomment "nova_console_endpoint" to define a specific nova console URI or
|
|
# IP address this will construct the specific proxy endpoint for the console.
|
|
# nova_console_endpoint: console.company_domain.name
|
|
|
|
# This defaults to KVM, if you are deploying on a host that is not KVM capable
|
|
# change this to your hypervisor type: IE "qemu", "lxc".
|
|
# nova_virt_type: kvm
|
|
# nova_cpu_allocation_ratio: 2.0
|
|
# nova_ram_allocation_ratio: 1.0
|
|
|
|
|
|
## Swift
|
|
# This will allow all users to create containers and upload to swift if set to True
|
|
swift_allow_all_users: False
|
|
|
|
## Apache SSL Settings
|
|
# These do not need to be configured unless you're creating certificates for
|
|
# services running behind Apache (currently, Horizon and Keystone).
|
|
ssl_protocol: "ALL -SSLv2 -SSLv3"
|
|
# Cipher suite string from https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
|
|
ssl_cipher_suite: "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS"
|
|
# To override for Keystone only:
|
|
# - keystone_ssl_protocol
|
|
# - keystone_ssl_cipher_suite
|
|
# To override for Horizon only:
|
|
# - horizon_ssl_protocol
|
|
# - horizon_ssl_cipher_suite
|