[Fedora-directory-commits] adminserver/admserv/cfgstuff console.conf.in, 1.2, 1.3

[Richard Allen Megginson (rmeggins)]

Author: rmeggins

Update of /cvs/dirsec/adminserver/admserv/cfgstuff
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv14602/adminserver/admserv/cfgstuff

Modified Files:
	console.conf.in 
Log Message:
Resolves: bug 426056
Bug Description: Unable to connect to admin express via SSL - firefox cipher issues?
Reviewed by: nkinder, nhosoi (Thanks!)
Fix Description: The admin server was defaulting to EXPORT instead of DOMESTIC so was not enabling the domestic ciphers by default.  Then when the admin server SSL was configured, it would give it a list of old ciphers not currently supported by Firefox.  Also, we are still being affected by Bug 151705 Processed: AS 6.2 Console cipher preferences bug, so when the list of ciphers pops up, you have to make sure all of the SSLv2 ciphers are disabled and the SSLv3 and TLS ciphers you want to use are enabled.
I also discovered a problem with the ugdsconfig CGI program - it was being caught by the admldapBuildInfoSSL problem where it tries to use the SIEDN to bind.  So I had to use the same hack used in mod_admserv and elsewhere to force it to use the correct bind dn and password.
Finally, I updated the list of ciphers in console.conf to reflect the full list of ciphers supported by mod_nss.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no



Index: console.conf.in
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cfgstuff/console.conf.in,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- console.conf.in	22 Jun 2007 01:34:19 -0000	1.2
+++ console.conf.in	18 Dec 2007 19:55:23 -0000	1.3
@@ -95,7 +95,8 @@
 #   SSL Cipher Suite:
 #   List the ciphers that the client is permitted to negotiate.
 #   See the mod_nss documentation for a complete list.
-NSSCipherSuite -des,-rc2export,+rc4export,+desede3,+rc4,-rc2,+rsa_rc2_40_md5,+rsa_rc4_128_md5,+rsa_3des_sha,+rsa_rc4_40_md5,+fips_des_sha,+fips_3des_sha,+rsa_des_sha,-rsa_null_md5
+# SSL 3 ciphers. SSL 2 is disabled by default.
+NSSCipherSuite +rsa_rc4_128_md5,+rsa_rc4_128_sha,+rsa_3des_sha,-rsa_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,+fips_3des_sha,-fips_des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-rsa_des_56_sha,-rsa_rc4_56_sha,+rsa_aes_128_sha,+rsa_aes_256_sha
 
 NSSProtocol SSLv3,TLSv1