CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

SSL Module - Change registry settings

Browse Source
This commit is contained in:
Mike Reeves
2018-07-17 12:34:22 -04:00
parent 4128a2ea4e
commit 4046f5fc00
2 changed files with 16 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
salt/ca/files/signing_policies.conf
View File

@@ -1,5 +1,20 @@
x509_signing_policies: x509_signing_policies:
filebeat: filebeat:
- minions: '*'
- signing_private_key: /etc/pki/ca.key
- signing_cert: /etc/pki/ca.crt
- C: US
- ST: Utah
- L: Salt Lake City
- basicConstraints: "critical CA:false"
- keyUsage: "digitalSignature, nonRepudiation"
- extendedkeyUsage: "serverAuth, clientAuth"
- keyUsage: "critical keyEncipherment"
- subjectKeyIdentifier: hash
- authorityKeyIdentifier: keyid,issuer:always
- days_valid: 3000
- copypath: /etc/pki/issued_certs/
registry:
- minions: '*' - minions: '*'
- signing_private_key: /etc/pki/ca.key - signing_private_key: /etc/pki/ca.key
- signing_cert: /etc/pki/ca.crt - signing_cert: /etc/pki/ca.crt

6
salt/ssl/init.sls
View File

@@ -26,8 +26,6 @@ m2cryptopkgs:
- CN: {{ master }} - CN: {{ master }}
- days_remaining: 3000 - days_remaining: 3000
- backup: True - backup: True
- keyUsage: "digitalSignature, nonRepudiation"
- extendedkeyUsage: "serverAuth, clientAuth"
- managed_private_key: - managed_private_key:
name: /etc/pki/filebeat.key name: /etc/pki/filebeat.key
bits: 4096 bits: 4096
@@ -53,7 +51,7 @@ fbcrtlink:
/etc/pki/registry.crt: /etc/pki/registry.crt:
x509.certificate_managed: x509.certificate_managed:
- ca_server: {{ master }} - ca_server: {{ master }}
- signing_policy: filebeat - signing_policy: registry
- public_key: /etc/pki/registry.key - public_key: /etc/pki/registry.key
- CN: {{ master }} - CN: {{ master }}
- days_remaining: 3000 - days_remaining: 3000
@@ -72,8 +70,6 @@ fbcrtlink:
- signing_policy: filebeat - signing_policy: filebeat
- public_key: /opt/so/conf/filebeat/etc/pki/filebeat.key - public_key: /opt/so/conf/filebeat/etc/pki/filebeat.key
- CN: {{ master }} - CN: {{ master }}
- keyUsage: "digitalSignature, nonRepudiation"
- extendedkeyUsage: "serverAuth, clientAuth"
- days_remaining: 3000 - days_remaining: 3000
- backup: True - backup: True
- managed_private_key: - managed_private_key: