[cpp-sp] branch master updated: SSPCPP-708 - "Safe" default cipher suites.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=71091ac00b66f8ff60baee22e8785ec584619d2a

The following commit(s) were added to refs/heads/master by this push:
       new  71091ac   SSPCPP-708 - "Safe" default cipher suites.
71091ac is described below

commit 71091ac00b66f8ff60baee22e8785ec584619d2a
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Mar 21 16:59:38 2018 -0400

    SSPCPP-708 - "Safe" default cipher suites.
---
 configs/example-shibboleth3.xml | 2 +-
 configs/shibboleth3.xml         | 3 ++-
 configs/win-shibboleth3.xml     | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/configs/example-shibboleth3.xml b/configs/example-shibboleth3.xml
index 27f7ee4..423006a 100644
--- a/configs/example-shibboleth3.xml
+++ b/configs/example-shibboleth3.xml
@@ -95,7 +95,7 @@
                          REMOTE_USER="eppn persistent-id targeted-id"
                          metadataAttributePrefix="Meta-"
                          sessionHook="/Shibboleth.sso/AttrChecker"
-                         cipherSuites="ECDHE+AESGCM:ECDHE:!aNULL:!eNULL:!LOW:!EXPORT:!RC4:!SHA:!SSLv2">
+                         cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
 
         <!--
         Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
diff --git a/configs/shibboleth3.xml b/configs/shibboleth3.xml
index 7cc5a8c..7e8bc31 100644
--- a/configs/shibboleth3.xml
+++ b/configs/shibboleth3.xml
@@ -21,7 +21,8 @@
 
     <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
     <ApplicationDefaults entityID="https://sp.example.org/shibboleth"
-                         REMOTE_USER="eppn persistent-id targeted-id">
+                         REMOTE_USER="eppn persistent-id targeted-id"
+                         cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
 
         <!--
         Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
diff --git a/configs/win-shibboleth3.xml b/configs/win-shibboleth3.xml
index f6166b0..a9193a9 100644
--- a/configs/win-shibboleth3.xml
+++ b/configs/win-shibboleth3.xml
@@ -65,7 +65,7 @@
     -->
     <ApplicationDefaults entityID="https://sp.example.org/shibboleth"
                          REMOTE_USER="eppn persistent-id targeted-id"
-                         cipherSuites="ECDHE+AESGCM:ECDHE:!aNULL:!eNULL:!LOW:!EXPORT:!RC4:!SHA:!SSLv2">
+                         cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
 
         <!--
         Controls session lifetimes, address checks, cookie handling, and the protocol handlers.

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.