53 lines
1.3 KiB
Diff
53 lines
1.3 KiB
Diff
|
From b31f1ab9a0e1c010037d2d660e3ce4ea7eb07d6c Mon Sep 17 00:00:00 2001
|
||
|
|
From: Alexander Scheel <ascheel@redhat.com>
|
||
|
|
Date: Wed, 5 Aug 2020 16:10:52 -0400
|
||
|
|
Subject: [PATCH] Use fixed FIPS-approved dhparam by default
|
||
|
|
|
||
|
|
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
|
||
|
|
---
|
||
|
|
raddb/certs/Makefile | 2 +-
|
||
|
|
raddb/certs/bootstrap | 7 +++++--
|
||
|
|
2 files changed, 6 insertions(+), 3 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/raddb/certs/Makefile b/raddb/certs/Makefile
|
||
|
|
index 5cbfd46..41b7aea 100644
|
||
|
|
--- a/raddb/certs/Makefile
|
||
|
|
+++ b/raddb/certs/Makefile
|
||
|
|
@@ -59,7 +59,7 @@ passwords.mk: server.cnf ca.cnf client.cnf inner-server.cnf
|
||
|
|
#
|
||
|
|
######################################################################
|
||
|
|
dh:
|
||
|
|
- $(OPENSSL) dhparam -out dh -2 $(DH_KEY_SIZE)
|
||
|
|
+ cp rfc3526-group-18-8192.dhparam dh
|
||
|
|
|
||
|
|
######################################################################
|
||
|
|
#
|
||
|
|
diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap
|
||
|
|
index 9920ecf..59b3310 100755
|
||
|
|
--- a/raddb/certs/bootstrap
|
||
|
|
+++ b/raddb/certs/bootstrap
|
||
|
|
@@ -13,6 +13,10 @@
|
||
|
|
umask 027
|
||
|
|
cd `dirname $0`
|
||
|
|
|
||
|
|
+if [ ! -e random ]; then
|
||
|
|
+ ln -sf /dev/urandom random
|
||
|
|
+fi
|
||
|
|
+
|
||
|
|
make -h > /dev/null 2>&1
|
||
|
|
|
||
|
|
#
|
||
|
|
@@ -35,8 +39,7 @@ fi
|
||
|
|
# re-generate these commands.
|
||
|
|
#
|
||
|
|
if [ ! -e dh ]; then
|
||
|
|
- openssl dhparam -out dh 2048 || exit 1
|
||
|
|
- ln -sf /dev/urandom random
|
||
|
|
+ cp rfc3526-group-18-8192.dhparam dh
|
||
|
|
fi
|
||
|
|
|
||
|
|
if [ ! -e server.key ]; then
|
||
|
|
--
|
||
|
|
2.26.2
|
||
|
|
|