bertvv / ansible-role-httpd Goto Github PK

Hi bertvv.httpd has not been updated to support Centos 7. The version of httpd.conf.j2 used is for Centos 6 (?) as it it has 'Include conf.d/.conf'. This overwrites the installed version of httpd.conf which has 'include conf.modules.d/.conf. ls

ansible-role-httpd has been updated to use the latest version of httpd.conf with the include for conf.modules.d/*.conf and runs correctly. However, its meta/main.yml has an unnecessary dependency for bertvv.httpd which pulls in the broken code and again overwrites httpd.conf with the old version, ignoring all the conf files in conf.modules.d.

Analysis of a server with this role on ssllabs.com yields score "C", so this should be better!

Issues reported:

• vulnerable to POODLE attack
• accepts RC4
• accepts SSL3
• no support for "forward secrecy"
• accepts insecure cipher suites TLS_RSA_WITH_RC4_128_SHA and TLS_ECDHE_RSA_WITH_RC4_128_SHA

Two ways: self-signed or via letsencrypt

I use an Azure VM with RHEL 7.6. I get this:

TASK [httpd : Generate default SSL certificate] *****************************************************************************************************************************************
fatal: [****]: FAILED! => {"changed": false, "cmd": "/usr/libexec/httpd-ssl-gencerts", "msg": "[Errno 2] No such file or directory", "rc": 2}

when installing wordpress I get this error:

TASK [bertvv.httpd : include_vars] ********************************************************************************************************
ok: [blog] => (item=/root/.ansible/roles/bertvv.wordpress/vars/RedHat-8.yml)

TASK [bertvv.httpd : Ensure Apache is installed] ******************************************************************************************
fatal: [blog]: FAILED! => {"msg": "'httpd_packages' is undefined"}

This seems to be the case because httpd only ships RedHat.yml and wordpress has RedHat-8.yml
a workaround was cp /root/.ansible/roles/bertvv.httpd/vars/RedHat.yml /root/.ansible/roles/bertvv.httpd/vars/RedHat-8.yml