Strong SSL ciphers option

diff --git a/webmin/CHANGELOG b/webmin/CHANGELOG
index a00fb66..7f4366e 100644 (file)
--- a/webmin/CHANGELOG
+++ b/webmin/CHANGELOG
@@ -99,3 +99,5 @@ Added an option on the Logging page to record logins and logouts from Webmin, fo
 Added a field to the Debugging Log File page to select modules to debug for.
 ---- Changes since 1.500 ----
 Added an option to the User Interface page to always put the hostname before the page title.
+---- Changes since 1.510 ----
+Strong PCI-compliant ciphers can now be selected on the SSL Encryption page.

diff --git a/webmin/change_ssl.cgi b/webmin/change_ssl.cgi
index f48d0c5..4ec0654 100755 (executable)
--- a/webmin/change_ssl.cgi
+++ b/webmin/change_ssl.cgi
@@ -20,9 +20,12 @@ else {
        $in{'version'} =~ /^\d+$/ || &error($text{'ssl_eversion'});
        $miniserv{'ssl_version'} = $in{'version'};
        }
-if ($in{'cipher_list_def'}) {
+if ($in{'cipher_list_def'} == 1) {
        delete($miniserv{'ssl_cipher_list'});
        }
+elsif ($in{'cipher_list_def'} == 2) {
+       $miniserv{'ssl_cipher_list'} = $strong_ssl_ciphers;
+       }
 else {
        $in{'cipher_list'} =~ /^\S+$/ || &error($text{'ssl_ecipher_list'});
        $miniserv{'ssl_cipher_list'} = $in{'cipher_list'};

diff --git a/webmin/edit_ssl.cgi b/webmin/edit_ssl.cgi
index a829442..6b1d1b0 100755 (executable)
--- a/webmin/edit_ssl.cgi
+++ b/webmin/edit_ssl.cgi
@@ -54,9 +54,16 @@ print &ui_table_row($text{'ssl_version'},
        &ui_opt_textbox("version", $miniserv{'ssl_version'}, 4,
                        $text{'ssl_auto'}));
 
+$clist = $miniserv{'ssl_cipher_list'};
+$cmode = !$clist ? 1 :
+        $clist eq $strong_ssl_ciphers ? 2 : 0;
 print &ui_table_row($text{'ssl_cipher_list'},
-       &ui_opt_textbox("cipher_list", $miniserv{'ssl_cipher_list'}, 30,
-                       $text{'ssl_auto'}));
+       &ui_radio("cipher_list_def", $cmode,
+                 [ [ 1, $text{'ssl_auto'}."<br>" ],
+                   [ 2, $text{'ssl_strong'}."<br>" ],
+                   [ 0, $text{'ssl_clist'}." ".
+                        &ui_textbox("cipher_list",
+                                    $cmode == 0 ? $clist : "", 30) ] ]));
 
 print &ui_table_row($text{'ssl_extracas'},
        &ui_textarea("extracas", join("\n",split(/\s+/, $miniserv{'extracas'})),

diff --git a/webmin/lang/en b/webmin/lang/en
index 08382f1..c8133b5 100644 (file)
--- a/webmin/lang/en
+++ b/webmin/lang/en
@@ -337,6 +337,8 @@ ssl_return=SSL keys
 ssl_version=SSL protocol version
 ssl_no2=Allow SSL version 2 browsers?
 ssl_cipher_list=Allowed SSL ciphers
+ssl_strong=Only strong PCI-compliant ciphers
+ssl_clist=Listed ciphers
 ssl_ecipher_list=Missing or invalid cipher list - must be like <tt>HIGH:-SSLv2:-aNULL</tt>
 ssl_auto=Detect automatically
 ssl_eversion=Missing or invalid version number

diff --git a/webmin/webmin-lib.pl b/webmin/webmin-lib.pl
index c246669..bff21ca 100755 (executable)
--- a/webmin/webmin-lib.pl
+++ b/webmin/webmin-lib.pl
@@ -52,6 +52,8 @@ $detect_operating_system_cache = "$module_config_directory/oscache";
 $record_login_cmd = "$config_directory/login.pl";
 $record_logout_cmd = "$config_directory/logout.pl";
 
+$strong_ssl_ciphers = "ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM";
+
 =head2 setup_ca
 
 Internal function to create all the configuration files needed for the Webmin