pupmod-simp-crypto_policy

Table of Contents

• Description
• Setup
  • What crypto_policy affects
• Usage
• Reference
• Limitations
• Development

Description

Manage, and provide information about, the system-wide crypto policies.

See update-crypto-policy(8) for additional information.

Setup

What crypto_policy affects

Manages the system-wide crypto policy.

Applications may opt-in, or out, of usage by following the steps outlined in update-crypto-=policy(8).

Usage

class { 'crypto_policy': }

Reference

See REFERENCE.md for the full module reference.

Limitations

SIMP Puppet modules are generally intended for use on Red Hat Enterprise Linux and compatible distributions, such as CentOS. Please see the metadata.json file for the most up-to-date list of supported operating systems, Puppet versions, and module dependencies.

Development

Please read our Contribution Guide.

If you find any issues, they can be submitted to our JIRA.

Reference

Table of Contents

Classes

• crypto_policy: Configure the system crypto policy settings
• crypto_policy::install: manage the installation of the crypto policy package(s)
• crypto_policy::update: Helper class for triggering a run of update-crypto-policies

Classes

crypto_policy

Configure the system crypto policy settings

Parameters

The following parameters are available in the crypto_policy class.

ensure

Data type: Optional[String]

The system crypto policy that you wish to enforce

• Will be checked against $facts['crypto_policy__state']['global_policies_available'] for validity

Default value: simplib::lookup('simp_options::fips', { 'default_value' => pick($facts['fips_enabled'], false) })

validate_policy

Data type: Boolean

Disables validiation of the $ensure parameter prior to application

Default value: true

force_fips_override

Data type: Boolean

Set this to indicate that you wish to force the system into the mode specified by $ensure even if the system is in FIPS mode

• WARNING: This may break all crypto on your system

Default value: false

manage_installation

Data type: Boolean

Enables management of the system installation via the crypto_policy::install class

Default value: true

crypto_policy::install

manage the installation of the crypto policy package(s)

Parameters

The following parameters are available in the crypto_policy::install class.

packages

Data type: Array[String[1]]

The list of packages to manage for this capability

Default value: ['crypto-policies']

package_ensure

Data type: String[1]

The 'ensure' parameter for $packages

Default value: simplib::lookup('simp_options::package_ensure', { 'default_value' => 'installed' })

crypto_policy::update

This is deliberately not kept private in case other classes need to trigger an update but do not wish to include full management

Parameters

The following parameters are available in the crypto_policy::update class.

command

Data type: Stdlib::Absolutepath

The path to the command to be executed

Default value: '/usr/bin/update-crypto-policies'

• Tue May 12 2020 Trevor Vaughan tvaughan@onyxpoint.com - 0.1.0-0

• Initial module release