Strong SSL ciphers option

webmin/CHANGELOG

@@ -99,3 +99,5 @@ Added an option on the Logging page to record logins and logouts from Webmin, fo
 Added a field to the Debugging Log File page to select modules to debug for.
 ---- Changes since 1.500 ----
 Added an option to the User Interface page to always put the hostname before the page title.
+---- Changes since 1.510 ----
+Strong PCI-compliant ciphers can now be selected on the SSL Encryption page.

webmin/change_ssl.cgi

@@ -20,9 +20,12 @@ else {
 	$in{'version'} =~ /^\d+$/ || &error($text{'ssl_eversion'});
 	$miniserv{'ssl_version'} = $in{'version'};
 	}
-if ($in{'cipher_list_def'}) {
+if ($in{'cipher_list_def'} == 1) {
 	delete($miniserv{'ssl_cipher_list'});
 	}
+elsif ($in{'cipher_list_def'} == 2) {
+	$miniserv{'ssl_cipher_list'} = $strong_ssl_ciphers;
+	}
 else {
 	$in{'cipher_list'} =~ /^\S+$/ || &error($text{'ssl_ecipher_list'});
 	$miniserv{'ssl_cipher_list'} = $in{'cipher_list'};

webmin/edit_ssl.cgi

@@ -54,9 +54,16 @@ print &ui_table_row($text{'ssl_version'},
 	&ui_opt_textbox("version", $miniserv{'ssl_version'}, 4,
 			$text{'ssl_auto'}));
 
+$clist = $miniserv{'ssl_cipher_list'};
+$cmode = !$clist ? 1 :
+	 $clist eq $strong_ssl_ciphers ? 2 : 0;
 print &ui_table_row($text{'ssl_cipher_list'},
-	&ui_opt_textbox("cipher_list", $miniserv{'ssl_cipher_list'}, 30,
-			$text{'ssl_auto'}));
+	&ui_radio("cipher_list_def", $cmode,
+		  [ [ 1, $text{'ssl_auto'}."<br>" ],
+		    [ 2, $text{'ssl_strong'}."<br>" ],
+		    [ 0, $text{'ssl_clist'}." ".
+			 &ui_textbox("cipher_list",
+				     $cmode == 0 ? $clist : "", 30) ] ]));
 
 print &ui_table_row($text{'ssl_extracas'},
 	&ui_textarea("extracas", join("\n",split(/\s+/, $miniserv{'extracas'})),

webmin/lang/en

@@ -337,6 +337,8 @@ ssl_return=SSL keys
 ssl_version=SSL protocol version
 ssl_no2=Allow SSL version 2 browsers?
 ssl_cipher_list=Allowed SSL ciphers
+ssl_strong=Only strong PCI-compliant ciphers
+ssl_clist=Listed ciphers
 ssl_ecipher_list=Missing or invalid cipher list - must be like <tt>HIGH:-SSLv2:-aNULL</tt>
 ssl_auto=Detect automatically
 ssl_eversion=Missing or invalid version number

webmin/webmin-lib.pl

@@ -52,6 +52,8 @@ $detect_operating_system_cache = "$module_config_directory/oscache";
 $record_login_cmd = "$config_directory/login.pl";
 $record_logout_cmd = "$config_directory/logout.pl";
 
+$strong_ssl_ciphers = "ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM";
+
 =head2 setup_ca
 
 Internal function to create all the configuration files needed for the Webmin