Current implementation of Majic Ansible Roles enforces use of TLS with strong ciphers wherever that is feasible. However, at the moment the Diffie-Hellman parameters, used in combination with a number of ciphers, are kept at their default values, which in most cases results in key sizes of 512 or 1024 bits. There is a number of problems with this:

• It is insecure due to existence of Logjam attack.
• Certain TLS implementations will trigger errors upon encountering such small key sizes, resulting in an effective inability to use the services (for example, mail clients and Firefox on Ubuntu 20.04).

It would instead be better to generate DH parameters for services that use TLS, and to configure the services to use the generated DH parameters explicitly.

The following should be done:

• Update the following roles:
  • ldap_server
  • mail_forwarder
  • mail_server
  • web_server
  • xmpp_server
• Generate a separate DH parameter for each service.
• Configure the services to use the custom DH parameter.
• Implement the necessary tests.
• Update role reference documentation.
• Update release notes.

This has been insecure for some time, and it would be desirable to switch to both explicitly generating the keys during deployment, and making sure that the generated key size is 2048 bits.