use the order Tested > Settings > References everywhere, corrected

some typographic issues with paragraphDiamond and paragraph

diff --git a/src/practical_settings/DBs.tex b/src/practical_settings/DBs.tex
index 4f54175..5a2c2ee 100644 (file)
--- a/src/practical_settings/DBs.tex
+++ b/src/practical_settings/DBs.tex
@@ -68,12 +68,6 @@ show variables like '%ssl%';
 \todo{not tested}
 
 
-\subsubsection{References}
-\begin{itemize*}
-  \item IMB Db2 Documentation on \emph{Supported cipher suites} \url{http://pic.dhe.ibm.com/infocenter/db2luw/v9r7/index.jsp?topic=\%2Fcom.ibm.db2.luw.admin.sec.doc\%2Fdoc\%2Fc0053544.html}
-\end{itemize*}
-
-
 \subsubsection{Settings}
 \paragraph*{ssl\_cipherspecs}
 In the link above the whole SSL-configuration is described in-depth. The following command shows only how to set the recommended ciphersuites.
@@ -102,6 +96,11 @@ TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
 \end{lstlisting}
 
 
+\subsubsection{References}
+\begin{itemize*}
+  \item IMB Db2 Documentation on \emph{Supported cipher suites} \url{http://pic.dhe.ibm.com/infocenter/db2luw/v9r7/index.jsp?topic=\%2Fcom.ibm.db2.luw.admin.sec.doc\%2Fdoc\%2Fc0053544.html}
+\end{itemize*}
+
 %% ---------------------------------------------------------------------- 
 
 \subsection{PostgreSQL}
@@ -112,14 +111,6 @@ TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
 \end{itemize*}
 
 
-\subsubsection{References}
-\begin{itemize*}
-  \item It's recommended to read \url{http://www.postgresql.org/docs/9.1/interactive/runtime-config-connection.html\#RUNTIME-CONFIG-CONNECTION-SECURITY} (please edit the version with your preferred one).
-  \item PostgreSQL Documentation on \emph{Secure TCP/IP Connections with SSL}: \url{http://www.postgresql.org/docs/9.1/static/ssl-tcp.html}
-  \item PostgreSQL Documentation on \emph{host-based authentication}: \url{http://www.postgresql.org/docs/current/static/auth-pg-hba-conf.html}
-\end{itemize*}
-
-
 \subsubsection{Settings}
 To start in SSL mode the server.crt and server.key must exist in the server's data directory \$PGDATA.
 
@@ -139,6 +130,14 @@ ssl_ciphers = '%*\cipherStringB*)'
 \end{lstlisting}
 
 
+\subsubsection{References}
+\begin{itemize*}
+  \item It's recommended to read \url{http://www.postgresql.org/docs/9.1/interactive/runtime-config-connection.html\#RUNTIME-CONFIG-CONNECTION-SECURITY} (please edit the version with your preferred one).
+  \item PostgreSQL Documentation on \emph{Secure TCP/IP Connections with SSL}: \url{http://www.postgresql.org/docs/9.1/static/ssl-tcp.html}
+  \item PostgreSQL Documentation on \emph{host-based authentication}: \url{http://www.postgresql.org/docs/current/static/auth-pg-hba-conf.html}
+\end{itemize*}
+
+
 \subsubsection{How to test}
 To test your ssl settings, run psql with the sslmode parameter:
 \begin{lstlisting}

diff --git a/src/practical_settings/mailserver.tex b/src/practical_settings/mailserver.tex
index 71cd01f..8d9faeb 100644 (file)
--- a/src/practical_settings/mailserver.tex
+++ b/src/practical_settings/mailserver.tex
@@ -339,7 +339,6 @@ to get even more TLS information logged.
 
 
 \paragraphDiamond{server mode (incoming)}
-
 In the main config section of Exim add:
 
 \begin{lstlisting}
@@ -430,7 +429,7 @@ Exim currently (4.82) does not support elliptic curves with OpenSSL. This means
 There already is a working patch to provide support:
 \url{http://bugs.exim.org/show_bug.cgi?id=1397}
 
-\paragraphDiamond{How to test}
+\subsubsection{How to test}
 \begin{lstlisting}
 openssl s_client -starttls smtp -crlf -connect SERVER.TLD:25
 \end{lstlisting}

diff --git a/src/practical_settings/proxy_solutions.tex b/src/practical_settings/proxy_solutions.tex
index 8148edc..827c019 100644 (file)
--- a/src/practical_settings/proxy_solutions.tex
+++ b/src/practical_settings/proxy_solutions.tex
@@ -22,18 +22,15 @@ Conclusion: Don't forget to check your proxy solutions SSL-capabilities. Also do
 As of squid-3.2.7 (01 Feb 2013) there is support for the OpenSSL NO\_Compression option within squid config (CRIME attack) and if you combine that in the config file, with an enforcement of the server cipher preferences (BEAST Attack) you are safe.
 
 
-\paragraphDiamond{squid.conf}
-
+\paragraph*{squid.conf}
 \todo{UNTESTED!}
 \begin{lstlisting}
 options=NO_SSLv2,NO_TLSv1,NO_Compression,CIPHER_SERVER_PREFERENCE 
 cipher=%*\cipherStringB*)
 \end{lstlisting}
 
-\paragraphDiamond{squid.conf}
-
+\paragraph*{squid.conf}
 %% http://forum.pfsense.org/index.php?topic=63262.0
-
 \todo{UNTESTED!}
 \begin{lstlisting}
                NO_SSLv2    Disallow the use of SSLv2
@@ -77,8 +74,7 @@ For squid Versions before 3.2.7 use this patch against a vanilla source-tree:
 
 BlueCoat Proxy SG Appliances can be used as forward and reverse proxies. The reverse proxy feature is rather under-developed, and while it is possible and supported, there only seems to be limited use of this feature "in the wild" - nonetheless there are a few cipher suites to choose from, when enabling SSL features.
 
-\paragraph{Only allow TLS 1.0,1.1 and 1.2 protocols:} \mbox{}
-
+\paragraph*{Only allow TLS 1.0,1.1 and 1.2 protocols:}
 \begin{lstlisting}
 $conf t
 $(config)ssl
@@ -87,8 +83,7 @@ $(config device-profile default)protocol tlsv1 tlsv1.1 tlsv1.2
   ok
 \end{lstlisting}
 
-\paragraph*{Select your accepted cipher-suites:} \mbox{}
-
+\paragraph*{Select your accepted cipher-suites:}
 \begin{lstlisting}
 $conf t
 Enter configuration commands, one per line.  End with CTRL-Z.
@@ -130,6 +125,7 @@ Disabling protocols and ciphers in a forward proxy environment could lead to une
   \item Pound 2.6
 \end{itemize*}
 
+\subsubsection{Settings}
 \begin{lstlisting}
 # HTTP Listener, redirects to HTTPS
 ListenHTTP

diff --git a/src/practical_settings/vpn.tex b/src/practical_settings/vpn.tex
index f44864e..b753c50 100644 (file)
--- a/src/practical_settings/vpn.tex
+++ b/src/practical_settings/vpn.tex
@@ -244,7 +244,7 @@ that is then negotiated as usual with TLS, the \verb|cipher|
 and \verb|auth| options both take a single argument that must match on
 client and server.
 
-\paragraphDiamond{Server Configuration}
+\paragraph*{Server Configuration}
 % the cipherlist here is config B without the ECDHE strings, because
 % it must fit in 256 bytes...
 % DO NOT CHANGE TO THE CIPHERSTRING MACRO!
@@ -254,8 +254,7 @@ cipher AES-256-CBC
 auth SHA384
 \end{lstlisting}
 
-\paragraph{Client Configuration}\mbox{}
-
+\paragraphDiamond{Client Configuration}
 Client and server have to use compatible configurations, otherwise they can't communicate.
 The \verb|cipher| and \verb|auth| directives have to be identical.
 
@@ -298,16 +297,14 @@ The configuration shown above is compatible with all tested versions.
 
 \subsubsection{Additional settings}
 
-\paragraph{Key renegotiation interval}\mbox{}
-
+\paragraphDiamond{Key renegotiation interval}
 The default for renegotiation of encryption keys is one hour
 (\verb|reneg-sec 3600|). If you
 transfer huge amounts of data over your tunnel, you might consider
 configuring a shorter interval, or switch to a byte- or packet-based
 interval (\verb|reneg-bytes| or \verb|reneg-pkts|).
 
-\paragraph{Fixing ``easy-rsa''}\mbox{}
-
+\paragraphDiamond{Fixing ``easy-rsa''}
 When installing an OpenVPN server instance, you are probably using
 \emph{easy-rsa} to generate keys and certificates.
 The file \verb|vars| in the easyrsa installation directory has a
@@ -433,7 +430,7 @@ Legacy ASA models (e.g. 5505, 5510, 5520, 5540, 5550) do not offer the possibili
 
 \subsubsection{References}
 \begin{itemize*}
-  \item \url{http://www.cisco.com/en/US/docs/security/asa/roadmap/asaroadmap.html}\\
+  \item \url{http://www.cisco.com/en/US/docs/security/asa/roadmap/asaroadmap.html}
   \item \url{http://www.cisco.com/web/about/security/intelligence/nextgen_crypto.html}
 \end{itemize*}