Re: [Pound Mailing List] Getting pound to not support DES
Joe Gooch <[email protected]> Tue, 12 Dec 2017 21:29:43 +0000
| Newsgroups | gmane.comp.web.pound.general |
|---|---|
| Message-ID | <[email protected]> |
--_000_939BA40F09CC48219675D6147A2C5FC0sapphirek12com_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable ...and per this https://www.openssl.org/blog/blog/2016/08/24/sweet32/ 3des is in MEDIUM Add !3DES Joe Sent from my iPhone On Dec 12, 2017, at 4:11 PM, Brad Allison <[email protected]<mailto:br= [email protected]>> wrote: Here's my Ciphers in pound.cfg: Ciphers "ALL:!ADH:!EXPORT:!SSLv2:!aNULL:!eNULL:!DES:!MD5:!PSK:!RC4:!DH:!LO= W:+HIGH:+MEDIUM" Then I do a sslscan on the pound server and save the data to /tmp/sslscan.o= ut, First I check for MD5: brad.allison@devops-west:/usr/local/devops/bin> grep MD5 /tmp/sslscan.out |= wc -l 0 Then I check for RC4: brad.allison@devops-west:/usr/local/devops/bin> grep RC4 /tmp/sslscan.out |= wc -l 0 Then I check for DES: brad.allison@devops-west:/usr/local/devops/bin> grep DES /tmp/sslscan.out |= wc -l 6 brad.allison@devops-west:/usr/local/devops/bin> grep DES /tmp/sslscan.out Accepted TLSv1 112 bits ECDHE-RSA-DES-CBC3-SHA Accepted TLSv1 112 bits DES-CBC3-SHA Accepted TLS11 112 bits ECDHE-RSA-DES-CBC3-SHA Accepted TLS11 112 bits DES-CBC3-SHA Accepted TLS12 112 bits ECDHE-RSA-DES-CBC3-SHA Accepted TLS12 112 bits DES-CBC3-SHA So why is it allowing DES support when I have !DES in my Ciphers list? -brad --_000_939BA40F09CC48219675D6147A2C5FC0sapphirek12com_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > </head> <body dir=3D"auto"> ...and per this <a href=3D"https://www.openssl.org/blog/blog/2016/08/2= 4/sweet32/">https://www.openssl.org/blog/blog/2016/08/24/sweet32/</a> <div><br> </div> <div>3des is in MEDIUM</div> <div><br> </div> <div>Add !3DES<br> <br> <div>Joe <div>Sent from my iPhone</div> </div> <div><br> On Dec 12, 2017, at 4:11 PM, Brad Allison <<a href=3D"mailto:brad.alliso= [email protected]">[email protected]</a>> wrote:<br> <br> </div> <blockquote type=3D"cite"> <div> <div dir=3D"ltr">Here's my Ciphers in pound.cfg: <div><br> </div> <blockquote style=3D"margin:0 0 0 40px;border:none;padding:0px"> <div> <div> <div><font face=3D"monospace, monospace" color=3D"#0000ff"> Ciphers &q= uot;ALL:!ADH:!EXPORT:!SSLv2:!aNULL:!eNULL:!DES:!MD5:!PSK:!RC4:!DH:!LOW:+= ;HIGH:+MEDIUM"</font></div> </div> </div> </blockquote> <div> <div><br> </div> </div> <div>Then I do a sslscan on the pound server and save the data to /tmp/ssls= can.out, </div> <div><br> </div> <div>First I check for MD5:</div> <div><br> </div> <blockquote style=3D"margin:0 0 0 40px;border:none;padding:0px"> <div> <div><font face=3D"monospace, monospace" color=3D"#0000ff">brad.allison@dev= ops-west:/usr/local/devops/bin> grep MD5 /tmp/sslscan.out | wc -l</font>= </div> </div> <div> <div><font face=3D"monospace, monospace" color=3D"#0000ff">0</font></div> </div> </blockquote> <div><br> </div> <div>Then I check for RC4:</div> <div><br> </div> <blockquote style=3D"margin:0 0 0 40px;border:none;padding:0px"> <div> <div><font face=3D"monospace, monospace" color=3D"#0000ff">brad.allison@dev= ops-west:/usr/local/devops/bin> grep RC4 /tmp/sslscan.out | wc -l</font>= </div> </div> <div> <div><font face=3D"monospace, monospace" color=3D"#0000ff">0</font></div> </div> </blockquote> <div> <div><br> </div> <div>Then I check for DES:</div> <div><br> </div> </div> <blockquote style=3D"margin:0 0 0 40px;border:none;padding:0px"> <div> <div><font face=3D"monospace, monospace" color=3D"#0000ff">brad.allison@dev= ops-west:/usr/local/devops/bin> grep DES /tmp/sslscan.out | wc -l</font>= </div> </div> <div> <div><font face=3D"monospace, monospace" color=3D"#0000ff">6</font></div> </div> <div> <div><font face=3D"monospace, monospace" color=3D"#0000ff"><br> </font></div> </div> <div> <div><font face=3D"monospace, monospace" color=3D"#0000ff">brad.allison@dev= ops-west:/usr/local/devops/bin> grep DES /tmp/sslscan.out </font></= div> </div> <div> <div><font face=3D"monospace, monospace" color=3D"#0000ff"> Ac= cepted TLSv1 112 bits ECDHE-RSA-DES-CBC3-SHA</font></div> </div> <div> <div><font face=3D"monospace, monospace" color=3D"#0000ff"> Ac= cepted TLSv1 112 bits DES-CBC3-SHA</font></div> </div> <div> <div><font face=3D"monospace, monospace" color=3D"#0000ff"> Ac= cepted TLS11 112 bits ECDHE-RSA-DES-CBC3-SHA</font></div> </div> <div> <div><font face=3D"monospace, monospace" color=3D"#0000ff"> Ac= cepted TLS11 112 bits DES-CBC3-SHA</font></div> </div> <div> <div><font face=3D"monospace, monospace" color=3D"#0000ff"> Ac= cepted TLS12 112 bits ECDHE-RSA-DES-CBC3-SHA</font></div> </div> <div> <div><font face=3D"monospace, monospace" color=3D"#0000ff"> Ac= cepted TLS12 112 bits DES-CBC3-SHA</font></div> </div> </blockquote> <div><br> </div> <div><br> </div> <div>So why is it allowing DES support when I have !DES in my Ciphers list?= </div> <div><br> </div> <div>-brad</div> </div> </div> </blockquote> </div> </body> </html> --_000_939BA40F09CC48219675D6147A2C5FC0sapphirek12com_-- -- To unsubscribe send an email with subject unsubscribe to [email protected] Please contact [email protected] for questions.