[Pound Mailing List] Re: Getting pound to not support DES
Brad Allison <[email protected]> Tue, 12 Dec 2017 16:28:29 -0500
| Newsgroups | gmane.comp.web.pound.general |
|---|---|
| Message-ID | <[email protected]> |
--001a114e22ae016f4c05602b55fe Content-Type: text/plain; charset="UTF-8" Nevermind. I found the solution. I added !DES to the list of Ciphers to exclude and it excluded those two CBC3 based ciphers. Ciphers "ALL:!ADH:!EXPORT:!SSLv2:!aNULL:!eNULL:!3DES:!DES:!MD5:!PSK:!RC4:!DH:!LOW:+HIGH:+MEDIUM" On Tue, Dec 12, 2017 at 4:04 PM, Brad Allison <[email protected]> wrote: > Here's my Ciphers in pound.cfg: > > Ciphers "ALL:!ADH:!EXPORT:!SSLv2:!aNULL:!eNULL:!DES:!MD5:!PSK:! > RC4:!DH:!LOW:+HIGH:+MEDIUM" > > > Then I do a sslscan on the pound server and save the data to > /tmp/sslscan.out, > > First I check for MD5: > > brad.allison@devops-west:/usr/local/devops/bin> grep MD5 /tmp/sslscan.out > | wc -l > 0 > > > Then I check for RC4: > > brad.allison@devops-west:/usr/local/devops/bin> grep RC4 /tmp/sslscan.out > | wc -l > 0 > > > Then I check for DES: > > brad.allison@devops-west:/usr/local/devops/bin> grep DES /tmp/sslscan.out > | wc -l > 6 > > brad.allison@devops-west:/usr/local/devops/bin> grep DES /tmp/sslscan.out > Accepted TLSv1 112 bits ECDHE-RSA-DES-CBC3-SHA > Accepted TLSv1 112 bits DES-CBC3-SHA > Accepted TLS11 112 bits ECDHE-RSA-DES-CBC3-SHA > Accepted TLS11 112 bits DES-CBC3-SHA > Accepted TLS12 112 bits ECDHE-RSA-DES-CBC3-SHA > Accepted TLS12 112 bits DES-CBC3-SHA > > > > So why is it allowing DES support when I have !DES in my Ciphers list? > > -brad > --001a114e22ae016f4c05602b55fe Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Nevermind.=C2=A0 I found the solution.<div><br></div><div>= I added !DES to the list of Ciphers to exclude and it excluded those two CB= C3 based ciphers.</div><div><br></div><div><div><font face=3D"monospace, mo= nospace" color=3D"#0000ff">=C2=A0Ciphers "ALL:!ADH:!EXPORT:!SSLv2:!aNU= LL:!eNULL:!3DES:!DES:!MD5:!PSK:!RC4:!DH:!LOW:+HIGH:+MEDIUM"</font></di= v></div><div><br></div></div><div class=3D"gmail_extra"><br><div class=3D"g= mail_quote">On Tue, Dec 12, 2017 at 4:04 PM, Brad Allison <span dir=3D"ltr"= ><<a href=3D"mailto:[email protected]" target=3D"_blank">brad.allis= [email protected]</a>></span> wrote:<br><blockquote class=3D"gmail_quote" sty= le=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div d= ir=3D"ltr">Here's my Ciphers in pound.cfg:<div><br></div><blockquote st= yle=3D"margin:0 0 0 40px;border:none;padding:0px"><div><div><div><font face= =3D"monospace, monospace" color=3D"#0000ff">=C2=A0Ciphers "ALL:!ADH:!E= XPORT:!SSLv2:!<wbr>aNULL:!eNULL:!DES:!MD5:!PSK:!<wbr>RC4:!DH:!LOW:+HIGH:+ME= DIUM"</font></div></div></div></blockquote><div><div><br></div></div><= div>Then I do a sslscan on the pound server and save the data to /tmp/sslsc= an.out,=C2=A0</div><div><br></div><div>First I check for MD5:</div><div><br= ></div><blockquote style=3D"margin:0 0 0 40px;border:none;padding:0px"><div= ><div><font face=3D"monospace, monospace" color=3D"#0000ff">brad.allison@de= vops-west:/usr/<wbr>local/devops/bin> grep MD5 /tmp/sslscan.out | wc -l<= /font></div></div><div><div><font face=3D"monospace, monospace" color=3D"#0= 000ff">0</font></div></div></blockquote><div><br></div><div>Then I check fo= r RC4:</div><div><br></div><blockquote style=3D"margin:0 0 0 40px;border:no= ne;padding:0px"><div><div><font face=3D"monospace, monospace" color=3D"#000= 0ff">brad.allison@devops-west:/usr/<wbr>local/devops/bin> grep RC4 /tmp/= sslscan.out | wc -l</font></div></div><div><div><font face=3D"monospace, mo= nospace" color=3D"#0000ff">0</font></div></div></blockquote><div><div><br><= /div><div>Then I check for DES:</div><div><br></div></div><blockquote style= =3D"margin:0 0 0 40px;border:none;padding:0px"><div><div><font face=3D"mono= space, monospace" color=3D"#0000ff">brad.allison@devops-west:/usr/<wbr>loca= l/devops/bin> grep DES /tmp/sslscan.out | wc -l</font></div></div><div><= div><font face=3D"monospace, monospace" color=3D"#0000ff">6</font></div></d= iv><div><div><font face=3D"monospace, monospace" color=3D"#0000ff"><br></fo= nt></div></div><div><div><font face=3D"monospace, monospace" color=3D"#0000= ff">brad.allison@devops-west:/usr/<wbr>local/devops/bin> grep DES /tmp/s= slscan.out=C2=A0</font></div></div><div><div><font face=3D"monospace, monos= pace" color=3D"#0000ff">=C2=A0 =C2=A0 Accepted =C2=A0TLSv1 =C2=A0112 bits = =C2=A0ECDHE-RSA-DES-CBC3-SHA</font></div></div><div><div><font face=3D"mono= space, monospace" color=3D"#0000ff">=C2=A0 =C2=A0 Accepted =C2=A0TLSv1 =C2= =A0112 bits =C2=A0DES-CBC3-SHA</font></div></div><div><div><font face=3D"mo= nospace, monospace" color=3D"#0000ff">=C2=A0 =C2=A0 Accepted =C2=A0TLS11 = =C2=A0112 bits =C2=A0ECDHE-RSA-DES-CBC3-SHA</font></div></div><div><div><fo= nt face=3D"monospace, monospace" color=3D"#0000ff">=C2=A0 =C2=A0 Accepted = =C2=A0TLS11 =C2=A0112 bits =C2=A0DES-CBC3-SHA</font></div></div><div><div><= font face=3D"monospace, monospace" color=3D"#0000ff">=C2=A0 =C2=A0 Accepted= =C2=A0TLS12 =C2=A0112 bits =C2=A0ECDHE-RSA-DES-CBC3-SHA</font></div></div>= <div><div><font face=3D"monospace, monospace" color=3D"#0000ff">=C2=A0 =C2= =A0 Accepted =C2=A0TLS12 =C2=A0112 bits =C2=A0DES-CBC3-SHA</font></div></di= v></blockquote><div><br></div><div><br></div><div>So why is it allowing DES= support when I have !DES in my Ciphers list?</div><span class=3D"HOEnZb"><= font color=3D"#888888"><div><br></div><div>-brad</div></font></span></div> </blockquote></div><br></div> --001a114e22ae016f4c05602b55fe-- -- To unsubscribe send an email with subject unsubscribe to [email protected] Please contact [email protected] for questions.