[Pound Mailing List] Re: Getting pound to not support DES
Brad Allison <[email protected]> Wed, 13 Dec 2017 13:42:24 -0500
| Newsgroups | gmane.comp.web.pound.general |
|---|---|
| Message-ID | <[email protected]> |
--94eb2c0d4604f1fee305603d20c7 Content-Type: text/plain; charset="UTF-8" Correction: That should say, "I added !3DES to the list of Ciphers...." And that fixed my problem. -b On Tue, Dec 12, 2017 at 4:28 PM, Brad Allison <[email protected]> wrote: > Nevermind. I found the solution. > > I added !DES to the list of Ciphers to exclude and it excluded those two > CBC3 based ciphers. > > Ciphers "ALL:!ADH:!EXPORT:!SSLv2:!aNULL:!eNULL:!3DES:!DES:!MD5:! > PSK:!RC4:!DH:!LOW:+HIGH:+MEDIUM" > > > On Tue, Dec 12, 2017 at 4:04 PM, Brad Allison <[email protected]> > wrote: > >> Here's my Ciphers in pound.cfg: >> >> Ciphers "ALL:!ADH:!EXPORT:!SSLv2:!aNULL:!eNULL:!DES:!MD5:!PSK:!RC4:! >> DH:!LOW:+HIGH:+MEDIUM" >> >> >> Then I do a sslscan on the pound server and save the data to >> /tmp/sslscan.out, >> >> First I check for MD5: >> >> brad.allison@devops-west:/usr/local/devops/bin> grep MD5 >> /tmp/sslscan.out | wc -l >> 0 >> >> >> Then I check for RC4: >> >> brad.allison@devops-west:/usr/local/devops/bin> grep RC4 >> /tmp/sslscan.out | wc -l >> 0 >> >> >> Then I check for DES: >> >> brad.allison@devops-west:/usr/local/devops/bin> grep DES >> /tmp/sslscan.out | wc -l >> 6 >> >> brad.allison@devops-west:/usr/local/devops/bin> grep DES >> /tmp/sslscan.out >> Accepted TLSv1 112 bits ECDHE-RSA-DES-CBC3-SHA >> Accepted TLSv1 112 bits DES-CBC3-SHA >> Accepted TLS11 112 bits ECDHE-RSA-DES-CBC3-SHA >> Accepted TLS11 112 bits DES-CBC3-SHA >> Accepted TLS12 112 bits ECDHE-RSA-DES-CBC3-SHA >> Accepted TLS12 112 bits DES-CBC3-SHA >> >> >> >> So why is it allowing DES support when I have !DES in my Ciphers list? >> >> -brad >> > > --94eb2c0d4604f1fee305603d20c7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Correction: =C2=A0That should say, "I added !3DES to = the list of Ciphers...." =C2=A0<div><br></div><div>And that fixed my p= roblem.</div><div><br></div><div>-b</div></div><div class=3D"gmail_extra"><= br><div class=3D"gmail_quote">On Tue, Dec 12, 2017 at 4:28 PM, Brad Allison= <span dir=3D"ltr"><<a href=3D"mailto:[email protected]" target=3D"= _blank">[email protected]</a>></span> wrote:<br><blockquote class= =3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd= ing-left:1ex"><div dir=3D"ltr">Nevermind.=C2=A0 I found the solution.<div><= br></div><div>I added !DES to the list of Ciphers to exclude and it exclude= d those two CBC3 based ciphers.</div><div><br></div><div><div><font face=3D= "monospace, monospace" color=3D"#0000ff">=C2=A0Ciphers "ALL:!ADH:!EXPO= RT:!SSLv2:!<wbr>aNULL:!eNULL:!3DES:!DES:!MD5:!<wbr>PSK:!RC4:!DH:!LOW:+HIGH:= +<wbr>MEDIUM"</font></div></div><div><br></div></div><div class=3D"HOE= nZb"><div class=3D"h5"><div class=3D"gmail_extra"><br><div class=3D"gmail_q= uote">On Tue, Dec 12, 2017 at 4:04 PM, Brad Allison <span dir=3D"ltr"><<= a href=3D"mailto:[email protected]" target=3D"_blank">brad.allison@gma= il.com</a>></span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"= margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"= ltr">Here's my Ciphers in pound.cfg:<div><br></div><blockquote style=3D= "margin:0 0 0 40px;border:none;padding:0px"><div><div><div><font face=3D"mo= nospace, monospace" color=3D"#0000ff">=C2=A0Ciphers "ALL:!ADH:!EXPORT:= !SSLv2:!aNUL<wbr>L:!eNULL:!DES:!MD5:!PSK:!RC4:!<wbr>DH:!LOW:+HIGH:+MEDIUM&q= uot;</font></div></div></div></blockquote><div><div><br></div></div><div>Th= en I do a sslscan on the pound server and save the data to /tmp/sslscan.out= ,=C2=A0</div><div><br></div><div>First I check for MD5:</div><div><br></div= ><blockquote style=3D"margin:0 0 0 40px;border:none;padding:0px"><div><div>= <font face=3D"monospace, monospace" color=3D"#0000ff">brad.allison@devops-w= est:/usr/<wbr>local/devops/bin> grep MD5 /tmp/sslscan.out | wc -l</font>= </div></div><div><div><font face=3D"monospace, monospace" color=3D"#0000ff"= >0</font></div></div></blockquote><div><br></div><div>Then I check for RC4:= </div><div><br></div><blockquote style=3D"margin:0 0 0 40px;border:none;pad= ding:0px"><div><div><font face=3D"monospace, monospace" color=3D"#0000ff">b= rad.allison@devops-west:/usr/<wbr>local/devops/bin> grep RC4 /tmp/sslsca= n.out | wc -l</font></div></div><div><div><font face=3D"monospace, monospac= e" color=3D"#0000ff">0</font></div></div></blockquote><div><div><br></div><= div>Then I check for DES:</div><div><br></div></div><blockquote style=3D"ma= rgin:0 0 0 40px;border:none;padding:0px"><div><div><font face=3D"monospace,= monospace" color=3D"#0000ff">brad.allison@devops-west:/usr/<wbr>local/devo= ps/bin> grep DES /tmp/sslscan.out | wc -l</font></div></div><div><div><f= ont face=3D"monospace, monospace" color=3D"#0000ff">6</font></div></div><di= v><div><font face=3D"monospace, monospace" color=3D"#0000ff"><br></font></d= iv></div><div><div><font face=3D"monospace, monospace" color=3D"#0000ff">br= ad.allison@devops-west:/usr/<wbr>local/devops/bin> grep DES /tmp/sslscan= .out=C2=A0</font></div></div><div><div><font face=3D"monospace, monospace" = color=3D"#0000ff">=C2=A0 =C2=A0 Accepted =C2=A0TLSv1 =C2=A0112 bits =C2=A0E= CDHE-RSA-DES-CBC3-SHA</font></div></div><div><div><font face=3D"monospace, = monospace" color=3D"#0000ff">=C2=A0 =C2=A0 Accepted =C2=A0TLSv1 =C2=A0112 b= its =C2=A0DES-CBC3-SHA</font></div></div><div><div><font face=3D"monospace,= monospace" color=3D"#0000ff">=C2=A0 =C2=A0 Accepted =C2=A0TLS11 =C2=A0112 = bits =C2=A0ECDHE-RSA-DES-CBC3-SHA</font></div></div><div><div><font face=3D= "monospace, monospace" color=3D"#0000ff">=C2=A0 =C2=A0 Accepted =C2=A0TLS11= =C2=A0112 bits =C2=A0DES-CBC3-SHA</font></div></div><div><div><font face= =3D"monospace, monospace" color=3D"#0000ff">=C2=A0 =C2=A0 Accepted =C2=A0TL= S12 =C2=A0112 bits =C2=A0ECDHE-RSA-DES-CBC3-SHA</font></div></div><div><div= ><font face=3D"monospace, monospace" color=3D"#0000ff">=C2=A0 =C2=A0 Accept= ed =C2=A0TLS12 =C2=A0112 bits =C2=A0DES-CBC3-SHA</font></div></div></blockq= uote><div><br></div><div><br></div><div>So why is it allowing DES support w= hen I have !DES in my Ciphers list?</div><span class=3D"m_-5273687717132933= 374HOEnZb"><font color=3D"#888888"><div><br></div><div>-brad</div></font></= span></div> </blockquote></div><br></div> </div></div></blockquote></div><br></div> --94eb2c0d4604f1fee305603d20c7-- -- To unsubscribe send an email with subject unsubscribe to [email protected] Please contact [email protected] for questions.