Re: Howto disable SSLv3 and only use TLS

--===============0537466026827005423==
Content-Type: multipart/alternative; boundary=001a113376ee30c27405057bf2f5

--001a113376ee30c27405057bf2f5
Content-Type: text/plain; charset=UTF-8

On Wed, Oct 15, 2014 at 3:03 PM, Dan Lukes <[email protected]> wrote:

> On 10/15/14 21:32, Jimmy Dorff:
>
>>  Is this possible to disable SSLv3 and only accept imaps using TLS?
>>>>
>>>
>  I created custom source patch for osdep/unix/ssl_unix.c
>>>
>>> Such patch allow me to write something like
>>>
>>> set ssl-protocols -ALL +TLSv1
>>> set ssl-cipher-list HIGH:!ADH:!EXPORT56:!SSLv2
>>>
>>> into c-client.cf file.
>>>
>>
>  I'm on CentOS Linux and specifically using the panda-imap now on github.
>>
>
> My patch has been created for imap-uw. I'm not familiar with panda-imap
> sources. It may or may not be portable to them.
>

I've never seen the panda-imap source until five minutes ago.  Cloning from
github then
find . -type f | xargs grep -l TLSv1 spits out ./src/osdep/unix/ssl_unix.c
then grep -i cipher on
it gives #define SSLCIPHERLIST "ALL:!SSLv2:!ADH:!EXP:!LOW" .
Should be easy to tweak+compile.



>  Is the patch available for testing?
>>
>
> See http://www.freebsd.cz/~dan/patch-DAN-SETSSLCIPHER
>
>  Did your patch also allow DHE ciphers to be used?
>>
>
> My ssl-cipher-list accept the same values as -cipher option of underlying
> OpenSSL library
>
> Dan
>
>
> _______________________________________________
> Imap-uw mailing list
> [email protected]
> http://mailman13.u.washington.edu/mailman/listinfo/imap-uw
>



-- 
scott hollatz
information technology systems and services
university of minnesota duluth mn usa
net: [email protected] tel: +1 218 726 8851 fax: +1 218 726 7674
                         Asn aD ta zlAp em uT zt33rg

--001a113376ee30c27405057bf2f5
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><div class=3D"gmail_extra"><br><div class=3D"gmail_quo=
te">On Wed, Oct 15, 2014 at 3:03 PM, Dan Lukes <span dir=3D"ltr">&lt;<a hre=
f=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>&gt;</span> w=
rote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8e=
x;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 10/15/14 21:3=
2, Jimmy Dorff:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-=
left:1px solid rgb(204,204,204);padding-left:1ex"><blockquote class=3D"gmai=
l_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,20=
4,204);padding-left:1ex"><blockquote class=3D"gmail_quote" style=3D"margin:=
0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
=C2=A0Is this possible to disable SSLv3 and only accept imaps using TLS?<br=
>
</blockquote></blockquote></blockquote>
<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-=
left:1px solid rgb(204,204,204);padding-left:1ex"><blockquote class=3D"gmai=
l_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,20=
4,204);padding-left:1ex">
I created custom source patch for osdep/unix/ssl_unix.c<br>
<br>
Such patch allow me to write something like<br>
<br>
set ssl-protocols -ALL +TLSv1<br>
set ssl-cipher-list HIGH:!ADH:!EXPORT56:!SSLv2<br>
<br>
into <a href=3D"http://c-client.cf" target=3D"_blank">c-client.cf</a> file.=
<br>
</blockquote></blockquote>
<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-=
left:1px solid rgb(204,204,204);padding-left:1ex">
I&#39;m on CentOS Linux and specifically using the panda-imap now on github=
.<br>
</blockquote>
<br>
My patch has been created for imap-uw. I&#39;m not familiar with panda-imap=
 sources. It may or may not be portable to them.<br></blockquote><div><br><=
/div><div>I&#39;ve never seen the panda-imap source until five minutes ago.=
=C2=A0 Cloning from github then<br>find . -type f | xargs grep -l TLSv1 spi=
ts out ./src/osdep/unix/ssl_unix.c then grep -i cipher on<br></div><div>it =
gives #define SSLCIPHERLIST &quot;ALL:!SSLv2:!ADH:!EXP:!LOW&quot; . <br>Sho=
uld be easy to tweak+compile.<br><br><br></div><blockquote class=3D"gmail_q=
uote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,2=
04);padding-left:1ex">
<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-=
left:1px solid rgb(204,204,204);padding-left:1ex">
Is the patch available for testing?<br>
</blockquote>
<br>
See <a href=3D"http://www.freebsd.cz/~dan/patch-DAN-SETSSLCIPHER" target=3D=
"_blank">http://www.freebsd.cz/~dan/<u></u>patch-DAN-SETSSLCIPHER</a><br>
<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-=
left:1px solid rgb(204,204,204);padding-left:1ex">
Did your patch also allow DHE ciphers to be used?<br>
</blockquote>
<br>
My ssl-cipher-list accept the same values as -cipher option of underlying O=
penSSL library<br>
<br>
Dan<br>
<br>
<br>
______________________________<u></u>_________________<br>
Imap-uw mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]=
hington.edu</a><br>
<a href=3D"http://mailman13.u.washington.edu/mailman/listinfo/imap-uw" targ=
et=3D"_blank">http://mailman13.u.washington.<u></u>edu/mailman/listinfo/ima=
p-uw</a><br>
</blockquote></div><br><br clear=3D"all"><br>-- <br>scott hollatz<br>inform=
ation technology systems and services<br>university of minnesota duluth mn =
usa<br>net: <a href=3D"mailto:[email protected]" target=3D"_blank">shollat=
[email protected]</a> tel: +1 218 726 8851 fax: +1 218 726 7674<br>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0Asn aD ta zlAp em uT zt33rg
</div></div>

--001a113376ee30c27405057bf2f5--

--===============0537466026827005423==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Imap-uw mailing list
[email protected]
http://mailman13.u.washington.edu/mailman/listinfo/imap-uw

--===============0537466026827005423==--