Re: Howto disable SSLv3 and only use TLS
David Severance <[email protected]> Wed, 15 Oct 2014 13:40:45 -0700
| Newsgroups | gmane.mail.imap.uw.c-client |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============2842671916169411024== Content-Type: multipart/alternative; boundary="------------080103020505020202030309" This is a multi-part message in MIME format. --------------080103020505020202030309 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Panda Imap was the continuation of UW-Imap after Mark and everyone else was shown the door at UW. It's pretty much UW-Imap with patches and enhancements. Every single user of UW-Imap should seriously consider upgrading to it. Previously you had to make a donation to Mark to get access to it (we did). Since his passing it's up there on github for all. David On 10/15/2014 1:26 PM, scott hollatz wrote: > > > On Wed, Oct 15, 2014 at 3:03 PM, Dan Lukes <[email protected] > <mailto:[email protected]>> wrote: > > On 10/15/14 21:32, Jimmy Dorff: > > Is this possible to disable SSLv3 and only accept > imaps using TLS? > > > I created custom source patch for osdep/unix/ssl_unix.c > > Such patch allow me to write something like > > set ssl-protocols -ALL +TLSv1 > set ssl-cipher-list HIGH:!ADH:!EXPORT56:!SSLv2 > > into c-client.cf <http://c-client.cf> file. > > > I'm on CentOS Linux and specifically using the panda-imap now > on github. > > > My patch has been created for imap-uw. I'm not familiar with > panda-imap sources. It may or may not be portable to them. > > > I've never seen the panda-imap source until five minutes ago. Cloning > from github then > find . -type f | xargs grep -l TLSv1 spits out > ./src/osdep/unix/ssl_unix.c then grep -i cipher on > it gives #define SSLCIPHERLIST "ALL:!SSLv2:!ADH:!EXP:!LOW" . > Should be easy to tweak+compile. > > > > Is the patch available for testing? > > > See http://www.freebsd.cz/~dan/patch-DAN-SETSSLCIPHER > <http://www.freebsd.cz/%7Edan/patch-DAN-SETSSLCIPHER> > > Did your patch also allow DHE ciphers to be used? > > > My ssl-cipher-list accept the same values as -cipher option of > underlying OpenSSL library > > Dan > > > _______________________________________________ > Imap-uw mailing list > [email protected] <mailto:[email protected]> > http://mailman13.u.washington.edu/mailman/listinfo/imap-uw > > > > > -- > scott hollatz > information technology systems and services > university of minnesota duluth mn usa > net: [email protected] <mailto:[email protected]> tel: +1 218 726 > 8851 fax: +1 218 726 7674 > Asn aD ta zlAp em uT zt33rg > > > _______________________________________________ > Imap-uw mailing list > [email protected] > http://mailman13.u.washington.edu/mailman/listinfo/imap-uw -- David Severance Enterprise Unix Services Office of Information Technology (949) 824-7552 [email protected] --------------080103020505020202030309 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by mxout12.cac.washington.edu id s9FKeLFi005641 <html> <head> <meta content=3D"text/html; charset=3Dwindows-1252" http-equiv=3D"Content-Type"> </head> <body bgcolor=3D"#FFFFFF" text=3D"#000000"> Panda Imap was the continuation of UW-Imap after Mark and everyone else was shown the door at UW. It's pretty much UW-Imap with patches and enhancements. Every single user of UW-Imap should seriously consider upgrading to it. Previously you had to make a donation to Mark to get access to it (we did). Since his passing it's up there on github for all.<br> <br> David<br> <br> <div class=3D"moz-cite-prefix">On 10/15/2014 1:26 PM, scott hollatz wrote:<br> </div> <blockquote cite=3D"mid:[email protected]= ail.com" type=3D"cite"> <div dir=3D"ltr"><br> <div class=3D"gmail_extra"><br> <div class=3D"gmail_quote">On Wed, Oct 15, 2014 at 3:03 PM, Dan Lukes <span dir=3D"ltr"><<a moz-do-not-send=3D"true" href=3D"mailto:[email protected]" target=3D"_blank">dan@oblud= a.cz</a>></span> wrote:<br> <blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 10/15/14 21:32, Jimmy Dorff:<br> <blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0= px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <blockquote class=3D"gmail_quote" style=3D"margin:0px 0= px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> =A0Is this possible to disable SSLv3 and only accept imaps using TLS?<br> </blockquote> </blockquote> </blockquote> <br> <blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0= px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> I created custom source patch for osdep/unix/ssl_unix.c<br> <br> Such patch allow me to write something like<br> <br> set ssl-protocols -ALL +TLSv1<br> set ssl-cipher-list HIGH:!ADH:!EXPORT56:!SSLv2<br> <br> into <a moz-do-not-send=3D"true" href=3D"http://c-client.cf" target=3D"_blank">c-clien= t.cf</a> file.<br> </blockquote> </blockquote> <br> <blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0= px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> I'm on CentOS Linux and specifically using the panda-imap now on github.<br> </blockquote> <br> My patch has been created for imap-uw. I'm not familiar with panda-imap sources. It may or may not be portable to them.<br> </blockquote> <div><br> </div> <div>I've never seen the panda-imap source until five minutes ago.=A0 Cloning from github then<br> find . -type f | xargs grep -l TLSv1 spits out ./src/osdep/unix/ssl_unix.c then grep -i cipher on<br> </div> <div>it gives #define SSLCIPHERLIST "ALL:!SSLv2:!ADH:!EXP:!LOW" . <br> Should be easy to tweak+compile.<br> <br> <br> </div> <blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <br> <blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0= px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> Is the patch available for testing?<br> </blockquote> <br> See <a moz-do-not-send=3D"true" href=3D"http://www.freebsd.cz/%7Edan/patch-DAN-SETSSLCIPH= ER" target=3D"_blank">http://www.freebsd.cz/~dan/patch-DAN-SE= TSSLCIPHER</a><br> <br> <blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0= px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> Did your patch also allow DHE ciphers to be used?<br> </blockquote> <br> My ssl-cipher-list accept the same values as -cipher option of underlying OpenSSL library<br> <br> Dan<br> <br> <br> _______________________________________________<br> Imap-uw mailing list<br> <a moz-do-not-send=3D"true" href=3D"mailto:[email protected]" target=3D"_blank= ">[email protected]</a><br> <a moz-do-not-send=3D"true" href=3D"http://mailman13.u.washington.edu/mailman/listinf= o/imap-uw" target=3D"_blank">http://mailman13.u.washington.edu/mailm= an/listinfo/imap-uw</a><br> </blockquote> </div> <br> <br clear=3D"all"> <br> -- <br> scott hollatz<br> information technology systems and services<br> university of minnesota duluth mn usa<br> net: <a moz-do-not-send=3D"true" href=3D"mailto:[email protected]" target=3D"_blank">shollatz= @d.UMn.eDu</a> tel: +1 218 726 8851 fax: +1 218 726 7674<br> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0Asn aD ta zl= Ap em uT zt33rg </div> </div> <br> <fieldset class=3D"mimeAttachmentHeader"></fieldset> <br> <pre wrap=3D"">_______________________________________________ Imap-uw mailing list <a class=3D"moz-txt-link-abbreviated" href=3D"mailto:[email protected]= .edu">[email protected]</a> <a class=3D"moz-txt-link-freetext" href=3D"http://mailman13.u.washington.= edu/mailman/listinfo/imap-uw">http://mailman13.u.washington.edu/mailman/l= istinfo/imap-uw</a> </pre> </blockquote> <br> <pre class=3D"moz-signature" cols=3D"72">--=20 David Severance Enterprise Unix Services Office of Information Technology (949) 824-7552 <a class=3D"moz-txt-link-abbreviated" href=3D"mailto:[email protected]">sev@uci= .edu</a> </pre> </body> </html> --------------080103020505020202030309-- --===============2842671916169411024== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Imap-uw mailing list [email protected] http://mailman13.u.washington.edu/mailman/listinfo/imap-uw --===============2842671916169411024==--