Re: Disabling SSLv3

--===============1778086267==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="huq684BweRXVnRxX"
Content-Disposition: inline


--huq684BweRXVnRxX
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi,

AFAIK, this enables STARTTLS in the port instead of starting a
purely encrypted connection.

nc -vv imapproxy01i 993
Connection to imapproxy01i 993 port [tcp/imaps] succeeded!
* OK [CAPABILITY IMAP4rev1 SASL-IR SORT THREAD=3DREFERENCES
* MULTIAPPEND UNSELECT LITERAL+ IDLE CHILDREN NAMESPACE
* LOGIN-REFERRALS STARTTLS LOGINDISABLED] perdition ready on
* imapproxy01i 00028de7

I haven't tested but I think this may not change the list of
accepted cyphers. After reading the manual and some messages in
the list, it seems that all references to TLS in the
configuration are aiming at STARTTLS and the only way to change
the valid ciphers is with *ssl_listen_ciphers* and
*ssl_outgoing_ciphers*. Am I mistaken?


Regards,

Xavier Garcia


On Fri, Oct 31, 2014 at 02:10:42PM +0100, LE SAOUT Mael wrote:
> Hi all,
>=20
> I have to disable it in /etc/sysconfig/perdition :
> POP3S_FLAGS=3D"--outgoing_port 110 --ssl_mode tls_listen,tls_listen_force"
> IMAP4S_FLAGS=3D"--outgoing_port 143 --ssl_mode tls_listen,tls_listen_forc=
e"
>=20
> Hope it will help you.
>=20
> Regards
>=20
> Mael
>=20
> -----Message d'origine-----
> De?: [email protected] [mailto:perdition-users-bounces=
@vergenet.net] De la part de Xavier Garcia
> Envoy??: vendredi 31 octobre 2014 13:59
> ??: [email protected]
> Objet?: [PERDITION-USERS] Disabling SSLv3
>=20
> Dear all,
>=20
> I am trying to disable SSLv3  on perdition 2.0-1.x86_64 It is running in =
a RHEL 6.5 clone and it was compiled with the SPEC files.
>=20
> In theory, I should apply the following configuration but it also disable=
s TLSv1 and TLSv1.1, being TLSv1.2 still available.
>=20
> ---
> ssl_listen_ciphers "ALL:!SSLv2:!SSLv3"
> ---
>=20
> I don't know much about cryptography but I guess it makes sense because I=
 obtain the same result in all my boxes (RHEL 6.5 , Fedora and FreeBSD 10) =
when I execute:
>=20
> openssl ciphers -v 'ALL:!SSLv2:!SSLv3'
>=20
>=20
> What would be the best way to disable SSLv2 and SSLv3 for incoming and ou=
tgoing connections?
>=20
> Regards,
>=20
> Xavier Garcia
> ______________________________________________
> Perdition-users mailing list
> [email protected]
> http://lists.vergenet.net/listinfo/perdition-users
>=20
> ----

--huq684BweRXVnRxX
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iEYEARECAAYFAlRTjykACgkQoDazPxB4I+M9IACfegWl52/GsHy8lkn5jWmxL4Xy
uK8Anj0V0jEcQCsrWS2mlc0XfjZPNzJj
=Bes3
-----END PGP SIGNATURE-----

--huq684BweRXVnRxX--

--===============1778086267==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

______________________________________________
Perdition-users mailing list
[email protected]
http://lists.vergenet.net/listinfo/perdition-users

--===============1778086267==--