Disabling SSLv3
Epiontis IT <[email protected]> Fri, 28 Aug 2015 17:20:50 +0200
| Newsgroups | gmane.mail.perdition.user |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============1121737212==
Content-Type: multipart/alternative;
boundary="------------070301020100030800060209"
This is a multi-part message in MIME format.
--------------070301020100030800060209
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Hello Xavier,
did you have any success disabling SSLv3? I would like to disable any
old ciphers and turn on Forward Secrecy. Do you have experience with
this and perdition?
Thank you,
Alex
From: Xavier Garcia <xavi.garcia <at> gmail.com>
Subject: Re: Disabling SSLv3
<http://news.gmane.org/find-root.php?message_id=20141031133121.GB53613%40beastie.ads.eso.org>
Newsgroups: gmane.mail.perdition.user
<http://news.gmane.org/gmane.mail.perdition.user>
Date: 2014-10-31 13:31:23 GMT (43 weeks, 1 hour and 45 minutes ago)
Hi,
AFAIK, this enables STARTTLS in the port instead of starting a
purely encrypted connection.
nc -vv imapproxy01i 993
Connection to imapproxy01i 993 port [tcp/imaps] succeeded!
* OK [CAPABILITY IMAP4rev1 SASL-IR SORT THREAD=REFERENCES
* MULTIAPPEND UNSELECT LITERAL+ IDLE CHILDREN NAMESPACE
* LOGIN-REFERRALS STARTTLS LOGINDISABLED] perdition ready on
* imapproxy01i 00028de7
I haven't tested but I think this may not change the list of
accepted cyphers. After reading the manual and some messages in
the list, it seems that all references to TLS in the
configuration are aiming at STARTTLS and the only way to change
the valid ciphers is with *ssl_listen_ciphers* and
*ssl_outgoing_ciphers*. Am I mistaken?
Regards,
Xavier Garcia
On Fri, Oct 31, 2014 at 02:10:42PM +0100, LE SAOUT Mael wrote:
> Hi all,
>
> I have to disable it in /etc/sysconfig/perdition :
> POP3S_FLAGS="--outgoing_port 110 --ssl_mode tls_listen,tls_listen_force"
> IMAP4S_FLAGS="--outgoing_port 143 --ssl_mode tls_listen,tls_listen_force"
>
> Hope it will help you.
>
> Regards
>
> Mael
>
> -----Message d'origine-----
> De?: perdition-users-bounces <at> vergenet.net [mailto:perdition-users-bounces <at> vergenet.net] De la
part de Xavier Garcia
> Envoy??: vendredi 31 octobre 2014 13:59
> ??: perdition-users <at> vergenet.net
> Objet?: [PERDITION-USERS] Disabling SSLv3
>
> Dear all,
>
> I am trying to disable SSLv3 on perdition 2.0-1.x86_64 It is running in a RHEL 6.5 clone and it was compiled
with the SPEC files.
>
> In theory, I should apply the following configuration but it also disables TLSv1 and TLSv1.1, being
TLSv1.2 still available.
>
> ---
> ssl_listen_ciphers "ALL:!SSLv2:!SSLv3"
> ---
>
> I don't know much about cryptography but I guess it makes sense because I obtain the same result in all my
boxes (RHEL 6.5 , Fedora and FreeBSD 10) when I execute:
>
> openssl ciphers -v 'ALL:!SSLv2:!SSLv3'
>
>
> What would be the best way to disable SSLv2 and SSLv3 for incoming and outgoing connections?
>
> Regards,
>
> Xavier Garcia
> ______________________________________________
> Perdition-users mailing list
> Perdition-users <at> vergenet.net
>http://lists.vergenet.net/listinfo/perdition-users
>
> ----
______________________________________________
Perdition-users mailing list
Perdition-users <at> vergenet.net
http://lists.vergenet.net/listinfo/perdition-users
--------------070301020100030800060209
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hello Xavier,<br>
<br>
did you have any success disabling SSLv3? I would like to disable
any old ciphers and turn on Forward Secrecy. Do you have experience
with this and perdition?<br>
<br>
Thank you,<br>
Alex<br>
<br>
From: Xavier Garcia <xavi.garcia <at> gmail.com><br>
Subject: <a target="_top" rel="nofollow"
href="http://news.gmane.org/find-root.php?message_id=20141031133121.GB53613%40beastie.ads.eso.org">Re:
Disabling SSLv3</a><br>
Newsgroups: <a
href="http://news.gmane.org/gmane.mail.perdition.user"
target="_top">gmane.mail.perdition.user</a><br>
Date: 2014-10-31 13:31:23 GMT (43 weeks, 1 hour and 45 minutes ago)<br>
<pre>Hi,
AFAIK, this enables STARTTLS in the port instead of starting a
purely encrypted connection.
nc -vv imapproxy01i 993
Connection to imapproxy01i 993 port [tcp/imaps] succeeded!
* OK [CAPABILITY IMAP4rev1 SASL-IR SORT THREAD=REFERENCES
* MULTIAPPEND UNSELECT LITERAL+ IDLE CHILDREN NAMESPACE
* LOGIN-REFERRALS STARTTLS LOGINDISABLED] perdition ready on
* imapproxy01i 00028de7
I haven't tested but I think this may not change the list of
accepted cyphers. After reading the manual and some messages in
the list, it seems that all references to TLS in the
configuration are aiming at STARTTLS and the only way to change
the valid ciphers is with *ssl_listen_ciphers* and
*ssl_outgoing_ciphers*. Am I mistaken?
Regards,
Xavier Garcia
On Fri, Oct 31, 2014 at 02:10:42PM +0100, LE SAOUT Mael wrote:
> Hi all,
>
> I have to disable it in /etc/sysconfig/perdition :
> POP3S_FLAGS="--outgoing_port 110 --ssl_mode tls_listen,tls_listen_force"
> IMAP4S_FLAGS="--outgoing_port 143 --ssl_mode tls_listen,tls_listen_force"
>
> Hope it will help you.
>
> Regards
>
> Mael
>
> -----Message d'origine-----
> De?: perdition-users-bounces <at> vergenet.net [<a class="moz-txt-link-freetext" href="mailto:perdition-users-bounces">mailto:perdition-users-bounces</a> <at> vergenet.net] De la
part de Xavier Garcia
> Envoy??: vendredi 31 octobre 2014 13:59
> ??: perdition-users <at> vergenet.net
> Objet?: [PERDITION-USERS] Disabling SSLv3
>
> Dear all,
>
> I am trying to disable SSLv3 on perdition 2.0-1.x86_64 It is running in a RHEL 6.5 clone and it was compiled
with the SPEC files.
>
> In theory, I should apply the following configuration but it also disables TLSv1 and TLSv1.1, being
TLSv1.2 still available.
>
> ---
> ssl_listen_ciphers "ALL:!SSLv2:!SSLv3"
> ---
>
> I don't know much about cryptography but I guess it makes sense because I obtain the same result in all my
boxes (RHEL 6.5 , Fedora and FreeBSD 10) when I execute:
>
> openssl ciphers -v 'ALL:!SSLv2:!SSLv3'
>
>
> What would be the best way to disable SSLv2 and SSLv3 for incoming and outgoing connections?
>
> Regards,
>
> Xavier Garcia
> ______________________________________________
> Perdition-users mailing list
> Perdition-users <at> vergenet.net
> <a rel="nofollow" href="http://lists.vergenet.net/listinfo/perdition-users" target="_top">http://lists.vergenet.net/listinfo/perdition-users</a>
>
> ----
</pre>
<pre>______________________________________________
Perdition-users mailing list
Perdition-users <at> vergenet.net
<a rel="nofollow" href="http://lists.vergenet.net/listinfo/perdition-users" target="_top">http://lists.vergenet.net/listinfo/perdition-users</a>
</pre>
</body>
</html>
--------------070301020100030800060209--
--===============1121737212==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpQZXJkaXRpb24t
dXNlcnMgbWFpbGluZyBsaXN0ClBlcmRpdGlvbi11c2Vyc0B2ZXJnZW5ldC5uZXQKaHR0cDovL2xp
c3RzLnZlcmdlbmV0Lm5ldC9saXN0aW5mby9wZXJkaXRpb24tdXNlcnMK
--===============1121737212==--