Re: [Proftpd-user] Security with SFTP

On 26.09.18 15:33, Jason Byers wrote:
>We run regular security scans through Digital Defense and they are 
>reporting that our proftpd is running RC4, Weak MAC Algorithms, and 
>CBC Mode Ciphers. I want to fix the issue but still have a high level 
>of usability. I tried a setting like this:
>
>SFTPCiphers aes256-ctr aes192-ctr aes128-ctr
>SFTPDigests hmac-sha2-256 hmac-sha2-512 hmac-ripemd160 
>[email protected]
>
>and about 10% of my users were not able to login anymore. Is there a 
>way like in Apache to say minus certain things rather then list what 
>is accepted? 

If ou mean something like
http://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslciphersuite
you should be aware that contents of directive is passed to the OpenSSL
layer. the same directive is applied in proftpd's mod_tls:
http://www.proftpd.org/docs/directives/linked/config_ref_TLSCipherSuite.html

parsing of similar string would require implementing similar code than
openssl.


-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
On the other hand, you have different fingers. 


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html