Re: [Proftpd-user] how to restrict server to only using tls 1.2

On 19.11.20 19:04, byron wrote:
>I'm running version 1.3.6 of proftpd on debian buster.  It is the version
>from the debian repository.
>
>I'm having problems with some clients connecting and to troubleshoot I
>wanted to restrict the version of tls being used to only 1.2.
>
>So before making any changes to the proftpd config, when I would connect
>using filezilla (which works fine) and click on the padlock in the bottom
>right it would show under session details that I am using protocol TLS1.3.
>
>So then I thought if I would to put the following entry in my tls.conf file
>
>TLSProtocol TLSv1.2
>
>and restart the server that when I connected with filezilla I would see
>TLS1.2 under the session details.  But I don't, I still get TLS1.3.
>
>And the strange thing is, eventually I commented out the TLSProtocol line
>all together and connected with filezilla and it still reported TLS1.3.

seems that tls1.3 is not compiled into tls.so in debian 10:

# strings /usr/lib/proftpd/mod_tls.so | grep -i -e sslv -e tlsv
SSLv3
SSLv23
TLSv1
TLSv1.1
TLSv1.2
SSLv2
TLSVerifyOrder
TLSVerifyClient
TLSVerifyServer
TLSVerifyDepth
%s: client did not provide certificate, but one is required via 'TLSVerifyClient on'

-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. -- Benjamin Franklin, 1759


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html