Re: [Proftpd-user] how to restrict server to only using tls 1.2
byron <[email protected]>
| Newsgroups | gmane.network.proftpd.user |
|---|---|
| Message-ID | <CAJ+YQyr_cew51WBdiCuvg4bvw2vVDbHhVa8e2ASrRan_mFiOdA@mail.gmail.com> |
I kind of managed to fix the problem but dont really understand why. In the end the config I used was TLSProtocol ALL -TLSv1.3 Which according to the notes at http://www.proftpd.org/docs/contrib/mod_tls.html#TLSProtocol Should allow everything except TLS1.3. However now I am able to accept connections for TLSv1.2 and TLSv1.3 (as per the entries /var/log/propftpd/tls.log). Which fixes my problem as people are able to connect. Before I had the entry TLSProtocol SSLv23 And proftpd was only accepting TLS1.3 connections from the newest filezilla clients. Everything else was getting dropped with 2020-11-10 16:09:09,872 mod_tls/2.7[665]: TLS/TLS-C requested, starting TLS handshake 2020-11-10 16:09:09,886 mod_tls/2.7[665]: unable to accept TLS connection: protocol error: (1) error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol 2020-11-10 16:09:09,886 mod_tls/2.7[665]: TLS/TLS-C negotiation failed on control channel Anyhow, it works. However I really dont understand why TLSv1.2 suddenly started working. Thanks On Fri, Nov 20, 2020 at 12:01 AM byron <[email protected]> wrote: > But this documentation appears to says otherwise > http://www.proftpd.org/docs/contrib/mod_tls.html#TLSProtocol > SSLv3 Allow only SSLv3 > TLSv1 Allow only TLSv1 > TLSv1.1 Allow only TLSv1.1 > TLSv1.2 Allow only TLSv1.2 > TLSv1.3 Allow only TLSv1.3 > > > On Thu, Nov 19, 2020 at 7:59 PM Benny Pedersen via Proftp-user < > [email protected]> wrote: > >> byron skrev den 2020-11-19 19:04: >> >> > TLSProtocol TLSv1.2 >> >> this is the minimal tls version, not the maximal >> >> please show logs of the real problem >> >> your config only ensures you not support sslv1 sslv2 sslv3 tls1.0 tls1.1 >> >> i am not openssl expert still, but i know atleast this >> >> if filezilla is on windows 7, you will need to have tls1.0 >> >> >> _______________________________________________ >> ProFTPD Users List <[email protected]> >> Unsubscribe problems? >> http://www.proftpd.org/list-unsub.html >> > _______________________________________________ ProFTPD Users List <[email protected]> Unsubscribe problems? http://www.proftpd.org/list-unsub.html