28 Aug
2015
28 Aug
'15
3:20 p.m.
Hello Xavier,
did you have any success disabling SSLv3? I would like to disable any
old ciphers and turn on Forward Secrecy. Do you have experience with
this and perdition?
Thank you,
Alex
From: Xavier Garcia <xavi.garcia <at> gmail.com>
Subject: Re: Disabling SSLv3
<http://news.gmane.org/find-root.php?message_id=20141031133121.GB53613%40beastie.ads.eso.org>
Newsgroups: gmane.mail.perdition.user
<http://news.gmane.org/gmane.mail.perdition.user>
Date: 2014-10-31 13:31:23 GMT (43 weeks, 1 hour and 45 minutes ago)
Hi,
AFAIK, this enables STARTTLS in the port instead of starting a
purely encrypted connection.
nc -vv imapproxy01i 993
Connection to imapproxy01i 993 port [tcp/imaps] succeeded!
* OK [CAPABILITY IMAP4rev1 SASL-IR SORT THREAD=REFERENCES
* MULTIAPPEND UNSELECT LITERAL+ IDLE CHILDREN NAMESPACE
* LOGIN-REFERRALS STARTTLS LOGINDISABLED] perdition ready on
* imapproxy01i 00028de7
I haven't tested but I think this may not change the list of
accepted cyphers. After reading the manual and some messages in
the list, it seems that all references to TLS in the
configuration are aiming at STARTTLS and the only way to change
the valid ciphers is with *ssl_listen_ciphers* and
*ssl_outgoing_ciphers*. Am I mistaken?
Regards,
Xavier Garcia
On Fri, Oct 31, 2014 at 02:10:42PM +0100, LE SAOUT Mael wrote:
Hi all,
I have to disable it in /etc/sysconfig/perdition :
POP3S_FLAGS="--outgoing_port 110 --ssl_mode tls_listen,tls_listen_force"
IMAP4S_FLAGS="--outgoing_port 143 --ssl_mode tls_listen,tls_listen_force"
Hope it will help you.
Regards
Mael
-----Message d'origine-----
De?: perdition-users-bounces <at> vergenet.net [mailto:perdition-users-bounces
<at> vergenet.net] De la
part de Xavier Garcia
Envoy??: vendredi 31 octobre 2014 13:59
??: perdition-users <at> vergenet.net
Objet?: [PERDITION-USERS] Disabling SSLv3
Dear all,
I am trying to disable SSLv3 on perdition 2.0-1.x86_64 It is running in a RHEL 6.5 clone
and it was compiled
with the SPEC files.
In theory, I should apply the following configuration but it also disables TLSv1 and
TLSv1.1, being
TLSv1.2 still available.
---
ssl_listen_ciphers "ALL:!SSLv2:!SSLv3"
---
I don't know much about cryptography but I guess it makes sense because I obtain the
same result in all my
boxes (RHEL 6.5 , Fedora and FreeBSD 10) when I execute:
openssl ciphers -v 'ALL:!SSLv2:!SSLv3'
What would be the best way to disable SSLv2 and SSLv3 for incoming and outgoing
connections?
Regards,
Xavier Garcia
______________________________________________
Perdition-users mailing list
Perdition-users <at> vergenet.net
http://lists.vergenet.net/listinfo/perdition-users
----
______________________________________________
Perdition-users mailing list
Perdition-users <at> vergenet.net
http://lists.vergenet.net/listinfo/perdition-users
28 Aug
28 Aug
3:54 p.m.
Hi,
I had to reconfigure perdition to listen only on localhost and then use
stunnel to do the TLS.
Kind regards,
Xavier Garcia
On Aug 28, 2015 17:31, "Epiontis IT" <it_mailinglists(a)epiontis.com>
wrote:
Hello Xavier,
did you have any success disabling SSLv3? I would like to disable any old
ciphers and turn on Forward Secrecy. Do you have experience with this and
perdition?
Thank you,
Alex
From: Xavier Garcia <xavi.garcia <at> gmail.com>
Subject: Re: Disabling SSLv3
<http://news.gmane.org/find-root.php?message_id=20141031133121.GB53613%40beastie.ads.eso.org>
Newsgroups: gmane.mail.perdition.user
<http://news.gmane.org/gmane.mail.perdition.user>
Date: 2014-10-31 13:31:23 GMT (43 weeks, 1 hour and 45 minutes ago)
Hi,
AFAIK, this enables STARTTLS in the port instead of starting a
purely encrypted connection.
nc -vv imapproxy01i 993
Connection to imapproxy01i 993 port [tcp/imaps] succeeded!
* OK [CAPABILITY IMAP4rev1 SASL-IR SORT THREAD=REFERENCES
* MULTIAPPEND UNSELECT LITERAL+ IDLE CHILDREN NAMESPACE
* LOGIN-REFERRALS STARTTLS LOGINDISABLED] perdition ready on
* imapproxy01i 00028de7
I haven't tested but I think this may not change the list of
accepted cyphers. After reading the manual and some messages in
the list, it seems that all references to TLS in the
configuration are aiming at STARTTLS and the only way to change
the valid ciphers is with *ssl_listen_ciphers* and
*ssl_outgoing_ciphers*. Am I mistaken?
Regards,
Xavier Garcia
On Fri, Oct 31, 2014 at 02:10:42PM +0100, LE SAOUT Mael wrote:
Hi all,
I have to disable it in /etc/sysconfig/perdition :
POP3S_FLAGS="--outgoing_port 110 --ssl_mode tls_listen,tls_listen_force"
IMAP4S_FLAGS="--outgoing_port 143 --ssl_mode tls_listen,tls_listen_force"
Hope it will help you.
Regards
Mael
-----Message d'origine-----
De?: perdition-users-bounces <at> vergenet.net [mailto:perdition-users-bounces
<perdition-users-bounces> <at> vergenet.net] De la
part de Xavier
Garcia
Envoy??: vendredi 31 octobre 2014 13:59
??: perdition-users <at> vergenet.net
Objet?: [PERDITION-USERS] Disabling SSLv3
Dear all,
I am trying to disable SSLv3 on perdition 2.0-1.x86_64 It is running in a RHEL 6.5 clone
and it was compiled
with the SPEC files.
In theory, I should apply the following configuration but it also disables TLSv1 and
TLSv1.1, being
TLSv1.2 still available.
---
ssl_listen_ciphers "ALL:!SSLv2:!SSLv3"
---
I don't know much about cryptography but I guess it makes sense because I obtain the
same result in all my
boxes (RHEL 6.5 , Fedora and FreeBSD 10) when I execute:
openssl ciphers -v 'ALL:!SSLv2:!SSLv3'
What would be the best way to disable SSLv2 and SSLv3 for incoming and outgoing
connections?
Regards,
Xavier Garcia
______________________________________________
Perdition-users mailing list
Perdition-users <at> vergenet.net
http://lists.vergenet.net/listinfo/perdition-users
----
______________________________________________
Perdition-users mailing list
Perdition-users <at>
vergenet.nethttp://lists.vergenet.net/listinfo/perdition-users
______________________________________________
Perdition-users mailing list
Perdition-users(a)vergenet.net
http://lists.vergenet.net/listinfo/perdition-users
30 Aug
30 Aug
12:15 p.m.
Am 28.08.2015 um 17:20 schrieb Epiontis IT:
Hello Xavier,
did you have any success disabling SSLv3? I would like to disable any
old ciphers and turn on Forward Secrecy. Do you have experience with
this and perdition?
There is a patch in the debian bug tracker:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=765867
According to Simons comment this should show up soon in the perdition
repository, but it is manageable to build own deb packages with that patch.
Regards
Matthias
7:56 p.m.
Thank you Matthias. I'll look into that.
On 08/30/2015 02:15 PM, Matthias Hunstock wrote:
Am 28.08.2015 um 17:20 schrieb Epiontis IT:
Hello Xavier,
did you have any success disabling SSLv3? I would like to disable any
old ciphers and turn on Forward Secrecy. Do you have experience with
this and perdition?
There is a patch in the debian bug tracker:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=765867
According to Simons comment this should show up soon in the perdition
repository, but it is manageable to build own deb packages with that patch.
Regards
Matthias
______________________________________________
Perdition-users mailing list
Perdition-users(a)vergenet.net
http://lists.vergenet.net/listinfo/perdition-users 
2 May
2 May
3:59 p.m.
Hi,
Is there any plan to merge this patch into perdition ?
bests
Christophe
On 30/08/2015 21:56, Epiontis IT wrote:
Thank you Matthias. I'll look into that.
On 08/30/2015 02:15 PM, Matthias Hunstock wrote:
Am 28.08.2015 um 17:20 schrieb Epiontis IT:
______________________________________________
Perdition-users mailing list
Perdition-users(a)vergenet.net
http://lists.vergenet.net/listinfo/perdition-users Hello Xavier,
did you have any success disabling SSLv3? I would like to disable any
old ciphers and turn on Forward Secrecy. Do you have experience with
this and perdition?
There is a patch in the debian bug tracker:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=765867
According to Simons comment this should show up soon in the perdition
repository, but it is manageable to build own deb packages with that
patch.
Regards
Matthias
______________________________________________
Perdition-users mailing list
Perdition-users(a)vergenet.net
http://lists.vergenet.net/listinfo/perdition-users 
9:23 p.m.
Hi Christophe,
* I believe that the patch in question has been merged and is
present in the mecurial repository.
http://hg.vergenet.net/perdition/perdition/rev/30672d224854
* It is not at all clear to me that the patch above disables SSLv3.
I believe a separate change to allow users to select which SSL/TLS
protocol versions are enabled may be worth adding to perdition.
But I'm not sure of a way to do that cleanly which doesn't require
updating perdition each time the underlying SSL/TLS implementation,
currently OpenSSL, adds support for a new protocol.
* It appears to me that updating OpenSSL will prevent perdition from
being the SSL DROWN vulnerability. My light testing indicates that
with an updated OpenSSL it is no longer possible to negotiate
an SSLv3 connection with perdition.
https://www.openssl.org/blog/blog/2016/03/01/an-openssl-users-guide-to-drow…
On Mon, May 02, 2016 at 05:59:59PM +0200, Christophe Ségui wrote:
Hi,
Is there any plan to merge this patch into perdition ?
bests
Christophe
On 30/08/2015 21:56, Epiontis IT wrote:
Thank you Matthias. I'll look into that.
On 08/30/2015 02:15 PM, Matthias Hunstock wrote:
Am 28.08.2015 um 17:20 schrieb Epiontis IT:
______________________________________________
Perdition-users mailing list
Perdition-users(a)vergenet.net
http://lists.vergenet.net/listinfo/perdition-users Hello Xavier,
did you have any success disabling SSLv3? I would like to disable any
old ciphers and turn on Forward Secrecy. Do you have experience with
this and perdition?
There is a patch in the debian bug tracker:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=765867
According to Simons comment this should show up soon in the perdition
repository, but it is manageable to build own deb packages with that
patch.
Regards
Matthias
______________________________________________
Perdition-users mailing list
Perdition-users(a)vergenet.net
http://lists.vergenet.net/listinfo/perdition-users ______________________________________________
Perdition-users mailing list
Perdition-users(a)vergenet.net
https://lists.vergenet.net/listinfo/perdition-users
3 May
3 May
7:33 a.m.
Am 02.05.2016 um 23:23 schrieb Simon Horman:
* It is not at all clear to me that the patch above
disables SSLv3.
No, that was a separate patch I think. Interesting that I do not find it
in my archive of this list :-/
I attached it for reference, but did not check, if it applies cleanly to
the current HEAD of perdition.
I believe a separate change to allow users to select
which SSL/TLS
protocol versions are enabled may be worth adding to perdition.
But I'm not sure of a way to do that cleanly which doesn't require
updating perdition each time the underlying SSL/TLS implementation,
currently OpenSSL, adds support for a new protocol.
The protocol option should be a text string that is just given to
OpenSSL, so you do not need to change code for a new protocol... but the
whole thing does not really scale up and is no fun, just see the support
for Forward Secrecy. Everytime you want to use a new feature of OpenSSL
you have to integrate a bunch of options, configurations etc. to be able
to use those features.
It seems to me that OpenSSL addresses this issue with its Version 1.1,
the recent announcement sounded like there will finally be a kind of
separate configuration file just for the SSL. So all your software needs
to know as an option is something like "path to openSSL config file".
But there will be some time going by until OpenSSL 1.1 is available in
the distros...
Regards
Matthias
--
Dipl.-Inf. Matthias Hunstock
UniRZ der TU Ilmenau, Raum 07
Tel.: +49 3677 69-1289
10 May
10 May
1:27 p.m.
On Tue, May 03, 2016 at 09:33:25AM +0200, Matthias Hunstock wrote:
Yes, it does seem a lot like that.
Am 02.05.2016 um 23:23 schrieb Simon Horman:
Thanks.
I like your patch and I think its a clean way for people to close
the gaps. However, for a release I think it would be worth making things
configurable.
As OpenSSL seems to advocate a continuous range of protocol versions
being enabled I have gone for an approach of providing configuration
options for the minimum and maximum protocol version. With SSLv3
and earlier are disabled by default.
Please find my first cut of the patch attached.
At this point it is only very lightly tested.
Testing and review by interested parties would be appreciated.
I plan to follow up with patches of a similar style to allow
configuration of the other OpenSSL options in your patch:
disable compression and set cipher server preference.
* It is not at all clear to me that the patch
above disables SSLv3.
No, that was a separate patch I think. Interesting that I do not find it
in my archive of this list :-/
I attached it for reference, but did not check, if it applies cleanly to
the current HEAD of perdition. I believe a
separate change to allow users to select which SSL/TLS
protocol versions are enabled may be worth adding to perdition.
But I'm not sure of a way to do that cleanly which doesn't require
updating perdition each time the underlying SSL/TLS implementation,
currently OpenSSL, adds support for a new protocol.
The protocol option should be a text string that is just given to
OpenSSL, so you do not need to change code for a new protocol... but the
whole thing does not really scale up and is no fun, just see the support
for Forward Secrecy. Everytime you want to use a new feature of OpenSSL
you have to integrate a bunch of options, configurations etc. to be able
to use those features.
It seems to me that OpenSSL addresses this issue with its Version 1.1,
the recent announcement sounded like there will finally be a kind of
separate configuration file just for the SSL. So all your software needs
to know as an option is something like "path to openSSL config file". But there will be some time going by until OpenSSL 1.1
is available in
the distros...
Interesting. That does sound promising.
Regards
Matthias
--
Dipl.-Inf. Matthias Hunstock
UniRZ der TU Ilmenau, Raum 07
Tel.: +49 3677 69-1289
2:44 p.m.
Am 10.05.2016 um 15:27 schrieb Simon Horman:
On Tue, May 03, 2016 at 09:33:25AM +0200, Matthias
Hunstock wrote:
This sounds sane and I think all users will appreciate that.
I probably did not suggest my patch earlier, because it's kind of hacky
to just hard-disable all the evil things ;)
I attached it for reference, but did not check,
if it applies cleanly to
the current HEAD of perdition.
Thanks.
I like your patch and I think its a clean way for people to close
the gaps. However, for a release I think it would be worth making things
configurable.
As OpenSSL seems to advocate a continuous range of protocol versions
being enabled I have gone for an approach of providing configuration
options for the minimum and maximum protocol version. With SSLv3
and earlier are disabled by default. I plan to follow up with patches of a similar style to
allow
configuration of the other OpenSSL options in your patch:
disable compression and set cipher server preference.
I personally do not see sensible use cases for compression or client
cipher preference, but having them as runtime configure option is of
course the best choice, as long as the defaults are sane.
Regards
Matthias
2910
days inactive
3166
days old
8 comments
5 participants
participants (5)
-
Christophe Ségui -
Epiontis IT -
Matthias Hunstock -
Simon Horman -
Xavi Garcia