13

I have make a security check of our postfix server on https://de.ssl-tools.net/mailservers and get a warning that "ECDHE_RSA_WITH_RC4_128_SHA" is still supported. But don't know how to disable that ...

Improve this question

1 Answer 1

Reset to default
22

Add to your main.cf:

# TLS Server
smtpd_tls_exclude_ciphers = RC4, aNULL
# TLS Client
smtp_tls_exclude_ciphers = RC4, aNULL
Improve this answer
2
  • Why did you add the aNULL cipher to that list?
    – Marian
    Oct 3, 2016 at 20:43
  • 2
    To block anonymous DH and ECDH algorithms. It's not strictly necessary for this question, but typically you always want the server to be authenticated to avoid MITM attacks.
    – Andrew Domaszek
    Oct 3, 2016 at 21:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .