Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Having run https://www.ssllabs.com/ssltest/index.html on a newly built Domino 8.5.3 server, is it possible to configure for https://community.qualys.com/blogs/securitylabs/2011/10/17/mitigating-the-beast-attack-on-tls

The server initially got a score of "F", but adding SSL_DISABLE_RENEGOTIATE=1 and unchecking the old SSL Ciphers has improved the score to "B".

(I've update the following to the correct settings as per the blog post below)

To clarify the following SSL Ciphers are enabled:
- RC4 encryption with 128-bit key and MD5 MAC
- RC4 encryption with 128-bit key and SHA-1 MAC

The following SSL Ciphers are disabled:
- AES encryption with 128-bit key and SHA-1 MAC (Domino 8+ only)
- AES encryption with 256-bit key and SHA-1 MAC (Domino 8+ only)
- DES encryption with 56-bit key and SHA-1 MAC
- Triple DES encryption with 168-bit key and SHA 1 MAC
- RC4 encryption with 40-bit key and MD5 MAC
- No encryption with MD5 MAC
- No encryption with SHA-1 MAC

SSL v2 is not enabled

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Can you check the Blogposting here and say which cipher you have still enabled?

share|improve this answer
    
All Ciphers are currently set as per the blog posting (I've updated the original question with this information). –  Gary Wilkinson Apr 2 '13 at 13:08
    
For the BREAST Vulnerability you need to disable also the AES and Triple cipher as mentioned in the blog posting. –  BastianW Apr 5 '13 at 20:45
    
Somehow missed that section, have disabled the 3 ciphers and now get 'A' grade for the server. Thanks. –  Gary Wilkinson Apr 10 '13 at 14:54
    
FYI - Recent IBM Open Mic on Securing an IBM Domino Web Server www-01.ibm.com/support/docview.wss?uid=swg27038063 –  Gary Wilkinson Apr 10 '13 at 15:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.