0

I am currently trying to secure my qmail installation and the SMTP connections.

When compiling the standard UCSPI SSL, all supported ciphers are enabled by default. This leads to problems with POODLE, heartblead and other SSL problems.

I set an environment variable called CIPHERS with the following values. 

CIPHERS=ALL:!LOW:!SSLv2:!EXP:!aNULL:!eNULL!3DES:!MD5:!EXP:!CBC:!PSK:!SRP:!DSS:!RC4

This disables most of the "not so nice" stuff except of SSLv3 which is responsible for POODLE.

The second I set

CIPHERS=ALL:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL:!eNULL!3DES:!MD5:!EXP:!CBC:!PSK:!SRP:!DSS:!RC4

the server stops working.

Any advice is welcome also for Ciphers that I may should disable on top.

Improve this question
2

1 Answer 1

Reset to default
0

You need SSLv3 ciphers for TLSv1. What is easier is disabling the SSL3 protocol, rather than the cipher. Given the problems with SSL vs the problems with other mailers, I'd still favour qmail over other monolithic mailers that do not follow the UNIX philosophy of splitting a task into separate compartments doing small tasks with well defined inputs and outputs.

There will be a better patch for TLS along some time soon I'm sure. When it hits the mail lists it will be welcomed.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .