0

I want to disable cipher SSL3_RSA_WITH_SEED_SHA in Postfix.

I have got in main.cf

smtpd_tls_ciphers = high
smtpd_tls_protocols = TLSv1,!SSLv2,!SSLv3
smtpd_tls_exclude_ciphers = aNULL, DES, 3DES, MD5, DES+MD5, RC4

What should I add to smtpd_tls_exclude_ciphers to exclude SSL3_RSA_WITH_SEED_SHA?

  • Isn't that already disabled as you have disabled the whole SSLv3 protocol? (SSL3_RSA_WITH_SEED_SHA sounds SSLv3 specific?) – Håkan Lindqvist Mar 30 '14 at 12:57
  • I was thinking the same but I have done scan with OpenVAS and I am still getting weak ciphers are: SSL3_RSA_WITH_SEED_SHA on port 465/tcp – Marek Mar 30 '14 at 13:10
5

You can use BetterCrypto document for a secure configuration. After that, OpenVAS should not trigger any problem.

smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
tls_preempt_cipherlist = yes
smtpd_tls_mandatory_ciphers=high
tls_high_cipherlist=EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA

Page 26, Section 2.3.4.Postfix: https://bettercrypto.org/static/applied-crypto-hardening.pdf

Please read Limitations, too.

I hope to be useful.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.