0

I want to disable cipher SSL3_RSA_WITH_SEED_SHA in Postfix.

I have got in main.cf

smtpd_tls_ciphers = high
smtpd_tls_protocols = TLSv1,!SSLv2,!SSLv3
smtpd_tls_exclude_ciphers = aNULL, DES, 3DES, MD5, DES+MD5, RC4

What should I add to smtpd_tls_exclude_ciphers to exclude SSL3_RSA_WITH_SEED_SHA?

2
  • Isn't that already disabled as you have disabled the whole SSLv3 protocol? (SSL3_RSA_WITH_SEED_SHA sounds SSLv3 specific?) Mar 30, 2014 at 12:57
  • I was thinking the same but I have done scan with OpenVAS and I am still getting weak ciphers are: SSL3_RSA_WITH_SEED_SHA on port 465/tcp
    – Marek
    Mar 30, 2014 at 13:10

1 Answer 1

6

You can use BetterCrypto document for a secure configuration. After that, OpenVAS should not trigger any problem.

smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
tls_preempt_cipherlist = yes
smtpd_tls_mandatory_ciphers=high
tls_high_cipherlist=EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA

Page 26, Section 2.3.4.Postfix: https://bettercrypto.org

Please read Limitations, too.

I hope to be useful.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .