13

I have make a security check of our postfix server on https://de.ssl-tools.net/mailservers and get a warning that "ECDHE_RSA_WITH_RC4_128_SHA" is still supported. But don't know how to disable that ...

22

Add to your main.cf:

# TLS Server
smtpd_tls_exclude_ciphers = RC4, aNULL
# TLS Client
smtp_tls_exclude_ciphers = RC4, aNULL
2
  • Why did you add the aNULL cipher to that list?
    – Marian
    Oct 3 '16 at 20:43
  • 2
    To block anonymous DH and ECDH algorithms. It's not strictly necessary for this question, but typically you always want the server to be authenticated to avoid MITM attacks. Oct 3 '16 at 21:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.