dovecot - Dec 2014 - disabling certain ciphers

On Tue, Dec 02, 2014 at 08:34:50AM -0800, Darren Pilgrim
wrote:
> On 12/1/2014 9:44 PM, Will Yardley wrote:
> > On Mon, Dec 01, 2014 at 09:27:48PM -0800, Darren Pilgrim wrote:
> >> On 12/1/2014 4:43 PM, Will Yardley wrote:
> >>> Can you use both ssl_protocols *and* ssl_cipher_list in the
same config
> >>> (in a way that's sane)?
> >>
> >> Yes to both.  If you need to support older clients:
> > But why does ssl_protocols behave differently depending on if
> > $ssl_cipher_list is defined? Shouldn't !SSLv2 and !SSLv3 be
sufficient?
> >
> > It seems that if ssl_cipher_list is defined,
> > ssl_protocols = !SSLv2 !SSLv3
> >
> > results in TLS1.2 being the only one active, but if it is defined,
1.0,
> > 1.1, and 1.2 are all active?
> 
> Where are you see this behaviour?  What tool is reporting this?
I have mostly been testing with nmap, e.g.,
nmap -p 993 --script ssl-enum-ciphers [target]

This then breaks down the ciphers by protocol suite. I'll test with your
ssl_cipher_list example and see if it's reproducible.

w

I had some problems the first few times I restarted with ssl-params
seeming to hang, but it finally works.

I am able to get it to work with just:
ssl = required
ssl_dh_parameters_length = 4096
ssl_parameters_regenerate = 0
ssl_prefer_server_ciphers = yes
ssl_protocols = !SSLv2 !SSLv3
ssl_cipher_list = HIGH+kEECDH:HIGH+kEDH:!3DES:!aNULL:@STRENGTH

Thanks for your help!

w

On 12/2/2014 10:05 AM, Will Yardley wrote:
> I had some problems the first few times I restarted with ssl-params
> seeming to hang, but it finally works.
That would have been dovecot generating the 4096-bit DH parameters.  It 
can take a bit, but Dovecot is quite fast at it.  If Dovecot supported 
it, you could use OpenSSL to generate tested-safe DH parameters and 
supply them by file the same way you do for Postfix, nginx, etc.