Disable SSLv3 and RC4

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Nikos,

That was spot on! That config line gives me A- on Qualy's ssllabs.
I get the "-" because the server does not support "Forward Secrecy"

Using the following line should solve fwd secrecy and give me A+ at the theoretical cost of breaking old clients, as per the manual.

tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0:-ARCFOUR-128"

In reality using that line makes the server unreachable by Qualys, Firefox or Cisco Anyconnect.

"ocserv[18873]: GnuTLS error (at worker-vpn.c:585): Could not negotiate a supported cipher suite."


Any ideas?

Thanks,
Lucian

--
Sent from the Delta quadrant using Borg technology!

Nux!
www.nux.ro

----- Original Message -----
> From: "Nux!" <nux at li.nux.ro>
> To: "Nikos Mavrogiannopoulos" <n.mavrogiannopoulos at gmail.com>
> Cc: "openconnect-devel" <openconnect-devel at lists.infradead.org>
> Sent: Tuesday, 13 September, 2016 15:33:15
> Subject: Re: Disable SSLv3 and RC4

> Thanks Nikos, I'll have a look at that option.
> 
> Lucian
> 
> --
> Sent from the Delta quadrant using Borg technology!
> 
> Nux!
> www.nux.ro
> 
> ----- Original Message -----
>> From: "Nikos Mavrogiannopoulos" <n.mavrogiannopoulos at gmail.com>
>> To: "Nux!" <nux at li.nux.ro>
>> Cc: "openconnect-devel" <openconnect-devel at lists.infradead.org>
>> Sent: Tuesday, 13 September, 2016 15:20:44
>> Subject: Re: Disable SSLv3 and RC4
> 
>> On Mon, Sep 12, 2016 at 3:37 PM, Nux! <nux at li.nux.ro> wrote:
>>> Hello,
>>>
>>> SSLLabs are currently giving my ocserv grade C because:
>>> This server is vulnerable to the POODLE attack. If possible, disable SSL 3 to
>>> mitigate. Grade capped to C.
>>> This server accepts RC4 cipher, but only with older protocol versions. Grade
>>> capped to B.
>> 
>> Check the tls-priorities option. Most likely you need to set something like:
> > tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0:-ARCFOUR-128"



[Index of Archives]     [Linux Samsung SoC]     [Linux Rockchip SoC]     [Linux Actions SoC]     [Linux for Synopsys ARC Processors]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]


  Powered by Linux