Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5835 > unrolled thread

TLS1.0 and 1.1 with Cyrus (Debian Buster)

Back to article view | Back to linux.debian.security

Contents

  TLS1.0 and 1.1 with Cyrus (Debian Buster) Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2020-05-08 21:20 +0200
    Re: TLS1.0 and 1.1 with Cyrus (Debian Buster) Alberto Gonzalez Iniesta <agi@inittab.org> - 2020-05-08 21:30 +0200
      Re: TLS1.0 and 1.1 with Cyrus (Debian Buster) Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2020-05-09 01:30 +0200
        Re: TLS1.0 and 1.1 with Cyrus (Debian Buster) Jonas Andradas <j.andradas@gmail.com> - 2020-05-09 22:00 +0200
          Re: TLS1.0 and 1.1 with Cyrus (Debian Buster) Roman Medina-Heigl Hernandez <roman@rs-labs.com> - 2020-05-09 23:00 +0200

#5835 — TLS1.0 and 1.1 with Cyrus (Debian Buster)

Hi,

I upgraded from Jessie to Buster (thru Stretch) and noticed that Cyrus
(imaps & pop3s) stopped negotiating TLS 1.0 and 1.1 protocols (I know
they're not recommended but I need them for older clients). I tried
several combinations of tls_ciphers and tls_versions in /etc/imapd.conf
(even very permisive combinations) with no success.

Any idea what's happening?

I'm not sure whether it's really a Cyrus issue or some other kind of
hardening feature in Buster. In that last regard, I also modified
/etc/ssl/openssl and set MinProtocol = TLSv1.0 (just in case), although
I think this setting is only for client programs like Curl. But seeing
that config I tend to think that Buster may have other tweaks against
older protocols like TLSv1.{0,1} and one of them may be impacting my setup.

Cheers,

-r

[toc] | [next] | [standalone]

#5836

Hi,

It's probably due to new defaults in libssl.
Try adding:
MinProtocol = None
CipherString = DEFAULT
To:
/etc/ssl/openssl.cnf

Regards,

Alberto

On Fri, May 08, 2020 at 09:07:31PM +0200, Roman Medina-Heigl Hernandez wrote:
> Hi,
> 
> I upgraded from Jessie to Buster (thru Stretch) and noticed that Cyrus
> (imaps & pop3s) stopped negotiating TLS 1.0 and 1.1 protocols (I know
> they're not recommended but I need them for older clients). I tried
> several combinations of tls_ciphers and tls_versions in /etc/imapd.conf
> (even very permisive combinations) with no success.
> 
> Any idea what's happening?
> 
> I'm not sure whether it's really a Cyrus issue or some other kind of
> hardening feature in Buster. In that last regard, I also modified
> /etc/ssl/openssl and set MinProtocol = TLSv1.0 (just in case), although
> I think this setting is only for client programs like Curl. But seeing
> that config I tend to think that Buster may have other tweaks against
> older protocols like TLSv1.{0,1} and one of them may be impacting my setup.
> 
> Cheers,
> 
> -r
> 

-- 
Alberto Gonzalez Iniesta    | Formación, consultoría y soporte técnico
mailto/sip: agi@inittab.org | en GNU/Linux y software libre
Encrypted mail preferred    | http://inittab.com

Key fingerprint = 5347 CBD8 3E30 A9EB 4D7D  4BF2 009B 3375 6B9A AA55

[toc] | [prev] | [next] | [standalone]

#5837

Gracias Alberto. Now it's solved (it has been a little bit tricky).

My final config:

* /etc/imapd.conf
tls_ciphers: TLSv1.2:TLSv1:HIGH:!aNULL:@STRENGTH
tls_versions: tls1_0 tls1_1 tls1_2 tls1_3

* /etc/ssl/openssl.cnf
MinProtocol = TLSv1.0
CipherString = DEFAULT@SECLEVEL=2

Still don't know how to fix the "Has server cipher order?     no (NOT
ok)" warning in testssl.sh (https://github.com/drwetter/testssl.sh).


Cheers,
-r

El 08/05/2020 a las 21:27, Alberto Gonzalez Iniesta escribió:
> Hi,
>
> It's probably due to new defaults in libssl.
> Try adding:
> MinProtocol = None
> CipherString = DEFAULT
> To:
> /etc/ssl/openssl.cnf
>
> Regards,
>
> Alberto
>
> On Fri, May 08, 2020 at 09:07:31PM +0200, Roman Medina-Heigl Hernandez wrote:
>> Hi,
>>
>> I upgraded from Jessie to Buster (thru Stretch) and noticed that Cyrus
>> (imaps & pop3s) stopped negotiating TLS 1.0 and 1.1 protocols (I know
>> they're not recommended but I need them for older clients). I tried
>> several combinations of tls_ciphers and tls_versions in /etc/imapd.conf
>> (even very permisive combinations) with no success.
>>
>> Any idea what's happening?
>>
>> I'm not sure whether it's really a Cyrus issue or some other kind of
>> hardening feature in Buster. In that last regard, I also modified
>> /etc/ssl/openssl and set MinProtocol = TLSv1.0 (just in case), although
>> I think this setting is only for client programs like Curl. But seeing
>> that config I tend to think that Buster may have other tweaks against
>> older protocols like TLSv1.{0,1} and one of them may be impacting my setup.
>>
>> Cheers,
>>
>> -r
>>

[toc] | [prev] | [next] | [standalone]

#5839

[Multipart message — attachments visible in raw view] — view raw

Hi Roman,

Did you try with the following in imapd.conf?

tls_prefer_server_ciphers: 1


Regards,
Jonas.

On Sat, 9 May 2020, 01:22 Roman Medina-Heigl Hernandez, <roman@rs-labs.com>
wrote:

> Gracias Alberto. Now it's solved (it has been a little bit tricky).
>
> My final config:
>
> * /etc/imapd.conf
> tls_ciphers: TLSv1.2:TLSv1:HIGH:!aNULL:@STRENGTH
> tls_versions: tls1_0 tls1_1 tls1_2 tls1_3
>
> * /etc/ssl/openssl.cnf
> MinProtocol = TLSv1.0
> CipherString = DEFAULT@SECLEVEL=2
>
> Still don't know how to fix the "Has server cipher order?     no (NOT
> ok)" warning in testssl.sh (https://github.com/drwetter/testssl.sh).
>
>
> Cheers,
> -r
>
> El 08/05/2020 a las 21:27, Alberto Gonzalez Iniesta escribió:
> > Hi,
> >
> > It's probably due to new defaults in libssl.
> > Try adding:
> > MinProtocol = None
> > CipherString = DEFAULT
> > To:
> > /etc/ssl/openssl.cnf
> >
> > Regards,
> >
> > Alberto
> >
> > On Fri, May 08, 2020 at 09:07:31PM +0200, Roman Medina-Heigl Hernandez
> wrote:
> >> Hi,
> >>
> >> I upgraded from Jessie to Buster (thru Stretch) and noticed that Cyrus
> >> (imaps & pop3s) stopped negotiating TLS 1.0 and 1.1 protocols (I know
> >> they're not recommended but I need them for older clients). I tried
> >> several combinations of tls_ciphers and tls_versions in /etc/imapd.conf
> >> (even very permisive combinations) with no success.
> >>
> >> Any idea what's happening?
> >>
> >> I'm not sure whether it's really a Cyrus issue or some other kind of
> >> hardening feature in Buster. In that last regard, I also modified
> >> /etc/ssl/openssl and set MinProtocol = TLSv1.0 (just in case), although
> >> I think this setting is only for client programs like Curl. But seeing
> >> that config I tend to think that Buster may have other tweaks against
> >> older protocols like TLSv1.{0,1} and one of them may be impacting my
> setup.
> >>
> >> Cheers,
> >>
> >> -r
> >>
>
>

[toc] | [prev] | [next] | [standalone]

#5840

[Multipart message — attachments visible in raw view] — view raw

Wow, it works! Thank you!

" Has server cipher order?     yes (OK) -- TLS 1.3 and below"

Cheers,

-r

El 09/05/2020 a las 21:53, Jonas Andradas escribió:
> Hi Roman,
>
> Did you try with the following in imapd.conf?
>
> |tls_prefer_server_ciphers: 1|
>
> Regards,
> Jonas.
>
> On Sat, 9 May 2020, 01:22 Roman Medina-Heigl Hernandez,
> <roman@rs-labs.com <mailto:roman@rs-labs.com>> wrote:
>
>     Gracias Alberto. Now it's solved (it has been a little bit tricky).
>
>     My final config:
>
>     * /etc/imapd.conf
>     tls_ciphers: TLSv1.2:TLSv1:HIGH:!aNULL:@STRENGTH
>     tls_versions: tls1_0 tls1_1 tls1_2 tls1_3
>
>     * /etc/ssl/openssl.cnf
>     MinProtocol = TLSv1.0
>     CipherString = DEFAULT@SECLEVEL=2
>
>     Still don't know how to fix the "Has server cipher order?     no (NOT
>     ok)" warning in testssl.sh (https://github.com/drwetter/testssl.sh).
>
>
>     Cheers,
>     -r
>
>     El 08/05/2020 a las 21:27, Alberto Gonzalez Iniesta escribió:
>     > Hi,
>     >
>     > It's probably due to new defaults in libssl.
>     > Try adding:
>     > MinProtocol = None
>     > CipherString = DEFAULT
>     > To:
>     > /etc/ssl/openssl.cnf
>     >
>     > Regards,
>     >
>     > Alberto
>     >
>     > On Fri, May 08, 2020 at 09:07:31PM +0200, Roman Medina-Heigl
>     Hernandez wrote:
>     >> Hi,
>     >>
>     >> I upgraded from Jessie to Buster (thru Stretch) and noticed
>     that Cyrus
>     >> (imaps & pop3s) stopped negotiating TLS 1.0 and 1.1 protocols
>     (I know
>     >> they're not recommended but I need them for older clients). I tried
>     >> several combinations of tls_ciphers and tls_versions in
>     /etc/imapd.conf
>     >> (even very permisive combinations) with no success.
>     >>
>     >> Any idea what's happening?
>     >>
>     >> I'm not sure whether it's really a Cyrus issue or some other
>     kind of
>     >> hardening feature in Buster. In that last regard, I also modified
>     >> /etc/ssl/openssl and set MinProtocol = TLSv1.0 (just in case),
>     although
>     >> I think this setting is only for client programs like Curl. But
>     seeing
>     >> that config I tend to think that Buster may have other tweaks
>     against
>     >> older protocols like TLSv1.{0,1} and one of them may be
>     impacting my setup.
>     >>
>     >> Cheers,
>     >>
>     >> -r
>     >>
>

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web