<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.E-MailFormatvorlage17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">modify line 138 in file /etc/httpd/conf.d/ssl_perl.conf and restart apache for the VSites.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">And modify line 46 in file /etc/admserv/conf.d/ssl.conf for admserv. Restart admserv after change.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">Best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">Dirk<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:6.0pt;margin-right:0cm;margin-bottom:6.0pt;margin-left:0cm">
<span lang="EN-US" style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray"><br>
Black Point Arts Internet Solutions GmbH - Hanauer Landstrasse 423a - 60314 Frankfurt<br>
<br>
<br>
</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Von:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> blueonyx-bounces@mail.blueonyx.it [mailto:blueonyx-bounces@mail.blueonyx.it]
<b>Im Auftrag von </b>Matt James<br>
<b>Gesendet:</b> Freitag, 17. Oktober 2014 14:53<br>
<b>An:</b> BlueOnyx General Mailing List<br>
<b>Betreff:</b> [BlueOnyx:16211] Re: SSL v3 POODLE vulnerability<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi Michael,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks for the great instructions! We really appreciate how on top of this you are.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I was able to shut off SSL3 for ProFTPd no problem, but my work to turn it off for Apache came up short. I'm running a 5107R and was unable to find the "SSLProtocol +ALL -SSLv2" reference in /usr/sausalito/handlers/base/apache/virtual_host.pl.
I did a search for "SSL" looking for similar lines and found only unrelated strings. Can you confirm that this is the file to edit for a 5107R?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks!<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">--<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><b>Matt James</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="http://rainstorminc.com">RainStorm, Inc</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">(207) 866-3908 x54<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Oct 14, 2014, at 10:54 PM, Michael Stauber <<a href="mailto:mstauber@blueonyx.it">mstauber@blueonyx.it</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">Hi all,<br>
<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">I'll do some more digging and will eventually push an update that<br>
disables the SSL v3.0 protocol on all BlueOnyx versions. But I'll give<br>
it a few days as I want to do some more digging.<o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><br>
I just did some digging and testing on EL6 based BlueOnyx (5107R, 5207R,<br>
5108R, 5208R). In order to disable SSLv3 entirely the following needs to<br>
be done:<br>
<br>
ProFTPd:<br>
========<br>
<br>
/etc/proftpd.conf<br>
Change ...<br>
TLSProtocol SSLv3 TLSv1<br>
... to ...<br>
TLSProtocol TLSv1<br>
/sbin/service xinetd restart<br>
<br>
I'll eventually build an updated proftpd and publish it to the YUM<br>
repositories.<br>
<br>
Apache:<br>
========<br>
<br>
Pretty straightforward:<br>
<br>
In /usr/sausalito/handlers/base/apache/virtual_host.pl:<br>
Change ...<br>
SSLProtocol +ALL -SSLv2<br>
... to...<br>
SSLProtocol +ALL -SSLv3 -SSLv2<br>
Run /usr/sausalito/sbin/SSL_fixer.pl to update all VSites that have SSL<br>
enabled to inherit the new configuration.<br>
<br>
Dovecot:<br>
========<br>
<br>
This is the nasty bugger. On EL6 we're using Dovecot 2.0.9 as provided<br>
by RedHat, CentOS or SL. Even though our OpenSSL supports TLSv1.2, this<br>
Dovecot doesn't. It's simply to old for that. I tried to force it to not<br>
use SSLv3 but to use TLSv1.0 instead. That didn't work. It started, by<br>
my Thunderbird on Ubuntu 14.04 LTS still insisted in connecting via<br>
SSLv3, for which this Dovecot then no longer has ciphers.<br>
<br>
Ideally we'd need to update to Dovecot 2.2.X (v2.2.14 is the newest a<br>
the time of this writing). Which supposedly supports TLSv1.2 and Perfect<br>
Forwarding Secrecy.<br>
<br>
Which then means I'd have to maintain Dovecot-2.2 out of the BlueOnyx<br>
YUM repositories to provide updates for it. Which is right now handled<br>
by upstream OS updates.<br>
<br>
Sendmail:<br>
========<br>
<br>
I'm not sure if I want to mess with its ciphers and protocols, as it<br>
kinda works pretty well as is.<br>
<br>
-- <br>
With best regards<br>
<br>
Michael Stauber<br>
_______________________________________________<br>
Blueonyx mailing list<br>
<a href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a><br>
<a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>