<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Dirk,<div><br></div><div>Terrific - thank you!</div><div><br><div>
<div style="orphans: 2; widows: 2;">--</div><div style="orphans: 2; widows: 2;"><b>Matt James</b></div><div style="orphans: 2; widows: 2;"><a href="http://rainstorminc.com">RainStorm, Inc</a></div><div style="orphans: 2; widows: 2;">(207) 866-3908 x54</div>
</div>
<br><div style=""><div>On Oct 17, 2014, at 11:51 AM, Dirk Estenfeld <<a href="mailto:dirk.estenfeld@bpanet.de">dirk.estenfeld@bpanet.de</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="DE" link="blue" vlink="purple" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Hello,<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">modify line 138 in file /etc/httpd/conf.d/ssl_perl.conf and restart apache for the VSites.<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">And modify line 46 in file /etc/admserv/conf.d/ssl.conf for admserv. Restart admserv after change.<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Best regards,<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Dirk<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div><p class="MsoNormal" style="margin: 0cm 0cm 6pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-US" style="font-size: 8pt; font-family: Arial, sans-serif; color: gray;"><br>Black Point Arts Internet Solutions GmbH - Hanauer Landstrasse 423a - 60314 Frankfurt<br><br><br></span><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"><o:p></o:p></span></p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0cm 0cm;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><b><span style="font-size: 11pt; font-family: Calibri, sans-serif;">Von:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;"><span class="Apple-converted-space"> </span><a href="mailto:blueonyx-bounces@mail.blueonyx.it" style="color: purple; text-decoration: underline;">blueonyx-bounces@mail.blueonyx.it</a><span class="Apple-converted-space"> </span>[<a href="mailto:blueonyx-bounces@mail.blueonyx.it" style="color: purple; text-decoration: underline;">mailto:blueonyx-bounces@mail.blueonyx.it</a>]<span class="Apple-converted-space"> </span><b>Im Auftrag von<span class="Apple-converted-space"> </span></b>Matt James<br><b>Gesendet:</b><span class="Apple-converted-space"> </span>Freitag, 17. Oktober 2014 14:53<br><b>An:</b><span class="Apple-converted-space"> </span>BlueOnyx General Mailing List<br><b>Betreff:</b><span class="Apple-converted-space"> </span>[BlueOnyx:16211] Re: SSL v3 POODLE vulnerability<o:p></o:p></span></div></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><o:p> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">Hi Michael,<o:p></o:p></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><o:p> </o:p></div></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">Thanks for the great instructions! We really appreciate how on top of this you are.<o:p></o:p></div></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><o:p> </o:p></div></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">I was able to shut off SSL3 for ProFTPd no problem, but my work to turn it off for Apache came up short. I'm running a 5107R and was unable to find the "SSLProtocol +ALL -SSLv2" reference in /usr/sausalito/handlers/base/apache/virtual_host.pl. I did a search for "SSL" looking for similar lines and found only unrelated strings. Can you confirm that this is the file to edit for a 5107R?<o:p></o:p></div></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><o:p> </o:p></div></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">Thanks!<o:p></o:p></div></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><o:p> </o:p></div><div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">--<o:p></o:p></div></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><b>Matt James</b><o:p></o:p></div></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><a href="http://rainstorminc.com/" style="color: purple; text-decoration: underline;">RainStorm, Inc</a><o:p></o:p></div></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">(207) 866-3908 x54<o:p></o:p></div></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><o:p> </o:p></div><div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">On Oct 14, 2014, at 10:54 PM, Michael Stauber <<a href="mailto:mstauber@blueonyx.it" style="color: purple; text-decoration: underline;">mstauber@blueonyx.it</a>> wrote:<o:p></o:p></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><br><br><o:p></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">Hi all,<br><br><br><o:p></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">I'll do some more digging and will eventually push an update that<br>disables the SSL v3.0 protocol on all BlueOnyx versions. But I'll give<br>it a few days as I want to do some more digging.<o:p></o:p></div></blockquote><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><br>I just did some digging and testing on EL6 based BlueOnyx (5107R, 5207R,<br>5108R, 5208R). In order to disable SSLv3 entirely the following needs to<br>be done:<br><br>ProFTPd:<br>========<br><br>/etc/proftpd.conf<br>Change ...<br> TLSProtocol SSLv3 TLSv1<br>... to ...<br> TLSProtocol TLSv1<br>/sbin/service xinetd restart<br><br>I'll eventually build an updated proftpd and publish it to the YUM<br>repositories.<br><br>Apache:<br>========<br><br>Pretty straightforward:<br><br>In /usr/sausalito/handlers/base/apache/virtual_host.pl:<br>Change ...<br>SSLProtocol +ALL -SSLv2<br>... to...<br>SSLProtocol +ALL -SSLv3 -SSLv2<br>Run /usr/sausalito/sbin/SSL_fixer.pl to update all VSites that have SSL<br>enabled to inherit the new configuration.<br><br>Dovecot:<br>========<br><br>This is the nasty bugger. On EL6 we're using Dovecot 2.0.9 as provided<br>by RedHat, CentOS or SL. Even though our OpenSSL supports TLSv1.2, this<br>Dovecot doesn't. It's simply to old for that. I tried to force it to not<br>use SSLv3 but to use TLSv1.0 instead. That didn't work. It started, by<br>my Thunderbird on Ubuntu 14.04 LTS still insisted in connecting via<br>SSLv3, for which this Dovecot then no longer has ciphers.<br><br>Ideally we'd need to update to Dovecot 2.2.X (v2.2.14 is the newest a<br>the time of this writing). Which supposedly supports TLSv1.2 and Perfect<br>Forwarding Secrecy.<br><br>Which then means I'd have to maintain Dovecot-2.2 out of the BlueOnyx<br>YUM repositories to provide updates for it. Which is right now handled<br>by upstream OS updates.<br><br>Sendmail:<br>========<br><br>I'm not sure if I want to mess with its ciphers and protocols, as it<br>kinda works pretty well as is.<br><br>--<span class="Apple-converted-space"> </span><br>With best regards<br><br>Michael Stauber<br>_______________________________________________<br>Blueonyx mailing list<br><a href="mailto:Blueonyx@mail.blueonyx.it" style="color: purple; text-decoration: underline;">Blueonyx@mail.blueonyx.it</a><br><a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx" style="color: purple; text-decoration: underline;">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a><o:p></o:p></div></blockquote></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><o:p> </o:p></div></div></div>_______________________________________________<br>Blueonyx mailing list<br><a href="mailto:Blueonyx@mail.blueonyx.it" style="color: purple; text-decoration: underline;">Blueonyx@mail.blueonyx.it</a><br><a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx" style="color: purple; text-decoration: underline;">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a></div></blockquote></div><br></div></body></html>