Date: Mon, 1 Jun 2015 19:09:54 -0500 From: "Matthew D. Fuller" <fullermd@over-yonder.net> To: Tim Daneliuk <tundra@tundraware.com> Cc: FreeBSD Ports Mailing List <freebsd-ports@FreeBSD.ORG> Subject: Re: Port Fetch Failing Message-ID: <20150602000954.GF1733@over-yonder.net> In-Reply-To: <556CF2B1.30100@tundraware.com> References: <556CEBE2.7030005@tundraware.com> <556CEEB8.2090406@delphij.net> <556CF2B1.30100@tundraware.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Jun 01, 2015 at 07:02:57PM -0500 I heard the voice of Tim Daneliuk, and lo! it spake thus: > > This is what happens when you are: A) In a hurry and B) Paranoid and > C) Willing to copypasta a config without thought :( > > Thanks to you and Chuck, I have a more reasonable (I think): > > SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+EXP:-eNULL:-SSLv3:-SSLv2:TLS_RSA_WITH_AES_256_CBC_SHA:TLS_RSA_WITH_AES_256_CBC_SHA256 That still looks awful weird. Paranoid, and enabling +LOW? If you're having to explicitly list ciphers, you're probably on the wrong path... And I suspect the "-SSLv3:-SSLv2" isn't really what you want. You probably want to disable the _protocols_, not the _ciphers_. e.g., on a 10.x machine, I have SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!RC4 SSLProtocol All -SSLv2 -SSLv3 (I figure every extra character on the CipherSuite line means either I'm way smarter, or way dumber. And there's only so much smarter I can get, so...) -- Matthew Fuller (MF4839) | fullermd@over-yonder.net Systems/Network Administrator | http://www.over-yonder.net/~fullermd/ On the Internet, nobody can hear you scream.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20150602000954.GF1733>