From: Silvio Rhatto <rhatto@riseup.net>
Date: Fri, 19 Aug 2016 18:33:51 +0000 (-0300)
Subject: Dovecot: drops SSLv2 and SSLv3 via ssl_protocols
X-Git-Url: https://gitweb.fluxo.info/?a=commitdiff_plain;h=da63b146d91e351120f6de66bcebe91e6389f2f8;p=puppet-mail.git

Dovecot: drops SSLv2 and SSLv3 via ssl_protocols
---

diff --git a/templates/dovecot/dovecot.conf.wheezy.erb b/templates/dovecot/dovecot.conf.wheezy.erb
index cf2d720..0d18b85 100644
--- a/templates/dovecot/dovecot.conf.wheezy.erb
+++ b/templates/dovecot/dovecot.conf.wheezy.erb
@@ -40,7 +40,10 @@ ssl_key = </etc/ssl/private/cert.pem
 
 # SSL ciphers to use
 # See http://www.virtualmin.com/node/25057
+#     https://zmap.io/sslv3/servers.html
+#     https://security.stackexchange.com/questions/71872/disable-sslv3-in-dovecot-tls-handshaking-failed-no-shared-cipher
 ssl_cipher_list = HIGH:MEDIUM:+TLSv1:!SSLv2:SSLv3
+ssl_protocols = !SSlv2 !SSLv3
 
 userdb {
   args = uid=5000 gid=5000 home=/var/mail/virtual/%u allow_all_users=yes