From 8d4ee517d61bfcce851e66872fcd762e9a5f751c Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Fri, 5 Oct 2018 15:47:45 +0100 Subject: [PATCH] Improve SMTP cipher selection --- cookbooks/exim/templates/default/exim4.conf.erb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cookbooks/exim/templates/default/exim4.conf.erb b/cookbooks/exim/templates/default/exim4.conf.erb index eb317b368..e0224872e 100644 --- a/cookbooks/exim/templates/default/exim4.conf.erb +++ b/cookbooks/exim/templates/default/exim4.conf.erb @@ -148,7 +148,7 @@ tls_advertise_hosts = <; !127.0.0.1 ; !::1 # Configured TLS cipher selection. -tls_require_ciphers = NORMAL:%LATEST_RECORD_VERSION:-ARCFOUR-128:-MD5:-SHA1:-VERS-SSL3.0:%SERVER_PRECEDENCE +tls_require_ciphers = NORMAL:-VERS-SSL3.0:-CIPHER-ALL:-SHA1:-MD5:+SHA1:+AES-256-GCM:+AES-256-CBC:+CAMELLIA-256-CBC:+AES-128-GCM:+AES-128-CBC:+CAMELLIA-128-CBC:%SERVER_PRECEDENCE # Specify the location of the Exim server's TLS certificate and private key. # The private key must not be encrypted (password protected). You can put @@ -662,7 +662,7 @@ begin transports remote_smtp: driver = smtp multi_domain = false - tls_require_ciphers = NORMAL:%LATEST_RECORD_VERSION:-ARCFOUR-128:-MD5:-SHA1:-VERS-SSL3.0:%SERVER_PRECEDENCE + tls_require_ciphers = NORMAL:-VERS-SSL3.0:-CIPHER-ALL:-SHA1:-MD5:+SHA1:+AES-256-GCM:+AES-256-CBC:+CAMELLIA-256-CBC:+AES-128-GCM:+AES-128-CBC:+CAMELLIA-128-CBC:%SERVER_PRECEDENCE # This transport is used for handling pipe deliveries generated by alias or -- 2.43.2