From daa069c2e0be98ecc5a4f0366a3ddde5a8a71b5e Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Fri, 5 Oct 2018 12:14:35 +0100 Subject: [PATCH] Disable SSLv3 for SMTP connections --- cookbooks/exim/templates/default/exim4.conf.erb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/cookbooks/exim/templates/default/exim4.conf.erb b/cookbooks/exim/templates/default/exim4.conf.erb index a00aefd8c..caac72c52 100644 --- a/cookbooks/exim/templates/default/exim4.conf.erb +++ b/cookbooks/exim/templates/default/exim4.conf.erb @@ -146,6 +146,10 @@ spamd_address = 127.0.0.1 783 tls_advertise_hosts = <; !127.0.0.1 ; !::1 +# Configured TLS cipher selection. + +tls_require_ciphers = NORMAL:%LATEST_RECORD_VERSION:-VERS-SSL3.0 + # Specify the location of the Exim server's TLS certificate and private key. # The private key must not be encrypted (password protected). You can put # the certificate and private key in the same file, in which case you only @@ -658,6 +662,7 @@ begin transports remote_smtp: driver = smtp multi_domain = false + tls_require_ciphers = NORMAL:%LATEST_RECORD_VERSION:-VERS-SSL3.0 # This transport is used for handling pipe deliveries generated by alias or -- 2.43.2