From: Tom Hughes Date: Fri, 5 Oct 2018 11:14:35 +0000 (+0100) Subject: Disable SSLv3 for SMTP connections X-Git-Url: https://git.openstreetmap.org./chef.git/commitdiff_plain/daa069c2e0be98ecc5a4f0366a3ddde5a8a71b5e Disable SSLv3 for SMTP connections --- diff --git a/cookbooks/exim/templates/default/exim4.conf.erb b/cookbooks/exim/templates/default/exim4.conf.erb index a00aefd8c..caac72c52 100644 --- a/cookbooks/exim/templates/default/exim4.conf.erb +++ b/cookbooks/exim/templates/default/exim4.conf.erb @@ -146,6 +146,10 @@ spamd_address = 127.0.0.1 783 tls_advertise_hosts = <; !127.0.0.1 ; !::1 +# Configured TLS cipher selection. + +tls_require_ciphers = NORMAL:%LATEST_RECORD_VERSION:-VERS-SSL3.0 + # Specify the location of the Exim server's TLS certificate and private key. # The private key must not be encrypted (password protected). You can put # the certificate and private key in the same file, in which case you only @@ -658,6 +662,7 @@ begin transports remote_smtp: driver = smtp multi_domain = false + tls_require_ciphers = NORMAL:%LATEST_RECORD_VERSION:-VERS-SSL3.0 # This transport is used for handling pipe deliveries generated by alias or