1

how do i Disable the ssl3 cipher in OSX Server so as to not be vulnerable for POODLE ?

  • Which version of OS X server app? Since the "poodle" vulnerability is a problem where data is leaked on the client side, what specific client are you looking to secure? Web clients running on a machine with server.app configured, etc... – bmike Oct 15 '14 at 16:07
  • i actually have very old stuff running: Lion Server app and Snow Leopard Server. and it is about securing the mail functionality, which means it includes postfix, Apache and Dovecot as far as i reckon – Joachim Rady Oct 16 '14 at 13:14
2

Depends on the Server...

Apache: SSLProtocol All -SSLv2 -SSLv3

NGINX: ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

Postfix: smtpd_tls_mandatory_protocols=!SSLv2,!SSLv3

Sendmail (sendmail.mc): LOCAL_CONFIG O CipherList=HIGH O ServerSSLOptions=+SSL_OP_NO_SSLv2 +SSL_OP_NO_SSLv3 +SSL_OP_CIPHER_SERVER_PREFERENCE O ClientSSLOptions=+SSL_OP_NO_SSLv2 +SSL_OP_NO_SSLv3

Dovecot (In /etc/dovecot/local.conf or /etc/dovecot/conf.d): ssl_protocols = !SSLv2 !SSLv3

If you use virtual Servers with SSL, please note that you have to do this on all instances!

1

If you're configuring VirtualHosts using Server.app, it will always set SSLProxyProtocol -ALL +SSLv3 +TLSv1 in your site configs. You can edit this line in /Library/Server/Web/Config/apache2/sites/*.conf, but watch out in case Server.app undoes your changes after an edit.

To fix in future VirtualHosts, you could try editing the default template in /Library/Server/Web/Config/apache2/sites_disabled/0000_default_default.conf, but watch out - upgrading Server.app through the app store may restore the original default config. Previously default_default.conf.default was the template, but this doesn't seem to be the case in Mavericks.

If you are ignoring Server.app and doing manual configuration, you may be able to get away with configuring once by installing a config fragment in /Library/Server/Web/Config/apache2/other/ (or /etc/apache2/other/ if Server.app is not installed at all). Here's mine:

/Library/Server/Web/Config/apache2/other/die_poodle_die.conf:

<IfModule mod_ssl.c>
    SSLProtocol All -SSLv2 -SSLv3
</IfModule>

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.