Project

General

Profile

Tâche #11332

Distribution EOLE - Scénario #10951: Désactiver le protocole SSLv3 sur les services web

Désactiver le SSLv3 sur l'EAD

Added by Joël Cuissinat about 8 years ago. Updated about 8 years ago.

Status:
Fermé
Priority:
Normal
Assigned To:
Laurent Flori
Target version:
Distribution EOLE - Sprint_2015_17-19 - Équipe MENESR
Start date:
04/20/2015
Due date:
% Done:

0%

Estimated time:
2.00 h
Spent time:
1.17 h
Remaining (hours):
0.0

Description

Vérifier (8062/tcp : cgi LightSquid) en même temps !

Related issues

Related to Distribution EOLE - Scénario #11490: Réactiver SSLv3 sur les projets python Terminé (Sprint) 05/13/2015 05/29/2015
Related to Documentations - Tâche #17355: Documenter le fait qu'EOLE préconise l'utilisation du port 4203 plutôt que l'enregistrement des frontend EAD Fermé 09/30/2016

Associated revisions

Revision 8d4ffc79 (diff)
Added by Laurent Flori about 8 years ago

Désactivation du protocole SSLv3 pour l'EAD

  • lib/libsecure.py : utilisation de la méthode TLSv1_METHOD

Ref: #11332 @1h

Revision fed27b1e (diff)
Added by Laurent Flori about 8 years ago

Désactivation du protocole SSLv3 pour l'EAD

  • lib/libsecure.py : utilisation de la méthode TLSv1_METHOD

Ref: #11332 [2.4.0]

History

#1 Updated by Joël Cuissinat about 8 years ago

  • Parent task set to #10951

#2 Updated by Joël Cuissinat about 8 years ago

  • Description updated (diff)

#3 Updated by Laurent Flori about 8 years ago

  • Assigned To set to Laurent Flori

#4 Updated by Joël Cuissinat about 8 years ago

  • Status changed from Nouveau to En cours

#5 Updated by Joël Cuissinat about 8 years ago

  • Status changed from En cours to Résolu

#6 Updated by Joël Cuissinat about 8 years ago

  • Remaining (hours) changed from 2.0 to 0.25

#7 Updated by Daniel Dehennin about 8 years ago

  • Status changed from Résolu to Fermé
  • Remaining (hours) changed from 0.25 to 0.0

Ok avec le paquet eole-sso version 2.4.1-22 en eole-2.4.1-proposed-updates

gnutls-cli-debug -p 4200 scribe.ac-test.fr
Warning: getservbyport(4200) failed. Using port number as service.
GnuTLS debug client 3.3.15
Checking scribe.ac-test.fr:4200
                             for SSL 3.0 (RFC6101) support... no
                        whether we need to disable TLS 1.2... no
                        whether we need to disable TLS 1.1... no
                        whether we need to disable TLS 1.0... no
                        whether %NO_EXTENSIONS is required... no
                               whether %COMPAT is required... no
                             for TLS 1.0 (RFC2246) support... yes
                             for TLS 1.1 (RFC4346) support... no
                                  fallback from TLS 1.1 to... TLS 1.0
                             for TLS 1.2 (RFC5246) support... no
                               for certificate chain order... sorted
                  for safe renegotiation (RFC5746) support... yes
                           for heartbeat (RFC6520) support... no
                       for version rollback bug in RSA PMS... no
                  for version rollback bug in Client Hello... no
            whether the server ignores the RSA PMS version... no
            whether small records (512 bytes) are accepted... yes
    whether cipher suites not in SSL 3.0 spec are accepted... yes
whether a bogus TLS record version in the client hello is accepted... yes
         whether the server understands TLS closure alerts... yes
            whether the server supports session resumption... no
                      for anonymous authentication support... no
                      for ephemeral Diffie-Hellman support... no
                   for ephemeral EC Diffie-Hellman support... no
                  for AES-128-GCM cipher (RFC5288) support... no
                  for AES-128-CBC cipher (RFC3268) support... yes
             for CAMELLIA-128-GCM cipher (RFC6367) support... no
             for CAMELLIA-128-CBC cipher (RFC5932) support... yes
                     for 3DES-CBC cipher (RFC2246) support... yes
                  for ARCFOUR 128 cipher (RFC2246) support... yes
                                       for MD5 MAC support... yes
                                      for SHA1 MAC support... yes
                                    for SHA256 MAC support... no
                              for ZLIB compression support... no
                     for max record size (RFC6066) support... no
                for OCSP status response (RFC6066) support... no
              for OpenPGP authentication (RFC6091) support... no

Also available in: Atom PDF