rpm/dovecot23
SHA256
1
0
Fork 0
forked from pool/dovecot23
Code Pull Requests Activity
5c9be102f7
dovecot23/dovecot-2.3.0-better_ssl_defaults.patch

49 lines
2.5 KiB
Diff
Raw Normal View History

Accepting request 936363 from home:stroeder:network update to 2.3.17.1 and pigeonhole to 0.5.17.1 OBS-URL: https://build.opensuse.org/request/show/936363 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=99
2021-12-08 03:44:45 +01:00
diff -ur dovecot-2.3.17.1.orig/doc/example-config/conf.d/10-ssl.conf dovecot-2.3.17.1/doc/example-config/conf.d/10-ssl.conf
--- dovecot-2.3.17.1.orig/doc/example-config/conf.d/10-ssl.conf 2021-12-03 12:48:47.000000000 +0100
+++ dovecot-2.3.17.1/doc/example-config/conf.d/10-ssl.conf 2021-12-07 20:09:55.575984341 +0100
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
@@ -9,8 +9,8 @@
# dropping root privileges, so keep the key file unreadable by anyone but
# root. Included doc/mkcert.sh can be used to easily generate self-signed
# certificate, just make sure to update the domains in dovecot-openssl.cnf
Accepting request 901209 from home:stroeder:network - update to 2.3.15 and pigeonhole to 0.5.15: * security fixes for CVE-2021-29157, CVE-2021-33515, and CVE-2020-28200 FWIW: It seems to work for me on Tumbleweed x64_64. OBS-URL: https://build.opensuse.org/request/show/901209 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=96
2021-06-21 19:08:49 +02:00
-ssl_cert = </etc/ssl/certs/dovecot.pem
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
-ssl_key = </etc/ssl/private/dovecot.pem
Accepting request 936363 from home:stroeder:network update to 2.3.17.1 and pigeonhole to 0.5.17.1 OBS-URL: https://build.opensuse.org/request/show/936363 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=99
2021-12-08 03:44:45 +01:00
+#ssl_cert = </etc/ssl/certs/dovecot.pem
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
+#ssl_key = </etc/ssl/private/dovecot.pem
# If key file is password protected, give the password here. Alternatively
# give it when starting dovecot with -p parameter. Since this file is often
Accepting request 901209 from home:stroeder:network - update to 2.3.15 and pigeonhole to 0.5.15: * security fixes for CVE-2021-29157, CVE-2021-33515, and CVE-2020-28200 FWIW: It seems to work for me on Tumbleweed x64_64. OBS-URL: https://build.opensuse.org/request/show/901209 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=96
2021-06-21 19:08:49 +02:00
@@ -64,6 +64,7 @@
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
#ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH
# To disable non-EC DH, use:
#ssl_cipher_list = ALL:!DH:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH
+ssl_cipher_list = ALL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH
# Colon separated list of elliptic curves to use. Empty value (the default)
# means use the defaults from the SSL library. P-521:P-384:P-256 would be an
Accepting request 901209 from home:stroeder:network - update to 2.3.15 and pigeonhole to 0.5.15: * security fixes for CVE-2021-29157, CVE-2021-33515, and CVE-2020-28200 FWIW: It seems to work for me on Tumbleweed x64_64. OBS-URL: https://build.opensuse.org/request/show/901209 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=96
2021-06-21 19:08:49 +02:00
@@ -71,7 +72,7 @@
#ssl_curve_list =
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
# Prefer the server's order of ciphers over client's.
Accepting request 901209 from home:stroeder:network - update to 2.3.15 and pigeonhole to 0.5.15: * security fixes for CVE-2021-29157, CVE-2021-33515, and CVE-2020-28200 FWIW: It seems to work for me on Tumbleweed x64_64. OBS-URL: https://build.opensuse.org/request/show/901209 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=96
2021-06-21 19:08:49 +02:00
-#ssl_prefer_server_ciphers = no
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
+ssl_prefer_server_ciphers = yes
# SSL crypto device to use, for valid values run "openssl engine"
#ssl_crypto_device =
Accepting request 901209 from home:stroeder:network - update to 2.3.15 and pigeonhole to 0.5.15: * security fixes for CVE-2021-29157, CVE-2021-33515, and CVE-2020-28200 FWIW: It seems to work for me on Tumbleweed x64_64. OBS-URL: https://build.opensuse.org/request/show/901209 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=96
2021-06-21 19:08:49 +02:00
@@ -80,3 +81,4 @@
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
# compression - Enable compression.
# no_ticket - Disable SSL session tickets.
#ssl_options =
+ssl_options = no_compression
Accepting request 936363 from home:stroeder:network update to 2.3.17.1 and pigeonhole to 0.5.17.1 OBS-URL: https://build.opensuse.org/request/show/936363 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=99
2021-12-08 03:44:45 +01:00
diff -ur dovecot-2.3.17.1.orig/src/lib-master/master-service-ssl-settings.c dovecot-2.3.17.1/src/lib-master/master-service-ssl-settings.c
--- dovecot-2.3.17.1.orig/src/lib-master/master-service-ssl-settings.c 2021-12-03 12:48:47.000000000 +0100
+++ dovecot-2.3.17.1/src/lib-master/master-service-ssl-settings.c 2021-12-07 20:10:57.811653344 +0100
@@ -49,7 +49,7 @@
.ssl_client_ca_dir = "",
- update to 2.3.2 and pigeonhole to 0.5.2 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=22
2018-06-30 22:12:10 +02:00
.ssl_client_cert = "",
.ssl_client_key = "",
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
- .ssl_cipher_list = "ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH",
+ .ssl_cipher_list = "ALL:!LOW:!SSLv2:!EXP:!aNULL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH",
Accepting request 901209 from home:stroeder:network - update to 2.3.15 and pigeonhole to 0.5.15: * security fixes for CVE-2021-29157, CVE-2021-33515, and CVE-2020-28200 FWIW: It seems to work for me on Tumbleweed x64_64. OBS-URL: https://build.opensuse.org/request/show/901209 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=96
2021-06-21 19:08:49 +02:00
.ssl_cipher_suites = "", /* Use TLS library provided value */
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
.ssl_curve_list = "",
Accepting request 901209 from home:stroeder:network - update to 2.3.15 and pigeonhole to 0.5.15: * security fixes for CVE-2021-29157, CVE-2021-33515, and CVE-2020-28200 FWIW: It seems to work for me on Tumbleweed x64_64. OBS-URL: https://build.opensuse.org/request/show/901209 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=96
2021-06-21 19:08:49 +02:00
.ssl_min_protocol = "TLSv1.2",
Copy Permalink