rpm/dovecot23
SHA256
1
0
Fork 0
forked from pool/dovecot23
Code Pull Requests Activity
aca9b3f546
dovecot23/dovecot-2.3.0-better_ssl_defaults.patch

51 lines
2.6 KiB
Diff
Raw Normal View History

Accepting request 940830 from home:favogt:branches:server:mail - Update dovecot-2.3.0-dont_use_etc_ssl_certs.patch to also adjust the path in the 10-ssl.conf example (boo#1193758) - Rebase dovecot-2.3.0-better_ssl_defaults.patch OBS-URL: https://build.opensuse.org/request/show/940830 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=100
2021-12-16 09:56:12 +01:00
Index: dovecot-2.3.17.1/doc/example-config/conf.d/10-ssl.conf
===================================================================
--- dovecot-2.3.17.1.orig/doc/example-config/conf.d/10-ssl.conf
+++ dovecot-2.3.17.1/doc/example-config/conf.d/10-ssl.conf
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
@@ -9,8 +9,8 @@
# dropping root privileges, so keep the key file unreadable by anyone but
# root. Included doc/mkcert.sh can be used to easily generate self-signed
# certificate, just make sure to update the domains in dovecot-openssl.cnf
Accepting request 950732 from home:dimstar:Factory - Fix dovecot-2.3.0-dont_use_etc_ssl_certs.patch: Align the certificate path/filenames to /etc/ssl/private/*.crt, which happens to match what the patch also does for mkert.sh (boo#1193909). - Rebase dovecot-2.3.0-better_ssl_defaults.patch OBS-URL: https://build.opensuse.org/request/show/950732 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=101
2022-02-03 13:40:28 +01:00
-ssl_cert = </etc/ssl/private/dovecot.crt
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
-ssl_key = </etc/ssl/private/dovecot.pem
Accepting request 950732 from home:dimstar:Factory - Fix dovecot-2.3.0-dont_use_etc_ssl_certs.patch: Align the certificate path/filenames to /etc/ssl/private/*.crt, which happens to match what the patch also does for mkert.sh (boo#1193909). - Rebase dovecot-2.3.0-better_ssl_defaults.patch OBS-URL: https://build.opensuse.org/request/show/950732 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=101
2022-02-03 13:40:28 +01:00
+#ssl_cert = </etc/ssl/private/dovecot.crt
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
+#ssl_key = </etc/ssl/private/dovecot.pem
# If key file is password protected, give the password here. Alternatively
# give it when starting dovecot with -p parameter. Since this file is often
Accepting request 940830 from home:favogt:branches:server:mail - Update dovecot-2.3.0-dont_use_etc_ssl_certs.patch to also adjust the path in the 10-ssl.conf example (boo#1193758) - Rebase dovecot-2.3.0-better_ssl_defaults.patch OBS-URL: https://build.opensuse.org/request/show/940830 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=100
2021-12-16 09:56:12 +01:00
@@ -64,6 +64,7 @@ ssl_key = </etc/ssl/private/dovecot.pem
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
#ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH
# To disable non-EC DH, use:
#ssl_cipher_list = ALL:!DH:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH
+ssl_cipher_list = ALL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH
# Colon separated list of elliptic curves to use. Empty value (the default)
# means use the defaults from the SSL library. P-521:P-384:P-256 would be an
Accepting request 940830 from home:favogt:branches:server:mail - Update dovecot-2.3.0-dont_use_etc_ssl_certs.patch to also adjust the path in the 10-ssl.conf example (boo#1193758) - Rebase dovecot-2.3.0-better_ssl_defaults.patch OBS-URL: https://build.opensuse.org/request/show/940830 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=100
2021-12-16 09:56:12 +01:00
@@ -71,7 +72,7 @@ ssl_key = </etc/ssl/private/dovecot.pem
Accepting request 901209 from home:stroeder:network - update to 2.3.15 and pigeonhole to 0.5.15: * security fixes for CVE-2021-29157, CVE-2021-33515, and CVE-2020-28200 FWIW: It seems to work for me on Tumbleweed x64_64. OBS-URL: https://build.opensuse.org/request/show/901209 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=96
2021-06-21 19:08:49 +02:00
#ssl_curve_list =
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
# Prefer the server's order of ciphers over client's.
Accepting request 901209 from home:stroeder:network - update to 2.3.15 and pigeonhole to 0.5.15: * security fixes for CVE-2021-29157, CVE-2021-33515, and CVE-2020-28200 FWIW: It seems to work for me on Tumbleweed x64_64. OBS-URL: https://build.opensuse.org/request/show/901209 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=96
2021-06-21 19:08:49 +02:00
-#ssl_prefer_server_ciphers = no
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
+ssl_prefer_server_ciphers = yes
# SSL crypto device to use, for valid values run "openssl engine"
#ssl_crypto_device =
Accepting request 940830 from home:favogt:branches:server:mail - Update dovecot-2.3.0-dont_use_etc_ssl_certs.patch to also adjust the path in the 10-ssl.conf example (boo#1193758) - Rebase dovecot-2.3.0-better_ssl_defaults.patch OBS-URL: https://build.opensuse.org/request/show/940830 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=100
2021-12-16 09:56:12 +01:00
@@ -80,3 +81,4 @@ ssl_key = </etc/ssl/private/dovecot.pem
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
# compression - Enable compression.
# no_ticket - Disable SSL session tickets.
#ssl_options =
+ssl_options = no_compression
Accepting request 940830 from home:favogt:branches:server:mail - Update dovecot-2.3.0-dont_use_etc_ssl_certs.patch to also adjust the path in the 10-ssl.conf example (boo#1193758) - Rebase dovecot-2.3.0-better_ssl_defaults.patch OBS-URL: https://build.opensuse.org/request/show/940830 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=100
2021-12-16 09:56:12 +01:00
Index: dovecot-2.3.17.1/src/lib-master/master-service-ssl-settings.c
===================================================================
--- dovecot-2.3.17.1.orig/src/lib-master/master-service-ssl-settings.c
+++ dovecot-2.3.17.1/src/lib-master/master-service-ssl-settings.c
@@ -49,7 +49,7 @@ static const struct master_service_ssl_s
Accepting request 936363 from home:stroeder:network update to 2.3.17.1 and pigeonhole to 0.5.17.1 OBS-URL: https://build.opensuse.org/request/show/936363 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=99
2021-12-08 03:44:45 +01:00
.ssl_client_ca_dir = "",
- update to 2.3.2 and pigeonhole to 0.5.2 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=22
2018-06-30 22:12:10 +02:00
.ssl_client_cert = "",
.ssl_client_key = "",
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
- .ssl_cipher_list = "ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH",
+ .ssl_cipher_list = "ALL:!LOW:!SSLv2:!EXP:!aNULL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH",
Accepting request 901209 from home:stroeder:network - update to 2.3.15 and pigeonhole to 0.5.15: * security fixes for CVE-2021-29157, CVE-2021-33515, and CVE-2020-28200 FWIW: It seems to work for me on Tumbleweed x64_64. OBS-URL: https://build.opensuse.org/request/show/901209 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=96
2021-06-21 19:08:49 +02:00
.ssl_cipher_suites = "", /* Use TLS library provided value */
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
.ssl_curve_list = "",
Accepting request 901209 from home:stroeder:network - update to 2.3.15 and pigeonhole to 0.5.15: * security fixes for CVE-2021-29157, CVE-2021-33515, and CVE-2020-28200 FWIW: It seems to work for me on Tumbleweed x64_64. OBS-URL: https://build.opensuse.org/request/show/901209 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=96
2021-06-21 19:08:49 +02:00
.ssl_min_protocol = "TLSv1.2",
Copy Permalink