<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 01/26/2016 10:00 AM, Martin Basti
wrote:<br>
</div>
<blockquote cite="mid:56A7A636.50709@redhat.com" type="cite">
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
<br>
<br>
<div class="moz-cite-prefix">On 26.01.2016 17:39, Terry John
wrote:<br>
</div>
<blockquote
cite="mid:AM2PR07MB08658C5F08694BF781FAA6BCCDD80@AM2PR07MB0865.eurprd07.prod.outlook.com"
type="cite">
<pre wrap="">Thanks for this. I've had a look today
We are running:
ipa-server.x86_64 3.0.0-47.el6.centos
and some of the directives did not work, namely allowWeakCipher, sslVersionMin and sslVersionMax . So I commented them out
The ldapupdater then seems happy but when I went to restart IPA. The ldap server wasn't happy with cipher TLS_RSA_WITH_AES_256_CBC_SHA256 and would not start.
Now I can't change anything and it doesn't work. Reaching for my backup.....</pre>
</blockquote>
IMO you can manually change dse.ldif, remove cipher from there and
start DS<br>
the file should be in <span style="color: rgb(51, 51, 51); font-family: 'dejavu sans mono', 'liberation mono', 'bitstream vera mono', 'dejavu mono', monospace; font-size: 13.86px; font-style: normal; font-variant: normal; font-weight: bold; letter-spacing: normal; line-height: 21px; orphans: 4; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 4; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: rgb(255, 255, 255);">/etc/dirsrv/slapd-</span><em class="replaceable" style="box-sizing: border-box; widows: 4; orphans: 4; color: rgb(51, 51, 51); font-family: 'dejavu sans mono', 'liberation mono', 'bitstream vera mono', 'dejavu mono', monospace; font-size: 13.86px; font-variant: normal; font-weight: bold; letter-spacing: normal; line-height: 21px; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; word-spacing: 0px; -webkit-text-stroke-width: 0px; !
ba!
ckground-c
olor: rgb(255, 255, 255);"><code style="box-sizing: border-box; widows: 4 !important; orphans: 4 !important; font-family: 'dejavu sans mono', 'liberation mono', 'bitstream vera mono', 'dejavu mono', monospace; font-size: 12.474px; padding: 0px; color: inherit; border-radius: 0px; font-weight: bold; white-space: pre-wrap; word-wrap: break-word; display: inline-block; background-color: transparent;">instance_name</code></em><br>
<blockquote
cite="mid:AM2PR07MB08658C5F08694BF781FAA6BCCDD80@AM2PR07MB0865.eurprd07.prod.outlook.com"
type="cite"> </blockquote>
</blockquote>
<br>
Make sure slapd is completely shutdown before you edit dse.ldif, or
your changes will be wiped out.<br>
<br>
<blockquote cite="mid:56A7A636.50709@redhat.com" type="cite">
<blockquote
cite="mid:AM2PR07MB08658C5F08694BF781FAA6BCCDD80@AM2PR07MB0865.eurprd07.prod.outlook.com"
type="cite">
<pre wrap="">
Terry
-----Original Message-----
From: Christian Heimes [<a moz-do-not-send="true" class="moz-txt-link-freetext" href="mailto:cheimes@redhat.com">mailto:cheimes@redhat.com</a>]
Sent: 22 January 2016 10:03
To: Terry John; Martin Kosek; <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>
Subject: Re: [Freeipa-users] FREAK Vulnerability
On 2016-01-21 17:54, Terry John wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Thanks for the info. I have tried nearly all the NSSCipherSuite settings in that ticket but none so far has eliminated the FREAK report.
Christian thanks for the heads up on the syntax, I wasn't sure of what
I was doing
Each time I've made a change I've run an sslscan from the OpenVAS scanner and I do get a different result each time but the errors still remains in OpenVAS.
Aaargh! Just noticed the port is 636/tcp(!) which is ns-slapd.
Back to the drawing board :-)
</pre>
</blockquote>
<pre wrap="">Hi Terry,
you can give the attached file a try. It's a ldif file for ipa-ldap-updater. You need to run the command on the machine as root and restart 389-DS.
The hardened TLS configuration is highly experimental and comes with no warranty whatsoever. The configuration works on my tests systems with Python's ldap client and Apache Directory Studio. It may not work with other clients, especially older clients or clients in FIPS mode.
Christian
The Manheim group of companies within the UK comprises: Manheim Europe Limited (registered number: 03183918), Manheim Auctions Limited (registered number: 00448761), Manheim Retail Services Limited (registered number: 02838588), Motors.co.uk Limited (registered number: 05975777), Real Time Communications Limited (registered number: 04277845) and Complete Automotive Solutions Limited (registered number: 05302535). Each of these companies is registered in England and Wales with the registered office address of Central House, Leeds Road, Rothwell, Leeds LS26 0JE. The Manheim group of companies operates under various brand/trading names including Manheim Inspection Services, Manheim Auctions, Manheim Direct, Manheim De-fleet and Manheim Aftersales Solutions.
V:0CF72C13B2AC
</pre>
</blockquote>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>