From 6c9397a5224ae393d110e3ba1f0b59461554c800 Mon Sep 17 00:00:00 2001 From: Jonas Smedegaard Date: Wed, 18 Jan 2017 18:04:44 +0100 Subject: Tighten crypto, based on blog entry drawing from bettercrypto.org. --- ejabberd/defs.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) (limited to 'ejabberd') diff --git a/ejabberd/defs.yml b/ejabberd/defs.yml index aeb08f9..8c7a4f6 100644 --- a/ejabberd/defs.yml +++ b/ejabberd/defs.yml @@ -1,5 +1,4 @@ -# Origin: https://github.com/jabber-at/config -# Origin: https://gitlab.com/hanno/ejabberd-config +# https://feeding.cloud.geek.nz/posts/running-your-own-xmpp-server-debian-ubuntu/ # The default ciphers-setting is found here: # https://github.com/processone/tls/blob/master/c_src/p1_tls_drv.c @@ -10,7 +9,7 @@ define_macro: - "no_sslv2" - "no_sslv3" - "no_tlsv1" - 'TLS_CIPHERS': "ECDH:DH:!CAMELLIA128:!3DES:!MD5:!RC4:!aNULL:!NULL:!EXPORT:!LOW:!MEDIUM" - #'TLS_CIPHERS': "HIGH:!MEDIUM:!LOW:!3DES:!CAMELLIA:!aNULL:!RSA@STRENGTH" - #'TLS_CIPHERS': "HIGH:!3DES:!aNULL:!SSLv2:@STRENGTH" + - "no_tlsv1_1" + - "cipher_server_preference" + 'TLS_CIPHERS': "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256" CERT_PATH: "/etc/ejabberd/ejabberd.pem" -- cgit v1.2.3