<div dir="ltr"><div><div><div><div><div><div>Hi,<br><br></div>Now that I got SSL running properly I wanted to fiddle a bit with it, namely its cipher-list and there's something that if not good IMHO.<br><br></div>SSLv2 is obsolete and dangerous but SSLv3 is also largely deprecated, even the first versions of TLS are deprecated.<br><br></div>A strict minimum for a cipher-list should be :<br><br>HIGH:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1:!3DES:!RC4:!aNULL:!ADH<br><br></div>"MEDIUM" is also acceptable but ciphers should start at least at TLSv1.2!<br><br></div>The problem with Gluster setting is that's impossible to go above <br><br>HIGH:!SSLv2:!3DES:!RC4:!aNULL:!ADH<br><br></div>Which is bad.. Gluster uses SSL only and not TLS :-( An upgrade should be considered.<br clear="all"><div><div><div><div><div><div><div><div><br>-- <br><div class="gmail_signature">Unix _IS_ user friendly, it's just selective about who its friends are.</div>
</div></div></div></div></div></div></div></div></div>