Sorry for the delay, I wanted to update the status of this issue, as I did set the ssl_cipher_list in ASSP, I thought it worked for setting the cipher on SMTP (see below appears not now), but it does not appear to affect the https: connections on port 55555 and 55553 for the web interface? I don't know am I missing something else?
My setting: SSL_cipher_list:=RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!ADH:!AESGCM:!AES:!DES-CB C3-SHA:!CAMELLIA256-SHA:!CAMELLIA128-SHA:!AES256-SHA (which works for all other cpanel services) Tested with beast.pl script on port 55555 and 55553 as well as actually port 465 also and the result is Protocol: TLS v1 Server Preferred Cipher: AES256-SHA Vulnerable: YES Also tested with this as per cpanel guidelines ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:!SSLv2 And same result, which makes me thing the service is grabbing its setting from somewhere else because on the second one there is not even a mention of AES256-SHA Thoughts? John ------------------------------------------------------------------------------ See everything from the browser to the database with AppDynamics Get end-to-end visibility with application monitoring from AppDynamics Isolate bottlenecks and diagnose root cause in seconds. Start your free trial of AppDynamics Pro today! http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk _______________________________________________ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
