Re: Verifying enabled ciphers?

2003-01-30 Thread Steve Chadsey
One more question regarding the SSLCipherSuite line. Our security auditor recommended that we change the line SSLCipherSuite HIGH:MEDIUM:!ADH to SSLCipherSuite HIGH:MEDIUM:-ADH:-aNULL What is the difference? openssl ciphers -v 'HIGH:MEDIUM:!ADH' and openssl ciphers -v

Re: Verifying enabled ciphers?

2003-01-30 Thread Lutz Jaenicke
On Thu, Jan 30, 2003 at 11:38:04AM -0700, Steve Chadsey wrote: One more question regarding the SSLCipherSuite line. Our security auditor recommended that we change the line SSLCipherSuite HIGH:MEDIUM:!ADH to SSLCipherSuite HIGH:MEDIUM:-ADH:-aNULL What is the difference? openssl

Re: Verifying enabled ciphers?

2003-01-27 Thread Steve Chadsey
On Fri, Jan 24, 2003 at 09:30:28AM -, [EMAIL PROTECTED] wrote: Try http://www.netcraft.com/sslwhats. It will give you a list of ciphers. OK. I did that, and the only one I support is RC4 with MD5. Strange, I thought I would be able to support more. Actually, to amend my previous post,

Re: Verifying enabled ciphers?

2003-01-27 Thread Lutz Jaenicke
On Mon, Jan 27, 2003 at 10:47:27AM -0700, Steve Chadsey wrote: On Fri, Jan 24, 2003 at 09:30:28AM -, [EMAIL PROTECTED] wrote: Try http://www.netcraft.com/sslwhats. It will give you a list of ciphers. OK. I did that, and the only one I support is RC4 with MD5. Strange, I thought I

RE: Verifying enabled ciphers?

2003-01-24 Thread John . Airey
Try http://www.netcraft.com/sslwhats. It will give you a list of ciphers. To unpack the terms: allows anonymous authentication - That sounds like allowing anyone to visit your site, since I've never heard of anonymous auth for http, only ftp. Of course, the evil IIS uses a specific account for

RE: Verifying enabled ciphers?

2003-01-24 Thread Boyle Owen
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Nearly everything we believe is second hand. For example, less than 500 people have seen the Earth from space, yet the majority of people believe it is round (or an oblate sphere for the pedants). Perhaps. But this

RE: Verifying enabled ciphers?

2003-01-24 Thread John . Airey
-Original Message- From: Boyle Owen [mailto:[EMAIL PROTECTED]] Sent: 24 January 2003 10:09 To: [EMAIL PROTECTED] Subject: RE: Verifying enabled ciphers? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Nearly everything we believe is second hand

RE: Verifying enabled ciphers?

2003-01-24 Thread John . Airey
Apologies for the last message everyone. I thought I was sending it personally, and not to the list. Must pay more attention in the mornings. - John Airey, BSc (Jt Hons), CNA, RHCE Internet systems support officer, ITCSD, Royal National Institute of the Blind, Bakewell Road, Peterborough PE2

RE: Verifying enabled ciphers?

2003-01-24 Thread R. DuFresne
On Fri, 24 Jan 2003 [EMAIL PROTECTED] wrote: [SNIP] A cynic may well claim that pictures of the Earth from space are faked. After all, that claim has been levelled against the Bible for years (and every year, more and more evidence is uncovered to support its authenticity. eg

RE: Verifying enabled ciphers?

2003-01-24 Thread john . f . kline
What round? Wow! That's news too me. Now I can resume my travels as I had paused for conscerns of walking off the edge -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Nearly everything we believe is second hand. For example, less than 500 people have

Re: Verifying enabled ciphers?

2003-01-23 Thread Lutz Jaenicke
On Thu, Jan 23, 2003 at 07:10:26PM -0700, Steve Chadsey wrote: How can I verify the ciphers enabled by my webserver? The reason I ask is because I have been informed by a third-party security auditor that my server allows anonymous authentication, allows cleartext communication, and supports