Re: packages.nginx.org IPv6 SSL is broken

2020-09-29 Thread sergio
On 28/09/2020 13:28, Sergey Budnevitch wrote: It works actually. Indeed. This has worked before, so I was wrong. It works on router, but not on clients. > was in tunnel and broken PMTUD Yep, I'm using HE tunnel with 1480 MTU auto configured. > so also try to reduce MTU on the interface. B

Re: SSL routines:tls_process_client_hello:version too low

2020-09-29 Thread jriker1
Thanks for the replies. I can't debug right now as at a hotel and can't turn on NGINX as if/when it fails I won't be able to access my servers again so will do that later this week however right now I am on NGINX 1.14.1. Essentials Server 2016 is basically RD Gateway. My configuration right now

Re: Simple SMTP proxy without an auth (pass AUTH command to backend)

2020-09-29 Thread Francis Daly
On Tue, Sep 29, 2020 at 11:24:14AM -0400, kay wrote: Hi there, > I'd like to use nginx to serve TLS and/or StartTLS connections only, the > rest must be "proxy passed" without a modification to the backend. "TLS-only" might work if you use "stream" rather than "mail", so that nginx is the TLS-te

Re: SSL routines:tls_process_client_hello:version too low

2020-09-29 Thread Francis Daly
On Tue, Sep 29, 2020 at 05:06:32PM -0400, jriker1 wrote: Hi there, > Thanks. Only thing I can see in a Wireshark trace is TLS 1.2 so shouldn't > be an issue from what I can see but who knows. > > So it works without NGINX but that said couple things. > > 1. Is there a way to just make NGINX ac

Re: SSL routines:tls_process_client_hello:version too low

2020-09-29 Thread Sergey Kandaurov
> On 28 Sep 2020, at 23:12, jriker1 wrote: > > Hope I can post this as Chrome keeps complaining this site has a data > breach. The primary interface is using mailing lists: http://nginx.org/en/support.html > > I have been using NGINX to route my 443 traffic for two servers for a while > now.

Re: SSL routines:tls_process_client_hello:version too low

2020-09-29 Thread jriker1
Thanks. Only thing I can see in a Wireshark trace is TLS 1.2 so shouldn't be an issue from what I can see but who knows. So it works without NGINX but that said couple things. 1. Is there a way to just make NGINX accept things and work? Way to prove it's a TLS issue then? 2. What would have cha

Re: SSL routines:tls_process_client_hello:version too low

2020-09-29 Thread Francis Daly
On Mon, Sep 28, 2020 at 06:12:24PM -0400, jriker1 wrote: Hi there, > What I get in the error logs when this happens is: > > 2020/09/28 05:09:50 [crit] 7556#7556: *1366 SSL_do_handshake() failed (SSL: > error:1417D18C:SSL routines:tls_process_client_hello:version too low) while > SSL handshaking,

Re: Nginx configuration to secure Baïkal installation

2020-09-29 Thread Francis Daly
On Sat, Sep 26, 2020 at 05:23:30AM -0400, Amateur Synologist wrote: Hi there, I think your first question was "which file should this go in"? You may have the answer already -- basically, it is "whichever file your nginx reads". If you have a running system, that is "the -c argument to nginx";

njs-0.4.4

2020-09-29 Thread Dmitry Volyntsev
Hello, I'm glad to announce a new release of NGINX JavaScript module (njs). This release proceeds to extend the coverage of ECMAScript specifications. Notable new features: - Buffer object. : >> var buf = Buffer.from([0x80,206,177,206,178]) : undefined : >> buf.slice(1).toString() : 'αβ' : >> b

Simple SMTP proxy without an auth (pass AUTH command to backend)

2020-09-29 Thread kay
I'd like to use nginx to serve TLS and/or StartTLS connections only, the rest must be "proxy passed" without a modification to the backend. Unfortunately I noticed https://www.ruby-forum.com/t/nginx-does-not-pass-smtp-auth-command-to-server/184290 topic, where Maxim Dounin mentioned that it is imp

nginx-1.19.3

2020-09-29 Thread Maxim Dounin
Changes with nginx 1.19.329 Sep 2020 *) Feature: the ngx_stream_set_module. *) Feature: the "proxy_cookie_flags" directive. *) Feature: the "userid_flags" directive. *) Bugfix: the "stale-if-error" cache control extension was erroneously