Re: Verifying enabled ciphers?

2003-01-30 Thread Lutz Jaenicke
On Thu, Jan 30, 2003 at 11:38:04AM -0700, Steve Chadsey wrote: > One more question regarding the SSLCipherSuite line. Our security > auditor recommended that we change the line > SSLCipherSuite HIGH:MEDIUM:!ADH > to > SSLCipherSuite HIGH:MEDIUM:-ADH:-aNULL > > What is the difference? > op

Re: Verifying enabled ciphers?

2003-01-30 Thread Steve Chadsey
One more question regarding the SSLCipherSuite line. Our security auditor recommended that we change the line SSLCipherSuite HIGH:MEDIUM:!ADH to SSLCipherSuite HIGH:MEDIUM:-ADH:-aNULL What is the difference? openssl ciphers -v 'HIGH:MEDIUM:!ADH' and openssl ciphers -v 'HIGH:MEDIUM:-ADH:

Re: Verifying enabled ciphers?

2003-01-27 Thread Lutz Jaenicke
On Mon, Jan 27, 2003 at 10:47:27AM -0700, Steve Chadsey wrote: > On Fri, Jan 24, 2003 at 09:30:28AM -, [EMAIL PROTECTED] wrote: > > Try http://www.netcraft.com/sslwhats. It will give you a list of ciphers. > > > > OK. I did that, and the only one I support is "RC4 with MD5". Strange, I > th

Re: Verifying enabled ciphers?

2003-01-27 Thread Steve Chadsey
On Fri, Jan 24, 2003 at 09:30:28AM -, [EMAIL PROTECTED] wrote: > Try http://www.netcraft.com/sslwhats. It will give you a list of ciphers. > OK. I did that, and the only one I support is "RC4 with MD5". Strange, I thought I would be able to support more. Actually, to amend my previous post

RE: Verifying enabled ciphers?

2003-01-24 Thread john . f . kline
What round? Wow! That's news too me. Now I can resume my travels as I had paused for conscerns of walking off the edge > >-Original Message- > >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] > > > >Nearly everything we believe is second hand. For example, less than 500 > >people

RE: Verifying enabled ciphers?

2003-01-24 Thread R. DuFresne
On Fri, 24 Jan 2003 [EMAIL PROTECTED] wrote: [SNIP] > A cynic may well claim that pictures of the Earth from space are faked. > After all, that claim has been levelled against the Bible for years (and > every year, more and more evidence is uncovered to support its authenticity. > eg http

RE: Verifying enabled ciphers?

2003-01-24 Thread John . Airey
Apologies for the last message everyone. I thought I was sending it personally, and not to the list. Must pay more attention in the mornings. - John Airey, BSc (Jt Hons), CNA, RHCE Internet systems support officer, ITCSD, Royal National Institute of the Blind, Bakewell Road, Peterborough PE2 6X

RE: Verifying enabled ciphers?

2003-01-24 Thread John . Airey
> -Original Message- > From: Boyle Owen [mailto:[EMAIL PROTECTED]] > Sent: 24 January 2003 10:09 > To: [EMAIL PROTECTED] > Subject: RE: Verifying enabled ciphers? > > > >-Original Message- > >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] &g

RE: Verifying enabled ciphers?

2003-01-24 Thread Boyle Owen
>-Original Message- >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] > >Nearly everything we believe is second hand. For example, less than 500 >people have seen the Earth from space, yet the majority of >people believe it is round (or an oblate sphere for the pedants). > Perhaps. But

RE: Verifying enabled ciphers?

2003-01-24 Thread John . Airey
ts). > -Original Message- > From: Steve Chadsey [mailto:[EMAIL PROTECTED]] > Sent: 24 January 2003 02:10 > To: [EMAIL PROTECTED] > Subject: Verifying enabled ciphers? > > > How can I verify the ciphers enabled by my webserver? > > The reason I a

Re: Verifying enabled ciphers?

2003-01-23 Thread Lutz Jaenicke
On Thu, Jan 23, 2003 at 07:10:26PM -0700, Steve Chadsey wrote: > How can I verify the ciphers enabled by my webserver? > > The reason I ask is because I have been informed by a third-party > security auditor that my server "allows anonymous authentication", > "allows cleartext communication", and

Verifying enabled ciphers?

2003-01-23 Thread Steve Chadsey
How can I verify the ciphers enabled by my webserver? The reason I ask is because I have been informed by a third-party security auditor that my server "allows anonymous authentication", "allows cleartext communication", and "supports weak encryption". I am unable to verify any of these claims on