Here's where I usually point:
http://www-01.ibm.com/support/docview.wss?uid=nas8N1020876
Just to clarify, IBM does remove weak ciphers via PTF. For example, see the removal of 3DES here:
http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697
Steve Pitcher
iTech Solutions
Office: (203) 744-7854 Ext. 176
Mobile: (902) 301-0810
http://www.itechsol.com
http://www.iInTheCloud.com
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Rob Berendt
Sent: Tuesday, January 9, 2018 5:23 PM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Subject: RE: V7R3 SSL system values and SSLCONFIG settings - is it ok to leave all at default?
Is there a one stop shopping site which lists currently acceptable ciphers, or currently unacceptable ciphers (and maybe the CVE(s) which flags them so), and is reasonably close to calling the cipher what IBM calls them in QSSLCSL?
Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com
From: Steve Pitcher <SPitcher@xxxxxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 01/09/2018 04:09 PM
Subject: RE: V7R3 SSL system values and SSLCONFIG settings - is it
ok to leave all at default?
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>
Remove the 3DES ciphers.
Steve Pitcher
iTech Solutions
Office: (203) 744-7854 Ext. 176
Mobile: (902) 301-0810
http://www.itechsol.com
http://www.iInTheCloud.com
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Steinmetz, Paul
Sent: Tuesday, January 9, 2018 4:55 PM
To: 'Midrange Systems Technical Discussion' <midrange-l@xxxxxxxxxxxx>
Subject: V7R3 SSL system values and SSLCONFIG settings - is it ok to leave
all at default?
I'm reviewing the SSL system values and in SST the SSLCONFIG default
settings compared to my V7R1 user defined settings.
From what I'm seeing, default settings should be ok.
No need for any user defined as I currently have on V7R1.
Is this correct?
QSSLCSL *SEC Secure sockets layer cipher specification list
Sequence Cipher
number Suite
0
10 *ECDHE_ECDSA_AES_128_GCM_SHA256
20 *ECDHE_ECDSA_AES_256_GCM_SHA384
30 *ECDHE_RSA_AES_128_GCM_SHA256
40 *ECDHE_RSA_AES_256_GCM_SHA384
50 *RSA_AES_128_GCM_SHA256
60 *RSA_AES_256_GCM_SHA384
70 *ECDHE_ECDSA_AES_128_CBC_SHA256
80 *ECDHE_ECDSA_AES_256_CBC_SHA384
90 *ECDHE_RSA_AES_128_CBC_SHA256
100 *ECDHE_RSA_AES_256_CBC_SHA384
110 *RSA_AES_128_CBC_SHA256
120 *RSA_AES_128_CBC_SHA
130 *RSA_AES_256_CBC_SHA256
140 *RSA_AES_256_CBC_SHA
150 *ECDHE_ECDSA_3DES_EDE_CBC_SHA
160 *ECDHE_RSA_3DES_EDE_CBC_SHA
170 *RSA_3DES_EDE_CBC_SHA
QSSLCSLCTL *SEC Secure sockets layer cipher control
Cipher control . . . . *OPSYS
QSSLPCL *SEC Secure sockets layer protocols
Protocols
*OPSYS
DISPLAY/ALTER/DUMP
Running macro: SSLCONFIG -DISPLAY
Current configuration
SSL Eligible Default Protocol List . . : TLSv1.2
TLSv1.1
TLSv1.0
SSL Default Protocol List. . . . . . . : TLSv1.2
TLSv1.1
TLSv1.0
SSL Eligible Default Cipher Suites . . : ECDHE_ECDSA_AES_128_GCM_SHA256
ECDHE_ECDSA_AES_256_GCM_SHA384
ECDHE_RSA_AES_128_GCM_SHA256
ECDHE_RSA_AES_256_GCM_SHA384
RSA_AES_128_GCM_SHA256
RSA_AES_256_GCM_SHA384
ECDHE_ECDSA_AES_128_CBC_SHA256
ECDHE_ECDSA_AES_256_CBC_SHA384
ECDHE_RSA_AES_128_CBC_SHA256
ECDHE_RSA_AES_256_CBC_SHA384
RSA_AES_128_CBC_SHA256
RSA_AES_128_CBC_SHA
RSA_AES_256_CBC_SHA256
RSA_AES_256_CBC_SHA SSL Default
Cipher Suite List. . . . . : ECDHE_ECDSA_AES_128_GCM_SHA256
ECDHE_ECDSA_AES_256_GCM_SHA384
ECDHE_RSA_AES_128_GCM_SHA256
ECDHE_RSA_AES_256_GCM_SHA384
RSA_AES_128_GCM_SHA256
RSA_AES_256_GCM_SHA384
ECDHE_ECDSA_AES_128_CBC_SHA256
ECDHE_ECDSA_AES_256_CBC_SHA384
ECDHE_RSA_AES_128_CBC_SHA256
ECDHE_RSA_AES_256_CBC_SHA384
RSA_AES_128_CBC_SHA256
RSA_AES_128_CBC_SHA
RSA_AES_256_CBC_SHA256
RSA_AES_256_CBC_SHA SSL
Renegotiation without RFC 5746 . . : None Minimum RSA key size . . . . . .
. . . : 0 bits SSL Client Hello Record Version . . . : Highest SSL Client
Hello Supports TLSv1.2 . . : Allowed SSL Client Hello Supports TLSv1.1 .
. : Allowed SSL Server Requires RFC 5746 . . . . . : Off SSL Client
Requires RFC 5746 . . . . . : Off SSL Default Elliptic Curve Named Curve
List . : Secp521r1
Secp384r1
Secp256r1 SSL Supported Elliptic Curve Named Curve List .
: Secp521r1
Secp384r1
Secp256r1
Secp224r1
Secp192r1 SSL Default
Signature Algorithm List . . . . : ECDSA with SHA512
ECDSA with SHA384
ECDSA with SHA256
ECDSA with SHA224
ECDSA with SHA1
RSA with SHA512
DISPLAY/ALTER/DUMP
RSA with SHA384
RSA with SHA256
RSA with SHA224
RSA with SHA1 SSL
Supported Signature Algorithm List . . . . : ECDSA with SHA512
ECDSA with SHA384
ECDSA with SHA256
ECDSA with SHA224
ECDSA with SHA1
RSA with SHA512
RSA with SHA384
RSA with SHA256
RSA with SHA224
RSA with SHA1
RSA with MD5 SSL
Connection Counters . . . . . . . : Disabled Netsecure Inspect
Application Data . . : Allowed Netsecure Telnet Server . . . . . . . :
Disabled Netsecure UDP . . . . . . . . . . . . : Enabled Maximum Number
of Global OCSP Response Cache Entries . . : NOLIMIT
ECDSA with SHA1
RSA with SHA512
RSA with SHA384
RSA with SHA256
RSA with SHA224
RSA with SHA1
RSA with MD5 SSL
Connection Counters . . . . . . . : Disabled Netsecure Inspect
Application Data . . : Allowed Netsecure Telnet Server . . . . . . . :
Disabled Netsecure UDP . . . . . . . . . . . . : Enabled Maximum Number
of Global OCSP Response Cache Entries . . : NOLIMIT Object Flush Latency .
. . . . . . . . : 500 ms PTF Level . . . . . . . . . . . . . . : 1
Thank You
_____
Paul Steinmetz
IBM i Systems Administrator
Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071
610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home
psteinmetz@xxxxxxxxxx<mailto:psteinmetz@xxxxxxxxxx>
http://www.pencor.com/
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at
https://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related
questions.
Help support midrange.com by shopping at amazon.com with our affiliate
link:
http://amzn.to/2dEadiD
midrange.com
