Re: V7R3 SSL system values and SSLCONFIG settings - is it ok to leave all at default?

Rob,

</snip>
Seems like we're hearing a lot about Feb 1...

What's happening on Feb 1?

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Rob Berendt
Sent: Wednesday, January 10, 2018 7:44 AM
To: Midrange Systems Technical Discussion
Subject: RE: V7R3 SSL system values and SSLCONFIG settings - is it ok to
leave all at default?

Is this as current as the industry?
<snip>
Weak Cipher Suites (as of November 2016):
</snip>
Seems like we're hearing a lot about Feb 1...


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail
to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: Steve Pitcher <SPitcher@xxxxxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 01/10/2018 07:33 AM
Subject: RE: V7R3 SSL system values and SSLCONFIG settings - is it
ok to leave all at default?
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Here's where I usually point:
http://www-01.ibm.com/support/docview.wss?uid=nas8N1020876

Just to clarify, IBM does remove weak ciphers via PTF. For example, see
the removal of 3DES here:
http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697


Steve Pitcher
iTech Solutions
Office: (203) 744-7854 Ext. 176
Mobile: (902) 301-0810
http://www.itechsol.com
http://www.iInTheCloud.com


-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Rob
Berendt
Sent: Tuesday, January 9, 2018 5:23 PM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Subject: RE: V7R3 SSL system values and SSLCONFIG settings - is it ok to
leave all at default?

Is there a one stop shopping site which lists currently acceptable
ciphers, or currently unacceptable ciphers (and maybe the CVE(s) which
flags them so), and is reasonably close to calling the cipher what IBM
calls them in QSSLCSL?


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail
to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: Steve Pitcher <SPitcher@xxxxxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 01/09/2018 04:09 PM
Subject: RE: V7R3 SSL system values and SSLCONFIG settings - is it
ok to leave all at default?
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Remove the 3DES ciphers.




Steve Pitcher
iTech Solutions
Office: (203) 744-7854 Ext. 176
Mobile: (902) 301-0810
http://www.itechsol.com
http://www.iInTheCloud.com


-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Steinmetz, Paul
Sent: Tuesday, January 9, 2018 4:55 PM
To: 'Midrange Systems Technical Discussion' <midrange-l@xxxxxxxxxxxx>
Subject: V7R3 SSL system values and SSLCONFIG settings - is it ok to leave

all at default?

I'm reviewing the SSL system values and in SST the SSLCONFIG default
settings compared to my V7R1 user defined settings.
From what I'm seeing, default settings should be ok.
No need for any user defined as I currently have on V7R1.
Is this correct?

QSSLCSL *SEC Secure sockets layer cipher specification list
Sequence Cipher
number Suite
0
10 *ECDHE_ECDSA_AES_128_GCM_SHA256
20 *ECDHE_ECDSA_AES_256_GCM_SHA384
30 *ECDHE_RSA_AES_128_GCM_SHA256
40 *ECDHE_RSA_AES_256_GCM_SHA384
50 *RSA_AES_128_GCM_SHA256
60 *RSA_AES_256_GCM_SHA384
70 *ECDHE_ECDSA_AES_128_CBC_SHA256
80 *ECDHE_ECDSA_AES_256_CBC_SHA384
90 *ECDHE_RSA_AES_128_CBC_SHA256
100 *ECDHE_RSA_AES_256_CBC_SHA384
110 *RSA_AES_128_CBC_SHA256
120 *RSA_AES_128_CBC_SHA
130 *RSA_AES_256_CBC_SHA256
140 *RSA_AES_256_CBC_SHA
150 *ECDHE_ECDSA_3DES_EDE_CBC_SHA
160 *ECDHE_RSA_3DES_EDE_CBC_SHA
170 *RSA_3DES_EDE_CBC_SHA

QSSLCSLCTL *SEC Secure sockets layer cipher control
Cipher control . . . . *OPSYS

QSSLPCL *SEC Secure sockets layer protocols
Protocols
*OPSYS

DISPLAY/ALTER/DUMP
Running macro: SSLCONFIG -DISPLAY

Current configuration
SSL Eligible Default Protocol List . . : TLSv1.2
TLSv1.1
TLSv1.0
SSL Default Protocol List. . . . . . . : TLSv1.2
TLSv1.1
TLSv1.0
SSL Eligible Default Cipher Suites . . : ECDHE_ECDSA_AES_128_GCM_SHA256
ECDHE_ECDSA_AES_256_GCM_SHA384
ECDHE_RSA_AES_128_GCM_SHA256
ECDHE_RSA_AES_256_GCM_SHA384
RSA_AES_128_GCM_SHA256
RSA_AES_256_GCM_SHA384
ECDHE_ECDSA_AES_128_CBC_SHA256
ECDHE_ECDSA_AES_256_CBC_SHA384
ECDHE_RSA_AES_128_CBC_SHA256
ECDHE_RSA_AES_256_CBC_SHA384
RSA_AES_128_CBC_SHA256
RSA_AES_128_CBC_SHA
RSA_AES_256_CBC_SHA256
RSA_AES_256_CBC_SHA SSL Default
Cipher Suite List. . . . . : ECDHE_ECDSA_AES_128_GCM_SHA256
ECDHE_ECDSA_AES_256_GCM_SHA384
ECDHE_RSA_AES_128_GCM_SHA256
ECDHE_RSA_AES_256_GCM_SHA384
RSA_AES_128_GCM_SHA256
RSA_AES_256_GCM_SHA384
ECDHE_ECDSA_AES_128_CBC_SHA256
ECDHE_ECDSA_AES_256_CBC_SHA384
ECDHE_RSA_AES_128_CBC_SHA256
ECDHE_RSA_AES_256_CBC_SHA384
RSA_AES_128_CBC_SHA256
RSA_AES_128_CBC_SHA
RSA_AES_256_CBC_SHA256
RSA_AES_256_CBC_SHA SSL
Renegotiation without RFC 5746 . . : None Minimum RSA key size . . . . . .

. . . : 0 bits SSL Client Hello Record Version . . . : Highest SSL Client

Hello Supports TLSv1.2 . . : Allowed SSL Client Hello Supports TLSv1.1 .

. : Allowed SSL Server Requires RFC 5746 . . . . . : Off SSL Client
Requires RFC 5746 . . . . . : Off SSL Default Elliptic Curve Named Curve
List . : Secp521r1
Secp384r1
Secp256r1 SSL Supported Elliptic Curve Named Curve List .

: Secp521r1
Secp384r1
Secp256r1
Secp224r1
Secp192r1 SSL Default
Signature Algorithm List . . . . : ECDSA with SHA512
ECDSA with SHA384
ECDSA with SHA256
ECDSA with SHA224
ECDSA with SHA1
RSA with SHA512
DISPLAY/ALTER/DUMP
RSA with SHA384
RSA with SHA256
RSA with SHA224
RSA with SHA1 SSL
Supported Signature Algorithm List . . . . : ECDSA with SHA512
ECDSA with SHA384
ECDSA with SHA256
ECDSA with SHA224
ECDSA with SHA1
RSA with SHA512
RSA with SHA384
RSA with SHA256
RSA with SHA224
RSA with SHA1
RSA with MD5 SSL
Connection Counters . . . . . . . : Disabled Netsecure Inspect
Application Data . . : Allowed Netsecure Telnet Server . . . . . . . :
Disabled Netsecure UDP . . . . . . . . . . . . : Enabled Maximum Number
of Global OCSP Response Cache Entries . . : NOLIMIT
ECDSA with SHA1
RSA with SHA512
RSA with SHA384
RSA with SHA256
RSA with SHA224
RSA with SHA1
RSA with MD5 SSL
Connection Counters . . . . . . . : Disabled Netsecure Inspect
Application Data . . : Allowed Netsecure Telnet Server . . . . . . . :
Disabled Netsecure UDP . . . . . . . . . . . . : Enabled Maximum Number
of Global OCSP Response Cache Entries . . : NOLIMIT Object Flush Latency .

. . . . . . . . : 500 ms PTF Level . . . . . . . . . . . . . . : 1

Thank You
_____
Paul Steinmetz
IBM i Systems Administrator

Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071

610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home

psteinmetz@xxxxxxxxxx<mailto:psteinmetz@xxxxxxxxxx>
http://www.pencor.com/

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD