I upgraded an R&D LPAR from V7R1 to V7R3 today.
All went well.
I was surprised to see the upgraded V7R3 LPAR retained my custom V7R1 SSL settings.
I expected the OS upgrade to set SSL settings back to V7R3 defaults.
This was not the case.
I had to change the 3 SSL system settings back to V7R3 defaults.
QSSLCSL *SEC Secure sockets layer cipher specification list
QSSLCSLCTL *SEC Secure sockets layer cipher control
QSSLPCL *SEC Secure sockets layer protocols
Paul
From: Steinmetz, Paul
Sent: Tuesday, January 09, 2018 3:55 PM
To: 'Midrange Systems Technical Discussion'
Subject: V7R3 SSL system values and SSLCONFIG settings - is it ok to leave all at default?
I'm reviewing the SSL system values and in SST the SSLCONFIG default settings compared to my V7R1 user defined settings.
From what I'm seeing, default settings should be ok.
No need for any user defined as I currently have on V7R1.
Is this correct?
QSSLCSL *SEC Secure sockets layer cipher specification list
Sequence Cipher
number Suite
0
10 *ECDHE_ECDSA_AES_128_GCM_SHA256
20 *ECDHE_ECDSA_AES_256_GCM_SHA384
30 *ECDHE_RSA_AES_128_GCM_SHA256
40 *ECDHE_RSA_AES_256_GCM_SHA384
50 *RSA_AES_128_GCM_SHA256
60 *RSA_AES_256_GCM_SHA384
70 *ECDHE_ECDSA_AES_128_CBC_SHA256
80 *ECDHE_ECDSA_AES_256_CBC_SHA384
90 *ECDHE_RSA_AES_128_CBC_SHA256
100 *ECDHE_RSA_AES_256_CBC_SHA384
110 *RSA_AES_128_CBC_SHA256
120 *RSA_AES_128_CBC_SHA
130 *RSA_AES_256_CBC_SHA256
140 *RSA_AES_256_CBC_SHA
150 *ECDHE_ECDSA_3DES_EDE_CBC_SHA
160 *ECDHE_RSA_3DES_EDE_CBC_SHA
170 *RSA_3DES_EDE_CBC_SHA
QSSLCSLCTL *SEC Secure sockets layer cipher control
Cipher control . . . . *OPSYS
QSSLPCL *SEC Secure sockets layer protocols
Protocols
*OPSYS
DISPLAY/ALTER/DUMP
Running macro: SSLCONFIG -DISPLAY
Current configuration
SSL Eligible Default Protocol List . . : TLSv1.2
TLSv1.1
TLSv1.0
SSL Default Protocol List. . . . . . . : TLSv1.2
TLSv1.1
TLSv1.0
SSL Eligible Default Cipher Suites . . : ECDHE_ECDSA_AES_128_GCM_SHA256
ECDHE_ECDSA_AES_256_GCM_SHA384
ECDHE_RSA_AES_128_GCM_SHA256
ECDHE_RSA_AES_256_GCM_SHA384
RSA_AES_128_GCM_SHA256
RSA_AES_256_GCM_SHA384
ECDHE_ECDSA_AES_128_CBC_SHA256
ECDHE_ECDSA_AES_256_CBC_SHA384
ECDHE_RSA_AES_128_CBC_SHA256
ECDHE_RSA_AES_256_CBC_SHA384
RSA_AES_128_CBC_SHA256
RSA_AES_128_CBC_SHA
RSA_AES_256_CBC_SHA256
RSA_AES_256_CBC_SHA
SSL Default Cipher Suite List. . . . . : ECDHE_ECDSA_AES_128_GCM_SHA256
ECDHE_ECDSA_AES_256_GCM_SHA384
ECDHE_RSA_AES_128_GCM_SHA256
ECDHE_RSA_AES_256_GCM_SHA384
RSA_AES_128_GCM_SHA256
RSA_AES_256_GCM_SHA384
ECDHE_ECDSA_AES_128_CBC_SHA256
ECDHE_ECDSA_AES_256_CBC_SHA384
ECDHE_RSA_AES_128_CBC_SHA256
ECDHE_RSA_AES_256_CBC_SHA384
RSA_AES_128_CBC_SHA256
RSA_AES_128_CBC_SHA
RSA_AES_256_CBC_SHA256
RSA_AES_256_CBC_SHA
SSL Renegotiation without RFC 5746 . . : None
Minimum RSA key size . . . . . . . . . : 0 bits
SSL Client Hello Record Version . . . : Highest
SSL Client Hello Supports TLSv1.2 . . : Allowed
SSL Client Hello Supports TLSv1.1 . . : Allowed
SSL Server Requires RFC 5746 . . . . . : Off
SSL Client Requires RFC 5746 . . . . . : Off
SSL Default Elliptic Curve Named Curve List . : Secp521r1
Secp384r1
Secp256r1
SSL Supported Elliptic Curve Named Curve List . : Secp521r1
Secp384r1
Secp256r1
Secp224r1
Secp192r1
SSL Default Signature Algorithm List . . . . : ECDSA with SHA512
ECDSA with SHA384
ECDSA with SHA256
ECDSA with SHA224
ECDSA with SHA1
RSA with SHA512
DISPLAY/ALTER/DUMP
RSA with SHA384
RSA with SHA256
RSA with SHA224
RSA with SHA1
SSL Supported Signature Algorithm List . . . . : ECDSA with SHA512
ECDSA with SHA384
ECDSA with SHA256
ECDSA with SHA224
ECDSA with SHA1
RSA with SHA512
RSA with SHA384
RSA with SHA256
RSA with SHA224
RSA with SHA1
RSA with MD5
SSL Connection Counters . . . . . . . : Disabled
Netsecure Inspect Application Data . . : Allowed
Netsecure Telnet Server . . . . . . . : Disabled
Netsecure UDP . . . . . . . . . . . . : Enabled
Maximum Number of Global OCSP Response Cache Entries . . : NOLIMIT
ECDSA with SHA1
RSA with SHA512
RSA with SHA384
RSA with SHA256
RSA with SHA224
RSA with SHA1
RSA with MD5
SSL Connection Counters . . . . . . . : Disabled
Netsecure Inspect Application Data . . : Allowed
Netsecure Telnet Server . . . . . . . : Disabled
Netsecure UDP . . . . . . . . . . . . : Enabled
Maximum Number of Global OCSP Response Cache Entries . . : NOLIMIT
Object Flush Latency . . . . . . . . . : 500 ms
PTF Level . . . . . . . . . . . . . . : 1
Thank You
_____
Paul Steinmetz
IBM i Systems Administrator
Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071
610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home
psteinmetz@xxxxxxxxxx<mailto:psteinmetz@xxxxxxxxxx>
http://www.pencor.com/
midrange.com
