Quantcast
Channel: iRedMail
Viewing all articles
Browse latest Browse all 14135

Apache config w/ iRedMail-0.9.0 still vulnerable to Poodle attack

$
0
0

==== Required information ====
- iRedMail version: 0.9.0
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Linux/BSD distribution name and version: CentOS 6.6
- Related log if you're reporting an issue: SSLv3
====

Just as an FYI:

I just stood up a new CentOS 6.6 minimal VM and then installed iRedMail and let it grab all necessary packages via Yum. The iRedMail installer script doesn't turn off SSLv3 on Apache when it installs and configures SSL. I had to manually edit /etc/httpd/conf.d/ssl.conf to turn off SSLv3 to prevent the Poodle attack. Postfix and Dovecot seemed to be already secured against the Poodle attack.

https://disablessl3.com/ for more info.


Viewing all articles
Browse latest Browse all 14135

Trending Articles