On Thu, 08 Mar 2012 19:04:47 +0000, Steve Platt <steve.pl...@mrc-bsu.cam.ac.uk> wrote:
> I've set up a list of ciphers that excludes SSLv2 ciphers (and other > weak ones) in the hope of preventing SSLv2 connections: > > ssl_cipher_list = TLSv1+HIGH : !SSLv2 : > RC4+MEDIUM : !aNULL : !eNULL : !3DES : @STRENGTH > > I tried making the same change to dovecot1's src tree on our test > system and it seems to have the desired effect; No need to change sources. Try this and see if it serves your purpose: ssl = required ssl_cipher_list = HIGH:!SSLv2:!aNULL:!MD5!DES:!3DES M.
