Re: [Dovecot] SSL renegotiation vulnerability

2011-11-04 Thread Timo Sirainen
http://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html -> "Things get worse" shows that it's easier to DoS the server with multiple connections than with renegotiations, so I don't know if there's much point in disabling renegotiations. Perhaps Dovecot could allow e.g. one renegotiation per

Re: [Dovecot] SSL renegotiation vulnerability

2011-10-27 Thread Robert Schetterer
Am 27.10.2011 10:25, schrieb Ed W: > On 26/10/2011 10:01, Robert Schetterer wrote: >> the most problem is see , not everybody can use fail2ban on his servers >> by keeping out dummy auth users over nat ( I have such case ) >> >> anyway ,firewalls should slow down ddos attacks, which might cause oth

Re: [Dovecot] SSL renegotiation vulnerability

2011-10-27 Thread Ed W
On 26/10/2011 10:01, Robert Schetterer wrote: > the most problem is see , not everybody can use fail2ban on his servers > by keeping out dummy auth users over nat ( I have such case ) > > anyway ,firewalls should slow down ddos attacks, which might cause other > problems then *g, but for sure not f

Re: [Dovecot] SSL renegotiation vulnerability

2011-10-26 Thread Robert Schetterer
Am 26.10.2011 10:43, schrieb Steinar Bang: >> Steinar Bang : >> Timo Sirainen : > >>> I don't know if I'm doing something wrong, but I can't even cause a >>> DoS. Even while all imap-login processes are eating 100% CPU (almost >>> 500 handshakes/second), I can successfully log in with anot

Re: [Dovecot] SSL renegotiation vulnerability

2011-10-26 Thread Steinar Bang
> Steinar Bang : > Timo Sirainen : >> I don't know if I'm doing something wrong, but I can't even cause a >> DoS. Even while all imap-login processes are eating 100% CPU (almost >> 500 handshakes/second), I can successfully log in with another client. > Are you using the tool linked to in

Re: [Dovecot] SSL renegotiation vulnerability

2011-10-26 Thread Steinar Bang
> Timo Sirainen : > I don't know if I'm doing something wrong, but I can't even cause a > DoS. Even while all imap-login processes are eating 100% CPU (almost > 500 handshakes/second), I can successfully log in with another client. Are you using the tool linked to in the article, to stress th

Re: [Dovecot] SSL renegotiation vulnerability (Was: dovecot evaluation on a 30 gb mailbox)

2011-10-25 Thread Timo Sirainen
On 25.10.2011, at 21.51, Timo Sirainen wrote: > On 25.10.2011, at 21.13, Timo Sirainen wrote: > >>> Could the reason he hasn't found such a setting be that SSL renegotiate >>> isn't supported at all in dovecot...? >> >> Looking at the OpenSSL code, I don't see any way to disable it. Or possibly

Re: [Dovecot] SSL renegotiation vulnerability (Was: dovecot evaluation on a 30 gb mailbox)

2011-10-25 Thread Timo Sirainen
On 25.10.2011, at 21.13, Timo Sirainen wrote: >> Could the reason he hasn't found such a setting be that SSL renegotiate >> isn't supported at all in dovecot...? > > Looking at the OpenSSL code, I don't see any way to disable it. Or possibly > with some undocumented kludgy way, but I don't reall

Re: [Dovecot] SSL renegotiation vulnerability (Was: dovecot evaluation on a 30 gb mailbox)

2011-10-25 Thread Timo Sirainen
On 25.10.2011, at 14.38, Steinar Bang wrote: >> Timo Sirainen : > >> Yes, SSL handshakes are extra. Although SSL supports some kind of >> quick renegotiation too, but Dovecot doesn't support that yet. No >> one's ever requested it.. Looks like it's not "renegotiation" but more like session

[Dovecot] SSL renegotiation vulnerability (Was: dovecot evaluation on a 30 gb mailbox)

2011-10-25 Thread Steinar Bang
> Timo Sirainen : > Yes, SSL handshakes are extra. Although SSL supports some kind of > quick renegotiation too, but Dovecot doesn't support that yet. No > one's ever requested it.. Hum... this article (in Norwegian) http://www.digi.no/881186/skrekkverktoy-slaar-ut-%ABsikre%BB-servere addres