[Dovecot] ssl-params regeneration with dovecot 2.2.7
Hello,
after switching from version 2.2.7 to 2.2.7 I miss the loglines which say:
ssl-params: Generating SSL parameters ssl-params: SSL parameters regeneration completed
The configuration has not been changed and reads:
| # 2.2.7: /usr/local/dovecot/etc/dovecot/dovecot.conf | # OS: Linux 2.6.35.14-106.fc14.i686.PAE i686 Fedora release 14 (Laughlin) ext3 | auth_mechanisms = plain login | default_vsz_limit = 512 M | first_valid_uid = 200 | last_valid_uid = 65534 | listen = * | lmtp_save_to_detail_mailbox = yes | login_greeting = c64.shuttle.de - IMAPs Service (dovecot) ready. | login_log_format_elements = %u %r %c | mail_location = maildir:/var/spool/mail/%u | mail_log_prefix = "%Us(%u,%r): " | mail_plugin_dir = /usr/dovecot/lib/dovecot/ | mail_plugins = notify quota fts fts_squat | namespace inbox { | inbox = yes | list = yes | location = | mailbox Drafts { | special_use = \Drafts | } | mailbox Gesendet { | special_use = \Sent | } | mailbox SPAM { | special_use = \Junk | } | mailbox Sent { | special_use = \Sent | } | mailbox Trash { | special_use = \Trash | } | prefix = | subscriptions = yes | type = private | } | passdb { | args = dovecot | driver = pam | } | plugin { | fts = squat | fts_squat = partial=4 full=10 | mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append | mail_log_fields = uid box from subject msgid size flags | mail_log_group_events = yes | quota = maildir:User quota | quota_rule = *:storage=2G | quota_rule2 = Trash:storage=+100M | } | postmaster_address = postmaster@moltke28.b.shuttle.de | protocols = imap | service anvil { | client_limit = 1027 | } | service auth { | unix_listener auth-client { | group = exim | mode = 0660 | user = exim | } | } | service imap-login { | inet_listener imap { | port = 143 | } | inet_listener imaps { | port = 993 | ssl = yes | } | process_limit = 512 | process_min_avail = 10 | } | service imap-postlogin { | executable = script-login /usr/local/sbin/dovecot-imap-post-login | } | service imap { | executable = imap imap-postlogin | } | service lmtp { | inet_listener lmtp { | address = 0.0.0.0 | port = 24 | } | } | service pop3-login { | inet_listener pop3 { | port = 110 | } | inet_listener pop3s { | port = 995 | ssl = yes | } | } | service pop3 { | process_limit = 1024 | } | ssl_cert =
What's going on? No more logging or no regeneration?
Greetings, Frank Elsner
Am 05.11.2013 20:01, schrieb Frank Elsner:
after switching from version 2.2.6 to 2.2.7 I miss the loglines which say:
ssl-params: Generating SSL parameters ssl-params: SSL parameters regeneration completed
What's going on? No more logging or no regeneration?
it is intentional i guess
http://hg.dovecot.org/dovecot-2.2/rev/43ab5abeb8f0 ssl-params: Added ssl_dh_parameters_length & removed ssl_parameters_regenerate setting
ssl-params: Added ssl_dh_parameters_length & removed ssl_parameters_regenerate setting. ssl_parameters_regenerate was based on some text from GNUTLS documentation a long time ago, but there's really not much point in doing it.
Ideally we should also support "openssl dhparam" input files, but for now there's the ssl_dh_parameters_length setting that can be used to specify the wanted DH parameters length. If the current ssl-parameters.dat has a different length, it's regenerated.
We should probably at some point support also built-in DH parameters which are returned while the ssl-params runs.
-------- Original-Nachricht -------- Betreff: Re: [Dovecot] DH parameter length too small? Datum: Sat, 2 Nov 2013 15:28:33 +0200 Von: Timo Sirainen tss@iki.fi Antwort an: Dovecot Mailing List dovecot@dovecot.org An: Jörg Lübbert j.luebbert@kaladix.org Kopie (CC): Dovecot Mailing List dovecot@dovecot.org
On 14.10.2013, at 19.08, Jörg Lübbert j.luebbert@kaladix.org wrote:
from my understanding, using 1024bit DH parameters results in a not sufficiently secure key exchange for DH(E). Therefore I think it would be advisable to have parameters of at least 2048bit . In fact, I would see a great benefit in chosing parameter length arbitrarily.
I also do not see the benefit of parameter regeneration. What were the design goals here?
participants (2)
-
Frank Elsner
-
Reindl Harald