<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<div class="moz-cite-prefix">On 17.4.2019 23.00, Kostya Vasilyev via
dovecot wrote:<br>
</div>
<blockquote type="cite"
cite="mid:3bf08a0e-8dcc-4745-b974-554e59915e9b@www.fastmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title></title>
<style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}</style>
<div>I'm not Aki but hope you don't mind...<br>
</div>
<div><br>
</div>
<div>On Wed, Apr 17, 2019, at 10:42 PM, TG Servers via dovecot
wrote:<br>
</div>
<blockquote type="cite" id="qt">
<div><span style="font-family:Lato" class="font">Hi,<br>
<br>
MariaDB documentation says it accepts OpenSSL cipher strings
in its ssl_cipher parameters like ssl_cipher="TLSv1.2". <br>
This is also mentioned when creating or changing users in
terms of setting this with the REQUIRE CIPHER parameter like
CREATE USER ... REQUIRE CIPHER 'TLSv1.2'...<br>
So this is all very nice and also working but sadly whith a
connection string from dovecot it is not working anymore.<br>
If you set the user only on REQUIRE SSL, the ssl connection
and everything is working fine between dovecot and mariaDB.<br>
But when you set REQUIRE CIPHER 'TLSv1.2' in mariaDB and use
ssl_cipher=TLSv1.2 in the connection string from dovecot you
get the following errors, it does not account the various
ciphers of TLSv1.2 but rather expects TLSv1.2 somehow.<br>
<br>
[Note] X509 ciphers mismatch: should be 'TLSv1.2' but is
'DHE-RSA-AES256-GCM-SHA384'<br>
<br>
A good cipher is sent but the cipher cannot be TLSv1.2 of
course :)<br>
But no one will put in explicit ciphers there as this is
dangerous in my eyes, people forget updating... Also this is
misbehaviour or misdocumented.<br>
The thing is now where to address this. Dovecot or MariaDB.
<br>
As dovecot seems to use a good cipher and MariaDB expects a
TLSv1.2 string rather than a cipher out of TLSv1.2 I would
say mariaDB but am not sure.<br>
<br>
Maybe Aki could say something to it, would be great.<br>
<br>
Thanks!<br>
<br>
The docs from mariaDB to this are here :<br>
</span><a
href="https://mariadb.com/kb/en/library/create-user/"
moz-do-not-send="true">https://mariadb.com/kb/en/library/create-user/</a></div>
<div> <a
href="https://mariadb.com/kb/en/library/securing-connections-for-client-and-server/"
moz-do-not-send="true">https://mariadb.com/kb/en/library/securing-connections-for-client-and-server/</a><br>
</div>
</blockquote>
<div><br>
</div>
<div>But but but...<br>
</div>
<div><br>
</div>
<div>TLSv1.2 is not a cipher, it's a protocol.<br>
</div>
<div><br>
</div>
<div>Maria DB docs say the settings excepts a list of ciphers or a
protocol name:<br>
</div>
<div><br>
</div>
<div><a
href="https://mariadb.com/kb/en/library/ssltls-system-variables/#ssl_cipher"
moz-do-not-send="true">https://mariadb.com/kb/en/library/ssltls-system-variables/#ssl_cipher</a><br>
</div>
<div><br>
</div>
<div>In in other software it's common to have two distinct
settings, one for protocol and one a cipher "pattern".<br>
</div>
<div><br>
</div>
<div>Maybe you could try something like this:<br>
</div>
<div><br>
</div>
<div>kECDHE+CHACHA20:kECDHE+AESGCM<br>
</div>
<div><br>
</div>
<div>ChaCha / Poly and AES GCM are TLS 1.2 + only ciphers.<br>
</div>
<div><br>
</div>
<div>This will not include AES CBC which exist with variations in
both 1.0 to 1.2, but if you're security conscious, you probably
don't want to use CBC anyway.<br>
</div>
<div><br>
</div>
<div>Or you could match just 1.2 versions with - I think -
AESCBC+SHA384:AESCBC+SHA256. This will leave out AES CBC SHA1
which are in 1.0 - 1.1.<br>
</div>
<div><br>
</div>
<div>And now Aki can correct me :)</div>
<div><br>
</div>
<div>-- K<br>
</div>
<div><br>
</div>
</blockquote>
<br>
<p>All I'm going to say is that this is 100% mysql/mariadb issue.</p>
<p>Aki<br>
</p>
</body>
</html>