Bug 1124827
| Summary: | RFE: Enable ECDHE support in sendmail | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Morten Stevens <mstevens> | ||||
| Component: | sendmail | Assignee: | Jaroslav Škarvada <jskarvad> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Roman Žilka <rzilka> | ||||
| Severity: | unspecified | Docs Contact: | Lenka Kimlickova <lkimlick> | ||||
| Priority: | high | ||||||
| Version: | 7.0 | CC: | amahdal, bressers, hkario, jskarvad, pvrabec, ralston, redhat-bugzilla, rupatel, rzilka, salmy, thozza, tmraz | ||||
| Target Milestone: | rc | Keywords: | FutureFeature, Patch | ||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | sendmail-8.14.7-5.el7 | Doc Type: | Release Note | ||||
| Doc Text: |
*Sendmail* now supports ECDHE
This update adds the Elliptic Curve Diffie-Hellman Ephemeral Keys (ECDHE) support to Red Hat Enterprise Linux 7 *Sendmail*. ECDHE is a variant of the Diffie-Hellman protocol that uses elliptic curve cryptography. It is an anonymous key agreement protocol that allows two parties to establish a shared secret over an insecure channel.
|
Story Points: | --- | ||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2017-08-01 12:42:36 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1057566, 1191019, 1289025, 1298243, 1305230, 1393869 | ||||||
| Attachments: |
|
||||||
|
Description
Morten Stevens
2014-07-30 12:15:06 UTC
I am not sure whether this will get in, please escalate it through the support channel to give it prio. We want this as well. I'll escalate through our support channels. Created attachment 1205272 [details] Backported feature Unfortunately sendmail version in RHEL-7.3 is too old, thus the patch from the comment 0 is not enough and we need to backport the support. Full patch is attached. Scratch build for testing (unsupported): http://people.redhat.com/jskarvad/rhbz1124827/ (In reply to Jaroslav Škarvada from comment #8) > Created attachment 1205272 [details] > Backported feature > > Unfortunately sendmail version in RHEL-7.3 is too old, thus the patch from > the comment 0 is not enough and we need to backport the support. Full patch > is attached. It needs to be applied together with the patch from the comment 0. QA: Verified on all archs.
********** sendmail-8.14.7-4.el7 (faulty):
# for i in $(openssl ciphers|sed 's/:/\n/g'); do echo QUIT | openssl s_client -cipher "$i" -starttls smtp -connect localhost:25 2>&1 | grep 'Cipher\s*: [^0]'; done
Cipher : ECDH-ECDSA-AES256-GCM-SHA384
Cipher : ECDH-ECDSA-AES256-SHA384
Cipher : ECDH-ECDSA-AES256-SHA
Cipher : ECDH-ECDSA-AES128-GCM-SHA256
Cipher : ECDH-ECDSA-AES128-SHA256
Cipher : ECDH-ECDSA-AES128-SHA
Cipher : ECDH-ECDSA-DES-CBC3-SHA
Cipher : ECDH-ECDSA-RC4-SHA
********** sendmail-8.14.7-5.el7 (fixed):
# for i in $(openssl ciphers|sed 's/:/\n/g'); do echo QUIT | openssl s_client -cipher "$i" -starttls smtp -connect localhost:25 2>&1 | grep 'Cipher\s*: [^0]'; done
Cipher : ECDHE-ECDSA-AES256-GCM-SHA384
Cipher : ECDHE-ECDSA-AES256-SHA384
Cipher : ECDHE-ECDSA-AES256-SHA
Cipher : ECDH-ECDSA-AES256-GCM-SHA384
Cipher : ECDH-ECDSA-AES256-SHA384
Cipher : ECDH-ECDSA-AES256-SHA
Cipher : ECDHE-ECDSA-AES128-GCM-SHA256
Cipher : ECDHE-ECDSA-AES128-SHA256
Cipher : ECDHE-ECDSA-AES128-SHA
Cipher : ECDH-ECDSA-AES128-GCM-SHA256
Cipher : ECDH-ECDSA-AES128-SHA256
Cipher : ECDH-ECDSA-AES128-SHA
Cipher : ECDHE-ECDSA-DES-CBC3-SHA
Cipher : ECDH-ECDSA-DES-CBC3-SHA
Cipher : ECDHE-ECDSA-RC4-SHA
Cipher : ECDH-ECDSA-RC4-SHA
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2197 |