Bug 1369830

Summary:	olcTLSProtocolMin: 3.2 does not disable TLSv1.0
Product:	Red Hat Enterprise Linux 7	Reporter:	Steven Haigh <netwiz>
Component:	openldap	Assignee:	Matus Honek <mhonek>
Status:	CLOSED NEXTRELEASE	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.2	CC:	netwiz, pkis
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openldap-2.4.40-12.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-08-29 12:16:02 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Steven Haigh 2016-08-24 14:02:00 UTC

$ rpm -qa | grep openldap
openldap-servers-2.4.40-9.el7_2.x86_64
openldap-2.4.40-9.el7_2.x86_64
openldap-clients-2.4.40-9.el7_2.x86_64

Documentation link:
https://access.redhat.com/articles/1474813

Setting olcTLSProtocolMin: 3.1 does only enable TLSv1.0 or above.

The documentation states:
olcTLSProtocolMin: 3.2 - TVSv1.1 or better

When using the following:
dn: cn=config
changetype: modify
replace: olcTLSCipherSuite
olcTLSCipherSuite: ECDHE-RSA-AES256-SHA384:AES256-SHA256:!RC4:HIGH:!MD5:!EDH:!EXP:!SSLV2:!eNULL
-
replace: olcTLSProtocolMin
olcTLSProtocolMin: 3.2

A scan of port 636 shows:
 SSLv2               not offered (OK)
 SSLv3               not offered (OK)
 TLS 1               offered
 TLS 1.1             offered
 TLS 1.2             offered (OK)

Comment 2 Matus Honek 2016-08-29 12:16:02 UTC

This issue should be resolved with next release (openldap-2.4.40-12.el7) by resolving bug 1249093.

Comment 3 Steven Haigh 2016-08-29 22:35:31 UTC

Hi,

It doesn't look like I have permission to view that bug for reference. Can I please be added to the CC to read it?

Comment 4 Matus Honek 2016-08-30 08:25:47 UTC

(In reply to Steven Haigh from comment #3)
> Hi,
> 
> It doesn't look like I have permission to view that bug for reference. Can I
> please be added to the CC to read it?

Hi Steven, I am sorry but I am not sure if I can do that. However, the fix there rewrites the olcTLSProtocolMin (aka TLS_PROTOCOL_MIN) portion of code so that this option works correctly for all settings of SSL2, SSL3 and TLSv1.x.