Red Hat Bugzilla – Bug 1124827
RFE: Enable ECDHE support in sendmail
Last modified: 2017-09-14 09:53:10 EDT
Description of problem: Please enable ECDHE support for RHEL 7 as we have it for Fedora. See: http://pkgs.fedoraproject.org/cgit/sendmail.git/commit/?id=509e9c8c3986e14a5fa698264f6b15a4ba2adb5f Version-Release number of selected component (if applicable): sendmail-8.14.7-4.el7.x86_64
I am not sure whether this will get in, please escalate it through the support channel to give it prio.
We want this as well. I'll escalate through our support channels.
Created attachment 1205272 [details] Backported feature Unfortunately sendmail version in RHEL-7.3 is too old, thus the patch from the comment 0 is not enough and we need to backport the support. Full patch is attached.
Scratch build for testing (unsupported): http://people.redhat.com/jskarvad/rhbz1124827/
(In reply to Jaroslav Škarvada from comment #8) > Created attachment 1205272 [details] > Backported feature > > Unfortunately sendmail version in RHEL-7.3 is too old, thus the patch from > the comment 0 is not enough and we need to backport the support. Full patch > is attached. It needs to be applied together with the patch from the comment 0.
QA: Verified on all archs. ********** sendmail-8.14.7-4.el7 (faulty): # for i in $(openssl ciphers|sed 's/:/\n/g'); do echo QUIT | openssl s_client -cipher "$i" -starttls smtp -connect localhost:25 2>&1 | grep 'Cipher\s*: [^0]'; done Cipher : ECDH-ECDSA-AES256-GCM-SHA384 Cipher : ECDH-ECDSA-AES256-SHA384 Cipher : ECDH-ECDSA-AES256-SHA Cipher : ECDH-ECDSA-AES128-GCM-SHA256 Cipher : ECDH-ECDSA-AES128-SHA256 Cipher : ECDH-ECDSA-AES128-SHA Cipher : ECDH-ECDSA-DES-CBC3-SHA Cipher : ECDH-ECDSA-RC4-SHA ********** sendmail-8.14.7-5.el7 (fixed): # for i in $(openssl ciphers|sed 's/:/\n/g'); do echo QUIT | openssl s_client -cipher "$i" -starttls smtp -connect localhost:25 2>&1 | grep 'Cipher\s*: [^0]'; done Cipher : ECDHE-ECDSA-AES256-GCM-SHA384 Cipher : ECDHE-ECDSA-AES256-SHA384 Cipher : ECDHE-ECDSA-AES256-SHA Cipher : ECDH-ECDSA-AES256-GCM-SHA384 Cipher : ECDH-ECDSA-AES256-SHA384 Cipher : ECDH-ECDSA-AES256-SHA Cipher : ECDHE-ECDSA-AES128-GCM-SHA256 Cipher : ECDHE-ECDSA-AES128-SHA256 Cipher : ECDHE-ECDSA-AES128-SHA Cipher : ECDH-ECDSA-AES128-GCM-SHA256 Cipher : ECDH-ECDSA-AES128-SHA256 Cipher : ECDH-ECDSA-AES128-SHA Cipher : ECDHE-ECDSA-DES-CBC3-SHA Cipher : ECDH-ECDSA-DES-CBC3-SHA Cipher : ECDHE-ECDSA-RC4-SHA Cipher : ECDH-ECDSA-RC4-SHA
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2197