Bug 1369830 - olcTLSProtocolMin: 3.2 does not disable TLSv1.0
Summary: olcTLSProtocolMin: 3.2 does not disable TLSv1.0
Keywords:
Status: CLOSED NEXTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: openldap
Version: 7.2
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Matus Honek
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-24 14:02 UTC by Steven Haigh
Modified: 2016-08-30 08:25 UTC (History)
2 users (show)

Fixed In Version: openldap-2.4.40-12.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-08-29 12:16:02 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1249093 1 None None None 2021-01-20 06:05:38 UTC

Internal Links: 1249093

Description Steven Haigh 2016-08-24 14:02:00 UTC 
$ rpm -qa | grep openldap
openldap-servers-2.4.40-9.el7_2.x86_64
openldap-2.4.40-9.el7_2.x86_64
openldap-clients-2.4.40-9.el7_2.x86_64

Documentation link:
https://access.redhat.com/articles/1474813

Setting olcTLSProtocolMin: 3.1 does only enable TLSv1.0 or above.

The documentation states:
olcTLSProtocolMin: 3.2 - TVSv1.1 or better

When using the following:
dn: cn=config
changetype: modify
replace: olcTLSCipherSuite
olcTLSCipherSuite: ECDHE-RSA-AES256-SHA384:AES256-SHA256:!RC4:HIGH:!MD5:!EDH:!EXP:!SSLV2:!eNULL
-
replace: olcTLSProtocolMin
olcTLSProtocolMin: 3.2

A scan of port 636 shows:
 SSLv2               not offered (OK)
 SSLv3               not offered (OK)
 TLS 1               offered
 TLS 1.1             offered
 TLS 1.2             offered (OK)
Comment 2 Matus Honek 2016-08-29 12:16:02 UTC 
This issue should be resolved with next release (openldap-2.4.40-12.el7) by resolving bug 1249093.
Comment 3 Steven Haigh 2016-08-29 22:35:31 UTC 
Hi,

It doesn't look like I have permission to view that bug for reference. Can I please be added to the CC to read it?
Comment 4 Matus Honek 2016-08-30 08:25:47 UTC 
(In reply to Steven Haigh from comment #3)
> Hi,
> 
> It doesn't look like I have permission to view that bug for reference. Can I
> please be added to the CC to read it?

Hi Steven, I am sorry but I am not sure if I can do that. However, the fix there rewrites the olcTLSProtocolMin (aka TLS_PROTOCOL_MIN) portion of code so that this option works correctly for all settings of SSL2, SSL3 and TLSv1.x.
Note You need to log in before you can comment on or make changes to this bug.