Mailing-List: contact users-help@trafficserver.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@trafficserver.apache.org
Received-SPF: neutral (nike.apache.org: local policy)
Content-Type: text/plain; charset=windows-1252
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
Subject: Re: POODLE and ATS configs
From: Leif Hedstrom <zwoop@apache.org>
In-Reply-To: 
 <CAHZAEpdxNBakiFiiiZvmDhu9OBNMd8go1tXP2dBwLFiR7cGjKg@mail.gmail.com>
Date: Tue, 14 Oct 2014 21:02:13 -0600
Cc: Scott Beardsley <sbeards@yahoo-inc.com>,
        "dev@trafficserver.apache.org" <dev@trafficserver.apache.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <4D3E0F27-B2F8-458B-B943-DC738EDC73A7@apache.org>
References: 
 <CAFKFyq7O_cXEXofQYQYAVxy7z8o+u4Zvd+9ksHUBLfD6Mdx1RA@mail.gmail.com>
 <1568469102.6745.1413328983786.JavaMail.yahoo@jws10001b.mail.ne1.yahoo.com>
 <CAHZAEpdxNBakiFiiiZvmDhu9OBNMd8go1tXP2dBwLFiR7cGjKg@mail.gmail.com>
To: users@trafficserver.apache.org


On Oct 14, 2014, at 5:25 PM, Jason J. W. Williams =
<jasonjwwilliams@gmail.com> wrote:

> We've been running our sites with SSLv3 off for sometime, since we
> only support IE7 and newer in our services.
>=20
> Disabling SSLv3 hurts folks who need to support IE6 clients primarily.


You still have the option to enable it, of course:

	CONFIG proxy.config.ssl.SSLv3 INT 1


=97 Leif


>=20
> -J
>=20
> On Tue, Oct 14, 2014 at 4:23 PM, Scott Beardsley =
<sbeards@yahoo-inc.com> wrote:
>> Is there an easy way to quantify the impact before turning SSLv3 off? =
Maybe
>> by looking at logs?
>>=20
>>=20
>> On Tuesday, October 14, 2014 4:18 PM, Brian Geffon =
<briang@apache.org>
>> wrote:
>>=20
>>=20
>> cc: users@
>>=20
>> For users who want to immediately disable SSLv3 you should only need =
to
>> change proxy.config.ssl.SSLv3 in records.config to 0 and bounce
>> traffic_server.
>>=20
>> Brian
>>=20
>> On Tue, Oct 14, 2014 at 4:13 PM, Leif Hedstrom <zwoop@apache.org> =
wrote:
>>=20
>> Now that the POODLE is out of the bag, I think we should consider =
changing
>> this for v5.1.1:
>>=20
>>  {RECT_CONFIG, "proxy.config.ssl.SSLv3", RECD_INT, "1", =
RECU_RESTART_TS,
>> RR_NULL, RECC_INT, "[0-1]", RECA_NULL}
>>=20
>>=20
>> I believe this does have a drawback: certain browsers / UAs on some =
OSes
>> might not have TLS support. I think (but not 100% certain) that IE on
>> Windows/XP is one such case?
>>=20
>> Thoughts?
>>=20
>> =97 Leif
>>=20
>> =
http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploit=
ing-ssl-30.html
>>=20
>>=20
>>=20
>>=20