Inferencium/cfg
1
0
Fork 0
Code Issues Activity

Prepare to upgrade password hashes from SCRAM-SHA-256 to SCRAM-SHA-512. Enforce specific ciphersuites. Disallow SSLv2 and TLSv1.1.

Browse Source
This commit is contained in:
inference 2023-02-19 19:24:26 +00:00
parent 29595644d9
commit 069a0a14d9
Signed by: inference
SSH Key Fingerprint: SHA256:9Pl0nZ2UJacgm+IeEtLSZ4FOESgP1eKCtRflfPfdX9M
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
server/xb000-0/ejabberd/ejabberd.yml
View File

@ -4,7 +4,7 @@
# Copyright 2022-2023 Jake Winters # Copyright 2022-2023 Jake Winters
# SPDX-License-Identifier: GPL-3.0-or-later # SPDX-License-Identifier: GPL-3.0-or-later
# Version: 2.0.0.3 # Version: 3.0.0.4
# Hosts # Hosts
@ -26,23 +26,30 @@ language: en
## Passwords ## Passwords
auth_password_format: scram auth_password_format: scram
auth_scram_hash: sha256 auth_scram_hash: sha256
### Upgrade password hashes to SHA-512 when possible. Currently infeasible due to current users
### having passwords created using SHA-256.
# auth_scram_hash: sha512
## Client-to-Server ## Client-to-Server
c2s_ciphers: c2s_ciphers:
- HIGH - "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"
c2s_protocol_options: c2s_protocol_options:
- no_sslv2
- no_sslv3 - no_sslv3
- no_tlsv1 - no_tlsv1
- no_tlsv1_1
- no_compression - no_compression
- cipher_server_preferences - cipher_server_preferences
c2s_tls_compression: false c2s_tls_compression: false
## Server-to-Server ## Server-to-Server
s2s_ciphers: s2s_ciphers:
- HIGH - "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"
s2s_protocol_options: s2s_protocol_options:
- no_sslv2
- no_sslv3 - no_sslv3
- no_tlsv1 - no_tlsv1
- no_tlsv1_1
- no_compression - no_compression
- cipher_server_preferences - cipher_server_preferences
s2s_use_starttls: required s2s_use_starttls: required