6

I'm running an Exim MTA which only receives emails from a few other systems under my control. All these systems happily negotiate TLSv1.2/TLSv1.3 with my MTA. I would like to disable support for TLSv1.0 and TLSv1.1 but I can't find instructions on how to do so.

All software is installed from the official Debian 10 repository (Exim 4.92, GnuTLS 3.6.6).

3 Answers 3

3

Add the following line to this file /etc/exim4/exim4.conf.template somewhere like in the TLS section (or as described here):

tls_require_ciphers = SECURE192:!VERS-SSL3.0:!VERS-TLS1.0:!VERS-TLS1.1:!VERS-DTLS0.9:!VERS-DTLS1.0 
  • Restart/reload exim with sudo systemctl restart exim4.

  • Verify the exim settings updated with sudo exim -bP | grep tls_require_ciphers.

For further reading on tls_require_ciphers see here.

2

GnuTLS options in Exim

See the bit about using tls_require_ciphers and the GnuTLS priority string definitions. The example which pertains to you is:

tls_require_ciphers = NORMAL:%LATEST_RECORD_VERSION:-VERS-SSL3.0

... which you could further tweak to suit your own requirements.

0

Add a line like this to the config file. Edit it for your required and unrequired ciphers.

# We need to disable SSL2 and key lengths < 128 bits for PCI compliance
tls_require_ciphers = ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+SHA:!MD5:!LOW:!SSLv2:!EXP:!DES
3
  • Note that I would like to disable old protocol versions which is an orthogonal problem to disabling ciphers. Commented Jul 10, 2020 at 1:59
  • 1
    "to the config file", which one? Exim is the absolute worst in documenting where config should go, I've been reading for a full hour in their docs, but it's still unclear.
    – Julius
    Commented Feb 28, 2023 at 16:25
  • "It Depends". The config file on Debian installations is autogenerated by default and usually lives in /etc/exim4/exim4.conf.template. It may live in /etc/exim4/conf.d/ if you split the config up into smaller files. On other GNU/Linux installs I have no idea where it's installed unfortunately.
    – jeremiah
    Commented Jan 19 at 18:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .