- Blind-sysadmins - lists.hodgsonfamily.org

Strange gateway issue
by Barry Toner 15 Jan '19

15 Jan '19

Hi all, I have an Asus router that has the standard gateway address of 192.168.1.1. I connected a Powerline adaptor from TP Link. When I connect to the SSID being broadcast from the router and not the Powerline adaptor, and try to browse to the routers web admin I end up at the Powerline adaptor web admin using the gateway address. However, if I disconnect the Powerline adaptor the gateway address takes me to the router as expected. All network services are working as normal with or without the Powerline adaptor. What is happening and when the Powerline adaptor is connecting and apparently stealing the gateway address where is the routers gateway or rather how is it being addressed? At first I thought the Powerline adaptor was taking over as a DHCP, but that doesn’t make sense as I haven’t configured the Powerline adaptors WIFI move, so as far as I am aware the SSID is still coming directly from the router and not the Powerline adaptor…. Hope this makes sense? Cheers, Barry.

1 1

Re: Podcast on why accessibility is not a win.
by Andrew Hodgson 14 Jan '19

14 Jan '19

Hi, Sorry only just got around to this now - I don't really listen to many podcasts so had to make a bit of time. I originally thought this was the Windows 10 RE mode speech we were talking about but we were talking about the OOBE. I am not sure what the end decision is on the talking OOBE now, but I agree that the way they implemented it was probably a bit dumb in the sense that everyone else I know of hates the thing and wants to get rid of it. Also if you try and use it without enabling Narrator you will have a tough time, so I think it needs addressing. However the podcast was totally wrong and the comments made were at best misguided and at worse will only serve to clarify people's misguided opinion on what people with little or no sight can do on a computer. I am not sure what the state of the talking OOBE will be going forward, but I like the way Apple do this after a while of silence, and then only giving the minimum of noise. If I can find it the BCAB (presenter me!) did a presentation on installing Windows from a completely blank disk and everyone was extremely pleased with the work that MS did. However I did do a survey afterwards about how many people would try this on their own and in a room of 40 people only 2 said they would try it actively which although I wasn't surprised, it did make me feel a bit sad. Andrew. -----Original Message----- From: Barry Toner <barry(a)tonermail.co.uk> Sent: 14 January 2019 20:32 To: Blind sysadmins list <blind-sysadmins(a)lists.hodgsonfamily.org> Subject: [Blind-sysadmins] Re: Podcast on why accessibility is not a win. Hi, I have reposted Daragh's link to the British Computer Of The Blind Association discussion list. It is important that word is gotten out there, and that people contact Paul, Leo and the team at TWIT.tv and our voice is heard. This is an utter disgrace. I've just about calmed down, after a few hours and a fair number of cigarettes. Thank you so so much Darragh for picking up on this and addressing this. As I've said on the BCAB list, talking on the lists is grand but to effect change the guys at TWIT.tv need to hear about this. It's important that we contact them directly and that the powers that be see Darragh's BLOG and accompanying comments. Barry. -----Original Message----- From: Billy Irwin [mailto:billy.irwin@outlook.com] Sent: Monday, January 14, 2019 5:12 PM To: Blind sysadmins list Subject: [Blind-sysadmins] Re: Podcast on why accessibility is not a win. I also submitted something to your blog and also sent an email to Leo directly. Best Billy L. Irwin - K9OH -----Original Message----- From: Barry Toner <barry(a)tonermail.co.uk> Sent: Monday, January 14, 2019 12:10 PM To: jheim(a)math.wisc.edu; Blind sysadmins list <blind-sysadmins(a)lists.hodgsonfamily.org> Subject: [Blind-sysadmins] Re: Podcast on why accessibility is not a win. Hi, I've submitted a reply on your BLOG. I hope it went through OK. Barry -----Original Message----- From: John G Heim [mailto:jheim@math.wisc.edu] Sent: Monday, January 14, 2019 4:36 PM To: Blind sysadmins list; Andrew Hodgson Subject: [Blind-sysadmins] Re: Podcast on why accessibility is not a win. I think this issue highlights a point I'veen trying to make for years. While the number of blind sys admins might be fairly small, to them, accessibility is extremely important. There probably are a lot more blind sys admins than most people realize. But having to call someone over to help you install Windows, as the podcaster suggested, is not a trivial thing. it is a matter of whether you can actually perform the job you were hired to do or not. There aren't that many tweeks Microsoft can make to Windows that can change the careers, and therefore the very lives, of a whole class of people. Accessibility problems aren't like other bugs. A typical bug doesn't make it harder for one guy to keep his job compared to another guy. A typical bug doesn't put a whole class of people at a disadvantage in the job market. On 1/14/19 5:21 AM, Andrew Hodgson wrote: > Hi, > > Have you had any response to paul on Twitter yet? He has responded to me a couple of times there, but this is a different point entirely. > > Andrew. > ________________________________________ > From: Darragh Ó Héiligh [d(a)digitaldarragh.com] > Sent: 14 January 2019 11:16 > To: Blind sysadmins list > Subject: [Blind-sysadmins] Re: Podcast on why accessibility is not a win. > > Thanks for highlighting this. > > I recorded this to hopefully get the message out that Paul Thurrott was very wrong in what he was saying. I'm hoping that they will correct him on Wednesday. > > -----Original Message----- > From: mhysnm1964(a)gmail.com <mhysnm1964(a)gmail.com> > Sent: Sunday 13 January 2019 23:26 > To: 'Blind sysadmins list' <blind-sysadmins(a)lists.hodgsonfamily.org> > Subject: [Blind-sysadmins] Podcast on why accessibility is not a win. > > All, > > > > The below podcast I would suggest you have a listen too. The original podcast is from Windows weekly episode 603 where this host makes a large number of negative statements against accessibility for the vision impaired in windows. They are design to get an reaction. The host of the below podcast does an excellent job in highlighting the errors. > > > > http://www.digitaldarragh.com/2019/01/10/windows-weekly-603-paul-thurr > ott-is > -so-very-wrong/#comment-49688 > > > > _______________________________________________ > Blind-sysadmins mailing list -- > blind-sysadmins(a)lists.hodgsonfamily.org > To unsubscribe send an email to > blind-sysadmins-leave(a)lists.hodgsonfamily.org > _______________________________________________ > Blind-sysadmins mailing list -- > blind-sysadmins(a)lists.hodgsonfamily.org > To unsubscribe send an email to > blind-sysadmins-leave(a)lists.hodgsonfamily.org > _______________________________________________ > Blind-sysadmins mailing list -- > blind-sysadmins(a)lists.hodgsonfamily.org > To unsubscribe send an email to > blind-sysadmins-leave(a)lists.hodgsonfamily.org > _______________________________________________ Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org To unsubscribe send an email to blind-sysadmins-leave(a)lists.hodgsonfamily.org _______________________________________________ Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org To unsubscribe send an email to blind-sysadmins-leave(a)lists.hodgsonfamily.org _______________________________________________ Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org To unsubscribe send an email to blind-sysadmins-leave(a)lists.hodgsonfamily.org _______________________________________________ Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org To unsubscribe send an email to blind-sysadmins-leave(a)lists.hodgsonfamily.org

1 0

Re: Podcast on why accessibility is not a win.
by Billy Irwin 14 Jan '19

14 Jan '19

I also submitted something to your blog and also sent an email to Leo directly. Best Billy L. Irwin - K9OH -----Original Message----- From: Barry Toner <barry(a)tonermail.co.uk> Sent: Monday, January 14, 2019 12:10 PM To: jheim(a)math.wisc.edu; Blind sysadmins list <blind-sysadmins(a)lists.hodgsonfamily.org> Subject: [Blind-sysadmins] Re: Podcast on why accessibility is not a win. Hi, I've submitted a reply on your BLOG. I hope it went through OK. Barry -----Original Message----- From: John G Heim [mailto:jheim@math.wisc.edu] Sent: Monday, January 14, 2019 4:36 PM To: Blind sysadmins list; Andrew Hodgson Subject: [Blind-sysadmins] Re: Podcast on why accessibility is not a win. I think this issue highlights a point I'veen trying to make for years. While the number of blind sys admins might be fairly small, to them, accessibility is extremely important. There probably are a lot more blind sys admins than most people realize. But having to call someone over to help you install Windows, as the podcaster suggested, is not a trivial thing. it is a matter of whether you can actually perform the job you were hired to do or not. There aren't that many tweeks Microsoft can make to Windows that can change the careers, and therefore the very lives, of a whole class of people. Accessibility problems aren't like other bugs. A typical bug doesn't make it harder for one guy to keep his job compared to another guy. A typical bug doesn't put a whole class of people at a disadvantage in the job market. On 1/14/19 5:21 AM, Andrew Hodgson wrote: > Hi, > > Have you had any response to paul on Twitter yet? He has responded to me a couple of times there, but this is a different point entirely. > > Andrew. > ________________________________________ > From: Darragh Ó Héiligh [d(a)digitaldarragh.com] > Sent: 14 January 2019 11:16 > To: Blind sysadmins list > Subject: [Blind-sysadmins] Re: Podcast on why accessibility is not a win. > > Thanks for highlighting this. > > I recorded this to hopefully get the message out that Paul Thurrott was very wrong in what he was saying. I'm hoping that they will correct him on Wednesday. > > -----Original Message----- > From: mhysnm1964(a)gmail.com <mhysnm1964(a)gmail.com> > Sent: Sunday 13 January 2019 23:26 > To: 'Blind sysadmins list' <blind-sysadmins(a)lists.hodgsonfamily.org> > Subject: [Blind-sysadmins] Podcast on why accessibility is not a win. > > All, > > > > The below podcast I would suggest you have a listen too. The original podcast is from Windows weekly episode 603 where this host makes a large number of negative statements against accessibility for the vision impaired in windows. They are design to get an reaction. The host of the below podcast does an excellent job in highlighting the errors. > > > > http://www.digitaldarragh.com/2019/01/10/windows-weekly-603-paul-thurr > ott-is > -so-very-wrong/#comment-49688 > > > > _______________________________________________ > Blind-sysadmins mailing list -- > blind-sysadmins(a)lists.hodgsonfamily.org > To unsubscribe send an email to > blind-sysadmins-leave(a)lists.hodgsonfamily.org > _______________________________________________ > Blind-sysadmins mailing list -- > blind-sysadmins(a)lists.hodgsonfamily.org > To unsubscribe send an email to > blind-sysadmins-leave(a)lists.hodgsonfamily.org > _______________________________________________ > Blind-sysadmins mailing list -- > blind-sysadmins(a)lists.hodgsonfamily.org > To unsubscribe send an email to > blind-sysadmins-leave(a)lists.hodgsonfamily.org > _______________________________________________ Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org To unsubscribe send an email to blind-sysadmins-leave(a)lists.hodgsonfamily.org _______________________________________________ Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org To unsubscribe send an email to blind-sysadmins-leave(a)lists.hodgsonfamily.org

2 1

Re: Podcast on why accessibility is not a win.
by John G Heim 14 Jan '19

14 Jan '19

I think this issue highlights a point I'veen trying to make for years. While the number of blind sys admins might be fairly small, to them, accessibility is extremely important. There probably are a lot more blind sys admins than most people realize. But having to call someone over to help you install Windows, as the podcaster suggested, is not a trivial thing. it is a matter of whether you can actually perform the job you were hired to do or not. There aren't that many tweeks Microsoft can make to Windows that can change the careers, and therefore the very lives, of a whole class of people. Accessibility problems aren't like other bugs. A typical bug doesn't make it harder for one guy to keep his job compared to another guy. A typical bug doesn't put a whole class of people at a disadvantage in the job market. On 1/14/19 5:21 AM, Andrew Hodgson wrote: > Hi, > > Have you had any response to paul on Twitter yet? He has responded to me a couple of times there, but this is a different point entirely. > > Andrew. > ________________________________________ > From: Darragh Ó Héiligh [d(a)digitaldarragh.com] > Sent: 14 January 2019 11:16 > To: Blind sysadmins list > Subject: [Blind-sysadmins] Re: Podcast on why accessibility is not a win. > > Thanks for highlighting this. > > I recorded this to hopefully get the message out that Paul Thurrott was very wrong in what he was saying. I'm hoping that they will correct him on Wednesday. > > -----Original Message----- > From: mhysnm1964(a)gmail.com <mhysnm1964(a)gmail.com> > Sent: Sunday 13 January 2019 23:26 > To: 'Blind sysadmins list' <blind-sysadmins(a)lists.hodgsonfamily.org> > Subject: [Blind-sysadmins] Podcast on why accessibility is not a win. > > All, > > > > The below podcast I would suggest you have a listen too. The original podcast is from Windows weekly episode 603 where this host makes a large number of negative statements against accessibility for the vision impaired in windows. They are design to get an reaction. The host of the below podcast does an excellent job in highlighting the errors. > > > > http://www.digitaldarragh.com/2019/01/10/windows-weekly-603-paul-thurrott-is > -so-very-wrong/#comment-49688 > > > > _______________________________________________ > Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org > To unsubscribe send an email to blind-sysadmins-leave(a)lists.hodgsonfamily.org > _______________________________________________ > Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org > To unsubscribe send an email to blind-sysadmins-leave(a)lists.hodgsonfamily.org > _______________________________________________ > Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org > To unsubscribe send an email to blind-sysadmins-leave(a)lists.hodgsonfamily.org >

2 1

Re: Podcast on why accessibility is not a win.
by Darragh Ó Héiligh 14 Jan '19

14 Jan '19

All he's said is he's completely uninterested in this. This isn't surprising. It's normal for him not to respond well to constructive feedback. So I@m hoping Leo and Mary Joe will speak to him and maybe we'll have some clarification on Wednesday. -----Original Message----- From: Andrew Hodgson <andrew(a)hodgson.io> Sent: Monday 14 January 2019 11:21 To: Blind sysadmins list <blind-sysadmins(a)lists.hodgsonfamily.org> Subject: [Blind-sysadmins] Re: Podcast on why accessibility is not a win. Hi, Have you had any response to paul on Twitter yet? He has responded to me a couple of times there, but this is a different point entirely. Andrew. ________________________________________ From: Darragh Ó Héiligh [d(a)digitaldarragh.com] Sent: 14 January 2019 11:16 To: Blind sysadmins list Subject: [Blind-sysadmins] Re: Podcast on why accessibility is not a win. Thanks for highlighting this. I recorded this to hopefully get the message out that Paul Thurrott was very wrong in what he was saying. I'm hoping that they will correct him on Wednesday. -----Original Message----- From: mhysnm1964(a)gmail.com <mhysnm1964(a)gmail.com> Sent: Sunday 13 January 2019 23:26 To: 'Blind sysadmins list' <blind-sysadmins(a)lists.hodgsonfamily.org> Subject: [Blind-sysadmins] Podcast on why accessibility is not a win. All, The below podcast I would suggest you have a listen too. The original podcast is from Windows weekly episode 603 where this host makes a large number of negative statements against accessibility for the vision impaired in windows. They are design to get an reaction. The host of the below podcast does an excellent job in highlighting the errors. http://www.digitaldarragh.com/2019/01/10/windows-weekly-603-paul-thurrott-is -so-very-wrong/#comment-49688 _______________________________________________ Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org To unsubscribe send an email to blind-sysadmins-leave(a)lists.hodgsonfamily.org _______________________________________________ Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org To unsubscribe send an email to blind-sysadmins-leave(a)lists.hodgsonfamily.org _______________________________________________ Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org To unsubscribe send an email to blind-sysadmins-leave(a)lists.hodgsonfamily.org

1 0

Re: Podcast on why accessibility is not a win.
by Andrew Hodgson 14 Jan '19

14 Jan '19

Hi, Have you had any response to paul on Twitter yet? He has responded to me a couple of times there, but this is a different point entirely. Andrew. ________________________________________ From: Darragh Ó Héiligh [d(a)digitaldarragh.com] Sent: 14 January 2019 11:16 To: Blind sysadmins list Subject: [Blind-sysadmins] Re: Podcast on why accessibility is not a win. Thanks for highlighting this. I recorded this to hopefully get the message out that Paul Thurrott was very wrong in what he was saying. I'm hoping that they will correct him on Wednesday. -----Original Message----- From: mhysnm1964(a)gmail.com <mhysnm1964(a)gmail.com> Sent: Sunday 13 January 2019 23:26 To: 'Blind sysadmins list' <blind-sysadmins(a)lists.hodgsonfamily.org> Subject: [Blind-sysadmins] Podcast on why accessibility is not a win. All, The below podcast I would suggest you have a listen too. The original podcast is from Windows weekly episode 603 where this host makes a large number of negative statements against accessibility for the vision impaired in windows. They are design to get an reaction. The host of the below podcast does an excellent job in highlighting the errors. http://www.digitaldarragh.com/2019/01/10/windows-weekly-603-paul-thurrott-is -so-very-wrong/#comment-49688 _______________________________________________ Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org To unsubscribe send an email to blind-sysadmins-leave(a)lists.hodgsonfamily.org _______________________________________________ Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org To unsubscribe send an email to blind-sysadmins-leave(a)lists.hodgsonfamily.org

1 0

Re: Implementing Encryption with the OWASP Advanced+ Setup
by David Mehler 07 Jan '19

07 Jan '19

Hello Andrew, Thanks. Does b only allow TLS 1.2? That's the only thing I am wanting, can I get a look at your settings? I'd like to compare yours to mine? Thanks. Dave. On 1/6/19, Andrew Hodgson <andrew(a)hodgson.io> wrote: > Hi, > > As I said I put my settings to the B grade which I think is strong enough > without disabling clients. I wouldn't go higher than B when configuring > hardening at work in any case. > > In terms of the SSL versions I am not talking about OpenSSL version but the > version of the TLS protocol you are using, if you are using A+ or A you need > to explicitly state only allowing TLS 1.2 and nothing else, if you specify > other TLS versions it may mismatch. > > Andrew. > > -----Original Message----- > From: David Mehler <dave.mehler(a)gmail.com> > Sent: 06 January 2019 00:19 > To: Blind sysadmins list <blind-sysadmins(a)lists.hodgsonfamily.org> > Subject: [Blind-sysadmins] Re: Implementing Encryption with the OWASP > Advanced+ Setup > > Hello Andrew, > > Thanks for your reply. My openssl version is 1.02q of November 2018. > The ciphers I'm using were from the A+ OWASP. Clients are Android 7.1 > Aquamail, and IE11. > > Andrew, where are you getting your ciphers from? They seem more advanced > yours are working, and the article i'm referencing. I'd like to go with A+ > or A if doable. > > Thanks. > Dave. > > > On 1/5/19, Andrew Hodgson <andrew(a)hodgson.io> wrote: >> FWIW I just implemented the cipher suites for B (broad compatibility) >> and got a higher score on the Qualys SSL Labs test (got A+ both times >> but higher score on secure ciphers second time). I think that B >> should be enough unless you want to really start locking down. I >> wouldn't go any higher than B on a public web server anyway. >> >> Andrew. >> >> -----Original Message----- >> From: Andrew Hodgson <andrew(a)hodgson.io> >> Sent: 05 January 2019 23:52 >> To: Blind sysadmins list <blind-sysadmins(a)lists.hodgsonfamily.org> >> Subject: [Blind-sysadmins] Re: Implementing Encryption with the OWASP >> Advanced+ Setup >> >> Hi, >> >> I would check you are using the correct SSL versions as well as the A+ >> needs TLS 1.2 with those ciphers so any other TLS version wouldn't work. >> >> You cannot make exceptions for specific clients as the handshake is >> done as the first step so the client isn't even identified. You can >> of course configure the strings in different servers differently. I >> think you may be able to get away with B now on web servers but if you >> are dealing with other protocols (especially IMAP/S and SMTP/S) I would >> set these to C. >> >> Which reminds me I need to check my own list as it is out of date. >> Andrew. >> >> -----Original Message----- >> From: David Mehler <dave.mehler(a)gmail.com> >> Sent: 05 January 2019 17:55 >> To: blind-sysadmins <blind-sysadmins(a)lists.hodgsonfamily.org> >> Subject: [Blind-sysadmins] Implementing Encryption with the OWASP >> Advanced+ Setup >> >> Hello, >> >> I'm trying to update my server security. I'm wanting to implement the >> OWASP recommended Advanced+ setup. For reference that is: >> >> https://www.owasp.org/index.php/TLS_Cipher_String_Cheat_Sheet >> >> My client compatibility I thought was good, using firefox 57, chrome >> the latest I just updated it from ninite, and ie11 on win10, and >> Aquamail as an android client. >> >> My tls cipher suite I'm using for the advanced+ configuration is: >> >> DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-G >> CM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 >> >> Having set this nothing is working, getting tls connection errors can >> not negotiate a compatible protocol or cipher. This tells me the >> protocols and ciphers are to restrictive, I was under the impression this >> should work. >> Does anyone have this implemented? Can you make exceptions for certain >> clients I'll go that way if I have to. >> >> The services I'm trying to get going are Apache v2.4, Postfix 3.3, and >> dovecot 2.3. My openssl version is 1.02q 20 NOV. 2018. >> >> Suggestions welcome. >> >> Thanks. >> Dave. >> _______________________________________________ >> Blind-sysadmins mailing list -- >> blind-sysadmins(a)lists.hodgsonfamily.org >> To unsubscribe send an email to >> blind-sysadmins-leave(a)lists.hodgsonfamily.org >> _______________________________________________ >> Blind-sysadmins mailing list -- >> blind-sysadmins(a)lists.hodgsonfamily.org >> To unsubscribe send an email to >> blind-sysadmins-leave(a)lists.hodgsonfamily.org >> _______________________________________________ >> Blind-sysadmins mailing list -- >> blind-sysadmins(a)lists.hodgsonfamily.org >> To unsubscribe send an email to >> blind-sysadmins-leave(a)lists.hodgsonfamily.org >> > _______________________________________________ > Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org > To unsubscribe send an email to > blind-sysadmins-leave(a)lists.hodgsonfamily.org > _______________________________________________ > Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org > To unsubscribe send an email to > blind-sysadmins-leave(a)lists.hodgsonfamily.org >

2 1

Re: Implementing Encryption with the OWASP Advanced+ Setup
by David Mehler 06 Jan '19

06 Jan '19

Hello Andrew, Thanks for your reply. My openssl version is 1.02q of November 2018. The ciphers I'm using were from the A+ OWASP. Clients are Android 7.1 Aquamail, and IE11. Andrew, where are you getting your ciphers from? They seem more advanced yours are working, and the article i'm referencing. I'd like to go with A+ or A if doable. Thanks. Dave. On 1/5/19, Andrew Hodgson <andrew(a)hodgson.io> wrote: > FWIW I just implemented the cipher suites for B (broad compatibility) and > got a higher score on the Qualys SSL Labs test (got A+ both times but higher > score on secure ciphers second time). I think that B should be enough > unless you want to really start locking down. I wouldn't go any higher than > B on a public web server anyway. > > Andrew. > > -----Original Message----- > From: Andrew Hodgson <andrew(a)hodgson.io> > Sent: 05 January 2019 23:52 > To: Blind sysadmins list <blind-sysadmins(a)lists.hodgsonfamily.org> > Subject: [Blind-sysadmins] Re: Implementing Encryption with the OWASP > Advanced+ Setup > > Hi, > > I would check you are using the correct SSL versions as well as the A+ needs > TLS 1.2 with those ciphers so any other TLS version wouldn't work. > > You cannot make exceptions for specific clients as the handshake is done as > the first step so the client isn't even identified. You can of course > configure the strings in different servers differently. I think you may be > able to get away with B now on web servers but if you are dealing with other > protocols (especially IMAP/S and SMTP/S) I would set these to C. > > Which reminds me I need to check my own list as it is out of date. > Andrew. > > -----Original Message----- > From: David Mehler <dave.mehler(a)gmail.com> > Sent: 05 January 2019 17:55 > To: blind-sysadmins <blind-sysadmins(a)lists.hodgsonfamily.org> > Subject: [Blind-sysadmins] Implementing Encryption with the OWASP Advanced+ > Setup > > Hello, > > I'm trying to update my server security. I'm wanting to implement the OWASP > recommended Advanced+ setup. For reference that is: > > https://www.owasp.org/index.php/TLS_Cipher_String_Cheat_Sheet > > My client compatibility I thought was good, using firefox 57, chrome the > latest I just updated it from ninite, and ie11 on win10, and Aquamail as an > android client. > > My tls cipher suite I'm using for the advanced+ configuration is: > > DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 > > Having set this nothing is working, getting tls connection errors can not > negotiate a compatible protocol or cipher. This tells me the protocols and > ciphers are to restrictive, I was under the impression this should work. > Does anyone have this implemented? Can you make exceptions for certain > clients I'll go that way if I have to. > > The services I'm trying to get going are Apache v2.4, Postfix 3.3, and > dovecot 2.3. My openssl version is 1.02q 20 NOV. 2018. > > Suggestions welcome. > > Thanks. > Dave. > _______________________________________________ > Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org > To unsubscribe send an email to > blind-sysadmins-leave(a)lists.hodgsonfamily.org > _______________________________________________ > Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org > To unsubscribe send an email to > blind-sysadmins-leave(a)lists.hodgsonfamily.org > _______________________________________________ > Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org > To unsubscribe send an email to > blind-sysadmins-leave(a)lists.hodgsonfamily.org >

2 1

Re: Implementing Encryption with the OWASP Advanced+ Setup
by Andrew Hodgson 06 Jan '19

06 Jan '19

FWIW I just implemented the cipher suites for B (broad compatibility) and got a higher score on the Qualys SSL Labs test (got A+ both times but higher score on secure ciphers second time). I think that B should be enough unless you want to really start locking down. I wouldn't go any higher than B on a public web server anyway. Andrew. -----Original Message----- From: Andrew Hodgson <andrew(a)hodgson.io> Sent: 05 January 2019 23:52 To: Blind sysadmins list <blind-sysadmins(a)lists.hodgsonfamily.org> Subject: [Blind-sysadmins] Re: Implementing Encryption with the OWASP Advanced+ Setup Hi, I would check you are using the correct SSL versions as well as the A+ needs TLS 1.2 with those ciphers so any other TLS version wouldn't work. You cannot make exceptions for specific clients as the handshake is done as the first step so the client isn't even identified. You can of course configure the strings in different servers differently. I think you may be able to get away with B now on web servers but if you are dealing with other protocols (especially IMAP/S and SMTP/S) I would set these to C. Which reminds me I need to check my own list as it is out of date. Andrew. -----Original Message----- From: David Mehler <dave.mehler(a)gmail.com> Sent: 05 January 2019 17:55 To: blind-sysadmins <blind-sysadmins(a)lists.hodgsonfamily.org> Subject: [Blind-sysadmins] Implementing Encryption with the OWASP Advanced+ Setup Hello, I'm trying to update my server security. I'm wanting to implement the OWASP recommended Advanced+ setup. For reference that is: https://www.owasp.org/index.php/TLS_Cipher_String_Cheat_Sheet My client compatibility I thought was good, using firefox 57, chrome the latest I just updated it from ninite, and ie11 on win10, and Aquamail as an android client. My tls cipher suite I'm using for the advanced+ configuration is: DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 Having set this nothing is working, getting tls connection errors can not negotiate a compatible protocol or cipher. This tells me the protocols and ciphers are to restrictive, I was under the impression this should work. Does anyone have this implemented? Can you make exceptions for certain clients I'll go that way if I have to. The services I'm trying to get going are Apache v2.4, Postfix 3.3, and dovecot 2.3. My openssl version is 1.02q 20 NOV. 2018. Suggestions welcome. Thanks. Dave. _______________________________________________ Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org To unsubscribe send an email to blind-sysadmins-leave(a)lists.hodgsonfamily.org _______________________________________________ Blind-sysadmins mailing list -- blind-sysadmins(a)lists.hodgsonfamily.org To unsubscribe send an email to blind-sysadmins-leave(a)lists.hodgsonfamily.org

1 0

Implementing Encryption with the OWASP Advanced+ Setup
by David Mehler 05 Jan '19

05 Jan '19

Hello, I'm trying to update my server security. I'm wanting to implement the OWASP recommended Advanced+ setup. For reference that is: https://www.owasp.org/index.php/TLS_Cipher_String_Cheat_Sheet My client compatibility I thought was good, using firefox 57, chrome the latest I just updated it from ninite, and ie11 on win10, and Aquamail as an android client. My tls cipher suite I'm using for the advanced+ configuration is: DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 Having set this nothing is working, getting tls connection errors can not negotiate a compatible protocol or cipher. This tells me the protocols and ciphers are to restrictive, I was under the impression this should work. Does anyone have this implemented? Can you make exceptions for certain clients I'll go that way if I have to. The services I'm trying to get going are Apache v2.4, Postfix 3.3, and dovecot 2.3. My openssl version is 1.02q 20 NOV. 2018. Suggestions welcome. Thanks. Dave.

2 1