Re: V7R3 SSL system values and SSLCONFIG settings - is it ok to leave all at default?

[Jack Woehr <jwoehr@xxxxxxxxxxxxxxxxxxxxxxxx>]

They put up the banners in Punxatawney as the TV crews arrive at the hotels?

On Wed, Jan 10, 2018 at 7:04 AM, Steinmetz, Paul <PSteinmetz@xxxxxxxxxx>
wrote:

> Rob,
>
>  </snip>
> Seems like we're hearing a lot about Feb 1...
>
> What's happening on Feb 1?
>
> Paul
>
> -----Original Message-----
> From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
> Rob Berendt
> Sent: Wednesday, January 10, 2018 7:44 AM
> To: Midrange Systems Technical Discussion
> Subject: RE: V7R3 SSL system values and SSLCONFIG settings - is it ok to
> leave all at default?
>
> Is this as current as the industry?
> <snip>
> Weak Cipher Suites (as of November 2016):
> </snip>
> Seems like we're hearing a lot about Feb 1...
>
>
> Rob Berendt
> --
> IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail
> to:  2505 Dekko Drive
>           Garrett, IN 46738
> Ship to:  Dock 108
>           6928N 400E
>           Kendallville, IN 46755
> http://www.dekko.com
>
>
>
>
>
> From:   Steve Pitcher <SPitcher@xxxxxxxxxxxx>
> To:     Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
> Date:   01/10/2018 07:33 AM
> Subject:        RE: V7R3 SSL system values and SSLCONFIG settings - is it
> ok      to      leave   all at default?
> Sent by:        "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>
>
>
>
> Here's where I usually point:
> http://www-01.ibm.com/support/docview.wss?uid=nas8N1020876
>
> Just to clarify, IBM does remove weak ciphers via PTF. For example, see
> the removal of 3DES here:
> http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697
>
>
> Steve Pitcher
> iTech Solutions
> Office: (203) 744-7854 Ext. 176
> Mobile: (902) 301-0810
> http://www.itechsol.com
> http://www.iInTheCloud.com
>
>
> -----Original Message-----
> From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Rob
> Berendt
> Sent: Tuesday, January 9, 2018 5:23 PM
> To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
> Subject: RE: V7R3 SSL system values and SSLCONFIG settings - is it ok to
> leave all at default?
>
> Is there a one stop shopping site which lists currently acceptable
> ciphers, or currently unacceptable ciphers (and maybe the CVE(s) which
> flags them so), and is reasonably close to calling the cipher what IBM
> calls them in QSSLCSL?
>
>
> Rob Berendt
> --
> IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail
> to:  2505 Dekko Drive
>           Garrett, IN 46738
> Ship to:  Dock 108
>           6928N 400E
>           Kendallville, IN 46755
> http://www.dekko.com
>
>
>
>
>
> From:   Steve Pitcher <SPitcher@xxxxxxxxxxxx>
> To:     Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
> Date:   01/09/2018 04:09 PM
> Subject:        RE: V7R3 SSL system values and SSLCONFIG settings - is it
> ok to   leave   all at default?
> Sent by:        "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>
>
>
>
> Remove the 3DES ciphers.
>
>
>
>
> Steve Pitcher
> iTech Solutions
> Office: (203) 744-7854 Ext. 176
> Mobile: (902) 301-0810
> http://www.itechsol.com
> http://www.iInTheCloud.com
>
>
> -----Original Message-----
> From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
> Steinmetz, Paul
> Sent: Tuesday, January 9, 2018 4:55 PM
> To: 'Midrange Systems Technical Discussion' <midrange-l@xxxxxxxxxxxx>
> Subject: V7R3 SSL system values and SSLCONFIG settings - is it ok to leave
>
> all at default?
>
> I'm reviewing the SSL system values and in SST the SSLCONFIG default
> settings compared to my V7R1 user defined settings.
> From what I'm seeing, default settings should be ok.
> No need for any user defined as I currently have on V7R1.
> Is this correct?
>
> QSSLCSL     *SEC     Secure sockets layer cipher specification list
> Sequence     Cipher
>  number      Suite
>      0
>     10       *ECDHE_ECDSA_AES_128_GCM_SHA256
>     20       *ECDHE_ECDSA_AES_256_GCM_SHA384
>     30       *ECDHE_RSA_AES_128_GCM_SHA256
>     40       *ECDHE_RSA_AES_256_GCM_SHA384
>     50       *RSA_AES_128_GCM_SHA256
>     60       *RSA_AES_256_GCM_SHA384
>     70       *ECDHE_ECDSA_AES_128_CBC_SHA256
>     80       *ECDHE_ECDSA_AES_256_CBC_SHA384
>     90       *ECDHE_RSA_AES_128_CBC_SHA256
>    100       *ECDHE_RSA_AES_256_CBC_SHA384
> 110       *RSA_AES_128_CBC_SHA256
> 120       *RSA_AES_128_CBC_SHA
> 130       *RSA_AES_256_CBC_SHA256
> 140       *RSA_AES_256_CBC_SHA
> 150       *ECDHE_ECDSA_3DES_EDE_CBC_SHA
> 160       *ECDHE_RSA_3DES_EDE_CBC_SHA
> 170       *RSA_3DES_EDE_CBC_SHA
>
> QSSLCSLCTL  *SEC     Secure sockets layer cipher control
>          Cipher control . . . .   *OPSYS
>
> QSSLPCL     *SEC     Secure sockets layer protocols
> Protocols
> *OPSYS
>
>      DISPLAY/ALTER/DUMP
> Running macro: SSLCONFIG                        -DISPLAY
>
> Current configuration
>   SSL Eligible Default Protocol List . . : TLSv1.2
>                                            TLSv1.1
>                                            TLSv1.0
>   SSL Default Protocol List. . . . . . . : TLSv1.2
>                                            TLSv1.1
>                                            TLSv1.0
>   SSL Eligible Default Cipher Suites . . : ECDHE_ECDSA_AES_128_GCM_SHA256
>                                            ECDHE_ECDSA_AES_256_GCM_SHA384
>                                            ECDHE_RSA_AES_128_GCM_SHA256
>                                            ECDHE_RSA_AES_256_GCM_SHA384
>                                            RSA_AES_128_GCM_SHA256
>                                            RSA_AES_256_GCM_SHA384
>                                          ECDHE_ECDSA_AES_128_CBC_SHA256
>                                          ECDHE_ECDSA_AES_256_CBC_SHA384
>                                          ECDHE_RSA_AES_128_CBC_SHA256
>                                          ECDHE_RSA_AES_256_CBC_SHA384
>                                          RSA_AES_128_CBC_SHA256
>                                          RSA_AES_128_CBC_SHA
>                                          RSA_AES_256_CBC_SHA256
>                                          RSA_AES_256_CBC_SHA SSL Default
> Cipher Suite List. . . . . : ECDHE_ECDSA_AES_128_GCM_SHA256
>                                          ECDHE_ECDSA_AES_256_GCM_SHA384
>                                          ECDHE_RSA_AES_128_GCM_SHA256
>                                          ECDHE_RSA_AES_256_GCM_SHA384
>                                          RSA_AES_128_GCM_SHA256
>                                          RSA_AES_256_GCM_SHA384
>                                          ECDHE_ECDSA_AES_128_CBC_SHA256
>                                          ECDHE_ECDSA_AES_256_CBC_SHA384
>                                          ECDHE_RSA_AES_128_CBC_SHA256
>                                          ECDHE_RSA_AES_256_CBC_SHA384
>                                          RSA_AES_128_CBC_SHA256
>                                          RSA_AES_128_CBC_SHA
>                                          RSA_AES_256_CBC_SHA256
>                                          RSA_AES_256_CBC_SHA SSL
> Renegotiation without RFC 5746 . . : None Minimum RSA key size . . . . . .
>
> . . . : 0 bits SSL Client Hello Record Version  . . . : Highest SSL Client
>
> Hello Supports TLSv1.2  . . : Allowed SSL Client Hello Supports TLSv1.1  .
>
> . : Allowed SSL Server Requires RFC 5746 . . . . . : Off SSL Client
> Requires RFC 5746 . . . . . : Off SSL Default Elliptic Curve Named Curve
> List . : Secp521r1
>                  Secp384r1
>                  Secp256r1 SSL Supported Elliptic Curve Named Curve List .
>
> : Secp521r1
>                                                 Secp384r1
>                                                 Secp256r1
>                                                 Secp224r1
>                                                 Secp192r1 SSL Default
> Signature Algorithm List  . . . . : ECDSA with SHA512
>                                                 ECDSA with SHA384
>                                                 ECDSA with SHA256
>                                                 ECDSA with SHA224
>                                                 ECDSA with SHA1
>                                                 RSA with SHA512
>    DISPLAY/ALTER/DUMP
>                                                 RSA with SHA384
>                                                 RSA with SHA256
>                                                 RSA with SHA224
>                                                 RSA with SHA1 SSL
> Supported Signature Algorithm List  . . . . : ECDSA with SHA512
>                                                   ECDSA with SHA384
>                                                   ECDSA with SHA256
>                                                   ECDSA with SHA224
>                                                   ECDSA with SHA1
>                                                   RSA with SHA512
>                                                   RSA with SHA384
>                                                   RSA with SHA256
>                                                   RSA with SHA224
>                                                   RSA with SHA1
>                                                   RSA with MD5 SSL
> Connection Counters  . . . . . . . : Disabled Netsecure Inspect
> Application Data . . : Allowed Netsecure Telnet Server  . . . . . . . :
> Disabled Netsecure UDP  . . . . . . . . . . . . : Enabled Maximum Number
> of Global OCSP Response Cache Entries . . : NOLIMIT
>                                                   ECDSA with SHA1
>                                                   RSA with SHA512
>                                                   RSA with SHA384
>                                                   RSA with SHA256
>                                                   RSA with SHA224
>                                                   RSA with SHA1
>                                                   RSA with MD5 SSL
> Connection Counters  . . . . . . . : Disabled Netsecure Inspect
> Application Data . . : Allowed Netsecure Telnet Server  . . . . . . . :
> Disabled Netsecure UDP  . . . . . . . . . . . . : Enabled Maximum Number
> of Global OCSP Response Cache Entries . . : NOLIMIT Object Flush Latency .
>
> . . . . . . . . : 500 ms PTF Level  . . . . . . . . . . . . . . : 1
>
> Thank You
> _____
> Paul Steinmetz
> IBM i Systems Administrator
>
> Pencor Services, Inc.
> 462 Delaware Ave
> Palmerton Pa 18071
>
> 610-826-9117 work
> 610-826-9188 fax
> 610-349-0913 cell
> 610-377-6012 home
>
> psteinmetz@xxxxxxxxxx<mailto:psteinmetz@xxxxxxxxxx>
> http://www.pencor.com/
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
> unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
> moment to review the archives at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: http://amzn.to/2dEadiD
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: http://amzn.to/2dEadiD
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: http://amzn.to/2dEadiD
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: http://amzn.to/2dEadiD
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: http://amzn.to/2dEadiD
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: http://amzn.to/2dEadiD