NethServer Documentation

10.1 Policy 2020-05-10
This policy disables the TLS protocol versions 1.0 and 1.1. It applies to the following services:
• Apache (httpd, httpd-admin)
• Ejabberd
• Cockpit
• Slapd (openldap-servers)
• Postfix
• Dovecot
Reference:
https://access.redhat.com/articles/1462183
10.2 Policy 2018-10-01
This policy restricts the TLS settings of the default Ejabberd configuration. It applies only to Ejabberd version 18 and
greater.
47

---

NethServer Documentation, Release 7 Final
Ejabberd (XMPP)
• See
https://bettercrypto.org/static/applied-crypto-hardening.pdf
category B
• Disabled SSLv3 and TLSv1.0
• Cipher server priority
• ECC certificate
• Ciphers suite
ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-
˓→
AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-
˓→
SHA256:EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!
˓→
aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:CAMELLIA256-
˓→
SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA