From 632f8d7a2344db4910d5f009a495b7f17bb08356 Mon Sep 17 00:00:00 2001 From: Gavin Henry Date: Thu, 6 Jan 2011 18:11:46 +0000 Subject: [PATCH] ITS#6525 gnutls cipher spec is unclear --- doc/man/man5/ldap.conf.5 | 26 ++++++++++++++++++++++---- doc/man/man5/slapd.conf.5 | 28 ++++++++++++++++++++++------ 2 files changed, 44 insertions(+), 10 deletions(-) diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 index 6a8c949a1c..43c355f058 100644 --- a/doc/man/man5/ldap.conf.5 +++ b/doc/man/man5/ldap.conf.5 @@ -334,19 +334,37 @@ it is of critical importance that the key file is protected carefully. .B TLS_CIPHER_SUITE Specifies acceptable cipher suite and preference order. should be a cipher specification for OpenSSL, -e.g., HIGH:MEDIUM:+SSLv2. + should be a cipher specification for OpenSSL resp. GNUtls. +Example: +.RS +.RS +.TP +.I OpenSSL: +TLS_CIPHER_SUITE HIGH:MEDIUM:+SSLv2 +.TP +.I GNUtls: +TLS_CIPHER_SUITE SECURE256:!AES-128-CBC +.RE -To check what ciphers a given spec selects, use: +To check what ciphers a given spec selects in OpenSSL, use: .nf openssl ciphers \-v .fi -To obtain the list of ciphers in GNUtls use: +With GNUtls the available specs can be found in the manual page of +.BR gnutls\-cli (1) +(see the description of the +option +.BR \-\-priority ). + +In older versions of GNUtls, where gnutls\-cli does not support the option +\-\-priority, you can obtain the \(em more limited \(em list of ciphers by calling: .nf - gnutls-cli \-l + gnutls\-cli \-l .fi +.RE .TP .B TLS_RANDFILE Specifies the file to obtain random bits from when /dev/[u]random is diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 index 3a89cd67df..6fb04efcc4 100644 --- a/doc/man/man5/slapd.conf.5 +++ b/doc/man/man5/slapd.conf.5 @@ -1029,22 +1029,37 @@ you can specify. .TP .B TLSCipherSuite Permits configuring what ciphers will be accepted and the preference order. - should be a cipher specification for OpenSSL. Example: - + should be a cipher specification for OpenSSL resp. GNUtls. +Example: +.RS +.RS +.TP +.I OpenSSL: TLSCipherSuite HIGH:MEDIUM:+SSLv2 +.TP +.I GNUtls: +TLSCiphersuite SECURE256:!AES-128-CBC +.RE -To check what ciphers a given spec selects, use: +To check what ciphers a given spec selects in OpenSSL, use: .nf openssl ciphers \-v .fi -To obtain the list of ciphers in GNUtls use: +With GNUtls the available specs can be found in the manual page of +.BR gnutls\-cli (1) +(see the description of the +option +.BR \-\-priority ). + +In older versions of GNUtls, where gnutls\-cli does not support the option +\-\-priority, you can obtain the \(em more limited \(em list of ciphers by calling: .nf - gnutls-cli \-l + gnutls\-cli \-l .fi - +.RE .TP .B TLSCACertificateFile Specifies the file that contains certificates for all of the Certificate @@ -1943,6 +1958,7 @@ ETCDIR/slapd.conf default slapd configuration file .SH SEE ALSO .BR ldap (3), +.BR gnutls\-cli (1), .BR slapd\-config (5), .BR slapd.access (5), .BR slapd.backends (5), -- 2.39.5