From da63b146d91e351120f6de66bcebe91e6389f2f8 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Fri, 19 Aug 2016 15:33:51 -0300
Subject: Dovecot: drops SSLv2 and SSLv3 via ssl_protocols

---
 templates/dovecot/dovecot.conf.wheezy.erb | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/templates/dovecot/dovecot.conf.wheezy.erb b/templates/dovecot/dovecot.conf.wheezy.erb
index cf2d720..0d18b85 100644
--- a/templates/dovecot/dovecot.conf.wheezy.erb
+++ b/templates/dovecot/dovecot.conf.wheezy.erb
@@ -40,7 +40,10 @@ ssl_key = </etc/ssl/private/cert.pem
 
 # SSL ciphers to use
 # See http://www.virtualmin.com/node/25057
+#     https://zmap.io/sslv3/servers.html
+#     https://security.stackexchange.com/questions/71872/disable-sslv3-in-dovecot-tls-handshaking-failed-no-shared-cipher
 ssl_cipher_list = HIGH:MEDIUM:+TLSv1:!SSLv2:SSLv3
+ssl_protocols = !SSlv2 !SSLv3
 
 userdb {
   args = uid=5000 gid=5000 home=/var/mail/virtual/%u allow_all_users=yes
-- 
cgit v1.2.3