diff options
| author | Peter Eisentraut <peter_e@gmx.net> | 2014-02-24 20:30:28 -0500 |
|---|---|---|
| committer | Peter Eisentraut <peter_e@gmx.net> | 2014-02-24 20:30:28 -0500 |
| commit | 32001ab0b7b4ee143e195f100543f531757a555b (patch) | |
| tree | 83865c1d82092e9b302600504466e45b9241ee16 /src | |
| parent | 848ae330a497b4d430d93bd813f93c40d2bb0157 (diff) | |
| download | postgresql-32001ab0b7b4ee143e195f100543f531757a555b.tar.gz postgresql-32001ab0b7b4ee143e195f100543f531757a555b.zip | |
Update and clarify ssl_ciphers default
- Write HIGH:MEDIUM instead of DEFAULT:!LOW:!EXP for clarity.
- Order 3DES last to work around inappropriate OpenSSL default.
- Remove !MD5 and @STRENGTH, because they are irrelevant.
- Add clarifying documentation.
Effectively, the new default is almost the same as the old one, but it
is arguably easier to understand and modify.
Author: Marko Kreen <markokr@gmail.com>
Diffstat (limited to 'src')
| -rw-r--r-- | src/backend/utils/misc/guc.c | 2 | ||||
| -rw-r--r-- | src/backend/utils/misc/postgresql.conf.sample | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c index aa5a8757fa3..b27cb89a289 100644 --- a/src/backend/utils/misc/guc.c +++ b/src/backend/utils/misc/guc.c @@ -3237,7 +3237,7 @@ static struct config_string ConfigureNamesString[] = }, &SSLCipherSuites, #ifdef USE_SSL - "DEFAULT:!LOW:!EXP:!MD5:@STRENGTH", + "HIGH:MEDIUM:+3DES:!aNULL", #else "none", #endif diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample index 07341e72a43..ce56059ceb2 100644 --- a/src/backend/utils/misc/postgresql.conf.sample +++ b/src/backend/utils/misc/postgresql.conf.sample @@ -79,7 +79,7 @@ #authentication_timeout = 1min # 1s-600s #ssl = off # (change requires restart) -#ssl_ciphers = 'DEFAULT:!LOW:!EXP:!MD5:@STRENGTH' # allowed SSL ciphers +#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers # (change requires restart) #ssl_prefer_server_ciphers = on # (change requires restart) #ssl_ecdh_curve = 'prime256v1' # (change requires restart) |