From bba486f372ffa28d6a0b70a6b0ad7065429213d0 Mon Sep 17 00:00:00 2001 From: Magnus Hagander <magnus@hagander.net> Date: Thu, 17 Jan 2013 15:04:44 +0100 Subject: [PATCH] Base the default SSL ciphers on DEFAULT instead of ALL It's better to start from what the OpenSSL people consider a good default and then remove insecure things (low encryption, exportable encryption and md5 at this point) from that, instead of starting from everything that exists and remove from that. We trust the OpenSSL people to make good choices about what the default is. --- src/backend/utils/misc/guc.c | 2 +- src/backend/utils/misc/postgresql.conf.sample | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c index ac5e4f3e48d..6128694200f 100644 --- a/src/backend/utils/misc/guc.c +++ b/src/backend/utils/misc/guc.c @@ -3056,7 +3056,7 @@ static struct config_string ConfigureNamesString[] = }, &SSLCipherSuites, #ifdef USE_SSL - "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH", + "DEFAULT:!LOW:!EXP:!MD5:@STRENGTH", #else "none", #endif diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample index eeb9b82abf1..62aea2f583e 100644 --- a/src/backend/utils/misc/postgresql.conf.sample +++ b/src/backend/utils/misc/postgresql.conf.sample @@ -79,7 +79,7 @@ #authentication_timeout = 1min # 1s-600s #ssl = off # (change requires restart) -#ssl_ciphers = 'ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH' # allowed SSL ciphers +#ssl_ciphers = 'DEFAULT:!LOW:!EXP:!MD5:@STRENGTH' # allowed SSL ciphers # (change requires restart) #ssl_renegotiation_limit = 512MB # amount of data between renegotiations #ssl_cert_file = 'server.crt' # (change requires restart) -- GitLab