Disable SSLv2

[baptiste]

Hi,
Is it possible to disable SSLv2 for encrypted ftps connections ?

Regards

[FTP]

It is impossible, has no such option.

[baptiste]

SSLv2 protocol is known to have security flaws, it will be nice to have the possibility to set protocols or cyphers that we want to use (or disable) for encrypted connections.

[FTP]

We know it, so we decide to allow SSLv3 only in the next version. SSLv2 like chicken ribs, very few client will use it.

[baptiste]

Ok,
I have asked this question because we must pass security audit and it's mandatory to avoid SSLv2 on all services on our network to be compliant.

Do you know when the next version of wftpd will be out and this version will be 'compatible' licence bought for current version ?

[FTP]

Finally we decide to add an option "disable SSLv2", then you can make a choice whether to disable it.

And new version 3.6.0 will be released in next week.

[baptiste]

OK,
Thanks a lot for your reactivity.