Syslog-ng 3.5.6 is the latest version currently offered by Debian stable (jessie).

I'm not sure how to blacklist ciphers with this version.

Newer versions of Syslog-ng seem to offer a more sophisticated cipher-suite() and ssl-options() directive.

I'm not sure how to interpret what is written in the Syslog-ng 3.5 Documentation: cipher-suite()

Ideally I'd like to disable TLSv1.0 and also RC4 ciphers for syslog-ng 3.5


Use the openssl ciphers -v command to see which ciphers your system supports, select one that that supports TLSv1.2, and set it in the cipher-suite() option.

Or you can upgrade to a newer syslog-ng version, you can download up-to-date syslog-ng binaries for Debian.

  • Thank you. It worked using the strings from openssl ciphers -v. Is it possible to supply a list of ciphers? (commonly they are delimited by colons but that doesn't work) Supplying only one cipher suite might lead to issues were ssl handshake fail because of no matching ciphers could be negotiated. – PhilippN Oct 21 '16 at 14:18
  • Hi, the list of available ciphers depends on the version of the OpenSSL library used to compile syslog-ng with. So unfortunately we can't include a fix list in the documentation. – Robert Fekete Oct 24 '16 at 6:55
  • Thats not what I was asking. I currently use cipher-suite(AES128-SHA256) in my config. Which works but the service now only offers one Cipher-Suite. I don't know how to specify more than one suite in the directive. cipher-suite(AES128-SHA256:AES256-SHA256) does not work. Is it possible at all and if so what is the delimiter? – PhilippN Oct 24 '16 at 10:14
  • 1
    Oh, I see. Try cipher-suite("AES128-SHA256:AES256-SHA256"). – Robert Fekete Oct 25 '16 at 10:20
  • Yes that worked perfectly. I don't know why I didn't try quoting it myself. You were a very big help. Thank you very much. – PhilippN Oct 27 '16 at 11:30

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.