Using internet.nl to test my MIAB setup, I received this message:
“At least one of your mail servers supports one or more TLS versions that should be phased out deliberately, because they are known to be fragile and at risk of becoming insufficiently secure”
Since I only have a handful of users and I know the clients, where can I go to turn off TLS 1.1 and 1.0?
Thanks
Each service (HTTP, SMTP on port 25, SMTP on ports 465/587, IMAP) has its own set of configuration parameters, and I wouldn’t recommend modifying them on your own unless you’re researching how to make Mail-in-a-Box better.
If you did the mail check, it’s probably checking only SMTP on port 25, where we’re generally pretty permissive to ensure the best compatibility with anyone trying to send you mail. But we follow best practices which change from year to year, and perhaps it’s time to disable TLSv1.0/1.1 for incoming mail.
To clarify, what I meant to say, was that the tool isn’t checking the ports that your end-user clients are connecting on.
Ok, I wasn’t sure if it was a client or server side check, hence my somewhat vague question. If it’s a server side check, wouldn’t they typically be ahead of end users and therefore have higher security settings? I would think so. Yeah, probably time to update settings.
Mail server encryption has always lagged because you end up with not receiving mail or sending mail to a disappointing number of servers, although this has been less and less so over the past ten years. There is actually a lot of mail that really doesn’t need encryption (e.g., mailing lists, newsletters, etc.)
I might be missing something, but Postfix in MiaB is currently configured to optionally use TLS and I thought that the !TLSv1.1 meant that one wouldn’t be used? You might be interested to check the output of postconf -n and evaluate the settings on Postfix Configuration Parameters.
$ postconf -n | grep tls
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_tls_ciphers = medium
smtp_tls_exclude_ciphers = aNULL,RC4
smtp_tls_loglevel = 2
smtp_tls_mandatory_ciphers = high
smtp_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtp_tls_protocols = !SSLv2,!SSLv3
smtp_tls_security_level = dane
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /home/user-data/ssl/ssl_certificate.pem
smtpd_tls_ciphers = medium
smtpd_tls_dh1024_param_file = /home/user-data/ssl/dh2048.pem
smtpd_tls_exclude_ciphers = aNULL,RC4
smtpd_tls_key_file = /home/user-data/ssl/ssl_private_key.pem
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers = aNULL,DES,3DES,MD5,DES+MD5,RC4
smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtpd_tls_protocols = !SSLv2,!SSLv3
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
tls_high_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
tls_preempt_cipherlist = no
I just ran a test there and also interesting is they report 2048-bit DH parameter as insufficient even though Qualys is just fine with it.
Yes, I saw that too. And yes, I looked at the postfix and dovecot config files.
I get there are instances where encryption is not needed. However, I’m not sending newsletters and the like. As MIAB was designed for, I am using as my personal email only.
If TLS v1 and v1.1 are insecure, why implement? If someone wants to hack they will. Perhaps to deter the casual hacker? Ok, maybe. But if there’s a more secure solution, that’s been in use for some time, why not use that?
This may not be the project for you.
Disabling receiving newsletters and mailing lists would likely upset a lot of users, and MiaB has more users than just you.
This topic was automatically closed 40 days after the last reply. New replies are no longer allowed.