MESSAGE
DATE | 2022-01-10 |
FROM | Alex
|
SUBJECT | Re: [Hangout - NYLXS] TLS ciphers
|
From hangout-bounces-at-nylxs.com Mon Jan 10 11:31:32 2022 Return-Path: X-Original-To: archive-at-mrbrklyn.com Delivered-To: archive-at-mrbrklyn.com Received: from www2.mrbrklyn.com (www2.mrbrklyn.com [96.57.23.82]) by mrbrklyn.com (Postfix) with ESMTP id E45EB16401E; Mon, 10 Jan 2022 11:31:31 -0500 (EST) X-Original-To: hangout-at-www2.mrbrklyn.com Delivered-To: hangout-at-www2.mrbrklyn.com Received: by mrbrklyn.com (Postfix, from userid 1000) id 4B227164011; Mon, 10 Jan 2022 11:31:26 -0500 (EST) Resent-From: Ruben Safir Resent-Date: Mon, 10 Jan 2022 11:31:26 -0500 Resent-Message-ID: <20220110163126.GB24733-at-www2.mrbrklyn.com> Resent-To: hangout-at-mrbrklyn.com X-Original-To: ruben-at-mrbrklyn.com Delivered-To: ruben-at-mrbrklyn.com Received: from russian-caravan.cloud9.net (russian-caravan.cloud9.net [168.100.1.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail.cloud9.net", Issuer "Sectigo RSA Domain Validation Secure Server CA" (not verified)) by mrbrklyn.com (Postfix) with ESMTPS id A3F8B164005 for ; Mon, 10 Jan 2022 11:17:51 -0500 (EST) Received: by russian-caravan.cloud9.net (Postfix) id 8203C342846; Mon, 10 Jan 2022 11:17:31 -0500 (EST) Delivered-To: postfix-users-outgoing-at-cloud9.net Received: from localhost (localhost [127.0.0.1]) by russian-caravan.cloud9.net (Postfix) with ESMTP id 80C9D3426FE for ; Mon, 10 Jan 2022 11:17:31 -0500 (EST) X-Virus-Scanned: amavisd-new at cloud9.net Received: from russian-caravan.cloud9.net ([127.0.0.1]) by localhost (russian-caravan.cloud9.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o-iw7XqbcN3u for ; Mon, 10 Jan 2022 11:17:31 -0500 (EST) Received: by russian-caravan.cloud9.net (Postfix, from userid 54) id 6098234284B; Mon, 10 Jan 2022 11:17:31 -0500 (EST) Delivered-To: postfix-users-at-cloud9.net Received: from localhost (localhost [127.0.0.1]) by russian-caravan.cloud9.net (Postfix) with ESMTP id 43945342846 for ; Mon, 10 Jan 2022 11:17:31 -0500 (EST) X-Virus-Scanned: amavisd-new at cloud9.net Received: from russian-caravan.cloud9.net ([127.0.0.1]) by localhost (russian-caravan.cloud9.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kQpTqhGGGmbs for ; Mon, 10 Jan 2022 11:17:31 -0500 (EST) Received: from mail-pj1-x1032.google.com (mail-pj1-x1032.google.com [IPv6:2607:f8b0:4864:20::1032]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by russian-caravan.cloud9.net (Postfix) with ESMTPS id 1B7AE3426FE for ; Mon, 10 Jan 2022 11:17:30 -0500 (EST) Received: by mail-pj1-x1032.google.com with SMTP id l16-20020a17090a409000b001b2e9628c9cso513119pjg.4 for ; Mon, 10 Jan 2022 08:17:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=DVI7lx7P4Eed5oe2bj1b1P87TMvPMk+gVRFUbIFresA=; b=OJWQjy9ebzJz9rxYPaKvnlmikwZRVhEfo9bz5Fe3Y5tUvUdySwgnL5CK336lzQlsIU FBDOYdKapHuzM0EBRNLnI62UcproHMTdxDHi+0tG91edJK8n1B7M0S5PevOv/hMgOtT2 O2JIpbsDLVVINn7G075TRAVbv3hRJ9FOAfKzHHmZKcuB1kXPh63k/PxA1p8nObWYwBrS l3mXcddDFio4I1CWaq5DQakReGRa1CkZz4i2fsVzlVRum+jn4j87/AXHwFxEPmqvmqBj 5GGMcLyMJzFqjkSimLU4zSsh8yRHpT+xQCqOtF92izCNWkOaA0bQXfP/WnyvE5SpPKPC maUg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=DVI7lx7P4Eed5oe2bj1b1P87TMvPMk+gVRFUbIFresA=; b=C+e6zPQxp+XYTRKlqGehsOQ/VdfPGLhrmVAETA2EM5BSJ07/zx3xMAdlFGm9EgM5GJ eXAf7dAvLGUt5Oti/Nss4JN56RcAyPsv0Z/Lvi6F1BecqokTeTkI8aGfu27zTd1NSU5z Oupst7YYqWJ0t8a2ajhXLzGxO4WDaPPbHq2+lZxu47O9ajhOu+6lDbdG2kEEL2GShLYB E5WfNkPIUAcQz2L3YVQxlsrhNMQeGuupUixqU/5+JV2dDTYtEH2kJfNLpbG6aeI22Jp3 flTOMR0K9scbRt8ioWh0aZorU37QxEmViTpO7X+XZcjhTgEYO9hgcoI3lkMJZJ1N8sXp mt/A== X-Gm-Message-State: AOAM533Jkx9LVQUrt/SX3GXW9uaC/OKJYrIXoMzVXVeYUFuhHkmNbCJA jh97NhuFCeyg2jzRwPOGu5BuNd9uqTJY0E71U+D8AVo= X-Google-Smtp-Source: ABdhPJwOXZD2QvOdihzswOiO7zsRKdoHwKmAmPPuCBXmeyUTLNX+zEWthYpbDo8lVBzEJH+1zF1KSPvOETAig/5ExgQ= X-Received: by 2002:a17:902:c951:b0:149:ee13:8db8 with SMTP id i17-20020a170902c95100b00149ee138db8mr175288pla.79.1641831443584; Mon, 10 Jan 2022 08:17:23 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Alex Date: Mon, 10 Jan 2022 11:17:12 -0500 Message-ID: To: postfix users list Precedence: bulk Subject: Re: [Hangout - NYLXS] TLS ciphers X-BeenThere: hangout-at-nylxs.com X-Mailman-Version: 2.1.30rc1 List-Id: NYLXS Tech Talk and Politics List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: hangout-bounces-at-nylxs.com Sender: "Hangout"
Hi, here is some follow-up info I received that provides more details on what the vulnerability scan is reporting:
Testing cipher categories
NULL ciphers (no encryption) not offered (OK) Anonymous NULL Ciphers (no authentication) offered (NOT ok) Export ciphers (w/o ADH+NULL) not offered (OK) LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK) Triple DES Ciphers / IDEA not offered Obsoleted CBC ciphers (AES, ARIA etc.) offered Strong encryption (AEAD ciphers) with no FS offered (OK) Forward Secrecy strong encryption (AEAD ciphers) offered (OK)
Example NMAP Output of Anonymous Cipher Suites
Nmap scan report for 209.XX.XX.117 25/tcp open smtp | ssl-enum-ciphers: | TLSv1.2: | TLS_DH_anon_WITH_AES_256_GCM_SHA384 (dh 2048) - F | TLS_DH_anon_WITH_AES_256_CBC_SHA256 (dh 2048) - F | TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 (dh 2048) - F | TLS_ECDH_anon_WITH_AES_256_CBC_SHA (ecdh_x25519) - F | TLS_DH_anon_WITH_AES_256_CBC_SHA (dh 2048) - F | TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA (dh 2048) - F | TLS_DH_anon_WITH_AES_128_GCM_SHA256 (dh 2048) - F | TLS_DH_anon_WITH_AES_128_CBC_SHA256 (dh 2048) - F | TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 (dh 2048) - F | TLS_ECDH_anon_WITH_AES_128_CBC_SHA (ecdh_x25519) - F | TLS_DH_anon_WITH_AES_128_CBC_SHA (dh 2048) - F | TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA (dh 2048) - F
This is a LetsEncrypt cert - do I need to make changes there, or is this all done with postfix configs?
And what nmap command can be run to probe port 25 for its cipher suite?
Thanks, Alex
On Mon, Jan 10, 2022 at 11:08 AM Alex wrote: > > Hi, > > I have a postfix-3.5.10 system and having a little trouble configuring > it to ensure I'm not including any vulnerable ciphers. I had > previously posted about this issue in September, and thought I > followed the instructions I was given, but a recent security scan > (onsecurity) shows port 25 is still vulnerable to the SWEET32 attack. > > For reference to previously discussion: > https://www.mail-archive.com/postfix-users-at-postfix.org/msg92857.html > > This system is just a general smtp/submission/pop/imap box with no > mandatory crypto/certificate requirements. We also don't need to > maintain compatibility with legacy systems. > > Here are my current settings: > # postconf -n -c /etc/postfix-117|grep -E 'tls|cipher' > smtp_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1 > smtp_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1 > smtp_tls_security_level = may > smtpd_tls_auth_only = yes > smtpd_tls_cert_file = /etc/letsencrypt/cert.pem > smtpd_tls_exclude_ciphers = MD5, RC4, 3DES, IDEA, SEED > smtpd_tls_key_file = /etc/letsencrypt/privkey.pem > smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1 > smtpd_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1 > smtpd_tls_received_header = yes > smtpd_tls_security_level = may > smtpd_tls_session_cache_database = > btree:${data_directory}/smtpd_tls_session_cache > tls_preempt_cipherlist = yes > tls_random_source = dev:/dev/urandom > tls_ssl_options = NO_COMPRESSION, NO_RENEGOTIATION > > What am I missing? Is this redhat.com article accurate? > https://access.redhat.com/articles/1468593 > > I believe I was told that trying to explicitly define the cipher list > was a bad idea. > > Thanks, > Alex _______________________________________________ Hangout mailing list Hangout-at-nylxs.com http://lists.mrbrklyn.com/mailman/listinfo/hangout
|
|