Dear List,
I'm trying to rule out a config error on my setup since postfix is a beast and I'm no beastmaster :) When I enabled "reject_plaintext_session" for smtpd_sender/relay/client_restrictions, I got the following log output from some big national mailprovider. Does that mean, that the other server is trying to deliver mail via TLS1.0 or TLS1.1 ? The mailprovider claims to have disabled those. ---------------------------------------------------------------------------------- Jun 7 08:57:01 cerberos postfix/smtpd[1859]: connect from unknown[xx.xx.xx.xx] Jun 7 08:57:01 cerberos postfix/smtpd[1859]: warning: TLS library problem: error:0A00042F:SSL routines::tlsv1 alert insufficient security:../openssl-3.0.13/ssl/record/rec_laye r_s3.c:1590:SSL alert number 71: Jun 7 08:57:01 cerberos postfix/smtpd[1859]: lost connection after STARTTLS from unknown[xx.xx.xx.xx] Jun 7 08:57:01 cerberos postfix/smtpd[1859]: disconnect from unknown[xx.xx.xx.xx] ehlo=1 starttls=1 commands=2 Jun 7 08:57:02 cerberos postfix/smtpd[1859]: connect from unknown[xx.xx.xx.xx] Jun 7 08:57:02 cerberos postfix/smtpd[1859]: NOQUEUE: reject: RCPT from unknown[xx.xx.xx.xx]: 450 4.7.1 Session encryption is required; from=<sen...@example.com> to=<recei...@myhost.com> proto=ESMTP helo=<mailserver.example.com> ---------------------------------------------------------------------------------- My cipher config is: smtpd_tls_mandatory_ciphers = medium smtpd_tls_mandatory_exclude_ciphers = aNULL, eNULL, LOW, 3DES, MD5, EXP, PSK, SRP, DSS, DES, RC4, PSK smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1 tls_medium_cipherlist = aNULL:-aNULL:HIGH:MEDIUM:!SEED:!IDEA:!3DES:!RC2:!RC4:!RC5:!kDH:!kECDH:!aDSS:!MD5:+RC4:@STRENGTH tls_preempt_cipherlist = yes tls_session_ticket_cipher = aes-256-cbc (same for lmtp_*, smtp_* and tolsproxy_*) My sslscan looks like this: ---------------------------------------------------------------------------------- Version: 2.1.2-static OpenSSL 3.0.12 24 Oct 2023 Testing SSL server mail.myhost.com on port 25 using SNI name mail.myhost.com SSL/TLS Protocols: SSLv2 disabled SSLv3 disabled TLSv1.0 disabled TLSv1.1 disabled TLSv1.2 enabled TLSv1.3 enabled TLS Fallback SCSV: Server supports TLS Fallback SCSV TLS renegotiation: Session renegotiation not supported TLS Compression: Compression disabled Heartbleed: TLSv1.3 not vulnerable to heartbleed TLSv1.2 not vulnerable to heartbleed Supported Server Cipher(s): Preferred TLSv1.3 256 bits TLS_AES_256_GCM_SHA384 Curve 25519 DHE 253 Accepted TLSv1.3 256 bits TLS_CHACHA20_POLY1305_SHA256 Curve 25519 DHE 253 Accepted TLSv1.3 128 bits TLS_AES_128_GCM_SHA256 Curve 25519 DHE 253 Preferred TLSv1.2 256 bits ADH-AES256-GCM-SHA384 DHE 4096 bits Accepted TLSv1.2 256 bits ADH-AES256-SHA256 DHE 4096 bits Accepted TLSv1.2 256 bits ADH-CAMELLIA256-SHA256 DHE 4096 bits Accepted TLSv1.2 256 bits AECDH-AES256-SHA Curve 25519 DHE 253 Accepted TLSv1.2 256 bits ADH-AES256-SHA DHE 4096 bits Accepted TLSv1.2 256 bits ADH-CAMELLIA256-SHA DHE 4096 bits Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve 25519 DHE 253 Accepted TLSv1.2 256 bits DHE-RSA-AES256-GCM-SHA384 DHE 4096 bits Accepted TLSv1.2 256 bits ECDHE-RSA-CHACHA20-POLY1305 Curve 25519 DHE 253 Accepted TLSv1.2 256 bits DHE-RSA-CHACHA20-POLY1305 DHE 4096 bits Accepted TLSv1.2 256 bits DHE-RSA-AES256-CCM8 DHE 4096 bits Accepted TLSv1.2 256 bits DHE-RSA-AES256-CCM DHE 4096 bits Accepted TLSv1.2 256 bits ECDHE-ARIA256-GCM-SHA384 Curve 25519 DHE 253 Accepted TLSv1.2 256 bits DHE-RSA-ARIA256-GCM-SHA384 DHE 4096 bits Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA384 Curve 25519 DHE 253 Accepted TLSv1.2 256 bits DHE-RSA-AES256-SHA256 DHE 4096 bits Accepted TLSv1.2 256 bits ECDHE-RSA-CAMELLIA256-SHA384 Curve 25519 DHE 253 Accepted TLSv1.2 256 bits DHE-RSA-CAMELLIA256-SHA256 DHE 4096 bits Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA Curve 25519 DHE 253 Accepted TLSv1.2 256 bits DHE-RSA-AES256-SHA DHE 4096 bits Accepted TLSv1.2 256 bits DHE-RSA-CAMELLIA256-SHA DHE 4096 bits Accepted TLSv1.2 256 bits AES256-GCM-SHA384 Accepted TLSv1.2 256 bits AES256-CCM8 Accepted TLSv1.2 256 bits AES256-CCM Accepted TLSv1.2 256 bits ARIA256-GCM-SHA384 Accepted TLSv1.2 256 bits AES256-SHA256 Accepted TLSv1.2 256 bits CAMELLIA256-SHA256 Accepted TLSv1.2 256 bits AES256-SHA Accepted TLSv1.2 256 bits CAMELLIA256-SHA Accepted TLSv1.2 128 bits ADH-AES128-GCM-SHA256 DHE 4096 bits Accepted TLSv1.2 128 bits ADH-AES128-SHA256 DHE 4096 bits Accepted TLSv1.2 128 bits ADH-CAMELLIA128-SHA256 DHE 4096 bits Accepted TLSv1.2 128 bits AECDH-AES128-SHA Curve 25519 DHE 253 Accepted TLSv1.2 128 bits ADH-AES128-SHA DHE 4096 bits Accepted TLSv1.2 128 bits ADH-CAMELLIA128-SHA DHE 4096 bits Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve 25519 DHE 253 Accepted TLSv1.2 128 bits DHE-RSA-AES128-GCM-SHA256 DHE 4096 bits Accepted TLSv1.2 128 bits DHE-RSA-AES128-CCM8 DHE 4096 bits Accepted TLSv1.2 128 bits DHE-RSA-AES128-CCM DHE 4096 bits Accepted TLSv1.2 128 bits ECDHE-ARIA128-GCM-SHA256 Curve 25519 DHE 253 Accepted TLSv1.2 128 bits DHE-RSA-ARIA128-GCM-SHA256 DHE 4096 bits Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA256 Curve 25519 DHE 253 Accepted TLSv1.2 128 bits DHE-RSA-AES128-SHA256 DHE 4096 bits Accepted TLSv1.2 128 bits ECDHE-RSA-CAMELLIA128-SHA256 Curve 25519 DHE 253 Accepted TLSv1.2 128 bits DHE-RSA-CAMELLIA128-SHA256 DHE 4096 bits Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve 25519 DHE 253 Accepted TLSv1.2 128 bits DHE-RSA-AES128-SHA DHE 4096 bits Accepted TLSv1.2 128 bits DHE-RSA-CAMELLIA128-SHA DHE 4096 bits Accepted TLSv1.2 128 bits AES128-GCM-SHA256 Accepted TLSv1.2 128 bits AES128-CCM8 Accepted TLSv1.2 128 bits AES128-CCM Accepted TLSv1.2 128 bits ARIA128-GCM-SHA256 Accepted TLSv1.2 128 bits AES128-SHA256 Accepted TLSv1.2 128 bits CAMELLIA128-SHA256 Accepted TLSv1.2 128 bits AES128-SHA Accepted TLSv1.2 128 bits CAMELLIA128-SHA Server Key Exchange Group(s): TLSv1.3 128 bits secp256r1 (NIST P-256) TLSv1.3 192 bits secp384r1 (NIST P-384) TLSv1.3 260 bits secp521r1 (NIST P-521) TLSv1.3 128 bits x25519 TLSv1.3 224 bits x448 TLSv1.3 112 bits ffdhe2048 TLSv1.3 128 bits ffdhe3072 TLSv1.2 128 bits secp256r1 (NIST P-256) TLSv1.2 192 bits secp384r1 (NIST P-384) TLSv1.2 260 bits secp521r1 (NIST P-521) TLSv1.2 128 bits x25519 TLSv1.2 224 bits x448 SSL Certificate: Signature Algorithm: sha256WithRSAEncryption RSA Key Strength: 2048 ---------------------------------------------------------------------------------- Any hint is highly appreciated. Best regards -- Daniel Hiepler _______________________________________________ Postfix-users mailing list -- postfix-users@postfix.org To unsubscribe send an email to postfix-users-le...@postfix.org
