On 11.01.22 15:46, Bill Cole wrote:
On 2022-01-10 at 19:15:46 UTC-0500 (Mon, 10 Jan 2022 19:15:46 -0500) Alex <mysqlstud...@gmail.com> is rumored to have said: [...]Here are my current settings: # postconf -n -c /etc/postfix-117|grep -E 'tls|cipher' smtp_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1 smtp_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1 smtp_tls_security_level = mayThis means that you will use plaintext for sending to many sites, rather than falling back to the almost universally supported TLSv1.0 on sites that can't do 1.2 or 1.3. The vulnerabilities I am aware of that justify sticking to v1.2/3 in web, IMAP, and database servers are not viable against SMTP because of the brief, non-repetitive, and largely unpredictable nature of the TLS sessions used by SMTP.Would you explain what specifically about the above that's removed any ability for clients to build an encrypted connection and require cleartext? Is it the exclusion of the use of any TLS version above 1.2?Typo? s/above/below/By including '!TLSv1,!TLSv1.1' in the protocol list, you've eliminated the only TLS versions known to some older systems.
That really seems like a problem with these ancient systems. openssl added TLS 1.2 support 9 years ago, and 6 years ago the last version to not support TLS 1.2 (1.0.0) had its support ended.
RHEL 5, discontinued in 2020, was the last version of RHEL to ship with openssl 1.0.0.
In the Windows world, Windows Server 2008 has been supporting TLS 1.2 since 2017. Standard and Expanded support for it ended in 2015 and 2020 respectively.
We are talking about systems that should not be running in prod anymore, but still are due to inertia. Mails not being delivered may hopefully be the push that kickstarts upgrading efforts.
Maybe the part I'm not understanding is whether it's possible to somehow compromise the server if we offer older versions of TLS?No, at least not BECAUSE of offering older versions of TLS. There's nothing inherent to any SSL/TLS protocol version that could make a server itself vulnerable.
Regardless of whether or not there are exploitable security issues in the protocol itself, TLS support is a somewhat good indication of how up-to-date the client is. Clients not supporting TLS 1.2 have likely not been receiving security updates for over a year at this point (see above), making it more likely for them to be vulnerable to critical security vulnerabilities.
-- Charlotte https://keybase.io/darkkirb • GPG Key 3CEF5DDA915AECB0 • https://darkkirb.de
OpenPGP_0x3CEF5DDA915AECB0.asc
Description: OpenPGP public key
OpenPGP_signature
Description: OpenPGP digital signature
