Re: [exim] Closing off Port to non-SSL traffic

2022-06-26 Thread Andrew C Aitchison via Exim-users
On Sat, 25 Jun 2022, Mark Elkins via Exim-users wrote: Not sure if I'm missing the boat or what but - for one of my users to send email - they must use mail Submission port 587 - and nothing else. That's on a server that only listens on port 587. This works fine until a user "shares" their pas

Re: [exim] Closing off Port to non-SSL traffic

2022-06-26 Thread Slavko via Exim-users
Ahoj, Dňa Sun, 26 Jun 2022 00:00:40 +0200 Kirill Miazine via Exim-users napísal: > According to docs, AuthBL is both: > "AuthBL is basically that: a collection of bots known to use stolen > credentials or authentication bruteforce." Yes, my mistake. I didn't check its docs, only my notes and me

Re: [exim] Closing off Port to non-SSL traffic

2022-06-26 Thread Jeremy Harris via Exim-users
On 26/06/2022 08:19, Andrew C Aitchison via Exim-users wrote: [ I should document CVE-2021-38371:  before exim 4.95 exim probably was exposed to a man-in-the  middle attack on STARTTLS when *sending* email, though it  it is not clear how it could have been exploited. Indeed, nobody that I am

Re: [exim] Closing off Port to non-SSL traffic

2022-06-26 Thread Mark Elkins via Exim-users
Seems I need to do more learning On 6/26/22 9:19 AM, Andrew C Aitchison via Exim-users wrote: On Sat, 25 Jun 2022, Mark Elkins via Exim-users wrote: Not sure if I'm missing the boat or what but - for one of my users to send email - they must use mail Submission port 587 - and nothing else

Re: [exim] Closing off Port to non-SSL traffic

2022-06-26 Thread Mark Elkins via Exim-users
I'm very interested in what you are doing. My thinking along country blocking for the submission of email addresses is... Subscribers have their data in a database. They have a properly secured web access system to that database for account management purposes (change their password - etc).

Re: [exim] Closing off Port to non-SSL traffic

2022-06-26 Thread Viktor Dukhovni via Exim-users
On Sun, Jun 26, 2022 at 03:52:56PM +0200, Mark Elkins via Exim-users wrote: > > I am curious. Why do you not allow your users to user port 465 ? > > RFC 8314 https://datatracker.ietf.org/doc/html/rfc8314#section-7.3 > > repurposed this as a mail *submission* port with Implicit TLS. > > Reading RF

Re: [exim] Closing off Port to non-SSL traffic

2022-06-26 Thread Slavko via Exim-users
Ahoj, Dňa Sun, 26 Jun 2022 15:52:56 +0200 Mark Elkins via Exim-users napísal: > urd        465/tcp        smtps ssmtp    # URL Rendesvous Directory > for SSM / smtp protocol over TLS/SSL > igmpv3lite    465/udp        smtps ssmtp    # IGMP over UDP for SSM > > submission    587/tcp             

Re: [exim] Closing off Port to non-SSL traffic

2022-06-26 Thread Viktor Dukhovni via Exim-users
On Sun, Jun 26, 2022 at 04:30:14PM +0200, Slavko via Exim-users wrote: > > it seems > > there is confusion over the use of this port. I've always assumed > > that some MTA clients may use port 465 - rather than using port 25. > > Not MAY, they SHOULD (if they support it), the 587 is as fallback

Re: [exim] Closing off Port to non-SSL traffic

2022-06-26 Thread Andrew C Aitchison via Exim-users
On Sun, 26 Jun 2022, Mark Elkins via Exim-users wrote: Seems I need to do more learning On 6/26/22 9:19 AM, Andrew C Aitchison via Exim-users wrote: On Sat, 25 Jun 2022, Mark Elkins via Exim-users wrote: Not sure if I'm missing the boat or what but - for one of my users to send email - t

Re: [exim] Closing off Port to non-SSL traffic

2022-06-26 Thread Slavko via Exim-users
Ahoj, Dňa Sun, 26 Jun 2022 10:41:47 -0400 Viktor Dukhovni via Exim-users napísal: > On Sun, Jun 26, 2022 at 04:30:14PM +0200, Slavko via Exim-users wrote: > > > Not MAY, they SHOULD (if they support it), the 587 is as fallback > > for old clients only, the 25/tcp is deprecated for MUAs for > >

Re: [exim] Closing off Port to non-SSL traffic

2022-06-26 Thread Cyborg via Exim-users
Am 24.06.22 um 08:08 schrieb Slavko via Exim-users: That is pretty simple, just add this IP to firewall's DROP. To automatize its banning, use fail2ban. But be aware, that they will often try from other IP soon. I have 100 - 800 different IPs per day, most of them has only one attempt allowed her

Re: [exim] Closing off Port to non-SSL traffic

2022-06-26 Thread Cyborg via Exim-users
Am 24.06.22 um 22:45 schrieb Sebastian Nielsen via Exim-users: Best way here is to add your users primary country to the auth_advertise_hosts list. Could be quite a IP list, but you can store it in a file if you want, by using a lookup condition. Then if they travel to a non-approved country, t

[exim] new release 4.96 and pcre2

2022-06-26 Thread Jim Pazarena via Exim-users
I loaded 4.96 on a FBSD box , I learned that it insisted on pcre2 . So far so good , I got that corrected in my Local / Makefile . It seemed to be working fine in a test environment , that is , until I noticed that my main server , running 4.94.2 cannot speak to it . 4.94.2 logs: Operation time