Re: nmap says there's vulnerability with Diffie-Hellman settings

2023-01-08 Thread Juri Haberland
On 08/01/2023 15:56, Benny Pedersen wrote: > Received: by kent.sdaoden.eu (Postfix, from userid 1000) > id 25D02B4B1E; Sat, 7 Jan 2023 19:35:21 +0100 (CET) > Date: Sat, 07 Jan 2023 19:35:21 +0100 > Author: Steffen Nurpmeso > From: Steffen Nurpmeso > > you are not using postfix imho when

Re: nmap says there's vulnerability with Diffie-Hellman settings

2023-01-08 Thread Wietse Venema
Viktor Dukhovni: > On Sun, Jan 08, 2023 at 09:23:52PM +0100, Benny Pedersen wrote: > > > > I want again to state that header which says "Received: by > > > (Postfix, from userid )" is perfectly normal and > > > expected Postfix behavior when mail is submitted locally. I have > > > seen it countle

Re: nmap says there's vulnerability with Diffie-Hellman settings

2023-01-08 Thread Viktor Dukhovni
On Sun, Jan 08, 2023 at 09:23:52PM +0100, Benny Pedersen wrote: > > I want again to state that header which says "Received: by > > (Postfix, from userid )" is perfectly normal and > > expected Postfix behavior when mail is submitted locally. I have > > seen it countless number of times. > > mayb

Re: nmap says there's vulnerability with Diffie-Hellman settings

2023-01-08 Thread Benny Pedersen
Jaroslaw Rafa skrev den 2023-01-08 21:00: Dnia 8.01.2023 o godz. 16:20:30 Benny Pedersen pisze: okay i do "sendmail -f m...@junc.eu -bv m...@junc.eu" it shows as result in probe attatchment Received: by mx.junc.eu (Postfix, from userid 0) id 9743182BDB; Sun, 8 Jan 2023 16:06:26 +0100 (C

Re: nmap says there's vulnerability with Diffie-Hellman settings

2023-01-08 Thread Jaroslaw Rafa
Dnia 8.01.2023 o godz. 16:20:30 Benny Pedersen pisze: > > okay i do "sendmail -f m...@junc.eu -bv m...@junc.eu" > > it shows as result in probe attatchment > > Received: by mx.junc.eu (Postfix, from userid 0) > id 9743182BDB; Sun, 8 Jan 2023 16:06:26 +0100 (CET) > > in whole email from th

Re: nmap says there's vulnerability with Diffie-Hellman settings

2023-01-08 Thread Viktor Dukhovni
On Sun, Jan 08, 2023 at 04:33:08AM -0600, Matthew McGehrin wrote: > The majority of the CBC_SHA ciphers are considered weak and should be > replaced with stronger ciphers. Are considered weak for use in browsers when either the server or client does not support the "Encrypt then MAC" (EtM) TLS e

Re: nmap says there's vulnerability with Diffie-Hellman settings

2023-01-08 Thread Viktor Dukhovni
On Sun, Jan 08, 2023 at 09:51:40AM +0400, Sam wrote: > Hi Eero. I'm using the default settings in postfix. In fact, you can > look in my settings you'll find `smtpd_tls_eecdh_grade = ultra`. That's > the only DH related thing AFAIK. Unless your Postfix version is very old, that setting is unwise

Re: nmap says there's vulnerability with Diffie-Hellman settings

2023-01-08 Thread Benny Pedersen
Jaroslaw Rafa skrev den 2023-01-08 16:01: Dnia 8.01.2023 o godz. 15:56:17 Benny Pedersen pisze: Received: by kent.sdaoden.eu (Postfix, from userid 1000) id 25D02B4B1E; Sat, 7 Jan 2023 19:35:21 +0100 (CET) Date: Sat, 07 Jan 2023 19:35:21 +0100 Author: Steffen Nurpmeso From: Steffen Nu

Re: nmap says there's vulnerability with Diffie-Hellman settings

2023-01-08 Thread Jaroslaw Rafa
Dnia 8.01.2023 o godz. 15:56:17 Benny Pedersen pisze: > > Received: by kent.sdaoden.eu (Postfix, from userid 1000) > id 25D02B4B1E; Sat, 7 Jan 2023 19:35:21 +0100 (CET) > Date: Sat, 07 Jan 2023 19:35:21 +0100 > Author: Steffen Nurpmeso > From: Steffen Nurpmeso > > you are not using post

Re: nmap says there's vulnerability with Diffie-Hellman settings

2023-01-08 Thread Benny Pedersen
Steffen Nurpmeso skrev den 2023-01-07 19:35: Matus UHLAR - fantomas wrote in : ... |one |can disable aDH by adding it to smtp_tls_mandatory_exclude_ciphers. Just last week with the new lighttpd update i followed his maintainer by doing (the EDH+AESGCM is _my_ addition, blame _me_ for that, i

Re: nmap says there's vulnerability with Diffie-Hellman settings

2023-01-08 Thread Matthew McGehrin
The majority of the CBC_SHA ciphers are considered weak and should be replaced with stronger ciphers. See also: https://www.tenable.com/plugins/nessus/159543 Recommended ciphers would be: TLSv1.3: - 0x13,0x01 TLS_AES_128_GCM_SHA256 - 0x13,0x02 TLS_AES_256_GCM_SHA384 - 0x13,0x03 TLS_CHACHA20_P