MESSAGE
| DATE | 2022-01-10 |
| FROM | Alex
|
| SUBJECT | Re: [Hangout - NYLXS] TLS ciphers
|
Hi, here is some follow-up info I received that provides more details
on what the vulnerability scan is reporting:
Testing cipher categories
NULL ciphers (no encryption) not offered (OK)
Anonymous NULL Ciphers (no authentication) offered (NOT ok)
Export ciphers (w/o ADH+NULL) not offered (OK)
LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK)
Triple DES Ciphers / IDEA not offered
Obsoleted CBC ciphers (AES, ARIA etc.) offered
Strong encryption (AEAD ciphers) with no FS offered (OK)
Forward Secrecy strong encryption (AEAD ciphers) offered (OK)
Example NMAP Output of Anonymous Cipher Suites
Nmap scan report for 209.XX.XX.117
25/tcp open smtp
| ssl-enum-ciphers:
| TLSv1.2:
| TLS_DH_anon_WITH_AES_256_GCM_SHA384 (dh 2048) - F
| TLS_DH_anon_WITH_AES_256_CBC_SHA256 (dh 2048) - F
| TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 (dh 2048) - F
| TLS_ECDH_anon_WITH_AES_256_CBC_SHA (ecdh_x25519) - F
| TLS_DH_anon_WITH_AES_256_CBC_SHA (dh 2048) - F
| TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA (dh 2048) - F
| TLS_DH_anon_WITH_AES_128_GCM_SHA256 (dh 2048) - F
| TLS_DH_anon_WITH_AES_128_CBC_SHA256 (dh 2048) - F
| TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 (dh 2048) - F
| TLS_ECDH_anon_WITH_AES_128_CBC_SHA (ecdh_x25519) - F
| TLS_DH_anon_WITH_AES_128_CBC_SHA (dh 2048) - F
| TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA (dh 2048) - F
This is a LetsEncrypt cert - do I need to make changes there, or is
this all done with postfix configs?
And what nmap command can be run to probe port 25 for its cipher suite?
Thanks,
Alex
On Mon, Jan 10, 2022 at 11:08 AM Alex wrote:
>
> Hi,
>
> I have a postfix-3.5.10 system and having a little trouble configuring
> it to ensure I'm not including any vulnerable ciphers. I had
> previously posted about this issue in September, and thought I
> followed the instructions I was given, but a recent security scan
> (onsecurity) shows port 25 is still vulnerable to the SWEET32 attack.
>
> For reference to previously discussion:
> https://www.mail-archive.com/postfix-users-at-postfix.org/msg92857.html
>
> This system is just a general smtp/submission/pop/imap box with no
> mandatory crypto/certificate requirements. We also don't need to
> maintain compatibility with legacy systems.
>
> Here are my current settings:
> # postconf -n -c /etc/postfix-117|grep -E 'tls|cipher'
> smtp_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
> smtp_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
> smtp_tls_security_level = may
> smtpd_tls_auth_only = yes
> smtpd_tls_cert_file = /etc/letsencrypt/cert.pem
> smtpd_tls_exclude_ciphers = MD5, RC4, 3DES, IDEA, SEED
> smtpd_tls_key_file = /etc/letsencrypt/privkey.pem
> smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
> smtpd_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
> smtpd_tls_received_header = yes
> smtpd_tls_security_level = may
> smtpd_tls_session_cache_database =
> btree:${data_directory}/smtpd_tls_session_cache
> tls_preempt_cipherlist = yes
> tls_random_source = dev:/dev/urandom
> tls_ssl_options = NO_COMPRESSION, NO_RENEGOTIATION
>
> What am I missing? Is this redhat.com article accurate?
> https://access.redhat.com/articles/1468593
>
> I believe I was told that trying to explicitly define the cipher list
> was a bad idea.
>
> Thanks,
> Alex
_______________________________________________
Hangout mailing list
Hangout-at-nylxs.com
http://lists.mrbrklyn.com/mailman/listinfo/hangout
|
|
