LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 02-12-2016, 12:39 AM   #1
psycroptic
Member
 
Registered: Aug 2011
Location: USA
Distribution: ArchLinux - 3.0 kernel
Posts: 348

Rep: Reputation: Disabled
Disabling TLSv1.0 on postfix = ~25% of mails not received


Hello. I have been running an Arch Linux Postfix mail server for about 3 years now and have had quite a good experience with it. However, I have been keeping up with current security news and have seen that TLSv1.0 is broken and should be disabled (indeed, the "PCI DSS" standards disallow it.) So I have added the following in /etc/postfix/main.cf:

Code:
smtpd_tls_protocols = !SSLv2,!SSLv3,!TLSv1
smtp_tls_protocols = !SSLv2,!SSLv3,!TLSv1
smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1
smtp_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1
However, since doing that I see a fair amount of the following in the server logs:

Code:
Feb 11 20:22:32 MailServer postfix/smtpd[23118]: connect from ec2-54-183-213-26.us-west-1.compute.amazonaws.com[54.183.213.26]
Feb 11 20:22:32 MailServer postfix/smtpd[23118]: SSL_accept error from ec2-54-183-213-26.us-west-1.compute.amazonaws.com[54.183.213.26]: -1
Feb 11 20:22:32 MailServer postfix/smtpd[23118]: warning: TLS library problem: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol:s23_srvr.c:640:
Feb 11 20:22:32 MailServer postfix/smtpd[23118]: lost connection after STARTTLS from ec2-54-183-213-26.us-west-1.compute.amazonaws.com[54.183.213.26]
Feb 11 20:22:32 MailServer postfix/smtpd[23118]: disconnect from ec2-54-183-213-26.us-west-1.compute.amazonaws.com[54.183.213.26] ehlo=1 starttls=0/1 commands=1/2
And the mail (in this case from Amazon) is not received. Many other sending domains have this problem, primarily Yahoo, Comcast, and several other big names. If I re-enable TLSv1, the messages come through.

Is this because the sending servers only support TLSv1? (Kind of hard to believe that Amazon and Yahoo still operate that way...). Or could it be due to misconfiguration on my part?
 
Old 02-15-2016, 07:37 AM   #2
TenTenths
Senior Member
 
Registered: Aug 2011
Location: Dublin
Distribution: Centos 5 / 6 / 7
Posts: 2,940

Rep: Reputation: 1211Reputation: 1211Reputation: 1211Reputation: 1211Reputation: 1211Reputation: 1211Reputation: 1211Reputation: 1211Reputation: 1211
Just so you're aware of it, the PCI standard has been recently changed to allow TLS1.0 until (I believe) 2018

[Edit:]Rather annoyingly as we spent a lot of effort in to going TLS1.1 ahead of our normal upgrade schedule.

Last edited by TenTenths; 02-15-2016 at 07:39 AM.
 
1 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to disable TLSv1.0/TLSv1.1 and CBC ciphers in Redhat surroor Red Hat 2 12-03-2015 04:44 PM
[SOLVED] fetchmail does not delete mails received mails from server golden_boy615 Linux - General 1 05-02-2011 02:16 AM
To restrict a user to send mails only to 3 e-mails IDs using postfix mail server sharath41 Linux - Newbie 2 07-21-2008 07:38 PM
Mails not received by a user J_Szucs Linux - Newbie 3 08-18-2002 06:20 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 07:01 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration