<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Hi Justina,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Kali tools is of course extremly unprecise. Excuse me, I had a long stressful day and wanted to get this out before the end of the Day. Kali is a rolling release and I keep it up to date by upgrading every few days. I also update the feeds. What I actually
use for security scans is the <span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">former OpenVAS, which now has been relegated to being a part of the Community Edition of the Greenbone suite. </span><span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">You
have seen the values I have in Dovecot. What follows now are my settings in the postfix main.cf. As you can clearly see it, it should prevent connections from TLS below 1.2. Dovecot is of course not very fresh because it's Debian 10 and Debian 11 is just around
the corner (a few days). </span><span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">These are the settings of my postfix main.cf. I am very tempted to grab an Image of Debian 11 and install ISPConfig and
my Dovecot and Postfix settings there. I am of course open to any other suggestions. A the moment I consider to install a new Bullseye RC2 and then put my configuration on it. I am of course open for any other suggestions.</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">Yours sincerely</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">Stefan</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">smtpd_use_tls = yes
<div>smtpd_tls_cert_file = /etc/postfix/smtpd.cert</div>
<div>smtpd_tls_key_file = /etc/postfix/smtpd.key</div>
<div>smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache</div>
<div>smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache</div>
<div><br>
</div>
<div>smtpd_tls_eecdh_grade = strong</div>
<div>smtpd_tls_protocols= !SSLv2, !SSLv3, !TLSv1, !TLSv1.1</div>
<div>smtpd_tls_mandatory_protocols= !SSLv2, !SSLv3, !TLSv1, !TLSv1.1</div>
<div>smtpd_tls_mandatory_ciphers = high</div>
<div>smtpd_tls_security_level=may</div>
<div>smtpd_tls_ciphers = high</div>
<div>tls_preempt_cipherlist = yes</div>
<div>smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL</div>
<div>smtpd_tls_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL</div>
<div>smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1</div>
<span>smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1</span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div id="appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>Von:</b> justina colmena ~biz <justina@colmena.biz><br>
<b>Gesendet:</b> Mittwoch, 14. Juli 2021 18:50<br>
<b>An:</b> dovecot@dovecot.org <dovecot@dovecot.org>; Stefan Schumacher <s.schumacher@consulting1x1.com><br>
<b>Betreff:</b> Re: TLS Security</font>
<div> </div>
</div>
<div dir="ltr">Interesting.<br>
<br>
Assuming your "Kali" tools are in fact up to date to test with newer protocols TLS1.2+, is Dovecot compiled against a recent version of the OpenSSL or GnuTLS library or whatever it uses to support the newer TLS protocols?<br>
<br>
Definitely an outdated cipher issue, on Postfix as well as Dovecot....<br>
<br>
<br>
<div class="x_gmail_quote">On July 14, 2021 6:55:19 AM AKDT, Stefan Schumacher <s.schumacher@consulting1x1.com> wrote:
<blockquote class="x_gmail_quote" style="margin:0pt 0pt 0pt 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
Hi,</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
<br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
I wish to build a new secure email server. It seems I am on the right way – at least I get no more error messages for Postfix – but Dovecot is still making trouble.
</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
<br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
I am using Dovecot 1:2.3.4.1-5+deb10u6 and I am using ISPconfig 3.25 to do the rough configuring and nano and whats left of my brain to do the finer details. Lets start with what I added to conf.d/10-ssl.conf</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
<br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
ssl_cert = </etc/letsencrypt/live/servername/fullchain.pem</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
ssl_key = </etc/letsencrypt/live/servername/privkey.pem</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
<br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aR$</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
ssl_min_protocol = TLSv1.2</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
<br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
As you can see, I clearly do not want to use TLS before v1.2. I think this is not unreasonable in the year 2021.
</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
<br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
Now, after the changes I ran Kali (I use it to verify the results of my experiments)</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
and - this is a mailing list, so no screenshots:</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
It says:</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
<br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
SSL/TLS Deprecated TLS v1.0 and TLS v1.1 Detection. I get this for the ports 143, 110, 993 and 995.</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
<br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
I thought I had done everything one could to disable old TLS-Versions. What am I doing wrong?</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
<br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
Yours sincerely</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-bottom:0cm; line-height:100%; background:transparent">
Stefan Schumacher</p>
<br>
</div>
</blockquote>
</div>
<br>
-- <br>
Sent from my Android device with K-9 Mail. Please excuse my brevity.</div>
</body>
</html>