From owner-freebsd-stable@FreeBSD.ORG Thu Jun 18 12:54:53 2015 Return-Path: Delivered-To: freebsd-stable@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 7FAA61EE; Thu, 18 Jun 2015 12:54:53 +0000 (UTC) (envelope-from royce.williams@gmail.com) Received: from mail-ob0-x234.google.com (mail-ob0-x234.google.com [IPv6:2607:f8b0:4003:c01::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 19DDA2DD; Thu, 18 Jun 2015 12:54:53 +0000 (UTC) (envelope-from royce.williams@gmail.com) Received: by obbgp2 with SMTP id gp2so53332841obb.2; Thu, 18 Jun 2015 05:54:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=4BNP3eCcBH3JZRkJ6jDU591xMym0QuQHISsV2N3ajWg=; b=ySxMRzkLD9Pidu/siBAQRfwzRAb3UMiPiKCR0xIIsrD3mDGScahE7cCuR8apop7BDc rTs/Sx1bwJHUmugm4e10xxRLhD8OlCEedgtHANySmci9W9c6HiXirIxwscpdlQF7VpI/ ozselsQ7xG3w49EjDZwBdE7Qk9Hz7679GdtsiT0GvlqIPEfuveqiH/PbEZcAI9dqogVi 3OLO2ZEB6KvXs7MUo3EmPLdxqM5LM4+fXDjB/JBHqID2yhjKDNW4XUYHkrF9PCq3vm5U b9pCXbtZoCh0/EVbdWejnoa4bHn//okNTlwUfW5UGysJ82vjVlFo+H0zD1P4uP0OE+Up ec2w== X-Received: by 10.202.207.206 with SMTP id f197mr2741346oig.28.1434632092355; Thu, 18 Jun 2015 05:54:52 -0700 (PDT) MIME-Version: 1.0 Sender: royce.williams@gmail.com Received: by 10.202.132.78 with HTTP; Thu, 18 Jun 2015 05:54:31 -0700 (PDT) In-Reply-To: <20150618112132.GD7234@pol-server.leissner.se> References: <201506180553.t5I5rKlO059969@freefall.freebsd.org> <20150618112132.GD7234@pol-server.leissner.se> From: Royce Williams Date: Thu, 18 Jun 2015 04:54:31 -0800 X-Google-Sender-Auth: uMsgD8jE7IZ85SBmd1oplQwlhxE Message-ID: Subject: Re: [FreeBSD-Announce] FreeBSD Errata Notice FreeBSD-EN-15:08.sendmail To: Peter Olsson Cc: freebsd-stable , FreeBSD Errata Notices Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.20 X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jun 2015 12:54:53 -0000 On Thu, Jun 18, 2015 at 3:21 AM, Peter Olsson < list-freebsd-announce@jyborn.se> wrote: > On Thu, Jun 18, 2015 at 05:53:20AM +0000, FreeBSD Errata Notices wrote: > > Corrected: 2015-06-17 02:39:10 UTC (stable/10, 10.1-STABLE) > > 2015-06-18 05:36:45 UTC (releng/10.1, 10.1-RELEASE-p13) > > > > V. Solution > ... > > # freebsd-update fetch > > # freebsd-update install > > This does not seem to solve the problem. > > I upgraded two of my 10.1-RELEASE-pX servers to > 10.1-RELEASE-p12 a couple of days ago, after which all > outgoing mail, both for local destinations and for > destinations outside the servers, end up stuck in > /var/spool/clientmqueue with this in maillog: > > sendmail[1045]: t5IBAMAB001045: from=pol, size=23, class=0, nrcpts=1, > msgid=<201506181110.t5IBAMAB001045@xxx>, relay=root@localhost > sendmail[1045]: STARTTLS=client, error: connect failed=-1, reason=dh key > too small, SSL_error=1, errno=0, retry=-1 > sm-mta[1046]: STARTTLS=server, error: accept failed=0, reason=sslv3 alert > handshake failure, SSL_error=1, errno=0, retry=-1, relay=localhost > [127.0.0.1] > sendmail[1045]: ruleset=tls_server, arg1=SOFTWARE, relay=[127.0.0.1], > reject=403 4.7.0 TLS handshake. > sm-mta[1046]: t5IBAMPQ001046: localhost [127.0.0.1] did not issue > MAIL/EXPN/VRFY/ETRN during connection to Daemon0 > sendmail[1045]: t5IBAMAB001045: to=www, ctladdr=pol (xxx/xxx), > delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30023, relay=[127.0.0.1] > [127.0.0.1], dsn=4.0.0, stat=Deferred: 403 4.7.0 TLS handshake. > > And I still have the same problem after upgrading to > 10.1-RELEASE-p13 and rebooting. > > Both servers use base sendmail, and I have done nothing > (except adding aliases) with the sendmail configuration > in them. Not even created `hostname` mc/cf files, so they > are using the default cf files. > Did you (re)generate your dh.params file as noted in the Workaround section? On my systems, I had to do this to support the actual patch (not to perform the workaround). You might have to restart sendmail as well, but I have not tested this. Royce