Date: Sun, 14 Jun 2015 19:26:00 -0500 From: Karl Denninger <karl@denninger.net> To: freebsd-stable@freebsd.org Subject: Re: Sendmail problem after upgrade to r284296 Message-ID: <557E1B98.6070402@denninger.net> In-Reply-To: <alpine.BSF.2.20.1506141952140.853@Ace.nina.org> References: <alpine.BSF.2.20.1506141014130.852@Ace.nina.org> <20150614165507.GD95564@minime.local> <alpine.BSF.2.20.1506141333131.852@Ace.nina.org> <20150614180142.GE95564@minime.local> <alpine.BSF.2.20.1506141952140.853@Ace.nina.org>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
On 6/14/2015 19:21, Frank Seltzer wrote:
> I updated source and rebuilt world and kernel with no change in
> sendmail's behavior. This is the revision I have now:
>
> root@Ace:/etc/mail/certs # svnlite info /usr/src/
> Path: /usr/src
> Working Copy Root Path: /usr/src
> URL: svn://ace/src/stable/10
> Relative URL: ^/stable/10
> Repository Root: svn://ace/src
> Repository UUID: ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
> Revision: 284384
> Node Kind: directory
> Schedule: normal
> Last Changed Author: kib
> Last Changed Rev: 284375
> Last Changed Date: 2015-06-14 01:12:48 -0400 (Sun, 14 Jun 2015)
>
> root@Ace:/etc/mail/certs # uname -a
> FreeBSD Ace.nina.org 10.1-STABLE FreeBSD 10.1-STABLE #0 r284384: Sun
> Jun 14 16:40:15 EDT 2015
> frank_s@Ace.nina.org:/usr/obj/usr/src/sys/GENERIC amd64
>
> and openssl:
>
> root@Ace:/etc/mail/certs # openssl version
> OpenSSL 1.0.1o-freebsd 12 Jun 2015
>
> so I'm up to date there as well.
>
>> /etc/rc.d/sendmail stop
>> mv /etc/mail/certs/dh.param{,~old}
>> openssl dhparam -out /etc/mail/certs/dh.param 2048
>> /etc/rc.d/sendmail start
>
> After the update I got your email and followed your instructions,
> except for moving dh.param because it didn't exist, and sendmail is
> happy now.
>
> I checked and there is still no mention of this in /usr/src/UPDATING
> so my question is, when and how is dh.param supposed to be created?
> Since I'm not the only one with this problem it doesn't seem to be
> something I did or didn't do. What could have caused dh.param to not
> be generated?
>
> Thanks,
> Frank
>
It only needs to be done once (and now you've done it.)
The reason is a bit obscure but has to do with some vulnerabilities
discovered in DH key negotiation with weak parameter sets. Most mail
servers do not check literally ANYTHING when it comes to SSL
connections, but this is a VERY poor practice. That it's being
tightened up is a good thing to a point, but there will be more of this
sort of problem over time (particularly if people start getting uppity
about broken certification chains or private CAs as a whole LOT of email
servers run self-signed or local-CA-issued SSL certificates!)
Are these potentially breakable too? Yes, with a MITM
(man-in-the-middle) attack -- but that's not the same degree of
vulnerability as the DH key problem, so hopefully the "cranking down of
the screws" will stop before it gets to where it begins to SEVERELY
impact mail exchange.
--
Karl Denninger
karl@denninger.net <mailto:karl@denninger.net>
/The Market Ticker/
/[S/MIME encrypted email preferred]/
[-- Attachment #2 --]
0 *H
01 0 + 0 *H
_0[0C)0
*H
01 0 UUS10UFlorida10U Niceville10U
Cuda Systems LLC1 0UCuda Systems LLC CA1"0 *H
Cuda Systems LLC CA0
150421022159Z
200419022159Z0Z1 0 UUS10UFlorida10U
Cuda Systems LLC1 0 UKarl Denninger (OCSP)0"0
*H
0
X@vkY
Tq/vE]5#֯MX \8LJ/V?5Da+
sJc*/r{ȼnS+ w")ąZ^DtdCOZ ~7Q '@a#ijc۴oZdB&!Ӝ-< ? HN5y
5}F|e f"V لio74zn">a1qWuɖbFeGE&3(KhixG3!#e_XƬ Ϝ/,$+;4y 'Bz<qT9_?rRUpn5
Jn&Rx/p Jyel*pN8/#9u/YP EC)TY>~/˘N[vyiDKˉ ,^" ?$T8 v& K%z8C @?K{9f`+@,| Mbia 007++0)0'+0http://cudasystems.net:88880 U 0 0 `HB0 U 0, `HB
OpenSSL Generated Certificate0 U -h\Ff Y0 U #0$q}ݽʒm50 U 0karl@denninger.net0
*H
Owbabɺx&Uk[ (Oj!%p MQ0I!#QH}.>~2&D}<wm_>V6 v ]f>=Nn+8;q wfΰ/RLyUG#b}n!Dր _up|_ǰc/%ۥ
nN8:d;-UJd/m1~VނיnN I˾$tF1&}|?q?\đXԑ&\4V<lKۮ3%Am_(q -(cAeGX)f}-˥6cv~Kg8m~v ;|9:-iAPқ6ېn-.)<[$KJtt/L4ᖣ^Cmu4vb{+BG$M0c\[MR|0FԸP&78"4p# }D Z9;V9#>Sw"[UP710001 0 UUS10UFlorida10U Niceville10U
Cuda Systems LLC1 0UCuda Systems LLC CA1"0 *H
Cuda Systems LLC CA)0 + !0 *H
1 *H
0 *H
1
150615002600Z0# *H
1JucGŞ
C0l *H
1_0]0 `He*0 `He0
*H
0*H
0
*H
@0+0
*H
(0 +71001 0 UUS10UFlorida10U Niceville10U
Cuda Systems LLC1 0UCuda Systems LLC CA1"0 *H
Cuda Systems LLC CA)0 *H
101 0 UUS10UFlorida10U Niceville10U
Cuda Systems LLC1 0UCuda Systems LLC CA1"0 *H
Cuda Systems LLC CA)0
*H
.mge Dq[<0~ P`_C&8Fu4OZܫ|̛k/
4ZwQPP~L`(ytŗk 6 n7%{LEZM_L-z<ʱIܚW4ѲԀ\nj;Fƥ p;3B 3]}*v}%%{hU`C#=-{e>- ZW8h.6mV9gyLJ`utژ &=ewx8 Oy hzf. [|! dXqN \Ɋ 'aquF1x: ӱt+1\Kc Z֞Zr#@`"ya&4:7a4@sϻv4!,xVp VJL+^WZk Of*~ sەtSZ5+8 2L4< ; <kKOYLz`5y? g>?v7m$/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?557E1B98.6070402>