Thread Info
  • State Verified Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 29 replies
  • Answers 2 answers
  • Subscribers 44 subscribers
  • Views 41557 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

TLS 1.2 Mandatory setzen

MarcSchrömges

Hallo zusammen,

 

die neue Europäische Datenschutzverordnung stellt uns gerade vor die Herausforderung unseren gesamten Emailverkehr nach aussen mittels TLS 1.2 zu verschlüsseln. Also den Übertragungskanal. Für uns stellt sich nun die Frage ob wir diese Verbindung mittels der Sophos UTM realisiert bekommen. In unserem Falle sollen alle Übertragungen, die nicht mittels TLS 1.2 gesichert werden können, blockiert werden. Ich weiß das es andere Compliances gibt die dies unterstützen. Daher nehme ich an das die Sophos das auch kann. Jedoch muss ich hier wissen wie man das eingestellt bekommt und was passiert wenn die Übertragung nicht statt findet. 

Wir nutzen derzeit die UTM in der Version: 9.506-2

 



This thread was automatically locked due to age.
Parents
  • +1

    Hallo Marc,

    (Sorry, my German-speaking brain isn't creating thoughts at the moment.  )

    Since you certainly have a paid subscription, don't do the following until it has been "blessed" by Sophos Support.

    There's probably a line (about 297) in /var/chroot-smtp/etc/exim.conf that contains

    openssl_options = +no_sslv3

    Change that to:

    openssl_options +no_sslv2 +no_sslv3 +no_tlsv1 +no_tlsv1_1

    And restart the Proxy:

    /var/mdw/scripts/smtp restart

    In my opinion Sophos should make a KnowledgeBase article for this fix for everyone in Europe.

    MfG - Bob (Bitte auf Deutsch weiterhin.)

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Thanks Bob. As GDPR is comming, I am sure that will be useful for me too. But of course I will first get in touch with Sophos support. Maybe if enough tickets to that relate they release a kba.

    Best

    Alex

    -

  • 0 in reply to Alexander Busch

    Thanks for your support, guys.

    I sent messages to Sachin Gurung and Karlos with a link to my thread above.  Karlos seems to be an author of several KB articles, so I hope we can look forward to a whole pack of articles that attack the GDPR challenges.

    Opening Support Tickets will give more attention to Karlos' suggestions to management.

    MfG - Bob (Bitte auf Deutsch weiterhin.)

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to PeterRenchen

    Danke Jungs für die Antworten. Das ist natürlich nicht wirklich eine Ideallösung. Ich hoffe das Sophos hier schnell die Vorschläge umsetzt. Jedoch finde ich keine Aussage bezürglich, was passiert wenn abgelehnt?

  • 0 in reply to MarcSchrömges

    Nachdem ja nun ca. 3 Monate vorbei sind kann mir jemand sagen ob sich hier eventuell was getan hat ? Ich komme nicht dazu mich weiter ein zu lesen ...

  • 0 in reply to MarcSchrömges

    Are you requiring TLS 1.2 for all outbound connections?  If so, how is that working for you?

    For sites that cannot do TLS 1.2, if encryption is not mandatory, then any mail server will fall back from TLS 1.0 to no encryption.   I don't see how that is an improvement in security.

  • 0 in reply to DouglasFoster

    To show compliance with a mandate like this, you really need two things:  (1) a setting to cause the desired behavior in the future, and (2) log data to prove that the setting was in effect at any point in time that might be of interest to an auditor or lawyer.    Fortunately, the SMTP log shows the inbound and outbound cipher settings, if you hunt for it.   

    If you can effectively parse the SMTP logs into a database structure, you can respond to audit questions at any level of complexity.   (Look for X=... in the logs to see the way cipher information is represented.)   Also see my post from earlier today for an annotated example of the log data.

    https://community.sophos.com/products/unified-threat-management/f/management-networking-logging-and-reporting/103336/understanding-the-smtp-logs

    If Sophos is really going to help its UTM customer base with GDPR, they really need to make IView into a database tool for querying the logs, rather than leaving it in its present state as a tool for generating beautiful summary reports.   I would be reluctant to give a summary report to a manager unless I knew how to generate the supporting detail, and when I last looked at IView, it could not provide those details.

Reply
  • 0 in reply to DouglasFoster

    To show compliance with a mandate like this, you really need two things:  (1) a setting to cause the desired behavior in the future, and (2) log data to prove that the setting was in effect at any point in time that might be of interest to an auditor or lawyer.    Fortunately, the SMTP log shows the inbound and outbound cipher settings, if you hunt for it.   

    If you can effectively parse the SMTP logs into a database structure, you can respond to audit questions at any level of complexity.   (Look for X=... in the logs to see the way cipher information is represented.)   Also see my post from earlier today for an annotated example of the log data.

    https://community.sophos.com/products/unified-threat-management/f/management-networking-logging-and-reporting/103336/understanding-the-smtp-logs

    If Sophos is really going to help its UTM customer base with GDPR, they really need to make IView into a database tool for querying the logs, rather than leaving it in its present state as a tool for generating beautiful summary reports.   I would be reluctant to give a summary report to a manager unless I knew how to generate the supporting detail, and when I last looked at IView, it could not provide those details.

Children
No Data
Unfiltered HTML