TLS 1.2 Mandatory setzen

Hallo Marc,

(Sorry, my German-speaking brain isn't creating thoughts at the moment. )

Since you certainly have a paid subscription, don't do the following until it has been "blessed" by Sophos Support.

There's probably a line (about 297) in /var/chroot-smtp/etc/exim.conf that contains

openssl_options = +no_sslv3

Change that to:

openssl_options +no_sslv2 +no_sslv3 +no_tlsv1 +no_tlsv1_1

And restart the Proxy:

/var/mdw/scripts/smtp restart

In my opinion Sophos should make a KnowledgeBase article for this fix for everyone in Europe.

MfG - Bob (Bitte auf Deutsch weiterhin.)

Thanks Bob. As GDPR is comming, I am sure that will be useful for me too. But of course I will first get in touch with Sophos support. Maybe if enough tickets to that relate they release a kba.

Best

Alex

Thanks Bob !

There's also an Feature Request:  https://ideas.sophos.com/forums/17359-sg-utm/suggestions/32791042-email-protection-tls-version-and-ciphersuite-se

Greetings, Peter

Danke Jungs für die Antworten. Das ist natürlich nicht wirklich eine Ideallösung. Ich hoffe das Sophos hier schnell die Vorschläge umsetzt. Jedoch finde ich keine Aussage bezürglich, was passiert wenn abgelehnt?

Nachdem ja nun ca. 3 Monate vorbei sind kann mir jemand sagen ob sich hier eventuell was getan hat ? Ich komme nicht dazu mich weiter ein zu lesen ...

Are you requiring TLS 1.2 for all outbound connections?  If so, how is that working for you?

For sites that cannot do TLS 1.2, if encryption is not mandatory, then any mail server will fall back from TLS 1.0 to no encryption.   I don't see how that is an improvement in security.

To show compliance with a mandate like this, you really need two things:  (1) a setting to cause the desired behavior in the future, and (2) log data to prove that the setting was in effect at any point in time that might be of interest to an auditor or lawyer.    Fortunately, the SMTP log shows the inbound and outbound cipher settings, if you hunt for it.   

If you can effectively parse the SMTP logs into a database structure, you can respond to audit questions at any level of complexity.   (Look for X=... in the logs to see the way cipher information is represented.)   Also see my post from earlier today for an annotated example of the log data.

https://community.sophos.com/products/unified-threat-management/f/management-networking-logging-and-reporting/103336/understanding-the-smtp-logs

If Sophos is really going to help its UTM customer base with GDPR, they really need to make IView into a database tool for querying the logs, rather than leaving it in its present state as a tool for generating beautiful summary reports.   I would be reluctant to give a summary report to a manager unless I knew how to generate the supporting detail, and when I last looked at IView, it could not provide those details.

Wir wollen ja den Fallback verhindern. Sollte ein Server kein TLS 1.2 unterstützen dürfen dort keine Mails hin geschickt werden.
Einen Folgeprozess dazu erarbeiten wir gerade. 

Hallo Marc,

das Erzwingen von TLS ist via GUI möglich, TLS 1.2 über die Konsole, siehe Post oben von Bob.

Kommt diese Lösung Deinen Anforderungen nicht nach?

Beste Grüße

Alex

Hallo Zusammen,

wie man von mehreren Stellen lesen kann, akzeptiert Office 365 ab Oktober 2018 nur noch Mailserver die mit TLS 1.2 verschlüsseln, andere Methoden werden nicht unterstützt. Kann man denn in der GUI einstellen, das er erst TLS 1.2 prüfen soll und nur im Notfall mit TLS 1.1 oder 1.0 sendet?

VG Uli

Unknown said:

Hallo Zusammen,

wie man von mehreren Stellen lesen kann, akzeptiert Office 365 ab Oktober 2018 nur noch Mailserver die mit TLS 1.2 verschlüsseln, andere Methoden werden nicht unterstützt. Kann man denn in der GUI einstellen, das er erst TLS 1.2 prüfen soll und nur im Notfall mit TLS 1.1 oder 1.0 sendet?

VG Uli

 

Genau das ist das Standardverhalten, entsprechendes Fallback TLS 1.2 -> 1.1 -> 1.0 -> unverschlüsselt.

Alex

It's possible to always require TLS.  Put "Any" in 'Require TLS Negotiation Hosts/Nets' on the 'Advanced' tab.  Careful!  Over a third of the MTAs out there today don't do TLS.  Almost 40% of domains don't have an MTA that does TLS.

Cheers - Bob

It's possible to always require TLS.  Put "Any" in 'Require TLS Negotiation Hosts/Nets' on the 'Advanced' tab.  Careful!  Over a third of the MTAs out there today don't do TLS.  Almost 40% of domains don't have an MTA that does TLS.

Cheers - Bob

Agreed.  you neef good log parsing to know what is affected by any lockdown decision.

i surveyed my traffic:. 2 residential ISPs and 2 important businesses were not doing encryption.   Requiring it everywhere would block a lot of important traffic.