Zimbra Forums

Zimbra Collaboration & Zimbra Desktop Forums
https://forums.zimbra.org/

Zimbra 8.7.11 SSL/TLS Cipher Suites

https://forums.zimbra.org/viewtopic.php?t=62878

Page 1 of 2

Zimbra 8.7.11 SSL/TLS Cipher Suites

Posted: Mon Oct 09, 2017 2:56 pm
by iodisciple
Hi all,

Been struggling with this for a while, hope somebody can help. I'm on a fully updated CentOS 7 box and fully updated Zimbra. Now from another machine I've ran OpenVAS to check the security and I was able to fix some stuff. Unfortunately I can't fix some Zimbra related things:

SSL/TLS: Report 'Anonymous' Cipher on port 465/tcp
SSL/TLS: Report Weak Cipher Suites on port 465/tcp
SSL/TLS: Report Weak Cipher Suites on port 587/tcp

I also had these error on my https 443 port but was able to fix it with a '$ zmprov mcf zimbraReverseProxySSLCiphers' command. It seems that these 465 and 587 ports don't use the Reverse proxy since the same command doesn't fix it for these ports.

I've also tried '$ zmprov mcf +zimbraSSLExcludeCipherSuites <cipher>' but doesn't do anything as well.

To cut a long story short: where can I disable weak(er) ciphers for ports 465 and 587.

Re: Zimbra 8.7.11 SSL/TLS Cipher Suites

Posted: Fri Oct 13, 2017 8:14 am
by iodisciple
Anyone? :)

More info needed?

Re: Zimbra 8.7.11 SSL/TLS Cipher Suites

Posted: Fri Oct 13, 2017 11:57 am
by L. Mark Stone
Ports 465 and 587 are handled by Postfix and do not go through the Proxy. Those ports are used to allow end-user email clients like Outlook to be able to send email through Zimbra after authenticating.

I believe, but am less than 100% sure, that the config you are seeking to mdify is smtp_tls_mandatory_ciphers:

Code: Select all

zimbra@smtp2:~$ zmprov desc -a zimbraMtaSmtpTlsMandatoryCiphers
zimbraMtaSmtpTlsMandatoryCiphers
    Value for postconf smtp_tls_mandatory_ciphers

               type : enum
              value : export,low,medium,high,null
           callback : 
          immutable : false
        cardinality : single
         requiredIn : 
         optionalIn : server,globalConfig
              flags : serverInherited
           defaults : medium
                min : 
                max : 
                 id : 1514
    requiresRestart : 
              since : 8.5.0
    deprecatedSince : 

zimbra@smtp2:~$
You could test in a lab by changing the value from the current (likely) "medium" to "high", then restart Zimbra and see what happens. If you are using Network Edition you are entitled to open a Support Case for something like this.

Note that if you do successfully change the value to "high" and pass your tests, that older clients which do not support more secure cipher suites will be unable to route email through your server as they now may be doing.

Hope that helps,
Mark

Re: Zimbra 8.7.11 SSL/TLS Cipher Suites

Posted: Thu Oct 19, 2017 1:55 pm
by iodisciple
Hi Mark,

Many thanks for your feedback and apologies for my late response, I've been away for a couple of days. I'll test this ASAP.

Regards,
iodisiple

Re: Zimbra 8.7.11 SSL/TLS Cipher Suites

Posted: Tue Oct 24, 2017 1:11 pm
by iodisciple
Today I setup a test environment. Unfortunately, I think it goes wrong at step 1... Could you please give me the commands to set zimbraMtaSmtpTlsMandatoryCiphers at high? I've tried several, but it seems it doesn't stick.

Re: Zimbra 8.7.11 SSL/TLS Cipher Suites

Posted: Tue Oct 24, 2017 9:29 pm
by L. Mark Stone
iodisciple wrote:Today I setup a test environment. Unfortunately, I think it goes wrong at step 1... Could you please give me the commands to set zimbraMtaSmtpTlsMandatoryCiphers at high? I've tried several, but it seems it doesn't stick.

The description says it's both a global and a server-level variable, so first find out if it's set at the server level:

Code: Select all

zmprov gs `zmhostname` zimbraMtaSmtpTlsMandatoryCiphers
If the command returns nothing, then you know you can just set it globally:

Code: Select all

zmprov mcf zimbraMtaSmtpTlsMandatoryCiphers high
Restart Zimbra and let us know! And please remember to do this in a lab first; I've always just set cipher lists explicitly in the past.

Hope that helps,
Mark

Re: Zimbra 8.7.11 SSL/TLS Cipher Suites

Posted: Wed Oct 25, 2017 9:41 am
by iodisciple
Awesome Mark, this shows me that I did indeed use the proper command before.

Code: Select all

$ zmprov gs `zmhostname` zimbraMtaSmtpTlsMandatoryCiphers
# name myserver.mydomain.com
zimbraMtaSmtpTlsMandatoryCiphers: high
But unfortunately OpenVAS still reports the exact same problems :(

Do you have maybe more suggestions? Below the errors more specified.

SSL/TLS: Report 'Anonymous' Cipher Suites on port 465

Code: Select all

'Anonymous' cipher suites accepted by this service via the TLSv1.0 protocol:

TLS_DH_anon_WITH_3DES_EDE_CBC_SHA
TLS_DH_anon_WITH_AES_128_CBC_SHA
TLS_DH_anon_WITH_AES_256_CBC_SHA
TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA
TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA
TLS_DH_anon_WITH_RC4_128_MD5
TLS_DH_anon_WITH_SEED_CBC_SHA
TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA
TLS_ECDH_anon_WITH_AES_128_CBC_SHA
TLS_ECDH_anon_WITH_AES_256_CBC_SHA
TLS_ECDH_anon_WITH_RC4_128_SHA

'Anonymous' cipher suites accepted by this service via the TLSv1.1 protocol:

TLS_DH_anon_WITH_3DES_EDE_CBC_SHA
TLS_DH_anon_WITH_AES_128_CBC_SHA
TLS_DH_anon_WITH_AES_256_CBC_SHA
TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA
TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA
TLS_DH_anon_WITH_RC4_128_MD5
TLS_DH_anon_WITH_SEED_CBC_SHA
TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA
TLS_ECDH_anon_WITH_AES_128_CBC_SHA
TLS_ECDH_anon_WITH_AES_256_CBC_SHA
TLS_ECDH_anon_WITH_RC4_128_SHA

'Anonymous' cipher suites accepted by this service via the TLSv1.2 protocol:

TLS_DH_anon_WITH_3DES_EDE_CBC_SHA
TLS_DH_anon_WITH_AES_128_CBC_SHA
TLS_DH_anon_WITH_AES_128_CBC_SHA256
TLS_DH_anon_WITH_AES_128_GCM_SHA256
TLS_DH_anon_WITH_AES_256_CBC_SHA
TLS_DH_anon_WITH_AES_256_CBC_SHA256
TLS_DH_anon_WITH_AES_256_GCM_SHA384
TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA
TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA
TLS_DH_anon_WITH_RC4_128_MD5
TLS_DH_anon_WITH_SEED_CBC_SHA
TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA
TLS_ECDH_anon_WITH_AES_128_CBC_SHA
TLS_ECDH_anon_WITH_AES_256_CBC_SHA
TLS_ECDH_anon_WITH_RC4_128_SHA
SSL/TLS: Report Weak Cipher Suites on port 587

Code: Select all

'Weak' cipher suites accepted by this service via the TLSv1.0 protocol:

TLS_DH_anon_WITH_RC4_128_MD5
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_ECDH_anon_WITH_RC4_128_SHA
TLS_RSA_WITH_RC4_128_MD5
TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_SEED_CBC_SHA

'Weak' cipher suites accepted by this service via the TLSv1.1 protocol:

TLS_DH_anon_WITH_RC4_128_MD5
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_ECDH_anon_WITH_RC4_128_SHA
TLS_RSA_WITH_RC4_128_MD5
TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_SEED_CBC_SHA

'Weak' cipher suites accepted by this service via the TLSv1.2 protocol:

TLS_DH_anon_WITH_RC4_128_MD5
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_ECDH_anon_WITH_RC4_128_SHA
TLS_RSA_WITH_RC4_128_MD5
TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_SEED_CBC_SHA
SSL/TLS: Report Weak Cipher Suites on port 465

Code: Select all

'Weak' cipher suites accepted by this service via the TLSv1.0 protocol:

TLS_DH_anon_WITH_RC4_128_MD5
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_ECDH_anon_WITH_RC4_128_SHA
TLS_RSA_WITH_RC4_128_MD5
TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_SEED_CBC_SHA

'Weak' cipher suites accepted by this service via the TLSv1.1 protocol:

TLS_DH_anon_WITH_RC4_128_MD5
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_ECDH_anon_WITH_RC4_128_SHA
TLS_RSA_WITH_RC4_128_MD5
TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_SEED_CBC_SHA

'Weak' cipher suites accepted by this service via the TLSv1.2 protocol:

TLS_DH_anon_WITH_RC4_128_MD5
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_ECDH_anon_WITH_RC4_128_SHA
TLS_RSA_WITH_RC4_128_MD5
TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_SEED_CBC_SHA

Re: Zimbra 8.7.11 SSL/TLS Cipher Suites

Posted: Wed Oct 25, 2017 7:21 pm
by L. Mark Stone
Did you restart Postfix?

zmmtactl restart

All the best,
Mark

Re: Zimbra 8.7.11 SSL/TLS Cipher Suites

Posted: Thu Oct 26, 2017 6:07 am
by iodisciple
Yes, the whole server has been rebooted since.

Re: Zimbra 8.7.11 SSL/TLS Cipher Suites

Posted: Thu Oct 26, 2017 1:55 pm
by L. Mark Stone
iodisciple wrote:Yes, the whole server has been rebooted since.
I'd say it's time to open a ticket with Zimbra Support then.
All times are UTC
Page 1 of 2

Powered by phpBB® Forum Software © phpBB Limited