Re: [exim] checking MX (was: if you use openssl v3+ with exim)

2022-12-09 Thread exim--- via Exim-users
On Fri, Dec 09, 2022, Andrew C Aitchison via Exim-users wrote: > # host -t mx circuit.inbus.at. > circuit.inbus.at has no MX record Try host -t mx inbus.at. -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki

Re: [exim] if you use openssl v3+ with exim

2022-12-09 Thread Andrew C Aitchison via Exim-users
On Fri, 9 Dec 2022, Cyborg via Exim-users wrote: The issue is reproduceable with openssl s_client directly: openssl s_client -connect 82.218.176.66:25 -starttls smtp I am not going to report the testssl results I got for that host:port here, but they are very worrying. Marius, do you have a

Re: [exim] if you use openssl v3+ with exim

2022-12-09 Thread Viktor Dukhovni via Exim-users
On Fri, Dec 09, 2022 at 07:55:42PM +0100, Cyborg via Exim-users wrote: > Guys, it was just a FYI without the FYI mark. I will add it next time :) Yeah, that could have been helpful. > There is nothing exim can do or should do. It's 100% caused by > outdated legacy servers, ignoring the year

Re: [exim] if you use openssl v3+ with exim

2022-12-09 Thread Cyborg via Exim-users
Am 09.12.22 um 18:22 schrieb Viktor Dukhovni via Exim-users: Are there any destination domains or MX hostnames you're willing and able to share which exhibit this issue? If this is reproducible also with e.g. Postfix and other MTAs, then there's nothing here for Exim to do. The remote server

Re: [exim] if you use openssl v3+ with exim

2022-12-09 Thread Viktor Dukhovni via Exim-users
On Fri, Dec 09, 2022 at 05:51:17PM +0100, Cyborg via Exim-users wrote: > If a TLS connect is done to an outdated server using the old > renegotiation methode, openssl 3 ends the connection with that error > message. > so, if you use openssl 3 and see this error message: > > 2022-12-09 10:23:22

Re: [exim] if you use openssl v3+ with exim

2022-12-09 Thread Cyborg via Exim-users
Am 09.12.22 um 13:21 schrieb Jeremy Harris via Exim-users: On 09/12/2022 10:43, Jeremy Harris via Exim-users wrote: The message looks like a courtesy note only, saying "I'm no longer prepared to TLS-renegotiate this sort of connection"; something that TLS endpoints have always been 

Re: [exim] if you use openssl v3+ with exim

2022-12-09 Thread Jeremy Harris via Exim-users
On 09/12/2022 10:43, Jeremy Harris via Exim-users wrote: The message looks like a courtesy note only, saying "I'm no longer prepared to TLS-renegotiate this sort of connection"; something that TLS endpoints have  always been permitted to do for any class of TLS connection, and not implying a 

Re: [exim] if you use openssl v3+ with exim

2022-12-09 Thread Jeremy Harris via Exim-users
On 09/12/2022 10:33, Cyborg via Exim-users wrote: since Fedora switched to openssl 3 (3.0.5 atm) we encounter these messages: TLS session: (SSL_connect): error:0A000152:SSL routines::unsafe legacy renegotiation disabled For SMTP/TLS? Involving Exim? The message looks like a courtesy note

[exim] if you use openssl v3+ with exim

2022-12-09 Thread Cyborg via Exim-users
Hi all, since Fedora switched to openssl 3 (3.0.5 atm) we encounter these messages: TLS session: (SSL_connect): error:0A000152:SSL routines::unsafe legacy renegotiation disabled This is connected to a 2009 CVE against common SSL libs ( nss, openssl etc.) using an insecure form of

Re: [exim] dkim=fail (body hash mismatch; body probably modified in transit)

2022-12-09 Thread Slavko via Exim-users
Dňa 9. 12. o 8:49 Victor Sudakov via Exim-users napísal(a): Slavko via Exim-users wrote: Dňa 9. 12. o 5:15 Victor Sudakov via Exim-users napísal(a): > I've just sent two messages to you with Message-IDs and I got both and both has DKIM=pass in both, the exim (4.94.2) and rspamd What OS