Re: [qmailtoaster] dh_key_too_small

2024-07-11 Thread Eric Broch 

you could also try to change the cipher list in qmail

# openssl ciphers 'MEDIUM:HIGH:!SSLv2:!MD5:!RC4:!3DES:!DH' &> myciphers

or

# openssl ciphers 'DEFAULT:!DH' &> myciphers

# cp -p /var/qmail/control/tlsserverciphers 
/var/qmail/control/tlsserverciphers.bak


# cp myciphers /var/qmail/control/tlsserverciphers (preserves permissions).

Keep me apprised.


On 7/11/2024 7:29 PM, Eric Broch wrote:


Could you try setting the policy like so:

update-crypto-policies --set DEFAULT



On 7/11/2024 1:43 PM, Chris Knight wrote:

update-crypto-policies --check

Re: [qmailtoaster] dh_key_too_small

2024-07-11 Thread Eric Broch 

Could you try setting the policy like so:

update-crypto-policies --set DEFAULT



On 7/11/2024 1:43 PM, Chris Knight wrote:

update-crypto-policies --check

Re: [qmailtoaster] dh_key_too_small

2024-07-11 Thread Chris Knight 



# rpm -qa |grep \\.qt
qmt-release-1-8.qt.el9.noarch
dspam-libs-3.10.2-36.qt.el9.x86_64
dspam-3.10.2-36.qt.el9.x86_64
dspam-web-3.10.2-36.qt.el9.x86_64
dspam-mysql-3.10.2-36.qt.el9.x86_64
dspam-client-3.10.2-36.qt.el9.x86_64
ezmlm-0.53.324-3.qt.el9.x86_64
libsrs2-1.0.18-1.qt.el9.x86_64
control-panel-0.5.1-3.qt.el9.x86_64
vpopmail-5.4.33-5.qt.el9.x86_64
ucspi-tcp-0.88-1.qt.el9.x86_64
spamdyke-5.0.1-6.qt.el9.x86_64
daemontools-0.76-1.qt.el9.x86_64
qmail-1.03-3.3.11.qt.el9.x86_64
autorespond-2.0.5-1.qt.el9.x86_64
qmailadmin-1.2.16-5.2.qt.el9.x86_64
simscan-1.4.0-10.qt.el9.x86_64
squirrelmail-1.4.23-1.qt.el9.20220805.noarch
vqadmin-2.3.7-4.qt.el9.x86_64
qmailmrtg-4.2-4.qt.el9.x86_64
ezmlm-cgi-0.53.324-3.qt.el9.x86_64
isoqlog-2.2.1-4.qt.el9.x86_64
libsrs2-devel-1.0.18-1.qt.el9.x86_64
ripmime-1.4.0.10-7.qt.el9.x86_64


> On Jul 11, 2024, at 10:06 AM, Eric Broch  wrote:
> 
> What version of qt?
> 
> # rpm -qa |grep \\.qt
> 
> On 7/10/2024 2:22 PM, Boheme wrote:
>> How recent was that?  I only built this server in the last month or so.
>> 
>> 
>> -Sent from my Pip-Boy 3000
>> 
>>> On 11 Jul 2024, at 1:50 AM, Eric Broch  wrote:
>>> 
>>> Chris,
>>> 
>>> As of qmail-1.03-3.3.10 the dh and rsa key requirements have been removed 
>>> from qmail-smtpd and qmail-remote per openssl policies.
>>> 
>>> Is this happening when receiving or sending mail or both? If when receiving 
>>> mail do you have spamdyke in place?
>>> 
>>> Eric
>>> 
 On 7/9/2024 3:15 PM, Chris Knight wrote:
 
>> On Jul 10, 2024, at 1:34 AM, Eric Broch  wrote:
> What system are you on? OS, qmt, etc...
 System:
 NAME="Rocky Linux"
 VERSION="9.4 (Blue Onyx)"
 ID="rocky"
 ID_LIKE="rhel centos fedora"
 VERSION_ID="9.4"
 PLATFORM_ID="platform:el9"
 PRETTY_NAME="Rocky Linux 9.4 (Blue Onyx)"
 ANSI_COLOR="0;32"
 LOGO="fedora-logo-icon"
 CPE_NAME="cpe:/o:rocky:rocky:9::baseos"
 HOME_URL="https://rockylinux.org/";
 BUG_REPORT_URL="https://bugs.rockylinux.org/";
 SUPPORT_END="2032-05-31"
 ROCKY_SUPPORT_PRODUCT="Rocky-Linux-9"
 ROCKY_SUPPORT_PRODUCT_VERSION="9.4"
 REDHAT_SUPPORT_PRODUCT="Rocky Linux"
 REDHAT_SUPPORT_PRODUCT_VERSION=“9.4"
 
 
 qmt:  qmt-release-1-8.qt.el9
 
 
 
 
> On 7/8/2024 11:43 PM, Chris wrote:
>> Back in 2020 there was a thread about mail delivery deferrals with the 
>> message "dh key too small'.  Well, I've got them on the toaster I just 
>> put into production.
>> 
>> TLS_connect_failed:_error:0A00018A:SSL_routines::dh_key_too_small
>> 
>> The advise at the time was to check the crypto policy 
>> (update-crypto-policies --show) and to set to LEGACY if that's not the 
>> case.
>> 
>> # update-crypto-policies --show
>> LEGACY
>> 
>> # update-crypto-policies --is-applied
>> The configured policy is applied
>> 
>> # update-crypto-policies --check
>> The configured policy matches the generated policy
>> 
>> These tests indicate I am using legacy settings, but I am still getting 
>> these delivery issues.
>> 
>> Any suggestions?
 -
 To unsubscribe, e-mail: [email protected]
 For additional commands, e-mail: [email protected]
 
>>> -
>>> To unsubscribe, e-mail: [email protected]
>>> For additional commands, e-mail: [email protected]
>>> 
>> -
>> To unsubscribe, e-mail: [email protected]
>> For additional commands, e-mail: [email protected]
>> 
> 
> -
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
> 


-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Re: [qmailtoaster] dh_key_too_small

2024-07-10 Thread Eric Broch 

What version of qt?

# rpm -qa |grep \\.qt

On 7/10/2024 2:22 PM, Boheme wrote:

How recent was that?  I only built this server in the last month or so.


-Sent from my Pip-Boy 3000


On 11 Jul 2024, at 1:50 AM, Eric Broch  wrote:

Chris,

As of qmail-1.03-3.3.10 the dh and rsa key requirements have been removed from 
qmail-smtpd and qmail-remote per openssl policies.

Is this happening when receiving or sending mail or both? If when receiving 
mail do you have spamdyke in place?

Eric


On 7/9/2024 3:15 PM, Chris Knight wrote:


On Jul 10, 2024, at 1:34 AM, Eric Broch  wrote:

What system are you on? OS, qmt, etc...

System:
NAME="Rocky Linux"
VERSION="9.4 (Blue Onyx)"
ID="rocky"
ID_LIKE="rhel centos fedora"
VERSION_ID="9.4"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Rocky Linux 9.4 (Blue Onyx)"
ANSI_COLOR="0;32"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:rocky:rocky:9::baseos"
HOME_URL="https://rockylinux.org/";
BUG_REPORT_URL="https://bugs.rockylinux.org/";
SUPPORT_END="2032-05-31"
ROCKY_SUPPORT_PRODUCT="Rocky-Linux-9"
ROCKY_SUPPORT_PRODUCT_VERSION="9.4"
REDHAT_SUPPORT_PRODUCT="Rocky Linux"
REDHAT_SUPPORT_PRODUCT_VERSION=“9.4"


qmt:  qmt-release-1-8.qt.el9





On 7/8/2024 11:43 PM, Chris wrote:

Back in 2020 there was a thread about mail delivery deferrals with the message 
"dh key too small'.  Well, I've got them on the toaster I just put into 
production.

TLS_connect_failed:_error:0A00018A:SSL_routines::dh_key_too_small

The advise at the time was to check the crypto policy (update-crypto-policies 
--show) and to set to LEGACY if that's not the case.

# update-crypto-policies --show
LEGACY

# update-crypto-policies --is-applied
The configured policy is applied

# update-crypto-policies --check
The configured policy matches the generated policy

These tests indicate I am using legacy settings, but I am still getting these 
delivery issues.

Any suggestions?

-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]


-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]


-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]



-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Re: [qmailtoaster] dh_key_too_small

2024-07-10 Thread Boheme 
How recent was that?  I only built this server in the last month or so. 


-Sent from my Pip-Boy 3000

> On 11 Jul 2024, at 1:50 AM, Eric Broch  wrote:
> 
> Chris,
> 
> As of qmail-1.03-3.3.10 the dh and rsa key requirements have been removed 
> from qmail-smtpd and qmail-remote per openssl policies.
> 
> Is this happening when receiving or sending mail or both? If when receiving 
> mail do you have spamdyke in place?
> 
> Eric
> 
>> On 7/9/2024 3:15 PM, Chris Knight wrote:
>> 
 On Jul 10, 2024, at 1:34 AM, Eric Broch  wrote:
>>> 
>>> What system are you on? OS, qmt, etc...
>> 
>> System:
>> NAME="Rocky Linux"
>> VERSION="9.4 (Blue Onyx)"
>> ID="rocky"
>> ID_LIKE="rhel centos fedora"
>> VERSION_ID="9.4"
>> PLATFORM_ID="platform:el9"
>> PRETTY_NAME="Rocky Linux 9.4 (Blue Onyx)"
>> ANSI_COLOR="0;32"
>> LOGO="fedora-logo-icon"
>> CPE_NAME="cpe:/o:rocky:rocky:9::baseos"
>> HOME_URL="https://rockylinux.org/";
>> BUG_REPORT_URL="https://bugs.rockylinux.org/";
>> SUPPORT_END="2032-05-31"
>> ROCKY_SUPPORT_PRODUCT="Rocky-Linux-9"
>> ROCKY_SUPPORT_PRODUCT_VERSION="9.4"
>> REDHAT_SUPPORT_PRODUCT="Rocky Linux"
>> REDHAT_SUPPORT_PRODUCT_VERSION=“9.4"
>> 
>> 
>> qmt:  qmt-release-1-8.qt.el9
>> 
>> 
>> 
>> 
>>> On 7/8/2024 11:43 PM, Chris wrote:
 Back in 2020 there was a thread about mail delivery deferrals with the 
 message "dh key too small'.  Well, I've got them on the toaster I just put 
 into production.
 
 TLS_connect_failed:_error:0A00018A:SSL_routines::dh_key_too_small
 
 The advise at the time was to check the crypto policy 
 (update-crypto-policies --show) and to set to LEGACY if that's not the 
 case.
 
 # update-crypto-policies --show
 LEGACY
 
 # update-crypto-policies --is-applied
 The configured policy is applied
 
 # update-crypto-policies --check
 The configured policy matches the generated policy
 
 These tests indicate I am using legacy settings, but I am still getting 
 these delivery issues.
 
 Any suggestions?
>> 
>> -
>> To unsubscribe, e-mail: [email protected]
>> For additional commands, e-mail: [email protected]
>> 
> 
> -
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
> 

-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Re: [qmailtoaster] dh_key_too_small

2024-07-10 Thread Eric Broch 
If you upgrade to the latest spamdyke >= 5.0.1-6 and qmail >= 
1.03-3.3.10 you should not have issues as both don't use dh keys.



On 7/10/2024 7:50 AM, Eric Broch wrote:

Chris,

As of qmail-1.03-3.3.10 the dh and rsa key requirements have been 
removed from qmail-smtpd and qmail-remote per openssl policies.


Is this happening when receiving or sending mail or both? If when 
receiving mail do you have spamdyke in place?


Eric

On 7/9/2024 3:15 PM, Chris Knight wrote:


On Jul 10, 2024, at 1:34 AM, Eric Broch  
wrote:


What system are you on? OS, qmt, etc...


System:
NAME="Rocky Linux"
VERSION="9.4 (Blue Onyx)"
ID="rocky"
ID_LIKE="rhel centos fedora"
VERSION_ID="9.4"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Rocky Linux 9.4 (Blue Onyx)"
ANSI_COLOR="0;32"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:rocky:rocky:9::baseos"
HOME_URL="https://rockylinux.org/";
BUG_REPORT_URL="https://bugs.rockylinux.org/";
SUPPORT_END="2032-05-31"
ROCKY_SUPPORT_PRODUCT="Rocky-Linux-9"
ROCKY_SUPPORT_PRODUCT_VERSION="9.4"
REDHAT_SUPPORT_PRODUCT="Rocky Linux"
REDHAT_SUPPORT_PRODUCT_VERSION=“9.4"


qmt:  qmt-release-1-8.qt.el9





On 7/8/2024 11:43 PM, Chris wrote:
Back in 2020 there was a thread about mail delivery deferrals with 
the message "dh key too small'.  Well, I've got them on the toaster 
I just put into production.


TLS_connect_failed:_error:0A00018A:SSL_routines::dh_key_too_small

The advise at the time was to check the crypto policy 
(update-crypto-policies --show) and to set to LEGACY if that's not 
the case.


# update-crypto-policies --show
LEGACY

# update-crypto-policies --is-applied
The configured policy is applied

# update-crypto-policies --check
The configured policy matches the generated policy

These tests indicate I am using legacy settings, but I am still 
getting these delivery issues.


Any suggestions?


-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]



-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]



-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Re: [qmailtoaster] dh_key_too_small

2024-07-10 Thread Eric Broch 

Chris,

As of qmail-1.03-3.3.10 the dh and rsa key requirements have been 
removed from qmail-smtpd and qmail-remote per openssl policies.


Is this happening when receiving or sending mail or both? If when 
receiving mail do you have spamdyke in place?


Eric

On 7/9/2024 3:15 PM, Chris Knight wrote:



On Jul 10, 2024, at 1:34 AM, Eric Broch  wrote:

What system are you on? OS, qmt, etc...


System:
NAME="Rocky Linux"
VERSION="9.4 (Blue Onyx)"
ID="rocky"
ID_LIKE="rhel centos fedora"
VERSION_ID="9.4"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Rocky Linux 9.4 (Blue Onyx)"
ANSI_COLOR="0;32"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:rocky:rocky:9::baseos"
HOME_URL="https://rockylinux.org/";
BUG_REPORT_URL="https://bugs.rockylinux.org/";
SUPPORT_END="2032-05-31"
ROCKY_SUPPORT_PRODUCT="Rocky-Linux-9"
ROCKY_SUPPORT_PRODUCT_VERSION="9.4"
REDHAT_SUPPORT_PRODUCT="Rocky Linux"
REDHAT_SUPPORT_PRODUCT_VERSION=“9.4"


qmt:  qmt-release-1-8.qt.el9





On 7/8/2024 11:43 PM, Chris wrote:

Back in 2020 there was a thread about mail delivery deferrals with the message 
"dh key too small'.  Well, I've got them on the toaster I just put into 
production.

TLS_connect_failed:_error:0A00018A:SSL_routines::dh_key_too_small

The advise at the time was to check the crypto policy (update-crypto-policies 
--show) and to set to LEGACY if that's not the case.

# update-crypto-policies --show
LEGACY

# update-crypto-policies --is-applied
The configured policy is applied

# update-crypto-policies --check
The configured policy matches the generated policy

These tests indicate I am using legacy settings, but I am still getting these 
delivery issues.

Any suggestions?


-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]



-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Re: [qmailtoaster] dh_key_too_small

2024-07-09 Thread Chris Knight 



> On Jul 10, 2024, at 1:34 AM, Eric Broch  wrote:
> 
> What system are you on? OS, qmt, etc...


System:
NAME="Rocky Linux"
VERSION="9.4 (Blue Onyx)"
ID="rocky"
ID_LIKE="rhel centos fedora"
VERSION_ID="9.4"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Rocky Linux 9.4 (Blue Onyx)"
ANSI_COLOR="0;32"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:rocky:rocky:9::baseos"
HOME_URL="https://rockylinux.org/";
BUG_REPORT_URL="https://bugs.rockylinux.org/";
SUPPORT_END="2032-05-31"
ROCKY_SUPPORT_PRODUCT="Rocky-Linux-9"
ROCKY_SUPPORT_PRODUCT_VERSION="9.4"
REDHAT_SUPPORT_PRODUCT="Rocky Linux"
REDHAT_SUPPORT_PRODUCT_VERSION=“9.4"


qmt:  qmt-release-1-8.qt.el9




> On 7/8/2024 11:43 PM, Chris wrote:
>> Back in 2020 there was a thread about mail delivery deferrals with the 
>> message "dh key too small'.  Well, I've got them on the toaster I just put 
>> into production.
>> 
>> TLS_connect_failed:_error:0A00018A:SSL_routines::dh_key_too_small
>> 
>> The advise at the time was to check the crypto policy 
>> (update-crypto-policies --show) and to set to LEGACY if that's not the case. 
>>  
>> 
>> # update-crypto-policies --show
>> LEGACY
>> 
>> # update-crypto-policies --is-applied
>> The configured policy is applied
>> 
>> # update-crypto-policies --check
>> The configured policy matches the generated policy
>> 
>> These tests indicate I am using legacy settings, but I am still getting 
>> these delivery issues.  
>> 
>> Any suggestions?


-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Re: [qmailtoaster] dh_key_too_small

2024-07-09 Thread Eric Broch 

What system are you on? OS, qmt, etc...

On 7/8/2024 11:43 PM, Chris wrote:
Back in 2020 there was a thread about mail delivery deferrals with the 
message "dh key too small'.  Well, I've got them on the toaster I just 
put into production.


TLS_connect_failed:_error:0A00018A:SSL_routines::dh_key_too_small

The advise at the time was to check the crypto policy 
(update-crypto-policies --show) and to set to LEGACY if that's not the 
case.


# update-crypto-policies --show
LEGACY

# update-crypto-policies --is-applied
The configured policy is applied

# update-crypto-policies --check
The configured policy matches the generated policy

These tests indicate I am using legacy settings, but I am still 
getting these delivery issues.


Any suggestions?