10
SmarterTools e-mail about TLS
Question asked by Sébastien Riccio - 4/6/2021 at 4:21 PM
Unanswered
Hello,

As many of you fellow SmarterMail users, I've received an informational e-mail about TLS and disabling TLS 1.0 and 1.1.

I would like to have more informations about what are the facts behind this declaration:

But the fact remains that if you continue allowing TLS 1.0/1.1 connections to and from your servers you will start seeing a variety of issues. These include:
  • Delivery delays of your messages.
  • Messages being outright rejected by receiving servers.
  • Connections to servers timing out.
  • Mail building up in your spool.
  • The complete inability to connect to servers, websites and services.
I personally agree that these clunky versions of TLS should be avoided but in really it's not that easy.

For inter-server exchanges (SMTP):
As far as I know when establishing a connection, both servers or both the server and the client negotiate a protocol/cipher starting by the strongest available to the weakest and that are supported by both. 
So if the remote server or client doesn't support TLS 1.2, disabling 1.1 and 1.0 will fail the negotiation and drop the connection.
As far as I know the sad reality is that there are many outdated remote servers that doesn't event support 1.2 (not even talking about 1.3) so disabling 1.0/1.1 will likely introduce more issues than it already exists.

Also if I'm not wrong, disabling TLS 1.0/TLS 1.1 this will also affect connections from mail clients on all protocols (IMAP, POP, SUBMISSION) if their software is outdated and not easily updatable, also for hardware like scanners that have old firmware.
Until updated, these would need to disable TLS and I'm not really sure switching back to plain unencrypted is a better option.

By the way, if it doesn't exists yet, It would be an interesting project to scan the internet for SMTP servers and generate a global report of the percent of supported TLS versions.

I would like to understand how you would handle issues with the remove servers that are outdated and customers with old hardware in case of completly disabling these old TLS versions ? Am I missing something ?

Kind regards.
Sébastien Riccio
System & Network Admin

8 Replies

Reply to Thread
1
Kyle Kerst Replied
Employee Post
Sebastien, I just wanted to comment here to provide some feedback based on what I've seen done on this front. What I usually see implemented to handle this is that the primary email server environment has TLS 1.0/1.1 disabled, and then a secondary MX is allowed to retain these versions so that an alternative delivery point exists for these older environments that can't be updated right away. This gateway environment should be configured to perform additional antivirus and antispam checks against this mail to account for the fact that it came in on a potentially risky environment. I hope this helps!
Kyle Kerst IT Coordinator SmarterTools Inc. www.smartertools.com
2
kevind Replied
Sébastien, great post!  Those are good comments and questions to achieve the highest security with most compatibility.

Kyle, from your post, is this the best hybrid solution?
  • Disable TLS 1.0/1.1 on primary server, make it 2nd MX.
  • Enable TLS 1.0/1.1 on gateway server, make it 1st MX.
  • Is SMTP smart enough to try backup MX if 1st MX doesn't support TLS 1.0?
Wonder if there's a way to disable TLS 1.0/1.1 for inbound messages, but leave enabled on IMAP/SMTP for users with old software?  Also, just curious how Google & Microsoft handle this.
1
Kyle Kerst Replied
Employee Post
Hello Kevin, and thanks for your follow up questions on this. The way I would set this up is as follows: 
  • Primary SM server is main MX record and has TLS 1.0/1.1 disabled
  • Secondary SM server (gateway) is secondary (lower priority) MX record with TLS 1.0/1.1 enabled and more stringent security for incoming messages. 
In this set up external mail servers will first attempt delivery to the primary mail server, and when TLS negotiation fails should then retry on the secondary MX record at which point they'll successfully negotiate TLS and complete the handoff. I hope this helps :)
Kyle Kerst IT Coordinator SmarterTools Inc. www.smartertools.com
1
Rod Strumbel Replied
And by allowing this continue, we will NEVER get off the TLS 1.0/1.1 technology.
If it ain't broke, why fix it.
In 30 years in the industry I've seen this time and time again.

TLS 1.2 has been around since 2008.
You do realize that is over 10 years ago right ?

There comes a time when you must simply say enough is enough and make the change without providing a safety net for old versions.  The number of non-supported systems is going to be so small, just move on.
0
Kyle Kerst Replied
Employee Post
Rod, while I completely agree with the sentiment here, making these changes in the real world is often more tricky than it sounds. With Government and other industries requiring months or even years of testing to take place before they roll out new versions, this could mean that receiving emails from one of these clients may be impossible or at least significantly delayed. Does that mean they should get a free pass for using older insecure versions of SSL and TLS? Absolutely not, but there should be some part of your deployment which is set up to handle these edge cases and allow that mail to safely get where its going, albeit with some additional scrutiny being applied to it!
Kyle Kerst IT Coordinator SmarterTools Inc. www.smartertools.com
1
Rod Strumbel Replied
KEVIND - ZDnet article here:

While that is targeted at the O365 family of products, it discusses some generality as well

And from Microsoft Directly:

1
Sébastien Riccio Replied
Hello Kyle,

Sebastien, I just wanted to comment here to provide some feedback based on what I've seen done on this front. What I usually see implemented to handle this is that the primary email server environment has TLS 1.0/1.1 disabled, and then a secondary MX is allowed to retain these versions so that an alternative delivery point exists for these older environments that can't be updated right away. This gateway environment should be configured to perform additional antivirus and antispam checks against this mail to account for the fact that it came in on a potentially risky environment. I hope this helps! 

Yes this could indeed be a trick, assuming that all MXs servers (incl. SmarterMail) are trying the alternatives MXs when a TLS issue is encountered. In theory they should, it's how it should be.
However this doesn't address the issue of customers having old hardware devices -- there are more than we think -- that are not supporting TLS 1.2 to submit mails through SMTP.

We can't really force customers to change their hardware because we disable something that was working before.

If I'm not wrong it will also affect pop/imap STARTTLS or implicit SSL and can cause issue with outdated mail clients that aren't upgradable due to different reasons.

Maybe it would be handy to be able to disable allowed TLS per service/protocol so it's not just globally on/off.

Also having in SmarterMail a tracking/chart about the used TLS versions so we can have a global view of the impact it would have to shut down older versions.

In all case we should inform customers first that support for TLS 1.2 will be mandatory and be ready to assist them resolve their issues.

As for this:
  • Delivery delays of your messages.
  • Messages being outright rejected by receiving servers.
  • Connections to servers timing out.
  • Mail building up in your spool.
  • The complete inability to connect to servers, websites and services.
Do you have the source information that leads to these assumption. I'm a bit surprised because on the other mail servers we run (postfix/dovecot) we still support TLS 1.0->1.3 and have seen no evidence of TLS negotiation issues due to this.

Kind regards.
Sébastien Riccio System & Network Admin https://swisscenter.com
1
Douglas Foster Replied
I think the warning is just incorrect.    Servers will negotiate to the highest encryption level available, and there is more to the encryption stack than just TLS versions.   If your servers talk TLS1.2 and older versions, devices that requires TLS1.2 will connect with TLS1.2, and devices that cannot use TLS1.2 will negotiate down to an earlier version.   I have no theory or evidence that running TLS1.0 creates an interoperability problem.

It DOES create a policy problem.   For example, PCI DSS scanners will throw a tantrum when they see TLS1.0, and your ability to negotiate an exception may be limited.

Let's examine the vulnerabilities:
1) For encryption to be useful, you must know that you are talking to the correct endpoint.   If a malicious router has diverted your traffic to a rogue server, encrypting the session with that server is useless.   The only way to have certain identity for outbound mail is to require verification of the server certificate.   SM cannot do this at present.   My untested expectation is that many destination servers use self-signed or expired certificates, and if you refuse to talk to them you will have more problems than you can handle.

2) TLS1.0 and TLS1.1 are vulnerable to a two-stage attack, where a man-in-the-middle first tricks both ends to downgrade from TLS1.2, then uses additional tricks to decrypt the traffic between them.    If you use Kyle's suggestion, you have not solved the problem.  If the man-in-the-middle attacker blocks the TLS1.2 connection to the first gateway, when the connection is retried on the second gateway his downgrade attack will proceed as originally planned.  Of course, traffic interception only matters for messages that are "imporant", which is in the eye of the beholder.   In general, intercepted data becomes more useful as the volume increases, even if each individual message is low risk.   

3) If you require either or both certificate verification and TLS1.2, your fallback options are limited when there is a failure.
(a) You can use no encryption, which simplifies both types of attacks because you cannot verify the remote server identity and you cannot prevent interception (or even manipulation) by a middleman.   
(b) You can refuse to send or receive with the domains that cannot do TLS1.2.
(c) You can use end-to-end encryption like S/MIME or PGP, in which case the transport layer does not matter, but the other user must also be able to handle those methods.

Security talks about Confidentiality, Integrity, and Availability.   Certificate verification and TLS1.2 improve confidentiality and integrity, but they damage availability.   So it is a policy call.

Our solution has been to use a third-party outbound gateway that can do web relay.   We require TLS on all outbound connections.   Domains that cannot do any encryption are added to a list which activates web relay for any traffic to that domain.   It reduces our corporate risk if an employee sends regulated content through email.  For inbound messages, we still accept unencrypted, but we are not in Europe and not subject to GDPR.

I strongly believe in using an Inbound Gateway to distinguish between unauthenticated SMTP from the Internet and authenticated SMTP from email clients.   Then you add Declude to both servers, because it will log the Received header (including encryption details) for each message (depending on log level selection).   Then you parse the Declude logs to detect who is and is not using TLS1.2.   There are other benefits to having this separation of duties:
- spam filtering configuration is likely to be very different between Internet sources and client sources.   You don't need to worry about SPF, DMARC, etc for authenticated users.
- Attempts to use authenticated SMTP on an incoming gateway can be used as a honeytrap to detect and block hostile servers (see my post about this).
I am sure there are others

 

Reply to Thread