Subject: [dane] Postfix Ubuntu packages with DANE support

From: Ondřej Surý <[email-masked]>
Date: Fri, 2 Aug 2013 11:02:28 +0200

Hey all (with my Debian Developer hat on),

I have created an Ubuntu PPA repository with Postfix 2.11-development snapshot
with DANE support in case you are running Ubuntu and you are too lazy to
compile from the source:

https://launchpad.net/~ondrej/+archive/postfix+dane

I'll probably do the same for Debian in near future, but I don't have a sensible
infrastructure at this moment (since Debian doesn't have something similar to
PPA yet).

And if you are even lazier and don't want to read the docs, just drop:

smtp_dns_support_level = dnssec
smtp_tls_security_level = dane
smtp_tls_loglevel = 1

to your main.cf and restart postfix.

Then the log would should this:

Aug  2 10:35:49 jedi postfix/smtp[24161]: Verified TLS connection established to mail.nic.cz[217.31.204.67]:25: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)

Aug  2 10:38:06 jedi postfix/smtp[24161]: Verified TLS connection established to mailly.debian.org[2001:41b8:202:deb:6564:a62:52c3:4b72]:25: TLSv1.2 with cipher DHE-RSA-AES256-SHA256 (256/256 bits)

for DANE verified TLS.

or this:

Aug  2 10:46:54 jedi postfix/smtp[24300]: Untrusted TLS connection established to aspmx.l.google.com[2a00:1450:4001:c02::1b]:25: TLSv1.2 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)

for no TLSA.

Ondrej
--
 Ondřej Surý -- Chief Science Officer
 -------------------------------------------
 CZ.NIC, z.s.p.o.    --    Laboratoře CZ.NIC
 Americka 23, 120 00 Praha 2, Czech Republic
 mailto:[email-masked]    http://nic.cz/
 tel:+420.222745110       fax:+420.222745112
 -------------------------------------------

---

From: Viktor Dukhovni <[email-masked]>
Date: Mon, 26 Aug 2013 18:13:33 +0000

> with DANE support in case you are running Ubuntu and you are too lazy to

I also notice that nic.cz now has working TLSA RRs for SMTP.
Thanks.  I recall some consensus at IETF Berlin to have ietf.org
enable TLS with DANE for SMTP.  Is that likely to move forward?

In the mean-time, Postfix 2.11-20130825 contains all my DANE patches,
so on platforms other than Debian you can build directly from
Wietse's source.   Debian modifies Postfix to dynamically load
table drivers, ... so some additional tweaks are required to build
Postfix for Debian or Ubuntu systems.

-- 
	Viktor.

---

From: Warren Kumari <[email-masked]>
Date: Mon, 26 Aug 2013 15:18:24 -0400

> enable TLS with DANE for SMTP.  Is that likely to move forward?

Yes. 

A few participants suggested that the folk running the IETF infrastructure monitor for $something when enabling this. AFAIR, $someone[0] was supposed to provide some things to monitor for…

We also still have the issue that mail.ietf.org:
250-ietfa.amsl.com
250-PIPELINING
250-SIZE 67108864
250-ETRN
250-AUTH LOGIN PLAIN
250-AUTH=LOGIN PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

is missing STARTTLS :-(

I have a todo to poke someone about this, but got sidetracked… Will do so now...

W

> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane
> 

--
"Go on, prove me wrong. Destroy the fabric of the universe. See if I care."  -- Terry Prachett

---

From: Viktor Dukhovni <[email-masked]>
Date: Mon, 26 Aug 2013 19:33:17 +0000

On Mon, Aug 26, 2013 at 03:18:24PM -0400, Warren Kumari wrote:

> A few participants suggested that the folk running the IETF
> infrastructure monitor for $something when enabling this. AFAIR,
> $someone[0] was supposed to provide some things to monitor for?

If they implement in stages:

  - The first step is to configure a suitable self-signed certificate
    for the SMTP server and enable STARTTLS.  Some small fraction
    of SMTP connections will fail the TLS handshake.  Generally the
    sending system will fallback to plaintext and deliver anyway.
    One can monitor the logs to identify any systems that consistently
    fail to establish a TLS connection, and gather statistics on the
    source IPs and frequency.

  - The second step is to publish corresponding TLSA RRs (either
    3 1 1 for a self-signed cert, or 2 1 1 if they elect instead to go
    with some issuing CA).  At this point one can monitor for any changes
    in the frequency of failed TLS sessions.

It should also be noted that some (for example Postfix) SMTP clients
will not abort the TLS handshake when server authentication fails.
Rather, the TLS handshake will be completed, and the client will
send a "QUIT" to gracefully close the session at the SMTP layer.
Therefore, they should also monitor for connections that close
gracefully without delivering any mail.

-- 
	Viktor.

---

From: Warren Kumari <[email-masked]>
Date: Mon, 26 Aug 2013 17:39:23 -0400

On Aug 26, 2013, at 3:33 PM, Viktor Dukhovni <[email-masked]> wrote:

>    for the SMTP server and enable STARTTLS.  

I received a reply from the AMS folk (who, as always, are friendly and helpful)
Part of the delay[0] is that the IETF server infrastructure is in the process of being upgraded.
New machines are being deployed, and then there will be some config / tuning / testing. Hopefully the new stuff will be ready sometime mid-September, and then we can continue.

> Some small fraction

Cool.

W
[0]: Yeah, it's a tiny bit -- the huge majority is me getting sidetracked and not, you know, actually asking them till now :-)

--
There were such things as dwarf gods. Dwarfs were not a naturally religious species, but in a world where pit props could crack without warning and pockets of fire damp could suddenly explode they'd seen the need for gods as the sort of supernatural equivalent of a hard hat. Besides, when you hit your thumb with an eight-pound hammer it's nice to be able to blaspheme. It takes a very special and straong-minded kind of atheist to jump up and down with their hand clasped under their other armpit and shout, "Oh, random-fluctuations-in-the-space-time-continuum!" or "Aaargh, primitive-and-outmoded-concept on a crutch!"
  -- Terry Pratchett

---

From: Scott Kitterman <[email-masked]>
Date: Mon, 26 Aug 2013 21:26:46 -0400

On Monday, August 26, 2013 18:13:33 Viktor Dukhovni wrote:
> > I have created an Ubuntu PPA repository with Postfix 2.11-development
> > snapshot with DANE support in case you are running Ubuntu and you are too
> > lazy to
> > compile from the source:

We should have a current snapshot in Debian experimental built with the Debian 
modifications in the next day or two.

Scott K

---

From: Scott Kitterman <[email-masked]>
Date: Sat, 31 Aug 2013 12:59:38 -0400

On Monday, August 26, 2013 21:26:46 Scott Kitterman wrote:
> We should have a current snapshot in Debian experimental built with the
> Debian modifications in the next day or two.

It took slightly longer, but this is now done as well.  

Scott K