Subject: [dane] Meeting at IETF89 (London).

From: Warren Kumari <[email-masked]>
Date: Thu, 16 Jan 2014 10:58:16 -0500

Hi all,

We have requested a 2 hour DNAE session in London.

It has been a while since we met -- please get your agenda requests in...
Preference is given to already discussed drafts, things that need face
to face time, etc.

A very quick update on the DANE for IETF mail situation:
The IETF mail servers still do not do STARTTLS. AMS is short staffed
at the moment, and is prioritizing mission critical things first.
Hopefully they will manage to get this done in January -- once that is
done, adding the TLSA record (and updating the documentation!) should
be (hopefully) quick and easy...

W

wkumari:~$ dig +short +nocomment MX ietf.org
0 mail.ietf.org.
wkumari@vimes:~$ telnet mail.ietf.org 25
Trying 2001:1900:3001:11::2c...
Connected to mail.ietf.org.
Escape character is '^]'.
220 ietfa.amsl.com ESMTP Postfix
EHLO example.com
250-ietfa.amsl.com
250-PIPELINING
250-SIZE 67108864
250-ETRN
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
STARTTLS
502 5.5.1 Error: command not implemented
quit
221 2.0.0 Bye
Connection closed by foreign host.

---

From: Viktor Dukhovni <[email-masked]>
Date: Fri, 17 Jan 2014 00:04:02 +0000

> 220 ietfa.amsl.com ESMTP Postfix

Recommended reading for AMSL:

    http://www.postfix.org/TLS_README.html#server_tls
    http://www.postfix.org/FORWARD_SECRECY_README.html#quick-start

Postfix 2.11.0 has been released.  If they are in a position to
build their own package, they should consider going with that.
Otherwise, they can upgrade at a later date, when their O/S vendor
makes an updated package available.

With 2.11 they get TLS session ticket support in the Postfix
SMTP server and DANE support in the Postfix SMTP client.

Best-practice configuration:

Postfix configured for opportunistic TLS or opportunistic DANE TLS
if >= 2.11.0:

    /etc/postfix/main.cf:
	# Server TLS
	smtpd_tls_security_level = may
	smtpd_tls_loglevel = 1
	smtpd_tls_cert_file = ${config_directory}/smtpd-chain.pem
	smtpd_tls_key_file = ${config_directory}/smtpd-key.pem
	smtpd_tls_dh1024_param_file ${config_directory}/dh2048.pem
	smtpd_tls_dh512_param_file ${config_directory}/dh512.pem

	# Client TLS: Postfix < 2.11
	smtp_tls_security_level = may
	smtpd_tls_loglevel = 1
	# In most cases do not configure a client certificate
	smtp_tls_cert_file = 
	smtp_tls_key_file =

	# Client TLS additions/changes for Postfix >= 2.11
	smtp_dns_support_level = dnssec
	smtp_tls_security_level = dane

For DANE security, a DNSSEC-validating recursive resolver is required
on the MTA machine, as the sole entry in:

  /etc/resolv.conf:
	domain amsl.com
	nameserver 127.0.0.1

-- 
	Viktor.

---

From: Warren Kumari <[email-masked]>
Date: Wed, 22 Jan 2014 14:26:27 -0500

And more than a quarter of our slot is already spoken for -- please
remember to ask early if you'd like some agenda time.

W

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 22 Jan 2014 12:43:42 -0700

Although Matt Miller and I haven't had much time to work on the SRV
I-D of late, it would be good to spend perhaps 10-15 minutes to
discuss it at the London session. We'll sure have an update by then.

On 01/22/2014 12:26 PM, Warren Kumari wrote:
> And more than a quarter of our slot is already spoken for --
> please remember to ask early if you'd like some agenda time.
> 
> W
> 
> 
>> It has been a while since we met -- please get your agenda
>> requests in... Preference is given to already discussed drafts,
>> things that need face to face time, etc.
>> 
>> 
>> 
>> A very quick update on the DANE for IETF mail situation: The IETF
>> mail servers still do not do STARTTLS. AMS is short staffed at
>> the moment, and is prioritizing mission critical things first. 
>> Hopefully they will manage to get this done in January -- once
>> that is done, adding the TLSA record (and updating the
>> documentation!) should be (hopefully) quick and easy...
>> 
>> W
>> 
>> 
>> wkumari:~$ dig +short +nocomment MX ietf.org 0 mail.ietf.org. 
>> wkumari@vimes:~$ telnet mail.ietf.org 25 Trying
>> 2001:1900:3001:11::2c... Connected to mail.ietf.org. Escape
>> character is '^]'. 220 ietfa.amsl.com ESMTP Postfix EHLO
>> example.com 250-ietfa.amsl.com 250-PIPELINING 250-SIZE 67108864 
>> 250-ETRN 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 
>> 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN STARTTLS 502 5.5.1
>> Error: command not implemented quit 221 2.0.0 Bye Connection
>> closed by foreign host.
> _______________________________________________ dane mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/dane
>

---

From: Olaf Kolkman <[email-masked]>
Date: Wed, 22 Jan 2014 21:00:08 +0100

[shameless plug ahead]

> 	smtpd_tls_dh512_param_file ${config_directory}/dh512.pem

Of course one should publish the TLSA RR once the server bit has been configured. Easy generation:

ldns-dane -c ${config_directory}/smtpd-chain.pem create <mx.example.com> 25 domain-issued full

e.g.

$ ldns-dane -c /usr/local/etc/postfix/postfix-cert.pem create mx.secret-wg.org 25 domain-issued full
_25._tcp.mx.secret-wg.org.	3600	IN	TLSA	3 0 1 3830c1286a6e1982d76b08ad04d681b5d870d8ad4374821b778b6aab462da96c

See http://www.nlnetlabs.nl/projects/ldns/ for ldns-dane (lives in most repos)

—Olaf

---

From: Viktor Dukhovni <[email-masked]>
Date: Wed, 22 Jan 2014 20:19:28 +0000

> been configured. Easy generation:

Yes, of course.

> ldns-dane -c ${config_directory}/smtpd-chain.pem create \
>	<mx.example.com> 25 domain-issued full

Or the short shell script below my signature, provided OpenSSL is
installed and the version is >= 1.0.0.

    $ tlsagen /usr/pkg/etc/mail-cert.pem mail.example.com:25 dane-ee spki sha2-256
    _25._tcp.mail.example.com. IN TLSA 3 1 1 89EF5B500559318251538FB1DA0BD309D38BD021EB0311A3227BE7B331B05BAC

-- 
	Viktor.

#! /bin/sh

extract() {
  case "$4" in
  0) openssl x509 -in "$1" -outform DER;;
  1) openssl x509 -in "$1" -noout -pubkey | openssl pkey -pubin -outform DER;;
  esac
}
digest() {
  case "$5" in
  0) cat;;
  1) openssl dgst -sha256 -binary;;
  2) openssl dgst -sha512 -binary;;
  esac
}
encode() {
  perl -e '
    ($cert, $hostport, $u, $s, $m) = @ARGV;
    ($host, $port) = split(":", $hostport); $port ||= 25;
    $/=undef;
    ($a=<STDIN>) =~ s/(.)/sprintf("%02X", ord($1))/egs;
    printf "_%d._tcp.%s. IN TLSA %d %d %d %s\n",
      $port, $host, $u, $s, $m, $a;
  ' "$@"
}

error() { echo "$1" 1>&2; exit 1; }
usage() { error "Usage: $0 cert.pem host[:port] usage selector mtype"; }
if [ $# -ne 5 ]; then usage; fi

case "$(echo $3 | tr '[A-Z]' '[a-z]')" in
0|pkix-[ct]a)	usage=0;;
1|pkix-ee)	usage=1;;
2|dane-[ct]a)	usage=2;;
3|dane-ee)	usage=3;;
*)		error "Invalid certificate usage: $3";;
esac

case "$(echo $4 | tr '[A-Z]' '[a-z]')" in
0|cert)		selector=0;;
1|spki|pkey)	selector=1;;
*) 		error "Invalid selector: $4";;
esac

case "$(echo $5 | tr '[A-Z]' '[a-z]')" in
0|full) 			mtype=0;;
1|sha2-256|sha256|sha-256) 	mtype=1;;
2|sha2-512|sha512|sha-512) 	mtype=2;;
*)				error "Invalid matching type: $5";;
esac

set -- "$1" "$2" "$usage" "$selector" "$mtype"
extract "$@" | digest "$@" | encode "$@"

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 29 Jan 2014 14:40:44 -0800

> remember to ask early if you'd like some agenda time.

DANE-smtp and likely DANE-opts both need discussion time.  Especially
the SMTP one.  On the upside I think we'll be ready for last call before
or shortly after the meeting.  I hope.
-- 
Wes Hardaker
Parsons