Bug 35924 – Check if perfect forward secrecy is enabled

Bug 35924 - Check if perfect forward secrecy is enabled


Summary:	Check if perfect forward secrecy is enabled

Status:	CLOSED FIXED

Product:	UCS Test
Classification:	Unclassified
Component:	Mail
Version:	unspecified
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	Dmitry Galkin
QA Contact:

URL:
Keywords:

Depends on:	35923
Blocks:
	Show dependency tree / graph

Reported:	2014-09-15 09:18 CEST by Sönke Schwardt-Krummrich
Modified:	2023-03-25 06:44 CET (History)
CC List:	1 user (show)

See Also:
What kind of report is it?:	Development Internal
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sönke Schwardt-Krummrich

2014-09-15 09:18:25 CEST

A test should be implemented that tests if TLS and PFS is enabled and working properly. Sending mails and receiving mails should be tested!

+++ This bug was initially created as a clone of Bug #35923 +++

We should enable Perfect Forward Secrecy:

* Execute the following commands during installation of univention-mail-postfix:
    $ openssl gendh -out /etc/postfix/dh_512.pem -2 512
    $ openssl gendh -out /etc/postfix/dh_1024.pem -2 1024
    $ openssl gendh -out /etc/postfix/dh_2048.pem -2 2048
  And the new config options:
    smtpd_tls_dh1024_param_file = /etc/postfix/dh_2048.pem
    smtpd_tls_dh512_param_file = /etc/postfix/dh_512.pem
  This enables EDH in postfix.
* smtpd_tls_eecdh_grade = strong
  Currently the builtin default value "none" is used which disables ciphers based on EECDH key exchange.
* tls_preempt_cipherlist = yes
  Is currently ignored in UCS 3.x (postfix 2.7) but used in UCS 4. It should also be set.
* smtpd_tls_loglevel = 1
  smtp_tls_loglevel = 1
  Raise TLS loglevel from 0 to 1.

Please recheck also for missing options:
http://www.postfix.org/FORWARD_SECRECY_README.html#quick-start

Comment 1 Dmitry Galkin

2015-01-20 12:08:19 CET

r57392:
  * Bug #35924: 40_mail/00check_forward_secrecy: check if Perfect Forward
    Secrecy is enabled.

The test greps the output of openssl s_client as in the Bug #35923.

Comment 2 Dmitry Galkin

2015-01-20 12:29:07 CET

r57394:
  * Bug #35924: 40_mail/00delivery00basic: added delivery test case with tls.

Comment 3 Stefan Gohmann

2016-10-12 07:48:07 CEST

For this bug is no separate QA needed.