Rocksolid Light

News from da outaworlds

mail  files  register  groups  login

Message-ID:  

So you're back... about time...

rocksolid / Rocksolid Nodes Help / rslight php mailer STARTTLS vs SSL/TLS

SubjectAuthor
* rslight php mailer STARTTLS vs SSL/TLSAnonymous
`- Re: rslight php mailer STARTTLS vs SSL/TLSRetro Guy

1
Subject: rslight php mailer STARTTLS vs SSL/TLS
From: Anonymous
Newsgroups: rocksolid.nodes.help
Organization: To protect and to server
Date: Sat, 13 Jul 2024 03:30 UTC
Path: eternal-september.org!news.eternal-september.org!feeder3.eternal-september.org!newsfeed.bofh.team!paganini.bofh.team!not-for-mail
From: invalid@example.com (Anonymous)
Newsgroups: rocksolid.nodes.help
Subject: rslight php mailer STARTTLS vs SSL/TLS
Date: Fri, 12 Jul 2024 22:30:31 -0500
Organization: To protect and to server
Message-ID: <v6ssd6$1lr0a$1@paganini.bofh.team>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Injection-Date: Sat, 13 Jul 2024 03:30:46 -0000 (UTC)
Injection-Info: paganini.bofh.team; logging-data="1764362"; posting-host="PucJEPotjJyynPGC85C0DQ.user.paganini.bofh.team"; mail-complaints-to="usenet@bofh.team"; posting-account="9dIQLXBM7WM9KzA+yjdR4A";
X-Notice: Filtered by postfilter v. 0.9.3
View all headers

It appears that the phpmailer is set to use STARTTLS at port 587.
This is less secure than SSL at port 465. STARTTLS is subject to MITM
protocol downgrade attack.

STARTTLS allows the client to establish a plaintext, unencrypted
connection with the mail server with no warning to the user. If this
happens both the client and the server may send credentials and message
data in the clear with no encryption. Why the brainlets who design mail
servers have allowed this state of affairs is beyond my clairvoyance.
STARTTLS should have been scrapped long ago.

To ensure security I need to configure rslight phpmailer to always
fail to connect if a secure SSL/TLS connection cannot be established at
port 465. Is there a way to force rslight phpmailer connect with
SSL/TLS or error and die, rather than STARTTLS?

The only other option I see is to configure a local proxy to connect to
the mail server and use IPTABLES to prevent the connection from
reaching out, so that STARTTLS won't expose a plaintext connection.
Even then I am not sure if this will 100% ensure against password
leakage even on localhost in the middle of a shared server farm.

Are there tips or tricks to ensure I am always getting a secure
connection with phpmailer?

Subject: Re: rslight php mailer STARTTLS vs SSL/TLS
From: Retro Guy
Newsgroups: rocksolid.nodes.help
Organization: Rocksolid Light
Date: Sat, 13 Jul 2024 11:25 UTC
References: 1
Path: eternal-september.org!news.eternal-september.org!feeder3.eternal-september.org!i2pn.org!i2pn2.org!.POSTED!not-for-mail
From: retroguy@novabbs.com (Retro Guy)
Newsgroups: rocksolid.nodes.help
Subject: Re: rslight php mailer STARTTLS vs SSL/TLS
Date: Sat, 13 Jul 2024 11:25:17 +0000
Organization: Rocksolid Light
Message-ID: <47cd41d17ccbb7fe217c31bc67f764ac@www.novabbs.org>
References: <v6ssd6$1lr0a$1@paganini.bofh.team>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Injection-Info: i2pn2.org;
logging-data="3132916"; mail-complaints-to="usenet@i2pn2.org";
posting-account="gg+dDWHMzVrdxGO9Gmt8aqyeWDXqlxfqiuS0jX/WMXY";
User-Agent: Rocksolid Light
X-Spam-Checker-Version: SpamAssassin 4.0.0
X-Rslight-Site: $2y$10$.mDx6Jh4ZYqieqHH5fZo9Ouap5XUonjQYUv3k7RTqpiz8AcQ2P3aO
X-Rslight-Posting-User: a93aefeeff923def71455caae2dbfb277a59e046
X-Face: .&YR-G(w(DZ$$,}%k=]*5*!p'=(anr"IT`wZG'2VWdfl\r)l[42u7JH`n(JUQ*e5*A|XCDf
?&\X&uwkl38"CYX3O8m}C8E4p'%N$2#kSTVzx{Ly|DjLT\Vk7NE}NQ(VC$Yq]i:7|z[.9iv^g>*8_B
H0=hZt'[%)4kG|
View all headers

On Sat, 13 Jul 2024 3:30:31 +0000, Anonymous wrote:

> It appears that the phpmailer is set to use STARTTLS at port 587.
> This is less secure than SSL at port 465. STARTTLS is subject to MITM
> protocol downgrade attack.
>
> STARTTLS allows the client to establish a plaintext, unencrypted
> connection with the mail server with no warning to the user. If this
> happens both the client and the server may send credentials and message
> data in the clear with no encryption. Why the brainlets who design mail
> servers have allowed this state of affairs is beyond my clairvoyance.
> STARTTLS should have been scrapped long ago.
>
> To ensure security I need to configure rslight phpmailer to always
> fail to connect if a secure SSL/TLS connection cannot be established at
> port 465. Is there a way to force rslight phpmailer connect with
> SSL/TLS or error and die, rather than STARTTLS?
>
> The only other option I see is to configure a local proxy to connect to
> the mail server and use IPTABLES to prevent the connection from
> reaching out, so that STARTTLS won't expose a plaintext connection.
> Even then I am not sure if this will 100% ensure against password
> leakage even on localhost in the middle of a shared server farm.
>
> Are there tips or tricks to ensure I am always getting a secure
> connection with phpmailer?

Rslight uses phpmailer: https://github.com/PHPMailer/PHPMailer

Please take a look at that page and it may provide the answers you need.

If you find a good, more secure config, please feel free to provide it
here for the rest of us to check out :)

Thanks!

--
Retro Guy

1

rocksolid light 0.9.8
clearnet tor