Repository navigation
Possible TLS version issue? #66
Description
First let me say thanks for DMA, it's a great lightweight MTA. I use it everywhere I don't want a full MTA and it does the job perfectly.
I'm trying to dma with runbox.com and am getting the error in my logs. First the basics...
OS: Debian Buster
DMA package version: 0.11-1+b1
Error snipped from mail.info...
dma[1be00ac.5574372207e0]: trying remote delivery to mail.runbox.com [91.220.196.250] pref 0
dma[1be00ac.5574372207e0]: remote delivery deferred: SSL handshake failed fatally: error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version
My /etc/dma.conf..
SMARTHOST mail.runbox.com
PORT 465
SECURETRANSFER
AUTHPATH /etc/dma/auth.conf
MAILNAME /etc/mailname
This might be related to a change runbox.com made recently about supported TLS versions...
We will be retiring support for TLS 1.0 and 1.1 and will only support TLS 1.2 or later.
Is the TLS version at issue here? If so, is there anything I can do to set it to use newer version? If not any suggestions?
Thanks.
Activity
phillipsjk commentedon Aug 20, 2019
I was able to reproduce this problem on FreeBSD 11.2 (now upgraded to 11.3), with citeglobe.ca acting as a "smarthost".
I documented the problem on the FreeBSD Forum
I am wondering if adding TLS v1.2 support through a library is easier than configuring exim4 as an alternative.
When asked, the support person at my webhost did think plain-text (insecure) auhtentication would work. But, obviously I don't want to do that long-term.
The person who responded to my post on the FreeBSD forum suggested checking what version of OpenSSL it is linked against.
corecode commentedon Aug 20, 2019
Ah, the code is present, we just didn't tag a new release.
corecode commentedon Aug 20, 2019
release 0.12 tagged, this should allow any tls version. Could you please test?
bigon commentedon Aug 22, 2019
That's probably because 0.11-1 in debian is not supporting TLS1.1 or TLS1.2
I just uploaded to buster yesterday 0.11-1+deb10u1 which contains the patch to enable these versions of TLS.
corecode commentedon Aug 22, 2019
could you please upload 0.12 instead of picking patches?
bigon commentedon Aug 22, 2019
@corecode not in stable releases
0.12 will arrive soon in unstable
airflow2010 commentedon Nov 12, 2019
Has anyone successfully tested the current TLS versions (1.2) with version 0.12 of dma? I just did and I did not succeed, I still get the same handshake-error as in earlier versions.
Nov 12 18:30:55 testus dma[4ca53.8018280a0]: remote delivery deferred: xxxx [yyyy] failed after EHLO: error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake failure
phillipsjk commentedon Nov 13, 2019
Version 12 worked it's way into FreeBSD 11 around October 10th (or, that was when I got around to installing it). It appears to work.
I suspect it was not marked for release because this commit is vulnerable to downgrading attacks:
497a2b2
That should be not allowed unless the "Insecure" flag is set. What you should do is enforce TLS 1.2 like everybody else.
corecode commentedon Nov 13, 2019
please file a separate bug if there is a TLS security issue with the current code.
natarajsn1 commentedon May 7, 2022
Having the same issue on a Debian based GNU Linux distro by name MX-Linux.
"Linux mx-mini 5.10.0-12-amd64 #1 SMP Debian 5.10.103-1 (2022-03-07) x86_64 GNU/Linux"
May 7 13:35:13 mx-mini dma[93d3c.5556a475d180]: trying remote delivery to smtp.gmail.com [142.251.10.109] pref 0
May 7 13:35:15 mx-mini dma[93d3c.5556a475d180]: remote delivery deferred: SSL handshake failed fatally: error:1408F10B:SSL routines:ssl3_get_record:wrong version number "
dma version is "0.13-1"
corecode commentedon May 7, 2022
I have no idea. We're not pinning any TLS version, so that must be related to your openssl.
bmarwell commentedon Oct 24, 2022
Hi, ran into this issue today. I would LOVE to see this fix so I do not need to use exim or postfix. Thanks! :)
corecode commentedon Oct 24, 2022
bmarwell commentedon Oct 24, 2022
Really? It is the same error as before. No change.
Version: https://aur.archlinux.org/packages/dma
corecode commentedon Oct 24, 2022
bmarwell commentedon Nov 7, 2022
I re-tried from my other PC where it is working. The error is gone:
Settings taken from https://www.dragonflybsd.org/docs/howtos/HowTo_dma_gmail/ (except .muttrc settings, as I do not use mutt).
ronaldklop commentedon Jan 6, 2025
The error about "wrong version number" can be an indication of missed error handling. In #87 mention of the version was a misleading side effect of continuing operation after an error.