next message in archive
no next message in thread
previous message in archive
previous message in thread
Index of Subjects
&nbsp;This might be what is happe This is a multi-part message in MIME format. --------------73DF15F7434B0B1F4DA307B1 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Things haven't really improved with regard to e-mail not being received but it's not predictable or consistent. As noted originally, e-mails from DFO (Fisheries and Oceans, @dfo-mpo.gc.ca) were not being received but I've also had some e-mails from sympatico servers not come through, as well as notification of E-Tranfers. This all started when the chebucto e-mail system went down in March. And as noted above, these issues are not consistent. Some e-mails from those systems do come through but others do not. But it's impossible to know how much e-mail that I need doesn't come through. CCN has been my primary e-mail for almost 20 years and I believe in the work that CCN does providing low-cost internet access throughout the Halifax community, including the work setting up Wi-Fi in various seniors' residences. But if I can't rely upon the system for my e-mail I would have to give up my membership. What's the possibility to these issues being resolved? Thanks, Philip Greyson (phyllo@chebucto.ns.ca) On 28/03/2018 2:41 AM, Chris Maxwell wrote: > Well that is disappointing. I fielded two reports within hours of > each other of mail not arriving related to waiting > for an email about employment. I found the explanation for one of > them and wondered whether I had for both. > It would seem not. > > In answer to the question, maybe sort of: Remember how CRA had an > issue with https and the Heartbleed attack > last year? This prompted a bunch of tightening up of SSL services at > CCN rejecting older versions of SSL and > older ciphers within SSL. This might be what is happening from what > the logs are reporting. > > The logs report that when the DFO server connects it is unable to come > to an agreement with us on > a common set of supported ciphers. I remember having difficulty > finding the handles to adjust to > control of ciphers and SSL versions in Zmailer and so I can not find > them in the configuration file > now either to pull back on the paranoia. There was a great deal of > pressure on the Tech Team to > be able to pass the external validations that we were no longer > vulnerable at the time so I can not > rule out that things have been hard-coded into the binaries and that > it would be greatly challenging to > roll this back now that people are no longer paying such close > attention. I had hoped to recruit > someone on the tech team to take on finding a temporary work around > until I get back from my > enforced limitation on time I can put into this, but no one stepped > forward. > > If my diagnosis is correct this can be solved by > * Upgrading us to a newer and better mail transport software which is > what the tech team is working on instead of > finding temporary work-arounds (this may or may not help, since > all it might do is provide the levers to lower the > security on our SSL, something which is opposed by some members of > the tech team.) If I could re-find the levers > to pull easily I would. > * Having the administrators of vsnsbiodmzedg01.dfo-mpo.gc.ca > <http://vsnsbiodmzedg01.dfo-mpo.gc.ca> upgrade their SSL library and > parameters > to support a newer TLS/SSL and cipher suite, or continue the > conversation when the STARTTLS > fails and just send the message via plaintext. > > I know our STARTTLS is not simply broken since office365 is able to > deliver messages via it. > > > If you are opting for option 2, here is the log entry for their > reference to see if they can find a workaround. > > > 0LKyDWB0001# 000-connection from vsnsbiodmzedg01.dfo-mpo.gc.ca > <http://vsnsbiodmzedg01.dfo-mpo.gc.ca>[205.194.26.55]:25661 on port 25 > ipcnt 1 childs 13 pid 13697 ident: IDENT-NONSENSE > 0LKyDWB0001# 000-Didn't find DNS A object: > 55.26.194.205.zen.spamhaus.org <http://zen.spamhaus.org>. > 0LKyDWB0001# 000-Didn't find DNS A object: > 55.26.194.205.bl.spamcop.net <http://bl.spamcop.net>. > 0LKyDWB0001w 220 sec.smtp.chebucto.ns.Ca ZMailer Server 2.99.57 #1 > ESMTP+IDENT ready at Tue, 27 Mar 2018 08:10:55 -0300 > 0LKyDWB0001r EHLO VSNSBIODMZEDG01.DFO-MPO.GC.CA > 0LKyDWB0001w 250-sec.smtp.chebucto.ns.Ca Hello > VSNSBIODMZEDG01.DFO-MPO.GC.CA > 0LKyDWB0001w 250-SIZE 200000000 > 0LKyDWB0001w 250-8BITMIME > 0LKyDWB0001w 250-PIPELINING > 0LKyDWB0001w 250-CHUNKING > 0LKyDWB0001w 250-ENHANCEDSTATUSCODES > 0LKyDWB0001w 250-DSN > 0LKyDWB0001w 250-X-RCPTLIMIT 150 > 0LKyDWB0001w 250-STARTTLS > 0LKyDWB0001w 250-ETRN > 0LKyDWB0001w 250 HELP > 0LKyDWB0001r STARTTLS > 0LKyDWB0001w 220 Ready to start TLS > 0LKyDWB0001# 000-SSL_accept:error in SSLv2/v3 read client hello A > 0LKyDWB0001# 000-SSL3 alert write:fatal:handshake failure > 0LKyDWB0001# 000-SSL_accept:error in SSLv3 read client hello C > 0LKyDWB0001# 000-SSL_accept:error in SSLv3 read client hello C > 0LKyDWB0001# 000-SSL_accept error -1/1 > 0LKyDWB0001# 000-13697:error:1408A0C1:SSL > routines:SSL3_GET_CLIENT_HELLO:no shared cipher:s3_srvr.c:1087: > 0LKyDWB0001# 000-SSL session removed > 0LKyDWB0001# 000-TLS stopping; mode was: OFF > > > Now, given my interactions with mx.ssan.seg-egs.GC.CA, I can not rule > out that I never did find > the appropriate lever and the problem is that we offer to talk SSL3 > instead of rejecting > unless they start with TLSv1 and rather than not make the request it > is failing because it is allowed. > > > > > -------- > Chris Maxwell > Chair, Technical Committee, Chebucto Community Net Society > cmaxwell@dal.ca <mailto:cmaxwell@dal.ca>, 902-494-1369 > > > >> On Mar 27, 2018, at 11:41 AM, Richard Bonner <ak621@chebucto.ns.ca >> <mailto:ak621@chebucto.ns.ca>> wrote: >> >> >> On Tue, 27 Mar 2018, Philip R. Greyson wrote: >> >>> Hi Richard and userhelp: >>> >>> Was there ever any resolution to this? >> >> *** Tech was working on it last week, but I don't have an update. I >> am CCing this to them. >> >> >>> I still don't receive any e-mail from my dfo-mpo.gc.ca >>> <http://dfo-mpo.gc.ca> account. I don't know whether all e-mails >>> from Government servers are getting blocked. >> >> *** I will leave the above paragraph in so that CCN Tech will know >> to look specifically into government domains. >> >> Sorry for the issue. >> >> Richard Bonner >> Chebucto User Help >> > --------------73DF15F7434B0B1F4DA307B1 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=windows-1252"> </head> <body text="#000000" bgcolor="#FFFFFF"> <p>Things haven't really improved with regard to e-mail not being received but it's not predictable or consistent. As noted originally, e-mails from DFO (Fisheries and Oceans, @dfo-mpo.gc.ca) were not being received but I've also had some e-mails from sympatico servers not come through, as well as notification of E-Tranfers. This all started when the chebucto e-mail system went down in March. And as noted above, these issues are not consistent. Some e-mails from those systems do come through but others do not. But it's impossible to know how much e-mail that I need doesn't come through.<br> </p> <p>CCN has been my primary e-mail for almost 20 years and I believe in the work that CCN does providing low-cost internet access throughout the Halifax community, including the work setting up Wi-Fi in various seniors' residences. But if I can't rely upon the system for my e-mail I would have to give up my membership. <br> </p> <p>What's the possibility to these issues being resolved?</p> <p>Thanks, <br> </p> <p>Philip Greyson (phyllo@chebucto.ns.ca)<br> </p> <br> <div class="moz-cite-prefix">On 28/03/2018 2:41 AM, Chris Maxwell wrote:<br> </div> <blockquote type="cite" cite="mid:C88D874B-8504-4C45-B9DF-29493ED4EED2@dal.ca"> <meta http-equiv="Content-Type" content="text/html; charset=windows-1252"> Well that is disappointing. I fielded two reports within hours of each other of mail not arriving related to waiting <div class="">for an email about employment. I found the explanation for one of them and wondered whether I had for both.</div> <div class="">It would seem not.</div> <div class=""><br class=""> </div> <div class=""> In answer to the question, maybe sort of: Remember how CRA had an issue with https and the Heartbleed attack </div> <div class="">last year? This prompted a bunch of tightening up of SSL services at CCN rejecting older versions of SSL and </div> <div class="">older ciphers within SSL. This might be what is happening from what the logs are reporting.</div> <div class=""><br class=""> </div> <div class="">The logs report that when the DFO server connects it is unable to come to an agreement with us on </div> <div class="">a common set of supported ciphers. I remember having difficulty finding the handles to adjust to </div> <div class="">control of ciphers and SSL versions in Zmailer and so I can not find them in the configuration file </div> <div class="">now either to pull back on the paranoia. There was a great deal of pressure on the Tech Team to </div> <div class="">be able to pass the external validations that we were no longer vulnerable at the time so I can not </div> <div class="">rule out that things have been hard-coded into the binaries and that it would be greatly challenging to </div> <div class="">roll this back now that people are no longer paying such close attention. I had hoped to recruit </div> <div class="">someone on the tech team to take on finding a temporary work around until I get back from my </div> <div class="">enforced limitation on time I can put into this, but no one stepped forward.</div> <div class=""><br class=""> </div> <div class="">If my diagnosis is correct this can be solved by </div> <div class="">* Upgrading us to a newer and better mail transport software which is what the tech team is working on instead of </div> <div class=""> finding temporary work-arounds (this may or may not help, since all it might do is provide the levers to lower the </div> <div class=""> security on our SSL, something which is opposed by some members of the tech team.) If I could re-find the levers </div> <div class=""> to pull easily I would.</div> <div class="">* Having the administrators of <span style="font-family: Menlo; font-size: 11px; font-variant-ligatures: no-common-ligatures; color: rgb(255, 255, 255); background-color: rgb(0, 0, 0);" class=""><a href="http://vsnsbiodmzedg01.dfo-mpo.gc.ca" class="" moz-do-not-send="true">vsnsbiodmzedg01.dfo-mpo.gc.ca</a></span><span style="font-family: Menlo; font-size: 11px; background-color: rgb(255, 255, 255); font-variant-ligatures: no-common-ligatures;" class=""> upgrade their SSL library and parameters </span></div> <div class=""><span style="font-family: Menlo; font-size: 11px; background-color: rgb(255, 255, 255); font-variant-ligatures: no-common-ligatures;" class=""> to support a newer TLS/SSL and cipher suite, or continue the conversation when the STARTTLS</span></div> <div class=""><span style="font-family: Menlo; font-size: 11px; background-color: rgb(255, 255, 255); font-variant-ligatures: no-common-ligatures;" class=""> fails and just send the message via plaintext. </span></div> <div class=""><br class=""> </div> <div class=""> <div class="">I know our STARTTLS is not simply broken since office365 is able to deliver messages via it. </div> </div> <div class=""><br class=""> </div> <div class=""><br class=""> </div> <div class="">If you are opting for option 2, here is the log entry for their reference to see if they can find a workaround.</div> <div class=""><br class=""> </div> <div class=""><br class=""> </div> <div class=""> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001# 000-connection from </span><span style="font-variant-ligatures: no-common-ligatures; color: #ffffff; background-color: #000000" class=""><a href="http://vsnsbiodmzedg01.dfo-mpo.gc.ca" class="" moz-do-not-send="true">vsnsbiodmzedg01.dfo-mpo.gc.ca</a></span><span style="font-variant-ligatures: no-common-ligatures" class=""> [205.194.26.55]:25661 on port 25 ipcnt 1 childs 13 pid 13697 ident: IDENT-NONSENSE</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001# 000-Didn't find DNS A object: 55.26.194.205.<a href="http://zen.spamhaus.org" class="" moz-do-not-send="true">zen.spamhaus.org</a>.</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001# 000-Didn't find DNS A object: 55.26.194.205.<a href="http://bl.spamcop.net" class="" moz-do-not-send="true">bl.spamcop.net</a>.</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001w 220 sec.smtp.chebucto.ns.Ca ZMailer Server 2.99.57 #1 ESMTP+IDENT ready at Tue, 27 Mar 2018 08:10:55 -0300</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001r EHLO VSNSBIODMZEDG01.DFO-MPO.GC.CA</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001w 250-sec.smtp.chebucto.ns.Ca Hello VSNSBIODMZEDG01.DFO-MPO.GC.CA</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001w 250-SIZE 200000000</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001w 250-8BITMIME</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001w 250-PIPELINING</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001w 250-CHUNKING</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001w 250-ENHANCEDSTATUSCODES</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001w 250-DSN</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001w 250-X-RCPTLIMIT 150</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001w 250-STARTTLS</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001w 250-ETRN</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001w 250 HELP</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001r STARTTLS</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001w 220 Ready to start TLS</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001# 000-SSL_accept:error in SSLv2/v3 read client hello A</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001# 000-SSL3 alert write:fatal:handshake failure</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001# 000-SSL_accept:error in SSLv3 read client hello C</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001# 000-SSL_accept:error in SSLv3 read client hello C</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001# 000-SSL_accept error -1/1</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001# 000-13697:error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher:s3_srvr.c:1087:</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001# 000-SSL session removed</span></div> <div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">0LKyDWB0001# 000-TLS stopping; mode was: OFF</span></div> </div> <div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class=""> </span></div> <div class=""><br class=""> </div> <div class="">Now, given my interactions with <span style="font-family: Menlo; font-size: 11px; background-color: rgb(255, 255, 255);" class="">mx.ssan.seg-egs.GC.CA, I can not rule out that I never did find </span></div> <div class=""><span style="background-color: rgb(255, 255, 255);" class=""><font class="" face="Menlo"><span style="font-size: 11px;" class="">the appropriate lever and the problem is that we offer to talk SSL3 instead of rejecting </span></font></span></div> <div class=""><span style="background-color: rgb(255, 255, 255);" class=""><font class="" face="Menlo"><span style="font-size: 11px;" class="">unless they start with TLSv1 and rather than not </span></font></span><span style="font-size: 11px; font-family: Menlo; background-color: rgb(255, 255, 255);" class="">make the request it is failing because it is allowed. </span></div> <div class=""><span style="font-size: 11px; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><br class=""> </span></div> <div class=""><span style="font-size: 11px; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><br class=""> </span></div> <div class=""> <br class=""> <div class=""> <div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;"><br class="Apple-interchange-newline"> --------</div> <div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">Chris Maxwell</div> <div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">Chair, Technical Committee, Chebucto Community Net Society</div> <div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;"><a href="mailto:cmaxwell@dal.ca" class="" moz-do-not-send="true">cmaxwell@dal.ca</a>, 902-494-1369</div> <div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""> </div> <br class="Apple-interchange-newline"> </div> <br class=""> <div> <blockquote type="cite" class=""> <div class="">On Mar 27, 2018, at 11:41 AM, Richard Bonner <<a href="mailto:ak621@chebucto.ns.ca" class="" moz-do-not-send="true">ak621@chebucto.ns.ca</a>> wrote:</div> <br class="Apple-interchange-newline"> <div class=""> <div class=""><br class=""> On Tue, 27 Mar 2018, Philip R. Greyson wrote:<br class=""> <br class=""> <blockquote type="cite" class="">Hi Richard and userhelp:<br class=""> <br class=""> Was there ever any resolution to this?<br class=""> </blockquote> <br class=""> *** Tech was working on it last week, but I don't have an update. I am CCing this to them.<br class=""> <br class=""> <br class=""> <blockquote type="cite" class="">I still don't receive any e-mail from my <a href="http://dfo-mpo.gc.ca" class="" moz-do-not-send="true">dfo-mpo.gc.ca</a> account. I don't know whether all e-mails from Government servers are getting blocked.<br class=""> </blockquote> <br class=""> *** I will leave the above paragraph in so that CCN Tech will know to look specifically into government domains.<br class=""> <br class=""> Sorry for the issue.<br class=""> <br class=""> Richard Bonner<br class=""> Chebucto User Help<br class=""> <br class=""> </div> </div> </blockquote> </div> <br class=""> </div> </blockquote> <br> </body> </html> --------------73DF15F7434B0B1F4DA307B1--
next message in archive
no next message in thread
previous message in archive
previous message in thread
Index of Subjects