mailserver test problem with "key exchange parameters"

Hi,
When I test online the ISPconfig 3 mail server with the website "en.Internet.nl", I get the message key exchange parameters

How can I solve this problem?

Kind Regards
Rob

 

Start with this:
https://www.howtoforge.com/community/threads/please-read-before-posting.58408/
My guess is your OS has too old TLS library, or you have not configured the used versions properly.

 

Hi Taleman and Tom,
I run on Debian 10 and ISPConfig 3.2.5

Code:

##### SERVER #####
IP-address (as per hostname): ***.***.***.***
[WARN] could not determine server's ip address by ifconfig
[INFO] OS version is Debian GNU/Linux 10 (buster)
 
[INFO] uptime:  22:37:42 up 12:36,  0 users,  load average: 0,19, 0,18, 0,12
 
[INFO] memory:
              total        used        free      shared  buff/cache   available
Mem:          3,6Gi       2,0Gi       706Mi        53Mi       907Mi       1,3Gi
Swap:          83Gi        20Mi        83Gi
 
[INFO] systemd failed services status:
  UNIT                       LOAD   ACTIVE SUB    DESCRIPTION         
● certbot.service            loaded failed failed Certbot             
● systemd-quotacheck.service loaded failed failed File System Quota Check

LOAD   = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB    = The low-level unit activation state, values depend on unit type.

2 loaded units listed. Pass --all to see loaded but inactive units, too.
To show all installed unit files use 'systemctl list-unit-files'.

[INFO] ISPConfig is installed.

##### ISPCONFIG #####
ISPConfig version is 3.2.5


##### VERSION CHECK #####

[INFO] php (cli) version is 7.3.29-1~deb10u1
[INFO] php-cgi (used for cgi php in default vhost!) is version 7.3.29

##### PORT CHECK #####


##### MAIL SERVER CHECK #####


##### RUNNING SERVER PROCESSES #####

[INFO] I found the following web server(s):
    Apache 2 (PID 2466)
[INFO] I found the following mail server(s):
    Postfix (PID 1092)
[INFO] I found the following pop3 server(s):
    Dovecot (PID 695)
[INFO] I found the following imap server(s):
    Dovecot (PID 695)
[INFO] I found the following ftp server(s):
    PureFTP (PID 1138)

##### LISTENING PORTS #####
(only        ()
Local        (Address)
[anywhere]:993        (695/dovecot)
[anywhere]:995        (695/dovecot)
[localhost]:10023        (780/postgrey)
[localhost]:10024        (1237/amavisd-new)
[localhost]:10025        (1092/master)
[localhost]:10026        (1237/amavisd-new)
[localhost]:3306        (677/mysqld)
[localhost]:10027        (1092/master)
[anywhere]:587        (1092/master)
[localhost]:11211        (569/memcached)
[anywhere]:110        (695/dovecot)
[anywhere]:143        (695/dovecot)
[anywhere]:465        (1092/master)
[anywhere]:21        (1138/pure-ftpd)
***.***.***.***:53        (587/named)
[localhost]:53        (587/named)
[anywhere]:22        (607/sshd)
[anywhere]:25        (1092/master)
[localhost]:953        (587/named)
*:*:*:*::*:3389        (678/xrdp)
*:*:*:*::*:993        (695/dovecot)
*:*:*:*::*:995        (695/dovecot)
*:*:*:*::*:10023        (780/postgrey)
*:*:*:*::*:10024        (1237/amavisd-new)
*:*:*:*::*:10026        (1237/amavisd-new)
*:*:*:*::*:587        (1092/master)
[localhost]10        (695/dovecot)
[localhost]43        (695/dovecot)
*:*:*:*::*:8080        (2466/apache2)
*:*:*:*::*:80        (2466/apache2)
*:*:*:*::*:8081        (2466/apache2)
*:*:*:*::*:465        (1092/master)
*:*:*:*::*:21        (1138/pure-ftpd)
*:*:*:*::*:53        (587/named)
*:*:*:*::*:3350        (618/xrdp-sesman)
*:*:*:*::*:22        (607/sshd)
*:*:*:*::*:25        (1092/master)
*:*:*:*::*:953        (587/named)
*:*:*:*::*:443        (2466/apache2)




##### IPTABLES #####
Chain INPUT (policy ACCEPT)
target     prot opt source               destination       
f2b-postfix-sasl  tcp  --  [anywhere]/0            [anywhere]/0            multi
port dports 25

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination       

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination       

Chain f2b-postfix-sasl (1 references)
target     prot opt source               destination       
REJECT     all  --  ***.***.***.***         [anywhere]/0            reject-with
icmp-port-unreachable
REJECT     all  --  ***.***.***.***        [anywhere]/0            reject-with i
cmp-port-unreachable
RETURN     all  --  [anywhere]/0            [anywhere]/0         




##### LET'S ENCRYPT #####
Certbot is installed in /usr/bin/letsencrypt

 

The test you refer to compains about

Code:

Mail server (MX)    Affected TLS versions    Status
mail.triumph-tr2.com.    TLS 1.1    phase out
...    TLS 1.0    phase out

Debian 10 has newer versions of the necessary protocols.
I have in my SSLProtocol setting "... -TLSv1 -TLSv1.1 ..." which disables those to your test complains about. Have you altered that setting in Apache configuration? How was this host installed?

 

Hi, where can I change the SSLProtocol settings?
ISPConfig was installed with this instruction.
https://www.howtoforge.com/perfect-server-debian-10-buster-apache-bind-dovecot-ispconfig-3-1/

 

Using Internet Search Engines with

Code:

site:howtoforge.com SSLProtocol

I found for example these:
https://www.howtoforge.com/community/threads/sslprotocol.83098/
https://www.howtoforge.com/community/threads/disabling-tls-1-0-and-1-1.83571/

 

Hi Tom,

Thanks for the information.
I tried what you write above, but stil get this warming on internet.nl. I put the pre-defined group in /etc/ssl/private/ffdhe4096.pem
And after this I define smtpd_tls_dh1024_param_file = /etc/ssl/private/ffdhe4096.pem in /etc/postfix/main.cf
but still get this warning Failed: Key exchange parameters on internet.nl

 

Hi Tom,
I restarted Postfix with sudo /etc/init.d/postfix restart.
But still the I get the warning in internet.nl.
View attachment 6826

 

Hi Till, I tried "systemctl restart postfix"
Still get this warning key exchange on internet.nl

 

Hi, still not A+ for mail TSL.
There are to solve 2 errors, as show below.
How can I solve
A) Cipher order
B) Key exchange parameter

 

Hi, still not A+ for mail TSL.
There is only one error to solve !
How can I solve
A) Cipher order

How to solve this Cipher order?

 

Hi,
Yes.... now I have a 100% score on internet.nl
Thanks for pointing me in the right direction.

 

Hi,
I'am now testing the website score, this is 97% but I also get this error.
What should I change in /etc/apache2/mods-available/ssl.conf to get rid off this error.

Key exchange parameters
Verdict:
Your web server supports insufficiently secure parameters for Diffie-Hellman key exchange.

Technical details:
Web server IP address Affected parameters Status
DH-4096 insufficient
DH-4096 insufficient

Thanks