1

Does anyone have a good template email to use to send to remote system/mail/security administrators to alert them to the fact that emails to them would not be getting through either at all or securely because of their weak DH keys?

I understand the OpenSSL team decision to disallow weak DH keys (under 768 bits for now, soon to rise to 1024 bits minimum). The knock-on from this change means that when our (now secure) sendmail attempts to connect to another SMTP server and is offered TLS but with a weak DH key, then the email is "deferred" because the TLS connection fails due to the new minimum our server now enforces.

So the community needs a well-worded template we can use to send to other system/mail/security admins at those sites that alerts them that their weak DH keys are causing mail delivery problems from us to them.

It seems lots of people would be wanting to do this, but I haven't found a good example yet online of a "Best-practice" approach.

Ideas?

Improve this question
3
  • I've sent out e-mails like these to folks using weak RSA keys (<1024) on SFTP sites with PHI data, as those keys aren't FIPS/NIST approved. It tends to work out with the CISO jumping in and saying something about mitigating measures and that they're not upgrading. All the folks I've emailed are still using the old keys. So, I think this might be an uphill battle.
    – Herringbone Cat
    Jul 21, 2015 at 18:02
  • 1
    Of those mail admins that actually read their postmaster inbox, a large percentage will ignore or argue with you. As a result, the way to inform other sysadmins that their email servers are inadequate is to stop sending them email. It is sad but true.
    – gowenfawr
    Jul 21, 2015 at 18:37
  • Well, tell them via RFC 2142 addresses what the problem is, what it will practically mean for them (and other mailers' ability to send mail to them), when you plan on making the information public if you don't hear back from them, and when you plan on making the information public if you do hear back from them. I'd give them a few weeks; which is really more than fair given how easy it is on any sanely designed system to replace a key. Unfortunately, public shame tends to be the only reason most people care about security, and as a result the only reliable motivator.
    – Parthian Shot
    Jul 22, 2015 at 1:02

0

Reset to default

Browse other questions tagged .