that is the state of OpenSSL in Fedora after this morining https://bugzilla.redhat.com/show_bug.cgi?id=319901#c108
since OpenSSL in Fedora from now on supports ECDHE depending software needs to be rebuilt to make use of it as well as libraries like NSS/GNUTLS should do the same and depending packages like Firefox needs a rebuild against refreshed NSS to support it also on the client side i made some triage today _____________________________________________________ openssl: https://bugzilla.redhat.com/show_bug.cgi?id=319901#c108 nss-softokn https://bugzilla.redhat.com/show_bug.cgi?id=1019244 nss https://bugzilla.redhat.com/show_bug.cgi?id=1019245 firefox https://bugzilla.redhat.com/show_bug.cgi?id=1019247 thunderbird: https://bugzilla.redhat.com/show_bug.cgi?id=1019249 httpd: https://bugzilla.redhat.com/show_bug.cgi?id=1019251 dovecot: https://bugzilla.redhat.com/show_bug.cgi?id=1019253 postfix: https://bugzilla.redhat.com/show_bug.cgi?id=1019254 openssh: https://bugzilla.redhat.com/show_bug.cgi?id=1019256 dbmail: https://bugzilla.redhat.com/show_bug.cgi?id=1019259
postfix-2.10.2-2.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/postfix-2.10.2-2.fc20
postfix-2.10.2-2.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/postfix-2.10.2-2.fc19
postfix-2.9.7-2.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/postfix-2.9.7-2.fc18
Package postfix-2.10.2-2.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing postfix-2.10.2-2.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-19768/postfix-2.10.2-2.fc20 then log in and leave karma (feedback).
postfix-2.10.2-2.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
postfix-2.9.7-2.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
postfix-2.10.2-2.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Just upgraded to F20, and tried to use ECDHE with postfix: # openssl s_client -connect localhost:25 -starttls smtp -cipher kEECDH 140691508164480:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:741: --- no peer certificate available ... Here's the relevant config: # postconf | egrep 'eecdh|cipherlist' smtpd_tls_eecdh_grade = strong tls_eecdh_strong_curve = prime256v1 tls_high_cipherlist = EECDH+AESGCM:EECDH+AES:EECDH+RC4:DH+aRSA+AES+SHA:+TLSv1+AES:RSA+AESGCM:RSA+AES:RSA+RC4+SHA:+TLSv1+RSA+AES:!aECDSA Checking the code, I should get a warning if I set smtpd_tls_eecdh_grade to an invalid value, eg: smtpd_tls_eecdh_grade = bogus But connecting with this configuration does not show a warning, so the build appears to have excluded the EEC code in src/tls/tls_dh.c -- which has the code wrapped in: #if OPENSSL_VERSION_NUMBER >= 0x1000000fL && !defined(OPENSSL_NO_ECDH) #endif Can you try building again with the correct library options? Thanks.
BTW, since this was closed, should I open a new bug?
don't touch config params you do not understand tls_high_cipherlist is for sure not builtin ___________________________________________________ Dec 23 11:45:09 testserver postfix/smtp[13888]: Untrusted TLS connection established to 192.168.196.1[192.168.196.1]:25: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits) Dec 23 11:45:09 testserver postfix/smtp[13888]: 3dnxz91sWWz28mQ: to=<rhsoft>, relay=192.168.196.1[192.168.196.1]:25, delay=0.59, delays=0.02/0.12/0.31/0.14, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 3dnxz95dByzBx51) Dec 23 11:45:09 testserver postfix/qmgr[979]: 3dnxz91sWWz28mQ: removed [root@testserver:~]$ cat /etc/redhat-release Fedora release 20 (Heisenbug) [root@testserver:~]$ postconf | egrep 'eecdh|cipherlist' smtpd_tls_eecdh_grade = strong tls_eecdh_strong_curve = prime256v1 tls_eecdh_ultra_curve = secp384r1 tls_export_cipherlist = aNULL:-aNULL:ALL:+RC4:@STRENGTH tls_high_cipherlist = aNULL:-aNULL:ALL:!EXPORT:!LOW:!MEDIUM:+RC4:@STRENGTH tls_low_cipherlist = aNULL:-aNULL:ALL:!EXPORT:+RC4:@STRENGTH tls_medium_cipherlist = aNULL:-aNULL:ALL:!EXPORT:!LOW:+RC4:@STRENGTH tls_null_cipherlist = eNULL:!aNULL tls_preempt_cipherlist = no tlsproxy_tls_eecdh_grade = $smtpd_tls_eecdh_grade ___________________________________________________ [root@testserver:~]$ openssl s_client -connect localhost:25 -starttls smtp -cipher kEECDH CONNECTED(00000003) depth=0 C = AT, ST = Vienna, L = Vienna, O = the lounge interactive design gmbh, OU = Administration, CN = *.testserver.rhsoft.net, emailAddress = hostmaster
I understand the cipherlist parameter quite well (that's why it's so carefully configured ;). Resetting to default doesn't fix the issue. Are you using the package for x86_64? Run yum reinstall postfix and try again. I rebuilt the rpm locally, and installed and postfix works correctly and supports EEC, however the package available via yum repos does not. Eg. # yum reinstall postfix ... downloads and installs postfix # cd /usr/libexec/postfix # ls -l smtpd -rwxr-xr-x. 1 root root 622520 Oct 23 02:34 smtpd # strings smtpd | grep EECDH # (no output) Installing local build (same release) # yum reinstall ~devel/rpm/RPMS/x86_64/postfix-2.10.2-2.fc20.x86_64.rpm ... # ls -l smtpd -rwxr-xr-x. 1 root root 622616 Dec 23 11:40 smtpd # strings smtpd | grep EECDH Invalid TLS eecdh grade "%s": EECDH disabled unknown curve "%s": disabling EECDH support unable to use curve "%s": disabling EECDH support # openssl s_client -connect localhost:25 -starttls smtp -cipher kEECDH ... SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 ... Checked the yum cache, and my repo build was from http://mirrors.kernel.org/fedora/development/20/x86_64/os/Packages/p/postfix-2.10.2-2.fc20.x86_64.rpm For ref, rpm -qip on it has: Signature : RSA/SHA256, Wed 23 Oct 2013 08:44:18 AM PDT, Key ID 2eb161fa24611\ 0c1 Build Date : Wed 23 Oct 2013 02:34:40 AM PDT Build Host : buildvm-14.phx2.fedoraproject.org
i build postfix without any special SSL params at my own so i do not understand what you mean with "Can you try building again with the correct library options" though i am not the fedora-maintainer
Yes, but this bug was opened to request ECDHE builds of postfix. The build available is not ECDHE enabled and so the bug should really be re-opened and new builds released.
I can confirm the current package in the repo doesn't support ECDHE, rebuilding again.
postfix-2.10.2-3.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/postfix-2.10.2-3.fc20
Package postfix-2.10.2-3.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing postfix-2.10.2-3.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-0083/postfix-2.10.2-3.fc20 then log in and leave karma (feedback).
Tested and new build does include ECDHE support. Added karma.
postfix-2.10.2-3.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.