<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body dir="auto">
<div>Hello,</div>
<div><br>
</div>
<div>yes but it is not a sslv3 related client issue if dovecot is not starting.</div>
<div>We have the pop/imap issue not with all bo servers. Only with ~ 10%.</div>
<div><br>
</div>
<div>Regards</div>
<div>Dirk<br>
<br>
----------------------<br>
<div><br>
</div>
<div>Black Point Arts Internet Solutions GmbH</div>
</div>
<div><br>
Am 30.10.2014 um 07:51 schrieb RA <<a href="mailto:richall@gmail.com">richall@gmail.com</a>>:<br>
<br>
</div>
<blockquote type="cite">
<div>
<div>Dirk from earlier announcement. Ssl3 turned off </div>
<div><br>
</div>
<div><br>
<span style="background-color: rgba(255, 255, 255, 0);">Hi all,<br>
<br>
I wish I could have done this sooner, but last week I was on a holiday.<br>
The work was pretty complex, but is finally done:<br>
<br>
The following YUM updates have just been published for BlueOnyx 5106R,<br>
5107R, 5108R, 5207R and 5208R:<br>
<br>
base-admserv-*<br>
base-apache-*<br>
base-email-*<br>
dovecot-2.2.15-1BX01<br>
proftpd-1.3.5-1BX1<br>
<br>
They deal with the recently announced Pootle SSLv3 vulnerability and<br>
turn off SSLv3 support for the services AdmServ (GUI), Apache, POP3/IMAP<br>
and FTP.<br>
<br>
Dovecot was updated to version 2.2.15 on all BlueOnyx versions. On 5106R<br>
it supports only TLSv1.0, as the underlying OpenSSL is too old. On all<br>
other BlueOnyx versions it supports TLSv1.2, TLSv1.1 and TLSv1.0.<br>
<br>
ProFTPD was also updated to the latest version (v1.3.5), which<br>
(finally!) handles TLSv1.2 as well as TLSv1.1 and TLSv1.0. But as<br>
before: On BlueOnyx 5106R only TLSv1.0 is available due to the ancient<br>
OpenSSL version that ships with CentOS5.<br>
<br>
Caveats:<br>
========<br>
<br>
This is a somewhat massive and intrusive update. Especially so on 5106R,<br>
where we went from Dovecot 1.1.X straight to the latest available<br>
version. When Dovecot gets updated, it will need to recalculate the<br>
2048bit Diffie-Hellman ciphers. This can easily take several minutes,<br>
during which the polling of emails via IMAPS or POP3S is not possible.<br>
Please wait for it to finish. If you restart Dovecot during that period,<br>
it will recalculate the DH-ciphers again until it finally completes it.<br>
After that it will accept TLS connections just fine without a restart of<br>
the service.<br>
<br>
As SSLv3 is now turned off for all services you might get the odd call<br>
from clients who are no longer able to connect to secure POP3, secure<br>
IMAP, secure FTP or maybe even to a webpage via HTTPS. Most likely they<br>
will be using Windows XP with some really old browsers (like IE6) or an<br>
ancient Outlook or similar, which don't support even TLSv1.0 and fall<br>
back to the compromised SSLv3 protocol, which we just disabled entirely.<br>
<br>
Unless they upgrade they are out of luck. Windows XP is end of life and<br>
we will no longer cripple the security of our OS to accommodate them.<br>
<br>
If you get such a report from a client that is *not* using Windows XP,<br>
please ask them to update their email client or browser or FTP client to<br>
the latest version and to check the connection settings. They might have<br>
to change their account settings to use TLS instead of SSLv3.<br>
<br>
If you have problems with this updates, then please report them via the<br>
BlueOnyx General Mailing List by replying to this message.<br>
<br>
-- <br>
With best regards<br>
<br>
Michael Stauber<br>
_______________________________________________<br>
Blueonyx mailing list<br>
<a href="mailto:Blueonyx@mail.blueonyx.it" x-apple-data-detectors="true" x-apple-data-detectors-type="link" x-apple-data-detectors-result="1">Blueonyx@mail.blueonyx.it</a><br>
<a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx" x-apple-data-detectors="true" x-apple-data-detectors-type="link" x-apple-data-detectors-result="2">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a></span><br>
<br>
</div>
<div><br>
On Oct 29, 2014, at 10:51 PM, Dirk Estenfeld <<a href="mailto:dirk.estenfeld@bpanet.de">dirk.estenfeld@bpanet.de</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div><span>Hello,</span><br>
<span></span><br>
<span>if someone have problems with imap / pop after the update.</span><br>
<span>Here is the fix for the issue</span><br>
<span></span><br>
<span><a href="http://help.directadmin.com/item.php?id=348">http://help.directadmin.com/item.php?id=348</a></span><br>
<span></span><br>
<span></span><br>
<span>regards</span><br>
<span>Dirk Estenfeld</span><br>
<span></span><br>
<span></span><br>
<span>-----------------------------------------------</span><br>
<span>Black Point Arts Internet Solutions GmbH - Hanauer Landstrasse 423a - 60314 Frankfurt</span><br>
<span></span><br>
<span>-----Ursprüngliche Nachricht-----</span><br>
<span>Von: <a href="mailto:blueonyx-bounces@mail.blueonyx.it">blueonyx-bounces@mail.blueonyx.it</a> [<a href="mailto:blueonyx-bounces@mail.blueonyx.it">mailto:blueonyx-bounces@mail.blueonyx.it</a>] Im Auftrag von Dirk Estenfeld</span><br>
<span>Gesendet: Donnerstag, 30. Oktober 2014 06:27</span><br>
<span>An: BlueOnyx General Mailing List</span><br>
<span>Betreff: [BlueOnyx:16287] Re: Yum Updates: vs. SSLv3 "Pootle" Vulnerability</span><br>
<span></span><br>
<span>Michael,</span><br>
<span></span><br>
<span>now _all_ of our BO Server do not accept ftp any longer :(</span><br>
<span></span><br>
<span>Please asap check and fix this issue ...</span><br>
<span></span><br>
<span>Thank you and regards,</span><br>
<span>Dirk</span><br>
<span></span><br>
<span></span><br>
<span>-----------------------------------------------</span><br>
<span>Black Point Arts Internet Solutions GmbH - Hanauer Landstrasse 423a - 60314 Frankfurt</span><br>
<span></span><br>
<span></span><br>
<span>-----Ursprüngliche Nachricht-----</span><br>
<span>Von: <a href="mailto:blueonyx-bounces@mail.blueonyx.it">blueonyx-bounces@mail.blueonyx.it</a> [<a href="mailto:blueonyx-bounces@mail.blueonyx.it">mailto:blueonyx-bounces@mail.blueonyx.it</a>] Im Auftrag von Michael Stauber</span><br>
<span>Gesendet: Donnerstag, 30. Oktober 2014 03:45</span><br>
<span>An: BlueOnyx General Mailing List</span><br>
<span>Betreff: [BlueOnyx:16284] Yum Updates: vs. SSLv3 "Pootle" Vulnerability</span><br>
<span></span><br>
<span>Hi all,</span><br>
<span></span><br>
<span>I wish I could have done this sooner, but last week I was on a holiday.</span><br>
<span>The work was pretty complex, but is finally done:</span><br>
<span></span><br>
<span>The following YUM updates have just been published for BlueOnyx 5106R,</span><br>
<span>5107R, 5108R, 5207R and 5208R:</span><br>
<span></span><br>
<span>base-admserv-*</span><br>
<span>base-apache-*</span><br>
<span>base-email-*</span><br>
<span>dovecot-2.2.15-1BX01</span><br>
<span>proftpd-1.3.5-1BX1</span><br>
<span></span><br>
<span>They deal with the recently announced Pootle SSLv3 vulnerability and</span><br>
<span>turn off SSLv3 support for the services AdmServ (GUI), Apache, POP3/IMAP</span><br>
<span>and FTP.</span><br>
<span></span><br>
<span>Dovecot was updated to version 2.2.15 on all BlueOnyx versions. On 5106R</span><br>
<span>it supports only TLSv1.0, as the underlying OpenSSL is too old. On all</span><br>
<span>other BlueOnyx versions it supports TLSv1.2, TLSv1.1 and TLSv1.0.</span><br>
<span></span><br>
<span>ProFTPD was also updated to the latest version (v1.3.5), which</span><br>
<span>(finally!) handles TLSv1.2 as well as TLSv1.1 and TLSv1.0. But as</span><br>
<span>before: On BlueOnyx 5106R only TLSv1.0 is available due to the ancient</span><br>
<span>OpenSSL version that ships with CentOS5.</span><br>
<span></span><br>
<span>Caveats:</span><br>
<span>========</span><br>
<span></span><br>
<span>This is a somewhat massive and intrusive update. Especially so on 5106R,</span><br>
<span>where we went from Dovecot 1.1.X straight to the latest available</span><br>
<span>version. When Dovecot gets updated, it will need to recalculate the</span><br>
<span>2048bit Diffie-Hellman ciphers. This can easily take several minutes,</span><br>
<span>during which the polling of emails via IMAPS or POP3S is not possible.</span><br>
<span>Please wait for it to finish. If you restart Dovecot during that period,</span><br>
<span>it will recalculate the DH-ciphers again until it finally completes it.</span><br>
<span>After that it will accept TLS connections just fine without a restart of</span><br>
<span>the service.</span><br>
<span></span><br>
<span>As SSLv3 is now turned off for all services you might get the odd call</span><br>
<span>from clients who are no longer able to connect to secure POP3, secure</span><br>
<span>IMAP, secure FTP or maybe even to a webpage via HTTPS. Most likely they</span><br>
<span>will be using Windows XP with some really old browsers (like IE6) or an</span><br>
<span>ancient Outlook or similar, which don't support even TLSv1.0 and fall</span><br>
<span>back to the compromised SSLv3 protocol, which we just disabled entirely.</span><br>
<span></span><br>
<span>Unless they upgrade they are out of luck. Windows XP is end of life and</span><br>
<span>we will no longer cripple the security of our OS to accommodate them.</span><br>
<span></span><br>
<span>If you get such a report from a client that is *not* using Windows XP,</span><br>
<span>please ask them to update their email client or browser or FTP client to</span><br>
<span>the latest version and to check the connection settings. They might have</span><br>
<span>to change their account settings to use TLS instead of SSLv3.</span><br>
<span></span><br>
<span>If you have problems with this updates, then please report them via the</span><br>
<span>BlueOnyx General Mailing List by replying to this message.</span><br>
<span></span><br>
<span>-- </span><br>
<span>With best regards</span><br>
<span></span><br>
<span>Michael Stauber</span><br>
<span>_______________________________________________</span><br>
<span>Blueonyx mailing list</span><br>
<span><a href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a></span><br>
<span><a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a></span><br>
<span></span><br>
<span>_______________________________________________</span><br>
<span>Blueonyx mailing list</span><br>
<span><a href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a></span><br>
<span><a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a></span><br>
<span></span><br>
<span>_______________________________________________</span><br>
<span>Blueonyx mailing list</span><br>
<span><a href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a></span><br>
<span><a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a></span><br>
</div>
</blockquote>
</div>
</blockquote>
<blockquote type="cite">
<div><span>_______________________________________________</span><br>
<span>Blueonyx mailing list</span><br>
<span><a href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a></span><br>
<span><a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a></span><br>
</div>
</blockquote>
</body>
</html>