[archive] Mail client configuration for d-thinker.org mailbox

[lingu]

Thunderbird complains weak keys due to the logjam attack -- https://weakdh.org/

The zimbra server should use a stronger key. Otherwise Thunderbird declines to connect to the server to do POP3.

As a workaround, I set the following items to false so that Thunderbird does not tell the server it can use short keys, and this appears to make POP3 work with the server with a weak key.

security.ssl3.dhe_rsa_aes_128_sha;false
security.ssl3.dhe_rsa_aes_256_sha;false

[lingu]

(01-14-2016 08:29 PM)lingu Wrote:  Thunderbird complains weak keys due to the logjam attack -- https://weakdh.org/

The zimbra server should use a stronger key. Otherwise Thunderbird declines to connect to the server to do POP3.

As a workaround, I set the following items to false so that Thunderbird does not tell the server it can use short keys, and this appears to make POP3 work with the server with a weak key.

security.ssl3.dhe_rsa_aes_128_sha;false
security.ssl3.dhe_rsa_aes_256_sha;false

I've written a separate thread for this -- http://tab.d-thinker.org/showthread.php?tid=4880

[lingu]

(08-26-2014 05:29 AM)DaY Wrote:  web client address: http://mx.d-thinker.org:9980

mail client configuration:
pop server address: mx.d-thinker.org, port: 995, using SSL authentication

POP3 uses SSL/TLS with a normal password without encryption? This is what works for me in Thunderbird, and it takes me quite a while to guess this setting.

[lingu]

(01-14-2016 09:40 AM)amoners Wrote:  

(01-13-2016 11:56 PM)lingu Wrote:  

(12-13-2015 03:28 PM)amoners Wrote:  

(12-13-2015 11:45 AM)lingu Wrote:  Thunderbird is not happy with mx.d-thinker.org's certificate.

I can't get point... I thought Zhiqiang use Thunderbird, you may get some experience from him.

is the certificate made for mx.d-thinker.org?

I checked certificate, It made for d-thinker.org. Should I correct it?

I don't know. What should it be made to? We need to follow the conventions of email systems.

[zma]

(12-13-2015 03:28 PM)amoners Wrote:  

(12-13-2015 11:45 AM)lingu Wrote:  Thunderbird is not happy with mx.d-thinker.org's certificate.

I can't get point... I thought Zhiqiang use Thunderbird, you may get some experience from him.

I just kept using an old version of nss and thunderbird that can accept mx.d-thinker.org's keys http://tab.d-thinker.org/showthread.php?tid=3484

I came across this https://wiki.zimbra.com/wiki/Disabling_t...https://wiki.zimbra.com/wiki/Disabling_the_use_of_weak_DH_keys_in_Zimbra_Collaboratio . We may consider the solution there instead of client-by-client configurations.

[lingu]

(01-19-2016 10:57 AM)zma Wrote:  

(12-13-2015 03:28 PM)amoners Wrote:  

(12-13-2015 11:45 AM)lingu Wrote:  Thunderbird is not happy with mx.d-thinker.org's certificate.

I can't get point... I thought Zhiqiang use Thunderbird, you may get some experience from him.

I just kept using an old version of nss and thunderbird that can accept mx.d-thinker.org's keys http://tab.d-thinker.org/showthread.php?tid=3484

I came across this https://wiki.zimbra.com/wiki/Disabling_t...https://wiki.zimbra.com/wiki/Disabling_the_use_of_weak_DH_keys_in_Zimbra_Collaboratio . We may consider the solution there instead of client-by-client configurations.

The resolution in the linked page suggests upgrading zimbra. That is fine. Another way is to modify the server code or certificate to use stronger keys.

[amoners]

I found some lines in the linked page. It works, may I do this on d-thinker.org mail server?

Quote:Disabling the insecure ciphers, will make Firefox happy again:

zmprov mcf +zimbraSSLExcludeCipherSuites TLS_DHE_RSA_WITH_AES_128_CBC_SHA
zmprov mcf +zimbraSSLExcludeCipherSuites TLS_DHE_RSA_WITH_AES_256_CBC_SHA
zmprov mcf +zimbraSSLExcludeCipherSuites SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
zmmailboxdctl restart

[lingu]

(01-20-2016 10:16 AM)amoners Wrote:  I found some lines in the linked page. It works, may I do this on d-thinker.org mail server?

Quote:Disabling the insecure ciphers, will make Firefox happy again:

zmprov mcf +zimbraSSLExcludeCipherSuites TLS_DHE_RSA_WITH_AES_128_CBC_SHA
zmprov mcf +zimbraSSLExcludeCipherSuites TLS_DHE_RSA_WITH_AES_256_CBC_SHA
zmprov mcf +zimbraSSLExcludeCipherSuites SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
zmmailboxdctl restart

OK. It's worth trying. Make sure that 1. you can go back, 2. the down time is short, 3. you test the email system well after the change.

[amoners]

(01-20-2016 05:27 PM)lingu Wrote:  

(01-20-2016 10:16 AM)amoners Wrote:  I found some lines in the linked page. It works, may I do this on d-thinker.org mail server?

Quote:Disabling the insecure ciphers, will make Firefox happy again:

zmprov mcf +zimbraSSLExcludeCipherSuites TLS_DHE_RSA_WITH_AES_128_CBC_SHA
zmprov mcf +zimbraSSLExcludeCipherSuites TLS_DHE_RSA_WITH_AES_256_CBC_SHA
zmprov mcf +zimbraSSLExcludeCipherSuites SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
zmmailboxdctl restart

OK. It's worth trying. Make sure that 1. you can go back, 2. the down time is short, 3. you test the email system well after the change.

Yes, it can use command of zimbra go back. the down time is short since just need restart service. I have done it before, and it works to me without setting with thunderbird.

[lingu]

(01-25-2016 10:20 AM)amoners Wrote:  

(01-20-2016 05:27 PM)lingu Wrote:  

(01-20-2016 10:16 AM)amoners Wrote:  I found some lines in the linked page. It works, may I do this on d-thinker.org mail server?

Quote:Disabling the insecure ciphers, will make Firefox happy again:

zmprov mcf +zimbraSSLExcludeCipherSuites TLS_DHE_RSA_WITH_AES_128_CBC_SHA
zmprov mcf +zimbraSSLExcludeCipherSuites TLS_DHE_RSA_WITH_AES_256_CBC_SHA
zmprov mcf +zimbraSSLExcludeCipherSuites SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
zmmailboxdctl restart

OK. It's worth trying. Make sure that 1. you can go back, 2. the down time is short, 3. you test the email system well after the change.

Yes, it can use command of zimbra go back. the down time is short since just need restart service. I have done it before, and it works to me without setting with thunderbird.

OK, go ahead. Make sure to record duly.