tuxad blog

RHEL 5 postfix poodle patch

More than one week ago the world was shocked by the SSLv3 protocol vulnerability named "POODLE". Red Hat doesn't provide an updated postfix package for RHEL 5 but offers a "resolution" by showing how to disable SSLv3 on postfix. Actually the solution is nonsense. RH says that you must enable this configuration:

smtpd_tls_mandatory_protocols = TLSv1
smtp_tls_mandatory_protocols = TLSv1
smtpd_enforce_tls = yes
smtp_enforce_tls = yes

RH just adds a small note that "your servers may fail to receive data from certain delivery agents" - a nice understatement. Actually it breaks RFC 2487:

A publicly-referenced SMTP server MUST NOT require use of the STARTTLS extension in order to deliver mail locally. This rule prevents the STARTTLS extension from damaging the interoperability of the Internet's SMTP infrastructure. A publicly-referenced SMTP server is an SMTP server which runs on port 25 of an Internet host listed in the MX record (or A record if an MX record is not present) for the domain name on the right hand side of an Internet mail address.

If you run a public mailserver then you CAN'T use mandatory TLS because mailserver without TLS can't deliver to you. You SHOULD use opportunistic TLS. "Opportunistic" means that if a TLS connection to your mailserver fails then a fallback to plain SMTP will happen.

Postfix 2.3 only knows the _mandatory_ options which will only disable SSLv3 in mandatory TLS mode. To switch off SSLv3 you need i.e. a patch for the postfix package.

You can easily prove that Red Hat's config doesn't disable SSLv3 in opportunistic TLS mode:

$ openssl s_client -starttls smtp \
  -connect 127.0.0.1:25 -ssl3 </dev/null
...
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 3072 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : DHE-RSA-AES256-SHA
...

To disable SSLv2 and SSLv3 you need a small patch which you can easily apply to the SRPM package. After building and installling the package you won't get SSLv3 connections to your server anymore:

$ openssl s_client -starttls smtp \
  -connect 127.0.0.1:25 -ssl3 </dev/null
CONNECTED(00000003)
5319:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl
handshake failure:s3_pkt.c:536:

Update 2015-08-09: The package is included in the tuxad repo.