{"thread":{"id":"61927","subject":"git send-email with ancient SMTP server … dh key too small","startedAt":"2024-08-09T10:22:59Z","lastAt":"2024-08-10T10:27:10Z","messageCount":3,"participants":["Matěj Cepl","brian m. carlson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"500533","messageId":"D3BAXOA4NL74.29XYKS0IO8UFC@cepl.eu","threadId":"61927","inReplyTo":null,"subject":"git send-email with ancient SMTP server … dh key too small","fromName":"Matěj Cepl","fromEmail":"mcepl@cepl.eu","sentAt":"2024-08-09T10:17:14Z","receivedAt":"2024-08-09T10:22:59Z","isPatch":false,"sender":{"key":"mcepl@cepl.eu","avatar":"https://avatars.githubusercontent.com/u/198999?v=4"},"body":"When using git send-email sending to very ancient SMTP server\n(postfix 2.6.6 on CentOS 6), I get this error:\n\nSTARTTLS failed! SSL connect attempt failed error:0A00018A:SSL routines::dh key too small at /usr/libexec/git/git-send-email line 1638.\n\nWhen looking what seems like a similar error at\nhttps://github.com/symfony/symfony/issues/44393 it seems I need\nto set `security_level` (whatever it is) to 1. Is it possible\nto do it just with configuration of git or do I need to patch\nsomething somewhere?\n\nThank you for any reply,\n\nMatěj Cepl\n\n-- \nhttp://matej.ceplovi.cz/blog/, @mcepl@floss.social\nGPG Finger: 3C76 A027 CA45 AD70 98B5  BC1D 7920 5802 880B C9D8\n \nOpportunity is missed by most people because it is dressed in\noveralls and looks like work.\n  -- Thomas A. Edison\n"},{"id":"500560","messageId":"ZrZrVpYdSPb731_p@tapette.crustytoothpaste.net","threadId":"61927","inReplyTo":"D3BAXOA4NL74.29XYKS0IO8UFC@cepl.eu","subject":"Re: git send-email with ancient SMTP server … dh key too smalll","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2024-08-09T19:17:42Z","receivedAt":"2024-08-09T19:17:50Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2024-08-09 at 10:17:14, Matěj Cepl wrote:\n> When using git send-email sending to very ancient SMTP server\n> (postfix 2.6.6 on CentOS 6), I get this error:\n> \n> STARTTLS failed! SSL connect attempt failed error:0A00018A:SSL routines::dh key too small at /usr/libexec/git/git-send-email line 1638.\n\nThis probably means that the DH key is insecure, so sending mail to this\nserver with TLS probably won't provide sufficient security.  You may\nwant to reconsider using this mail server, especially since it hasn't\nhad security updates for well over 3.5 years.\n\nIf you're using level 2, then the requirement is the equivalent of 112\nbits of security, which is still inadequate by today's standards (which\nsuggest 128 bits of security, or level 3).  Level 1 is 80 bits, which is\nprobably attackable by government agencies.\n\n> When looking what seems like a similar error at\n> https://github.com/symfony/symfony/issues/44393 it seems I need\n> to set `security_level` (whatever it is) to 1. Is it possible\n> to do it just with configuration of git or do I need to patch\n> something somewhere?\n\nWhat you're looking for is an OpenSSL configuration on your system.  On\nmy Debian system, the configuration file is in `/etc/ssl/openssl.cnf`.\nThe steps for what you need to set are available at several different\nplaces online.\nhttps://askubuntu.com/questions/1233186/ubuntu-20-04-how-to-set-lower-ssl-security-level\nis an example you can use.\n\nI don't believe that Git provides a set of TLS configuration options for\n`git send-email`, but if it did, you could control the configuration by\nspecifying cipher suites as `DEFAULT@SECLEVEL=1`.  You might, but\nprobably would not, need to configure the minimum protocol to something\nlower as well.  I believe CentOS 6 does support TLS 1.2, so that should\nbe a fine default and shouldn't need to be modified.\n-- \nbrian m. carlson (they/them or he/him)\nToronto, Ontario, CA\n"},{"id":"500595","messageId":"D3C5RQ4Q7N5K.1OE55HRDAYH0A@cepl.eu","threadId":"61927","inReplyTo":"ZrZrVpYdSPb731_p@tapette.crustytoothpaste.net","subject":"Re: git send-email with ancient SMTP server … dh key too smalll","fromName":"Matěj Cepl","fromEmail":"mcepl@cepl.eu","sentAt":"2024-08-10T10:27:03Z","receivedAt":"2024-08-10T10:27:10Z","isPatch":false,"sender":{"key":"mcepl@cepl.eu","avatar":"https://avatars.githubusercontent.com/u/198999?v=4"},"body":"On Fri Aug 9, 2024 at 9:17 PM CEST, brian m. carlson wrote:\n> If you're using level 2, then the requirement is the equivalent of 112\n> bits of security, which is still inadequate by today's standards (which\n> suggest 128 bits of security, or level 3).  Level 1 is 80 bits, which is\n> probably attackable by government agencies.\n\nWe are talking about sending patches to the public email lists\n(and yes, considering my other emails, I can live with them\nbeing snooped on by government agencies, they are welcome to my\nramblings in emails).\n\n> What you're looking for is an OpenSSL configuration on your system.  On\n> my Debian system, the configuration file is in `/etc/ssl/openssl.cnf`.\n> The steps for what you need to set are available at several different\n> places online.\n> https://askubuntu.com/questions/1233186/ubuntu-20-04-how-to-set-lower-ssl-security-level\n> is an example you can use.\n\nWell, but that would degrade the security of the whole system for\nall purposes it uses OpenSSL, right? That’s rather too drastic.\n\n> I don't believe that Git provides a set of TLS configuration options for\n> `git send-email`, but if it did, you could control the configuration by\n> specifying cipher suites as `DEFAULT@SECLEVEL=1`.  You might, but\n> probably would not, need to configure the minimum protocol to something\n> lower as well.  I believe CentOS 6 does support TLS 1.2, so that should\n> be a fine default and shouldn't need to be modified.\n\nThank you, I will take a look. I found\nhttps://stackoverflow.com/q/34176433 and\nhttps://stackoverflow.com/a/36417794, so I will take a look at\nthe Perl code.\n\nBest,\n\nMatěj\n\n-- \nhttp://matej.ceplovi.cz/blog/, @mcepl@floss.social\nGPG Finger: 3C76 A027 CA45 AD70 98B5  BC1D 7920 5802 880B C9D8\n \nSee, when the GOVERNMENT spends money, it creates jobs; whereas\nwhen the money is left in the hands of TAXPAYERS, God only knows\nwhat they do with it. Bake it into pies, probably. Anything to\navoid creating jobs.\n    -- Dave Barry\n\n"}]}