git send-email with ancient SMTP server … dh key too small

When using git send-email sending to very ancient SMTP server (postfix 2.6.6 on CentOS 6), I get this error:

STARTTLS failed! SSL connect attempt failed error:0A00018A:SSL routines::dh key too small at /usr/libexec/git/git-send-email line 1638.

When looking what seems like a similar error at https://github.com/symfony/symfony/issues/44393 it seems I need to set `security_level` (whatever it is) to 1. Is it possible to do it just with configuration of git or do I need to patch something somewhere?

Thank you for any reply,

Matěj Cepl

On 2024-08-09 at 10:17:14, Matěj Cepl wrote:

This probably means that the DH key is insecure, so sending mail to this server with TLS probably won't provide sufficient security. You may want to reconsider using this mail server, especially since it hasn't had security updates for well over 3.5 years.

If you're using level 2, then the requirement is the equivalent of 112 bits of security, which is still inadequate by today's standards (which suggest 128 bits of security, or level 3). Level 1 is 80 bits, which is probably attackable by government agencies.

What you're looking for is an OpenSSL configuration on your system. On my Debian system, the configuration file is in `/etc/ssl/openssl.cnf`. The steps for what you need to set are available at several different places online. https://askubuntu.com/questions/1233186/ubuntu-20-04-how-to-set-lower-ssl-security-level is an example you can use.

I don't believe that Git provides a set of TLS configuration options for `git send-email`, but if it did, you could control the configuration by specifying cipher suites as `DEFAULT@SECLEVEL=1`. You might, but probably would not, need to configure the minimum protocol to something lower as well. I believe CentOS 6 does support TLS 1.2, so that should be a fine default and shouldn't need to be modified.

On Fri Aug 9, 2024 at 9:17 PM CEST, brian m. carlson wrote:

We are talking about sending patches to the public email lists (and yes, considering my other emails, I can live with them being snooped on by government agencies, they are welcome to my ramblings in emails).

Well, but that would degrade the security of the whole system for all purposes it uses OpenSSL, right? That’s rather too drastic.

Thank you, I will take a look. I found https://stackoverflow.com/q/34176433 and https://stackoverflow.com/a/36417794, so I will take a look at the Perl code.

Best,

Matěj