<div dir="ltr"><div>One thing you might check is the cipher set you're using.</div><div><br></div><div>I can connect to <a href="https://tpg.com.au">https://tpg.com.au</a> with TLS1.2 just fine.</div><div><br></div><div>TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, 256 bit keys, TLS1.2</div><div><br></div><div>Output of following can usually highlight problems:</div><div><br></div><div>openssl s_client -connect <a href="http://mx1.tpgi.com.au:465">mx1.tpgi.com.au:465</a></div><div>or<br></div><div>curl -v smtps://<a href="http://mx1.tpgi.com.au:465">mx1.tpgi.com.au:465</a><br></div><div><br></div><div>Kind regards<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 24 July 2018 at 14:45, Bradley Silverman <span dir="ltr"><<a href="mailto:bsilverman@staff.ventraip.com" target="_blank">bsilverman@staff.ventraip.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I think I am still doing a poor job of explaining the scenario clearly, which is making everyone go off track with this.<div><br></div><div>We can receive emails from MTAs and the like, without any authentication, without TLS. That is perfectly fine and PCI compliant.</div><div>IF authentication is required (like users sending email with us as <i>their</i> outgoing server), then TLSv1.1 or higher is required. That's because confidential credentials are being sent, the username and password specifically.</div><div><br></div><div>It isn't possible to set TLSv1.0 for un-authenticated email, and TLSv1.1 for authenticated, though that would fix the problem.</div><div>If TPG were using TLS1.1 OR sending without TLS at all, everything would be perfectly fine.</div><div><br></div><div>While I agree that TPG aren't doing the 'wrong' thing, they are using a protocol that is almost 20 years old and generally considered not secure.</div><div><br></div><div>We got some great details to get in touch with them (thanks for that) and we are working towards a solution. Thanks to everyone for responding and have a great day!</div></div><div class="gmail_extra"><span class=""><br clear="all"><div><div class="m_-6866059528778312938gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr">Regards,<div><br></div><div>Bradley Silverman | VentraIP Australia<br><b>Technical Operations</b><br><br>mobile. +61 418 641 103<br>phone. +61 3 9013 8464<br></div></div></div></div></div></div>
<br></span><div><div class="h5"><div class="gmail_quote">On Tue, Jul 24, 2018 at 1:59 PM, Scott Howard <span dir="ltr"><<a href="mailto:scott@doc.net.au" target="_blank">scott@doc.net.au</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto">My take would be that for a general service provider, like TPG, you should be as accepting as possible. That would including accepting clear text and TLS 1.0 (although possibly not SSLv3). Any specific sender or recipient can enforce stronger limitations if they choose to do so.<div dir="auto"><br></div><div dir="auto">For a provider that has any focus on security it's potentially a different story. In that case enforcing TLS1.2 potentially makes sense, although it the raises the question around what you do with servers that don't support TLS at all, or like TPG at the moment, don't support TLS higher than 1.0 (is cleartext better than TLS1.0?)<br><div dir="auto"><br></div><div dir="auto">Then there's the elephant in the room when it comes to SMTP around certificate verification, and if/how you determine your talking to the correct mail server (at which point you have to move the conversation over to things like DNSSEC)</div><span class="m_-6866059528778312938HOEnZb"><font color="#888888"><div dir="auto"><br></div><div dir="auto"> Scott</div><div dir="auto"><br></div><div dir="auto"><br></div></font></span></div></div><div class="m_-6866059528778312938HOEnZb"><div class="m_-6866059528778312938h5"><br><div class="gmail_quote"><div dir="ltr">On Tue, Jul 24, 2018, 09:48 Paul Wilkins <<a href="mailto:paulwilkins369@gmail.com" target="_blank">paulwilkins369@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Should TLS 1.0 be acceptable?</div><div><br></div><div>I don't claim to be a crypto geek.</div><div><br></div><div>Curiously the ISM standards make TLS 1.2 only advisory:</div><div><br></div><div><ul><li>Control: 1447; Revision: 0; Updated: Apr-15; Applicability: UD, P, C, S, TS; Compliance: must; Authority: AA</li><ul><li>Agencies <b>must use TLS</b>.</li><li><br></li></ul><li>Control: 1139; Revision: 3; Updated: Apr-15; Applicability: UD, P, C, S, TS; Compliance: should; Authority: AA</li><ul><li>Agencies <b>should use the latest version of TLS</b></li></ul></ul>Kind regards<div class="m_-6866059528778312938m_-4968152334143482805m_-2151073009425191506gmail-yj6qo m_-6866059528778312938m_-4968152334143482805m_-2151073009425191506gmail-ajU"><div id="m_-6866059528778312938m_-4968152334143482805m_-2151073009425191506gmail-:qs" class="m_-6866059528778312938m_-4968152334143482805m_-2151073009425191506gmail-ajR"><img class="m_-6866059528778312938m_-4968152334143482805m_-2151073009425191506gmail-ajT" src="https://ssl.gstatic.com/ui/v1/icons/mail/images/cleardot.gif"></div></div><span class="m_-6866059528778312938m_-4968152334143482805m_-2151073009425191506gmail-HOEnZb m_-6866059528778312938m_-4968152334143482805m_-2151073009425191506gmail-adL"><font color="#888888"><br>Paul Wilkins</font></span><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 24 July 2018 at 11:10, Scott Howard <span dir="ltr"><<a href="mailto:scott@doc.net.au" rel="noreferrer" target="_blank">scott@doc.net.au</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><span>On Mon, Jul 23, 2018 at 6:00 PM, Noel Butler <span dir="ltr"><<a href="mailto:noel.butler@ausics.net" rel="noreferrer" target="_blank">noel.butler@ausics.net</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="font-size:10pt"><div dir="ltr">
You are the one choosing to use cpanel/plesk, lazy webhost solutions that puts all your customers eggs in the one single basket (though I heard plesk may soon be changing that), sorry, but that is not TPG's fault your chosen hosting software lives in the 90s.</div><span class="m_-6866059528778312938m_-4968152334143482805m_-2151073009425191506m_-1051376555541353626gmail-HOEnZb"><font color="#888888">
<div></div></font></span></div></blockquote><div><br></div></span><div>Perhaps not, but it IS TPG's fault that their mail server is only supporting encryption algorithms that live in the 90's...</div><div><br></div><div>Irrespective of the PCI argument or not, TPG supporting TLS 1.0 but not higher in 2018 simply shouldn't be seen as acceptable.</div><span class="m_-6866059528778312938m_-4968152334143482805m_-2151073009425191506HOEnZb"><font color="#888888"><div><br></div><div> Scott</div><div><br></div></font></span></div></div></div>
<br>______________________________<wbr>_________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net" rel="noreferrer" target="_blank">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer noreferrer" target="_blank">http://lists.ausnog.net/mailma<wbr>n/listinfo/ausnog</a><br>
<br></blockquote></div><br></div>
______________________________<wbr>_________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net" rel="noreferrer" target="_blank">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer noreferrer" target="_blank">http://lists.ausnog.net/mailma<wbr>n/listinfo/ausnog</a><br>
</blockquote></div>
</div></div><br>______________________________<wbr>_________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer" target="_blank">http://lists.ausnog.net/mailma<wbr>n/listinfo/ausnog</a><br>
<br></blockquote></div><br></div></div></div>
</blockquote></div><br></div>