[AusNOG] Issues receiving from TPG Mail servers.
James Hodgkinson
yaleman at ricetek.net
Mon Jul 23 19:34:23 EST 2018
I think we all need to step back a bit, let OP do what his auditor feels
is right, then thank him on behalf of EFF’s StartTLSEverywhere
project... [1]
;)
James
[1] https://starttls-everywhere.org
On Mon, 23 Jul 2018, at 18:21, Mark Foster wrote:
> Maybe i've missed something. Email is valid to shift around in plain
> text. TLS 1.0 might not be acceptable if you're talking minimum
> encryption standards, but I agree with the posters that point out that
> the Payment Card environment should have no dependencies on any email
> exchange with third parties. This sounds to me like a box-ticking
> exercise where the right action on the public internet is to generally
> support the lowest common denominator unless it's insecure to do so -
> and in the case of email, you have to assume all transactions are
> insecure anyway unless you have end-to-end controls in place (which
> clearly you don't in this case if TPG is one end!)> In the end you should be able to exchange email with TPG without any
> encryption at all and it shouldn't affect your compliance, surely?! As
> you can't be held responsible for a third party system and shouldn't
> be dependent on its status for your compliance as a result.> Disclaimer: Have never tried to seek PCI compliance in any system i've
> operated.> Mark.
>
> On 23/07/2018 7:03 PM, Paul Wilkins wrote:
>> PCI spec is pretty clear you're to have separation (virtual/physical)
>> between PCI and other environments.>>
>> OTOH, TPG SLA's do not require TLS1.0+.
>>
>> Someone is going to have to sling for an external MTA.
>>
>> Kind regards
>>
>> Paul Wilkins
>>
>> On 23 July 2018 at 16:01, Michael Junek
>> <michael at juneks.com.au> wrote:>>
>>> Just being the 'mean security consultant' - the security level of
>>> each system could easily be argued - email would be considered low
>>> security for compatibility (which technically means that TLS1.0/SSL3
>>> etc is acceptable) ; whereas the web servers are considered high
>>> security handling CHD, which means that they should covered under
>>> the full encrypted spec. It would also mean if that was considered,
>>> that 2.2.1 would apply, and seperation of function would be
>>> required.>>>
>>>
>>>
>>> *From:* Bradley Silverman <bsilverman at staff.ventraip.com> *Sent:*
>>> Monday, 23 July 2018 15:56 *To:* Michael Junek *Cc:* Mark Newton;
>>> ausnog at lists.ausnog.net>>>
>>> *Subject:* Re: [AusNOG] Issues receiving from TPG Mail servers.>>>
>>>
>>> @Michael - That's what we are looking at doing, though it will be a
>>> pain. Not sure how to go about doing it with Exim & cPanel but will
>>> start looking into it.>>>
>>> Re 2.2.1, it won't fail if they have the same security level, which
>>> is what we are trying to accomplish by bringing TPG into spec. DNS
>>> is on separate servers, and the database connection isn't publicly
>>> accessible.>>>
>>> Really appreciate the help with this gents. Hopefully TPG get back
>>> in touch with me else we will have to investigate ways of blocking
>>> TLS handshakes from TPG.>>>
>>> Regards,
>>>
>>> Bradley Silverman | VentraIP Australia
>>> *Technical Operations*
>>>
>>> mobile. +61 418 641 103
>>> phone. +61 3 9013 8464
>>>
>>> On Mon, Jul 23, 2018 at 3:48 PM, Michael Junek
>>> <michael at juneks.com.au> wrote:>>>
>>>> On the PCI Audit side of things, however, I think the shared
>>>> hosting such as CPanel servers will fail PCI based on requirement
>>>> 2.2.1 regardless-->>>>
>>>> "
>>>> Implement only one primary function per server to prevent functions
>>>> that require different security levels from co-existing on the same
>>>> server. (For example, web servers, database servers, and DNS should
>>>> be implemented on separate servers.)>>>> "
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> *From:* AusNOG <ausnog-bounces at lists.ausnog.net> on behalf of
>>>> Bradley Silverman <bsilverman at staff.ventraip.com> *Sent:* Monday,
>>>> 23 July 2018 15:40 *To:* Mark Newton *Cc:* ausnog at lists.ausnog.net
>>>> *Subject:* Re: [AusNOG] Issues receiving from TPG Mail servers.>>>>
>>>>
>>>> @Michael - I agree that turning it off is the best way of solving
>>>> it, the issue is we don't have the servers forcing TLS, that's TPG.>>>>
>>>> @Mark - These are shared hosting servers, think cPanel & Plesk.
>>>> The one server is both mail, and website. Which means that the
>>>> server has websites that accept credit card payments, and
>>>> therefore is subject to PCI. Any system that is on that server is
>>>> required to comply with PCI.>>>>
>>>> If the server was website only, then I'd agree 100% that it would
>>>> be out of scope for PCI, but since the same server runs both email
>>>> and websites for shared hosting customers, it is in scope.>>>>
>>>> We have zero issue with any other MTA, it is only these TPG MTA's
>>>> that are forcing both TLSv1.0 and an old cipher. If they either
>>>> turned off TLS or upgraded to TLSv1.2 they would be up to spec.>>>>
>>>> But we either have to make the decision to block TPG from being
>>>> able to send to the 100,000s of email accounts we have, or make it
>>>> so that none of our customers servers are PCI compliant. I'd rather
>>>> speak to TPG and work with them to fix the underlying problem.>>>>
>>>> Regards,
>>>>
>>>> Bradley Silverman | VentraIP Australia
>>>> *Technical Operations*
>>>>
>>>> mobile. +61 418 641 103
>>>> phone. +61 3 9013 8464
>>>>
>>>> On Mon, Jul 23, 2018 at 3:34 PM, Mark Newton
>>>> <newton at atdot.dotat.org> wrote:>>>>
>>>>> But PCI Compliance only applies to the Cardholder Data
>>>>> Environment.>>>>>
>>>>> Why on earth would you have a mail server in the Cardholder Data
>>>>> Environment?>>>>>
>>>>> And if it isn’t in the CDE: You can run whatever version of TLS
>>>>> you want, and it’s none of PCI’s business.>>>>>
>>>>>
>>>>> - mark
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>> On Jul 23, 2018, at 3:06 PM, Bradley Silverman
>>>>>> <bsilverman at staff.ventraip.com> wrote:>>>>>>
>>>>>> Hi Matt,
>>>>>>
>>>>>> Really appreciate you sending me that email, I will definitely
>>>>>> send an email through to there!>>>>>>
>>>>>> @Mark Certainly not! PCI Compliance requires that TLSv1.0 be
>>>>>> disabled on the server. Postifx/Exim/Dovecot are not exception
>>>>>> to the rule, if we disable TLSv1.0 on the server and remove the
>>>>>> weak cipher, then TPG's MTAs aren't able to send mail to us.>>>>>>
>>>>>> Regards,
>>>>>>
>>>>>> Bradley Silverman | VentraIP Australia
>>>>>> *Technical Operations*
>>>>>>
>>>>>> mobile. +61 418 641 103
>>>>>> phone. +61 3 9013 8464
>>>>>>
>>>>>> On Mon, Jul 23, 2018 at 2:48 PM, Mark Newton
>>>>>> <newton at atdot.dotat.org> wrote:>>>>>>
>>>>>>> You’re trying to exchange payment card information over email?>>>>>>>
>>>>>>>
>>>>>>> - mark
>>>>>>>
>>>>>>>> On Jul 23, 2018, at 1:30 PM, Bradley Silverman
>>>>>>>> <bsilverman at staff.ventraip.com> wrote:>>>>>>>>
>>>>>>>> Does anyone have a contact at TPG regarding their mail servers?>>>>>>>>
>>>>>>>> We are having issues with their mail servers using non-PCI
>>>>>>>> compliant ciphers which is stopping our servers accepting mail
>>>>>>>> from them.>>>>>>>>
>>>>>>>>
>>>>>>>> Regards,
>>>>>>>>
>>>>>>>> Bradley Silverman | VentraIP Australia
>>>>>>>> *Technical Operations*
>>>>>>>>
>>>>>>>> mobile. +61 418 641 103
>>>>>>>> phone. +61 3 9013 8464
>>>>>>>> _______________________________________________
>>>>>>>> AusNOG mailing list AusNOG at lists.ausnog.net
>>>>>>>> http://lists.ausnog.net/mailman/listinfo/ausnog>>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>>>
>>> _______________________________________________
>>> AusNOG mailing list
>>> AusNOG at lists.ausnog.net
>>> http://lists.ausnog.net/mailman/listinfo/ausnog
>>>
>>
>>
>>
>> _______________________________________________ AusNOG mailing list
>> AusNOG at lists.ausnog.net
>> http://lists.ausnog.net/mailman/listinfo/ausnog
>>>
> _________________________________________________
> AusNOG mailing list
> AusNOG at lists.ausnog.net
> http://lists.ausnog.net/mailman/listinfo/ausnog
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20180723/7a36529a/attachment.html>
More information about the AusNOG
mailing list