email issue with 9.3

[berni51]

Greetings to the party,

after updating my NetBSD machines from 9.2 to 9.3 (or also to 10.0 BETA) I have an email problem:
beside others I have 2 accounts at freenet.de, a German email provider. And only with freenet I cannot longer receive mails: TLS handshake error is the corresponding message.

This happens:
- in each mail agent (tested claws-mail, sylpheed, thunderbird, mutt, alpine)
- only on NetBSD 9.3/!0.0. Worked perfect with 9.2
- not on other OS (OpenBSD, FreeBSD, Linux)
- only with freenet.de. GMX, gmail and others run properly.

I fear that the issue is caused by openssh, but have no idea how to fix it.

Any hints?

Kind regards
Berni

[shep]

I had issues with the Default Encryption Policy in a RedHat Clone:

https://www.redhat.com/en/blog/confi...block-chaining

https://access.redhat.com/documentat...2000001OH7EAAW

My email provider was using an older algorithm that was considered insecure.

The Redhat fix was to enable "Legacy" policy.

[berni51]

That seems not to be my problem.

[shep]

With mutt, there should be some details briefly displayed with the TLS handshake errors. If you can catch the TLS version, hopefully you can do a more specific search on howto enable it in NBSD 9.3.

[berni51]

Unfortunately mutt offers no further information: Connecting to mx.freenet.de .....

however a connection is never established. I waited 30 minutes, but nothing happened.

[J65nko]

You could try to use tcpdump or wireshark to see what is going on.

[berni51]

Thx for your hints. I tried with tcpdump and openssh without getting more info. The last message is "Conneting to mx.freenet.de", and thats it until timeout.

[shep]

SSL_CONF_cmd(3)

-legacy_server_connect, -no_legacy_server_connect
Permits or prohibits the use of unsafe legacy renegotiation for
OpenSSL clients only. Equivalent to setting or clearing
SSL_OP_LEGACY_SERVER_CONNECT.

Worth trying?

[berni51]

Yes, absolutely! But currently I don't how to do this. I must read a little bit before.
Thx for this insiration.

[shep]

There may be two ways to do this.

SSL_CONF is an environment variable and could be implemented just when you connect to mx.freenet.de.

Alternatively, you may be able to set it globally in /etc/openssl.conf

https://wiki.openssl.org/index.php/O..._3.0#Providers