From Newsgroup: rocksolid.nodes.help

It appears that the phpmailer is set to use STARTTLS at port 587.
This is less secure than SSL at port 465. STARTTLS is subject to MITM
protocol downgrade attack.

STARTTLS allows the client to establish a plaintext, unencrypted
connection with the mail server with no warning to the user. If this
happens both the client and the server may send credentials and message
data in the clear with no encryption. Why the brainlets who design mail
servers have allowed this state of affairs is beyond my clairvoyance.
STARTTLS should have been scrapped long ago.

To ensure security I need to configure rslight phpmailer to always
fail to connect if a secure SSL/TLS connection cannot be established at
port 465. Is there a way to force rslight phpmailer connect with
SSL/TLS or error and die, rather than STARTTLS?

The only other option I see is to configure a local proxy to connect to
the mail server and use IPTABLES to prevent the connection from
reaching out, so that STARTTLS won't expose a plaintext connection.
Even then I am not sure if this will 100% ensure against password
leakage even on localhost in the middle of a shared server farm.

Are there tips or tricks to ensure I am always getting a secure
connection with phpmailer?

--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: rocksolid.nodes.help

On Sat, 13 Jul 2024 3:30:31 +0000, Anonymous wrote:

It appears that the phpmailer is set to use STARTTLS at port 587.
This is less secure than SSL at port 465. STARTTLS is subject to MITM protocol downgrade attack.

STARTTLS allows the client to establish a plaintext, unencrypted
connection with the mail server with no warning to the user. If this
happens both the client and the server may send credentials and message
data in the clear with no encryption. Why the brainlets who design mail servers have allowed this state of affairs is beyond my clairvoyance. STARTTLS should have been scrapped long ago.

To ensure security I need to configure rslight phpmailer to always
fail to connect if a secure SSL/TLS connection cannot be established at
port 465. Is there a way to force rslight phpmailer connect with
SSL/TLS or error and die, rather than STARTTLS?

The only other option I see is to configure a local proxy to connect to
the mail server and use IPTABLES to prevent the connection from
reaching out, so that STARTTLS won't expose a plaintext connection.
Even then I am not sure if this will 100% ensure against password
leakage even on localhost in the middle of a shared server farm.

Are there tips or tricks to ensure I am always getting a secure
connection with phpmailer?

Rslight uses phpmailer: https://github.com/PHPMailer/PHPMailer

Please take a look at that page and it may provide the answers you need.

If you find a good, more secure config, please feel free to provide it
here for the rest of us to check out :)

Thanks!
--
Retro Guy
--- Synchronet 3.21a-Linux NewsLink 1.2