<p>Stephen: A download link is on its way to you!</p><p> </p>

<p>Hi!</p><p>I tried to post this the other day, but for some reason it looks like it didn't go through.  Scanmyserver.com (aka BeyondSecurity) has reported the following issues with Mercury 4.80.  I already have "weak ciphers disabled unless authenticated", but that hasn't been sufficient to help.  Is there a way to address these issues?</p><p>Thanks!</p><p> </p><div class="timeline-item clearfix" style="box-sizing: border-box; position: relative; margin-bottom: 8px; color: rgb(57, 57, 57); font-family: Roboto, sans-serif; font-size: 13px;"><div class="widget-box" style="box-sizing: border-box; box-shadow: none; padding: 0px; margin: 0px 0px 0px 60px; border: 1px solid rgb(204, 204, 204); background-color: rgb(243, 243, 243); color: rgb(97, 97, 97); position: relative; max-width: none;"><div class="widget-header header-color-orange widget-header-small" style="box-sizing: content-box; position: relative; min-height: 31px; background: linear-gradient(rgb(255, 255, 255) 0px, rgb(238, 238, 238) 100%) repeat-x rgb(247, 247, 247); color: rgb(102, 159, 199); border-bottom: 1px solid rgb(221, 221, 221); padding-left: 10px;"><h5 class="smaller" style="box-sizing: border-box; font-family: 'Open Sans', 'Helvetica Neue', Helvetica, Arial, sans-serif; font-weight: 400; line-height: 1.1; color: inherit; margin-top: 10px; margin-bottom: 10px; font-size: 14px;">Sweet32 Birthday Attacks on 64-bit Block Ciphers in TLS and OpenVPN (DES-CBC3)</h5><span class="widget-toolbar" style="box-sizing: border-box; display: inline-block; padding: 0px 10px; line-height: 29px; float: right; position: relative;"><a data-action="collapse" style="box-sizing: border-box; background-color: transparent; color: rgb(170, 170, 170); text-decoration-line: none; font-size: 14px; margin: 0px 1px; display: inline-block; padding: 0px; line-height: 24px; cursor: pointer; transition: transform 0.1s ease 0s;" href="https://scanmyserver.com/my_account/?#"><span class="ace-icon fa fa-chevron-up" style="box-sizing: border-box; display: inline-block; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; line-height: 1; font-family: FontAwesome; font-size: inherit; text-rendering: auto; -webkit-font-smoothing: antialiased; text-align: center; margin-right: 0px;"></span></a></span></div><div class="widget-body" style="box-sizing: border-box; background-color: transparent;"><div class="widget-main" style="box-sizing: border-box; padding: 12px; margin: 0px; position: relative; max-width: none; border-bottom-width: 0px;"><dl id="dt-list-1" class="dl-horizontal" style="box-sizing: border-box; margin-top: 0.5em; margin-bottom: 1em;"><dt style="box-sizing: border-box; line-height: 1.42857; font-weight: 700; float: left; width: 160px; overflow: hidden; clear: left; text-align: right; text-overflow: ellipsis; white-space: nowrap;">Summary</dt><dd style="box-sizing: border-box; line-height: 1.42857; margin-left: 180px; padding-left: 1em;">This test detects SSL ciphers DES-CBC3 supported by the remote service for encrypting communications.<br style="box-sizing: border-box;"><br style="box-sizing: border-box;"><div class="output" style="box-sizing: border-box; overflow: auto; padding: 0.5em; border: 1px solid;">Weak Cipher DES-CBC3 found: (Cipher: DES-CBC3-SHA|SSLv3|Kx=RSA|Au=RSA|Enc=3DES(168)|Mac=SHA1) (Cipher: DES-CBC3-SHA|TLSv1|Kx=RSA|Au=RSA|Enc=3DES(168)|Mac=SHA1)</div></dd><dt style="box-sizing: border-box; line-height: 1.42857; font-weight: 700; float: left; width: 160px; overflow: hidden; clear: left; text-align: right; text-overflow: ellipsis; white-space: nowrap;">Port</dt><dd style="box-sizing: border-box; line-height: 1.42857; margin-left: 180px; padding-left: 1em;">imaps (993/tcp)</dd><dt style="box-sizing: border-box; line-height: 1.42857; font-weight: 700; float: left; width: 160px; overflow: hidden; clear: left; text-align: right; text-overflow: ellipsis; white-space: nowrap;">Solution</dt><dd style="box-sizing: border-box; line-height: 1.42857; margin-left: 180px; padding-left: 1em;">See solution found at: <a target="_blank" rel="nofollow" style="box-sizing: border-box; background-color: transparent; color: rgb(51, 122, 183); text-decoration-line: none; cursor: pointer;" href="https://www.openssl.org/blog/blog/2016/08/24/sweet32/">https://www.openssl.org/blog/blog/2016/08/24/sweet32/</a></dd><dt style="box-sizing: border-box; line-height: 1.42857; font-weight: 700; float: left; width: 160px; overflow: hidden; clear: left; text-align: right; text-overflow: ellipsis; white-space: nowrap;">External sources</dt><dd style="box-sizing: border-box; line-height: 1.42857; margin-left: 180px; padding-left: 1em;"><a target="_blank" rel="nofollow" style="box-sizing: border-box; background-color: transparent; color: rgb(51, 122, 183); text-decoration-line: none; cursor: pointer;" href="https://sweet32.info/">https://sweet32.info/</a></dd><dt style="box-sizing: border-box; line-height: 1.42857; font-weight: 700; float: left; width: 160px; overflow: hidden; clear: left; text-align: right; text-overflow: ellipsis; white-space: nowrap;">CVE</dt><dd style="box-sizing: border-box; line-height: 1.42857; margin-left: 180px; padding-left: 1em;"><a target="_new" style="box-sizing: border-box; background-color: transparent; color: rgb(51, 122, 183); text-decoration-line: none; cursor: pointer;" href="http://www.securiteam.com/cgi-bin/cve.pl?cve=CVE-2016-2183">CVE-2016-2183</a></dd><dt style="box-sizing: border-box; line-height: 1.42857; font-weight: 700; float: left; width: 160px; overflow: hidden; clear: left; text-align: right; text-overflow: ellipsis; white-space: nowrap;">Test ID</dt><dd style="box-sizing: border-box; line-height: 1.42857; margin-left: 180px; padding-left: 1em;">19146</dd></dl></div></div></div></div><div class="timeline-item clearfix" style="box-sizing: border-box; position: relative; margin-bottom: 8px; color: rgb(57, 57, 57); font-family: Roboto, sans-serif; font-size: 13px;"><div class="timeline-info" style="box-sizing: border-box; float: left; width: 60px; text-align: center; position: relative;"><i class="timeline-indicator icon-circle btn btn-warning no-hover" style="box-sizing: border-box; display: inline-block; padding: 0px; margin: 0px; font-size: 16px; line-height: 30px; white-space: nowrap; vertical-align: middle; touch-action: manipulation; cursor: default; user-select: none; border-radius: 100%; transition: background-color 0.15s ease 0s, border-color 0.15s ease 0s, opacity 0.15s ease 0s; position: relative; opacity: 1; height: 36px; width: 36px; background-image: none !important; border: 3px solid rgb(255, 255, 255) !important; color: rgb(255, 255, 255) !important; background-color: rgb(255, 183, 82) !important; text-shadow: none !important; box-shadow: none !important;"></i></div><div class="widget-box" style="box-sizing: border-box; box-shadow: none; padding: 0px; margin: 0px 0px 0px 60px; border: 1px solid rgb(204, 204, 204); background-color: rgb(243, 243, 243); color: rgb(97, 97, 97); position: relative; max-width: none;"><div class="widget-header header-color-orange widget-header-small" style="box-sizing: content-box; position: relative; min-height: 31px; background: linear-gradient(rgb(255, 255, 255) 0px, rgb(238, 238, 238) 100%) repeat-x rgb(247, 247, 247); color: rgb(102, 159, 199); border-bottom: 1px solid rgb(221, 221, 221); padding-left: 10px;"><h5 class="smaller" style="box-sizing: border-box; font-family: 'Open Sans', 'Helvetica Neue', Helvetica, Arial, sans-serif; font-weight: 400; line-height: 1.1; color: inherit; margin-top: 10px; margin-bottom: 10px; font-size: 14px;">SSL Medium Strength Cipher Suites Supported</h5><span class="widget-toolbar" style="box-sizing: border-box; display: inline-block; padding: 0px 10px; line-height: 29px; float: right; position: relative;"><a data-action="collapse" style="box-sizing: border-box; background-color: transparent; color: rgb(170, 170, 170); text-decoration-line: none; font-size: 14px; margin: 0px 1px; display: inline-block; padding: 0px; line-height: 24px; cursor: pointer; transition: transform 0.1s ease 0s;" href="https://scanmyserver.com/my_account/?#"><span class="ace-icon fa fa-chevron-up" style="box-sizing: border-box; display: inline-block; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; line-height: 1; font-family: FontAwesome; font-size: inherit; text-rendering: auto; -webkit-font-smoothing: antialiased; text-align: center; margin-right: 0px;"></span></a></span></div><div class="widget-body" style="box-sizing: border-box; background-color: transparent;"><div class="widget-main" style="box-sizing: border-box; padding: 12px; margin: 0px; position: relative; max-width: none; border-bottom-width: 0px;"><dl id="dt-list-1" class="dl-horizontal" style="box-sizing: border-box; margin-top: 0.5em; margin-bottom: 1em;"><dt style="box-sizing: border-box; line-height: 1.42857; font-weight: 700; float: left; width: 160px; overflow: hidden; clear: left; text-align: right; text-overflow: ellipsis; white-space: nowrap;">Summary</dt><dd style="box-sizing: border-box; line-height: 1.42857; margin-left: 180px; padding-left: 1em;">The remote host supports the use of SSL ciphers that offer medium strength encryption, which we currently regard as those with key lengths at least 56 bits and less than 112 bits.<br style="box-sizing: border-box;"><br style="box-sizing: border-box;"><div class="output" style="box-sizing: border-box; overflow: auto; padding: 0.5em; border: 1px solid;">Here is the only medium strength SSL cipher supported by the remote server:<br style="box-sizing: border-box;">* Medium Strength Ciphers (>= 56-bit and < 112-bit key)<br style="box-sizing: border-box;">* SSLv3 - DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 <br style="box-sizing: border-box;">* TLSv1 - DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 <br style="box-sizing: border-box;">The fields above are:<br style="box-sizing: border-box;">* {OpenSSL ciphername}<br style="box-sizing: border-box;">* Kx={key exchange}<br style="box-sizing: border-box;">* Au={authentication}<br style="box-sizing: border-box;">* Enc={symmetric encryption method}<br style="box-sizing: border-box;">* Mac={message authentication code}<br style="box-sizing: border-box;">* {export flag}</div></dd><dt style="box-sizing: border-box; line-height: 1.42857; font-weight: 700; float: left; width: 160px; overflow: hidden; clear: left; text-align: right; text-overflow: ellipsis; white-space: nowrap;">Port</dt><dd style="box-sizing: border-box; line-height: 1.42857; margin-left: 180px; padding-left: 1em;">imaps (993/tcp)</dd><dt style="box-sizing: border-box; line-height: 1.42857; font-weight: 700; float: left; width: 160px; overflow: hidden; clear: left; text-align: right; text-overflow: ellipsis; white-space: nowrap;">Solution</dt><dd style="box-sizing: border-box; line-height: 1.42857; margin-left: 180px; padding-left: 1em;">Reconfigure the affected application if possible to avoid use of medium strength ciphers.</dd><dt style="box-sizing: border-box; line-height: 1.42857; font-weight: 700; float: left; width: 160px; overflow: hidden; clear: left; text-align: right; text-overflow: ellipsis; white-space: nowrap;">External sources</dt><dd style="box-sizing: border-box; line-height: 1.42857; margin-left: 180px; padding-left: 1em;"><a target="_blank" rel="nofollow" style="box-sizing: border-box; background-color: transparent; color: rgb(51, 122, 183); text-decoration-line: none; cursor: pointer;" href="http://support.microsoft.com/kb/245030">http://support.microsoft.com/kb/245030</a></dd><dt style="box-sizing: border-box; line-height: 1.42857; font-weight: 700; float: left; width: 160px; overflow: hidden; clear: left; text-align: right; text-overflow: ellipsis; white-space: nowrap;">Test ID</dt><dd style="box-sizing: border-box; line-height: 1.42857; margin-left: 180px; padding-left: 1em;">12076</dd></dl></div></div></div></div><div class="timeline-item clearfix" style="box-sizing: border-box; position: relative; margin-bottom: 8px; color: rgb(57, 57, 57); font-family: Roboto, sans-serif; font-size: 13px;"><div class="timeline-info" style="box-sizing: border-box; float: left; width: 60px; text-align: center; position: relative;"><i class="timeline-indicator icon-circle btn btn-warning no-hover" style="box-sizing: border-box; display: inline-block; padding: 0px; margin: 0px; font-size: 16px; line-height: 30px; white-space: nowrap; vertical-align: middle; touch-action: manipulation; cursor: default; user-select: none; border-radius: 100%; transition: background-color 0.15s ease 0s, border-color 0.15s ease 0s, opacity 0.15s ease 0s; position: relative; opacity: 1; height: 36px; width: 36px; background-image: none !important; border: 3px solid rgb(255, 255, 255) !important; color: rgb(255, 255, 255) !important; background-color: rgb(255, 183, 82) !important; text-shadow: none !important; box-shadow: none !important;"></i></div><div class="widget-box" style="box-sizing: border-box; box-shadow: none; padding: 0px; margin: 0px 0px 0px 60px; border: 1px solid rgb(204, 204, 204); background-color: rgb(242, 246, 249); color: rgb(89, 92, 102); position: relative; max-width: none;"><div class="widget-header header-color-orange widget-header-small" style="box-sizing: content-box; position: relative; min-height: 31px; background: linear-gradient(rgb(255, 255, 255) 0px, rgb(238, 238, 238) 100%) repeat-x rgb(247, 247, 247); color: rgb(102, 159, 199); border-bottom: 1px solid rgb(221, 221, 221); padding-left: 10px;"><h5 class="smaller" style="box-sizing: border-box; font-family: 'Open Sans', 'Helvetica Neue', Helvetica, Arial, sans-serif; font-weight: 400; line-height: 1.1; color: inherit; margin-top: 10px; margin-bottom: 10px; font-size: 14px;">Deprecated SSL Protocol Usage</h5><span class="widget-toolbar" style="box-sizing: border-box; display: inline-block; padding: 0px 10px; line-height: 29px; float: right; position: relative;"><a data-action="collapse" style="box-sizing: border-box; background-color: transparent; color: rgb(170, 170, 170); text-decoration-line: none; font-size: 14px; margin: 0px 1px; display: inline-block; padding: 0px; line-height: 24px; cursor: pointer; transition: transform 0.1s ease 0s;" href="https://scanmyserver.com/my_account/?#"><span class="ace-icon fa fa-chevron-up" style="box-sizing: border-box; display: inline-block; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; line-height: 1; font-family: FontAwesome; font-size: inherit; text-rendering: auto; -webkit-font-smoothing: antialiased; text-align: center; margin-right: 0px;"></span></a></span></div><div class="widget-body" style="box-sizing: border-box; background-color: transparent;"><div class="widget-main" style="box-sizing: border-box; padding: 12px; margin: 0px; position: relative; max-width: none; border-bottom-width: 0px;"><dl id="dt-list-1" class="dl-horizontal" style="box-sizing: border-box; margin-top: 0.5em; margin-bottom: 1em;"><dt style="box-sizing: border-box; line-height: 1.42857; font-weight: 700; float: left; width: 160px; overflow: hidden; clear: left; text-align: right; text-overflow: ellipsis; white-space: nowrap;">Summary</dt><dd style="box-sizing: border-box; line-height: 1.42857; margin-left: 180px; padding-left: 1em;">The remote service accepts connections encrypted using SSLv2 and/or SSLv3, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients.<br style="box-sizing: border-box;"><br style="box-sizing: border-box;"><div class="output" style="box-sizing: border-box; overflow: auto; padding: 0.5em; border: 1px solid;">SSLv3</div></dd><dt style="box-sizing: border-box; line-height: 1.42857; font-weight: 700; float: left; width: 160px; overflow: hidden; clear: left; text-align: right; text-overflow: ellipsis; white-space: nowrap;">Port</dt><dd style="box-sizing: border-box; line-height: 1.42857; margin-left: 180px; padding-left: 1em;">imaps (993/tcp)</dd><dt style="box-sizing: border-box; line-height: 1.42857; font-weight: 700; float: left; width: 160px; overflow: hidden; clear: left; text-align: right; text-overflow: ellipsis; white-space: nowrap;">Solution</dt><dd style="box-sizing: border-box; line-height: 1.42857; margin-left: 180px; padding-left: 1em;">Consult the application's documentation to disable SSL 2.0 and SSL 3.0, and use TLS 1.0 or newer.</dd><dt style="box-sizing: border-box; line-height: 1.42857; font-weight: 700; float: left; width: 160px; overflow: hidden; clear: left; text-align: right; text-overflow: ellipsis; white-space: nowrap;">External sources</dt><dd style="box-sizing: border-box; line-height: 1.42857; margin-left: 180px; padding-left: 1em;"><a target="_blank" rel="nofollow" style="box-sizing: border-box; background-color: transparent; color: rgb(51, 122, 183); text-decoration-line: none; cursor: pointer;" href="http://www.schneier.com/paper-ssl.pdf">http://www.schneier.com/paper-ssl.pdf</a></dd><dt style="box-sizing: border-box; line-height: 1.42857; font-weight: 700; float: left; width: 160px; overflow: hidden; clear: left; text-align: right; text-overflow: ellipsis; white-space: nowrap;">Test ID</dt><dd style="box-sizing: border-box; line-height: 1.42857; margin-left: 180px; padding-left: 1em;">9329</dd></dl></div></div></div></div>

I suggest to use stunnel for the entire encrypted communication from and to mercury. Then you get more config options and it is easier to harden. Maybe this will changed anytime in the future, hopefully. The last mercury-update was released in september 2015...

<p><span style="font-size: 10pt;">Thanks!  That's a good idea. </span></p>

One very unfortunate part is that when using stunnel it looks like all of the connections come from 127.0.0.1, so any special processing of the logs to ban abusive ip's, etc, no longer works.  I hope they update Mercury soon.

<p>If you would be interested in running the current beta I can send you a download link.</p><p> </p>

Absolutely!

<p>On its way!<span style="font-size: 10pt;"> </span></p>

Thanks!  So far, so good.  I'm interested in trying out the "SSL and access control" for MercuryE with the "Use SSL whenever it is available" option enabled, but it says to reference the help file before enabling which doesn't appear to be updated.  Is there any info on this feature yet, or is there anything specific in this beta that you would like me to test or look out for?  I'll do what I can to help.

<p>There should be a link to the SSL and Access control help page on the MercuryE page. The text there reads:</p><p><span style="font-size: 10pt;">-  -  - </span></p><p>Use SSL whenever it is available</p><p>Selecting this control tells MercuryE that it can use secure connections whenever the servers to which it connects advertise that they will accept them. The caveats that apply to accepting incoming SSL connections in the MercuryS SMTP server do not usually apply in reverse to MercuryE, and it is normally quite safe to select this option in MercuryE provided you do not mind the slight performance penalty it will introduce. </p><p>-  -  -</p><p>If you notice any problems or unexpected behavior please report here or directly to me, all input is much appreciated!</p><p> </p><p> </p>

Hello Rolf, I would be interested in running the current Beta if possible. Thank you. Stephen