{"id":91951,"date":"2020-08-20T19:42:11","date_gmt":"2020-08-20T17:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts"},"modified":"2020-08-20T19:42:11","modified_gmt":"2020-08-20T17:42:11","slug":"pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts","title":{"rendered":"Mail.ru \u00ee\u0219i \u00eencepe aplicarea \u00een regim de testare a politicilor MTA-STS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Mail.ru \u00ee\u0219i \u00eencepe aplicarea \u00een regim de testare a politicilor MTA-STS\" src=\"\/wp-content\/uploads\/2020\/08\/1f0b7542aedb372c06c2077ea987dd36.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPe scurt, MTA-STS este o modalitate de a proteja suplimentar e-mailurile \u00eempotriva intercept\u0103rii (adic\u0103 atacuri de tip MitM) \u00een timpul transportului \u00eentre serverele de e-mail. Acesta rezolv\u0103 par\u021bial problemele arhitecturale tradi\u021bionale ale protocoalelor de e-mail \u0219i este descris \u00een standardul relativ recent RFC 8461. Mail.ru este primul serviciu major de e-mail din Runet care implementeaz\u0103 acest standard. O prezentare mai detaliat\u0103 urmeaz\u0103 mai jos.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h1>Ce problem\u0103 rezolv\u0103 MTA-STS?<\/h1>\n<p>\nIstoric, protocoalele de e-mail (SMTP, POP3, IMAP) au transmis informa\u021biile \u00een mod deschis, ceea ce permite interceptarea acestora, de exemplu, \u00een cazul accesului la canalul de comunica\u021bie.<\/p>\n<p>Cum arat\u0103 mecanismul de livrare a unui e-mail de la un utilizator la altul:<\/p>\n<p><img decoding=\"async\" alt=\"Mail.ru \u00ee\u0219i \u00eencepe aplicarea \u00een regim de testare a politicilor MTA-STS\" src=\"\/wp-content\/uploads\/2020\/08\/5b0d4749298d7644220a6322912d8716.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIstoric, atacurile MitM erau posibile \u00een toate punctele prin care trecea e-mailul.<\/p>\n<p>Standardul RFC 8314 impune utilizarea obligatorie a TLS \u00eentre aplica\u021bia de e-mail a utilizatorului (MUA) \u0219i serverul de e-mail. Dac\u0103 serverul dumneavoastr\u0103 \u0219i aplica\u021biile de e-mail utilizate respect\u0103 RFC 8314, atunci a\u021bi eliminat (\u00een mare parte) posibilitatea atacurilor Man-in-the-Middle \u00eentre utilizator \u0219i serverele de e-mail.<\/p>\n<p>Respectarea practicilor generale acceptate (standardizate \u00een RFC 8314) elimin\u0103 atacurile aproape de utilizator:<\/p>\n<p><img decoding=\"async\" alt=\"Mail.ru \u00ee\u0219i \u00eencepe aplicarea \u00een regim de testare a politicilor MTA-STS\" src=\"\/wp-content\/uploads\/2020\/08\/7a45c95793ec958c46f63898db39c1fc.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nServerele de e-mail Mail.ru respectau RFC 8314 \u00eenc\u0103 \u00eenainte de adoptarea standardului, de fapt, acesta doar consemneaz\u0103 practicile deja acceptate \u0219i nu a fost necesar s\u0103 facem ajust\u0103ri suplimentare. Dar, dac\u0103 serverul dumneavoastr\u0103 de e-mail permite \u00een continuare utilizatorilor s\u0103 foloseasc\u0103 protocoale nesigure, implementa\u021bi neap\u0103rat recomand\u0103rile acestui standard, deoarece este foarte probabil ca cel pu\u021bin o parte dintre utilizatorii dumneavoastr\u0103 s\u0103 foloseasc\u0103 e-mailul f\u0103r\u0103 criptare, chiar dac\u0103 o sus\u021bine\u021bi.<\/p>\n<p>Clientul de email lucreaz\u0103 \u00eentotdeauna cu acela\u0219i server de email al acelea\u0219i organiza\u021bii. Se poate for\u021ba to\u021bi utilizatorii s\u0103 se conecteze \u00een mod sigur, dup\u0103 care s\u0103 se fac\u0103 imposibil\u0103 conexiunea nesigur\u0103 (aceasta este ceea ce necesit\u0103 RFC 8314). Este uneori complicat, dar realizabil. Traficul \u00eentre serverele de email este \u0219i mai complex. Serverele apar\u021bin unor organiza\u021bii diferite \u0219i sunt adesea folosite \u00een modul \"am instalat \u0219i am uitat\", ceea ce face imposibil\u0103 o trecere instantanee la un protocol sigur f\u0103r\u0103 a compromite coeren\u021ba. \u00cen SMTP exist\u0103 de mult\u0103 vreme o extensie STARTTLS, care permite serverelor care suport\u0103 criptarea s\u0103 treac\u0103 la TLS. Dar un atacator care poate influen\u021ba traficul poate \"t\u0103ia\" informa\u021bia despre suportul acestei comenzi \u0219i poate for\u021ba serverele s\u0103 comunice prin protocol de text obi\u0219nuit (a\u0219a-numita atac downgrade \u2014 atac asupra versiunii protocolului). Din acela\u0219i motiv, pentru STARTTLS de obicei nu se verific\u0103 conformitatea certificatului (un certificat nevalidat poate proteja \u00eempotriva atacurilor pasive, iar asta nu este mai r\u0103u dec\u00e2t trimiterea unui mesaj \u00een text clar). Prin urmare, STARTTLS protejeaz\u0103 doar \u00eempotriva ascult\u0103rii pasive.<\/p>\n<p>MTA-STS elimine par\u021bial problema intercept\u0103rii mesajelor \u00eentre serverele de email, atunci c\u00e2nd un atacator are posibilitatea de a influen\u021ba activ traficul. Dac\u0103 domeniul destinatarului public\u0103 o politic\u0103 MTA-STS \u0219i serverul expeditorului suport\u0103 MTA-STS, acesta va trimite mesajul doar printr-o conexiune TLS, doar c\u0103tre serverele specificate \u00een politic\u0103 \u0219i doar cu verificarea certificatului serverului.<\/p>\n<p>De ce par\u021bial? MTA-STS func\u021bioneaz\u0103 doar dac\u0103 ambele p\u0103r\u021bi se preocup\u0103 de implementarea acestui standard, iar MTA-STS nu protejeaz\u0103 \u00eempotriva scenariilor \u00een care atacatorul poate ob\u021bine un certificat valid pentru domeniu de la una dintre autorit\u0103\u021bile de certificare publice.<\/p>\n<h1>Cum func\u021bioneaz\u0103 MTA-STS<\/h1>\n<p>\n<b>Destinatarul<\/b><\/p>\n<ol>\n<li>Configureaz\u0103 suportul STARTTLS cu un certificat valid pe serverul de email.\u00a0<\/li>\n<li>Public\u0103 prin HTTPS politica MTA-STS, pentru publicare folosind un domeniu special mta-sts \u0219i un path well-known special, de exemplu <code>https:\/\/mta-sts.mail.ru\/.well-known\/mta-sts.txt<\/code>. Politica con\u021bine o list\u0103 de servere de email (mx) care au dreptul s\u0103 primeasc\u0103 emailuri pentru acest domeniu.<\/li>\n<li>Public\u0103 un \u00eenregistrare TXT special\u0103 _mta-sts \u00een DNS cu versiunea politicii. Atunci c\u00e2nd politica se modific\u0103, aceast\u0103 \u00eenregistrare trebuie actualizat\u0103 (acest lucru semnalizeaz\u0103 expeditorului c\u0103 trebuie s\u0103 refac\u0103 cererea de politic\u0103). De exemplu, <code>_mta-sts.mail.ru. TXT \"v=STSv1; id=20200303T120000;\"<\/code><\/li>\n<\/ol>\n<p>\n<b>Expeditor<\/b><\/p>\n<p>Expeditorul solicit\u0103 \u00eenregistrarea DNS _mta-sts, iar dac\u0103 aceasta exist\u0103, face o cerere de politic\u0103 prin HTTPS (verific\u00e2nd certificatul). Politica ob\u021binut\u0103 este cache-uit\u0103 (\u00een cazul \u00een care atacatorul blocheaz\u0103 accesul la aceasta sau \u00eenlocuie\u0219te \u00eenregistrarea DNS).<\/p>\n<p>Atunci c\u00e2nd se trimite un e-mail, se verific\u0103 c\u0103:<\/p>\n<ul>\n<li>serverul la care se livreaz\u0103 e-mailul este \u00een politic\u0103;<\/li>\n<li>serverul accept\u0103 e-mailuri utiliz\u00e2nd TLS (STARTTLS) \u0219i are un certificat valid.<\/li>\n<\/ul>\n<p><\/p>\n<h1>Avantajele MTA-STS<\/h1>\n<p>\nMTA-STS folose\u0219te tehnologii care sunt deja implementate \u00een majoritatea organiza\u021biilor (SMTP+STARTTLS, HTTPS, DNS). Pentru implementare pe partea destinatarului nu este necesar\u0103 o suport software special pentru standard.<\/p>\n<h1>Dezavantajele MTA-STS<\/h1>\n<p>\nEste necesar s\u0103 urm\u0103ri\u021bi validitatea certificatului serverului web \u0219i de e-mail, conformitatea numelui, actualizarea la timp. Problemele cu certificatul vor duce la imposibilitatea livr\u0103rii e-mailului.<\/p>\n<p>Pe partea expeditorului, este necesar un MTA cu suport pentru politicile MTA-STS, \u00een prezent nu exist\u0103 suport nativ pentru MTA-STS \u00een MTA.<\/p>\n<p>MTA-STS utilizeaz\u0103 o list\u0103 de CA r\u0103d\u0103cin\u0103 de \u00eencredere.<\/p>\n<p>MTA-STS nu protejeaz\u0103 \u00eempotriva atacurilor \u00een care atacatorul utilizeaz\u0103 un certificat valid. \u00cen majoritatea cazurilor, un MitM apropiat de server implic\u0103 posibilitatea de a emite un certificat. Un astfel de atac poate fi detectat datorit\u0103 Certificate Transparency. Prin urmare, \u00een general, MTA-STS mitigeaz\u0103, dar nu elimin\u0103 complet posibilitatea intercept\u0103rii traficului.<\/p>\n<p>Cele dou\u0103 ultime puncte fac MTA-STS mai pu\u021bin sigur dec\u00e2t standardul concurent DANE pentru SMTP (RFC 7672), dar mai tehnic fiabil, adic\u0103 pentru MTA-STS probabilitatea ca un e-mail s\u0103 nu fie livrat din cauza problemelor tehnice cauzate de implementarea standardului este sc\u0103zut\u0103.<\/p>\n<h4>Standardul concurent \u2013 DANE<\/h4>\n<p>\nDANE folose\u0219te DNSSEC pentru a publica informa\u021bii despre certificate \u0219i nu necesit\u0103 \u00eencredere \u00een autorit\u0103\u021bile de certificare externe, ceea ce este mult mai sigur. \u00cens\u0103 utilizarea DNSSEC duce, \u00een mod semnificativ mai des, la defec\u021biuni tehnice, dac\u0103 ne baz\u0103m pe statistici din c\u00e2\u021biva ani de utilizare (de\u0219i fiabilitatea DNSSEC \u0219i suportul tehnic, \u00een general, prezint\u0103 o tendin\u021b\u0103 pozitiv\u0103). Pentru a implementa DANE \u00een SMTP pe partea destinatarului, prezen\u021ba DNSSEC pentru zona DNS este obligatorie, iar pentru DANE este esen\u021bial suportul corect pentru NSEC\/NSEC3, cu care DNSSEC are probleme sistemice.<\/p>\n<p>Dac\u0103 DNSSEC este configurat gre\u0219it, acest lucru poate duce la refuzuri \u00een livrarea e-mailurilor, \u00een cazul \u00een care partea expeditorului suport\u0103 DANE, chiar dac\u0103 partea destinatar\u0103 nu \u0219tie nimic despre acesta. Prin urmare, de\u0219i DANE este un standard mai vechi \u0219i mai sigur, deja acceptat \u00een unele software-uri server pe partea expeditorului, de fapt, penetrarea sa r\u0103m\u00e2ne nesemnificativ\u0103, multe organiza\u021bii nu sunt preg\u0103tite s\u0103-l implementeze din cauza necesit\u0103\u021bii de a implementa DNSSEC, ceea ce a \u00eencetinit semnificativ adoptarea DANE \u00een to\u021bi ace\u0219ti ani de existen\u021b\u0103 a standardului.<\/p>\n<p>DANE \u0219i MTA-STS nu se \u00eempiedic\u0103 reciproc \u0219i pot fi utilizate \u00eempreun\u0103.<\/p>\n<h1>Ce suport are MTA-STS \u00een Mail.ru?<\/h1>\n<p>\nMail.ru public\u0103 de mult timp politica MTA-STS pentru toate domeniile principale. Acum ne ocup\u0103m de implementarea p\u0103r\u021bii client a standardului. La momentul redact\u0103rii articolului, politicile sunt aplicate \u00een mod non-blocant (\u00een cazul \u00een care livrarea este blocat\u0103 de politic\u0103, e-mailul va fi livrat printr-un server \u201ede rezerv\u0103\u201d f\u0103r\u0103 aplicarea politicilor), apoi va fi for\u021bat un mod blocant pentru o mic\u0103 parte din traficul SMTP de ie\u0219ire, gradual pentru 100% din trafic va fi sus\u021binut\u0103 aplicarea politicilor.<\/p>\n<h1>Cine mai suport\u0103 standardul?<\/h1>\n<p>\n\u00cen prezent, politicile MTA-STS sunt publicate de aproximativ 0,05% din domeniile active, dar, cu toate acestea, acestea protejeaz\u0103 deja un volum mare de trafic po\u0219tal, deoarece standardul este sus\u021binut de juc\u0103tori mari \u2014 Google, Comcast \u0219i par\u021bial Verizon (AOL, Yahoo). Multe alte servicii de po\u0219t\u0103 au anun\u021bat c\u0103 suportul pentru standard va fi implementat \u00een viitorul apropiat.<\/p>\n<h1>Cum m\u0103 va afecta acest lucru?<\/h1>\n<p>\nNiciunul, dac\u0103 domeniul dumneavoastr\u0103 nu public\u0103 o politic\u0103 MTA-STS. Dac\u0103 publica\u021bi o politic\u0103, atunci mesajele pentru utilizatorii serverului dumneavoastr\u0103 de email vor fi mai bine protejate \u00eempotriva intercept\u0103rii.<\/p>\n<h1>Cum s\u0103 implementez MTA-STS?<\/h1>\n<p>\n<b>Suport pentru MTA-STS pe partea de destinatar<\/b><\/p>\n<p>Este suficient s\u0103 publica\u021bi o politic\u0103 prin HTTPS \u0219i s\u0103 configura\u021bi \u00eenregistr\u0103rile DNS, s\u0103 ave\u021bi un certificat valid de la unul dintre CA-uri de \u00eencredere (pute\u021bi folosi Let's Encrypt) pentru STARTTLS \u00een MTA (STARTTLS este suportat \u00een toate MTA-urile moderne), nu este necesar\u0103 o asisten\u021b\u0103 special\u0103 din partea MTA.<\/p>\n<p>Pas cu pas, arat\u0103 astfel:<\/p>\n<ol>\n<li>Configura\u021bi STARTTLS \u00een MTA-ul utilizat (postfix, exim, sendmail, Microsoft Exchange etc.).<\/li>\n<li>Asigura\u021bi-v\u0103 c\u0103 se folose\u0219te un certificat valid (\u00eentocmit de un CA de \u00eencredere, netrecut de termen, subiectul certificatului corespunde \u00eenregistr\u0103rii MX pe care se livreaz\u0103 emailurile pentru domeniul dumneavoastr\u0103).<\/li>\n<li>Configura\u021bi \u00eenregistrarea TLS-RPT, pe care se vor livra rapoartele de aplicare a politicilor (servicii care suport\u0103 trimiterea rapoartelor TLS). Exemplu de \u00eenregistrare (pentru domeniul example.com):\n<pre><code class=\"plaintext\">smtp._tls.example.com. 300 IN TXT \"v=TLSRPTv1; rua=mailto:tlsrpt@example.com\"<\/code><\/pre>\n<p>\nAceast\u0103 \u00eenregistrare instruie\u0219te expeditorii de email s\u0103 trimit\u0103 rapoarte statistice despre utilizarea TLS \u00een SMTP la adresa <code>tlsrpt@exmple.com<\/code>.<\/p>\n<p>Urm\u0103ri\u021bi rapoartele c\u00e2teva zile, asigura\u021bi-v\u0103 c\u0103 nu exist\u0103 erori.<\/li>\n<li>Publica\u021bi politica MTA-STS prin HTTPS. Politica este publicat\u0103 ca un fi\u0219ier text cu terminatori de linie CRLF la loca\u021bie.\n<pre><code class=\"plaintext\">https:\/\/mta-sts.example.com\/.well-known\/mta-sts.txt\n<\/code><\/pre>\n<p>\nExemplu de politic\u0103:<\/p>\n<pre><code class=\"plaintext\">version: STSv1\nmode: enforce\nmx: mxs.mail.ru\nmx: emx.mail.ru\nmx: mx2.corp.mail.ru\nmax_age: 86400\n<\/code><\/pre>\n<p>\nC\u00e2mpul version con\u021bine versiunea politicii (\u00een prezent aceasta este <code>STSv1<\/code>), Modu stabile\u0219te modul de aplicare a politicii, testing \u2014 modul de testare (politica nu se aplic\u0103), enforce \u2014 modul 'de produc\u021bie'. Publica\u021bi mai \u00eent\u00e2i politica cu mode: testing, dac\u0103 nu apar probleme cu politica \u00een modul de testare, dup\u0103 o vreme pute\u021bi trece la mode: enforce.<\/p>\n<p>\u00cen mx se specific\u0103 lista tuturor serverelor de email care pot primi emailuri pentru domeniul dumneavoastr\u0103 (fiecare server trebuie s\u0103 aib\u0103 un certificat configurat care corespunde numelui specificat \u00een mx). Max_age stabile\u0219te timpul de cache al politicii (o politic\u0103 deja memorat\u0103 va fi aplicat\u0103 chiar dac\u0103 atacatorul blocheaz\u0103 livrarea sa sau altereaz\u0103 \u00eenregistr\u0103rile DNS pe parcursul timpului de cache, semnalizarea necesit\u0103\u021bii de a solicita din nou politica poate fi realizat\u0103 prin modificarea \u00eenregistr\u0103rii MTA-STS \u00een DNS).<\/li>\n<li>Publica\u021bi \u00eenregistrarea TXT \u00een DNS:\u00a0\n<pre><code class=\"plaintext\">_mta-sts.example.com. TXT \"v=STS1; id=someid;\"\n<\/code><\/pre>\n<p>\n\u00cen c\u00e2mpul id, se poate folosi un identificator personalizat (de exemplu, un timestamp); atunci c\u00e2nd politica se schimb\u0103, identificatorul trebuie s\u0103 se schimbe, ceea ce permite expeditorilor s\u0103 \u00een\u021beleag\u0103 c\u0103 este necesar s\u0103 re\u00eentrebe politica cache-uit\u0103 (dac\u0103 identificatorul difer\u0103 de cel cache-uit).<\/li>\n<\/ol>\n<p>\n<b>Suport pentru MTA-STS pe partea expeditorului<\/b><\/p>\n<p>Momentan este slab, deoarece standardul este nou.<\/p>\n<ul>\n<li>Exim - nu are suport \u00eencorporat, exist\u0103 un script de ter\u021b\u0103 parte <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Bobberty\/MTASTS-EXIM-PERL\">https:\/\/github.com\/Bobberty\/MTASTS-EXIM-PERL<\/a><\/noindex>\u00a0<\/li>\n<li>Postfix - nu are suport \u00eencorporat, exist\u0103 un script despre care s-a discutat detaliat pe Habr <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/en\/post\/424961\/\">https:\/\/habr.com\/en\/post\/424961\/<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<h1>Ca un epilog despre \u201emandatory TLS\u201d<\/h1>\n<p>\nRecent, reglatorii acord\u0103 aten\u021bie securit\u0103\u021bii e-mailului (\u0219i este un lucru bun). De exemplu, DMARC este obligatoriu pentru toate institu\u021biile guvernamentale din SUA \u0219i este tot mai frecvent solicitat \u00een domeniul financiar; \u00een domeniile reglementate, penetrarea standardului atinge 90%. Acum, unii reglatorii cer implementarea \u201emandatory TLS\u201d cu domenii separate, dar mecanismul de asigurare a \u201emandatory TLS\u201d nu este definit \u0219i, \u00een practic\u0103, aceast\u0103 setare este adesea implementat\u0103 \u00een moduri care nu protejeaz\u0103 chiar \u0219i minim \u00eempotriva atacurilor reale, care sunt deja prev\u0103zute \u00een mecanisme precum DANE sau MTA-STS.<\/p>\n<p>Dac\u0103 reglatorul solicit\u0103 implementarea \u201emandatory TLS\u201d cu domenii separate, recomand\u0103m s\u0103 lua\u021bi \u00een considerare MTA-STS sau un echivalent par\u021bial ca cel mai potrivit mecanism; acesta elimin\u0103 necesitatea de a face set\u0103ri-secure pentru fiecare domeniu \u00een parte. Dac\u0103 ave\u021bi dificult\u0103\u021bi \u00een implementarea p\u0103r\u021bii clientului MTA-STS (p\u00e2n\u0103 c\u00e2nd protocolul nu va ob\u021bine un suport larg, acestea vor fi probabil), se poate recomanda aceast\u0103 abordare:<\/p>\n<ol>\n<li>Publica\u021bi politica MTA-STS \u0219i\/sau \u00eenregistr\u0103rile DANE (DANE are sens s\u0103 ad\u0103uga\u021bi doar dac\u0103 pentru domeniul dvs. este deja activat DNSSEC, iar MTA-STS \u00een orice caz); aceasta va proteja traficul c\u0103tre dvs. \u0219i va elimina necesitatea de a solicita altor servicii de e-mail s\u0103 configureze mandatory TLS pentru domeniul dvs., dac\u0103 serviciul de e-mail suport\u0103 deja MTA-STS \u0219i\/sau DANE.<\/li>\n<li>Pentru serviciile mari de mail, implementa\u021bi un \u00abanalog\u00bb MTA-STS prin set\u0103ri de transport separate pentru fiecare domeniu, care vor fixa MX utilizat pentru redirec\u021bionarea e-mailurilor \u0219i vor solicita verificarea obligatorie a certificatului TLS. Dac\u0103 domeniile public\u0103 deja o politic\u0103 MTA-STS, acest lucru se poate face probabil f\u0103r\u0103 probleme. Activarea TLS obligatoriu pentru un domeniu f\u0103r\u0103 fixarea relay-ului \u0219i verificarea certificatului nu este eficient\u0103 din perspectiva securit\u0103\u021bii \u0219i nu adaug\u0103 nimic la mecanismele existente STARTTLS.<\/li>\n<\/ol>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/515746\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0415\u0441\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e, \u0442\u043e MTA-STS \u2014 \u044d\u0442\u043e \u0441\u043f\u043e\u0441\u043e\u0431 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0438\u0441\u044c\u043c\u0430 \u043e\u0442 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 (\u0442.\u0435. \u0430\u0442\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a-\u0432-\u0441\u0435\u0440\u0435\u0434\u0438\u043d\u0435 aka MitM) \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u043c\u0435\u0436\u0434\u0443 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438. \u041e\u043d \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0440\u0435\u0448\u0430\u0435\u0442 \u0443\u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b \u0438 \u043e\u043f\u0438\u0441\u0430\u043d \u0432 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0432\u0435\u0436\u0435\u043c \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0435 RFC 8461. \u041f\u043e\u0447\u0442\u0430 Mail.ru \u2014 \u043f\u0435\u0440\u0432\u0430\u044f \u043a\u0440\u0443\u043f\u043d\u0430\u044f \u043f\u043e\u0447\u0442\u043e\u0432\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u0432 \u0420\u0443\u043d\u0435\u0442\u0435, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0430\u044f \u0434\u0430\u043d\u043d\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442. \u0410 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91952,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-91951","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0415\u0441\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e, \u0442\u043e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u043e\u0447\u0442\u0430 Mail.ru \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 MTA-STS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0415\u0441\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e, \u0442\u043e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-20T17:42:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-20T17:42:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mail.ru \u00eencepe s\u0103 aplice \u00een modul de testare politicile MTA-STS | ProHoster","description":"Pe scurt,.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u0447\u0442\u0430 Mail.ru \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 MTA-STS | ProHoster","og:description":"\u0415\u0441\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e, \u0442\u043e.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-20T17:42:11+00:00","article:modified_time":"2020-08-20T17:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91951","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:18:26","updated":"2022-09-27 15:16:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/91951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=91951"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/91951\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/91952"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=91951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=91951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=91951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}