{"id":91951,"date":"2020-08-20T19:42:11","date_gmt":"2020-08-20T17:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts"},"modified":"2020-08-20T19:42:11","modified_gmt":"2020-08-20T17:42:11","slug":"pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts","title":{"rendered":"Mail.ru fillon t\u00eb implementoj\u00eb politikat MTA-STS n\u00eb mod t\u00eb testimit","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Mail.ru fillon t\u00eb implementoj\u00eb politikat MTA-STS n\u00eb mod t\u00eb testimit\" src=\"\/wp-content\/uploads\/2020\/08\/1f0b7542aedb372c06c2077ea987dd36.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00ebse e p\u00ebrmbledhim, MTA-STS \u00ebsht\u00eb nj\u00eb m\u00ebnyr\u00eb p\u00ebr t\u00eb mbrojtur shtes\u00eb email-et nga kapja (dmth. sulmet e njeriut n\u00eb mes aka MitM) gjat\u00eb transmetimit midis server\u00ebve t\u00eb email-it. Ai zgjidh pjes\u00ebrisht problemet arkitektonike t\u00eb trash\u00ebguara t\u00eb protokolleve t\u00eb email-it dhe \u00ebsht\u00eb p\u00ebrshkruar n\u00eb standardin relativisht t\u00eb ri RFC 8461. Mail.ru \u00ebsht\u00eb sh\u00ebrbimi i par\u00eb i madh i email-it n\u00eb Rusi q\u00eb implementon k\u00ebt\u00eb standard. Nj\u00eb p\u00ebrshkrim m\u00eb i holl\u00ebsish\u00ebm jepet m\u00eb posht\u00eb.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h1>Cil\u00ebn problem zgjidh MTA-STS?<\/h1>\n<p>\nHistorikisht, protokollet e email-it (SMTP, POP3, IMAP) transmetonin informacionin n\u00eb form\u00eb t\u00eb hapur, duke e b\u00ebr\u00eb at\u00eb t\u00eb ndjesh\u00ebm ndaj kapjes, p\u00ebr shembull, gjat\u00eb qasjes n\u00eb kanalin e komunikimit.<\/p>\n<p>Si duket mekanizmi i dor\u00ebzimit t\u00eb nj\u00eb email-i nga nj\u00eb p\u00ebrdorues te tjetri:<\/p>\n<p><img decoding=\"async\" alt=\"Mail.ru fillon t\u00eb implementoj\u00eb politikat MTA-STS n\u00eb mod t\u00eb testimit\" src=\"\/wp-content\/uploads\/2020\/08\/5b0d4749298d7644220a6322912d8716.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHistorikisht, sulmi MitM ka qen\u00eb i mundsh\u00ebm n\u00eb t\u00eb gjitha vendet ku kalon posta.<\/p>\n<p>Standardi RFC 8314 k\u00ebrkon p\u00ebrdorimin e detyruesh\u00ebm t\u00eb TLS mes programit t\u00eb p\u00ebrdoruesit t\u00eb email-it (MUA) dhe serverit t\u00eb email-it. N\u00ebse serveri juaj dhe aplikacionet e email-it q\u00eb p\u00ebrdorni p\u00ebrputhen me RFC 8314, at\u00ebher\u00eb ju (n\u00eb mas\u00eb t\u00eb konsiderueshme) keni eliminuar mund\u00ebsin\u00eb p\u00ebr sulme Man-in-the-Middle midis p\u00ebrdoruesit dhe server\u00ebve t\u00eb email-it.<\/p>\n<p>Respektimi i praktikave t\u00eb pranuara (RFC 8314 t\u00eb standardizuara) eliminon sulmet af\u00ebr p\u00ebrdoruesit:<\/p>\n<p><img decoding=\"async\" alt=\"Mail.ru fillon t\u00eb implementoj\u00eb politikat MTA-STS n\u00eb mod t\u00eb testimit\" src=\"\/wp-content\/uploads\/2020\/08\/7a45c95793ec958c46f63898db39c1fc.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nServer\u00ebt e post\u00ebs Mail.ru kan\u00eb p\u00ebrmbushur RFC 8314 edhe para miratimit t\u00eb standardit; n\u00eb fakt, ai thjesht fikson praktikat e pranuara, dhe nuk na duhej t\u00eb b\u00ebnim ndonj\u00eb konfigurim shtes\u00eb. Por, n\u00ebse serveri juaj i post\u00ebs ende lejon p\u00ebrdoruesit t\u00eb hyjn\u00eb p\u00ebrmes protokolleve t\u00eb pasigurta, sigurohuni q\u00eb t\u00eb zbatosh rekomandimet e k\u00ebtij standardi, pasi ka shum\u00eb t\u00eb ngjar\u00eb q\u00eb t\u00eb pakt\u00ebn nj\u00eb pjes\u00eb e p\u00ebrdoruesve tuaj punojn\u00eb me post\u00eb pa enkriptim, edhe n\u00ebse ju e mb\u00ebshtesni at\u00eb.<\/p>\n<p>\u041f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u043a\u043b\u0438\u0435\u043d\u0442 \u0432\u0441\u0435\u0433\u0434\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441 \u043e\u0434\u043d\u0438\u043c \u0438 \u0442\u0435\u043c \u0436\u0435 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u043e\u0434\u043d\u043e\u0439 \u0438 \u0442\u043e\u0439 \u0436\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u0418 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0432\u0441\u0435\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0442\u044c\u0441\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u043c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0442\u044c\u0441\u044f \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c (\u044d\u0442\u043e \u043a\u0430\u043a \u0440\u0430\u0437 \u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 RFC 8314). \u042d\u0442\u043e \u0438\u043d\u043e\u0433\u0434\u0430 \u0441\u043b\u043e\u0436\u043d\u043e, \u043d\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c\u043e. \u0421 \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c \u043c\u0435\u0436\u0434\u0443 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 \u0432\u0441\u0435 \u0435\u0449\u0435 \u0441\u043b\u043e\u0436\u043d\u0435\u0439. \u0421\u0435\u0440\u0432\u0435\u0440\u044b \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0442 \u0440\u0430\u0437\u043d\u044b\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u0438 \u0437\u0430\u0447\u0430\u0441\u0442\u0443\u044e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u00ab\u043f\u043e\u0441\u0442\u0430\u0432\u0438\u043b \u0438 \u0437\u0430\u0431\u044b\u043b\u00bb, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u043c \u043e\u0434\u043d\u043e\u043c\u043e\u043c\u0435\u043d\u0442\u043d\u043e\u0435 \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043d\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b \u0431\u0435\u0437 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f \u0441\u0432\u044f\u0437\u043d\u043e\u0441\u0442\u0438. \u0412 SMTP \u0443\u0436\u0435 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0434\u0430\u0432\u043d\u043e \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 STARTTLS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u043c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043d\u0430 TLS. \u041d\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439, \u0443 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0435\u0441\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0432\u043b\u0438\u044f\u0442\u044c \u043d\u0430 \u0442\u0440\u0430\u0444\u0438\u043a, \u043c\u043e\u0436\u0435\u0442 \u00ab\u0432\u044b\u0440\u0435\u0437\u0430\u0442\u044c\u00bb \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0435 \u044d\u0442\u043e\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0438 \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043e\u0431\u0449\u0430\u0442\u044c\u0441\u044f \u043f\u043e \u043e\u0431\u044b\u0447\u043d\u043e\u043c\u0443 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u043e\u043c\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0443 (\u0442.\u043d. downgrade attack \u2014 \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u043e\u043d\u0438\u0436\u0435\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430). \u041f\u043e \u044d\u0442\u043e\u0439 \u0436\u0435 \u043f\u0440\u0438\u0447\u0438\u043d\u0435, \u0434\u043b\u044f STARTTLS \u043e\u0431\u044b\u0447\u043d\u043e \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442\u0441\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 (\u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u0449\u0438\u0449\u0430\u0442\u044c \u043e\u0442 \u043f\u0430\u0441\u0441\u0438\u0432\u043d\u044b\u0445 \u0430\u0442\u0430\u043a, \u0438 \u044d\u0442\u043e \u043d\u0435 \u0445\u0443\u0436\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043f\u0438\u0441\u044c\u043c\u0430 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0442\u0435\u043a\u0441\u0442\u043e\u043c). \u041f\u043e\u044d\u0442\u043e\u043c\u0443 STARTTLS \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u043e\u0442 \u043f\u0430\u0441\u0441\u0438\u0432\u043d\u043e\u0439 \u043f\u0440\u043e\u0441\u043b\u0443\u0448\u043a\u0438.<\/p>\n<p>MTA-STS pjes\u00ebrisht zbut problemin e nd\u00ebrhyrjes s\u00eb mesazheve midis server\u00ebve t\u00eb email-it, kur sulmuesi ka mund\u00ebsin\u00eb t\u00eb ndikoj\u00eb aktivisht n\u00eb trafikun. N\u00ebse domeni i marr\u00ebsit publikojn\u00eb nj\u00eb politik\u00eb MTA-STS, dhe serveri i d\u00ebrguesit mb\u00ebshtet MTA-STS, ai do t\u00eb d\u00ebrgoj\u00eb mesazhin vet\u00ebm p\u00ebrmes nj\u00eb lidhjeje TLS, vet\u00ebm n\u00eb server\u00ebt e p\u00ebrcaktuar nga politika, dhe vet\u00ebm pas verifikimit t\u00eb certifikat\u00ebs s\u00eb serverit.<\/p>\n<p>Pse pjes\u00ebrisht? MTA-STS funksionon vet\u00ebm n\u00ebse t\u00eb dy an\u00ebt jan\u00eb kujdesur p\u00ebr zbatimin e k\u00ebtij standardi, dhe MTA-STS nuk mbron nga skenar\u00ebt ku sulmuesi ka mund\u00ebsin\u00eb t\u00eb marr\u00eb nj\u00eb certifikat\u00eb valide t\u00eb domenit nga ndonj\u00eb nga CA-t\u00eb publike.<\/p>\n<h1>Si funksionon MTA-STS<\/h1>\n<p>\n<b>Marr\u00ebsi<\/b><\/p>\n<ol>\n<li>Konfiguron mb\u00ebshtetje p\u00ebr STARTTLS me nj\u00eb certifikat\u00eb valide n\u00eb serverin e email-it.\u00a0<\/li>\n<li>Publikon politik\u00ebn MTA-STS p\u00ebrmes HTTPS, p\u00ebr publikimin p\u00ebrdoret nj\u00eb domen i ve\u00e7ant\u00eb mta-sts dhe nj\u00eb rrug\u00eb e njohur e ve\u00e7ant\u00eb, p\u00ebr shembull <code>https:\/\/mta-sts.mail.ru\/.well-known\/mta-sts.txt<\/code>. Politika p\u00ebrmban nj\u00eb list\u00eb t\u00eb server\u00ebve t\u00eb email-it (mx) q\u00eb kan\u00eb t\u00eb drejta p\u00ebr t\u00eb marr\u00eb email p\u00ebr k\u00ebt\u00eb domen.<\/li>\n<li>Publikon nj\u00eb regjistrim t\u00eb ve\u00e7ant\u00eb TXT _mta-sts n\u00eb DNS me versionin e politik\u00ebs. Kur politika ndryshohet, ky regjistrim duhet t\u00eb azhurnohet (kjo sinjalizon d\u00ebrguesin p\u00ebr nevoj\u00ebn p\u00ebr t\u00eb rik\u00ebrkuar politik\u00ebn). P\u00ebr shembull, <code>_mta-sts.mail.ru. TXT &quot;v=STSv1; id=20200303T120000;&quot;<\/code><\/li>\n<\/ol>\n<p>\n<b>D\u00ebrguesi<\/b><\/p>\n<p>D\u00ebrguesi k\u00ebrkon regjistrimin DNS _mta-sts, dhe n\u00ebse ka nj\u00eb t\u00eb till\u00eb, b\u00ebn nj\u00eb k\u00ebrkes\u00eb p\u00ebr politik\u00ebn p\u00ebrmes HTTPS (duke verifikuar certifikat\u00ebn). Politika e marr\u00eb ruhet n\u00eb cache (p\u00ebr rastin n\u00ebse sulmuesi bllokon qasjen n\u00eb t\u00eb ose nd\u00ebrron regjistrimin DNS).<\/p>\n<p>Kur d\u00ebrgohet post\u00eb, kontrollohet q\u00eb:<\/p>\n<ul>\n<li>serveri, ku d\u00ebrgohet posta, \u00ebsht\u00eb n\u00eb politik\u00eb;<\/li>\n<li>serveri pranon post\u00eb duke p\u00ebrdorur TLS (STARTTLS) dhe ka nj\u00eb certifikat\u00eb valide.<\/li>\n<\/ul>\n<p><\/p>\n<h1>P\u00ebrfitimet e MTA-STS<\/h1>\n<p>\nMTA-STS p\u00ebrdor teknologji q\u00eb jan\u00eb tashm\u00eb t\u00eb implementuara n\u00eb shumic\u00ebn e organizatave (SMTP+STARTTLS, HTTPS, DNS). P\u00ebr realizimin n\u00eb an\u00ebn e marr\u00ebsit nuk k\u00ebrkohet mb\u00ebshtetje e ve\u00e7ant\u00eb programore p\u00ebr standardin.<\/p>\n<h1>Disavantazhet e MTA-STS<\/h1>\n<p>\nDuhet t\u00eb monitoroni vlefshm\u00ebrin\u00eb e certifikat\u00ebs s\u00eb serverit t\u00eb uebit dhe post\u00ebs, p\u00ebrputhshm\u00ebrin\u00eb e emrave, dhe p\u00ebrdit\u00ebsimin e saj n\u00eb koh\u00eb. Problemet me certifikat\u00ebn do t\u00eb \u00e7ojn\u00eb n\u00eb pamund\u00ebsin\u00eb p\u00ebr t\u00eb d\u00ebrguar post\u00eb.<\/p>\n<p>N\u00eb an\u00ebn e d\u00ebrguesit, k\u00ebrkohet nj\u00eb MTA me mb\u00ebshtetje p\u00ebr politikat MTA-STS; p\u00ebr momentin, MTA-STS nuk mb\u00ebshtetet \"nga kutia\" n\u00eb MTA.<\/p>\n<p>MTA-STS p\u00ebrdor nj\u00eb list\u00eb t\u00eb CA-ve rr\u00ebnj\u00ebsore t\u00eb besueshme.<\/p>\n<p>MTA-STS nuk mbron nga sulmet ku sulmuesi p\u00ebrdor nj\u00eb certifikat\u00eb valide. N\u00eb shumic\u00ebn e rasteve, MitM af\u00ebr serverit n\u00ebnkupton mund\u00ebsin\u00eb e l\u00ebshimit t\u00eb nj\u00eb certifikate. Nj\u00eb sulm i till\u00eb mund t\u00eb zbulohet p\u00ebrmes Transparency t\u00eb Certifikatave. Prandaj, n\u00eb p\u00ebrgjith\u00ebsi, MTA-STS mitigon, por nuk e eliminon plot\u00ebsisht mund\u00ebsin\u00eb e kapjes s\u00eb trafikut.<\/p>\n<p>Dy pik\u00ebt e fundit e b\u00ebjn\u00eb MTA-STS m\u00eb pak t\u00eb sigurt se standardi konkurrues DANE p\u00ebr SMTP (RFC 7672), por m\u00eb teknikisht t\u00eb besuesh\u00ebm, dmth. p\u00ebr MTA-STS, ka nj\u00eb probabilitet t\u00eb ul\u00ebt q\u00eb nj\u00eb let\u00ebr t\u00eb mos dor\u00ebzohet p\u00ebr shkak t\u00eb problemeve teknike t\u00eb shkaktuara nga zbatimi i standardit.<\/p>\n<h4>Standardi konkurrues \u00ebsht\u00eb DANE<\/h4>\n<p>\nDANE p\u00ebrdor DNSSEC p\u00ebr t\u00eb publikuar informacion rreth certifikatave dhe nuk k\u00ebrkon besim n\u00eb autoritetet e jashtme t\u00eb certifikimit, q\u00eb \u00ebsht\u00eb shum\u00eb m\u00eb t\u00eb sigurta. Por p\u00ebrdorimi i DNSSEC shpesh \u00e7on n\u00eb defekte teknike, n\u00ebse mb\u00ebshtetet n\u00eb statistikat e disa viteve t\u00eb p\u00ebrdorimit (edhe pse \u00ebsht\u00eb v\u00ebn\u00eb re nj\u00eb dinamik\u00eb pozitive n\u00eb besueshm\u00ebrin\u00eb e DNSSEC dhe mb\u00ebshtetje teknike t\u00eb tij). P\u00ebr t\u00eb implementuar DANE n\u00eb SMTP n\u00eb an\u00ebn e marr\u00ebsit, prania e DNSSEC p\u00ebr zon\u00ebn DNS \u00ebsht\u00eb e domosdoshme, dhe p\u00ebr DANE mb\u00ebshtetje korrekte e NSEC\/NSEC3 \u00ebsht\u00eb thelb\u00ebsore, p\u00ebr t\u00eb cil\u00ebn DNSSEC ka probleme sistemike.<\/p>\n<p>N\u00ebse DNSSEC \u00ebsht\u00eb konfiguruar me gabime, kjo mund t\u00eb \u00e7oj\u00eb n\u00eb d\u00ebshtime t\u00eb dor\u00ebzimit t\u00eb post\u00ebs, n\u00ebse ana d\u00ebrguese mb\u00ebshtet DANE, edhe n\u00ebse ana pranuese nuk e di asgj\u00eb rreth tij. Prandaj, p\u00ebrkund\u00ebr faktit se DANE \u00ebsht\u00eb nj\u00eb standart m\u00eb i vjet\u00ebr dhe i sigurt dhe tashm\u00eb mb\u00ebshtetet n\u00eb disa programe serveri n\u00eb an\u00ebn e d\u00ebrguesit, n\u00eb praktik\u00eb dep\u00ebrtimi i tij mbetet i pak\u00ebt; shum\u00eb organizata nuk jan\u00eb t\u00eb gatshme ta implementojn\u00eb at\u00eb p\u00ebr shkak t\u00eb nevoj\u00ebs p\u00ebr t\u00eb implementuar DNSSEC, k\u00ebt\u00eb e ka ngadal\u00ebsuar ndjesh\u00ebm implementimin e DANE p\u00ebr gjith\u00eb vitet q\u00eb egziston standardi.<\/p>\n<p>DANE dhe MTA-STS nuk jan\u00eb n\u00eb konflikt me nj\u00ebri-tjetrin dhe mund t\u00eb p\u00ebrdoren s\u00eb bashku.<\/p>\n<h1>\u00c7far\u00eb ndodh me mb\u00ebshtetje p\u00ebr MTA-STS n\u00eb Mail.ru?<\/h1>\n<p>\nMail.ru ka publikuar politik\u00ebn MTA-STS p\u00ebr t\u00eb gjitha domain-t kryesore p\u00ebr nj\u00eb koh\u00eb t\u00eb gjat\u00eb. Tani jemi duke punuar p\u00ebr zbatimin e pjes\u00ebs klientit t\u00eb standardit. N\u00eb momentin kur u shkrua ky artikull, politikat aplikohen n\u00eb nj\u00eb mod\u00eb jo bllokuese (n\u00ebse dor\u00ebzimi bllokohet nga politika, letra do t\u00eb dor\u00ebzohet p\u00ebrmes nj\u00eb serveri 'rezerv\u00eb' pa p\u00ebrdorur politikat), dhe m\u00eb pas do t\u00eb detyrohet t\u00eb aplikohet nj\u00eb mod\u00eb bllokuese p\u00ebr nj\u00eb pjes\u00eb t\u00eb vog\u00ebl t\u00eb trafikut SMTP t\u00eb d\u00ebrguar, gradualisht p\u00ebr 100% t\u00eb trafikut do t\u00eb mb\u00ebshtetet aplikimi i politikave.<\/p>\n<h1>Kush tjet\u00ebr e mb\u00ebshtet standardin?<\/h1>\n<p>\nAktualisht, politikat MTA-STS po publikohen nga rreth 0.05% e domain-eve aktive, por megjithat\u00eb, ato tashm\u00eb mbrojn\u00eb nj\u00eb volum t\u00eb madh t\u00eb trafikut t\u00eb post\u00ebs elektronike, pasi standardi mb\u00ebshtetet nga lojtar\u00eb t\u00eb m\u00ebdhenj - Google, Comcast dhe pjes\u00ebrisht Verizon (AOL, Yahoo). Sh\u00ebrbime t\u00eb tjera t\u00eb post\u00ebs elektronike kan\u00eb njoftuar se mb\u00ebshtetje p\u00ebr standardin do t\u00eb realizohet n\u00eb t\u00eb ardhmen e af\u00ebrt.<\/p>\n<h1>Si do t\u00eb m\u00eb ndikoj\u00eb?<\/h1>\n<p>\nAsnj\u00ebher\u00eb, n\u00ebse domaini juaj nuk publikon nj\u00eb politik\u00eb MTA-STS. N\u00ebse publikoni nj\u00eb politik\u00eb, at\u00ebher\u00eb emailat p\u00ebr p\u00ebrdoruesit e serverit tuaj t\u00eb post\u00ebs do t\u00eb jen\u00eb m\u00eb t\u00eb sigurt nga nd\u00ebrhyrjet.<\/p>\n<h1>Si mund ta implementoj MTA-STS?<\/h1>\n<p>\n<b>Mb\u00ebshtetje p\u00ebr MTA-STS n\u00eb an\u00ebn e marr\u00ebsit<\/b><\/p>\n<p>N\u00eb m\u00ebnyr\u00eb t\u00eb mjaftueshme p\u00ebr t\u00eb publikuar nj\u00eb politik\u00eb p\u00ebrmes HTTPS dhe regjistrimeve n\u00eb DNS, duke konfiguruar nj\u00eb certifikat t\u00eb vlefshme nga nj\u00eb nga CA t\u00eb besueshme (mund t\u00eb p\u00ebrdorni Let\u2019s Encrypt) p\u00ebr STARTTLS n\u00eb MTA (STARTTLS mb\u00ebshtetet n\u00eb t\u00eb gjith\u00eb MTA t\u00eb sot\u00ebm), mb\u00ebshtetje t\u00eb ve\u00e7ant\u00eb nga MTA nuk k\u00ebrkohet.<\/p>\n<p>Hapat, duken si vijon:<\/p>\n<ol>\n<li>Konfiguroni STARTTLS n\u00eb MTA-n\u00eb q\u00eb po p\u00ebrdorni (postfix, exim, sendmail, Microsoft Exchange etj.).<\/li>\n<li>Sigurohuni q\u00eb t\u00eb p\u00ebrdoret nj\u00eb certifikat e vlefshme (e l\u00ebshuar nga nj\u00eb CA t\u00eb besueshme, e pa skaduar, subjekti i certifikat\u00ebs p\u00ebrputhet me regjistrin MX p\u00ebr t\u00eb cilin d\u00ebrgohet posta p\u00ebr domainin tuaj).<\/li>\n<li>Konfiguroni nj\u00eb regjistrim TLS-RPT, mbi t\u00eb cilin do t\u00eb d\u00ebrgohen raportet p\u00ebr zbatimin e politikave (nga sh\u00ebrbimet q\u00eb mb\u00ebshtesin d\u00ebrgimin e raporteve TLS). Nj\u00eb shembull regjistrimi (p\u00ebr domainin example.com):\n<pre><code class=\"plaintext\">smtp._tls.example.com. 300 IN TXT \"v=TLSRPTv1;rua=mailto:tlsrpt@example.com\"<\/code><\/pre>\n<p>\nKy regjistrim udh\u00ebzon d\u00ebrguesit e emailit t\u00eb d\u00ebrgojn\u00eb raportet statistikore mbi p\u00ebrdorimin e TLS n\u00eb SMTP n\u00eb adres\u00ebn <code>tlsrpt@exmple.com<\/code>.<\/p>\n<p>Ndjekni raportet p\u00ebr disa dit\u00eb, sigurohuni q\u00eb t\u00eb mos ket\u00eb gabime.<\/li>\n<li>Publikoni politik\u00ebn MTA-STS p\u00ebrmes HTTPS. Politika publikohet si nj\u00eb sked\u00eb teksti me terminator\u00eb rreshtash CRLF n\u00eb lokacion.\n<pre><code class=\"plaintext\">https:\/\/mta-sts.example.com\/.well-known\/mta-sts.txt\n<\/code><\/pre>\n<p>\nShembulli i politik\u00ebs:<\/p>\n<pre><code class=\"plaintext\">version: STSv1\nmode: enforce\nmx: mxs.mail.ru\nmx: emx.mail.ru\nmx: mx2.corp.mail.ru\nmax_age: 86400\n<\/code><\/pre>\n<p>\nFusha version p\u00ebrmban versionin e politik\u00ebs (aktualisht kjo \u00ebsht\u00eb <code>STSv1<\/code>), Mode p\u00ebrcakton m\u00ebnyr\u00ebn e p\u00ebrdorimit t\u00eb politik\u00ebs, testing \u2014 m\u00ebnyr\u00eb testimi (politika nuk aplikohet), enforce \u2014 m\u00ebnyr\u00eb operimi. S\u00eb pari, publikoni politik\u00ebn me mode: testing, n\u00ebse nuk ka probleme me politik\u00ebn n\u00eb m\u00ebnyr\u00ebn testuese, pas nj\u00eb kohe mund t\u00eb kaloni n\u00eb mode: enforce.<\/p>\n<p>N\u00eb mx jepet lista e t\u00eb gjith\u00eb server\u00ebve t\u00eb post\u00ebs q\u00eb mund t\u00eb pranojn\u00eb post\u00eb p\u00ebr domenin tuaj (\u00e7do server duhet t\u00eb ket\u00eb t\u00eb konfiguruar nj\u00eb sertifikat q\u00eb p\u00ebrputhet me emrin e caktuar n\u00eb mx). Max_age p\u00ebrcakton koh\u00ebn e cache-it t\u00eb politik\u00ebs (nj\u00eb her\u00eb e mbajtur politika do t\u00eb aplikohet edhe n\u00ebse sulmuesi e bllokon kthimin e saj ose d\u00ebmtuan regjistrimet e DNS-s\u00eb gjat\u00eb koh\u00ebs s\u00eb cache-it, sinjalizimi p\u00ebr nevoj\u00ebn p\u00ebr t\u00eb k\u00ebrkuar s\u00ebrish politik\u00ebn mund t\u00eb b\u00ebhet p\u00ebrmes ndryshimit t\u00eb regjistrimit mta-sts DNS).<\/li>\n<li>Publikoni n\u00eb DNS nj\u00eb regjistrim TXT:\u00a0\n<pre><code class=\"plaintext\">_mta-sts.example.com. TXT \u201cv=STS1; id=someid;\u201d\n<\/code><\/pre>\n<p>\nN\u00eb fush\u00ebn id mund t\u00eb p\u00ebrdoret nj\u00eb identifikues i rast\u00ebsish\u00ebm (p.sh. marka e koh\u00ebs), kur politika ndryshon ai duhet t\u00eb ndryshohet, kjo lejon d\u00ebrguesit t\u00eb kuptojn\u00eb se duhet t\u00eb rifreskohet politika e cache-uar (n\u00ebse identifikuesi ndryshon nga ai i cache-it).<\/li>\n<\/ol>\n<p>\n<b>Mb\u00ebshtetje MTA-STS nga ana e d\u00ebrguesit<\/b><\/p>\n<p>Aktualisht nuk \u00ebsht\u00eb mir\u00eb, pasi standardi \u00ebsht\u00eb i ri.<\/p>\n<ul>\n<li>Exim - nuk ka mb\u00ebshtetje t\u00eb integruar, ka nj\u00eb skenar t\u00eb jasht\u00ebm. <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Bobberty\/MTASTS-EXIM-PERL\">https:\/\/github.com\/Bobberty\/MTASTS-EXIM-PERL<\/a><\/noindex>\u00a0<\/li>\n<li>Postfix - nuk ka mb\u00ebshtetje t\u00eb integruar, ka nj\u00eb skenar t\u00eb jasht\u00ebm p\u00ebr t\u00eb cilin flitet gjer\u00ebsisht n\u00eb Habr. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/en\/post\/424961\/\">https:\/\/habr.com\/en\/post\/424961\/<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<h1>Si nj\u00eb pasth\u00ebnie n\u00eb lidhje me \u00abTLS t\u00eb detyruesh\u00ebm\u00bb<\/h1>\n<p>\nN\u00eb koh\u00ebt e fundit, rregullator\u00ebt po i kushtojn\u00eb v\u00ebmendje siguris\u00eb s\u00eb post\u00ebs (dhe kjo \u00ebsht\u00eb e mir\u00eb). P\u00ebr shembull, DMARC \u00ebsht\u00eb i detyruesh\u00ebm p\u00ebr t\u00eb gjitha institucionet shtet\u00ebrore n\u00eb SHBA dhe po k\u00ebrkohet gjithnj\u00eb e m\u00eb shum\u00eb n\u00eb sektorin financiar; n\u00eb fushat e rregulluara, p\u00ebrhapja e standardit arrin 90%. Aktualisht, disa rregullator\u00eb k\u00ebrkojn\u00eb zbatimin e \u00abTLS t\u00eb detyruesh\u00ebm\u00bb me domene t\u00eb ve\u00e7anta, por mekanizmi p\u00ebr sigurimin e \u00abTLS t\u00eb detyruesh\u00ebm\u00bb nuk p\u00ebrcaktohet dhe n\u00eb praktik\u00eb kjo konfigurim shpesh zbatohen n\u00eb nj\u00eb m\u00ebnyr\u00eb q\u00eb as minimalisht nuk mbron nga sulmet reale, t\u00eb cilat tashm\u00eb parashikohen n\u00eb mekanizma si DANE ose MTA-STS.<\/p>\n<p>N\u00ebse rregullatori k\u00ebrkon zbatimin e \u00abmandatory TLS\u00bb me domaine t\u00eb ve\u00e7anta, ne rekomandojm\u00eb t\u00eb shqyrtoni MTA-STS ose nj\u00eb analog t\u00eb tij si mekanizmin m\u00eb t\u00eb p\u00ebrshtatsh\u00ebm, sepse ai eliminon nevoj\u00ebn p\u00ebr t\u00eb b\u00ebr\u00eb konfigurime t\u00eb sigurta p\u00ebr \u00e7do domain ve\u00e7mas. N\u00ebse keni v\u00ebshtir\u00ebsi n\u00eb zbatimin e pjes\u00ebs klient MTA-STS (nd\u00ebrsa protokolli nuk ka marr\u00eb mb\u00ebshtetje t\u00eb gjer\u00eb, ato do t\u00eb jen\u00eb ndoshta t\u00eb pranishme), mund t\u00eb rekomandohet nj\u00eb qasje t\u00eb till\u00eb:<\/p>\n<ol>\n<li>Publikoni politik\u00ebn MTA-STS dhe\/ose regjistrat DANE (DANE ka kuptim t\u00eb shtohet vet\u00ebm n\u00ebse p\u00ebr domenin tuaj \u00ebsht\u00eb aktivizuar DNSSEC, nd\u00ebrsa MTA-STS \u00ebsht\u00eb gjithsesi i nevojsh\u00ebm), kjo do t\u00eb mbroj\u00eb trafikun n\u00eb drejtimin tuaj dhe do t\u00eb eliminoj\u00eb nevoj\u00ebn p\u00ebr t\u00eb k\u00ebrkuar nga sh\u00ebrbimet e tjera t\u00eb post\u00ebs t\u00eb konfigurojn\u00eb mandatory TLS p\u00ebr domenin tuaj, n\u00ebse sh\u00ebrbimi i post\u00ebs tashm\u00eb mb\u00ebshtet MTA-STS dhe\/ose DANE.<\/li>\n<li>P\u00ebr sh\u00ebrbimet e m\u00ebdha t\u00eb post\u00ebs, implementoni nj\u00eb \"analog\" t\u00eb MTA-STS p\u00ebrmes cil\u00ebsimeve t\u00eb ve\u00e7anta t\u00eb transportit p\u00ebr \u00e7do domain, q\u00eb do t\u00eb p\u00ebrcaktoj\u00eb MX-n\u00eb e p\u00ebrdorur p\u00ebr relen e post\u00ebs dhe do t\u00eb k\u00ebrkoj\u00eb verifikimin e detyruesh\u00ebm t\u00eb certifikat\u00ebs TLS p\u00ebr t\u00eb. N\u00ebse domainet tashm\u00eb publikojn\u00eb nj\u00eb politik\u00eb MTA-STS, kjo, me siguri, mund t\u00eb b\u00ebhet pa probleme. Aktivizimi i TLS-it t\u00eb detyruar p\u00ebr nj\u00eb domain pa caktimin e relen dhe verifikimin e certifikat\u00ebs p\u00ebr t\u00eb \u00ebsht\u00eb efikasisht i pamjaftuesh\u00ebm p\u00ebr q\u00ebllimet e siguris\u00eb dhe nuk sjell asgj\u00eb t\u00eb re n\u00eb mekanizmat ekzistues t\u00eb STARTTLS.<\/li>\n<\/ol>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/515746\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0415\u0441\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e, \u0442\u043e MTA-STS \u2014 \u044d\u0442\u043e \u0441\u043f\u043e\u0441\u043e\u0431 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0438\u0441\u044c\u043c\u0430 \u043e\u0442 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 (\u0442.\u0435. \u0430\u0442\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a-\u0432-\u0441\u0435\u0440\u0435\u0434\u0438\u043d\u0435 aka MitM) \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u043c\u0435\u0436\u0434\u0443 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438. \u041e\u043d \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0440\u0435\u0448\u0430\u0435\u0442 \u0443\u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b \u0438 \u043e\u043f\u0438\u0441\u0430\u043d \u0432 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0432\u0435\u0436\u0435\u043c \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0435 RFC 8461. \u041f\u043e\u0447\u0442\u0430 Mail.ru \u2014 \u043f\u0435\u0440\u0432\u0430\u044f \u043a\u0440\u0443\u043f\u043d\u0430\u044f \u043f\u043e\u0447\u0442\u043e\u0432\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u0432 \u0420\u0443\u043d\u0435\u0442\u0435, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0430\u044f \u0434\u0430\u043d\u043d\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442. \u0410 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91952,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-91951","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0415\u0441\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e, \u0442\u043e MTA-STS \u2014 \u044d\u0442\u043e \u0441\u043f\u043e\u0441\u043e\u0431 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0438\u0441\u044c\u043c\u0430 \u043e\u0442 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 (\u0442.\u0435. \u0430\u0442\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a-\u0432-\u0441\u0435\u0440\u0435\u0434\u0438\u043d\u0435 aka MitM) \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u043c\u0435\u0436\u0434\u0443 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438. \u041e\u043d \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0440\u0435\u0448\u0430\u0435\u0442 \u0443\u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b \u0438 \u043e\u043f\u0438\u0441\u0430\u043d \u0432 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0432\u0435\u0436\u0435\u043c \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0435 RFC 8461. \u041f\u043e\u0447\u0442\u0430 Mail.ru \u2014 \u043f\u0435\u0440\u0432\u0430\u044f \u043a\u0440\u0443\u043f\u043d\u0430\u044f \u043f\u043e\u0447\u0442\u043e\u0432\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u0432 \u0420\u0443\u043d\u0435\u0442\u0435, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0430\u044f \u0434\u0430\u043d\u043d\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442. \u0410 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u043e\u0447\u0442\u0430 Mail.ru \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 MTA-STS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0415\u0441\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e, \u0442\u043e MTA-STS \u2014 \u044d\u0442\u043e \u0441\u043f\u043e\u0441\u043e\u0431 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0438\u0441\u044c\u043c\u0430 \u043e\u0442 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 (\u0442.\u0435. \u0430\u0442\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a-\u0432-\u0441\u0435\u0440\u0435\u0434\u0438\u043d\u0435 aka MitM) \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u043c\u0435\u0436\u0434\u0443 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438. \u041e\u043d \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0440\u0435\u0448\u0430\u0435\u0442 \u0443\u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b \u0438 \u043e\u043f\u0438\u0441\u0430\u043d \u0432 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0432\u0435\u0436\u0435\u043c \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0435 RFC 8461. \u041f\u043e\u0447\u0442\u0430 Mail.ru \u2014 \u043f\u0435\u0440\u0432\u0430\u044f \u043a\u0440\u0443\u043f\u043d\u0430\u044f \u043f\u043e\u0447\u0442\u043e\u0432\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u0432 \u0420\u0443\u043d\u0435\u0442\u0435, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0430\u044f \u0434\u0430\u043d\u043d\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442. \u0410 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-20T17:42:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-20T17:42:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mail.ru fillon t\u00eb aplikohet n\u00eb m\u00ebnyr\u00eb testuese politik\u00ebn MTA-STS | ProHoster","description":"N\u00eb p\u00ebrmbledhje, MTA-STS \u00ebsht\u00eb nj\u00eb m\u00ebnyr\u00eb p\u00ebr t\u00eb mbrojtur m\u00eb tej email-at nga p\u00ebrgjojja (dmth. sulmet e haker\u00ebve n\u00eb mes aka MitM) gjat\u00eb transfert\u00ebs midis sh\u00ebrbimeve t\u00eb post\u00ebs. Ai pjes\u00ebrisht zgjidh problemet arkitekturore t\u00eb trash\u00ebguara t\u00eb protokolleve t\u00eb post\u00ebs elektronike dhe p\u00ebrshkruhet n\u00eb nj\u00eb standard relativisht t\u00eb ri RFC 8461. Mail.ru \u00ebsht\u00eb sh\u00ebrbimi i par\u00eb i madh i post\u00ebs n\u00eb Runet q\u00eb implementon k\u00ebt\u00eb standard. P\u00ebr m\u00eb shum\u00eb detaje, shiko","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u0447\u0442\u0430 Mail.ru \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 MTA-STS | ProHoster","og:description":"\u0415\u0441\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e, \u0442\u043e MTA-STS \u2014 \u044d\u0442\u043e \u0441\u043f\u043e\u0441\u043e\u0431 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0438\u0441\u044c\u043c\u0430 \u043e\u0442 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 (\u0442.\u0435. \u0430\u0442\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a-\u0432-\u0441\u0435\u0440\u0435\u0434\u0438\u043d\u0435 aka MitM) \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u043c\u0435\u0436\u0434\u0443 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438. \u041e\u043d \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0440\u0435\u0448\u0430\u0435\u0442 \u0443\u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b \u0438 \u043e\u043f\u0438\u0441\u0430\u043d \u0432 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0432\u0435\u0436\u0435\u043c \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0435 RFC 8461. \u041f\u043e\u0447\u0442\u0430 Mail.ru \u2014 \u043f\u0435\u0440\u0432\u0430\u044f \u043a\u0440\u0443\u043f\u043d\u0430\u044f \u043f\u043e\u0447\u0442\u043e\u0432\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u0432 \u0420\u0443\u043d\u0435\u0442\u0435, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0430\u044f \u0434\u0430\u043d\u043d\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442. \u0410 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-20T17:42:11+00:00","article:modified_time":"2020-08-20T17:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91951","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:18:26","updated":"2022-09-27 15:16:28"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/91951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=91951"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/91951\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/91952"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=91951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=91951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=91951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}