{"id":91951,"date":"2020-08-20T19:42:11","date_gmt":"2020-08-20T17:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts"},"modified":"2020-08-20T19:42:11","modified_gmt":"2020-08-20T17:42:11","slug":"pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts","title":{"rendered":"Mail.ru Mail nis t\u00eb zbatoj\u00eb n\u00eb regjim testues politikat MTA-STS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Mail.ru Mail nis t\u00eb zbatoj\u00eb n\u00eb regjim testues politikat MTA-STS\" src=\"\/wp-content\/uploads\/2020\/08\/1f0b7542aedb372c06c2077ea987dd36.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nShkurtimisht, MTA-STS \u00ebsht\u00eb nj\u00eb m\u00ebnyr\u00eb p\u00ebr t\u00eb mbrojtur shtes\u00eb email-et nga p\u00ebrgjimi gjat\u00eb transmetimit midis server\u00ebve t\u00eb post\u00ebs (pra, nga sulmet man-in-the-middle, aka MitM). Ai zgjidh pjes\u00ebrisht problemet e trash\u00ebguara arkitekturore t\u00eb protokolleve t\u00eb email-it dhe p\u00ebrshkruhet n\u00eb standardin relativisht t\u00eb ri RFC 8461. Mail.ru Mail \u00ebsht\u00eb sh\u00ebrbimi i par\u00eb i madh i post\u00ebs n\u00eb Runet q\u00eb zbaton k\u00ebt\u00eb standard. M\u00eb posht\u00eb gjeni shpjegimin m\u00eb t\u00eb detajuar.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h1>\u00c7far\u00eb problemi zgjidh MTA-STS?<\/h1>\n<p>\nHistorikisht, protokollet e post\u00ebs elektronike (SMTP, POP3, IMAP) e transmetonin informacionin n\u00eb form\u00eb t\u00eb hapur, gj\u00eb q\u00eb lejonte p\u00ebrgjimin e tij, p\u00ebr shembull kur ka qasje n\u00eb kanalin e komunikimit.<\/p>\n<p>Ja si duket mekanizmi i dor\u00ebzimit t\u00eb nj\u00eb email-i nga nj\u00eb p\u00ebrdorues te tjetri:<\/p>\n<p><img decoding=\"async\" alt=\"Mail.ru Mail nis t\u00eb zbatoj\u00eb n\u00eb regjim testues politikat MTA-STS\" src=\"\/wp-content\/uploads\/2020\/08\/5b0d4749298d7644220a6322912d8716.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHistorikisht, sulmet MitM kan\u00eb qen\u00eb t\u00eb mundshme n\u00eb t\u00eb gjitha pikat ku kalon posta elektronike.<\/p>\n<p>Standardi RFC 8314 k\u00ebrkon p\u00ebrdorimin e detyruesh\u00ebm t\u00eb TLS midis programit t\u00eb post\u00ebs s\u00eb p\u00ebrdoruesit (MUA) dhe serverit t\u00eb post\u00ebs. N\u00ebse serveri juaj dhe aplikacionet e post\u00ebs q\u00eb p\u00ebrdorni jan\u00eb n\u00eb p\u00ebrputhje me RFC 8314, at\u00ebher\u00eb ju keni eliminuar n\u00eb mas\u00eb t\u00eb madhe mund\u00ebsin\u00eb e sulmeve Man-in-the-Middle midis p\u00ebrdoruesit dhe server\u00ebve t\u00eb post\u00ebs.<\/p>\n<p>Zbatimi i praktikave t\u00eb pranuara gjer\u00ebsisht (t\u00eb standardizuara n\u00eb RFC 8314) eliminon sulmin pran\u00eb p\u00ebrdoruesit:<\/p>\n<p><img decoding=\"async\" alt=\"Mail.ru Mail nis t\u00eb zbatoj\u00eb n\u00eb regjim testues politikat MTA-STS\" src=\"\/wp-content\/uploads\/2020\/08\/7a45c95793ec958c46f63898db39c1fc.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nServer\u00ebt e post\u00ebs s\u00eb Mail.ru ishin n\u00eb p\u00ebrputhje me RFC 8314 edhe para miratimit t\u00eb standardit; n\u00eb fakt, ai thjesht formalizon praktikat e zbatuara tashm\u00eb, ndaj nuk na u desh t\u00eb konfiguronim asgj\u00eb shtes\u00eb. Por n\u00ebse serveri juaj i post\u00ebs ende i lejon p\u00ebrdoruesit t\u00eb lidhen p\u00ebrmes protokolleve t\u00eb pasigurta, zbatoni patjet\u00ebr rekomandimet e k\u00ebtij standardi, sepse ka shum\u00eb gjasa q\u00eb t\u00eb pakt\u00ebn nj\u00eb pjes\u00eb e p\u00ebrdoruesve tuaj t\u00eb punojn\u00eb me post\u00ebn pa enkriptim, edhe n\u00ebse ju e mb\u00ebshtesni at\u00eb.<\/p>\n<p>Klienti i post\u00ebs punon gjithmon\u00eb me t\u00eb nj\u00ebjtin server postar t\u00eb s\u00eb nj\u00ebjt\u00ebs organizat\u00eb. Prandaj, mund t\u00eb detyrohen t\u00eb gjith\u00eb p\u00ebrdoruesit t\u00eb lidhen n\u00eb m\u00ebnyr\u00eb t\u00eb sigurt dhe m\u00eb pas t\u00eb b\u00ebhet teknikisht e pamundur lidhja n\u00eb m\u00ebnyr\u00eb t\u00eb pasigurt (pik\u00ebrisht k\u00ebt\u00eb k\u00ebrkon RFC 8314). Kjo ndonj\u00ebher\u00eb \u00ebsht\u00eb e v\u00ebshtir\u00eb, por e realizueshme. Me trafikun nd\u00ebrmjet server\u00ebve postar\u00eb situata \u00ebsht\u00eb edhe m\u00eb e nd\u00ebrlikuar. Server\u00ebt u p\u00ebrkasin organizatave t\u00eb ndryshme dhe shpesh p\u00ebrdoren sipas parimit \u00abkonfiguro dhe harro\u00bb, gj\u00eb q\u00eb e b\u00ebn t\u00eb pamundur kalimin e menj\u00ebhersh\u00ebm n\u00eb nj\u00eb protokoll t\u00eb sigurt pa cenuar lidhshm\u00ebrin\u00eb. N\u00eb SMTP prej koh\u00ebsh ekziston zgjerimi STARTTLS, i cili u lejon server\u00ebve q\u00eb mb\u00ebshtesin enkriptimin t\u00eb kalojn\u00eb n\u00eb TLS. Por nj\u00eb sulmues q\u00eb ka mund\u00ebsi t\u00eb ndikoj\u00eb n\u00eb trafik mund t\u00eb \u00abheq\u00eb\u00bb informacionin p\u00ebr mb\u00ebshtetjen e k\u00ebsaj komande dhe t\u2019i detyroj\u00eb server\u00ebt t\u00eb komunikojn\u00eb p\u00ebrmes protokollit t\u00eb zakonsh\u00ebm me tekst t\u00eb hapur (i ashtuquajturi downgrade attack \u2014 sulm p\u00ebr uljen e versionit t\u00eb protokollit). P\u00ebr t\u00eb nj\u00ebjt\u00ebn arsye, te STARTTLS zakonisht nuk verifikohet p\u00ebrputhshm\u00ebria e certifikat\u00ebs (nj\u00eb certifikat\u00eb e pabesuar mund t\u00eb mbroj\u00eb nga sulmet pasive dhe kjo nuk \u00ebsht\u00eb m\u00eb keq sesa d\u00ebrgimi i emailit n\u00eb tekst t\u00eb hapur). Prandaj STARTTLS mbron vet\u00ebm nga p\u00ebrgjimi pasiv.<\/p>\n<p>MTA-STS e zbut pjes\u00ebrisht problemin e kapjes s\u00eb email-eve nd\u00ebrmjet server\u00ebve postar\u00eb, kur sulmuesi ka mund\u00ebsi t\u00eb ndikoj\u00eb aktivisht n\u00eb trafik. N\u00ebse domeni i marr\u00ebsit publikon nj\u00eb politik\u00eb MTA-STS dhe serveri i d\u00ebrguesit mb\u00ebshtet MTA-STS, ai do ta d\u00ebrgoj\u00eb emailin vet\u00ebm p\u00ebrmes nj\u00eb lidhjeje TLS, vet\u00ebm te server\u00ebt e p\u00ebrcaktuar nga politika dhe vet\u00ebm me verifikim t\u00eb certifikat\u00ebs s\u00eb serverit.<\/p>\n<p>Pse vet\u00ebm pjes\u00ebrisht? MTA-STS funksionon vet\u00ebm n\u00ebse t\u00eb dyja pal\u00ebt jan\u00eb kujdesur p\u00ebr zbatimin e k\u00ebtij standardi, dhe MTA-STS nuk mbron nga skenar\u00ebt n\u00eb t\u00eb cil\u00ebt sulmuesi ka mund\u00ebsi t\u00eb marr\u00eb nj\u00eb certifikat\u00eb t\u00eb vlefshme t\u00eb domenit nga nj\u00eb prej CA-ve publike.<\/p>\n<h1>Si funksionon MTA-STS<\/h1>\n<p>\n<b>Marr\u00ebsi<\/b><\/p>\n<ol>\n<li>Konfiguron mb\u00ebshtetjen e STARTTLS me nj\u00eb certifikat\u00eb t\u00eb vlefshme n\u00eb serverin postar.\u00a0<\/li>\n<li>Publikon p\u00ebrmes HTTPS politik\u00ebn MTA-STS; p\u00ebr publikim p\u00ebrdoret domeni i posa\u00e7\u00ebm mta-sts dhe rruga speciale well-known, p\u00ebr shembull <code>https:\/\/mta-sts.mail.ru\/.well-known\/mta-sts.txt<\/code>. Politika p\u00ebrmban nj\u00eb list\u00eb t\u00eb server\u00ebve postar\u00eb (mx) q\u00eb kan\u00eb t\u00eb drejt\u00eb t\u00eb marrin post\u00eb p\u00ebr k\u00ebt\u00eb domen.<\/li>\n<li>Publikon nj\u00eb regjistrim t\u00eb posa\u00e7\u00ebm TXT _mta-sts n\u00eb DNS me versionin e politik\u00ebs. Kur politika ndryshon, ky regjistrim duhet t\u00eb p\u00ebrdit\u00ebsohet (kjo i sinjalizon d\u00ebrguesit se politika duhet t\u00eb k\u00ebrkohet s\u00ebrish). P\u00ebr shembull, <code>_mta-sts.mail.ru. TXT \"v=STSv1; id=20200303T120000;\"<\/code><\/li>\n<\/ol>\n<p>\n<b>D\u00ebrguesi<\/b><\/p>\n<p>D\u00ebrguesi k\u00ebrkon regjistrimin DNS _mta-sts; n\u00ebse ai ekziston, b\u00ebn nj\u00eb k\u00ebrkes\u00eb p\u00ebr politik\u00ebn p\u00ebrmes HTTPS (duke verifikuar certifikat\u00ebn). Politika e marr\u00eb ruhet n\u00eb cache (n\u00eb rast se nj\u00eb sulmues bllokon qasjen tek ajo ose z\u00ebvend\u00ebson regjistrimin DNS).<\/p>\n<p>Gjat\u00eb d\u00ebrgimit t\u00eb post\u00ebs verifikohet q\u00eb:<\/p>\n<ul>\n<li>serveri ku dor\u00ebzohet posta t\u00eb jet\u00eb i p\u00ebrfshir\u00eb n\u00eb politik\u00eb;<\/li>\n<li>serveri pranon post\u00ebn duke p\u00ebrdorur TLS (STARTTLS) dhe ka nj\u00eb certifikat\u00eb t\u00eb vlefshme.<\/li>\n<\/ul>\n<p><\/p>\n<h1>P\u00ebrpar\u00ebsit\u00eb e MTA-STS<\/h1>\n<p>\nMTA-STS p\u00ebrdor teknologji q\u00eb tashm\u00eb jan\u00eb zbatuar n\u00eb shumic\u00ebn e organizatave (SMTP+STARTTLS, HTTPS, DNS). P\u00ebr zbatimin nga ana e marr\u00ebsit nuk k\u00ebrkohet mb\u00ebshtetje e posa\u00e7me softuerike p\u00ebr k\u00ebt\u00eb standard.<\/p>\n<h1>Mang\u00ebsit\u00eb e MTA-STS<\/h1>\n<p>\nDuhet t\u00eb monitorohet vlefshm\u00ebria e certifikat\u00ebs s\u00eb serverit web dhe atij t\u00eb post\u00ebs, p\u00ebrputhshm\u00ebria e emrave dhe p\u00ebrdit\u00ebsimi n\u00eb koh\u00eb. Problemet me certifikat\u00ebn do ta b\u00ebjn\u00eb t\u00eb pamundur dor\u00ebzimin e post\u00ebs.<\/p>\n<p>Nga ana e d\u00ebrguesit k\u00ebrkohet nj\u00eb MTA me mb\u00ebshtetje p\u00ebr politikat MTA-STS; aktualisht MTA-STS nuk mb\u00ebshtetet \"out of the box\" n\u00eb MTA.<\/p>\n<p>MTA-STS p\u00ebrdor nj\u00eb list\u00eb t\u00eb CA rr\u00ebnj\u00eb t\u00eb besuara.<\/p>\n<p>MTA-STS nuk mbron nga sulmet ku sulmuesi p\u00ebrdor nj\u00eb certifikat\u00eb t\u00eb vlefshme. N\u00eb shumic\u00ebn e rasteve, MitM pran\u00eb serverit n\u00ebnkupton mund\u00ebsin\u00eb e l\u00ebshimit t\u00eb nj\u00eb certifikate. Nj\u00eb sulm i till\u00eb mund t\u00eb zbulohet p\u00ebrmes Certificate Transparency. Prandaj, n\u00eb t\u00ebr\u00ebsi, MTA-STS e zbut, por nuk e eliminon plot\u00ebsisht mund\u00ebsin\u00eb e p\u00ebrgjimit t\u00eb trafikut.<\/p>\n<p>Dy pikat e fundit e b\u00ebjn\u00eb MTA-STS m\u00eb pak t\u00eb sigurt se standardi konkurrues DANE p\u00ebr SMTP (RFC 7672), por m\u00eb t\u00eb besuesh\u00ebm nga ana teknike, pra p\u00ebr MTA-STS probabiliteti q\u00eb email-i t\u00eb mos dor\u00ebzohet p\u00ebr shkak t\u00eb problemeve teknike t\u00eb shkaktuara nga zbatimi i standardit \u00ebsht\u00eb i ul\u00ebt.<\/p>\n<h4>Standardi konkurrues \u2014 DANE<\/h4>\n<p>\nDANE p\u00ebrdor DNSSEC p\u00ebr t\u00eb publikuar informacion mbi certifikatat dhe nuk k\u00ebrkon besim te autoritetet e jashtme t\u00eb certifikimit, gj\u00eb q\u00eb \u00ebsht\u00eb duksh\u00ebm m\u00eb e sigurt. Megjithat\u00eb, p\u00ebrdorimi i DNSSEC \u00e7on shum\u00eb m\u00eb shpesh n\u00eb d\u00ebshtime teknike, n\u00ebse mb\u00ebshtetemi te statistikat e disa viteve t\u00eb p\u00ebrdorimit (edhe pse n\u00eb besueshm\u00ebrin\u00eb e DNSSEC dhe mb\u00ebshtetjen e tij teknike n\u00eb p\u00ebrgjith\u00ebsi v\u00ebrehet nj\u00eb prirje pozitive). P\u00ebr zbatimin e DANE n\u00eb SMTP nga ana e marr\u00ebsit, prania e DNSSEC p\u00ebr zon\u00ebn DNS \u00ebsht\u00eb e detyrueshme, nd\u00ebrsa p\u00ebr DANE \u00ebsht\u00eb thelb\u00ebsore mb\u00ebshtetja korrekte e NSEC\/NSEC3, me t\u00eb cil\u00ebn DNSSEC ka probleme sistemike.<\/p>\n<p>N\u00ebse DNSSEC \u00ebsht\u00eb konfiguruar me gabime, kjo mund t\u00eb \u00e7oj\u00eb n\u00eb d\u00ebshtime t\u00eb dor\u00ebzimit t\u00eb post\u00ebs, n\u00ebse pala d\u00ebrguese mb\u00ebshtet DANE, edhe n\u00ebse pala marr\u00ebse nuk di asgj\u00eb p\u00ebr t\u00eb. Prandaj, edhe pse DANE \u00ebsht\u00eb nj\u00eb standard m\u00eb i vjet\u00ebr dhe m\u00eb i sigurt dhe tashm\u00eb mb\u00ebshtetet nga nj\u00eb pjes\u00eb e softuerit t\u00eb server\u00ebve n\u00eb an\u00ebn e d\u00ebrguesit, n\u00eb praktik\u00eb p\u00ebrhapja e tij mbetet e kufizuar. Shum\u00eb organizata nuk jan\u00eb t\u00eb gatshme ta zbatojn\u00eb p\u00ebr shkak t\u00eb nevoj\u00ebs p\u00ebr t\u00eb implementuar DNSSEC, dhe kjo e ka ngadal\u00ebsuar ndjesh\u00ebm adoptimin e DANE gjat\u00eb gjith\u00eb viteve t\u00eb ekzistenc\u00ebs s\u00eb k\u00ebtij standardi.<\/p>\n<p>DANE dhe MTA-STS nuk bien n\u00eb konflikt me nj\u00ebri-tjetrin dhe mund t\u00eb p\u00ebrdoren s\u00eb bashku.<\/p>\n<h1>Si q\u00ebndron mb\u00ebshtetja p\u00ebr MTA-STS n\u00eb Mail.ru<\/h1>\n<p>\nMail.ru ka koh\u00eb q\u00eb publikon politik\u00ebn MTA-STS p\u00ebr t\u00eb gjitha domenet kryesore. Aktualisht po punojm\u00eb p\u00ebr zbatimin e pjes\u00ebs klient t\u00eb standardit. N\u00eb momentin e shkrimit t\u00eb artikullit, politikat zbatohen n\u00eb modalitet jo-bllokues (n\u00ebse dor\u00ebzimi bllokohet nga politika, emaili do t\u00eb dor\u00ebzohet p\u00ebrmes nj\u00eb serveri \u00abrezerv\u00eb\u00bb pa zbatimin e politikave), m\u00eb pas do t\u00eb aktivizohet modaliteti bllokues p\u00ebr nj\u00eb pjes\u00eb t\u00eb vog\u00ebl t\u00eb trafikut dal\u00ebs SMTP dhe gradualisht zbatimi i politikave do t\u00eb mbuloj\u00eb 100% t\u00eb trafikut.<\/p>\n<h1>Kush tjet\u00ebr e mb\u00ebshtet standardin<\/h1>\n<p>\nP\u00ebr momentin, politikat MTA-STS publikohen nga rreth 0.05% e domeneve aktive, por megjithat\u00eb ato tashm\u00eb mbrojn\u00eb nj\u00eb v\u00ebllim t\u00eb madh t\u00eb trafikut t\u00eb emailit, sepse standardi mb\u00ebshtetet nga lojtar\u00eb t\u00eb m\u00ebdhenj si Google, Comcast dhe pjes\u00ebrisht Verizon (AOL, Yahoo). Shum\u00eb sh\u00ebrbime t\u00eb tjera t\u00eb post\u00ebs kan\u00eb deklaruar se mb\u00ebshtetja p\u00ebr standardin do t\u00eb zbatohet n\u00eb t\u00eb ardhmen e af\u00ebrt.<\/p>\n<h1>Si do t\u00eb m\u00eb ndikoj\u00eb kjo?<\/h1>\n<p>\nN\u00eb asnj\u00eb m\u00ebnyr\u00eb, n\u00ebse domeni juaj nuk publikon nj\u00eb politik\u00eb MTA-STS. N\u00ebse publikoni nj\u00eb politik\u00eb, email-et p\u00ebr p\u00ebrdoruesit e serverit tuaj t\u00eb post\u00ebs do t\u00eb mbrohen m\u00eb mir\u00eb nga p\u00ebrgjimi.<\/p>\n<h1>Si ta zbatoj MTA-STS?<\/h1>\n<p>\n<b>Mb\u00ebshtetja e MTA-STS n\u00eb an\u00ebn e marr\u00ebsit<\/b><\/p>\n<p>Mjafton t\u00eb publikoni politik\u00ebn p\u00ebrmes HTTPS dhe regjistrimeve n\u00eb DNS, t\u00eb konfiguroni nj\u00eb certifikat\u00eb t\u00eb vlefshme nga nj\u00eb prej CA-ve t\u00eb besuara (mund t\u00eb p\u00ebrdorni edhe Let\u2019s Encrypt) p\u00ebr STARTTLS n\u00eb MTA (STARTTLS mb\u00ebshtetet nga t\u00eb gjitha MTA moderne); nuk k\u00ebrkohet mb\u00ebshtetje e ve\u00e7ant\u00eb nga ana e MTA-s\u00eb.<\/p>\n<p>Hap pas hapi, kjo duket k\u00ebshtu:<\/p>\n<ol>\n<li>Konfiguroni STARTTLS n\u00eb MTA q\u00eb p\u00ebrdorni (postfix, exim, sendmail, Microsoft Exchange, etj.).<\/li>\n<li>Sigurohuni q\u00eb t\u00eb p\u00ebrdoret nj\u00eb certifikat\u00eb e vlefshme (e l\u00ebshuar nga nj\u00eb CA i besuar, jo e skaduar, subjekti i certifikat\u00ebs p\u00ebrputhet me regjistrimin MX p\u00ebrmes t\u00eb cilit dor\u00ebzohet posta p\u00ebr domenin tuaj).<\/li>\n<li>Konfiguroni regjistrimin TLS-RPT, p\u00ebrmes t\u00eb cilit do t\u00eb d\u00ebrgohen raportet p\u00ebr zbatimin e politikave (nga sh\u00ebrbimet q\u00eb mb\u00ebshtesin d\u00ebrgimin e raporteve TLS). Shembull regjistrimi (p\u00ebr domenin example.com):\n<pre><code class=\"plaintext\">smtp._tls.example.com. 300 IN TXT \u00abv=TLSRPTv1;rua=mailto:tlsrpt@example.com\u00bb<\/code><\/pre>\n<p>\nKy regjistrim u udh\u00ebzon d\u00ebrguesve t\u00eb post\u00ebs t\u00eb d\u00ebrgojn\u00eb raporte statistikore p\u00ebr p\u00ebrdorimin e TLS n\u00eb SMTP n\u00eb adres\u00ebn <code>tlsrpt@exmple.com<\/code>.<\/p>\n<p>Ndiqni raportet p\u00ebr disa dit\u00eb dhe sigurohuni q\u00eb nuk ka gabime.<\/li>\n<li>Publikoni politik\u00ebn MTA-STS p\u00ebrmes HTTPS. Politika publikohet si nj\u00eb skedar teksti me terminator\u00eb rreshtash CRLF n\u00eb vendndodhjen:\n<pre><code class=\"plaintext\">https:\/\/mta-sts.example.com\/.well-known\/mta-sts.txt\n<\/code><\/pre>\n<p>\nShembull politike:<\/p>\n<pre><code class=\"plaintext\">version: STSv1\nmode: enforce\nmx: mxs.mail.ru\nmx: emx.mail.ru\nmx: mx2.corp.mail.ru\nmax_age: 86400\n<\/code><\/pre>\n<p>\nFusha version p\u00ebrmban versionin e politik\u00ebs (aktualisht \u00ebsht\u00eb <code>STSv1<\/code>), Mode p\u00ebrcakton m\u00ebnyr\u00ebn e zbatimit t\u00eb politik\u00ebs: testing \u00ebsht\u00eb m\u00ebnyra e testimit (politika nuk zbatohet), nd\u00ebrsa enforce \u00ebsht\u00eb m\u00ebnyra e plot\u00eb e zbatimit. Fillimisht publikoni politik\u00ebn me mode: testing; n\u00ebse gjat\u00eb testimit nuk shfaqen probleme, pas nj\u00eb kohe mund ta kaloni n\u00eb mode: enforce.<\/p>\n<p>Te mx p\u00ebrcaktohet lista e t\u00eb gjith\u00eb server\u00ebve t\u00eb post\u00ebs q\u00eb mund t\u00eb pranojn\u00eb post\u00eb p\u00ebr domenin tuaj (n\u00eb secilin server duhet t\u00eb konfigurohet nj\u00eb certifikat\u00eb q\u00eb p\u00ebrputhet me emrin e caktuar n\u00eb mx). Max_age p\u00ebrcakton koh\u00ebn e ruajtjes n\u00eb cache t\u00eb politik\u00ebs (nj\u00eb politik\u00eb e ruajtur do t\u00eb zbatohet edhe n\u00ebse nj\u00eb sulmues bllokon dor\u00ebzimin e saj ose prish regjistrimet DNS gjat\u00eb periudh\u00ebs s\u00eb cache; nevoja p\u00ebr ta k\u00ebrkuar s\u00ebrish politik\u00ebn mund t\u00eb sinjalizohet p\u00ebrmes ndryshimit t\u00eb regjistrimit DNS mta-sts).<\/li>\n<li>Publikoni nj\u00eb regjistrim TXT n\u00eb DNS:\u00a0\n<pre><code class=\"plaintext\">_mta-sts.example.com. TXT \u201cv=STS1; id=someid;\u201d\n<\/code><\/pre>\n<p>\nN\u00eb fush\u00ebn id mund t\u00eb p\u00ebrdoret nj\u00eb identifikues arbitrar (p\u00ebr shembull, nj\u00eb shenj\u00eb kohore); kur politika ndryshon, ai duhet t\u00eb ndryshoj\u00eb gjithashtu. Kjo u lejon d\u00ebrguesve t\u00eb kuptojn\u00eb se duhet t\u00eb rik\u00ebrkojn\u00eb politik\u00ebn e ruajtur n\u00eb cache (n\u00ebse identifikuesi ndryshon nga ai i cache).<\/li>\n<\/ol>\n<p>\n<b>Mb\u00ebshtetja e MTA-STS nga ana e d\u00ebrguesit<\/b><\/p>\n<p>P\u00ebr momentin, situata nuk \u00ebsht\u00eb e mir\u00eb, sepse standardi \u00ebsht\u00eb i ri.<\/p>\n<ul>\n<li>Exim \u2014 nuk ka mb\u00ebshtetje t\u00eb integruar, ka nj\u00eb skript nga pal\u00eb t\u00eb treta <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Bobberty\/MTASTS-EXIM-PERL\">https:\/\/github.com\/Bobberty\/MTASTS-EXIM-PERL<\/a><\/noindex>\u00a0<\/li>\n<li>Postfix \u2014 nuk ka mb\u00ebshtetje t\u00eb integruar, ka nj\u00eb skript nga pal\u00eb t\u00eb treta p\u00ebr t\u00eb cilin \u00ebsht\u00eb shpjeguar holl\u00ebsisht n\u00eb Habr <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/en\/post\/424961\/\">https:\/\/habr.com\/en\/post\/424961\/<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<h1>Si p\u00ebrfundim, disa fjal\u00eb p\u00ebr \u00abmandatory TLS\u00bb<\/h1>\n<p>\nKoh\u00ebt e fundit, rregullator\u00ebt po i kushtojn\u00eb v\u00ebmendje siguris\u00eb s\u00eb email-it (dhe kjo \u00ebsht\u00eb gj\u00eb e mir\u00eb). P\u00ebr shembull, DMARC \u00ebsht\u00eb i detyruesh\u00ebm p\u00ebr t\u00eb gjitha institucionet shtet\u00ebrore n\u00eb SHBA dhe po k\u00ebrkohet gjithnj\u00eb e m\u00eb shpesh n\u00eb sektorin financiar; n\u00eb fushat e rregulluara, p\u00ebrhapja e standardit arrin n\u00eb 90%. Tani disa rregullator\u00eb k\u00ebrkojn\u00eb zbatimin e \u00abmandatory TLS\u00bb me domene t\u00eb ve\u00e7anta, por mekanizmi p\u00ebr garantimin e \u00abmandatory TLS\u00bb nuk p\u00ebrcaktohet, dhe n\u00eb praktik\u00eb ky konfigurim shpesh zbatohet n\u00eb nj\u00eb m\u00ebnyr\u00eb q\u00eb nuk mbron as minimalisht nga sulmet reale, t\u00eb cilat tashm\u00eb mbulohen nga mekanizma si DANE ose MTA-STS.<\/p>\n<p>N\u00ebse rregullatori k\u00ebrkon zbatimin e \u00abmandatory TLS\u00bb me domene t\u00eb ve\u00e7anta, ne rekomandojm\u00eb t\u00eb shqyrtoni MTA-STS ose analogun e tij t\u00eb pjessh\u00ebm si mekanizmin m\u00eb t\u00eb p\u00ebrshtatsh\u00ebm; ai eliminon nevoj\u00ebn p\u00ebr t\u00eb b\u00ebr\u00eb konfigurime t\u00eb sigurta p\u00ebr secilin domen ve\u00e7mas. N\u00ebse keni v\u00ebshtir\u00ebsi me zbatimin e pjes\u00ebs klient t\u00eb MTA-STS (p\u00ebr sa koh\u00eb q\u00eb protokolli ende nuk ka marr\u00eb mb\u00ebshtetje t\u00eb gjer\u00eb, me shum\u00eb gjas\u00eb do t\u2019i hasni), mund t\u00eb rekomandohet kjo qasje:<\/p>\n<ol>\n<li>Publikoni politik\u00ebn MTA-STS dhe\/ose regjistrimet DANE (DANE ka kuptim t\u00eb shtohet vet\u00ebm n\u00ebse DNSSEC \u00ebsht\u00eb tashm\u00eb i aktivizuar p\u00ebr domenin tuaj, nd\u00ebrsa MTA-STS n\u00eb \u00e7do rast); kjo do t\u00eb mbroj\u00eb trafikun hyr\u00ebs drejt jush dhe do t\u2019ju liroj\u00eb nga nevoja p\u00ebr t\u2019u k\u00ebrkuar sh\u00ebrbimeve t\u00eb tjera t\u00eb post\u00ebs t\u00eb konfigurojn\u00eb mandatory TLS p\u00ebr domenin tuaj, n\u00ebse sh\u00ebrbimi i post\u00ebs tashm\u00eb mb\u00ebshtet MTA-STS dhe\/ose DANE.<\/li>\n<li>P\u00ebr sh\u00ebrbime t\u00eb m\u00ebdha email-i, zbatoni nj\u00eb \u201canalog\u201d t\u00eb MTA-STS p\u00ebrmes cil\u00ebsimeve t\u00eb ve\u00e7anta t\u00eb transportit p\u00ebr secilin domen, t\u00eb cilat do t\u00eb fiksojn\u00eb MX-in e p\u00ebrdorur p\u00ebr relay t\u00eb post\u00ebs dhe do t\u00eb k\u00ebrkojn\u00eb p\u00ebr t\u00eb verifikim t\u00eb detyruesh\u00ebm t\u00eb certifikat\u00ebs TLS. N\u00ebse domenet tashm\u00eb publikojn\u00eb politik\u00ebn MTA-STS, kjo me shum\u00eb gjasa mund t\u00eb b\u00ebhet pa probleme. Aktivizimi i TLS t\u00eb detyruesh\u00ebm p\u00ebr nj\u00eb domen, pa fiksim t\u00eb relay-t dhe pa verifikimin e certifikat\u00ebs p\u00ebr t\u00eb, n\u00eb vetvete \u00ebsht\u00eb joefektiv nga pik\u00ebpamja e siguris\u00eb dhe nuk shton asgj\u00eb ndaj mekanizmave ekzistues t\u00eb STARTTLS.<\/li>\n<\/ol>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/515746\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0415\u0441\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e, \u0442\u043e MTA-STS \u2014 \u044d\u0442\u043e \u0441\u043f\u043e\u0441\u043e\u0431 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0438\u0441\u044c\u043c\u0430 \u043e\u0442 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 (\u0442.\u0435. \u0430\u0442\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a-\u0432-\u0441\u0435\u0440\u0435\u0434\u0438\u043d\u0435 aka MitM) \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u043c\u0435\u0436\u0434\u0443 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438. \u041e\u043d \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0440\u0435\u0448\u0430\u0435\u0442 \u0443\u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b \u0438 \u043e\u043f\u0438\u0441\u0430\u043d \u0432 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0432\u0435\u0436\u0435\u043c \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0435 RFC 8461. \u041f\u043e\u0447\u0442\u0430 Mail.ru \u2014 \u043f\u0435\u0440\u0432\u0430\u044f \u043a\u0440\u0443\u043f\u043d\u0430\u044f \u043f\u043e\u0447\u0442\u043e\u0432\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u0432 \u0420\u0443\u043d\u0435\u0442\u0435, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0430\u044f \u0434\u0430\u043d\u043d\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442. \u0410 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91952,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-91951","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0415\u0441\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e, \u0442\u043e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u043e\u0447\u0442\u0430 Mail.ru \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 MTA-STS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0415\u0441\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e, \u0442\u043e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-20T17:42:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-20T17:42:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mail.ru Mail nis t\u00eb zbatoj\u00eb politikat MTA-STS n\u00eb regjim testues | ProHoster","description":"Shkurtimisht,","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u0447\u0442\u0430 Mail.ru \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 MTA-STS | ProHoster","og:description":"\u0415\u0441\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e, \u0442\u043e.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-20T17:42:11+00:00","article:modified_time":"2020-08-20T17:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91951","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:18:26","updated":"2022-09-27 15:16:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/91951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=91951"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/91951\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/91952"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=91951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=91951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=91951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}