Unannounced mandatory enforcement of SSL email authentication after server attack

[wyvernit]

There was an attack on the host23 server recently. One of the fixes by the EUK server team was to disable plain text email authentication, and enforce mandatory SSL authentication. This was done without any prior announcement, and causes large problems with reseller clients. Most of my clients are set up with plain text authentication. Therefore there's no way I can contact them all easily to instruct how to reconfigure email, as they cannot receive emails. Also the change means having to change the mail servers to host23 as the domain mail servers don't have SSL certificates.

Changes like this need to be pre-warned with a reasonable amount of time to inform clients. I need a grace period where plain text is re-enabled so I can sort my clients out. I have tried to discuss this using the ticket system but just get generic responses, or just plain ignored.

[Ryan]

This was a precautionary measure as host23 server was targeted with too many connection requests using non secured protocol. In order to protect the mail server, we had to force the mail server to allow authentication over secure protocol.

I would also like to iterate that the setting was a temporary one when the server was being flooded with hugh number of connections. We have now reverted to the previous settings so you should not face any problem with plain text email authentication.

If you still need any assistance on this issue, please feel free to initiate a new live chat session from our website.

[wyvernit]

I understand the reasons to make this measure. However there were no communications to say what had been done, which is bad as it impacts a lot of people who rely on regular email for their business. Given that you send out advertising emails regularly, you need to communicate properly when you impose changes that affect users this way. As a reseller I am happy to handle the individual clients, but can't do so unless I am made aware by yourselves. My admin email account for the reseller package is hosted on Gmail, so I can easily receive status updates. What would make more sense is an SMS notification system. You also failed to update your own status portal at http://euk-status.com.

As for reverting to the previous settings, no this has not happened. I have just reverted to plain text and the connection is still refused:

Outlook 2016 response: "Log onto incoming mail server (IMAP): General authentication failed. None of the authentication methods supported by your IMAP server (if any) are supported on this computer."

[Ryan]

With reference to previous settings revert, I have just received an update from our tech team stating that a setting "Allow Plaintext Authentication" has now been enabled in exim configuration file with the help of which connections originating on the local server will be allowed to authenticate without encryption.

About the lack of communication, due to the nature of attack and the fact that this was only a temporary restriction, we did not send out an official communication for this action. In general, we do send official email communication to all clients for any major updates or changes that take place at the server level, which may directly or indirectly have an impact on their services.

Lastly, if you still face any issues related to authentication, kindly update your ongoing ticket or initiate a new live chat from our website.

[wyvernit]

The attack happened on 16th September, the revert to normal service happened today, 21st September. So in 5 days, no one thought to communicate to your customers about what was happening and that email authentication had changed. Nothing got posted on the euk status website, that should happen in the first couple of hours. This isn't acceptable.

[Ryan]

At the outset, the restriction wasn't intended to be in place for these many days. An official communication would have definitely been sent if this was the case. Restriction was put in place at the time of attack and since then our team was monitoring the activity on server for it to subside so they can revert back to original settings. This eventually took longer than expected which is why the notification part was missed.

We regret the inconvenience this action caused to you. Our QA team have taken note of this instance to ensure that communication is sent out in case of any such instances in future.