all lists on lists.proxmox.com
 help / color / mirror / Atom feed
* [pmg-devel] [PATCH v2 pmg-{api, gui, docs} 0/4] fix #2437: Add TLS enforcment option for inbound domains
@ 2023-03-20 10:35 Christoph Heiss
  2023-03-20 10:35 ` [pmg-devel] [PATCH v2 pmg-api 1/4] fix #2437: config: Add new tls_inbound_domains postfix map Christoph Heiss
                   ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: Christoph Heiss @ 2023-03-20 10:35 UTC (permalink / raw)
  To: pmg-devel

TL;DR: Implements the approach as laid out by Stoiko in the Bugzilla
ticket [0].

A new API endpoint is added - /api2/json/config/tlsinbounddomains. This
is used to configure the newly introduced postfix map at
/etc/pmg/tls_inbound_domains, specifying sender domains which get the
`reject_plaintext_session` action [1] set, thus requiring TLS-encrypted
sessions on inbound connections.

On the GUI side, a new panel is added in Configuration -> Mail Proxy ->
TLS, where the domains for which this should be enforced can be specified.

Testing
-------
Tested this to the best of my knowledge, by adding some domains using
the UI and using `curl` to send some simple mails:

  echo '' | curl -skv smtp://<host> -T - \
    --mail-from foo@localhost.localdomain \
    --mail-rcpt bar@localhost.localdomain

.. where `localhost.localdomain` is on the new 'TLS Inbound Domains' list.
This will now fail with:

  450 4.7.1 Session encryption is required

When additionally adding the `--ssl-reqd` option to curl (instructing it
to require a TLS-encrypted session), the above command will succeed.

(Also tested it with a domain not on the list, checking that no
regressions are introduced.)

[0] https://bugzilla.proxmox.com/show_bug.cgi?id=2437
[1] http://www.postfix.org/postconf.5.html#reject_plaintext_session

v1: https://lists.proxmox.com/pipermail/pmg-devel/2023-March/002296.html

---
pmg-api:

Christoph Heiss (2):
      fix #2437: config: Add new tls_inbound_domains postfix map
      fix #2437: api: Add endpoint for managing tls_inbound_domains entries

 src/Makefile                      |   1 +
 src/PMG/API2/Config.pm            |   7 +++
 src/PMG/API2/InboundTLSDomains.pm | 127 ++++++++++++++++++++++++++++++++++++++
 src/PMG/Cluster.pm                |   1 +
 src/PMG/Config.pm                 |  56 +++++++++++++++++
 src/templates/main.cf.in          |   1 +
 6 files changed, 193 insertions(+)

pmg-gui:

Christoph Heiss (1):
      fix #2437: proxy: Add 'TLS Inbound Domains' panel

 js/MailProxyTLSInboundDomains.js | 93 ++++++++++++++++++++++++++++++++++++++++
 js/MailProxyTLSPanel.js          |  8 +++-
 js/Makefile                      |  1 +
 3 files changed, 101 insertions(+), 1 deletion(-)

pmg-docs:

Christoph Heiss (1):
      pmgconfig: Explain new TLS inbound domains configuration

 pmgconfig.adoc | 11 +++++++++++
 1 file changed, 11 insertions(+)
--
2.39.2





^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2023-03-20 21:02 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-03-20 10:35 [pmg-devel] [PATCH v2 pmg-{api, gui, docs} 0/4] fix #2437: Add TLS enforcment option for inbound domains Christoph Heiss
2023-03-20 10:35 ` [pmg-devel] [PATCH v2 pmg-api 1/4] fix #2437: config: Add new tls_inbound_domains postfix map Christoph Heiss
2023-03-20 10:35 ` [pmg-devel] [PATCH v2 pmg-api 2/4] fix #2437: api: Add endpoint for managing tls_inbound_domains entries Christoph Heiss
2023-03-20 10:35 ` [pmg-devel] [PATCH v2 pmg-gui 3/4] fix #2437: proxy: Add 'TLS Inbound Domains' panel Christoph Heiss
2023-03-20 10:35 ` [pmg-devel] [PATCH v2 pmg-docs 4/4] pmgconfig: Explain new TLS inbound domains configuration Christoph Heiss
2023-03-20 21:01 ` [pmg-devel] applied-series: [PATCH v2 pmg-{api, gui, docs} 0/4] fix #2437: Add TLS enforcment option for inbound domains Stoiko Ivanov

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal