From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <s.ivanov@proxmox.com> Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id D1945BECF6 for <pmg-devel@lists.proxmox.com>; Tue, 2 Jan 2024 11:31:02 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id B0ADA157EC for <pmg-devel@lists.proxmox.com>; Tue, 2 Jan 2024 11:31:02 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for <pmg-devel@lists.proxmox.com>; Tue, 2 Jan 2024 11:31:01 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 0B85F452AA for <pmg-devel@lists.proxmox.com>; Tue, 2 Jan 2024 11:31:00 +0100 (CET) From: Stoiko Ivanov <s.ivanov@proxmox.com> To: pmg-devel@lists.proxmox.com Date: Tue, 2 Jan 2024 11:30:39 +0100 Message-Id: <20240102103039.15709-1-s.ivanov@proxmox.com> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.088 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record T_SCC_BODY_TEXT_LINE -0.01 - Subject: [pmg-devel] [PATCH pmg-api] templates: postfix: forbid_bare_newline on external port X-BeenThere: pmg-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Mail Gateway development discussion <pmg-devel.lists.proxmox.com> List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pmg-devel>, <mailto:pmg-devel-request@lists.proxmox.com?subject=unsubscribe> List-Archive: <http://lists.proxmox.com/pipermail/pmg-devel/> List-Post: <mailto:pmg-devel@lists.proxmox.com> List-Help: <mailto:pmg-devel-request@lists.proxmox.com?subject=help> List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pmg-devel>, <mailto:pmg-devel-request@lists.proxmox.com?subject=subscribe> X-List-Received-Date: Tue, 02 Jan 2024 10:31:02 -0000 This patch addresses the smtp-smuggling vulnerability [0,1], with the recommended fix by postfix upstream [2]. Disallowing bare linefeeds instead of crlf should not be a problem with any standards-compliant MTA. The internal port allows bare linefeed, since internal clients (mail-scripts written ages ago, some ancient embedded systems) might not adhere to the protocol. Additionally the mail-proxy allowlist (the ip and cidr entries, are the only ones applicable here) is also added to the global exceptions. Currently the updated postfix-packages are not published in the security repositories but only as stable updates [3,4] However postfix ignores unknown configuration parameters and only prints a warning to the journal - so the changes to the templates can already be shipped, for those users who have the stable-updates mirror enabled. Tested with the current postfix in bookworm, then updating to the one in bookworm-updates and running tests with netcat (verified with nc -C that it still works with the correct line-termination): ``` $ nc -6 pmgtest 25 220 pmgtest.proxmox.com ESMTP Proxmox EHLO pmgsender.proxmox.com 521 5.5.2 pmgtest.proxmox.com Error: bare <LF> received ``` [0] https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/ [1] https://nvd.nist.gov/vuln/detail/CVE-2023-51764 [2] https://www.postfix.org/smtp-smuggling.html [3] https://security-tracker.debian.org/tracker/CVE-2023-51764 [4] https://lists.debian.org/debian-stable-announce/2023/12/msg00004.html Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com> --- src/templates/main.cf.in | 5 +++++ src/templates/master.cf.in | 1 + 2 files changed, 6 insertions(+) diff --git a/src/templates/main.cf.in b/src/templates/main.cf.in index c689af3..3b56355 100644 --- a/src/templates/main.cf.in +++ b/src/templates/main.cf.in @@ -101,6 +101,11 @@ unverified_recipient_reject_code = [% pmg.mail.verifyreceivers %] smtpd_data_restrictions = reject_unauth_pipelining +smtpd_forbid_bare_newline = yes +smtpd_forbid_bare_newline_exclusions = + $mynetworks, + cidr:/etc/postfix/clientaccess + smtpd_client_connection_count_limit = [% pmg.mail.conn_count_limit %] smtpd_client_connection_rate_limit = [% pmg.mail.conn_rate_limit %] smtpd_client_message_rate_limit = [% pmg.mail.message_rate_limit %] diff --git a/src/templates/master.cf.in b/src/templates/master.cf.in index 7d60d1d..674767d 100644 --- a/src/templates/master.cf.in +++ b/src/templates/master.cf.in @@ -92,6 +92,7 @@ scan unix - - n - [% pmg.mail.max_filters %] -o smtpd_client_restrictions= -o smtpd_sender_restrictions= -o smtpd_data_restrictions= + -o smtpd_forbid_bare_newline = no [% pmg.mail.ext_port %] inet n - - - 1 postscreen -- 2.39.2