8 ms·

Dovecot audit complete

303 points by richardboegli 10y ago

saycheese 10y ago
Anyone know how much MOSS Secure Open Source (SOS) budgets a year for audits and how they select a vendor to do an audit? EDIT - Answer to the budget appears to be $500k to start: https://blog.mozilla.org/blog/2016/06/09/help-make-open-source-secure/ https://blog.mozilla.org/blog/2016/06/09/help-make-open-sour...
- Osmose 10y ago
  https://www.mozilla.org/en-US/moss/ https://www.mozilla.org/en-US/moss/ says the yearly budget is about $3 million.
  - citruspi 10y ago
    > Mozilla Open Source Support (MOSS) is Mozilla’s program for supporting the Open Source and Free Software movement, with a yearly budget of around $3 million. That's the yearly budget for the whole Open Source Support program. The Secure Open Source "pillar" which saycheese was asking about is just one of three (the other two being Foundational Technology and Missing Partners) which presumably split that $3 MM.
    - saycheese 10y ago
      Agree, MOSS is the "boss" of the SOS project; as stated in theSOS's budget appears to be $500k to start per: https://blog.mozilla.org/blog/2016/06/09/help-make-open-source-secure/ https://blog.mozilla.org/blog/2016/06/09/help-make-open-sour...
nl 10y ago
The libjpeg-turbo medium exploits are (as they said) interesting: However, more interesting were the two medium vulnerabilities, which were initially reported as DoS bugs in the libjpeg-turbo library but on further investigation were found to be issues with the JPEG standard itself. These issues were reproduced across multiple JPEG implementations, can be triggered by entirely legal JPEGs, and so are not easy to mitigate in any JPEG library itself.
- makomk 10y ago
  Those are probably fairly common in image compression standards - designers of image compression are not, in general, going to make their compression less efficient than it has to be. JPEG2000 in particular is likely to be far worse.
  - gcp 10y ago
    Not at all. Decode performance is generally a very important consideration, as it has to go in all kinds of devices. Unbounded decoding time would be terrible (it would "lock up" embedded devices), and it's almost certainly an oversight. You probably have encoding performance in mind, where there's much more liberty to make things very heavy.
  - nl 10y ago
    No, the opposite is true. Fast decompression is usually either the first or second priority for images.
    - jstimpfle 10y ago
      I don't think you disagree with your parent.
tln 10y ago
That's a fantastic endorsement for Dovecot. It's interesting that security is not highlighted on the homepage[0], just mentioned in passing. Also interesting is the "special C variant that makes it much more difficult to write security holes"[1] [0]: https://www.dovecot.org https://www.dovecot.org [1]: https://www.dovecot.org/security.html https://www.dovecot.org/security.html
- rubyn00bie 10y ago
  I was curious about what this special variant entailed and it looks to be some sensible guidelines/practices: https://github.com/dovecot/core/blob/master/doc/securecoding.txt https://github.com/dovecot/core/blob/master/doc/securecoding...
  - rtpg 10y ago
    >Don't rely on input validation. Maybe you missed something. Maybe someone calls your function somewhere else where you didn't originally intend it. Maybe someone makes the input validation less restrictive for some reason. Point is, it's not an excuse to cause a security hole just because input wasn't what you expected it to be. This point makes me mad because we have both ways to statically verify that calling conditions are "correct" through the right kind of design, and it should be a zero-cost abstraction but you can't do it in C. Plus this advice is messy when it comes to things like string escaping. This could easily lead to issues like double encoding. Issues that don't exist if you could set up "proper" type checking in C without having to use things like wrapper structs that incur performance penalties. Defensive programming is always a bit weird because it always feels un-necessary, but in C it's really necessary because you have so few assurances. Pretty scary I wonder if there's a tool out there that lets you use Rust-style linear types over C code, and other things that would make some of this advice redundant (because the CI server would check the code). You could still write C, but wrong C would error in the checking step.
    - viraptor 10y ago
      I don't think they meant what you described here. > Plus this advice is messy when it comes to things like string escaping. This could easily lead to issues like double encoding. That's escaping - it's not the same as validation. What they mean is that you shouldn't expect that the invariants you see right now to hold in the future. It still means that you should only escape right before the data sink that requires it. But on the other hand it means: escape it right before the data sink, even if you see that the caller only passes in 2 different static strings - it may change. Or escape even if the current filter before rejects anything apart from digits.
wonko1 10y ago
That's really interesting. I've been considering moving back to my own mail server from gmail for a long time but have been worried about the security issues. This is one more thing pushing me in that direction.
- hippich 10y ago
  you might be interested in https://github.com/sovereign/sovereign https://github.com/sovereign/sovereign
  - reitanqild 10y ago
    That seems to be a great repo, both as a starting point for self hosting and as a starting point for learning ansible!
  - tlrobinson 10y ago
    Installing 10 other services doesn't seem like a good way to run a secure mail server.
    - floatboth 10y ago
      Well, that setup offers a personal "cloud", not just mail. And the focus is more on "independent" than "secure". I wouldn't worry too much about running many services. They all run as their own unprivileged users. (Of course chroots or even jails/containers would be better.)
- chrismartin 10y ago
  I've been hosting my personal email on a $5/month DigitalOcean server, running Postfix + Dovecot, for almost two years. I think it's reasonably secure. I run updates regularly and trust the distro maintainers to release timely fixes for new vulns. Aside from that, I mostly ignore it because it works. I should probably look at the logs, but eh. After the typical host hardening stuff (which isn't much work with modern OS defaults), I have configured SPF, DKIM, DMARC policy, opportunistic TLS for server-to-server, and mandatory TLS for IMAP client connections. From a data privacy perspective, I know that nobody is mining the contents of my mailbox (except the messages I send to Gmail, etc. users!), and my server is not a high-value target for compromise. (Yes, DigitalOcean could snoop on my non-GPG-encrypted messages if they wanted. I guess I could migrate the server back to my own hardware.) I also encourage friends to use GPG, though this is orthogonal to one's choice of email host. For clients I use Thunderbird on desktop and K-9 Mail on Android. Mobile push via IMAP IDLE works out of the box. (I also run a CalDAV/CardDAV server to sync contacts/calendar/todo across devices, but that is technically separate.) Overall I'm really happy with the arrangement. The only annoyance was having my messages to Gmail users consistently marked as spam, but after doing everything suggested by mail-tester.com, I think I'm making it through most of the time.
frederikvs 10y ago
Makes one wonder how they achieved this. I can find a passing mention of a "special C variant that makes it much more difficult to write security holes"[0], but no more details on whether they enforce this (and how), nor on other techniques to improve security. Do they have a rules checker? Are they running static analysis? Which security-related compiler flags are they enabling? Other tools they use to achieve this? Or is it just a lead developer who really groks C and security, and who reviews all PRs? It'd be interesting to see what that other projects can learn here to improve security... [0] https://www.dovecot.org/security.html https://www.dovecot.org/security.html
- gcp 10y ago
  Much like djb's code it's forcing the most error prone parts (string handling, memory) to go through a library, or simply forbidding the error prone constructs entirely (static buffers).
jwilk 10y ago
This title badly needs a (semi)colon before "auditor".
- richardboegli 10y ago
  I hit the 80 char limit :( It was a struggle to get everything in there. Was going to use DONE instead of complete, but that didn't read right.
  - wodenokoto 10y ago
    You can drop the "by" and have > Mozilla sponsored Dovecot audit complete; auditor Cure53 “extremely impressed”
    - richardboegli 10y ago
      I had that as one the options, but wanted to have Dovecot first, not Mozilla as it is their product. But you have given me an idea :) EDIT: Doh, cannot edit. Email sent. Dovecot audit: Mozilla sponsored complete. Auditor Cure53 “extremely impressed”
      - wodenokoto 10y ago
        That is even more confusing. How about: Dovecot audit complete: Mozilla sponsored auditor, Cure53 "extremely impressed"
corv 10y ago
What is a good smtp server to go with it in terms of security and reliability?
- atmosx 10y ago
  The most secure in absolute terms is qmail[1] but I found OpenSMTPd[2] to be a joy to work with, something that can not be said for any other SMTPd system I worked over the years (postfix, sendmail horror, exim, qmail and OpenSMTPd). OpenSMTPd seems to be fairly secure[3]. [1]: http://www.qmail.org/top.html http://www.qmail.org/top.html [2]: https://www.opensmtpd.org/ https://www.opensmtpd.org/ [3]: https://www.opensmtpd.org/security.html https://www.opensmtpd.org/security.html
  - corv 10y ago
    Thanks
- xorcist 10y ago
  Use postfix. It's (one of the, it not the) most common, and it's got a security secord to rival dovecot (the author is competent and cares). It integrates with everything under the sun for filtering. There's good documentation in the form of bundled text files. Don't use qmail unless you really want to, as you need to patch it up a lot in any modern setting. And don't use sendmail if postfix will suffice. Exif will also do the job but there's really nothing it does better than the others.
kakarot 10y ago
Could anyone here point me in a good direction for hosting my own mail server? Is Dovecot a good solution? I can figure out a hosting solution but I would like to know about best practices for implementation and security. Thanks in advance ~
- jamespo 10y ago
  Dovecot + postfix are a good combination. Getting whitelisted by major mail providers could be more of an issue.
  - throwanem 10y ago
    If you're on DO or Linode or similar, you start with a new VPS and check the IP it's assigned in all the RBLs and spam blacklists. (Google "multi rbl check", there's a bunch.) If it's on any of them, tear down the VPS and stand up a fresh one, and repeat until you get a clean IP. Then keep it that way by not running an open relay. Beyond that, the main deliverability improvements, in approximate order of value, are: PTR record with the hostname you send mail from; DKIM; SPF; DMARC. My mail server runs all of these, and I've yet to encounter trouble sending to anyone, including Gmail, which is often mentioned in threads like these as being a special issue. Admittedly I've been running mail from that IP since 2004, so have a long history of not being a spammer, but as long as you start out with a clean IP and keep it so, and make sure all your sender legitimacy boxes are properly checked, I don't see any reason why you should have undue difficulty.
    - throwanem 10y ago
      (That's approximate descending order of value, to be clear. In particular, if you don't have a matching PTR record, you're hosed whatever else you try to do.)
      - greglindahl 10y ago
        Looking at the incoming mail in my server, I discovered that there are big legit mail senders who have a non-matching PTR. I suppose that at some point gmail et al stopped using that rule, or they just look for certain patterns in the PTR name, or something.
lolc 10y ago
Wow, congrats. Good engineering. I remember Dovecot for being the easy option back when I ran my own mailserver.

303 points by richardboegli 10y ago

Anyone know how much MOSS Secure Open Source (SOS) budgets a year for audits and how they select a vendor to do an audit? EDIT - Answer to the budget appears to be $500k to start: https://blog.mozilla.org/blog/2016/06/09/help-make-open-source-secure/ https://blog.mozilla.org/blog/2016/06/09/help-make-open-sour...

Osmose 10y ago
https://www.mozilla.org/en-US/moss/ https://www.mozilla.org/en-US/moss/ says the yearly budget is about $3 million.
- citruspi 10y ago
  > Mozilla Open Source Support (MOSS) is Mozilla’s program for supporting the Open Source and Free Software movement, with a yearly budget of around $3 million. That's the yearly budget for the whole Open Source Support program. The Secure Open Source "pillar" which saycheese was asking about is just one of three (the other two being Foundational Technology and Missing Partners) which presumably split that $3 MM.
  - saycheese 10y ago
    Agree, MOSS is the "boss" of the SOS project; as stated in theSOS's budget appears to be $500k to start per: https://blog.mozilla.org/blog/2016/06/09/help-make-open-source-secure/ https://blog.mozilla.org/blog/2016/06/09/help-make-open-sour...

nl 10y ago

The libjpeg-turbo medium exploits are (as they said) interesting: However, more interesting were the two medium vulnerabilities, which were initially reported as DoS bugs in the libjpeg-turbo library but on further investigation were found to be issues with the JPEG standard itself. These issues were reproduced across multiple JPEG implementations, can be triggered by entirely legal JPEGs, and so are not easy to mitigate in any JPEG library itself.

makomk 10y ago
Those are probably fairly common in image compression standards - designers of image compression are not, in general, going to make their compression less efficient than it has to be. JPEG2000 in particular is likely to be far worse.
- gcp 10y ago
  Not at all. Decode performance is generally a very important consideration, as it has to go in all kinds of devices. Unbounded decoding time would be terrible (it would "lock up" embedded devices), and it's almost certainly an oversight. You probably have encoding performance in mind, where there's much more liberty to make things very heavy.
- nl 10y ago
  No, the opposite is true. Fast decompression is usually either the first or second priority for images.
  - jstimpfle 10y ago
    I don't think you disagree with your parent.

tln 10y ago

That's a fantastic endorsement for Dovecot. It's interesting that security is not highlighted on the homepage[0], just mentioned in passing. Also interesting is the "special C variant that makes it much more difficult to write security holes"[1] [0]: https://www.dovecot.org https://www.dovecot.org [1]: https://www.dovecot.org/security.html https://www.dovecot.org/security.html

rubyn00bie 10y ago
I was curious about what this special variant entailed and it looks to be some sensible guidelines/practices: https://github.com/dovecot/core/blob/master/doc/securecoding.txt https://github.com/dovecot/core/blob/master/doc/securecoding...
- rtpg 10y ago
  >Don't rely on input validation. Maybe you missed something. Maybe someone calls your function somewhere else where you didn't originally intend it. Maybe someone makes the input validation less restrictive for some reason. Point is, it's not an excuse to cause a security hole just because input wasn't what you expected it to be. This point makes me mad because we have both ways to statically verify that calling conditions are "correct" through the right kind of design, and it should be a zero-cost abstraction but you can't do it in C. Plus this advice is messy when it comes to things like string escaping. This could easily lead to issues like double encoding. Issues that don't exist if you could set up "proper" type checking in C without having to use things like wrapper structs that incur performance penalties. Defensive programming is always a bit weird because it always feels un-necessary, but in C it's really necessary because you have so few assurances. Pretty scary I wonder if there's a tool out there that lets you use Rust-style linear types over C code, and other things that would make some of this advice redundant (because the CI server would check the code). You could still write C, but wrong C would error in the checking step.
  - viraptor 10y ago
    I don't think they meant what you described here. > Plus this advice is messy when it comes to things like string escaping. This could easily lead to issues like double encoding. That's escaping - it's not the same as validation. What they mean is that you shouldn't expect that the invariants you see right now to hold in the future. It still means that you should only escape right before the data sink that requires it. But on the other hand it means: escape it right before the data sink, even if you see that the caller only passes in 2 different static strings - it may change. Or escape even if the current filter before rejects anything apart from digits.

wonko1 10y ago

That's really interesting. I've been considering moving back to my own mail server from gmail for a long time but have been worried about the security issues. This is one more thing pushing me in that direction.

hippich 10y ago
you might be interested in https://github.com/sovereign/sovereign https://github.com/sovereign/sovereign
- reitanqild 10y ago
  That seems to be a great repo, both as a starting point for self hosting and as a starting point for learning ansible!
- tlrobinson 10y ago
  Installing 10 other services doesn't seem like a good way to run a secure mail server.
  - floatboth 10y ago
    Well, that setup offers a personal "cloud", not just mail. And the focus is more on "independent" than "secure". I wouldn't worry too much about running many services. They all run as their own unprivileged users. (Of course chroots or even jails/containers would be better.)
chrismartin 10y ago
I've been hosting my personal email on a $5/month DigitalOcean server, running Postfix + Dovecot, for almost two years. I think it's reasonably secure. I run updates regularly and trust the distro maintainers to release timely fixes for new vulns. Aside from that, I mostly ignore it because it works. I should probably look at the logs, but eh. After the typical host hardening stuff (which isn't much work with modern OS defaults), I have configured SPF, DKIM, DMARC policy, opportunistic TLS for server-to-server, and mandatory TLS for IMAP client connections. From a data privacy perspective, I know that nobody is mining the contents of my mailbox (except the messages I send to Gmail, etc. users!), and my server is not a high-value target for compromise. (Yes, DigitalOcean could snoop on my non-GPG-encrypted messages if they wanted. I guess I could migrate the server back to my own hardware.) I also encourage friends to use GPG, though this is orthogonal to one's choice of email host. For clients I use Thunderbird on desktop and K-9 Mail on Android. Mobile push via IMAP IDLE works out of the box. (I also run a CalDAV/CardDAV server to sync contacts/calendar/todo across devices, but that is technically separate.) Overall I'm really happy with the arrangement. The only annoyance was having my messages to Gmail users consistently marked as spam, but after doing everything suggested by mail-tester.com, I think I'm making it through most of the time.

frederikvs 10y ago

Makes one wonder how they achieved this. I can find a passing mention of a "special C variant that makes it much more difficult to write security holes"[0], but no more details on whether they enforce this (and how), nor on other techniques to improve security. Do they have a rules checker? Are they running static analysis? Which security-related compiler flags are they enabling? Other tools they use to achieve this? Or is it just a lead developer who really groks C and security, and who reviews all PRs? It'd be interesting to see what that other projects can learn here to improve security... [0] https://www.dovecot.org/security.html https://www.dovecot.org/security.html

gcp 10y ago
Much like djb's code it's forcing the most error prone parts (string handling, memory) to go through a library, or simply forbidding the error prone constructs entirely (static buffers).

jwilk 10y ago

This title badly needs a (semi)colon before "auditor".

richardboegli 10y ago
I hit the 80 char limit :( It was a struggle to get everything in there. Was going to use DONE instead of complete, but that didn't read right.
- wodenokoto 10y ago
  You can drop the "by" and have > Mozilla sponsored Dovecot audit complete; auditor Cure53 “extremely impressed”
  - richardboegli 10y ago
    I had that as one the options, but wanted to have Dovecot first, not Mozilla as it is their product. But you have given me an idea :) EDIT: Doh, cannot edit. Email sent. Dovecot audit: Mozilla sponsored complete. Auditor Cure53 “extremely impressed”
    - wodenokoto 10y ago
      That is even more confusing. How about: Dovecot audit complete: Mozilla sponsored auditor, Cure53 "extremely impressed"

corv 10y ago

What is a good smtp server to go with it in terms of security and reliability?

atmosx 10y ago
The most secure in absolute terms is qmail[1] but I found OpenSMTPd[2] to be a joy to work with, something that can not be said for any other SMTPd system I worked over the years (postfix, sendmail horror, exim, qmail and OpenSMTPd). OpenSMTPd seems to be fairly secure[3]. [1]: http://www.qmail.org/top.html http://www.qmail.org/top.html [2]: https://www.opensmtpd.org/ https://www.opensmtpd.org/ [3]: https://www.opensmtpd.org/security.html https://www.opensmtpd.org/security.html
- corv 10y ago
  Thanks
xorcist 10y ago
Use postfix. It's (one of the, it not the) most common, and it's got a security secord to rival dovecot (the author is competent and cares). It integrates with everything under the sun for filtering. There's good documentation in the form of bundled text files. Don't use qmail unless you really want to, as you need to patch it up a lot in any modern setting. And don't use sendmail if postfix will suffice. Exif will also do the job but there's really nothing it does better than the others.

kakarot 10y ago

Could anyone here point me in a good direction for hosting my own mail server? Is Dovecot a good solution? I can figure out a hosting solution but I would like to know about best practices for implementation and security. Thanks in advance ~

jamespo 10y ago
Dovecot + postfix are a good combination. Getting whitelisted by major mail providers could be more of an issue.
- throwanem 10y ago
  If you're on DO or Linode or similar, you start with a new VPS and check the IP it's assigned in all the RBLs and spam blacklists. (Google "multi rbl check", there's a bunch.) If it's on any of them, tear down the VPS and stand up a fresh one, and repeat until you get a clean IP. Then keep it that way by not running an open relay. Beyond that, the main deliverability improvements, in approximate order of value, are: PTR record with the hostname you send mail from; DKIM; SPF; DMARC. My mail server runs all of these, and I've yet to encounter trouble sending to anyone, including Gmail, which is often mentioned in threads like these as being a special issue. Admittedly I've been running mail from that IP since 2004, so have a long history of not being a spammer, but as long as you start out with a clean IP and keep it so, and make sure all your sender legitimacy boxes are properly checked, I don't see any reason why you should have undue difficulty.
  - throwanem 10y ago
    (That's approximate descending order of value, to be clear. In particular, if you don't have a matching PTR record, you're hosed whatever else you try to do.)
    - greglindahl 10y ago
      Looking at the incoming mail in my server, I discovered that there are big legit mail senders who have a non-matching PTR. I suppose that at some point gmail et al stopped using that rule, or they just look for certain patterns in the PTR name, or something.

lolc 10y ago

Wow, congrats. Good engineering. I remember Dovecot for being the easy option back when I ran my own mailserver.