freinet-devops / postfix-relay-dummy Goto Github PK

It would be nice if the snake oil cert included a SAN derived from MAILNAME. Since this runs in a container the hostname in the cert is the internal container hostname. Since clients outside the container infrastructure access the service with some other hostname, usually MAILNAME, the CN in certificate doesn't match causing a STARTTLS failure. TLS security will usually allow for a self signed cert but not a CN mismatch.

The v1.5 docker image has a total of 212 high or critical security issues! The latest docker image is more or less the same with 210 issues. In general it is very confusing, that the latest is 3 years older than v1.5.

This is a trivy security scan

2023-08-11T07:30:36.558Z	INFO	Vulnerability scanning is enabled
2023-08-11T07:30:36.558Z	INFO	Secret scanning is enabled
2023-08-11T07:30:36.558Z	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-08-11T07:30:36.558Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.44/docs/scanner/secret/#recommendation for faster secret detection
2023-08-11T07:30:38.099Z	INFO	Detected OS: debian
2023-08-11T07:30:38.099Z	INFO	Detecting Debian vulnerabilities...
2023-08-11T07:30:38.152Z	INFO	Number of language-specific files: 0

freinet/postfix-relay:1.5 (debian 11.3)
=======================================
Total: 212 (HIGH: 187, CRITICAL: 25)

...DETAIL REPORT IN ATTACHMENT...
[security-scan.txt](https://github.com/freinet-devops/postfix-relay-dummy/files/12319418/security-scan.txt)

Please excuse my ignorance regarding postfix. I believe I'm setting the correct values for the correct variables when running your docker container, but I can't get past the auth during testing.

I'm not entirely sure what MAILNAME, RELAYHOST and RELAYHOST_PASSWORDMAP should be. Below is the actual command.

docker run -d -p 587:587 \
    -e MAILNAME=thisrelay.local \
    -e POSTFIX_ADD_MISSING_HEADERS=yes \
    -e RELAYHOST=thisrelay.local:587 \
    -e RELAYHOST_AUTH=yes \
    -e RELAYHOST_PASSWORDMAP=thisrelay.local:test:password \
    -e USE_TLS=yes \
    -e TLS_SECURITY_LEVEL=encrypt \
    freinet/postfix-relay

Testing:

echo -e "To: Bob <[email protected]>\nFrom: Bill <[email protected]>\nSubject: Test email\n\nThis is a test email message" | \
   s-nail -v \
   -S v15-compat \
   -S smtp-use-starttls \
   -S tls-verify=ignore \
   -S mta=smtp://user:[email protected]:587 \
   -S [email protected] \
   -t

Result:

s-nail: P(seudo)R(andom)N(umber)G(enerator): *TLS RAND_*
s-nail: Resolving host 127.0.0.1:587 ... done
s-nail: Connecting to 127.0.0.1:587 ... connected.
s-nail: TLS connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
s-nail: SMTP server: 503 5.5.1 Error: authentication not enabled

Hi,

came here looking for the source code for https://hub.docker.com/r/freinet/postfix-relay, but couldn't find it.

The readme mentions this repo is temporary.

Please advise.