This patch adds a new configuration option 'tls_before_auth', that when set, does not offer AUTH until the connection has been secured. This helps to prevent password disclosures with SASL LOGIN/PLAIN mechanisms.
Signed-off-by: Robin H. Johnson <[EMAIL PROTECTED]>
Index: README
===================================================================
--- README (revision 642)
+++ README (working copy)
@@ -176,6 +176,11 @@ smtpd uses during the data transactions.
will default to use $ENV{HOME}/tmp/. This directory should be set with
a mode of 700 and owned by the smtpd user.
+=item tls_before_auth
+
+If this file contains anything except a 0 on the first line, then AUTH will not
+be offered unless TLS/SSL are in place, either with STARTTLS, or SMTP-SSL on
+port 465.
=item everything (?) that qmail-smtpd supports.
Index: lib/Qpsmtpd/SMTP.pm
===================================================================
--- lib/Qpsmtpd/SMTP.pm (revision 642)
+++ lib/Qpsmtpd/SMTP.pm (working copy)
@@ -219,7 +219,9 @@ HOOK: foreach my $hook ( keys %{$self->{
}
}
- if ( %auth_mechanisms ) {
+ # Check if we should only offer AUTH after TLS is completed
+ my $tls_before_auth = ($self->config('tls_before_auth') ?
($self->config('tls_before_auth'))[0] &&
$self->transaction->notes('tls_enabled') : 0);
+ if ( %auth_mechanisms && !$tls_before_auth) {
push @capabilities, 'AUTH '.join(" ",keys(%auth_mechanisms));
$self->{_commands}->{'auth'} = "";
}
@@ -248,6 +250,9 @@ sub auth {
and $self->{_auth} == OK );
return $self->respond( 503, "AUTH not defined for HELO" )
if ( $self->connection->hello eq "helo" );
+ return $self->respond( 503, "SSL/TLS required before AUTH" )
+ if ( ($self->config('tls_before_auth'))[0]
+ and $self->transaction->notes('tls_enabled') );
return $self->{_auth} = Qpsmtpd::Auth::SASL( $self, $arg, @stuff );
}
--
Robin Hugh Johnson
E-Mail : [EMAIL PROTECTED]
Home Page : http://www.orbis-terrarum.net/?l=people.robbat2
ICQ# : 30269588 or 41961639
GnuPG FP : 11AC BA4F 4778 E3F6 E4ED F38E B27B 944E 3488 4E85
pgptVgwr6oZwo.pgp
Description: PGP signature
