Dovecot audit complete

https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#dovecot

by richardboegli • 10 years ago

303 80 10 years ago

wiki.mozilla.org

saycheese2• 10 years ago

Anyone know how much MOSS Secure Open Source (SOS) budgets a year for audits and how they select a vendor to do an audit?

EDIT - Answer to the budget appears to be $500k to start: https://blog.mozilla.org/blog/2016/06/09/help-make-open-sour...

Osmose• 10 years ago

https://www.mozilla.org/en-US/moss/ says the yearly budget is about $3 million.

citruspi• 10 years ago

Mozilla Open Source Support (MOSS) is Mozilla’s program for supporting the Open Source and Free Software movement, with a yearly budget of around $3 million.

That's the yearly budget for the whole Open Source Support program.

The Secure Open Source "pillar" which saycheese was asking about is just one of three (the other two being Foundational Technology and Missing Partners) which presumably split that $3 MM.

nl2• 10 years ago

The libjpeg-turbo medium exploits are (as they said) interesting:

However, more interesting were the two medium vulnerabilities, which were initially reported as DoS bugs in the libjpeg-turbo library but on further investigation were found to be issues with the JPEG standard itself. These issues were reproduced across multiple JPEG implementations, can be triggered by entirely legal JPEGs, and so are not easy to mitigate in any JPEG library itself.

makomk• 10 years ago

Those are probably fairly common in image compression standards - designers of image compression are not, in general, going to make their compression less efficient than it has to be. JPEG2000 in particular is likely to be far worse.

gcp2• 10 years ago

Not at all. Decode performance is generally a very important consideration, as it has to go in all kinds of devices. Unbounded decoding time would be terrible (it would "lock up" embedded devices), and it's almost certainly an oversight.

You probably have encoding performance in mind, where there's much more liberty to make things very heavy.

nl2• 10 years ago

No, the opposite is true. Fast decompression is usually either the first or second priority for images.

tln• 10 years ago

That's a fantastic endorsement for Dovecot. It's interesting that security is not highlighted on the homepage[0], just mentioned in passing. Also interesting is the "special C variant that makes it much more difficult to write security holes"[1]

[0] https://www.dovecot.org [1]: https://www.dovecot.org/security.html

rubyn00bie• 10 years ago

I was curious about what this special variant entailed and it looks to be some sensible guidelines/practices:

https://github.com/dovecot/core/blob/master/doc/securecoding...

rtpg2• 10 years ago

Don't rely on input validation. Maybe you missed something. Maybe someone calls your function somewhere else where you didn't originally intend it. Maybe someone makes the input validation less restrictive for some reason. Point is, it's not an excuse to cause a security hole just because input wasn't what you expected it to be.

This point makes me mad because we have both ways to statically verify that calling conditions are "correct" through the right kind of design, and it should be a zero-cost abstraction but you can't do it in C.

Plus this advice is messy when it comes to things like string escaping. This could easily lead to issues like double encoding. Issues that don't exist if you could set up "proper" type checking in C without having to use things like wrapper structs that incur performance penalties.

Defensive programming is always a bit weird because it always feels un-necessary, but in C it's really necessary because you have so few assurances. Pretty scary

I wonder if there's a tool out there that lets you use Rust-style linear types over C code, and other things that would make some of this advice redundant (because the CI server would check the code). You could still write C, but wrong C would error in the checking step.

duneroadrunner• 10 years ago

it looks to be some sensible guidelines/practices

But more notably I think, a whole bunch of custom functions and data types to be used in place of more typical C coding practices. The document references a number of (presumably custom) header files (lib/buffer.h, lib/str.h, lib/strfuncs.h, lib/array.h, lib/data-stack.h, lib/mempool.h), the Boehm GC, and use of "GCC Extensions".

Also, there seems to be one person contributing an overwhelming proportion of commits (just going by the "contributors" page). Hmm, this seems to be an example of largely a single person implementing a program in C with a priority on code safety. Impressively successfully. But with substantial effort and individual discipline employed to avoid the pitfalls of C.

I'm not sure how scalable/transferable this kind of approach is. Perhaps the takeaway here is

i) This is an impressive (mostly) individual achievement.

ii) Dovecot may have some useful libraries for improving code safety if you're forced to or are committed to using C.

iii) The effort and discipline required to achieve code safety in C in this case, might also be interpreted as a validation of the effort and time required to achieve code safety by adopting newer alternatives like Rust and SaferCPlusPlus[1] when those choices are available.

[1] shameless plug: https://github.com/duneroadrunner/SaferCPlusPlus

inopinatus• 10 years ago

If you hack on the source (as I have for both fun and profit) then the secure coding style and defensive internal infrastructure quickly become obvious and natural to work with.

It's a great product, inside & out.

sandGorgon• 10 years ago

is this is a good usecase for building this in Rust instead ?

vetinari• 10 years ago

There's currently going a discussion, whether Rust is ready yet for such a project. See http://esr.ibiblio.org/?p=7303

jabl• 10 years ago

One could argue that in 2017 software that is safety-critical and/or handles potentially untrusted input should be written in memory-safe languages. Rust is one such choice, but there are certainly other valid choices too.

But, given that dovecot just got a glowing security audit, perhaps there are other software projects that should be prioritized higher in the "rewrite everything in rust" list..

sidlls• 10 years ago

No.

On the one hand, the audit is a bit of a counter to "writing C is the same as writing unsafe code". On the other hand, there are a number of potential efficiency (as in, time-to-develop, maintenance effort required) gains for using a language, such as Rust, which provides the abstractions used in the C code out of the box and "for free" (in terms of implementation time--not necessarily execution performance). For a mature and stable project, especially one that has already built-in the effort to set up and maintain the appropriate abstractions, the effort to re-write is probably not worth it.

"Rewrite all the things in Rust" is asinine in general, but in this particular case it's especially bad. It would be much better to focus on C and C++ projects with actual problems.

diggan• 10 years ago

I think including security in the first paragraph you read can be called a highlight.

First sentence: "Dovecot is an open source IMAP and POP3 email server for Linux/UNIX-like systems, written with security primarily in mind"

gkya• 10 years ago

It actually says "secure imap server" besides the logo in the page header too.

wonko1• 10 years ago

That's really interesting. I've been considering moving back to my own mail server from gmail for a long time but have been worried about the security issues.

This is one more thing pushing me in that direction.

hippich• 10 years ago

you might be interested in https://github.com/sovereign/sovereign

reitanqild• 10 years ago

That seems to be a great repo, both as a starting point for self hosting and as a starting point for learning ansible!

tlrobinson• 10 years ago

Installing 10 other services doesn't seem like a good way to run a secure mail server.

chrismartin3• 10 years ago

I've been hosting my personal email on a $5/month DigitalOcean server, running Postfix + Dovecot, for almost two years. I think it's reasonably secure. I run updates regularly and trust the distro maintainers to release timely fixes for new vulns. Aside from that, I mostly ignore it because it works. I should probably look at the logs, but eh.

After the typical host hardening stuff (which isn't much work with modern OS defaults), I have configured SPF, DKIM, DMARC policy, opportunistic TLS for server-to-server, and mandatory TLS for IMAP client connections.

From a data privacy perspective, I know that nobody is mining the contents of my mailbox (except the messages I send to Gmail, etc. users!), and my server is not a high-value target for compromise. (Yes, DigitalOcean could snoop on my non-GPG-encrypted messages if they wanted. I guess I could migrate the server back to my own hardware.) I also encourage friends to use GPG, though this is orthogonal to one's choice of email host.

For clients I use Thunderbird on desktop and K-9 Mail on Android. Mobile push via IMAP IDLE works out of the box. (I also run a CalDAV/CardDAV server to sync contacts/calendar/todo across devices, but that is technically separate.)

Overall I'm really happy with the arrangement. The only annoyance was having my messages to Gmail users consistently marked as spam, but after doing everything suggested by mail-tester.com, I think I'm making it through most of the time.

Karlozkiller• 10 years ago

Thank you for that post. I've been trying some time ago, mostly for fun, to set up an email server. I did get one up and running with a setup similar to what you describe but was spam-filtered by Gmail as you describe. And because of this I kind of gave up.

But now I might try it again some time.

JupiterMoon2• 10 years ago

What CalDAV/CardDAV server do you run?

vbezhenar• 10 years ago

Inability to reliably send messages to gmail is huge. I'm using my own server, I own my domain for years, I asked a lot of people to remove "Spam" label from my messages, I did everything (reverse DNS, DKIM, SPF, checked that Gmail likes it all) I could, yet for new recipients gmail might mark my e-mail as spam. Gmail is worse e-mail provider, I liked it before, but I really don't like it, because it seems to punish people for decentralization. And I don't have this problem with other e-mail providers that I checked, they are happy to receive my e-mails.

insertnickname• 10 years ago

Did you register with https://www.dnswl.org/? That should help with deliverability (in general, don't know about Gmail).

a3n• 10 years ago

I run dovecot on my laptop, for a few years now, for local email storage. I usually move my messages down from fastmail once or twice a year.

I just recently set it up to use TLS on port 993. It was easy to do.

hannob• 10 years ago

I run my own mail server, I can tell you this: Buffer overflows and format string vulns in your imap implementation will be the least of your worries.

It is certainly still valuable work to audit the software used for the mailserver. But the challenges lie elsewhere. The biggest chunks are configuration issues and - if you have users that aren't very security savvy - stolen passwords and subsequent abuse of mail accounts for spam.

noinsight• 10 years ago

configuration issues

This is where having a mail server with a sane configuration file comes handy. OpenSMTPd is simply awesome in that regard. Plus, it too was recently audited and vulnerabilities fixed so it should be secure.

OpenSMTPd + Dovecot makes for an awesome combination for a mail server.

frederikvs• 10 years ago

Makes one wonder how they achieved this. I can find a passing mention of a "special C variant that makes it much more difficult to write security holes"[0], but no more details on whether they enforce this (and how), nor on other techniques to improve security.

Do they have a rules checker? Are they running static analysis? Which security-related compiler flags are they enabling? Other tools they use to achieve this? Or is it just a lead developer who really groks C and security, and who reviews all PRs?

It'd be interesting to see what that other projects can learn here to improve security...

[0] https://www.dovecot.org/security.html

gcp2• 10 years ago

Much like djb's code it's forcing the most error prone parts (string handling, memory) to go through a library, or simply forbidding the error prone constructs entirely (static buffers).

jwilk• 10 years ago

This title badly needs a (semi)colon before "auditor".

richardboegli2• 10 years ago

I hit the 80 char limit :( It was a struggle to get everything in there. Was going to use DONE instead of complete, but that didn't read right.

wodenokoto2• 10 years ago

You can drop the "by" and have

Mozilla sponsored Dovecot audit complete; auditor Cure53 “extremely impressed”

corv2• 10 years ago

What is a good smtp server to go with it in terms of security and reliability?

atmosx• 10 years ago

The most secure in absolute terms is qmail[1] but I found OpenSMTPd[2] to be a joy to work with, something that can not be said for any other SMTPd system I worked over the years (postfix, sendmail horror, exim, qmail and OpenSMTPd). OpenSMTPd seems to be fairly secure[3].

[1] http://www.qmail.org/top.html

[2] https://www.opensmtpd.org/

[3] https://www.opensmtpd.org/security.html

corv2• 10 years ago

Thanks

xorcist• 10 years ago

Use postfix. It's (one of the, it not the) most common, and it's got a security secord to rival dovecot (the author is competent and cares). It integrates with everything under the sun for filtering. There's good documentation in the form of bundled text files.

Don't use qmail unless you really want to, as you need to patch it up a lot in any modern setting. And don't use sendmail if postfix will suffice. Exif will also do the job but there's really nothing it does better than the others.

kakarot• 10 years ago

Could anyone here point me in a good direction for hosting my own mail server? Is Dovecot a good solution? I can figure out a hosting solution but I would like to know about best practices for implementation and security. Thanks in advance ~

jamespo• 10 years ago

Dovecot + postfix are a good combination. Getting whitelisted by major mail providers could be more of an issue.

throwanem3• 10 years ago

If you're on DO or Linode or similar, you start with a new VPS and check the IP it's assigned in all the RBLs and spam blacklists. (Google "multi rbl check", there's a bunch.) If it's on any of them, tear down the VPS and stand up a fresh one, and repeat until you get a clean IP. Then keep it that way by not running an open relay.

Beyond that, the main deliverability improvements, in approximate order of value, are: PTR record with the hostname you send mail from; DKIM; SPF; DMARC.

My mail server runs all of these, and I've yet to encounter trouble sending to anyone, including Gmail, which is often mentioned in threads like these as being a special issue. Admittedly I've been running mail from that IP since 2004, so have a long history of not being a spammer, but as long as you start out with a clean IP and keep it so, and make sure all your sender legitimacy boxes are properly checked, I don't see any reason why you should have undue difficulty.

problems• 10 years ago

If you follow the basic steps of checking RBLs, using SPF and DKIM, you usually can do decent. I still have the occasional issue with hotmail/outlook/live mail though.

Another option if you just don't want to deal with it, but do want to run your own mail server is to use something like MailGun which can act as an SMTP relay and will be approved by those webmail providers out of the box.

skosch• 10 years ago

Check out mailinabox – been using that for years now and it's fabulously hassle-free.

flowless• 10 years ago

We're building a set of Ansible roles for self-hosting services with a complete mailserver based on dovecot and postfix. See https://wiki.base48.cz/Nestihacky and https://github.com/nestihacky/ansible-role-mailserver for more details. Originally inspired by https://github.com/sovereign/sovereign/ but with focus on Centos/Fedora (due to SELinux) and re-usability (separate Ansible roles).

lolc• 10 years ago

Wow, congrats. Good engineering. I remember Dovecot for being the easy option back when I ran my own mailserver.

Dovecot audit complete

Related Stories