diff options
| -rw-r--r-- | CHANGES.auth | 62 | ||||
| -rw-r--r-- | README.auth | 175 | ||||
| -rw-r--r-- | tools/makefile | 2 | ||||
| -rwxr-xr-x | tools/qmail-tls-check_certs | 84 |
4 files changed, 323 insertions, 0 deletions
diff --git a/CHANGES.auth b/CHANGES.auth new file mode 100644 index 0000000..80c8935 --- /dev/null +++ b/CHANGES.auth @@ -0,0 +1,62 @@ +0.20 +- initial release + +0.21 +- wrong condition in analysis of response. fixed +- unnecesary debug output freezed eudora. now it should work. + +0.22 +- added auth state support as described in rfc 2554. It prevents you +from authenticated again, when you are already authenticated. +- fixed few error codes to conform with rfc +- errors during authentication does not end the smtp connection anymore as +rfc requires. +- second cram-md5 authentication after failure of first resulted in wrong +challenge generation (in all subsequent authentications too) +- major bug in login implementation fixed (bug introduced in 0.21). it +should work again +- added a more clean netscape compatibility fix (documented in readme) + +0.23 +- added the new style (rfc recommended) greeting message. Yoo can select +beetwen them by #defining or #undefining USE_NEW_GREETING and +USE_OLD_GREETING on the begining of qmail-smtpd.c. You can even enable both +to maintain highest degree of compatibility with various clients. This fix +was suggested by David Harris <David.Harris@pmail.gen.nz>, the developer of +Pegasus Mail. + +0.24 +- cram-md5 fix. I wonder, how it ever worked for me. 1 week of my beta +tests. 3 months of tests on our mail server and the fundamental bug in +cram-md5 has been found so long after 0.23 release? Anyway it should work +now. + +0.25 +- changed the error message when problems with starting checkpassword +occour. This was a big source of question ("out of memory") that i receive +in my e-mail. +- Joerg Strohmayer <usenet@bigfoot.de> showed me light in the dark. I've +read the SMTP AUTH RFC and assumend that if it uses SASL'a PLAIN, it has to +be implemented exactly like SASL RFC says. Poor me... SMTP AUTH says that it +also has to be base64 encoded. This is the relief for the infamous +NETSCAPE_WORKAROUND. Again big thanks for Joerg for not only telling me +where the problem is but also for providing the fully working patch. + +0.26 +- security fix - if your checkpassword crashed, attacker would get the relay +permission. Now it should work. Reported by Javier Kohen <jkohen@tough.com>, +thank you! + +0.30 +- codebase switch. From now on have merged efforts with Eric M. Johnston +<emj@postal.net> so now there are no more 2 separate auth patches but +just one. +- arguments to qmail-smtpd have changed! See README.auth for further info. +- the code is djbized right now +- TCPREMOTEINFO is set if sender is properly authenticated. + +0.31 +- bug: AUTH PLAIN 334 response not RFC compliant. Reported by Mark Crispin + <mrc@CAC.Washington.EDU>. +- change: Set TCPREMOTEINFO environment variable to authenticated username. + (Previously only set locally to qmail-smtpd.) diff --git a/README.auth b/README.auth new file mode 100644 index 0000000..1e383aa --- /dev/null +++ b/README.auth @@ -0,0 +1,175 @@ +*** Warning! Cuidado! Vorsicht! *** +=================================== +*** Version 0.30 of the patch changes the arguments which must be +*** passed to qmail-smtpd. If you are upgrading from a previous +*** version of the patch, take care to ensure your invocation of +*** qmail-smtpd uses the correct arguments. Otherwise, your server +*** may run as an open relay! +=================================== +*** Warning! Cuidado! Vorsicht! *** + + +This patch adds ESMTP AUTH authentication protocol support to +qmail-1.03. It's originally based on Mrs. Brisby's smtp-auth patch +with many enhancements from Krzysztof Dabrowski <brush@elysium.pl>. + +Beginning with version 0.30, the patch was completely rewritten to +use only djb's string functions by Eric M. Johnston <emj@postal.net>. + +You can always get the newest version from: +http://members.elysium.pl/brush/qmail-smtpd-auth/ + +To use all of it's functionality you will also have to obtain and +install Krzysztof's cmd5checkpw utility available at: +http://members.elysium.pl/brush/cmd5checkpw/ + +If you need more information about SMTP-AUTH itself and the +client/server support and configuration, visit: +http://members.elysium.pl/brush/smtp-auth/ + +--- + +Detailed patch information: + +This patch adds the ESMTP AUTH option to qmail-1.03, allowing the +LOGIN, PLAIN, and CRAM-MD5 AUTH types. An appropriate checkpassword +tool is necessary to support the authentication. See +http://cr.yp.to/checkpwd.html for more information on the interface. +Note that the checkpassword tool should support all of the AUTH types +advertised by qmail-smtpd. + +As reflected in the modified qmail-smtpd(8) man page, qmail-smtpd +must be invoked with three arguments: hostname, checkprogram, and +subprogram. If these arguments are missing, qmail-smtpd will still +advertise availability of AUTH, but will fail with a permanent error +when AUTH is used. + +hostname is simply used to form the CRAM-MD5 challenge. qmail-smtpd +invokes checkprogram, feeding it the username and password, in the +case of LOGIN or PLAIN, or the username, challenge, and response, in +the case of CRAM-MD5. If the user is permitted, checkprogram invokes +subprogram, which just has to exit with a status of 0 for the user to +be authenticated. Otherwise, checkprogram exits with a non-zero +status. subprogram can usually be /usr/bin/true (or /bin/true, +depending on your flavor of OS). + +If the user is successfully authenticated, the RELAYCLIENT +environment variable is effectively set for the SMTP session, and +the TCPREMOTEINFO environment variable is set to the authenticated +username, overriding any value that tcpserver may have set. The +value of TCPREMOTEINFO is reflected in a Received header. + + +How to install it: + +Simply patch your qmail-1.03 distribution with the included patch +file and recompile & install like usual. + +The steps to do this are as follows (assuming your virgin +qmail-1.03 install is in "../qmail-1.03"): + + cp README.auth base64.c base64.h ../qmail-1.03 + patch -d ../qmail-1.03 < auth.patch + +Install qmail normally, with the exception of the new arguments +to qmail-smtpd described elsewhere in this file. + +Also obtain, unpack, compile and install the cmd5checkpw utility +(or some other checkpassword utility) and add a sample account to +/etc/poppasswd file. This file must be readable by the qmail-smtpd +user, usually qmaild. + + +How to use it: + +*** Warning: In version 0.30 the arguments have changed from +*** previous versions of qmail-smtpd-auth. Take care to make sure +*** you update your startup scripts if updating! + +If you're running qmail-smtpd from inetd, you'll want to do the +following: + +smtp stream tcp nowait qmaild /var/qmail/bin/tcp-env tcp-env \ +/var/qmail/bin/qmail-smtpd mail.acme.com /bin/cmd5checkpw /bin/true + +Replace mail.acme.com with your hostname. The second argument to +qmail-smtpd is your checkpassword utility (preferably cmd5checkpw +or some alternative that can handle CRAM-MD5). The third argument +is the executable that the checkpassword utility execs when +authentication is successful. (Note that the location of "true" +is OS dependent: you may need /usr/bin/true.) + +Invocations using tcpserver will require analagous changes. Give +your inetd a kill -HUP or restart tcpserver and away you go. + + +Caveats: + +Please note that as authentication needs vary wildly across +installations, no effort has been made to make this patch work ``out +of the box.'' You'll have to procure or develop your own +checkpassword program. Also note that CRAM-MD5 will require you to +keep plaintext passwords. You'll probably want to disable this AUTH +type if you're just using /etc/passwd (keeping in mind that PLAIN and +LOGIN aren't quite as safe over the wire) -- just undefine AUTHCRAM +in qmail-smtpd. + +Krzysztof Dabrowski's cmd5checkpw tool used as an example in this +document supports the three AUTH types included in this patch. +It's available at http://www.elysium.pl/members/brush/cmd5checkpw/. + +This patch has been generated against the stock qmail 1.03 +distribution. The results of combining this patch with others are +unknown. + + +Features: + +This patch supports the following auth methods: LOGIN, PLAIN and +CRAM-MD5. + + +Compatibility: + +The following MUA's are confirmed to work with this patch: + +Eudora 4.2.2 - CRAM-MD5 +Eudora 5.0.2 - CRAM-MD5 +The Bat 1.39 - LOGIN & CRAM-MD5 +Outlook Express 4 - LOGIN +Outlook Express 5 - LOGIN +Outlook 2000 - LOGIN +Netscape 4.x - LOGIN & PLAIN +Netscape 4.0x - LOGIN +Pegasus Mail 3.1x - CRAM-MD5 + + +Various compatibility issues: + +Testing with Pegasus Mail 3.1 revealed that it requires the new style +(RFC recommended) greeting message. Both styles are now enabled to +maintain the highest degree of compatibility with various clients. +This fix was suggested by David Harris <David.Harris@pmail.gen.nz>, +the developer of Pegasus Mail. + + +Acknowledgments: + +This patch is based on work by Krzysztof Dabrowski at +http://members.elysium.pl/brush/qmail-smtpd-auth/ and ``Mrs. Brisby'' +at http://www.nimh.org/hacks/qmail-smtpd.c which has been further +developed by Eric M. Johnston <emj@postal.net>. + +--- + +THIS SOFTWARE IS IN THE PUBLIC DOMAIN, IS PROVIDED BY THE AUTHOR +``AS IS,'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE +LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, +EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/tools/makefile b/tools/makefile index f64b9c2..005b408 100644 --- a/tools/makefile +++ b/tools/makefile @@ -23,6 +23,8 @@ install: chmod u+s /var/qmail/rbin/checkpassword cp smtp.conf /etc/stunnel/ cp pop3.conf /etc/stunnel/ + chmod 640 /var/qmail/control/*.crtkey + chown qmaild /var/qmail/control/*.crtkey /etc/tcpserver/smtp.rules : install -d /etc/tcpserver diff --git a/tools/qmail-tls-check_certs b/tools/qmail-tls-check_certs new file mode 100755 index 0000000..d8f97de --- /dev/null +++ b/tools/qmail-tls-check_certs @@ -0,0 +1,84 @@ +#!/bin/sh +# +# Author: Jason Haar <jhaar@users.sourceforge.net> +# Date: 09-Nov-2004 +# Version: 1.0 +# Copyright: GPL +# +# This script simply checks the status of the certificates used by +# Qmail with Frederik Vermeulen's TLS patch - to ensure they are +# valid, non-expired certs with the appropriate KeyUsage extensions +# required to get their jobs done. +# This script can be run on a nightly basis to check the cert status. +# Note that when it marked as cert as "bad" (typically because it's +# expired), it will be renamed, a syslog event generated, and probably +# Qmail will STOP WORKING FOR NEW TLS SESSIONS. +# +# That may sound bad, but the alternative is that Qmail will stop working +# for new TLS sessions *anyway* - it's just that this script will tell +# you why... + +LOGGER="logger -i -t qmail-tls-check_certs" + +dir='' +dirlist="/etc/qmail/control /var/qmail/control" +for trydir in $dirlist ; do + if test -d $trydir ; then + dir=$trydir + break + fi +done +if test -z "$dir" ; then + 1>&2 echo "Cannot find any control director ($dirlist)" + exit 1 +fi + +for cert in servercert.pem clientcert.pem ; do + if ! test -f "$dir/$cert"; then + echo "Certificate missing: $dir/$cert" + else + #First, check that it's a valid cert for the task + TEMP_PURPOSE=`openssl x509 -in $dir/$cert -noout -purpose 2>/dev/null` + if [ "$?" != "0" ]; then + echo "$dir/$cert is a broken cert. Disabled" + mv -f $dir/$cert $dir/BROKEN-${cert} + $LOGGER "$dir/$cert is a broken cert. Disabled" + continue + fi + + #Now check it hasn't expired + TEMP_DATE=$( openssl x509 -in $dir/$cert -noout -dates 2>/dev/null | \ + grep -i after|cut -d= -f2 ) + EXPIRE_IN_SECS=`date +%s --date $TEMP_DATE 2>/dev/null` + if [ "`echo $EXPIRE_IN_SECS|egrep '^[0-9]+$'`" != "" ]; then + NOW_IN_SECS=`date +%s 2>/dev/null` + if [ "`echo $NOW_IN_SECS|egrep '^[0-9]+$'`" != "" ]; then + if [ $NOW_IN_SECS -gt $EXPIRE_IN_SECS ]; then + echo "$dir/$cert has EXPIRED. Disabling" + mv -f $dir/$cert $dir/EXPIRED-${cert} + $LOGGER "$dir/$cert has EXPIRED. Disabling" + continue + fi + fi + fi + + if [ "`echo $cert|grep server`" != "" ] ; then + if [ "_$( echo $TEMP_PURPOSE | \ + egrep -i '(any purpose|server).* yes' )" = "_" ]; then + echo "$dir/$cert is NOT a server cert. Disabled" + mv -f $dir/$cert $dir/NOT-A-SERVER-CERT-${cert} + $LOGGER "$dir/$cert is NOT a server cert. Disabled" + continue + fi + fi + if [ "`echo $cert|grep client`" != "" ] ; then + if [ "_$( echo $TEMP_PURPOSE | + egrep -i '(any purpose|client).* yes' )" = "_" ]; then + echo "$dir/$cert is NOT a client cert. Disabled" + mv -f $dir/$cert $dir/NOT-A-CLIENT-CERT-${cert} + $LOGGER "$dir/$cert is NOT a client cert. Disabled" + fi + fi + fi + +done |