You are viewing a plain text version of this content. The canonical link for it is here.
Posted to server-dev@james.apache.org by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org> on 2009/02/12 21:48:59 UTC
[jira] Created: (JAMES-886) Security Services
Security Services
-----------------
Key: JAMES-886
URL: https://issues.apache.org/jira/browse/JAMES-886
Project: JAMES Server
Issue Type: Wish
Affects Versions: Trunk
Reporter: Robert Burrell Donkin
Assignee: Robert Burrell Donkin
Fix For: Trunk
JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673575#action_12673575 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
Use Case Seventeen: Command Availability Before Authentication
Example: When an unauthenticated connection sends a command which is not supported in this state, drop the connection
Example: When an unauthenticated connection sends a command which is not supported in this state, drop the connection and blacklist the IP for 5 minutes
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673576#action_12673576 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
>From Stefano (http://markmail.org/message/ijvl4qpreyvhfbnn)
In SMTP, AUTH and STARTTLS are 2 ESMTP extensions.
If you don't want AUTH to be used without TLS then the SMTP server
should not reply AUTH to the first EHLO command, but only STARTTLS and
then, when the STARTTLS is issued and a new EHLO is sent from the client
then the server will reply that it supports AUTH.
This is how it works if I remember correctly. I don't know if this is
similar or share anything with IMAP.
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673342#action_12673342 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
Use Case Five: Grace Periods
Example: After 5 minutes, any connection which has not authenticated will be closed
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Issue Comment Edited: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673480#action_12673480 ]
robertburrelldonkin edited comment on JAMES-886 at 2/14/09 12:26 AM:
-----------------------------------------------------------------------
Use Case Nine: TLS Connection Limiting
Example: Setting "start:rate:full" to "10:30:60" will refuse 30% of un-certificated connections once 10 are connected, until 60 are connected when all connections will be refused
was (Author: robertburrelldonkin):
Use Case Nine: TLS Load Balancing
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673483#action_12673483 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
Use Case Eleven: Authentication Options
Example: Offer plain text authentication only when TLS is used
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673050#action_12673050 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
Use Case Two - Dynamic User Blacklisting
Example: When a user fails to authenticate 5 times, blacklist the user
* until an adminstrator clears the block
* for five minutes
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673589#action_12673589 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
Use Case Eighteen: Statistical Monitoring
Example: When a connection tries to authenticate as an unknown user, increment counter
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673048#action_12673048 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
Use Case One - Static IP Whitelisting and Blocklisting ala TCPWrappers
Example: allow connections from 192.168.17.xxx but deny from 192.168.17.99
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673344#action_12673344 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
Use Case Six: Connection Limiting
Example: Setting "start:rate:full" to "10:30:60" will refuse 30% of connections once 10 are connected, until 60 are connected when all
connections will be refused
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673572#action_12673572 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
Use Case Thirteen: Password Guessing
Example: Drop any connetion that fails to authenticate three times
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673480#action_12673480 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
Use Case Nine: TLS Load Balancing
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673341#action_12673341 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
As pointed out by Stefano, these services are more useful for small scale instances (personal or small business servers) than for large scale industrial installations.
A key advantage of a central service would be the possibility of creating a central administration console which could be shared by multiple protocols.
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673487#action_12673487 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
Use Case Twelve: TLS White And Blacklisting
Example: Drop any connection whose subject matches C=US
Example: Drop any connection whose subject does not match C=US
Example: Drop any connection whose issuer matches C=US
Example: Drop any connection whose issuer does not match C=US
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673051#action_12673051 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
Use Case Three - Dynamic IP Blacklisting
Example: When an IP tries to authenticate as an unknown user, block the address for 1 hour
Example: When an IP fails to authenticate as a user 5 times, block the address for 1 hour
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Guillermo Grandes (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673370#action_12673370 ]
Guillermo Grandes commented on JAMES-886:
-----------------------------------------
Use Case Seven: IP rewrite
Example: Client in Internet (198.246.1.1) -> LoadBalancer in Frontend (80.38.9.18 / 10.1.1.1) -> James in Backend (10.1.1.2 / 10.1.1.3), the LB send command: "CLIENTIP: 198.246.1.1", in the logs the IP will show: 198.246.1.1 instead of 10.1.1.1, and AccessList will be good filtered by Security/Relay Filters.
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673574#action_12673574 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
Use Case Fifteen: Monitoring Violations
Example: When any connection fails to authenticate 20 times, post a mail to the spool
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673571#action_12673571 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
On StartTLS:
Generally, the right way to do StartTLS is to offer a separate set of commands before and after TLS negotiation. Take IMAP, for example (setting aside the issues associated with support of RFC2060 clients). before TLS is established, CAPABILITY should advertise only a limited number of commands including CAPABILITY and STARTTLS. Once TLS has been established, CAPABILITY should advertise a full set. So, correct StartTLS support requires work at the protocol level in conjunction with the handler and socket frameworks.
This issue is more about hardening an installation. It covers configuring and controlling the appropriate general behaviour when potential security issues occur. Protocols are going to need to be changed to add correct StartTLS support and then hook into appropriate points in the general security framework. But I think it would be better to attempt to use a common set of security services than to duplicate code.
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Re: [jira] Commented: (JAMES-886) Security Services
Posted by Robert Burrell Donkin <ro...@gmail.com>.
On Thu, Feb 12, 2009 at 9:12 PM, Stefano Bagnara <ap...@bago.org> wrote:
> Robert Burrell Donkin (JIRA) ha scritto:
>> [ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673053#action_12673053 ]
>>
>> Robert Burrell Donkin commented on JAMES-886:
>> ---------------------------------------------
>>
>> Use Case Four - Load Blacklisting
>>
>> Example: When the number of concurrent connection from one IP exceeds 50, block new connections from that IP for 10 minutes
>
> Unfortunately I've found botnets are the real issues with mail servers
> load. You get thousands of connections coming from thousands different
> IPs... they use different senders, different recipients.
>
> Fastfail would be much more effective in fighting DoS that this
> proposal, IMHO.
i agree that this is mostly not very useful for a large scale,
industrial strength installation but i don't see this as an either-or
situation
i'm thinking about more modest installations where a DoS of the scale
you see would almost certainly blast the incoming pipe. an infected PC
on a relatively local network making a nuisance of itself against a
modest server is the sort of thing i was thinking about.
- robert
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Re: [jira] Commented: (JAMES-886) Security Services
Posted by Stefano Bagnara <ap...@bago.org>.
Robert Burrell Donkin (JIRA) ha scritto:
> [ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673053#action_12673053 ]
>
> Robert Burrell Donkin commented on JAMES-886:
> ---------------------------------------------
>
> Use Case Four - Load Blacklisting
>
> Example: When the number of concurrent connection from one IP exceeds 50, block new connections from that IP for 10 minutes
Unfortunately I've found botnets are the real issues with mail servers
load. You get thousands of connections coming from thousands different
IPs... they use different senders, different recipients.
Fastfail would be much more effective in fighting DoS that this
proposal, IMHO.
Stefano
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673053#action_12673053 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
Use Case Four - Load Blacklisting
Example: When the number of concurrent connection from one IP exceeds 50, block new connections from that IP for 10 minutes
Example: When the number of unauthenticated concurrent connection from one IP exceeds 10, close all connections and block for 5 minutes
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Re: [jira] Commented: (JAMES-886) Security Services
Posted by Robert Burrell Donkin <ro...@gmail.com>.
On Sat, Feb 14, 2009 at 6:52 PM, Stefano Bagnara <ap...@bago.org> wrote:
> Robert Burrell Donkin ha scritto:
>> On Sat, Feb 14, 2009 at 2:14 PM, Stefano Bagnara <ap...@bago.org> wrote:
>>> Robert Burrell Donkin (JIRA) ha scritto:
>>>> [ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673481#action_12673481 ]
>>>>
>>>> Robert Burrell Donkin commented on JAMES-886:
>>>> ---------------------------------------------
>>>>
>>>> Use Case Ten: Start TLS
>>>>
>>>> Example: Drop any connection which authenticates before StartTLS
>>> Shouldn't this be a protocol behaviour? This belongs to fastfail stuff.
>>
>> a protocol behaviour, yes
>>
>> but StartTLS spans a number of protocols so we'll need to be able to
>> reuse some of the functionality required to implement this behaviour
>
>
> One more thing.
>
> In SMTP, AUTH and STARTTLS are 2 ESMTP extensions.
> If you don't want AUTH to be used without TLS then the SMTP server
> should not reply AUTH to the first EHLO command, but only STARTTLS and
> then, when the STARTTLS is issued and a new EHLO is sent from the client
> then the server will reply that it supports AUTH.
>
> This is how it works if I remember correctly. I don't know if this is
> similar or share anything with IMAP.
good point
i think all the mail protocols generally work by restricting the
commands available before and after StartTLS.
however, StartTLS has issues :-/ (especially for IMAP where it was
only included for political reasons) and is now considered vulnerable
to some classes of MoM attack. many of the security ideas attached to
this issue go beyond the RFCs. i plan to start running a hardened
personal version of James this year. i've correlated a number of these
with other hardened apps (eg secure postfix and sshd) but one of the
reasons why i wanted to start by just brainstorming was that we'd be
able to think about issues before implementation and do some review
before even thinking about implementation.
- robert
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Re: [jira] Commented: (JAMES-886) Security Services
Posted by Stefano Bagnara <ap...@bago.org>.
Robert Burrell Donkin ha scritto:
> On Sat, Feb 14, 2009 at 2:14 PM, Stefano Bagnara <ap...@bago.org> wrote:
>> Robert Burrell Donkin (JIRA) ha scritto:
>>> [ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673481#action_12673481 ]
>>>
>>> Robert Burrell Donkin commented on JAMES-886:
>>> ---------------------------------------------
>>>
>>> Use Case Ten: Start TLS
>>>
>>> Example: Drop any connection which authenticates before StartTLS
>> Shouldn't this be a protocol behaviour? This belongs to fastfail stuff.
>
> a protocol behaviour, yes
>
> but StartTLS spans a number of protocols so we'll need to be able to
> reuse some of the functionality required to implement this behaviour
One more thing.
In SMTP, AUTH and STARTTLS are 2 ESMTP extensions.
If you don't want AUTH to be used without TLS then the SMTP server
should not reply AUTH to the first EHLO command, but only STARTTLS and
then, when the STARTTLS is issued and a new EHLO is sent from the client
then the server will reply that it supports AUTH.
This is how it works if I remember correctly. I don't know if this is
similar or share anything with IMAP.
Stefano
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Re: [jira] Commented: (JAMES-886) Security Services
Posted by Robert Burrell Donkin <ro...@gmail.com>.
On Sat, Feb 14, 2009 at 2:14 PM, Stefano Bagnara <ap...@bago.org> wrote:
> Robert Burrell Donkin (JIRA) ha scritto:
>> [ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673481#action_12673481 ]
>>
>> Robert Burrell Donkin commented on JAMES-886:
>> ---------------------------------------------
>>
>> Use Case Ten: Start TLS
>>
>> Example: Drop any connection which authenticates before StartTLS
>
> Shouldn't this be a protocol behaviour? This belongs to fastfail stuff.
a protocol behaviour, yes
but StartTLS spans a number of protocols so we'll need to be able to
reuse some of the functionality required to implement this behaviour
> This is not a generic socket behaviour... JAMES-886 is too much generic
> if it includes both generic socket stuff and SMTP/IMAP protocol stuff, IMHO.
i'm just trying to build up a use case shopping list ATM, thinking
mainly about small scale installations (sometimes knows as private
mail servers in the RFCs)
i think that a common approach to configuration and a framework to
allow protocols to access common functions would be useful but i'm not
really proposing any particular implementation idea ATM.
perhaps you see some of these use cases fitting into fail fast which
is fine but i don't have a deep understanding of what 'fail fast'
means in this context, so i can't see the ttradeoff that you do
- robert
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Re: [jira] Commented: (JAMES-886) Security Services
Posted by Stefano Bagnara <ap...@bago.org>.
Robert Burrell Donkin (JIRA) ha scritto:
> [ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673481#action_12673481 ]
>
> Robert Burrell Donkin commented on JAMES-886:
> ---------------------------------------------
>
> Use Case Ten: Start TLS
>
> Example: Drop any connection which authenticates before StartTLS
Shouldn't this be a protocol behaviour? This belongs to fastfail stuff.
This is not a generic socket behaviour... JAMES-886 is too much generic
if it includes both generic socket stuff and SMTP/IMAP protocol stuff, IMHO.
Stefano
>> Security Services
>> -----------------
>>
>> Key: JAMES-886
>> URL: https://issues.apache.org/jira/browse/JAMES-886
>> Project: JAMES Server
>> Issue Type: Wish
>> Affects Versions: Trunk
>> Reporter: Robert Burrell Donkin
>> Assignee: Robert Burrell Donkin
>> Fix For: Trunk
>>
>>
>> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
>
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673481#action_12673481 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
Use Case Ten: Start TLS
Example: Drop any connection which authenticates before StartTLS
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673573#action_12673573 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
Use Case Fourteen: StartTLS Negotiation
Example: Drop any connection which attempts to send plain text commands during StartTLS negotiation
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
[jira] Commented: (JAMES-886) Security Services
Posted by "Robert Burrell Donkin (JIRA)" <se...@james.apache.org>.
[ https://issues.apache.org/jira/browse/JAMES-886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12673479#action_12673479 ]
Robert Burrell Donkin commented on JAMES-886:
---------------------------------------------
Use Case Eight: TLS
Example: Drop any connections which do not use a valid clientside certificate
Example: Drop any connections which do not use a trusted clientside certificate
Example: Drop any connection where the user authenticated does not match the user inferred from the clientside certificate
> Security Services
> -----------------
>
> Key: JAMES-886
> URL: https://issues.apache.org/jira/browse/JAMES-886
> Project: JAMES Server
> Issue Type: Wish
> Affects Versions: Trunk
> Reporter: Robert Burrell Donkin
> Assignee: Robert Burrell Donkin
> Fix For: Trunk
>
>
> JAMES has core support for authentication and authorization, used by the protocols. Central support for additional security could be improved.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org