mix/selfpost
1
0
Fork 0
Code Issues Pull Requests Actions 8 Packages Projects Releases Wiki Activity

postfix: ETRN refused and not offered (audit S6)

Browse Source 
Security audit 2026-10-17, finding S6 (low), stage 0 - proven from
outside: `ETRN <an inbound domain>` on port 25 answered "250 Queuing
started". smtpd_etrn_restrictions was empty (Postfix allows every client)
and fast_flush_domains = $relay_domains, so a stranger could flush the
deferred queue toward an inbound domain's upstream at will. Now
smtpd_etrn_restrictions=reject (etrn_cmd -> smtpd_check_etrn -> reject_code
554, Postfix 3.10.13 src/smtpd/smtpd.c) and smtpd_discard_ehlo_keywords=etrn.

e2e: testInboundRelay sends EHLO + ETRN for the inbound domain on port 25
and expects 554 and no ETRN in the EHLO reply (etrnPort25);
checkPostfixHardening reads both settings back. To be run on the server.

Docs: architecture.md § Postfix; CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
mix
2026-10-17 21:36:55 +03:00
co-authored by Claude Opus 5.5
parent 5210cb19f2
commit 8820294472
7 changed files with 57 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security-audit-2026-10-17.md
+4 -2
View File
@@ -709,9 +709,11 @@ the argument.
- [x] **A4.** Duplicate-cookie line through `loggedPath`. — **Sonnet**, 0.25 h.
*Done 2026-10-17:* `loggedPath` moved to `auth.LoggedPath`, used by both
lines; TestDuplicateCookieLineHidesALinksToken.
- [ ] **S6.** `smtpd_etrn_restrictions = reject`, `smtpd_discard_ehlo_keywords
- [x] **S6.** `smtpd_etrn_restrictions = reject`, `smtpd_discard_ehlo_keywords
= etrn` in postfix-config.sh; architecture.md § Postfix one line. Done when
an e2e `ETRN` on 25 gets `554`. — **Opus**, 0.5 h.
an e2e `ETRN` on 25 gets `554`. — **Opus**, 0.5 h. *Done 2026-10-17:*
testInboundRelay sends ETRN for the inbound domain; checkPostfixHardening
reads both settings back.
- [ ] **X1.** SECURITY.md's table: `latest 2.x` supported, `1.x` not. —
**Sonnet**, 0.25 h.