From ec1c3a6138f5ead4b41ebafdc780f0a515c6d597 Mon Sep 17 00:00:00 2001 From: Mix Date: Sat, 17 Oct 2026 22:41:25 +0300 Subject: [PATCH] docs: the 2026-10-17 security audit in security.md's history and the roadmap "After the plan" of docs/security-audit-2026-10-17.md: security.md's history paragraph names A2 and the seven mediums and what closed them; the roadmap gets the row security-audit-2026-10-17 (26 of 29 plan lines; stage H is the owner's host, S4 in progress) and two proposed rows the audit left as product choices: upstream-tls-verify (M7's optional "secure") and server-dmarc-hint (S3's product side). Co-Authored-By: Claude Opus 5.5 --- docs/roadmap.md | 3 +++ docs/security.md | 17 ++++++++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/docs/roadmap.md b/docs/roadmap.md index 4a35cb8..d87af3f 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -28,6 +28,9 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md). | ID | Topic | Status | Progress | Plan | |---|---|---|---|---| +| security-audit-2026-10-17 | Follow-ups of the 2026-10-17 security audit: A2 (high), seven mediums, the lows | stages 0-6 built 2026-10-17 for `2.14.4`; stage H (the host, S1-S3, S5) the owner's; S4 (rspamd 4.2) in progress | 26/29 | [security-audit-2026-10-17.md](security-audit-2026-10-17.md) | +| upstream-tls-verify | Inbound: offer "Verified" TLS to the upstream (Postfix `secure`, the upstream's name checked), beside Required, which checks no certificate (audit M7) | proposed | — | — | +| server-dmarc-hint | Server › Settings lists a DMARC record for the server's own name beside its DKIM and SPF (audit S3, product side) | proposed | — | — | | inbound-upstream-result | Inbound › Log shows what the upstream answered: sent, deferred, bounced, with its last reply | shipped `2.10.0` | 7/7 | [plans/inbound-upstream-result.md](plans/inbound-upstream-result.md) | | health-setup-checks | Server › Health also checks the certificate's name, Postfix's greeting and the trusted proxy (was preflight) | shipped `2.11.0` | — | — | | test-email | Send a test message from the panel (was preflight) | shipped `2.12.0` | — | — | diff --git a/docs/security.md b/docs/security.md index 0afe6c4..e24e2b7 100644 --- a/docs/security.md +++ b/docs/security.md @@ -64,7 +64,22 @@ notification (the server's name is kept in lower case for DKIM); only `From` was over-signed (now the shown headers too) - all fixed. `Sender:`, which the review found neither held nor signed (F1), is now both: signed, and held to the login like `From:` (the owner's decision, 2026-10-16). What the header -cap leaves is under Accepted risks. +cap leaves is under Accepted risks. The 2026-10-17 security audit +([security-audit-2026-10-17.md](security-audit-2026-10-17.md); four zone +readers, the live server, probes from outside) found no Critical. Its High, +A2: a stolen `global` session could set its own password on the user form +and so pass the backup's password check - the user form now asks for the +signed-in password to add a user or to change a password, an e-mail or a +role, and to delete one. Its seven Mediums: a stranger reserving a domain's +level-2 slots through `MAIL FROM` (M1, now the login's domain), a refused +recipient writing an Inbound log row in a stranger's words (M2, now +Postfix's own tail), one message as a thousand journal rows uncut (M3), a +custom DMARC address on the server's name opening an untagged mailbox (W1), +the TLS key readable by Postfix through group 10998 (I1, now group 10997), +a link the entrypoint could follow at the DMARC maps (I2), and every +visitor sharing one sign-in limit behind an untrusted proxy (A1) - all fixed +in `2.14.4`, with the lows the plan named; two reviews (Fable) of the fixes +found nothing above low, and their lows were fixed too. (2) **Accepted risks** — deliberate departures beyond the mandatory, recorded so the decision is not lost.