mixandClaude Opus 5.5
2cfd239d16
test / test (push) Canceled after 0s
architecture § OpenDKIM becomes § DKIM signing (keys, the selector table and when it is rewritten, the two sockets, what is signed and the limits, the old tree); the process table, start order, liveness, the mail-path diagram, § Sender check, Persistence and the restore Resync follow the code. security.md: the panel signs with the login's key, the keys are the panel's alone, group selfpost and CAP_KILL as they are now; OpenDKIM's accepted risks go; new ones: what sendmail(1) submits is signed as the server, Sender: is signed but not judged (the owner's decision), and go-milter keeps every header per session, so the signer's 1 MiB refusal does not bound the library's copy. guide: Health, the container log's dkim-signer lines, backups, the long-line limit, and upgrading to 2.8.0 - with the rollback to 2.7.x: its start reads the queue as its own postfix (uid 101) before it hands the queue over, so the hand-over by name is run in the 2.7.x image first (measured on a copy of the test server's queue: postsuper failed before, passed after). development, README, SECURITY, product, the assumptions register's header: what left the image. entrypoint.sh: a comment, the rollback note as the guide gives it. Plan stage 3 lines ticked, roadmap 12/14. Written by four agents, one document each, against a brief of what the code does; reviewed here. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
83 lines
3.6 KiB
Markdown
83 lines
3.6 KiB
Markdown
# Security policy
|
|
|
|
## Supported versions
|
|
|
|
SelfPost follows SemVer. Fixes are issued for the **latest minor release of the
|
|
1.x line** only; there is no backporting to earlier minors. Upgrade before
|
|
reporting if you are behind — the image tag is `ghcr.io/mixeme/selfpost:X.Y.Z`.
|
|
|
|
| Version | Supported |
|
|
|---|---|
|
|
| latest 1.x | yes |
|
|
| earlier 1.x | no — upgrade first |
|
|
| 0.x | no (pre-release) |
|
|
|
|
## Reporting a vulnerability
|
|
|
|
**Do not open a public issue.** Use GitHub's private vulnerability reporting:
|
|
the *Report a vulnerability* button under the repository's
|
|
[Security tab](https://github.com/mixeme/selfpost/security). If you cannot use
|
|
it, mail `public@mixeme.ru` instead.
|
|
|
|
Useful in a report: the image tag, the reverse proxy in front of the panel, the
|
|
steps to reproduce, and what an attacker gains. A relevant excerpt of
|
|
`mail.log` or the panel's system log helps; strip recipient addresses first.
|
|
|
|
**No response time is promised.** SelfPost is maintained by one person, and a
|
|
deadline that cannot be honoured is worse than none. Reports are read and
|
|
answered as soon as the maintainer is able; a fix ships in a patch release,
|
|
with the timeline agreed in the thread.
|
|
|
|
Disclosure is coordinated by request, not by demand: please hold public details
|
|
until a patch is out. If you get no reply, that is not a request for a
|
|
continued embargo — disclose at your own discretion. Reporters are credited in
|
|
the CHANGELOG unless they ask not to be.
|
|
|
|
## In scope
|
|
|
|
The relay's job is to accept authenticated mail from an application and hand it
|
|
to the internet as the operator's domain, and nothing else. Breaking that is in
|
|
scope:
|
|
|
|
- **Open relay** — mail accepted from an unauthenticated sender, or relayed for
|
|
a domain the sending application is not bound to
|
|
- **SASL bypass** — sending without valid credentials, or credential recovery
|
|
from anything the container exposes
|
|
- **Cross-domain access** — an application or a panel session reaching a domain
|
|
it was not granted
|
|
- **Secret disclosure** — DKIM private keys, the admin password hash, session
|
|
tokens, or backup encryption material leaking to an unauthorised party
|
|
- **Panel authentication and session flaws** — login bypass, session fixation,
|
|
CSRF on state-changing routes, privilege escalation
|
|
- **Rate-limit bypass** — evading either the Postfix-level backstop or the
|
|
per-domain and per-application limits
|
|
- **Container escape** or privilege escalation from the panel's unprivileged
|
|
user to root
|
|
|
|
## Out of scope
|
|
|
|
These are the operator's responsibility or accepted trade-offs, documented in
|
|
[docs/security.md](docs/security.md) and the
|
|
[operator guide](docs/guide.md):
|
|
|
|
- Host configuration the operator controls: a blocked port 25, a missing or
|
|
wrong PTR record, DNS records not published, a self-signed or expired
|
|
certificate on the reverse proxy
|
|
- Anything requiring the attacker to already have root on the host or write
|
|
access to the `./data` bind mount
|
|
- Missing hardening headers or TLS options on the reverse proxy — SelfPost
|
|
never terminates HTTPS itself
|
|
- Deliverability outcomes: mail rejected or filtered by a receiving provider is
|
|
a policy decision of that provider, not a defect
|
|
- Denial of service through sheer volume against a single-tenant relay
|
|
- Vulnerabilities in upstream Postfix, the Go libraries SelfPost builds on,
|
|
or the base image — report
|
|
those upstream; if SelfPost's configuration makes an upstream issue
|
|
exploitable when it otherwise would not be, that *is* in scope
|
|
|
|
## Reports we cannot act on
|
|
|
|
Automated scanner output with no demonstrated impact, and reports whose only
|
|
content is a version number compared against a CVE list, are closed without
|
|
investigation.
|