infrastructure/mox
1
0
Fork 0
mirror of https://github.com/mjl-/mox.git synced 2025-07-19 00:46:36 +03:00
Code Issues Packages Projects Releases Wiki Activity

implement tls client certificate authentication

Browse Source 
the imap & smtp servers now allow logging in with tls client authentication and
the "external" sasl authentication mechanism. email clients like thunderbird,
fairemail, k9, macos mail implement it. this seems to be the most secure among
the authentication mechanism commonly implemented by clients. a useful property
is that an account can have a separate tls public key for each device/email
client.  with tls client cert auth, authentication is also bound to the tls
connection. a mitm cannot pass the credentials on to another tls connection,
similar to scram-*-plus. though part of scram-*-plus is that clients verify
that the server knows the client credentials.

for tls client auth with imap, we send a "preauth" untagged message by default.
that puts the connection in authenticated state. given the imap connection
state machine, further authentication commands are not allowed. some clients
don't recognize the preauth message, and try to authenticate anyway, which
fails. a tls public key has a config option to disable preauth, keeping new
connections in unauthenticated state, to work with such email clients.

for smtp (submission), we don't require an explicit auth command.

both for imap and smtp, we allow a client to authenticate with another
mechanism than "external". in that case, credentials are verified, and have to
be for the same account as the tls client auth, but the adress can be another
one than the login address configured with the tls public key.

only the public key is used to identify the account that is authenticating. we
ignore the rest of the certificate. expiration dates, names, constraints, etc
are not verified. no certificate authorities are involved.

users can upload their own (minimal) certificate. the account web interface
shows openssl commands you can run to generate a private key, minimal cert, and
a p12 file (the format that email clients seem to like...) containing both
private key and certificate.

the imapclient & smtpclient packages can now also use tls client auth. and so
does "mox sendmail", either with a pem file with private key and certificate,
or with just an ed25519 private key.

there are new subcommands "mox config tlspubkey ..." for
adding/removing/listing tls public keys from the cli, by the admin.
This commit is contained in:
Mechiel Lukkien
2024-12-05 22:41:49 +01:00
parent 5f7831a7f0
commit 8804d6b60e
38 changed files with 2737 additions and 309 deletions
Download Patch File Download Diff File Expand all files Collapse all files

132
sendmail.go
View File

@ -3,11 +3,18 @@ package main
import (
"bufio"
"context"
"crypto"
"crypto/ed25519"
cryptorand "crypto/rand"
"crypto/tls"
"crypto/x509"
"encoding/base64"
"encoding/pem"
"errors"
"fmt"
"io"
"log"
"math/big"
"net"
"os"
"path/filepath"
@ -26,17 +33,24 @@ import (
)
var submitconf struct {
LocalHostname string `sconf-doc:"Hosts don't always have an FQDN, set it explicitly, for EHLO."`
Host string `sconf-doc:"Host to dial for delivery, e.g. mail.<domain>."`
Port int `sconf-doc:"Port to dial for delivery, e.g. 465 for submissions, 587 for submission, or perhaps 25 for smtp."`
TLS bool `sconf-doc:"Connect with TLS. Usually for connections to port 465."`
STARTTLS bool `sconf-doc:"After starting in plain text, use STARTTLS to enable TLS. For port 587 and 25."`
Username string `sconf-doc:"For SMTP authentication."`
Password string `sconf-doc:"For password-based SMTP authentication, e.g. SCRAM-SHA-256-PLUS, CRAM-MD5, PLAIN."`
AuthMethod string `sconf-doc:"If set, only attempt this authentication mechanism. E.g. SCRAM-SHA-256-PLUS, SCRAM-SHA-256, SCRAM-SHA-1-PLUS, SCRAM-SHA-1, CRAM-MD5, PLAIN. If not set, any mutually supported algorithm can be used, in order listed, from most to least secure. It is recommended to specify the strongest authentication mechanism known to be implemented by the server, to prevent mechanism downgrade attacks."`
From string `sconf-doc:"Address for MAIL FROM in SMTP and From-header in message."`
DefaultDestination string `sconf:"optional" sconf-doc:"Used when specified address does not contain an @ and may be a local user (eg root)."`
RequireTLS RequireTLSOption `sconf:"optional" sconf-doc:"If yes, submission server must implement SMTP REQUIRETLS extension, and connection to submission server must use verified TLS. If no, a TLS-Required header with value no is added to the message, allowing fallback to unverified TLS or plain text delivery despite recpient domain policies. By default, the submission server will follow the policies of the recipient domain (MTA-STS and/or DANE), and apply unverified opportunistic TLS with STARTTLS."`
LocalHostname string `sconf-doc:"Hosts don't always have an FQDN, set it explicitly, for EHLO."`
Host string `sconf-doc:"Host to dial for delivery, e.g. mail.<domain>."`
Port int `sconf-doc:"Port to dial for delivery, e.g. 465 for submissions, 587 for submission, or perhaps 25 for smtp."`
TLS bool `sconf-doc:"Connect with TLS. Usually for connections to port 465."`
STARTTLS bool `sconf-doc:"After starting in plain text, use STARTTLS to enable TLS. For port 587 and 25."`
TLSInsecureSkipVerify bool `sconf:"optional" sconf-doc:"If true, do not verify the server TLS identity."`
Username string `sconf-doc:"For SMTP authentication."`
Password string `sconf:"optional" sconf-doc:"For password-based SMTP authentication, e.g. SCRAM-SHA-256-PLUS, CRAM-MD5, PLAIN."`
ClientAuthEd25519PrivateKey string `sconf:"optional" sconf-doc:"If set, used for TLS client authentication with a certificate. The private key must be a raw-url-base64-encoded ed25519 key. A basic certificate is composed automatically. The server must use the public key of a certificate to identify/verify users."`
ClientAuthCertPrivateKeyPEMFile string `sconf:"optional" sconf-doc:"If set, an absolute path to a PEM file containing both a PKCS#8 unencrypted private key and a certificate. Used for TLS client authentication."`
AuthMethod string `sconf-doc:"If set, only attempt this authentication mechanism. E.g. EXTERNAL (for TLS client authentication), SCRAM-SHA-256-PLUS, SCRAM-SHA-256, SCRAM-SHA-1-PLUS, SCRAM-SHA-1, CRAM-MD5, PLAIN. If not set, any mutually supported algorithm can be used, in order listed, from most to least secure. It is recommended to specify the strongest authentication mechanism known to be implemented by the server, to prevent mechanism downgrade attacks. Exactly one of Password, ClientAuthEd25519PrivateKey and ClientAuthCertPrivateKeyPEMFile must be set."`
From string `sconf-doc:"Address for MAIL FROM in SMTP and From-header in message."`
DefaultDestination string `sconf:"optional" sconf-doc:"Used when specified address does not contain an @ and may be a local user (eg root)."`
RequireTLS RequireTLSOption `sconf:"optional" sconf-doc:"If yes, submission server must implement SMTP REQUIRETLS extension, and connection to submission server must use verified TLS. If no, a TLS-Required header with value no is added to the message, allowing fallback to unverified TLS or plain text delivery despite recpient domain policies. By default, the submission server will follow the policies of the recipient domain (MTA-STS and/or DANE), and apply unverified opportunistic TLS with STARTTLS."`
// For TLS client authentication with a certificate. Either from
// ClientAuthEd25519PrivateKey or ClientAuthCertPrivateKeyPEMFile.
clientCert *tls.Certificate
}
type RequireTLSOption string
@ -128,6 +142,71 @@ binary should be setgid that group:
err := sconf.ParseFile(confPath, &submitconf)
xcheckf(err, "parsing config")
var secrets []string
for _, s := range []string{submitconf.Password, submitconf.ClientAuthEd25519PrivateKey, submitconf.ClientAuthCertPrivateKeyPEMFile} {
if s != "" {
secrets = append(secrets, s)
}
}
if len(secrets) != 1 {
xcheckf(fmt.Errorf("got passwords/keys %s, need exactly one", strings.Join(secrets, ", ")), "checking passwords/keys")
}
if submitconf.ClientAuthEd25519PrivateKey != "" {
seed, err := base64.RawURLEncoding.DecodeString(submitconf.ClientAuthEd25519PrivateKey)
xcheckf(err, "parsing ed25519 private key")
if len(seed) != ed25519.SeedSize {
xcheckf(fmt.Errorf("got %d bytes, need %d", len(seed), ed25519.SeedSize), "parsing ed25519 private key")
}
privKey := ed25519.NewKeyFromSeed(seed)
_, cert := xminimalCert(privKey)
submitconf.clientCert = &cert
} else if submitconf.ClientAuthCertPrivateKeyPEMFile != "" {
pemBuf, err := os.ReadFile(submitconf.ClientAuthCertPrivateKeyPEMFile)
xcheckf(err, "reading pem file")
var cert tls.Certificate
for {
block, rest := pem.Decode(pemBuf)
if block == nil && len(rest) != 0 {
log.Printf("xxx, leftover data %q", rest)
log.Fatalf("leftover data in pem file")
} else if block == nil {
break
}
switch block.Type {
case "CERTIFICATE":
c, err := x509.ParseCertificate(block.Bytes)
xcheckf(err, "parsing certificate")
if cert.Leaf == nil {
cert.Leaf = c
}
cert.Certificate = append(cert.Certificate, block.Bytes)
case "PRIVATE KEY":
if cert.PrivateKey != nil {
log.Fatalf("cannot handle multiple private keys")
}
privKey, err := x509.ParsePKCS8PrivateKey(block.Bytes)
xcheckf(err, "parsing private key")
cert.PrivateKey = privKey
default:
log.Fatalf("unrecognized pem type %q, only CERTIFICATE and PRIVATE KEY allowed", block.Type)
}
pemBuf = rest
}
if len(cert.Certificate) == 0 {
log.Fatalf("no certificate(s) found in pem file")
}
if cert.PrivateKey == nil {
log.Fatalf("no private key found in pem file")
}
type cryptoPublicKey interface {
Equal(x crypto.PublicKey) bool
}
if !cert.PrivateKey.(crypto.Signer).Public().(cryptoPublicKey).Equal(cert.Leaf.PublicKey) {
log.Fatalf("certificate public key does not match with private key")
}
submitconf.clientCert = &cert
}
var recipient string
if len(args) == 1 && !tflag {
recipient = args[0]
@ -257,6 +336,8 @@ binary should be setgid that group:
auth := func(mechanisms []string, cs *tls.ConnectionState) (sasl.Client, error) {
// Check explicitly configured mechanisms.
switch submitconf.AuthMethod {
case "EXTERNAL":
return sasl.NewClientExternal(submitconf.Username), nil
case "SCRAM-SHA-256-PLUS":
if cs == nil {
return nil, fmt.Errorf("scram plus authentication mechanism requires tls")
@ -278,7 +359,9 @@ binary should be setgid that group:
}
// Try the defaults, from more to less secure.
if cs != nil && slices.Contains(mechanisms, "SCRAM-SHA-256-PLUS") {
if cs != nil && submitconf.clientCert != nil {
return sasl.NewClientExternal(submitconf.Username), nil
} else if cs != nil && slices.Contains(mechanisms, "SCRAM-SHA-256-PLUS") {
return sasl.NewClientSCRAMSHA256PLUS(submitconf.Username, submitconf.Password, *cs), nil
} else if slices.Contains(mechanisms, "SCRAM-SHA-256") {
return sasl.NewClientSCRAMSHA256(submitconf.Username, submitconf.Password, true), nil
@ -308,6 +391,9 @@ binary should be setgid that group:
} else if submitconf.RequireTLS == RequireTLSYes {
xsavecheckf(errors.New("cannot submit with requiretls enabled without tls to submission server"), "checking tls configuration")
}
if submitconf.TLSInsecureSkipVerify {
tlsPKIX = false
}
ourHostname, err := dns.ParseDomain(submitconf.LocalHostname)
xsavecheckf(err, "parsing our local hostname")
@ -320,8 +406,9 @@ binary should be setgid that group:
// todo: implement SRV and DANE, allowing for a simpler config file (just the email address & password)
opts := smtpclient.Opts{
Auth: auth,
RootCAs: mox.Conf.Static.TLS.CertPool,
Auth: auth,
RootCAs: mox.Conf.Static.TLS.CertPool,
ClientCert: submitconf.clientCert,
}
client, err := smtpclient.New(ctx, c.log.Logger, conn, tlsMode, tlsPKIX, ourHostname, remoteHostname, opts)
xsavecheckf(err, "open smtp session")
@ -333,3 +420,20 @@ binary should be setgid that group:
log.Printf("closing smtp session after message was sent: %v", err)
}
}
func xminimalCert(privKey ed25519.PrivateKey) ([]byte, tls.Certificate) {
template := &x509.Certificate{
// Required field.
SerialNumber: big.NewInt(time.Now().Unix()),
}
certBuf, err := x509.CreateCertificate(cryptorand.Reader, template, template, privKey.Public(), privKey)
xcheckf(err, "creating minimal certificate")
cert, err := x509.ParseCertificate(certBuf)
xcheckf(err, "parsing certificate")
c := tls.Certificate{
Certificate: [][]byte{certBuf},
PrivateKey: privKey,
Leaf: cert,
}
return certBuf, c
}