3191 Commits (3e123f7de5eba07f2e23304443664f164575696c)
 

Author SHA1 Message Date
bors[bot] 11bbceb9cc
Merge #2032
2032: doh r=mergify[bot] a=nextgens

This should have been part of #2030

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
3 years ago
Florent Daigniere 8dad40f67c doh 3 years ago
bors[bot] e52a3de1b0
Merge #2027 #2030
2027: Make logs more quiet r=mergify[bot] a=nextgens

## What type of PR?

enhancement

## What does this PR do?

It silences various useless log messages in front, specifically:
```
Oct 30 03:11:04 instance-20210109-1612 docker-front[1963]: 127.0.0.1 - - [30/Oct/2021:03:11:04 +0000] "GET /health HTTP/1.1" 301 162 "-" "curl/7.78.0"
Oct 30 03:11:04 instance-20210109-1612 docker-front[1963]: 127.0.0.1 - - [30/Oct/2021:03:11:04 +0000] "GET /health HTTP/2.0" 204 0 "-" "curl/7.78.0"
Oct 30 03:11:04 instance-20210109-1612 docker-front[1963]: 2021/10/30 03:11:04 [info] 476302#476302: *2622679 client 127.0.0.1 closed keepalive connection
Oct 30 03:13:02 instance-20210109-1612 docker-front[1963]: 127.0.0.1 - - [30/Oct/2021:03:13:02 +0000] "GET /auth/email HTTP/1.0" 200 0 "-" "-"
```

`@micw` has requested it for k8s

2030: Fix RELAYNETS r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

RELAYNETS should be comma separated like everything else; rspamd should also be aware of what is considered "trusted".

I am not sure whether ```local_networks``` is the right configuration option for it though

- close #360

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
3 years ago
Florent Daigniere c8316cead1 Improve wording 3 years ago
bors[bot] e3396b83ce
Merge #2029
2029: The Rate-limiter should run after the deny r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

It ensures that we *always* prevent login attempts on port 25; without it clients eventually get a temporary error instead of a permanent one.

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
3 years ago
Florent Daigniere 70b374c46f Document that RELAYNETS is comma separated 3 years ago
Florent Daigniere 2170e07731 Tell rspamd about RELAYNETS 3 years ago
Florent Daigniere 9d474f32a6 RELAYNETS is comma separated! 3 years ago
Florent Daigniere f3c93212c6 The Rate-limiter should run after the deny 3 years ago
Florent Daigniere 53a0363b9e Deal with the noisy keepalive messages
We don't particularly care about HTTP... and that's what's noisy.
3 years ago
Florent Daigniere 80a85c27a9 Silent healthchecks in logs 3 years ago
bors[bot] 3ccb6ff4b5
Merge #2023
2023: Fix sso 1929 r=mergify[bot] a=Diman0

## What type of PR?

Enhancement

## What does this PR do?

- Introduces a separate login page that uses the same styling as the admin page.
- Shows login target of login page (Now this is either Admin or Webmail)
- Allows the user to choose the login target.
- Introduces a new stub /static which is used for retrieving all static files by all web apps (/admin and /sso).

### Related issue(s)
-  closes #1929

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Diman0 <diman@huisman.xyz>
Co-authored-by: Dimitri Huisman <diman@huisman.xyz>
Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
3 years ago
Alexander Graf 9bc685c30b removed some more whitespace 3 years ago
Alexander Graf 8c31699baf fixed locale selector for no_NB 3 years ago
Alexander Graf 882a27f87c simplified if's and added external link icon 3 years ago
Alexander Graf 3141ffe791 removed some whitespace 3 years ago
Dimitri Huisman 6b16756d92 Fix acessing antispam via sidebar. 3 years ago
Dimitri Huisman 3449b67c86 Process code review remarks PR2023 3 years ago
Dimitri Huisman 8784971b7f Merge rate limiting and failed login logging 3 years ago
Dimitri Huisman a01df56a9b Forgot to include the new endpoint /static 3 years ago
Dimitri Huisman edb76f25d8 Update newsfragment 3 years ago
Dimitri Huisman 8eabece225 Update reverse proxy doc with new /sso endpoint. 3 years ago
Dimitri Huisman 503044ef6e Reintroduce ProxyFix. Use two buttons for logging in. 3 years ago
Dimitri Huisman c42ad8e71e Forgot to include changes for url_for of base.html 3 years ago
Dimitri Huisman fb0f005343 Get rid of complicated prefix logic. Further simplify /static handling and nginx config. 3 years ago
Dimitri Huisman da788ddee3 Merge branch 'fix-sso-1929' of github.com:Diman0/Mailu into fix-sso-1929 3 years ago
Dimitri Huisman bdcc183165 Redirect to configured ENV VAR for Admin/Webmail, further simplify nginx config. 3 years ago
Dimitri Huisman f1a60aa6ea Remove unneeded auth_request_set 3 years ago
Florent Daigniere fee13e6c4b Save a redirect 3 years ago
Florent Daigniere d3f07a0882 Simplify the handling of /static 3 years ago
Florent Daigniere aee089f3b1 Ensure that static assets are readable 3 years ago
Dimitri Huisman a47afec4ee Make logic more readable. 3 years ago
Dimitri Huisman 48764f0400 Ensure all requests from the page sso go through the page sso. 3 years ago
Dimitri Huisman 5232bd38fd Simplify webmail logout. 3 years ago
Dimitri Huisman aab258d284 Move handling of logging out in admin, to sso logout page. 3 years ago
Dimitri Huisman 615743b331 Improve indendation of conditions. 3 years ago
Dimitri Huisman 5d81846c5d Introduce the shared stub /static for providing all static files 3 years ago
Dimitri Huisman eb74a72a52 Moved locations to correct area in nginx.conf. 3 years ago
Dimitri Huisman edc00a4af3
Merge pull request #2024 from Diman0/1932-org-cleanup
Modified trusted authors mergify config as disccused in #1932
3 years ago
Dimitri Huisman f2474c968e Modified trusted authors mergify config as disccused in #1932 3 years ago
Dimitri Huisman aa7380ffba Doh! 3 years ago
Dimitri Huisman 44d2448412 Updated SSO logic for webmails. Fixed small bug rate limiting. 3 years ago
Dimitri Huisman f9eee0cbaf Adapt HEALTHCHECK to new URL 3 years ago
Dimitri Huisman ed7adf52a6 Merge branch 'master' of github.com:Diman0/Mailu into fix-sso-1929 3 years ago
Dimitri Huisman 913a6304a7 Finishing touches. Introduce /static stub for handling all static files. 3 years ago
bors[bot] a1192d8039
Merge #1987
1987: Enhancement to the rate limits r=mergify[bot] a=nextgens

## What type of PR?

enhancement

## What does this PR do?

Turn the rate-limiters into something useful (that won't fire for no reason).

- fix rate-limiting on /webdav/
- it changes the rate-limiting behaviour from limiting a single IP address to a subnet of a reasonable size (/24 on v4 and /56 on v6 both are now configurable) : AUTH_RATELIMIT_IP / AUTH_RATELIMIT_IP_V4_MASK / AUTH_RATELIMIT_IP_V6_MASK
- It ensures we only use IP-based rate-limits for attempts on accounts that do not exist
- it creates a new rate limit preventing attackers from targetting a specific user account (separate from what's above) : AUTH_RATELIMIT_USER
- it introduces a rate limiting exemption mechanism whereby, upon authentication, users will see their source-ip address being exempt for a specific amount of time AUTH_RATELIMIT_EXEMPTION_LENGTH. A similar mechanism is available for web-based sessions (see below)
- It introduces in AUTH_RATELIMIT_EXEMPTION a comma separated list of network CIDRs that will be exempt from both types of rate limiting
- it implements device-tokens, as described on https://owasp.org/www-community/Slow_Down_Online_Guessing_Attacks_with_Device_Cookies to ensure that genuine users aren't locked-out by a malicious attacker abusing the rate-limit feature.

Things that could be improved include:
- the IP-based rate limiter flags attempts against "non-existing" accounts: it could go further and flag the number of unique non-existing accounts attempted (to prevent the case of a user making a typo in his MUA configuration)
- the IP address exemption mechanism doesn't pin the exemption to a specific username: any real user can trivially bypass the rate limits (and attempt to brute-force someone else's account)

### Related issue(s)
- close #1926
- close #1745 
- close #1915


## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Co-authored-by: Diman0 <diman@huisman.xyz>
Co-authored-by: Florent Daigniere <nextgens@users.noreply.github.com>
3 years ago
Florent Daigniere 693b578bbb The second strip isn't necessary 3 years ago
Florent Daigniere 1c6165213c better that way 3 years ago
Florent Daigniere 34497cff20 doh 3 years ago
Florent Daigniere e8871dd77f doh 3 years ago