2033: Misc r=nextgens a=nextgens
## What type of PR?
bug-fix
## What does this PR do?
- Remove /dkim from the rspamd container in setup as that's not necessary anymore;
`@micw` helms-chart should probably be updated too. There is an open question on whether we want to keep it on admin. We can either have DKIM keys auto-imported to the DB on upgrade (if they exist) or provide a facility to manually import them (so that the directory can be removed altogether). Having the former doesn't allow for removing /dkim from admin. `@Diman0` any opinion on what we want for 1.9?
- Remove spam points from RCVD_NO_TLS_LAST as we don't detect whether TLS was used or not.
### Related issue(s)
- close#1705
## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.
- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.
Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
2027: Make logs more quiet r=mergify[bot] a=nextgens
## What type of PR?
enhancement
## What does this PR do?
It silences various useless log messages in front, specifically:
```
Oct 30 03:11:04 instance-20210109-1612 docker-front[1963]: 127.0.0.1 - - [30/Oct/2021:03:11:04 +0000] "GET /health HTTP/1.1" 301 162 "-" "curl/7.78.0"
Oct 30 03:11:04 instance-20210109-1612 docker-front[1963]: 127.0.0.1 - - [30/Oct/2021:03:11:04 +0000] "GET /health HTTP/2.0" 204 0 "-" "curl/7.78.0"
Oct 30 03:11:04 instance-20210109-1612 docker-front[1963]: 2021/10/30 03:11:04 [info] 476302#476302: *2622679 client 127.0.0.1 closed keepalive connection
Oct 30 03:13:02 instance-20210109-1612 docker-front[1963]: 127.0.0.1 - - [30/Oct/2021:03:13:02 +0000] "GET /auth/email HTTP/1.0" 200 0 "-" "-"
```
`@micw` has requested it for k8s
2030: Fix RELAYNETS r=mergify[bot] a=nextgens
## What type of PR?
bug-fix
## What does this PR do?
RELAYNETS should be comma separated like everything else; rspamd should also be aware of what is considered "trusted".
I am not sure whether ```local_networks``` is the right configuration option for it though
- close#360
Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
2029: The Rate-limiter should run after the deny r=mergify[bot] a=nextgens
## What type of PR?
bug-fix
## What does this PR do?
It ensures that we *always* prevent login attempts on port 25; without it clients eventually get a temporary error instead of a permanent one.
Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
2023: Fix sso 1929 r=mergify[bot] a=Diman0
## What type of PR?
Enhancement
## What does this PR do?
- Introduces a separate login page that uses the same styling as the admin page.
- Shows login target of login page (Now this is either Admin or Webmail)
- Allows the user to choose the login target.
- Introduces a new stub /static which is used for retrieving all static files by all web apps (/admin and /sso).
### Related issue(s)
- closes#1929
## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.
- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.
Co-authored-by: Diman0 <diman@huisman.xyz>
Co-authored-by: Dimitri Huisman <diman@huisman.xyz>
Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
1987: Enhancement to the rate limits r=mergify[bot] a=nextgens
## What type of PR?
enhancement
## What does this PR do?
Turn the rate-limiters into something useful (that won't fire for no reason).
- fix rate-limiting on /webdav/
- it changes the rate-limiting behaviour from limiting a single IP address to a subnet of a reasonable size (/24 on v4 and /56 on v6 both are now configurable) : AUTH_RATELIMIT_IP / AUTH_RATELIMIT_IP_V4_MASK / AUTH_RATELIMIT_IP_V6_MASK
- It ensures we only use IP-based rate-limits for attempts on accounts that do not exist
- it creates a new rate limit preventing attackers from targetting a specific user account (separate from what's above) : AUTH_RATELIMIT_USER
- it introduces a rate limiting exemption mechanism whereby, upon authentication, users will see their source-ip address being exempt for a specific amount of time AUTH_RATELIMIT_EXEMPTION_LENGTH. A similar mechanism is available for web-based sessions (see below)
- It introduces in AUTH_RATELIMIT_EXEMPTION a comma separated list of network CIDRs that will be exempt from both types of rate limiting
- it implements device-tokens, as described on https://owasp.org/www-community/Slow_Down_Online_Guessing_Attacks_with_Device_Cookies to ensure that genuine users aren't locked-out by a malicious attacker abusing the rate-limit feature.
Things that could be improved include:
- the IP-based rate limiter flags attempts against "non-existing" accounts: it could go further and flag the number of unique non-existing accounts attempted (to prevent the case of a user making a typo in his MUA configuration)
- the IP address exemption mechanism doesn't pin the exemption to a specific username: any real user can trivially bypass the rate limits (and attempt to brute-force someone else's account)
### Related issue(s)
- close#1926
- close#1745
- close#1915
## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.
- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.
Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Co-authored-by: Diman0 <diman@huisman.xyz>
Co-authored-by: Florent Daigniere <nextgens@users.noreply.github.com>
bors[bot]