linux-from-scratch/glfs
1
0
Fork 0
mirror of https://github.com/Zeckmathederg/glfs.git synced 2025-02-03 23:07:23 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

postfix - update the smuggling details for 3.8.5.

Browse Source 
The previous 'yes' is now aliased to 'normalize' which will be
the default in postfix-3.9, so prefer that.  It now only rejects
if the bare newlines are in the DATA section of the mail, to
provide better compatibility with existing SMTP clients.

If a site needs to reject mails with bare newlines in the
message body, the value can be changed to 'reject'.

See https://www.openwall.com/lists/oss-security/2024/01/22/1
This commit is contained in:
Ken Moffat 2024-02-07 14:39:29 +00:00
parent fe1f174292
commit 9f3382f62c
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
server/mail/postfix.xml
View File

@ -411,11 +411,12 @@ echo 'alias_maps = lmdb:/etc/aliases' &gt;&gt; /etc/postfix/main.cf</userinp
To protect your server against the recent SMTP smuggling attacks,
additional steps are required. Add two lines into
<filename>/etc/postfix/main.cf</filename> to disconnect remote SMTP
clients that send bare newlines, while also allowing clients on your
network with non-standard SMTP implementations to still send mail:
clients that send bare newlines in the DATA section, while also
allowing clients on your network with non-standard SMTP implementations
to still send mail:
</para>
<screen role="root"><userinput>echo 'smtpd_forbid_bare_newline = yes' &gt;&gt; /etc/postfix/main.cf &amp;&amp;
<screen role="root"><userinput>echo 'smtpd_forbid_bare_newline = normalize' &gt;&gt; /etc/postfix/main.cf &amp;&amp;
echo 'smtpd_forbid_bare_newline_exclusions = $mynetworks' &gt;&gt; /etc/postfix/main.cf</userinput></screen>
<para>