1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
|
%global _empty_manifest_terminate_build 0
Name: python-postfix-mta-sts-resolver
Version: 1.3.0
Release: 1
Summary: Daemon which provides TLS client policy for Postfix via socketmap, according to domain MTA-STS policy
License: MIT
URL: https://github.com/Snawoot/postfix-mta-sts-resolver
Source0: https://mirrors.nju.edu.cn/pypi/web/packages/41/65/3699a8cd634e95660814e6f86f6c551d5f321a096e81b425e11d6b6da069/postfix_mta_sts_resolver-1.3.0.tar.gz
BuildArch: noarch
Requires: python3-aiodns
Requires: python3-aiohttp
Requires: python3-PyYAML
Requires: python3-pytest
Requires: python3-pytest-cov
Requires: python3-pytest-asyncio
Requires: python3-pytest-timeout
Requires: python3-pylint
Requires: python3-tox
Requires: python3-coverage
Requires: python3-setuptools
Requires: python3-wheel
Requires: python3-twine
Requires: python3-cryptography
Requires: python3-redis
Requires: python3-aiosqlite
Requires: python3-uvloop
%description
[](https://travis-ci.org/Snawoot/postfix-mta-sts-resolver) [](https://travis-ci.org/Snawoot/postfix-mta-sts-resolver) [](https://pypistats.org/packages/postfix-mta-sts-resolver) [](https://pypi.org/project/postfix-mta-sts-resolver/) [](https://pypi.org/project/postfix-mta-sts-resolver/) [](https://pypi.org/project/postfix-mta-sts-resolver/) [](https://snapcraft.io/postfix-mta-sts-resolver) 
Daemon which provides TLS client policy for Postfix via socketmap, according to domain MTA-STS policy.
Current support of [RFC 8461](https://www.rfc-editor.org/rfc/rfc8461) is limited:
* [MTA-STS policy overrides DANE TLS authentication](#warning-mta-sts-policy-overrides-dane-tls-authentication) against [RFC 8461, 2](https://www.rfc-editor.org/rfc/rfc8461#section-2).
* Daemon lacks some minor features:
* Fetch error reporting.
* Fetch ratelimit (but actual fetch rate partially restricted with `cache_grace` config option).
Server has configurable cache backend which allows to store cached STS policies in memory (`internal`), file (`sqlite`) or in Redis database (`redis`).
## Requirements
* Postfix 3.4+ (or Postfix 2.10+ if missing Postfix SNI feature is tolerable. In that case you have to set zone option `require_sni` to `false` in MTA-STS daemon config)
* Python 3.5.3+ (see ["Systems without Python 3.5+"](#systems-without-python-35) below if you haven't one, or use Docker installation method)
* aiodns
* aiohttp
* aiosqlite
* redis-py
* PyYAML
* (optional) uvloop
All dependency packages installed automatically if this package is installed via pip.
## Installation
### Method 1. System-wide install from PyPI (recommended for humans)
Run:
```bash
sudo python3 -m pip install postfix-mta-sts-resolver[redis,sqlite]
```
If you don't need `redis` or `sqlite` support, you may omit one of them in square brackets. If you don't need any of them and you plan to use internal cache without persistence, you should also omit square brackets.
Package scripts shall be available in standard executable locations upon completion.
#### pip user install
All pip invocations can be run with `--user` option of `pip` installer. In this case superuser privileges are not required and package(s) are getting installed into user home directory. Usually, script executables will appear in `~/.local/bin`.
### Method 2. System-wide install from project source
Run in project directory:
```bash
sudo python3 -m pip install .[redis,sqlite]
```
If you don't need `redis` or `sqlite` support, you may omit one of them in square brackets. If you don't need any of them and you plan to use internal cache without persistence, you should also omit square brackets.
Package scripts shall be available in standard executable locations upon completion.
### Method 3. Install into virtualenv
See ["Building virtualenv"](#building-virtualenv)
### Method 4. Docker
Run
```bash
docker volume create mta-sts-cache
docker run -d \
--security-opt no-new-privileges \
-v mta-sts-cache:/var/lib/mta-sts \
-p 127.0.0.1:8461:8461 \
--restart unless-stopped \
--name postfix-mta-sts-resolver \
yarmak/postfix-mta-sts-resolver
```
Daemon will be up and running, listening on local interface on port 8461. Default configuration baked into docker image uses SQLite for cache stored in persistent docker volume. You may override this configuration with your own config file by mapping it into container with option `-v my_config.yml:/etc/mta-sta-daemon.yml`.
### Method 5. Snap Store
[](https://snapcraft.io/postfix-mta-sts-resolver)
```bash
sudo snap install postfix-mta-sts-resolver
```
NOTE: in snap layout `mta-sta-daemon` program is named `postfix-mta-sts-resolver.daemon` and `mta-sts-query` is named `postfix-mta-sts-resolver.query`.
### Common installation notes
See also [contrib/README.md](https://github.com/Snawoot/postfix-mta-sts-resolver/tree/master/contrib/README.md) for RHEL/OEL/Centos and FreeBSD notes.
See [contrib/](https://github.com/Snawoot/postfix-mta-sts-resolver/tree/master/contrib) for example of systemd unit file suitable to run daemon under systemd control.
## Running
This package provides two executables available after installation in respective locations.
### mta-sts-query
`mta-sts-query` is a command line tool which fetches and outputs domain MTA-STS policies. Intended to be used for debug purposes.
Synopsis:
```
$ mta-sts-query --help
usage: mta-sts-query [-h] [-v {debug,info,warn,error,fatal}]
domain [known_version]
positional arguments:
domain domain to fetch MTA-STS policy from
known_version latest known version (default: None)
optional arguments:
-h, --help show this help message and exit
-v {debug,info,warn,error,fatal}, --verbosity {debug,info,warn,error,fatal}
logging verbosity (default: warn)
```
### mta-sts-daemon
`mta-sts-daemon` is a daemon which provides external [TLS policy for Postfix SMTP client](http://www.postfix.org/TLS_README.html#client_tls_policy) via [socketmap interface](http://www.postfix.org/socketmap_table.5.html).
You may find useful systemd unit file to run daemon in [contrib/](https://github.com/Snawoot/postfix-mta-sts-resolver/tree/master/contrib).
Synopsis:
```
$ mta-sts-daemon --help
usage: mta-sts-daemon [-h] [-v {debug,info,warn,error,fatal}] [-c FILE]
[-l FILE] [--disable-uvloop]
optional arguments:
-h, --help show this help message and exit
-v {debug,info,warn,error,fatal}, --verbosity {debug,info,warn,error,fatal}
logging verbosity (default: info)
-c FILE, --config FILE
config file location (default: /etc/mta-sts-
daemon.yml)
-l FILE, --logfile FILE
log file location (default: None)
--disable-uvloop do not use uvloop even if it is available (default:
False)
```
#### Seamless restart/upgrade/reload and load balancing
By default mta-sts-daemon allows its multiple instances to share same port (on Linux/FreeBSD/Windows). Therefore, restart or upgrade of daemon can be performed seamlessly. Set of unit files for systemd in [contrib/](contrib/) directory implements "reload" by mean of running backup instance when main instance is getting restarted.
Also on Linux and FreeBSD, load distributed across all processes (with SO\_REUSEPORT and SO\_REUSEPORT\_LB respectively).
## MTA-STS Daemon configuration
See [configuration man page](https://github.com/Snawoot/postfix-mta-sts-resolver/blob/master/man/mta-sts-daemon.yml.5.adoc) and [config\_examples/](https://github.com/Snawoot/postfix-mta-sts-resolver/tree/master/config_examples) directory. Default config location is: `/etc/mta-sts-daemon.yml`, but it can be overridden with command line option `-c FILE`.
All options is self-explanatory, only exception is `strict_testing` option. If set to `true`, STS policy will be enforced even if domain announces `testing` MTA-STS mode. Useful for premature incorporation of MTA-STS against domains hesitating to go `enforce`. Please use with caution.
## Postfix configuration
SMTP client of your Postfix instance must be able to validate peer certificates. In order to achieve that, you have to ensure [`smtp_tls_CAfile`](http://www.postfix.org/postconf.5.html#smtp_tls_CAfile) or [`smtp_tls_CApath`](http://www.postfix.org/postconf.5.html#smtp_tls_CApath) points to system CA bundle. Otherwise you'll get `Unverified TLS connection` even for peers with valid certificate, and delivery failures for MTA-STS-enabled destinations. Also note: even enabled [`tls_append_default_CA`](http://www.postfix.org/postconf.5.html#tls_append_default_CA) will not work alone if both `smtp_tls_CAfile` and `smtp_tls_CApath` are empty.
Once certificate validation is enabled and your Postfix log shows "Trusted TLS connection ... " for destinations with valid certificates signed by public CA, you may enable MTA-STS by adding following line to `main.cf`:
```
smtp_tls_policy_maps = socketmap:inet:127.0.0.1:8461:postfix
```
If your configuration already has some TLS policy maps, just add MTA-STS socketmap to list of configured maps accordingly to [`smtp_tls_policy_maps`](http://www.postfix.org/postconf.5.html#smtp_tls_policy_maps) syntax. TLS policy tables are searched in the specified order until a match is found, so you may have table with local overrides of TLS policy prior to MTA-STS socketmap. This may be useful for skipping network lookup for well-known destinations or relaxing security for broken destinations, announcing MTA-STS support.
Reload Postfix after reconfiguration.
### Warning: MTA-STS policy overrides DANE TLS authentication
Due to Postfix's limitations, a resolved MTA-STS policy overrides DANE TLS authentication ([RFC 6698](https://www.rfc-editor.org/rfc/rfc6698)), because DANE is an internal feature of Postfix, and the postfix-mta-sts-resolver always responds with a ([`smtp_tls_policy_maps`](https://www.postfix.org/postconf.5.html#smtp_tls_policy_maps)) lookup result `secure` for [Secure server certificate verification](https://www.postfix.org/TLS_README.html#client_tls_secure).
* The resulting behaviour is against [RFC 8461, 2](https://www.rfc-editor.org/rfc/rfc8461#section-2):
> However, MTA-STS is designed not to interfere with DANE deployments when the two overlap; in particular, senders who implement MTA-STS validation MUST NOT allow MTA-STS Policy validation to override a failing DANE validation.
Domains implementing both MTA-STS and DANE probably want DANE to be preferred:
* DANE allows strict binding of certificates; the policy can authorize only a certain certificate or certificates from a certain CA. With MTA-STS, a certificate from any trusted CA is automatically trusted; [RFC 8461, 10.1](https://www.rfc-editor.org/rfc/rfc8461#section-10.1):
> SMTP MTA-STS relies on certificate validation via PKIX-based TLS identity checking [RFC6125]. Attackers who are able to obtain a
valid certificate for the targeted recipient mail service (e.g., by compromising a CA) are thus able to circumvent STS authentication.
* Based on DNSSEC, DANE not vulnerable to downgrade attack that could prevent policy discovery. MTA-STS security considerations acknowledges this weakness in [RFC 8461, 10.2](https://www.rfc-editor.org/rfc/rfc8461#section-10.2):
> Since MTA-STS uses DNS TXT records for policy discovery, an attacker who is able to block DNS responses can suppress the discovery of an
MTA-STS Policy, making the Policy Domain appear not to have an MTA-STS Policy.
> Resistance to downgrade attacks of this nature -- due to the ability to authoritatively determine "lack of a record" even for non-participating recipients -- is a feature of DANE, due to its use of DNSSEC for policy discovery.
* The postfix-mta-sts-resolver does not intent to implement policy lookups for DANE, and responses other than `secure` with `match=` would not verify the TLS certificate as required by [RFC 8461, 4,2](https://www.rfc-editor.org/rfc/rfc8461#section-4.2).
If you wish to meet this requirement:
* List a DANE policy resolver responding with `dane-only` (for [Mandatory DANE](https://www.postfix.org/TLS_README.html#client_tls_dane)) before postfix-mta-sts-resolver in `smtp_tls_policy_maps` lookup table list.
* Alternatively, you could use a static lookup table for domains known to implement both MTA-STS & DANE, e.g.,
```
smtp_tls_policy_maps = hash:/etc/postfix/tls_policy,socketmap:inet:127.0.0.1:8461:postfix
```
## Operability check
Assuming default MTA-STA daemon configuration. Following command:
```bash
/usr/sbin/postmap -q dismail.de socketmap:inet:127.0.0.1:8461:postfix
```
should return something like:
```
secure match=mx1.dismail.de
```
Postfix log should show `Verified TLS connection established to ...` instead of `Untrusted ...` or `Trusted TLS connection established to ...` when mail is getting sent to MTA-STS-enabled domain.
## Special cases of deployment
### Systems without Python 3.5+
Some people may find convenient to install latest python from source into `/opt` directory. This way you can have separate python installation not interfering with system packages by any means. Download latest python source from [python.org](https://www.python.org/), unpack and run in unpacked source directory:
```bash
./configure --prefix=/opt --enable-optimizations && make -j $[ $(nproc) + 1 ] && make test && sudo make install
```
Python binaries will be available in `/opt/bin`, including `pip3`. You may install `postfix-mta-sts-resolver` using `/opt/bin/pip3` without interference with any system packages:
```bash
sudo /opt/bin/pip3 install postfix-mta-sts-resolver[sqlite,redis]
```
Executable files of `postfix-mta-sts-resolver` will be available in `/opt/bin/mta-sts-query` and `/opt/bin/mta-sts-daemon`
### Building virtualenv
Run `make` in project directory in order to build virtualenv. As result of it, new directory `venv` shall appear. `venv` contains interpreter and all required dependencies, i.e. encloses package with dependencies in separate environment. It is possible to specify alternative path where virtualenv directory shall be placed. Specify VENV variable for `make` command. Example:
```bash
make VENV=~/postfix-mta-sts-resolver
```
Such virtual environment can be moved to another machine of similar type (as far python interpreter is compatible with new environment). If virtualenv is placed into same location on new machine, application can be run this way:
```bash
venv/bin/mta-sts-daemon
```
Otherwise, some hacks required. First option - explicitly call virtualenv interpreter:
```bash
venv/bin/python venv/bin/mta-sts-daemon
```
Second option - specify new path in shebang of scripts installed in virtualenv. It is recommended to build virtualenv at same location which app shall occupy on target system.
## Credits
Inspired by [this forum thread](http://postfix.1071664.n5.nabble.com/MTA-STS-when-td95086.html).
%package -n python3-postfix-mta-sts-resolver
Summary: Daemon which provides TLS client policy for Postfix via socketmap, according to domain MTA-STS policy
Provides: python-postfix-mta-sts-resolver
BuildRequires: python3-devel
BuildRequires: python3-setuptools
BuildRequires: python3-pip
%description -n python3-postfix-mta-sts-resolver
[](https://travis-ci.org/Snawoot/postfix-mta-sts-resolver) [](https://travis-ci.org/Snawoot/postfix-mta-sts-resolver) [](https://pypistats.org/packages/postfix-mta-sts-resolver) [](https://pypi.org/project/postfix-mta-sts-resolver/) [](https://pypi.org/project/postfix-mta-sts-resolver/) [](https://pypi.org/project/postfix-mta-sts-resolver/) [](https://snapcraft.io/postfix-mta-sts-resolver) 
Daemon which provides TLS client policy for Postfix via socketmap, according to domain MTA-STS policy.
Current support of [RFC 8461](https://www.rfc-editor.org/rfc/rfc8461) is limited:
* [MTA-STS policy overrides DANE TLS authentication](#warning-mta-sts-policy-overrides-dane-tls-authentication) against [RFC 8461, 2](https://www.rfc-editor.org/rfc/rfc8461#section-2).
* Daemon lacks some minor features:
* Fetch error reporting.
* Fetch ratelimit (but actual fetch rate partially restricted with `cache_grace` config option).
Server has configurable cache backend which allows to store cached STS policies in memory (`internal`), file (`sqlite`) or in Redis database (`redis`).
## Requirements
* Postfix 3.4+ (or Postfix 2.10+ if missing Postfix SNI feature is tolerable. In that case you have to set zone option `require_sni` to `false` in MTA-STS daemon config)
* Python 3.5.3+ (see ["Systems without Python 3.5+"](#systems-without-python-35) below if you haven't one, or use Docker installation method)
* aiodns
* aiohttp
* aiosqlite
* redis-py
* PyYAML
* (optional) uvloop
All dependency packages installed automatically if this package is installed via pip.
## Installation
### Method 1. System-wide install from PyPI (recommended for humans)
Run:
```bash
sudo python3 -m pip install postfix-mta-sts-resolver[redis,sqlite]
```
If you don't need `redis` or `sqlite` support, you may omit one of them in square brackets. If you don't need any of them and you plan to use internal cache without persistence, you should also omit square brackets.
Package scripts shall be available in standard executable locations upon completion.
#### pip user install
All pip invocations can be run with `--user` option of `pip` installer. In this case superuser privileges are not required and package(s) are getting installed into user home directory. Usually, script executables will appear in `~/.local/bin`.
### Method 2. System-wide install from project source
Run in project directory:
```bash
sudo python3 -m pip install .[redis,sqlite]
```
If you don't need `redis` or `sqlite` support, you may omit one of them in square brackets. If you don't need any of them and you plan to use internal cache without persistence, you should also omit square brackets.
Package scripts shall be available in standard executable locations upon completion.
### Method 3. Install into virtualenv
See ["Building virtualenv"](#building-virtualenv)
### Method 4. Docker
Run
```bash
docker volume create mta-sts-cache
docker run -d \
--security-opt no-new-privileges \
-v mta-sts-cache:/var/lib/mta-sts \
-p 127.0.0.1:8461:8461 \
--restart unless-stopped \
--name postfix-mta-sts-resolver \
yarmak/postfix-mta-sts-resolver
```
Daemon will be up and running, listening on local interface on port 8461. Default configuration baked into docker image uses SQLite for cache stored in persistent docker volume. You may override this configuration with your own config file by mapping it into container with option `-v my_config.yml:/etc/mta-sta-daemon.yml`.
### Method 5. Snap Store
[](https://snapcraft.io/postfix-mta-sts-resolver)
```bash
sudo snap install postfix-mta-sts-resolver
```
NOTE: in snap layout `mta-sta-daemon` program is named `postfix-mta-sts-resolver.daemon` and `mta-sts-query` is named `postfix-mta-sts-resolver.query`.
### Common installation notes
See also [contrib/README.md](https://github.com/Snawoot/postfix-mta-sts-resolver/tree/master/contrib/README.md) for RHEL/OEL/Centos and FreeBSD notes.
See [contrib/](https://github.com/Snawoot/postfix-mta-sts-resolver/tree/master/contrib) for example of systemd unit file suitable to run daemon under systemd control.
## Running
This package provides two executables available after installation in respective locations.
### mta-sts-query
`mta-sts-query` is a command line tool which fetches and outputs domain MTA-STS policies. Intended to be used for debug purposes.
Synopsis:
```
$ mta-sts-query --help
usage: mta-sts-query [-h] [-v {debug,info,warn,error,fatal}]
domain [known_version]
positional arguments:
domain domain to fetch MTA-STS policy from
known_version latest known version (default: None)
optional arguments:
-h, --help show this help message and exit
-v {debug,info,warn,error,fatal}, --verbosity {debug,info,warn,error,fatal}
logging verbosity (default: warn)
```
### mta-sts-daemon
`mta-sts-daemon` is a daemon which provides external [TLS policy for Postfix SMTP client](http://www.postfix.org/TLS_README.html#client_tls_policy) via [socketmap interface](http://www.postfix.org/socketmap_table.5.html).
You may find useful systemd unit file to run daemon in [contrib/](https://github.com/Snawoot/postfix-mta-sts-resolver/tree/master/contrib).
Synopsis:
```
$ mta-sts-daemon --help
usage: mta-sts-daemon [-h] [-v {debug,info,warn,error,fatal}] [-c FILE]
[-l FILE] [--disable-uvloop]
optional arguments:
-h, --help show this help message and exit
-v {debug,info,warn,error,fatal}, --verbosity {debug,info,warn,error,fatal}
logging verbosity (default: info)
-c FILE, --config FILE
config file location (default: /etc/mta-sts-
daemon.yml)
-l FILE, --logfile FILE
log file location (default: None)
--disable-uvloop do not use uvloop even if it is available (default:
False)
```
#### Seamless restart/upgrade/reload and load balancing
By default mta-sts-daemon allows its multiple instances to share same port (on Linux/FreeBSD/Windows). Therefore, restart or upgrade of daemon can be performed seamlessly. Set of unit files for systemd in [contrib/](contrib/) directory implements "reload" by mean of running backup instance when main instance is getting restarted.
Also on Linux and FreeBSD, load distributed across all processes (with SO\_REUSEPORT and SO\_REUSEPORT\_LB respectively).
## MTA-STS Daemon configuration
See [configuration man page](https://github.com/Snawoot/postfix-mta-sts-resolver/blob/master/man/mta-sts-daemon.yml.5.adoc) and [config\_examples/](https://github.com/Snawoot/postfix-mta-sts-resolver/tree/master/config_examples) directory. Default config location is: `/etc/mta-sts-daemon.yml`, but it can be overridden with command line option `-c FILE`.
All options is self-explanatory, only exception is `strict_testing` option. If set to `true`, STS policy will be enforced even if domain announces `testing` MTA-STS mode. Useful for premature incorporation of MTA-STS against domains hesitating to go `enforce`. Please use with caution.
## Postfix configuration
SMTP client of your Postfix instance must be able to validate peer certificates. In order to achieve that, you have to ensure [`smtp_tls_CAfile`](http://www.postfix.org/postconf.5.html#smtp_tls_CAfile) or [`smtp_tls_CApath`](http://www.postfix.org/postconf.5.html#smtp_tls_CApath) points to system CA bundle. Otherwise you'll get `Unverified TLS connection` even for peers with valid certificate, and delivery failures for MTA-STS-enabled destinations. Also note: even enabled [`tls_append_default_CA`](http://www.postfix.org/postconf.5.html#tls_append_default_CA) will not work alone if both `smtp_tls_CAfile` and `smtp_tls_CApath` are empty.
Once certificate validation is enabled and your Postfix log shows "Trusted TLS connection ... " for destinations with valid certificates signed by public CA, you may enable MTA-STS by adding following line to `main.cf`:
```
smtp_tls_policy_maps = socketmap:inet:127.0.0.1:8461:postfix
```
If your configuration already has some TLS policy maps, just add MTA-STS socketmap to list of configured maps accordingly to [`smtp_tls_policy_maps`](http://www.postfix.org/postconf.5.html#smtp_tls_policy_maps) syntax. TLS policy tables are searched in the specified order until a match is found, so you may have table with local overrides of TLS policy prior to MTA-STS socketmap. This may be useful for skipping network lookup for well-known destinations or relaxing security for broken destinations, announcing MTA-STS support.
Reload Postfix after reconfiguration.
### Warning: MTA-STS policy overrides DANE TLS authentication
Due to Postfix's limitations, a resolved MTA-STS policy overrides DANE TLS authentication ([RFC 6698](https://www.rfc-editor.org/rfc/rfc6698)), because DANE is an internal feature of Postfix, and the postfix-mta-sts-resolver always responds with a ([`smtp_tls_policy_maps`](https://www.postfix.org/postconf.5.html#smtp_tls_policy_maps)) lookup result `secure` for [Secure server certificate verification](https://www.postfix.org/TLS_README.html#client_tls_secure).
* The resulting behaviour is against [RFC 8461, 2](https://www.rfc-editor.org/rfc/rfc8461#section-2):
> However, MTA-STS is designed not to interfere with DANE deployments when the two overlap; in particular, senders who implement MTA-STS validation MUST NOT allow MTA-STS Policy validation to override a failing DANE validation.
Domains implementing both MTA-STS and DANE probably want DANE to be preferred:
* DANE allows strict binding of certificates; the policy can authorize only a certain certificate or certificates from a certain CA. With MTA-STS, a certificate from any trusted CA is automatically trusted; [RFC 8461, 10.1](https://www.rfc-editor.org/rfc/rfc8461#section-10.1):
> SMTP MTA-STS relies on certificate validation via PKIX-based TLS identity checking [RFC6125]. Attackers who are able to obtain a
valid certificate for the targeted recipient mail service (e.g., by compromising a CA) are thus able to circumvent STS authentication.
* Based on DNSSEC, DANE not vulnerable to downgrade attack that could prevent policy discovery. MTA-STS security considerations acknowledges this weakness in [RFC 8461, 10.2](https://www.rfc-editor.org/rfc/rfc8461#section-10.2):
> Since MTA-STS uses DNS TXT records for policy discovery, an attacker who is able to block DNS responses can suppress the discovery of an
MTA-STS Policy, making the Policy Domain appear not to have an MTA-STS Policy.
> Resistance to downgrade attacks of this nature -- due to the ability to authoritatively determine "lack of a record" even for non-participating recipients -- is a feature of DANE, due to its use of DNSSEC for policy discovery.
* The postfix-mta-sts-resolver does not intent to implement policy lookups for DANE, and responses other than `secure` with `match=` would not verify the TLS certificate as required by [RFC 8461, 4,2](https://www.rfc-editor.org/rfc/rfc8461#section-4.2).
If you wish to meet this requirement:
* List a DANE policy resolver responding with `dane-only` (for [Mandatory DANE](https://www.postfix.org/TLS_README.html#client_tls_dane)) before postfix-mta-sts-resolver in `smtp_tls_policy_maps` lookup table list.
* Alternatively, you could use a static lookup table for domains known to implement both MTA-STS & DANE, e.g.,
```
smtp_tls_policy_maps = hash:/etc/postfix/tls_policy,socketmap:inet:127.0.0.1:8461:postfix
```
## Operability check
Assuming default MTA-STA daemon configuration. Following command:
```bash
/usr/sbin/postmap -q dismail.de socketmap:inet:127.0.0.1:8461:postfix
```
should return something like:
```
secure match=mx1.dismail.de
```
Postfix log should show `Verified TLS connection established to ...` instead of `Untrusted ...` or `Trusted TLS connection established to ...` when mail is getting sent to MTA-STS-enabled domain.
## Special cases of deployment
### Systems without Python 3.5+
Some people may find convenient to install latest python from source into `/opt` directory. This way you can have separate python installation not interfering with system packages by any means. Download latest python source from [python.org](https://www.python.org/), unpack and run in unpacked source directory:
```bash
./configure --prefix=/opt --enable-optimizations && make -j $[ $(nproc) + 1 ] && make test && sudo make install
```
Python binaries will be available in `/opt/bin`, including `pip3`. You may install `postfix-mta-sts-resolver` using `/opt/bin/pip3` without interference with any system packages:
```bash
sudo /opt/bin/pip3 install postfix-mta-sts-resolver[sqlite,redis]
```
Executable files of `postfix-mta-sts-resolver` will be available in `/opt/bin/mta-sts-query` and `/opt/bin/mta-sts-daemon`
### Building virtualenv
Run `make` in project directory in order to build virtualenv. As result of it, new directory `venv` shall appear. `venv` contains interpreter and all required dependencies, i.e. encloses package with dependencies in separate environment. It is possible to specify alternative path where virtualenv directory shall be placed. Specify VENV variable for `make` command. Example:
```bash
make VENV=~/postfix-mta-sts-resolver
```
Such virtual environment can be moved to another machine of similar type (as far python interpreter is compatible with new environment). If virtualenv is placed into same location on new machine, application can be run this way:
```bash
venv/bin/mta-sts-daemon
```
Otherwise, some hacks required. First option - explicitly call virtualenv interpreter:
```bash
venv/bin/python venv/bin/mta-sts-daemon
```
Second option - specify new path in shebang of scripts installed in virtualenv. It is recommended to build virtualenv at same location which app shall occupy on target system.
## Credits
Inspired by [this forum thread](http://postfix.1071664.n5.nabble.com/MTA-STS-when-td95086.html).
%package help
Summary: Development documents and examples for postfix-mta-sts-resolver
Provides: python3-postfix-mta-sts-resolver-doc
%description help
[](https://travis-ci.org/Snawoot/postfix-mta-sts-resolver) [](https://travis-ci.org/Snawoot/postfix-mta-sts-resolver) [](https://pypistats.org/packages/postfix-mta-sts-resolver) [](https://pypi.org/project/postfix-mta-sts-resolver/) [](https://pypi.org/project/postfix-mta-sts-resolver/) [](https://pypi.org/project/postfix-mta-sts-resolver/) [](https://snapcraft.io/postfix-mta-sts-resolver) 
Daemon which provides TLS client policy for Postfix via socketmap, according to domain MTA-STS policy.
Current support of [RFC 8461](https://www.rfc-editor.org/rfc/rfc8461) is limited:
* [MTA-STS policy overrides DANE TLS authentication](#warning-mta-sts-policy-overrides-dane-tls-authentication) against [RFC 8461, 2](https://www.rfc-editor.org/rfc/rfc8461#section-2).
* Daemon lacks some minor features:
* Fetch error reporting.
* Fetch ratelimit (but actual fetch rate partially restricted with `cache_grace` config option).
Server has configurable cache backend which allows to store cached STS policies in memory (`internal`), file (`sqlite`) or in Redis database (`redis`).
## Requirements
* Postfix 3.4+ (or Postfix 2.10+ if missing Postfix SNI feature is tolerable. In that case you have to set zone option `require_sni` to `false` in MTA-STS daemon config)
* Python 3.5.3+ (see ["Systems without Python 3.5+"](#systems-without-python-35) below if you haven't one, or use Docker installation method)
* aiodns
* aiohttp
* aiosqlite
* redis-py
* PyYAML
* (optional) uvloop
All dependency packages installed automatically if this package is installed via pip.
## Installation
### Method 1. System-wide install from PyPI (recommended for humans)
Run:
```bash
sudo python3 -m pip install postfix-mta-sts-resolver[redis,sqlite]
```
If you don't need `redis` or `sqlite` support, you may omit one of them in square brackets. If you don't need any of them and you plan to use internal cache without persistence, you should also omit square brackets.
Package scripts shall be available in standard executable locations upon completion.
#### pip user install
All pip invocations can be run with `--user` option of `pip` installer. In this case superuser privileges are not required and package(s) are getting installed into user home directory. Usually, script executables will appear in `~/.local/bin`.
### Method 2. System-wide install from project source
Run in project directory:
```bash
sudo python3 -m pip install .[redis,sqlite]
```
If you don't need `redis` or `sqlite` support, you may omit one of them in square brackets. If you don't need any of them and you plan to use internal cache without persistence, you should also omit square brackets.
Package scripts shall be available in standard executable locations upon completion.
### Method 3. Install into virtualenv
See ["Building virtualenv"](#building-virtualenv)
### Method 4. Docker
Run
```bash
docker volume create mta-sts-cache
docker run -d \
--security-opt no-new-privileges \
-v mta-sts-cache:/var/lib/mta-sts \
-p 127.0.0.1:8461:8461 \
--restart unless-stopped \
--name postfix-mta-sts-resolver \
yarmak/postfix-mta-sts-resolver
```
Daemon will be up and running, listening on local interface on port 8461. Default configuration baked into docker image uses SQLite for cache stored in persistent docker volume. You may override this configuration with your own config file by mapping it into container with option `-v my_config.yml:/etc/mta-sta-daemon.yml`.
### Method 5. Snap Store
[](https://snapcraft.io/postfix-mta-sts-resolver)
```bash
sudo snap install postfix-mta-sts-resolver
```
NOTE: in snap layout `mta-sta-daemon` program is named `postfix-mta-sts-resolver.daemon` and `mta-sts-query` is named `postfix-mta-sts-resolver.query`.
### Common installation notes
See also [contrib/README.md](https://github.com/Snawoot/postfix-mta-sts-resolver/tree/master/contrib/README.md) for RHEL/OEL/Centos and FreeBSD notes.
See [contrib/](https://github.com/Snawoot/postfix-mta-sts-resolver/tree/master/contrib) for example of systemd unit file suitable to run daemon under systemd control.
## Running
This package provides two executables available after installation in respective locations.
### mta-sts-query
`mta-sts-query` is a command line tool which fetches and outputs domain MTA-STS policies. Intended to be used for debug purposes.
Synopsis:
```
$ mta-sts-query --help
usage: mta-sts-query [-h] [-v {debug,info,warn,error,fatal}]
domain [known_version]
positional arguments:
domain domain to fetch MTA-STS policy from
known_version latest known version (default: None)
optional arguments:
-h, --help show this help message and exit
-v {debug,info,warn,error,fatal}, --verbosity {debug,info,warn,error,fatal}
logging verbosity (default: warn)
```
### mta-sts-daemon
`mta-sts-daemon` is a daemon which provides external [TLS policy for Postfix SMTP client](http://www.postfix.org/TLS_README.html#client_tls_policy) via [socketmap interface](http://www.postfix.org/socketmap_table.5.html).
You may find useful systemd unit file to run daemon in [contrib/](https://github.com/Snawoot/postfix-mta-sts-resolver/tree/master/contrib).
Synopsis:
```
$ mta-sts-daemon --help
usage: mta-sts-daemon [-h] [-v {debug,info,warn,error,fatal}] [-c FILE]
[-l FILE] [--disable-uvloop]
optional arguments:
-h, --help show this help message and exit
-v {debug,info,warn,error,fatal}, --verbosity {debug,info,warn,error,fatal}
logging verbosity (default: info)
-c FILE, --config FILE
config file location (default: /etc/mta-sts-
daemon.yml)
-l FILE, --logfile FILE
log file location (default: None)
--disable-uvloop do not use uvloop even if it is available (default:
False)
```
#### Seamless restart/upgrade/reload and load balancing
By default mta-sts-daemon allows its multiple instances to share same port (on Linux/FreeBSD/Windows). Therefore, restart or upgrade of daemon can be performed seamlessly. Set of unit files for systemd in [contrib/](contrib/) directory implements "reload" by mean of running backup instance when main instance is getting restarted.
Also on Linux and FreeBSD, load distributed across all processes (with SO\_REUSEPORT and SO\_REUSEPORT\_LB respectively).
## MTA-STS Daemon configuration
See [configuration man page](https://github.com/Snawoot/postfix-mta-sts-resolver/blob/master/man/mta-sts-daemon.yml.5.adoc) and [config\_examples/](https://github.com/Snawoot/postfix-mta-sts-resolver/tree/master/config_examples) directory. Default config location is: `/etc/mta-sts-daemon.yml`, but it can be overridden with command line option `-c FILE`.
All options is self-explanatory, only exception is `strict_testing` option. If set to `true`, STS policy will be enforced even if domain announces `testing` MTA-STS mode. Useful for premature incorporation of MTA-STS against domains hesitating to go `enforce`. Please use with caution.
## Postfix configuration
SMTP client of your Postfix instance must be able to validate peer certificates. In order to achieve that, you have to ensure [`smtp_tls_CAfile`](http://www.postfix.org/postconf.5.html#smtp_tls_CAfile) or [`smtp_tls_CApath`](http://www.postfix.org/postconf.5.html#smtp_tls_CApath) points to system CA bundle. Otherwise you'll get `Unverified TLS connection` even for peers with valid certificate, and delivery failures for MTA-STS-enabled destinations. Also note: even enabled [`tls_append_default_CA`](http://www.postfix.org/postconf.5.html#tls_append_default_CA) will not work alone if both `smtp_tls_CAfile` and `smtp_tls_CApath` are empty.
Once certificate validation is enabled and your Postfix log shows "Trusted TLS connection ... " for destinations with valid certificates signed by public CA, you may enable MTA-STS by adding following line to `main.cf`:
```
smtp_tls_policy_maps = socketmap:inet:127.0.0.1:8461:postfix
```
If your configuration already has some TLS policy maps, just add MTA-STS socketmap to list of configured maps accordingly to [`smtp_tls_policy_maps`](http://www.postfix.org/postconf.5.html#smtp_tls_policy_maps) syntax. TLS policy tables are searched in the specified order until a match is found, so you may have table with local overrides of TLS policy prior to MTA-STS socketmap. This may be useful for skipping network lookup for well-known destinations or relaxing security for broken destinations, announcing MTA-STS support.
Reload Postfix after reconfiguration.
### Warning: MTA-STS policy overrides DANE TLS authentication
Due to Postfix's limitations, a resolved MTA-STS policy overrides DANE TLS authentication ([RFC 6698](https://www.rfc-editor.org/rfc/rfc6698)), because DANE is an internal feature of Postfix, and the postfix-mta-sts-resolver always responds with a ([`smtp_tls_policy_maps`](https://www.postfix.org/postconf.5.html#smtp_tls_policy_maps)) lookup result `secure` for [Secure server certificate verification](https://www.postfix.org/TLS_README.html#client_tls_secure).
* The resulting behaviour is against [RFC 8461, 2](https://www.rfc-editor.org/rfc/rfc8461#section-2):
> However, MTA-STS is designed not to interfere with DANE deployments when the two overlap; in particular, senders who implement MTA-STS validation MUST NOT allow MTA-STS Policy validation to override a failing DANE validation.
Domains implementing both MTA-STS and DANE probably want DANE to be preferred:
* DANE allows strict binding of certificates; the policy can authorize only a certain certificate or certificates from a certain CA. With MTA-STS, a certificate from any trusted CA is automatically trusted; [RFC 8461, 10.1](https://www.rfc-editor.org/rfc/rfc8461#section-10.1):
> SMTP MTA-STS relies on certificate validation via PKIX-based TLS identity checking [RFC6125]. Attackers who are able to obtain a
valid certificate for the targeted recipient mail service (e.g., by compromising a CA) are thus able to circumvent STS authentication.
* Based on DNSSEC, DANE not vulnerable to downgrade attack that could prevent policy discovery. MTA-STS security considerations acknowledges this weakness in [RFC 8461, 10.2](https://www.rfc-editor.org/rfc/rfc8461#section-10.2):
> Since MTA-STS uses DNS TXT records for policy discovery, an attacker who is able to block DNS responses can suppress the discovery of an
MTA-STS Policy, making the Policy Domain appear not to have an MTA-STS Policy.
> Resistance to downgrade attacks of this nature -- due to the ability to authoritatively determine "lack of a record" even for non-participating recipients -- is a feature of DANE, due to its use of DNSSEC for policy discovery.
* The postfix-mta-sts-resolver does not intent to implement policy lookups for DANE, and responses other than `secure` with `match=` would not verify the TLS certificate as required by [RFC 8461, 4,2](https://www.rfc-editor.org/rfc/rfc8461#section-4.2).
If you wish to meet this requirement:
* List a DANE policy resolver responding with `dane-only` (for [Mandatory DANE](https://www.postfix.org/TLS_README.html#client_tls_dane)) before postfix-mta-sts-resolver in `smtp_tls_policy_maps` lookup table list.
* Alternatively, you could use a static lookup table for domains known to implement both MTA-STS & DANE, e.g.,
```
smtp_tls_policy_maps = hash:/etc/postfix/tls_policy,socketmap:inet:127.0.0.1:8461:postfix
```
## Operability check
Assuming default MTA-STA daemon configuration. Following command:
```bash
/usr/sbin/postmap -q dismail.de socketmap:inet:127.0.0.1:8461:postfix
```
should return something like:
```
secure match=mx1.dismail.de
```
Postfix log should show `Verified TLS connection established to ...` instead of `Untrusted ...` or `Trusted TLS connection established to ...` when mail is getting sent to MTA-STS-enabled domain.
## Special cases of deployment
### Systems without Python 3.5+
Some people may find convenient to install latest python from source into `/opt` directory. This way you can have separate python installation not interfering with system packages by any means. Download latest python source from [python.org](https://www.python.org/), unpack and run in unpacked source directory:
```bash
./configure --prefix=/opt --enable-optimizations && make -j $[ $(nproc) + 1 ] && make test && sudo make install
```
Python binaries will be available in `/opt/bin`, including `pip3`. You may install `postfix-mta-sts-resolver` using `/opt/bin/pip3` without interference with any system packages:
```bash
sudo /opt/bin/pip3 install postfix-mta-sts-resolver[sqlite,redis]
```
Executable files of `postfix-mta-sts-resolver` will be available in `/opt/bin/mta-sts-query` and `/opt/bin/mta-sts-daemon`
### Building virtualenv
Run `make` in project directory in order to build virtualenv. As result of it, new directory `venv` shall appear. `venv` contains interpreter and all required dependencies, i.e. encloses package with dependencies in separate environment. It is possible to specify alternative path where virtualenv directory shall be placed. Specify VENV variable for `make` command. Example:
```bash
make VENV=~/postfix-mta-sts-resolver
```
Such virtual environment can be moved to another machine of similar type (as far python interpreter is compatible with new environment). If virtualenv is placed into same location on new machine, application can be run this way:
```bash
venv/bin/mta-sts-daemon
```
Otherwise, some hacks required. First option - explicitly call virtualenv interpreter:
```bash
venv/bin/python venv/bin/mta-sts-daemon
```
Second option - specify new path in shebang of scripts installed in virtualenv. It is recommended to build virtualenv at same location which app shall occupy on target system.
## Credits
Inspired by [this forum thread](http://postfix.1071664.n5.nabble.com/MTA-STS-when-td95086.html).
%prep
%autosetup -n postfix-mta-sts-resolver-1.3.0
%build
%py3_build
%install
%py3_install
install -d -m755 %{buildroot}/%{_pkgdocdir}
if [ -d doc ]; then cp -arf doc %{buildroot}/%{_pkgdocdir}; fi
if [ -d docs ]; then cp -arf docs %{buildroot}/%{_pkgdocdir}; fi
if [ -d example ]; then cp -arf example %{buildroot}/%{_pkgdocdir}; fi
if [ -d examples ]; then cp -arf examples %{buildroot}/%{_pkgdocdir}; fi
pushd %{buildroot}
if [ -d usr/lib ]; then
find usr/lib -type f -printf "/%h/%f\n" >> filelist.lst
fi
if [ -d usr/lib64 ]; then
find usr/lib64 -type f -printf "/%h/%f\n" >> filelist.lst
fi
if [ -d usr/bin ]; then
find usr/bin -type f -printf "/%h/%f\n" >> filelist.lst
fi
if [ -d usr/sbin ]; then
find usr/sbin -type f -printf "/%h/%f\n" >> filelist.lst
fi
touch doclist.lst
if [ -d usr/share/man ]; then
find usr/share/man -type f -printf "/%h/%f.gz\n" >> doclist.lst
fi
popd
mv %{buildroot}/filelist.lst .
mv %{buildroot}/doclist.lst .
%files -n python3-postfix-mta-sts-resolver -f filelist.lst
%dir %{python3_sitelib}/*
%files help -f doclist.lst
%{_docdir}/*
%changelog
* Tue May 30 2023 Python_Bot <Python_Bot@openeuler.org> - 1.3.0-1
- Package Spec generated
|
