templates: postfix: forbid_bare_newline on external port

This patch addresses the smtp-smuggling vulnerability [0,1], with the
recommended fix by postfix upstream [2].

Disallowing bare linefeeds instead of crlf should not be a problem
with any standards-compliant MTA.
The internal port allows bare linefeed, since internal clients
(mail-scripts written ages ago, some ancient embedded systems) might
not adhere to the protocol. Additionally the mail-proxy allowlist (the
ip and cidr entries, are the only ones applicable here) is also added
to the global exceptions.

Currently the updated postfix-packages are not published in the
security repositories but only as stable updates [3,4]
However postfix ignores unknown configuration parameters and only
prints a warning to the journal - so the changes to the templates can
already be shipped, for those users who have the stable-updates mirror
enabled.

Tested with the current postfix in bookworm, then updating to the one
in bookworm-updates and running tests with netcat (verified with nc -C
that it still works with the correct line-termination):
```
$ nc -6  pmgtest 25
220 pmgtest.proxmox.com ESMTP Proxmox
EHLO pmgsender.proxmox.com
521 5.5.2 pmgtest.proxmox.com Error: bare <LF> received
```

[0] https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
[1] https://nvd.nist.gov/vuln/detail/CVE-2023-51764
[2] https://www.postfix.org/smtp-smuggling.html
[3] https://security-tracker.debian.org/tracker/CVE-2023-51764
[4] https://lists.debian.org/debian-stable-announce/2023/12/msg00004.html

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>

diff --git a/src/templates/main.cf.in b/src/templates/main.cf.in
index c689af303180c1eb03ed6a8f573f371dd9dd4443..3b56355b2b4e1c5ee9cb2ceb390e7fbd063b0db2 100644 (file)
--- a/src/templates/main.cf.in
+++ b/src/templates/main.cf.in
@@ -101,6 +101,11 @@ unverified_recipient_reject_code = [% pmg.mail.verifyreceivers %]
 
 smtpd_data_restrictions = reject_unauth_pipelining
 
+smtpd_forbid_bare_newline = yes
+smtpd_forbid_bare_newline_exclusions =
+        $mynetworks,
+        cidr:/etc/postfix/clientaccess
+
 smtpd_client_connection_count_limit = [% pmg.mail.conn_count_limit %]
 smtpd_client_connection_rate_limit = [% pmg.mail.conn_rate_limit %]
 smtpd_client_message_rate_limit = [% pmg.mail.message_rate_limit %]

diff --git a/src/templates/master.cf.in b/src/templates/master.cf.in
index 7d60d1d38dd87a45e43ec08d0e68c45c4818dae2..674767d6db272e11941c251aec852bb5fe086c6e 100644 (file)
--- a/src/templates/master.cf.in
+++ b/src/templates/master.cf.in
@@ -92,6 +92,7 @@ scan      unix  -       -       n       -       [% pmg.mail.max_filters %]
   -o smtpd_client_restrictions=
   -o smtpd_sender_restrictions=
   -o smtpd_data_restrictions=
+  -o smtpd_forbid_bare_newline = no
 
 [% pmg.mail.ext_port %]       inet  n -       -       -       1 postscreen