#haraka

_smf_: would you recommend it over SA in production at this point?

No - I'm not using it in production yet myself.

But then for your likely volumes - I don't recommend SA either.

wtf is going on on the haraka mailing list. lol.

baudehlo: LMAO - looks like the blind leading the blind.

_smf_: heh - if not SA and not rspamd... Are there other options? MessageSniffer?

MessageSniffer is what I would go with.

hmmm....

unrelated - I run across the commits for not cuddling else statements, and I'm like okay, weird, but purely an opinion. But then I see a bunch of If (foo) do_whatever() single line if statements, and think "that's messed up"

embrace the brace.

=)

hi guys

been digging through the haraka code yesteday, i had some basic questions

did i understand correctly that 'relaying' means whether to relay or not (and not that relaying is in progress)

from what i can tell, relaying is set via the relay plugins or auth. these plugins give haraka the permission to relay the mail

is that a good way to think about the flag ?

girishr: yes

When connection.relaying = true; the connection is allowed to relay.

_smf_: is there also a notion of inbound mail vs outbound mail somehow ?

specifically for plugins, let's say i have a dkim checker plugin

how does it know if this mail is coming in via port 25 (say) or it came via the mail submission port ?

i cannot find the logic in dkim_verifier.js which makes me think that maybe plugins are not aware of this

as in, one should not add dkim_verifier if haraka is meant for outbound mail

is that correct :-) ?

No

dkim_verifier is for verifying incoming signatures - if a message is being sent out, then there's no harm in verifying a signature in if (if it exists).

And dkim_sign only runs on hook_queue_outbound which is only run if connection.relaying = true.

hook_queue is run for when connection.relaying = false (e.g. the message is inbound).

ok thanks, got that part

but dkim was a bad example

what i am trying to do is to make sure that a the user has authenticated before relaying

how does a plugin stop the connection if relaying is false and not authenticated

specifically, https://github.com/haraka/Haraka/blob/master/co...

the port numbers are hard coded there. the haraka we have runs as non-root and does not bind to those ports inside the container

mm. i think that comment is misleading given your previous explanation

it should actually say "Require relaying flag on connections" because it's not just auth that sets the relaying flag

_smf_: do you prefer changing the docs or changing the config file for https://github.com/haraka/Haraka/pull/1441 ?

girishr: if you're not relaying (i.e. outbound) then it's assumed to be inbound mail, and something has to approve the recipients - some kind of rcpt hook. A lot of people use rcpt_to.in_host_list for that.

baudehlo, did you see my questions about the TLS plugin ... 18 hours ago?

nope

Why not just use symlinks to do what you want?

I mean here's mine:

lrwxrwxrwx 1 root root 49 May 5 01:00 tls_cert.pem -> /etc/letsencrypt/live/emailitin.com/fullchain.pem

lrwxrwxrwx 1 root root 47 May 5 01:00 tls_key.pem -> /etc/letsencrypt/live/emailitin.com/privkey.pem

i think i understand now. so in my plugin, if i wanted to check if the client has auth'ed, i would simply look into connection.results.get('auth')

If you know you're only using AUTH to set connection.relaying, then you can just use that.

baudehlo, that's a fine workaround, I'm just wondering if we could obviate the need for a workaround here

chazomaticus: we could, but is it necessary?

¯\_(ツ)_/¯

it would put haraka in line with many other pieces of software that do TLS, in that most servers I've ever configured let you specify where the certs live

right now it seems to strike our systems people as an oversight on haraka's part

have your systems people never used symlinks? ;-)

zing!

man, I don't want to talk about it ;)

Anyway it's fine to do a PR for it - but it won't go into 2.8

bear in mind tls.ini is used in more than just plugins/tls

cool, cool

(outbound and smtp_client too)

baudehlo: sorry, still not getting one part. if haraka listens on port 25 and port 587. my plugin has rcpt_to hook. if relaying is false, this could mean the mail is a) incoming or b) auth was never done in 587. how do i distinguish ?

thx baudehlo

girishr: you wouldn't. Why would you care?

if relaying is false on 587 it'll tell you to FOAD anyway.

baudehlo: so i want to enforce auth is done before relaying. the current auth plugins don't enforce it

"auth is done before relaying" - that phrase makes no sense.

baudehlo: is there a method for enforcing mandatory TLS from certain hosts already built in, or is that something I'd need to check via a plugin/whitelist I build.

right, so the other tangential issue is i don't run on port 587 and there is this hardcoded check in connection.js

EyePulp: you have to write that yourself - I did that for emailitin

girishr: so why is that check an issue?

It's just there to enforce the RFCs.

baudehlo: roger that. What hook do you check at if I can ask?

rcpt.

danke

It's literally this:

if (user.require_tls && !connection.using_tls) {

return next(DENY, "This email address requires that email is sent over a secure connection");

}

baudehlo: so let me explain it like this. let's say i have haraka on port 25 (incoming) and port 2500 (relay). for the relay port i have an auth plugin setup

heh

I'll need weeks to study and digest that.

I know right.

I'm giving away my private secret sauce. Emailitin is going to go out of business.

baudehlo: it also turned out (maybe bad config from my side), that i allowed relaying via relay_acl from 172.x.x.x. this relay plugin ended up setting the relaying flag based on the IP

the end result was that: clients from 172.x.x.x were able to relay without auth despite auth_ldap

girishr: why not just run two Harakas?

of course, that is what the confg says and haraka is doing what i told it :-)

so don't use relay_acl. Lol.

yes, i removed acl and now it works

but i am just trying to understand here what the design of haraka is :-)

i think the confusion for me was that haraka allows email to be sent if even _one_ of the plugins allowed it

s/sent/relayed

baudehlo: regarding https://github.com/haraka/Haraka/pull/1440, it's the same as what is in flat_file. do you think they are different ?

No... Though there should be a config option for that frankly, as it's dangerous. Your local users can sniff passwords on the network.

i think i agree. i was going to add a config option when i noticed that flat_file had it