fix: harden Haraka TLS (renegotiation DoS + untrusted cert chain) - #8
Draft
taobojlen wants to merge 2 commits into
Draft
fix: harden Haraka TLS (renegotiation DoS + untrusted cert chain)#8taobojlen wants to merge 2 commits into
taobojlen wants to merge 2 commits into
Conversation
Two scanner findings on app.shroud.email:25, both in the SMTP (Haraka)
TLS path:
1. Client-initiated TLS renegotiation allowed (DoS). Haraka tls_socket
passes secureOptions from tls.ini [main] straight to
tls.createSecureContext. Set secureOptions=1073741824
(crypto.constants.SSL_OP_NO_RENEGOTIATION) to refuse renegotiation,
closing the CPU-exhaustion vector.
2. Untrusted certificate presented on port 25. The daily cron bundle
appended a hardcoded, now-expired intermediate (lets-encrypt-r4.pem,
expired 2025-09-15) to Caddy fullchain, producing a broken chain.
Caddy {domain}.crt is already leaf + intermediates; copy it verbatim
and drop the stale intermediate. Also run the bundle at container
startup (not only daily) so a fresh pem_certs volume is populated
before Haraka first STARTTLS, and no-op gracefully when Caddy has not
issued yet.
* feat: add Cap + valkey services and document Cap setup
* fix: correct Cap site-key auth flow in hosting docs
The README and example.env used 'Authorization: Bot $CAP_ADMIN_KEY' to
create a site key, but Cap's Bot scheme authenticates against
Valkey-stored API keys, not the ADMIN_KEY env var — so that curl always
401s. The correct flow: POST /auth/login with the admin_key to obtain a
session token + hash, then POST /server/keys with a Bearer token
(base64 of {token,hash}). Verified live against tiago2/cap:latest.
Also notes that the production 'cap' service has no host port mapping,
so the curl must run via a temporary ports override or 'docker compose
exec' on the compose network (http://cap:3000).
* fix: make CAP_INSTANCE_URL browser-reachable in hosting config
The final whole-branch review found a production-breaking defect: the
hosting compose hardcoded CAP_INSTANCE_URL=http://cap:3000, but that
value is rendered into the browser's <cap-widget data-cap-api-endpoint>.
http://cap:3000 is Docker-network-internal (unresolvable from a browser)
and would be blocked as mixed content on an https://APP_DOMAIN page.
With Cap 'enabled' the widget would never solve, fail-closing every
register/login/reset POST for real users.
Fix: make the compose use ${CAP_INSTANCE_URL} (not the hardcoded
internal URL), document that it MUST be a browser-reachable HTTPS URL,
and add it to example.env with guidance. The cap service stays
internal-only; the self-hoster puts it behind their own ingress
(e.g. a Caddy route) and points CAP_INSTANCE_URL at the public URL.
* fix: use base64 -w0 so Bearer token stays single-line on Linux
* fix: set valkey maxmemory so noeviction policy engages
* chore: pin cap image to major version 3
* update README
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes two security scanner findings on
app.shroud.email:25(the Haraka SMTP TLS path):1. Client-initiated TLS renegotiation (DoS)
haraka/haraka_config/config/tls.ini— setsecureOptions=1073741824(=crypto.constants.SSL_OP_NO_RENEGOTIATION). Haraka'stls_socket.jspassessecureOptionsfromtls.ini [main]straight totls.createSecureContext/TLSSocket, so this refuses renegotiation on every STARTTLS upgrade (ports 25 and 465), closing the CPU-exhaustion vector where an attacker forces repeated handshakes.2. Untrusted certificate on port 25
cron/bundle_certs.sh+cron/Dockerfile— the daily bundle appended a hardcoded, now-expired Let's Encrypt intermediate (lets-encrypt-r4.pem, expired 2025-09-15) to Caddy's fullchain, producingleaf + correct_intermediate + expired_R4→ broken chain → untrusted. Caddy's{domain}.crtis already the full chain (leaf + intermediates); copy it verbatim and delete the stale intermediate. Also:pem_certsvolume is populated before Haraka's first STARTTLS.exit 0) when Caddy hasn't issued yet, so a cold boot where ACME is still running doesn't crash crond.Test plan
docker compose build cron && docker compose up -d --build cron haraka— verify Haraka starts and presents a valid chain on port 25.openssl s_client -starttls smtp -connect app.shroud.email:25 -showcerts </dev/null | openssl x509 -noout -issuer -subject— issuer is a current Let's Encrypt intermediate (R10/R11), not R4.openssl s_client -starttls smtp -connect app.shroud.email:25 -CAfile /etc/ssl/cert.pem -verify_return_error </dev/null—Verify return code: 0 (ok).printf 'R\n' | openssl s_client -starttls smtp -connect app.shroud.email:25) returns an alert/reset while the initial handshake still succeeds.app.shroud.email:25; both findings clear.Notes
secureOptionsdoes not inherit into Haraka's[outbound]section, but renegotiation isn't a DoS risk on outbound (we're the client), so this is intentional.