foxcpp / foxcpp/maddy

Error Message should Validate Username is in Domain for Authentication Error

Ouverte
#649 1 commentaire 0 réactions 0 personnes assignées Voir sur GitHub
bug
Langage dominant
Go
Étoiles
6.1k
Forks
327
Métriques de merge des PR
Aucune PR mergée en 30 j

Description

# Describe the bug

I am setting up and testing Maddy for the first time.

It appears I made a typo and missed off a character in our domain when testing via Thunderbird. This means that Thunderbird was trying to authenticate with a user whose email address' domain did no match the domain Maddy was configured to use.

From the docs, as far as I understand, all accounts must use and authenticate with a full email address, and I presume this ought to be an address under the domain Maddy is configured for. Therefore, an address under a different domain would be an error (please correct me if I am wrong). If this is the case, then I feel a different error message would be helpful - this is not so much an error in authenticating a user, as one of an invalid user. I think, if such addresses would be illegal, then testing the given username against the mailserver's domain and outputting a message specifically for this scenario could not only help in finding configuration mistakes, but also in identifying attempted attacks and the like - if someone were flooding the server with invalid addresses, we could filter those out easily.

Thanks!

# Steps to reproduce

Set up as container for 0.7.0 as in instructions
```
maddy creds create postmaster@example.org
maddy imap-acct create postmaster@example.org
```

Accidentally send SMTP message using account `postmaster@example.or`, or some other typo. Or try to sync with IMAP.

# Log files

```
imap: authentication failed {"reason":"no auth. provider accepted creds, last err: unknown credentials","src_ip":"1.2.3.4:12345","username":"postmaster.example.or"}
```
[Location]( https://github.com/foxcpp/maddy/blob/master/internal/auth/sasl.go#L114 )

# Configuration file
Basically the same as the defualt, all we have changed thus far is TLS certificate path and domain name.

# Environment information

* maddy version: 0.7.0

Guide de contribution

Ouvrir le guide de contribution

Piste de recherche

Commencez dans internal/auth/sasl.go vers la ligne 114 et reproduisez la tentative d’authentification avec un nom d’utilisateur dont le domaine diffère du domaine configuré. Déterminez le comportement attendu et le libellé de l’erreur pour ce cas ; le travail est terminé lorsque le comportement est couvert et que le message qui en résulte distingue un domaine invalide d’identifiants génériques invalides.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
go
Domaine
authentication
Type d'issue
Bug
Difficulté
3/5
Temps estimé
1-2 jours
Activité
À l'abandon
Clarté
Plutôt claire
Accessibilité débutants
35/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.