mirror of
https://blitiri.com.ar/repos/chasquid
synced 2026-10-29 15:02:30 +00:00
Alberto Bertogli
6b64c9ccba
If chasquid runs out of file descriptors, that can cause problems accepting connections, writing to the queue, and even reloading configs. Some of those errors are fatal, as they should not happen under normal conditions. Since a remote client can open a lot of connections, this can end up consuming all file descriptors, and resulting in a denial of service. To reduce the impact of that kind of event, this patch makes chasquid limit the number of concurrent SMTP connections to half the maximum number of file descriptors. Connections over that limit will get closed immediately. The server will log (rate-limited) when such event happens, and new metrics make these events visible through monitoring too. This approach complements the previous patch, which made the server retry Accept errors, to reduce the impact of connection overloads. This mainly affects deployments with low file descriptor limits; most modern deployments have very high limits by default, so they are unlikely to experience this problem in the first place. Users who have to be very defensive can deploy OS-level safeguards (such as firewall rules to limit number of connections, etc.) which are more effective and tunable. Thanks to John JEAN <john@wargan.com> for finding and reporting this problem. The detailed report can be found in https://johnjean.io/advisories/chasquid-unauthenticated-remote-dos/.
chasquid
chasquid is an SMTP (email) server with a focus on simplicity, security, and ease of operation.
It is designed mainly for individuals and small groups.
It's written in Go, and distributed under the Apache license 2.0.
Features
- Easy
- Easy to configure.
- Hard to mis-configure in ways that are harmful or insecure (e.g. no open relay, or clear-text authentication).
- Monitoring HTTP server, with exported variables and tracing to help debugging.
- Integrated with Debian, Ubuntu, Arch, and Alpine.
- Supports using Dovecot for authentication.
- Useful
- Secure
- Tracking of per-domain TLS support, prevents connection downgrading.
- Multiple TLS certificates.
- Easy integration with Let's Encrypt.
- SPF and MTA-STS checking.
- DKIM support (signing and verification).
Documentation
The how-to guide and the installation guide are the best starting points on how to install, configure and run chasquid.
You will find all documentation here.
Contact
If you have any questions, comments or patches, please send them to the mailing
list,
chasquid@googlegroups.com.
To subscribe, send an email to chasquid+subscribe@googlegroups.com.
Security issues can be reported privately to albertito@blitiri.com.ar.
Bug reports and pull requests on GitHub are also welcome.
You can also reach out via IRC, #chasquid on OFTC.