The release of the chasquid SMTP server version 1.13 has been introduced, focusing on ease of setup and security. Chasquid is primarily designed for use in standard projects where the flexibility and functionality of Postfix and Exim are excessive. The project's code is written in Go and is distributed under the Apache 2.0 license.
Main features:
- Simplified setup system. The configuration of the SMTP server consists of the chasquid.conf file with basic parameters and a set of directories named after the managed domain names, within which files related to the domain are placed for mapping email addresses to users, parameters for the database to store the user base, TLS certificates, etc. The chasquid-util utility is used to create and edit the user database for each domain.
- A hook system is used for filtering emails and discarding spam, allowing a handler to be bound that is called at the final stage of email receipt. The following ready-made handlers are provided: greylist for maintaining 'grey lists' (issuing a temporary error on the first request from unfamiliar servers) using greylistd, spamc and rspamc for blocking spam using Spamassassin and rspamd, clamdscan for virus filtering via ClamAV, and dkimsign for DKIM verification using driusan/dkim or dkimpy.
- Protection against configuration errors that lead to security issues such as open relays and plaintext authentication.
- The presence of a specialized HTTP server for monitoring and debugging the operation of the SMTP server.
- Availability of ready-made packages for Debian, Ubuntu, and Arch Linux distributions.
- Support for integration with the Dovecot IMAP server for user authentication.
- The ability to use virtual mail domains with their own user databases and redirects.
- Support for discarding parts of an address, for instance, processing 'user+something@domain' as 'user@domain'.
- Support for the SMTPUTF8 extension (RFC 6531), allowing the use of national alphabet characters in email addresses, host names, mailbox names, and SMTP headers.
- Support for using multiple TLS certificates. Handling TLS parameters bound to domains and protection against downgrading connections to less secure TLS settings.
- Simplified certificate acquisition system through the Let’s Encrypt service.
- Support for SPF (Sender Policy Framework) checks and MTA-STS (MTA Strict Transport Security).
In the new release:
- Protection against SMTP smuggling attacks has been added, allowing a single message to be split into multiple different messages using a non-standard sequence for separating emails.
- A user class has been implemented that can only receive emails without the ability to send.
- The configuration does not allow specifying empty (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community. connection acceptance (address parameters must be explicitly defined; in the simplest case, it is sufficient to uncomment the corresponding setting in the configuration file).
- Support for obtaining email and password from environment variables has been added to the script docker/add-user.sh.
Source: opennet.ru
