After 10 months of development, a new stable version of the Postfix mail server has been released — 3.7.0. At the same time, support for the Postfix 3.3 branch, released in early 2018, has been discontinued. Postfix is one of the few projects that combines high security, reliability, and performance, achieved through a well-thought-out architecture and a strict code governance and patch audit policy. The project's code is distributed under the EPL 2.0 (Eclipse Public License) and IPL 1.0 (IBM Public License).
According to a January automated survey of about 500 thousand mail servers, servers, Postfix is used on 34.08% (up from 33.66% a year ago) of mail servers, Exim accounts for 58.95% (down from 59.14%), Sendmail — 3.58% (down from 3.6%), MailEnable — 1.99% (down from 2.02%), MDaemon — 0.52% (down from 0.60%), Microsoft Exchange — 0.26% (down from 0.32%), OpenSMTPD — 0.06% (up from 0.05%).
Key innovations:
- A new feature allows inline inclusion of small tables such as "cidr:", "pcre:", and "regexp:" within the configuration parameter values of Postfix, without the need to connect external files or databases. Inline substitution is determined using curly braces; for example, the default value for the smtpd_forbidden_commands parameter now contains the line "CONNECT GET POST regexp:{{/^[^A-Z]/ Thrash}}", which ensures the termination of connections from clients sending garbage instead of commands. The general syntax is: /etc/postfix/main.cf: parameter = .. map-type:{ { rule-1 }, { rule-2 } .. } .. /etc/postfix/master.cf: .. -o { parameter = .. map-type:{ { rule-1 }, { rule-2 } .. } .. } ..
- The postlog handler is now equipped with the set-gid flag, and when started, it operates with the privileges of the postdrop group, allowing it to be used by unprivileged programs for logging through the background process postlogd, thereby enhancing the flexibility of configuring maillog_file and enabling, among other things, stdout logging from the container.
- Support for API libraries OpenSSL 3.0.0, PCRE2, and Berkeley DB 18 has been added.
- Protection against collision attacks in hashes by brute-force key guessing has been implemented. This protection is achieved through randomization of the initial state of hash tables stored in memory. Currently, only one method of conducting such attacks has been identified, involving guessing IPv6 addresses of SMTP clients in the anvil service, requiring the establishment of hundreds of short-lived connections per second while cyclically guessing thousands of different client addresses. (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community.Other hash tables, where key checks can be performed based on the attacker's data, are not susceptible to such attacks as they employ size restrictions (in anvil, cleanup was performed every 100 seconds).
- Protection against external clients and servers has been strengthened, very slowly transmitting data piece by piece to maintain active SMTP and LMTP connections (for example, to block operations by creating conditions that exhaust the limit on the number of established connections). Instead of time limits tied to records, limits are now applied based on requests, as well as a minimum possible data transmission intensity in DATA and BDAT blocks has been introduced. Accordingly, the settings {smtpd,smtp,lmtp}_per_record_deadline have been replaced by {smtpd,smtp,lmtp}_per_request_deadline and {smtpd,smtp,lmtp}_min_data_rate.
- In the postqueue team, non-printable characters, such as line breaks, are cleaned up before outputting to the standard output stream or formatting the string in JSON.
- In tlsproxy, the parameters tlsproxy_client_level and tlsproxy_client_policy have been replaced with new settings tlsproxy_client_security_level and tlsproxy_client_policy_maps for unification of parameter naming in Postfix (the naming of tlsproxy_client_xxx settings now corresponds to smtp_tls_xxx settings).
- Error handling has been reworked for clients using LMDB.
Source: opennet.ru
