Skip to content

mail-auth-proxy 0.7.0

Latest
Latest

Choose a tag to compare

View all tags
@NK-IT-CLOUD NK-IT-CLOUD released this 25 Oct 14:25
Immutable release. Only release title and notes can be modified.
v0.7.0
666f96c

Added

  • Metrics endpoint over HTTPS with a bearer token: metrics.tls_cert and metrics.tls_key
    serve /metrics over TLS only, metrics.bearer_token_file makes every scrape send
    Authorization: Bearer <token> (otherwise 401), so Prometheus can scrape with
    scheme: https and authorization.credentials_file. Both files are read again on every
    SIGHUP, so a renewed certificate or a rotated token takes effect with
    systemctl reload. A token on an address other than loopback without TLS is a
    configuration error; an endpoint off loopback without a token still gets the warning.
  • [session] end_at_token_expiry (default false) ends a session that logged in with
    OAuth at its token's exp plus token_expiry_grace_secs (default 300, 0-86400), so
    an account disabled in the IdP does not stay logged in until the client disconnects.
    The end is absolute: a session that starts after it (a token accepted within
    oauth.leeway_secs, a slow backend) is closed right after the login, and a grace below
    the leeway gives a warning.
    The session is closed like one ended by max_session_secs; with both set, the earlier
    deadline applies. Password sessions are not affected. New reason="token_expired" in
    mail_auth_proxy_sessions_ended_total and in the session closed by limit log line.

Changed

  • Metrics endpoint: idle connections no longer take the 4 scrape slots. Up to 64
    connections wait for their request (TLS handshake and request head within 5 s instead
    of 10 s); only a request that gets the metrics takes a scrape slot. A connection
    accepted before a reload that changed the endpoint's TLS or token is closed without an
    answer.

Security

  • Dependencies updated for RustSec advisories published after 0.7.0-rc.1: rustls 0.23.46
    (RUSTSEC-2026-0346, -0347, -0348, -0349), rustls-webpki 0.103.16 (RUSTSEC-2026-0382) and
    tokio 1.53.3 (RUSTSEC-2026-0386). Relevant here are the TLS client connections to the
    backends and to the identity providers' JWKS endpoints: an unauthenticated ServerHello
    could downgrade later connections to a classical key exchange (-0349), and certificate
    verification could accept a distrusted intermediate (-0382). The proxy uses no ECH, no
    custom client session store, no Brotli certificate compression and no AsyncFd, so the
    other advisories do not apply to it.

Install

Debian and Ubuntu: APT repository, see INSTALL.md.
Other systems: download the package or archive and SHA256SUMS, SHA256SUMS.asc and
release-signing-key.asc, then:

gpg --import release-signing-key.asc   # 0B58 3E99 144D CD9B 5A34  D96B E52C 6D1E FB67 927B
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMS
Assets 11
Loading