-
Notifications
You must be signed in to change notification settings - Fork 0
Security Considerations
limit the SMTP server's listen address (set with postgraph config smtp setup --address) to be the least permissive to meet your needs.
if only applications on the same machine need to access the service, consider binding to the loopback interface only (e.g. "127.0.0.1:25").
NEVER make PostGraph accessible over the internet!
you should consider configuring TLS for the service, especially if it is accessed over the network. not enabling TLS may allow attackers on your network to read SMTP traffic, potentially exposing credentials as the contents of mails.
configure user for authentication so the server cannot be used without authorization. use secure passwords (the cli will auto-generate a password for you if you don't provide one). note that some clients don't accept longer passwords
by default, the Microsoft Graph Application Permission for sending mail allows the application to send as any sender in the tenant. consider using RBAC (described in setup instructions) to limit what users the application can send as.
Ensure only administrators can read the configuration file, as it contains confidential information such as the client credentials and user's password hashes. to do so, setup the permissions for the configuration file to be as restrictive as possible. on Windows, this is done automatically when using the setup script.