jambotron_gang/reactive-mail-server
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Защита от перебора паролей: SMTP, IMAP, веб — лимит по IP и по ящику
continuous-integration/drone/pr Build is passing
Details

Browse Source 
Один LoginGuard на все проверки пароля (SMTP AUTH, IMAP LOGIN/AUTHENTICATE,
вход в веб, смена пароля): 10 неверных с IP за 15 мин → блок 15 мин, дальше
вдвое дольше до суток; 20 неверных на ящик с разных IP → ящик закрыт, кроме
IP, с которых в него уже входили. Во время блока пароль не проверяется
(SMTP 421, IMAP BYE + NO [UNAVAILABLE], веб 429 + Retry-After); неверный
пароль — ответ через 1 с; 3 неверных в соединении — обрыв.

X-Forwarded-For веб-входа — только от прокси в частной сети, иначе
заголовок отбрасывается (подменой IP лимит не обойти).

Попутно: IMAP терял тегированный ответ после "* BYE" (LOGOUT, обрыв после
неудачных входов) — takeUntil теперь после тегированной строки.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Liosha84
2026-11-06 18:32:33 +01:00
co-authored by Claude Opus 5.5
parent 8f3ad77b69
commit b19e9682a8
15 changed files with 876 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/main/java/com/mailserver/config/ImapConfig.java
+5 -4
View File
@@ -1,5 +1,6 @@
package com.mailserver.config;
import com.mailserver.security.LoginGuard;
import com.mailserver.imap.DbImapStore;
import com.mailserver.imap.ImapServer;
import com.mailserver.imap.ImapStore;
@@ -32,7 +33,7 @@ public class ImapConfig {
@Bean(initMethod = "start", destroyMethod = "stop")
@ConditionalOnProperty(name = "mailserver.imap.enabled", havingValue = "true", matchIfMissing = true)
public ImapServer imapServer(ImapStore store, MailServerConfig.SmtpTlsContext tls,
public ImapServer imapServer(ImapStore store, MailServerConfig.SmtpTlsContext tls, LoginGuard guard,
@Value("${mailserver.imap.host:0.0.0.0}") String host,
@Value("${mailserver.imap.port:3143}") int port,
@Value("${mailserver.smtp.hostname:localhost}") String hostname,
@@ -41,12 +42,12 @@ public class ImapConfig {
@Value("${mailserver.imap.idle-timeout:30m}") Duration idleTimeout,
@Value("${mailserver.imap.idle-poll:5s}") Duration idlePoll) {
return new ImapServer(new ImapServer.Settings(host, port, hostname, authWithoutTls, tls.context(), false,
(int) maxLiteral.toBytes(), idleTimeout, idlePoll), store);
(int) maxLiteral.toBytes(), idleTimeout, idlePoll), store, guard);
}
@Bean(initMethod = "start", destroyMethod = "stop")
@ConditionalOnExpression("'${mailserver.imap.enabled:true}' == 'true' and ${mailserver.imaps.port:0} > 0 and ${mailserver.tls.enabled:true}")
public ImapServer imapsServer(ImapStore store, MailServerConfig.SmtpTlsContext tls,
public ImapServer imapsServer(ImapStore store, MailServerConfig.SmtpTlsContext tls, LoginGuard guard,
@Value("${mailserver.imap.host:0.0.0.0}") String host,
@Value("${mailserver.imaps.port}") int port,
@Value("${mailserver.smtp.hostname:localhost}") String hostname,
@@ -54,6 +55,6 @@ public class ImapConfig {
@Value("${mailserver.imap.idle-timeout:30m}") Duration idleTimeout,
@Value("${mailserver.imap.idle-poll:5s}") Duration idlePoll) {
return new ImapServer(new ImapServer.Settings(host, port, hostname, false, tls.context(), true,
(int) maxLiteral.toBytes(), idleTimeout, idlePoll), store);
(int) maxLiteral.toBytes(), idleTimeout, idlePoll), store, guard);
}
}
backend/src/main/java/com/mailserver/config/LoginGuardConfig.java
+74
View File
@@ -0,0 +1,74 @@
package com.mailserver.config;
import com.mailserver.security.LoginGuard;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.web.server.adapter.ForwardedHeaderTransformer;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.time.Duration;
import java.util.Arrays;
import java.util.Set;
import java.util.stream.Collectors;
/** Brute-force protection (one guard for SMTP, IMAP and the web) and whose X-Forwarded-* headers to believe. */
@Configuration
public class LoginGuardConfig {
@Bean
public LoginGuard loginGuard(@Value("${mailserver.login-guard.enabled:true}") boolean enabled,
@Value("${mailserver.login-guard.max-per-ip:10}") int maxPerIp,
@Value("${mailserver.login-guard.max-per-account:20}") int maxPerAccount,
@Value("${mailserver.login-guard.window:15m}") Duration window,
@Value("${mailserver.login-guard.block:15m}") Duration block,
@Value("${mailserver.login-guard.max-block:24h}") Duration maxBlock,
@Value("${mailserver.login-guard.known-ip-ttl:30d}") Duration knownIpTtl,
@Value("${mailserver.login-guard.trusted-ips:}") String trustedIps,
@Value("${mailserver.login-guard.failure-delay:1s}") Duration failureDelay) {
Set<String> trusted = Arrays.stream(trustedIps.split(","))
.map(String::trim).filter(s -> !s.isEmpty()).collect(Collectors.toUnmodifiableSet());
return new LoginGuard(new LoginGuard.Settings(enabled, maxPerIp, maxPerAccount, window, block, maxBlock,
knownIpTtl, trusted, failureDelay));
}
/**
* Replaces Boot's transformer (server.forward-headers-strategy=framework): X-Forwarded-* / Forwarded are believed
* only from a proxy in a private network (Jambotron's Caddy comes over the docker network / WireGuard). A request
* straight from the internet (the VM's public address) has them removed — otherwise anyone could put a new
* X-Forwarded-For into every login attempt and never hit the per-IP limit.
*/
@Bean(name = "forwardedHeaderTransformer")
public ForwardedHeaderTransformer forwardedHeaderTransformer() {
return new TrustedProxyHeaderTransformer();
}
static final class TrustedProxyHeaderTransformer extends ForwardedHeaderTransformer {
private final ForwardedHeaderTransformer stripOnly = new ForwardedHeaderTransformer();
TrustedProxyHeaderTransformer() {
stripOnly.setRemoveOnly(true);
}
@Override
public ServerHttpRequest apply(ServerHttpRequest request) {
return privatePeer(request.getRemoteAddress()) ? super.apply(request) : stripOnly.apply(request);
}
}
/** Loopback, 10/8, 172.16/12, 192.168/16, link-local, IPv6 fc00::/7. */
static boolean privatePeer(InetSocketAddress peer) {
if (peer == null || peer.getAddress() == null) {
return false;
}
InetAddress a = peer.getAddress();
if (a.isLoopbackAddress() || a.isSiteLocalAddress() || a.isLinkLocalAddress()) {
return true;
}
byte[] b = a.getAddress();
return b.length == 16 && (b[0] & 0xfe) == 0xfc;
}
}
backend/src/main/java/com/mailserver/config/MailServerConfig.java
+5 -4
View File
@@ -1,5 +1,6 @@
package com.mailserver.config;
import com.mailserver.security.LoginGuard;
import com.mailserver.delivery.SmtpDeliveryClient;
import com.mailserver.smtp.MailRouter;
import com.mailserver.smtp.SmtpServer;
@@ -39,7 +40,7 @@ public class MailServerConfig {
@Bean(initMethod = "start", destroyMethod = "stop")
@ConditionalOnProperty(name = "mailserver.smtp.enabled", havingValue = "true", matchIfMissing = true)
public SmtpServer smtpServer(MailRouter router, SmtpTlsContext tls,
public SmtpServer smtpServer(MailRouter router, SmtpTlsContext tls, LoginGuard guard,
@Value("${mailserver.smtp.host:0.0.0.0}") String host,
@Value("${mailserver.smtp.port:3025}") int port,
@Value("${mailserver.smtp.hostname:localhost}") String hostname,
@@ -47,20 +48,20 @@ public class MailServerConfig {
@Value("${mailserver.smtp.auth-without-tls:false}") boolean authWithoutTls,
@Value("${mailserver.smtp.idle-timeout:5m}") Duration idleTimeout) {
return new SmtpServer(new SmtpServer.Settings(host, port, hostname, maxBytes, authWithoutTls, idleTimeout,
tls.context(), false), router);
tls.context(), false), router, guard);
}
/** Implicit TLS (RFC 8314, usually port 465) — only when mailserver.smtps.port is set and TLS is on. */
@Bean(initMethod = "start", destroyMethod = "stop")
@ConditionalOnExpression("${mailserver.smtps.port:0} > 0 and ${mailserver.tls.enabled:true}")
public SmtpServer smtpsServer(MailRouter router, SmtpTlsContext tls,
public SmtpServer smtpsServer(MailRouter router, SmtpTlsContext tls, LoginGuard guard,
@Value("${mailserver.smtp.host:0.0.0.0}") String host,
@Value("${mailserver.smtps.port}") int port,
@Value("${mailserver.smtp.hostname:localhost}") String hostname,
@Value("${mailserver.smtp.max-message-bytes:26214400}") long maxBytes,
@Value("${mailserver.smtp.idle-timeout:5m}") Duration idleTimeout) {
return new SmtpServer(new SmtpServer.Settings(host, port, hostname, maxBytes, false, idleTimeout,
tls.context(), true), router);
tls.context(), true), router, guard);
}
/**
backend/src/main/java/com/mailserver/controller/AuthenticationController.java
+69 -15
View File
@@ -10,11 +10,16 @@ import com.mailserver.dto.ProfileUpdateRequest;
import com.mailserver.dto.RegisterRequest;
import com.mailserver.service.MailService;
import com.mailserver.service.UserService;
import com.mailserver.security.LoginGuard;
import com.mailserver.util.JwtUtils;
import jakarta.validation.Valid;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.security.core.Authentication;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
@@ -25,6 +30,8 @@ import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.server.ResponseStatusException;
import reactor.core.publisher.Mono;
import java.net.InetSocketAddress;
import java.time.Duration;
import java.util.Locale;
import java.util.Map;
import java.util.Set;
@@ -34,6 +41,10 @@ import java.util.Set;
@RequestMapping("/api")
public class AuthenticationController {
private static final Logger log = LoggerFactory.getLogger(AuthenticationController.class);
/** Marker for "no such mailbox or wrong password": both look the same from outside. */
private static final User NO_USER = new User();
/** Service addresses nobody can register (RFC 2142 and ours). */
static final Set<String> RESERVED = Set.of("postmaster", "abuse", "mailer-daemon", "hostmaster", "webmaster",
"root", "admin", "noreply", "no-reply", "security", "support");
@@ -43,9 +54,12 @@ public class AuthenticationController {
private final JwtUtils jwtUtils;
private final MailDomains domains;
private final boolean registrationEnabled;
private final LoginGuard guard;
public AuthenticationController(UserService userService, MailService mailService, JwtUtils jwtUtils, MailDomains domains,
@Value("${mailserver.registration.enabled:false}") boolean registrationEnabled) {
@Value("${mailserver.registration.enabled:false}") boolean registrationEnabled,
LoginGuard guard) {
this.guard = guard;
this.userService = userService;
this.mailService = mailService;
this.jwtUtils = jwtUtils;
@@ -60,23 +74,34 @@ public class AuthenticationController {
}
@PostMapping("/login")
public Mono<ResponseEntity<?>> login(@Valid @RequestBody Mono<LoginRequest> requestMono) {
return requestMono.flatMap(request ->
userService.findByEmail(request.getEmail().trim().toLowerCase(Locale.ROOT))
.switchIfEmpty(Mono.error(new IllegalArgumentException("Invalid credentials")))
public Mono<ResponseEntity<?>> login(@Valid @RequestBody Mono<LoginRequest> requestMono, ServerHttpRequest http) {
String ip = clientIp(http);
return requestMono.flatMap(request -> {
String email = request.getEmail().trim().toLowerCase(Locale.ROOT);
Duration wait = guard.retryAfter(ip, email);
if (!wait.isZero()) {
log.warn("WEB {}: login as {} refused, blocked for {}", ip, email, LoginGuard.human(wait));
return Mono.just(tooMany(wait));
}
return userService.findByEmail(email)
.map(user -> userService.checkPassword(user, request.getPassword()) ? user : NO_USER)
.onErrorResume(IllegalArgumentException.class, e -> Mono.just(NO_USER))
.defaultIfEmpty(NO_USER)
.flatMap(user -> {
if (user == NO_USER) {
guard.failure(ip, email);
log.warn("WEB {}: authentication failed for {}", ip, email);
Mono<ResponseEntity<?>> answer = Mono.just(ResponseEntity.badRequest().body(Map.of("error", "Invalid credentials")));
Duration delay = guard.failureDelay();
return delay.isZero() ? answer : answer.delayElement(delay);
}
guard.success(ip, email);
if (!user.isActive()) {
return Mono.just(ResponseEntity.badRequest().body(Map.of("error", "User is deactivated")));
}
if (!userService.checkPassword(user, request.getPassword())) {
return Mono.just(ResponseEntity.badRequest().body(Map.of("error", "Invalid credentials")));
}
return Mono.just(ResponseEntity.ok(token(user)));
})
.onErrorResume(IllegalArgumentException.class, e ->
Mono.just(ResponseEntity.badRequest().body(Map.of("error", "Invalid credentials")))
)
);
});
});
}
/** New mailbox in one of our domains; logs in right away (the answer carries the token). */
@@ -116,12 +141,41 @@ public class AuthenticationController {
}
@PutMapping("/me/password")
public Mono<Map<String, String>> changePassword(Mono<Authentication> auth, @Valid @RequestBody Mono<PasswordChangeRequest> body) {
public Mono<Map<String, String>> changePassword(Mono<Authentication> auth, @Valid @RequestBody Mono<PasswordChangeRequest> body,
ServerHttpRequest http) {
String ip = clientIp(http);
return user(auth).zipWith(body)
.flatMap(pair -> userService.changePassword(pair.getT1(), pair.getT2().currentPassword(), pair.getT2().newPassword()))
.flatMap(pair -> {
User user = pair.getT1();
// Someone with a stolen session must not guess the current password either
Duration wait = guard.retryAfter(ip, user.getEmail());
if (!wait.isZero()) {
return Mono.error(new ResponseStatusException(HttpStatus.TOO_MANY_REQUESTS,
"Too many failed attempts, try again in " + LoginGuard.human(wait)));
}
if (!userService.checkPassword(user, pair.getT2().currentPassword())) {
guard.failure(ip, user.getEmail());
}
return userService.changePassword(user, pair.getT2().currentPassword(), pair.getT2().newPassword());
})
.thenReturn(Map.of("message", "Password changed"));
}
private static ResponseEntity<?> tooMany(Duration wait) {
return ResponseEntity.status(HttpStatus.TOO_MANY_REQUESTS)
.header(HttpHeaders.RETRY_AFTER, String.valueOf(Math.max(1, (wait.toMillis() + 999) / 1000)))
.body(Map.of("error", "Too many failed logins, try again in " + LoginGuard.human(wait)));
}
/** Client address; behind Caddy it comes from X-Forwarded-For (server.forward-headers-strategy=framework). */
static String clientIp(ServerHttpRequest http) {
InetSocketAddress address = http.getRemoteAddress();
if (address == null) {
return "unknown";
}
return address.getAddress() != null ? address.getAddress().getHostAddress() : address.getHostString();
}
private Mono<ProfileResponse> profile(User user) {
return mailService.usedBytes(user.getId())
.map(used -> new ProfileResponse(user.getEmail(), user.getDisplayName(), used,
backend/src/main/java/com/mailserver/imap/ImapServer.java
+15 -2
View File
@@ -1,5 +1,6 @@
package com.mailserver.imap;
import com.mailserver.security.LoginGuard;
import io.netty.buffer.ByteBuf;
import io.netty.buffer.Unpooled;
import io.netty.channel.ChannelHandlerContext;
@@ -67,11 +68,17 @@ public class ImapServer {
private final Settings settings;
private final ImapStore store;
private final LoginGuard guard;
private DisposableServer server;
public ImapServer(Settings settings, ImapStore store) {
this(settings, store, LoginGuard.disabled());
}
public ImapServer(Settings settings, ImapStore store, LoginGuard guard) {
this.settings = settings;
this.store = store;
this.guard = guard;
}
public void start() {
@@ -98,7 +105,7 @@ public class ImapServer {
});
ImapSession session = new ImapSession(
new ImapSession.Settings(settings.hostname(), settings.tls() != null, settings.authWithoutTls()),
store, remoteIp[0], settings.implicitTls());
store, guard, remoteIp[0], settings.implicitTls());
@SuppressWarnings("unchecked")
Sinks.Empty<Void>[] idleDone = new Sinks.Empty[1];
@@ -135,7 +142,9 @@ public class ImapServer {
log.debug("IMAP {}: connection closed: {}", session.remoteIp, e.toString());
return Mono.just(ImapSession.line("* BYE " + e.getMessage()));
})
.takeUntil(response -> session.closing);
// after the tagged line of the command that closes (LOGOUT, too many failed logins), not after
// its first untagged "* BYE" — the tagged answer must still reach the client
.takeUntil(response -> session.closing && !untagged(response));
return Flux.concat(Mono.just(session.greeting()), responses)
.concatMap(response -> response == ImapSession.STARTTLS_READY
@@ -164,6 +173,10 @@ public class ImapServer {
return new String(bytes, StandardCharsets.US_ASCII).trim().toUpperCase(Locale.ROOT).equals("DONE");
}
private static boolean untagged(byte[] response) {
return response.length > 1 && response[0] == '*' && response[1] == ' ';
}
private static Flux<byte[]> blocking(java.util.concurrent.Callable<List<byte[]>> work) {
return Mono.fromCallable(work).subscribeOn(Schedulers.boundedElastic()).flatMapIterable(list -> list);
}
backend/src/main/java/com/mailserver/imap/ImapSession.java
+44 -3
View File
@@ -1,5 +1,6 @@
package com.mailserver.imap;
import com.mailserver.security.LoginGuard;
import com.mailserver.service.LocalDelivery;
import jakarta.mail.Session;
import jakarta.mail.internet.MimeMessage;
@@ -9,6 +10,7 @@ import org.slf4j.LoggerFactory;
import java.io.ByteArrayInputStream;
import java.nio.charset.StandardCharsets;
import java.time.Duration;
import java.time.Instant;
import java.time.LocalDate;
import java.time.ZoneOffset;
@@ -39,6 +41,8 @@ final class ImapSession {
private static final Logger log = LoggerFactory.getLogger(ImapSession.class);
private static final int MAX_BAD_COMMANDS = 30;
/** Wrong passwords in one connection before it is closed. */
private static final int MAX_AUTH_FAILURES = 3;
private static final int SOURCE_CACHE = 16;
private static final DateTimeFormatter INTERNAL_DATE =
DateTimeFormatter.ofPattern("dd-MMM-yyyy HH:mm:ss Z", Locale.ENGLISH);
@@ -53,6 +57,7 @@ final class ImapSession {
private final Settings settings;
private final ImapStore store;
private final LoginGuard guard;
final String remoteIp;
boolean tls;
@@ -78,8 +83,13 @@ final class ImapSession {
volatile String idleTag;
ImapSession(Settings settings, ImapStore store, String remoteIp, boolean tls) {
this(settings, store, LoginGuard.disabled(), remoteIp, tls);
}
ImapSession(Settings settings, ImapStore store, LoginGuard guard, String remoteIp, boolean tls) {
this.settings = settings;
this.store = store;
this.guard = guard;
this.remoteIp = remoteIp;
this.tls = tls;
}
@@ -254,7 +264,7 @@ final class ImapSession {
out.add(line(tag + " NO [PRIVACYREQUIRED] Use STARTTLS first"));
return;
}
loggedIn(tag, store.authenticate(user, password), user, out);
checkPassword(tag, user, password, out);
}
private void authenticate(String tag, ImapReader in, List<byte[]> out) {
@@ -292,13 +302,44 @@ final class ImapSession {
bad(tag, "Bad PLAIN response", out);
return;
}
loggedIn(tag, store.authenticate(fields[1], fields[2]), fields[1], out);
checkPassword(tag, fields[1], fields[2], out);
}
/** Through the login guard: a blocked IP/mailbox gets no answer about the password and the connection closes. */
private void checkPassword(String tag, String user, String password, List<byte[]> out) {
Duration wait = guard.retryAfter(remoteIp, user);
if (!wait.isZero()) {
log.warn("IMAP {}: login as {} refused, blocked for {}", remoteIp, user, LoginGuard.human(wait));
out.add(line("* BYE Too many failed logins, try again in " + LoginGuard.human(wait)));
out.add(line(tag + " NO [UNAVAILABLE] Too many failed logins"));
closing = true;
return;
}
ImapStore.Account result = store.authenticate(user, password);
if (result == null) {
guard.failure(remoteIp, user);
pause(guard.failureDelay());
} else {
guard.success(remoteIp, user);
}
loggedIn(tag, result, user, out);
}
private static void pause(Duration delay) {
if (delay.isZero()) {
return;
}
try {
Thread.sleep(delay.toMillis());
} catch (InterruptedException e) {
Thread.currentThread().interrupt();
}
}
private void loggedIn(String tag, ImapStore.Account result, String user, List<byte[]> out) {
if (result == null) {
log.warn("IMAP {}: authentication failed for {}", remoteIp, user);
if (++badCommands > 5) {
if (++badCommands >= MAX_AUTH_FAILURES) {
out.add(line("* BYE Too many failed logins"));
closing = true;
}
backend/src/main/java/com/mailserver/security/LoginGuard.java
+257
View File
@@ -0,0 +1,257 @@
package com.mailserver.security;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.scheduling.annotation.Scheduled;
import java.time.Clock;
import java.time.Duration;
import java.time.Instant;
import java.util.ArrayDeque;
import java.util.Deque;
import java.util.LinkedHashMap;
import java.util.Locale;
import java.util.Map;
import java.util.Set;
import java.util.concurrent.ConcurrentHashMap;
/**
* Brute-force protection for every place that checks a password: SMTP AUTH, IMAP LOGIN/AUTHENTICATE, web login,
* password change. One instance is shared by all of them, so failures on SMTP and IMAP add up.
* <ul>
* <li><b>By IP:</b> {@code maxPerIp} failures within {@code window} → the IP is blocked for {@code block};
* each next block of the same IP is twice as long, up to {@code maxBlock}.</li>
* <li><b>By mailbox:</b> {@code maxPerAccount} failures within {@code window} from any IPs (a distributed attack on
* one mailbox) → the mailbox is blocked for {@code block} — but not for IPs that logged in to it successfully
* before ({@code knownIpTtl}), so an attacker cannot lock the owner's own mail program out.</li>
* </ul>
* While blocked the password is not checked at all (no answer to a guess) and the caller gets {@link #retryAfter}.
* State is in memory: a restart forgets it, which is fine for minutes-long blocks.
*/
public class LoginGuard {
private static final Logger log = LoggerFactory.getLogger(LoginGuard.class);
/** Upper bound of tracked keys of each kind, so a flood of random usernames/IPs cannot eat the memory. */
static final int MAX_KEYS = 100_000;
private static final int MAX_KNOWN_IPS_PER_ACCOUNT = 20;
public record Settings(boolean enabled, int maxPerIp, int maxPerAccount, Duration window, Duration block,
Duration maxBlock, Duration knownIpTtl, Set<String> trustedIps, Duration failureDelay) {
public static Settings defaults() {
return new Settings(true, 10, 20, Duration.ofMinutes(15), Duration.ofMinutes(15), Duration.ofHours(24),
Duration.ofDays(30), Set.of(), Duration.ofSeconds(1));
}
}
/** Failures in the window, current block and how many times the key was blocked in a row. */
private static final class Counter {
final Deque<Instant> failures = new ArrayDeque<>();
volatile Instant blockedUntil = Instant.EPOCH;
int strikes;
Instant lastSeen = Instant.EPOCH;
}
private final Settings settings;
private final Clock clock;
private final Map<String, Counter> byIp = new ConcurrentHashMap<>();
private final Map<String, Counter> byAccount = new ConcurrentHashMap<>();
/** account → IPs that logged in to it successfully, with the time of the last success. */
private final Map<String, Map<String, Instant>> knownIps = new ConcurrentHashMap<>();
public LoginGuard(Settings settings) {
this(settings, Clock.systemUTC());
}
LoginGuard(Settings settings, Clock clock) {
this.settings = settings;
this.clock = clock;
}
/** Guard that never blocks (tests, closed networks). */
public static LoginGuard disabled() {
Settings d = Settings.defaults();
return new LoginGuard(new Settings(false, d.maxPerIp(), d.maxPerAccount(), d.window(), d.block(), d.maxBlock(),
d.knownIpTtl(), Set.of(), Duration.ZERO));
}
/** Pause before answering "wrong password": slows down guessing inside one connection. */
public Duration failureDelay() {
return settings.enabled() ? settings.failureDelay() : Duration.ZERO;
}
/**
* Zero when the attempt may go on and the password may be checked; otherwise how long the caller has to wait.
*/
public Duration retryAfter(String ip, String account) {
if (!settings.enabled()) {
return Duration.ZERO;
}
Instant now = clock.instant();
Duration wait = Duration.ZERO;
if (!trusted(ip)) {
wait = remaining(byIp.get(ip), now);
}
String acc = normalize(account);
if (acc != null && !known(acc, ip, now)) {
Duration accountWait = remaining(byAccount.get(acc), now);
if (accountWait.compareTo(wait) > 0) {
wait = accountWait;
}
}
return wait;
}
public boolean blocked(String ip, String account) {
return !retryAfter(ip, account).isZero();
}
/** A wrong password (or an unknown mailbox). */
public void failure(String ip, String account) {
if (!settings.enabled()) {
return;
}
Instant now = clock.instant();
if (!trusted(ip)) {
count(byIp, ip, settings.maxPerIp(), now, "IP " + ip);
}
String acc = normalize(account);
if (acc != null) {
count(byAccount, acc, settings.maxPerAccount(), now, "mailbox " + acc);
}
}
/** A right password: the IP becomes known for the mailbox, failures of this IP are forgiven. */
public void success(String ip, String account) {
if (!settings.enabled()) {
return;
}
Instant now = clock.instant();
String acc = normalize(account);
if (acc != null) {
if (knownIps.size() < MAX_KEYS || knownIps.containsKey(acc)) {
knownIps.compute(acc, (k, ips) -> {
Map<String, Instant> map = ips != null ? ips : new LinkedHashMap<>();
synchronized (map) {
map.remove(ip);
map.put(ip, now);
while (map.size() > MAX_KNOWN_IPS_PER_ACCOUNT) {
map.remove(map.keySet().iterator().next());
}
}
return map;
});
}
}
byIp.computeIfPresent(ip, (k, c) -> {
c.failures.clear();
return c.blockedUntil.isAfter(now) ? c : null;
});
}
/** Drops what expired; runs every minute. */
@Scheduled(fixedDelay = 60_000)
public void sweep() {
Instant now = clock.instant();
Instant idle = now.minus(settings.maxBlock()).minus(settings.window());
byIp.entrySet().removeIf(e -> stale(e.getValue(), now, idle));
byAccount.entrySet().removeIf(e -> stale(e.getValue(), now, idle));
Instant knownSince = now.minus(settings.knownIpTtl());
knownIps.entrySet().removeIf(e -> {
synchronized (e.getValue()) {
e.getValue().values().removeIf(t -> t.isBefore(knownSince));
return e.getValue().isEmpty();
}
});
}
int trackedIps() {
return byIp.size();
}
int trackedAccounts() {
return byAccount.size();
}
// ---------------------------------------------------------------------------------------------
private void count(Map<String, Counter> map, String key, int max, Instant now, String what) {
if (map.size() >= MAX_KEYS && !map.containsKey(key)) {
sweep();
if (map.size() >= MAX_KEYS) {
log.warn("login guard: {} keys tracked, {} not counted", map.size(), what);
return;
}
}
map.compute(key, (k, existing) -> {
Counter c = existing != null ? existing : new Counter();
c.lastSeen = now;
Instant from = now.minus(settings.window());
while (!c.failures.isEmpty() && c.failures.peekFirst().isBefore(from)) {
c.failures.pollFirst();
}
if (c.blockedUntil.isAfter(now)) {
return c; // already blocked: attempts are refused before the password check anyway
}
// A long quiet time after the last block forgives the strikes
if (c.strikes > 0 && c.blockedUntil.plus(settings.maxBlock()).isBefore(now)) {
c.strikes = 0;
}
c.failures.addLast(now);
if (c.failures.size() >= max) {
Duration block = settings.block().multipliedBy(1L << Math.min(c.strikes, 20));
if (block.compareTo(settings.maxBlock()) > 0) {
block = settings.maxBlock();
}
c.strikes++;
c.blockedUntil = now.plus(block);
c.failures.clear();
log.warn("login guard: {} blocked for {} after {} failed logins (block #{})",
what, human(block), max, c.strikes);
}
return c;
});
}
private static Duration remaining(Counter c, Instant now) {
if (c == null) {
return Duration.ZERO;
}
Instant until = c.blockedUntil;
return until.isAfter(now) ? Duration.between(now, until) : Duration.ZERO;
}
private boolean known(String account, String ip, Instant now) {
Map<String, Instant> ips = knownIps.get(account);
if (ips == null) {
return false;
}
synchronized (ips) {
Instant at = ips.get(ip);
return at != null && at.plus(settings.knownIpTtl()).isAfter(now);
}
}
private boolean trusted(String ip) {
return settings.trustedIps().contains(ip);
}
private static boolean stale(Counter c, Instant now, Instant idle) {
return !c.blockedUntil.isAfter(now) && c.lastSeen.isBefore(idle);
}
private static String normalize(String account) {
if (account == null) {
return null;
}
String acc = account.trim().toLowerCase(Locale.ROOT);
return acc.isEmpty() ? null : acc;
}
/** "15 min" / "2 h" for messages to the user. */
public static String human(Duration d) {
long minutes = Math.max(1, (d.toSeconds() + 59) / 60);
return minutes < 120 ? minutes + " min" : (minutes + 59) / 60 + " h";
}
}
backend/src/main/java/com/mailserver/smtp/SmtpServer.java
+29 -3
View File
@@ -1,5 +1,6 @@
package com.mailserver.smtp;
import com.mailserver.security.LoginGuard;
import io.netty.buffer.ByteBuf;
import io.netty.buffer.ByteBufUtil;
import io.netty.channel.ChannelHandlerContext;
@@ -54,6 +55,8 @@ public class SmtpServer {
static final int MAX_LINE = 64 * 1024;
static final int MAX_RECIPIENTS = 100;
private static final int MAX_BAD_COMMANDS = 20;
/** Wrong passwords in one connection before it is closed. */
private static final int MAX_AUTH_FAILURES = 3;
// Compared by identity: TLS starts right after exactly this reply is written
private static final String STARTTLS_READY = new String("220 2.0.0 Ready to start TLS\r\n");
@@ -84,11 +87,17 @@ public class SmtpServer {
private final Settings settings;
private final SmtpBackend backend;
private final LoginGuard guard;
private DisposableServer server;
public SmtpServer(Settings settings, SmtpBackend backend) {
this(settings, backend, LoginGuard.disabled());
}
public SmtpServer(Settings settings, SmtpBackend backend, LoginGuard guard) {
this.settings = settings;
this.backend = backend;
this.guard = guard;
}
public void start() {
@@ -183,6 +192,7 @@ public class SmtpServer {
final ByteArrayOutputStream data = new ByteArrayOutputStream();
boolean dataTooBig;
int badCommands;
int authFailures;
volatile boolean closing;
Session(String remoteIp, boolean tls) {
@@ -356,16 +366,32 @@ public class SmtpServer {
private Mono<String> checkPassword(String user, String password) {
String username = user.trim().toLowerCase(Locale.ROOT);
Duration wait = guard.retryAfter(remoteIp, username);
if (!wait.isZero()) {
// Blocked: the password is not even checked, the connection is closed
log.warn("SMTP {}: login as {} refused, blocked for {}", remoteIp, username, LoginGuard.human(wait));
closing = true;
return reply("421 4.7.0 Too many failed logins, try again in " + LoginGuard.human(wait));
}
return blocking(() -> backend.authenticate(username, password))
.map(ok -> {
.flatMap(ok -> {
if (ok) {
guard.success(remoteIp, username);
authenticatedUser = username;
log.info("SMTP {}: authenticated as {}", remoteIp, username);
return "235 2.7.0 Authentication successful\r\n";
return Mono.just("235 2.7.0 Authentication successful\r\n");
}
guard.failure(remoteIp, username);
log.warn("SMTP {}: authentication failed for {}", remoteIp, username);
badCommands++;
return "535 5.7.8 Authentication credentials invalid\r\n";
if (++authFailures >= MAX_AUTH_FAILURES) {
closing = true;
}
String answer = closing
? "535 5.7.8 Authentication credentials invalid, closing connection\r\n"
: "535 5.7.8 Authentication credentials invalid\r\n";
Duration delay = guard.failureDelay();
return delay.isZero() ? Mono.just(answer) : Mono.just(answer).delayElement(delay);
});
}
backend/src/main/resources/application.properties
+12
View File
@@ -83,3 +83,15 @@ management.endpoints.web.exposure.include=health
management.endpoint.health.show-details=never
logging.level.com.mailserver=INFO
# Brute-force protection for SMTP AUTH, IMAP login, web login and password change (one counter for all of them):
# MAX_PER_IP wrong passwords from one IP within WINDOW → the IP is blocked for BLOCK (each next block twice as long,
# up to MAX_BLOCK); MAX_PER_ACCOUNT wrong passwords to one mailbox from any IPs → the mailbox is blocked for BLOCK,
# except for IPs that logged in to it before. TRUSTED_IPS (comma-separated) are never blocked by IP
mailserver.login-guard.enabled=${LOGIN_GUARD:true}
mailserver.login-guard.max-per-ip=${LOGIN_GUARD_MAX_PER_IP:10}
mailserver.login-guard.max-per-account=${LOGIN_GUARD_MAX_PER_ACCOUNT:20}
mailserver.login-guard.window=${LOGIN_GUARD_WINDOW:15m}
mailserver.login-guard.block=${LOGIN_GUARD_BLOCK:15m}
mailserver.login-guard.max-block=${LOGIN_GUARD_MAX_BLOCK:24h}
mailserver.login-guard.trusted-ips=${LOGIN_GUARD_TRUSTED_IPS:}