Security features

[gnieser]

Hello,

I'm currently evaluating spam protection solutions and I've just found mosparo.
First of all, congratulations for all the hard work to create such a nice open source product, that makes the internet a safer place.

I have some security requirements that are not met out of the box:

• TLS encrypted database connection
• Deployment on OpenShift (in other words, Docker/Kubernetes with lesser permissions, arbitrary uid, etc.)

I think can somehow help mosparo meet them.
I have a workaround for the TLS database connection by override SetupController.php and doctrine.yaml
I have a very complicated setup for OpenShift to ditch the nginx privileged process and avoid writing inside the image

I also need to integrate mosparo with a java backend, so I will probably also write a java client library.

Please let me know whether you are interested, and if so I shall proceed.
Best regards

[gnieser]

Here is my workaround to enable TLS for MariaDB by directly editing the mosparo sources.

SetupController.php

                $tmpConnection = DriverManager::getConnection([
[...]
                    'driverOptions' => [
                        \PDO::MYSQL_ATTR_SSL_KEY => '/certs/client-key.pem',
                        \PDO::MYSQL_ATTR_SSL_CERT => '/certs/client-cert.pem',
                        \PDO::MYSQL_ATTR_SSL_CA => '/certs/ca.pem',
                        \PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => true
                    ]
                ]);

In doctrine.yaml

doctrine:
    dbal:
[...]
        options:
            !php/const PDO::MYSQL_ATTR_SSL_KEY: '%env(DATABASE_PRIV_KEY)%'
            !php/const PDO::MYSQL_ATTR_SSL_CERT: '%env(DATABASE_PUB_KEY)%'
            !php/const PDO::MYSQL_ATTR_SSL_CA: '%env(DATABASE_CA_CERT)%'
            !php/const PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT: true

[zepich]

Hi @gnieser

First of all, congratulations for all the hard work to create such a nice open source product, that makes the internet a safer place.

Thank you very much for your kind words! It's incredible to read such feedback!

I have some security requirements that are not met out of the box:

TLS encrypted database connection
Deployment on OpenShift (in other words, Docker/Kubernetes with lesser permissions, arbitrary uid, etc.)

Thank you very much for bringing these things to our attention and for the workaround.

TLS Encrypted Database Connection

The easiest thing for us is to add some additional environment variables and a hint in the setup to let users know how to configure the encrypted connection.

Adding the required configuration fields is also possible, but it makes the setup more complicated.

What do you think? Would the environment variables be enough?

Deployment on OpenShift

What exactly do you need here? Do you need a different Docker image? Or does such a setup need changes in the code?

I think can somehow help mosparo meet them.
I have a workaround for the TLS database connection by override SetupController.php and doctrine.yaml
I have a very complicated setup for OpenShift to ditch the nginx privileged process and avoid writing inside the image

Our main goal is to provide software that can be used in every situation and on every host (on a simple shared web host or a cluster of servers). So we're interested in learning more about other setups that we don't know or for which we don't have knowledge.

Please let me know what problems we have to solve. We're very interested in all suggestions and ideas to make mosparo better.

Java Client Library

That would be awesome! I worked with Java before (Android and desktop apps), but I'm not that good in Java to write a library. I helped another user integrate mosparo into Keycloak. Here is the code: https://git.schuerz.at/jakob/keycloak-mosparo (Just in case you need an example of how to communicate with the mosparo API in Java).

Thank you very much for your help in making mosparo better! Please let me know if you need anything or have any questions!

Kind regards,

zepich

[gnieser]

Hi @zepich !

Thanks for the answer.

Thank you very much for your kind words! It's incredible to read such feedback!
It's well deserved :)

TLS Encrypted Database Connection

What do you think? Would the environment variables be enough?

I think environment variables are very easy to work with in containers.
One can create a kubernetes secret with the configured values and inject them as environment variables.
It may be worth considering that some users may prefer to inject the secret as a file for more flexibility.
See https://kubernetes.io/docs/concepts/security/security-checklist/#secrets where there's hint toward mounting secrets as file is more secure.

Deployment on OpenShift

What exactly do you need here? Do you need a different Docker image? Or does such a setup need changes in the code?

By default, pods in OpenShift will get the 'restricted-v2' security context constraint.
https://docs.openshift.com/container-platform/4.17/authentication/managing-security-context-constraints.html

Currently, my experience running mosparo image in OpenShift shows errors related to:

• nginx requiring privileged permissions
• mosparo run.sh entrypoint requiring permissions in some folders
• mosparo trying to write to access some folders at various points

My current workaround is very convoluted. I've used volume everywhere I detected that the application wanted to write to a folder.
Also I avoided to rebuild another image. There is probably an easier setup.
I haven't look at the cron jobs at all.

• An init-container:
  • running the mosparo image
  • with a share volume "mosparo-public"
  • and a overriden command that copies /mosparo/public into the shared volume
• A container with nginxinc/nginx-unprivileged:latest
  • an additional nginx.conf file (mounted in /etc/nginx/conf.d) to accommodate for fastcgi and mosparo settings
  • the share volume mounted at /mosparo/public
  • a volume for /mosparo/public/resources
  • a volume for /mosparo/var
• A container with mosparo
  • With a overriden entrypoint to:
    • cp /env/env.mosparo.php /mosparo/config/
    • and start php-fpm
  • a volume for /mosparo/public/resources
  • a volume for /mosparo/var
  • a volume for /mosparo/run
  • a volume for /env
  • a volume for /mosparo/public

Java Client Library

That would be awesome! I worked with Java before (Android and desktop apps), but I'm not that good in Java to write a library. I helped another user integrate mosparo into Keycloak. Here is the code: https://git.schuerz.at/jakob/keycloak-mosparo (Just in case you need an example of how to communicate with the mosparo API in Java).

I'll work on a proof of concept, taking into account this Keycloak use case.
Please let me know where you prefer to have the git repository.

Best regards