Re: Plan to build a new mailguard server

Hi,

I’m going to say this once and then I won’t argue further.

Building a database of user credentials in 2015 using MD5 is irresponsible. Forking an existing project so you can remove a secure hashing library and replace it with MD5 is worse.

I don’t know where this term “native mysql encryption” is coming from, but what this code does – is MD5. It also replaced a CSPRNG with calls to mt_rand() for some reason.

From: Maia-users [mailto:[email protected]] On Behalf Of jjs - mainphrame
Sent: Saturday, 22 August 2015 8:51 AM
To: [email protected]
Subject: Re: [Maia-users] Plan to build a new mailguard server

I've since discovered what was going on with the failed logins, as I was able to reproduce the issue without scrypt, and learned something about the maia db schema in the process. In any case, I've put together some install scripts for maia, which, when launched, ask a few questions and then do an unattended install.

1.0.4 - Brings a fresh centos 7 container to successful login of first maia user in a few minutes, depending on processing power and bandwidth
1.0.4r - Same procedure as above; tested on centos 7 and also the installer for ubuntu 14.04 LTS
1.0.3 - Same procedure as above; tested on centos 6

1.0.4r is my testing fork, which uses native mysql password encryption, plus the extra installer files.
1.0.3 is the legacy 1.0 branch forked from maiamailguard.com<http://maiamailguard.com>, plus the extra installer files.

The scripts do the right thing here, but my platform coverage is sort of narrow here; Except for one deployment to a KVM image of ubuntu 14.04, I've only used OVZ containers in the testing, since they are incredibly fast and easy to deploy.

if someone wants to try the installer on VMs or physical servers and tell me what breaks, that would be great.

The 1.04r and the legacy repos:

1.04r - https://github.com/einheit/maia_mailguard
1.03r - https://github.com/einheit/mailguard_legacy

Regards,

Joe

On Wed, Jul 29, 2015 at 12:36 PM, jjs - mainphrame <[email protected]<mailto:[email protected]>> wrote:
David,

just as a sanity check, I'd set up a 1.0.3 server and the internal-init worked just as I remembered it.

However, I'd really like to get up and running with 1.0.4, so thanks for the links, I'll follow up and see what all is needed.

Regards,

On Wed, Jul 29, 2015 at 12:23 PM, David Newman <[email protected]<mailto:[email protected]>> wrote:
On 7/29/15 12:17 PM, jjs - mainphrame wrote:

> A promising maia login screen appears, but accessing
> the login.php?super=register link leads only to a login failure.

In pho-postfix (which uses Maia), that initial login must be from the
full email address of a currently existing virtual user.

pho-postfix start page:

http://www.purplehat.org/?page_id=4

Maia setup page, requires all preceding steps:

http://www.purplehat.org/?page_id=199

pho-postfix uses FreeBSD, so file locations will differ from CentOS, but
Maia setup is similar.

dn

_______________________________________________
Maia-users mailing list
[email protected]<mailto:[email protected]>
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

_______________________________________________
Maia-users mailing list
[email protected]
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users