Re: Plan to build a new mailguard server

Hi Joshua,

Thanks for your input. Obviously you feel strongly about encryption, and
that's as it should be.

My aim was to preserve not only the old 1.03 version from rennaissoft for
reference, but an updated version of that to work with newer distros, in a
repo which I could test and update quickly.

But since then, I've been testing with  the technion branch as well, and
I've made a repo for the 1.0.4 install scripts, which I've used for several
installs on Centos 7 containers, all of which appear to be working, apart
from some cosmetic breakage that came from moving internal-init.php into
/admin. (I've only ever used internal auth, so it's fine for my needs).

Thanks & Regards,

Regards,

Joe





On Sun, Aug 23, 2015 at 4:08 PM, Joshua Small <[email protected]> wrote:

> Hi,
>
>
>
> I’m going to say this once and then I won’t argue further.
>
>
>
> Building a database of user credentials in 2015 using MD5 is
> irresponsible. Forking an existing project so you can remove a secure
> hashing library and replace it with MD5 is worse.
>
>
>
> I don’t know where this term “native mysql encryption” is coming from, but
> what this code does – is MD5. It also replaced a CSPRNG with calls to
> mt_rand() for some reason.
>
>
>
> *From:* Maia-users [mailto:[email protected]] *On Behalf
> Of *jjs - mainphrame
> *Sent:* Saturday, 22 August 2015 8:51 AM
> *To:* [email protected]
> *Subject:* Re: [Maia-users] Plan to build a new mailguard server
>
>
>
> I've since discovered what was going on with the failed logins, as I was
> able to reproduce the issue without scrypt, and learned something about the
> maia db schema in the process. In any case, I've put together some install
> scripts for maia, which, when launched, ask a few questions and then do an
> unattended install.
>
>
>
> 1.0.4 - Brings a fresh centos 7 container to successful login of first
> maia user in a few minutes, depending on processing power and bandwidth
>
> 1.0.4r - Same procedure as above; tested on centos 7 and also the
> installer for ubuntu 14.04 LTS
>
> 1.0.3 - Same procedure as above; tested on centos 6
>
>
>
> 1.0.4r is my testing fork, which uses native mysql password encryption,
> plus the extra installer files.
>
> 1.0.3 is the legacy 1.0 branch forked from maiamailguard.com, plus the
> extra installer files.
>
>
>
> The scripts do the right thing here, but my platform coverage is sort of
> narrow here; Except for one deployment to a KVM image of ubuntu 14.04, I've
> only used OVZ containers in the testing, since they are incredibly fast and
> easy to deploy.
>
>
>
> if someone wants to try the installer on VMs or physical servers and tell
> me what breaks, that would be great.
>
>
>
> The 1.04r and the legacy repos:
>
>
>
> 1.04r - https://github.com/einheit/maia_mailguard
>
> 1.03r - https://github.com/einheit/mailguard_legacy
>
>
>
> Regards,
>
>
>
> Joe
>
>
>
> On Wed, Jul 29, 2015 at 12:36 PM, jjs - mainphrame <[email protected]>
> wrote:
>
> David,
>
>
>
> just as a sanity check, I'd set up a 1.0.3 server and the internal-init
> worked just as I remembered it.
>
>
>
> However, I'd really like to get up and running with 1.0.4, so thanks for
> the links, I'll follow up and see what all is needed.
>
>
>
> Regards,
>
>
>
> On Wed, Jul 29, 2015 at 12:23 PM, David Newman <[email protected]>
> wrote:
>
> On 7/29/15 12:17 PM, jjs - mainphrame wrote:
>
> > A promising maia login screen appears, but accessing
> > the login.php?super=register link leads only to a login failure.
>
> In pho-postfix (which uses Maia), that initial login must be from the
> full email address of a currently existing virtual user.
>
> pho-postfix start page:
>
> http://www.purplehat.org/?page_id=4
>
> Maia setup page, requires all preceding steps:
>
> http://www.purplehat.org/?page_id=199
>
> pho-postfix uses FreeBSD, so file locations will differ from CentOS, but
> Maia setup is similar.
>
> dn
>
>
> _______________________________________________
> Maia-users mailing list
> [email protected]
> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>
>
>
>
>

_______________________________________________
Maia-users mailing list
[email protected]
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users