Re: [Tools-discuss] Fwd: [rt5.ietf.org #6435] Unable to get mail back from alias expansion - expand-mediaman-chairs

[Tero Kivinen <[e-mail]>]

Michael Richardson writes:
>     > 1) We use ARC to sign incoming messages before they are forwarded, and
>     > this allows end systems to verify the ARC headers, and whitelist our
>     > servers. I think that some of those modern mailbox service providers
> 
> What are you using to do this?

We use milter and rspamd to do that (it works both with sendmail and
postfix, and half of our machines are using sendmail other half
postfix). This is done on the first incoming machine, i.e., after that
the email might get forwarded to other machines in our internal
network (spam marking, the www mailbox etc), but those other machines
do not add any other ARC headers, only the first step does that.

>     > 2) We offer read-only web mail box for our members (opt-in), which
>     > stores copies for all emails sent to his address for last 7 days.  This
> 
> That's quite a brilliant thing to do.

As we are non-profit organization in Finland, that also adds some
restrictions to us, i.e., we are not supposed to compete against
companies offering similar things as a service. Because of that we
can't really offer real web mailbox service, as that would directly
complete with oter companies offering similar service, but this read
only temporary mailbox solution is fine. Also because it is read only
and isn't meant for permanent storage, it is also offered with
best-effort way, meaning we do not need to have backups of those
emails. If that machine break we simply replace it with new one from
the scratch.

For authentication all our services use separate automatically
generated strong service passwords for each service. We do NOT allow
users to pick those password themselves.

I.e., the web mail has password that looks like
asdfa-asdas-fewrg-vrmkl-weknq (i.e, 5 * 5 lower case letters separated
by dashes, about 120 bits of security). We do not expect anybody to
type that, but if you need to type it on your phone (for example you
do need to add your authenticated smtp service password to your email
client on phone, to be able to send emails), it is much easier to type
if it is only lowercase letters and dashes.

We did end up in cases where some applications didn't allow using that
long passwords so we also have a way of generating less secure (about
95 bits of security) passwords which are only 16-characters long, but
uses larger set of characters...

As those passwords are added to configurations of different low
security system like phones, web browsers etc, we want to make sure
each password is separate, and we have then one master password that
allows you to log in to user admin panel and change or show those
passwords (and then you can cut & paste it to your configuration
dialog).

For this master password we recommend people to write it down on paper
and keeping that paper in safe location. It is impossible to remember
password you use every few years or once every ten years, so you must
write it down. We also offer ability to use goverment issued
smartcards to log in to the adminstration interface (and then you do
not need passwords), which provides much better security than any of
the 2fa that others are using. Of course we had to disable TLS1.3
because of that (older smartcards support only RSASSA-PKCS1-v1_5,
newer ones support also RSASSA-PSS (TLS1.3) but TLS1.3 misses
renegotiation support also (I think)).
-- 
[e-mail]