[LBBS-37] Restrict outgoing port 25 from containers while allowing other traffic
The isonetexec execution mode launches programs inside a container with networking. The problem with this is that this is done as simply as possible, so all outbound connections are possible, in theory. A skilled user can connect to a mail server and send mail impersonating other BBS users or traffic that the BBS itself is authorized to send but not that particular user.
There is no good reason to allow any connections to port 25 from within any container environments - ideally, these should always be blocked, much the same way that residential ISPs block outgoing port 25. However, this will involve more complex network arrangements than those assumed so far. This should be figured out and incorporated in the defaults/templates for containers so that a known-secure configuration is available as a starting point.
Informative References:
- https://lukasatkinson.de/2017/linux-containers/
- https://blog.lizzie.io/linux-containers-in-500-loc.html
Comments
You must be