kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss

Robert Speicher 2defc7b931 Merge branch 'rs-incoming-email-domain-docs' into 'security-10-0'

Add Security Concerns section to reply by email documentation

[ci skip]

See merge request gitlab/gitlabhq!2191

2017-09-17 12:54:30 -04:00

14 KiB

Raw Blame History

Reply by email

GitLab can be set up to allow users to comment on issues and merge requests by replying to notification emails.

Requirement

Reply by email requires an IMAP-enabled email account. GitLab allows you to use three strategies for this feature:

using email sub-addressing
using a dedicated email address
using a catch-all mailbox

Email sub-addressing

If your provider or server supports email sub-addressing, we recommend using it. Some features (e.g. create new issue via email) only work with sub-addressing.

Sub-addressing is a feature where any email to user+some_arbitrary_tag@example.com will end up in the mailbox for user@example.com, and is supported by providers such as Gmail, Google Apps, Yahoo! Mail, Outlook.com and iCloud, as well as the Postfix mail server which you can run on-premises.

Dedicated email address

This solution is really simple to set up: you just have to create an email address dedicated to receive your users' replies to GitLab notifications.

Catch-all mailbox

A catch-all mailbox for a domain will "catch all" the emails addressed to the domain that do not exist in the mail server.

How it works?

1. GitLab sends a notification email

When GitLab sends a notification and Reply by email is enabled, the Reply-To header is set to the address defined in your GitLab configuration, with the %{key} placeholder (if present) replaced by a specific "reply key". In addition, this "reply key" is also added to the References header.

2. You reply to the notification email

When you reply to the notification email, your email client will:

send the email to the Reply-To address it got from the notification email
set the In-Reply-To header to the value of the Message-ID header from the notification email
set the References header to the value of the Message-ID plus the value of the notification email's References header.

3. GitLab receives your reply to the notification email

When GitLab receives your reply, it will look for the "reply key" in the following headers, in this order:

the To header
the References header

If it finds a reply key, it will be able to leave your reply as a comment on the entity the notification was about (issue, merge request, commit...).

For more details about the Message-ID, In-Reply-To, and References headers, please consult RFC 5322.

Set it up

If you want to use Gmail / Google Apps with Reply by email, make sure you have IMAP access enabled and allowed less secure apps to access the account or turn-on 2-step validation and use an application password.

To set up a basic Postfix mail server with IMAP access on Ubuntu, follow the Postfix setup documentation.

Security Concerns

WARNING: Be careful when choosing the domain used for receiving incoming email.

For the sake of example, suppose your top-level company domain is hooli.com. All employees in your company have an email address at that domain via Google Apps, and your company's private Slack instance requires a valid @hooli.com email address in order to sign up.

If you also host a public-facing GitLab instance at hooli.com and set your incoming email domain to hooli.com, an attacker could abuse the "Create new issue by email" feature by using a project's unique address as the email when signing up for Slack, which would send a confirmation email, which would create a new issue on the project owned by the attacker, allowing them to click the confirmation link and validate their account on your company's private Slack instance.

We recommend receiving incoming email on a subdomain, such as incoming.hooli.com, and ensuring that you do not employ any services that authenticate solely based on access to an email domain such as *.hooli.com. Alternatively, use a dedicated domain for GitLab email communications such as hooli-gitlab.com.

See GitLab issue #30366 for a real-world example of this exploit.

Omnibus package installations

Find the incoming_email section in /etc/gitlab/gitlab.rb, enable the feature and fill in the details for your specific IMAP server and email account:

# Configuration for Postfix mail server, assumes mailbox incoming@gitlab.example.com
gitlab_rails['incoming_email_enabled'] = true

# The email address including the `%{key}` placeholder that will be replaced to reference the item being replied to.
# The placeholder can be omitted but if present, it must appear in the "user" part of the address (before the `@`).
gitlab_rails['incoming_email_address'] = "incoming+%{key}@gitlab.example.com"

# Email account username
# With third party providers, this is usually the full email address.
# With self-hosted email servers, this is usually the user part of the email address.
gitlab_rails['incoming_email_email'] = "incoming"
# Email account password
gitlab_rails['incoming_email_password'] = "[REDACTED]"

# IMAP server host
gitlab_rails['incoming_email_host'] = "gitlab.example.com"
# IMAP server port
gitlab_rails['incoming_email_port'] = 143
# Whether the IMAP server uses SSL
gitlab_rails['incoming_email_ssl'] = false
# Whether the IMAP server uses StartTLS
gitlab_rails['incoming_email_start_tls'] = false

# The mailbox where incoming mail will end up. Usually "inbox".
gitlab_rails['incoming_email_mailbox_name'] = "inbox"
# The IDLE command timeout.
gitlab_rails['incoming_email_idle_timeout'] = 60

# Configuration for Gmail / Google Apps, assumes mailbox gitlab-incoming@gmail.com
gitlab_rails['incoming_email_enabled'] = true

# The email address including the `%{key}` placeholder that will be replaced to reference the item being replied to.
# The placeholder can be omitted but if present, it must appear in the "user" part of the address (before the `@`).
gitlab_rails['incoming_email_address'] = "gitlab-incoming+%{key}@gmail.com"

# Email account username
# With third party providers, this is usually the full email address.
# With self-hosted email servers, this is usually the user part of the email address.
gitlab_rails['incoming_email_email'] = "gitlab-incoming@gmail.com"
# Email account password
gitlab_rails['incoming_email_password'] = "[REDACTED]"

# IMAP server host
gitlab_rails['incoming_email_host'] = "imap.gmail.com"
# IMAP server port
gitlab_rails['incoming_email_port'] = 993
# Whether the IMAP server uses SSL
gitlab_rails['incoming_email_ssl'] = true
# Whether the IMAP server uses StartTLS
gitlab_rails['incoming_email_start_tls'] = false

# The mailbox where incoming mail will end up. Usually "inbox".
gitlab_rails['incoming_email_mailbox_name'] = "inbox"
# The IDLE command timeout.
gitlab_rails['incoming_email_idle_timeout'] = 60

# Configuration for Microsoft Exchange mail server w/ IMAP enabled, assumes mailbox incoming@exchange.example.com
gitlab_rails['incoming_email_enabled'] = true

# The email address replies are sent to - Exchange does not support sub-addressing so %{key} is not used here
gitlab_rails['incoming_email_address'] = "incoming@exchange.example.com"

# Email account username
# Typically this is the userPrincipalName (UPN)
gitlab_rails['incoming_email_email'] = "incoming@ad-domain.example.com"
# Email account password
gitlab_rails['incoming_email_password'] = "[REDACTED]"

# IMAP server host
gitlab_rails['incoming_email_host'] = "exchange.example.com"
# IMAP server port
gitlab_rails['incoming_email_port'] = 993
# Whether the IMAP server uses SSL
gitlab_rails['incoming_email_ssl'] = true

Reconfigure GitLab for the changes to take effect:
```
sudo gitlab-ctl reconfigure
```
Verify that everything is configured correctly:
```
sudo gitlab-rake gitlab:incoming_email:check
```
Reply by email should now be working.

Installations from source

Go to the GitLab installation directory:
```
cd /home/git/gitlab
```

Find the incoming_email section in config/gitlab.yml, enable the feature and fill in the details for your specific IMAP server and email account:

sudo editor config/gitlab.yml

# Configuration for Postfix mail server, assumes mailbox incoming@gitlab.example.com
incoming_email:
  enabled: true

  # The email address including the `%{key}` placeholder that will be replaced to reference the item being replied to.
  # The placeholder can be omitted but if present, it must appear in the "user" part of the address (before the `@`).
  address: "incoming+%{key}@gitlab.example.com"

  # Email account username
  # With third party providers, this is usually the full email address.
  # With self-hosted email servers, this is usually the user part of the email address.
  user: "incoming"
  # Email account password
  password: "[REDACTED]"

  # IMAP server host
  host: "gitlab.example.com"
  # IMAP server port
  port: 143
  # Whether the IMAP server uses SSL
  ssl: false
  # Whether the IMAP server uses StartTLS
  start_tls: false

  # The mailbox where incoming mail will end up. Usually "inbox".
  mailbox: "inbox"
  # The IDLE command timeout.
  idle_timeout: 60

# Configuration for Gmail / Google Apps, assumes mailbox gitlab-incoming@gmail.com
incoming_email:
  enabled: true

  # The email address including the `%{key}` placeholder that will be replaced to reference the item being replied to.
  # The placeholder can be omitted but if present, it must appear in the "user" part of the address (before the `@`).
  address: "gitlab-incoming+%{key}@gmail.com"

  # Email account username
  # With third party providers, this is usually the full email address.
  # With self-hosted email servers, this is usually the user part of the email address.
  user: "gitlab-incoming@gmail.com"
  # Email account password
  password: "[REDACTED]"

  # IMAP server host
  host: "imap.gmail.com"
  # IMAP server port
  port: 993
  # Whether the IMAP server uses SSL
  ssl: true
  # Whether the IMAP server uses StartTLS
  start_tls: false

  # The mailbox where incoming mail will end up. Usually "inbox".
  mailbox: "inbox"
  # The IDLE command timeout.
  idle_timeout: 60

# Configuration for Microsoft Exchange mail server w/ IMAP enabled, assumes mailbox incoming@exchange.example.com
incoming_email:
  enabled: true

  # The email address replies are sent to - Exchange does not support sub-addressing so %{key} is not used here
  address: "incoming@exchange.example.com"

  # Email account username
  # Typically this is the userPrincipalName (UPN)
  user: "incoming@ad-domain.example.com"
  # Email account password
  password: "[REDACTED]"

  # IMAP server host
  host: "exchange.example.com"
  # IMAP server port
  port: 993
  # Whether the IMAP server uses SSL
  ssl: true
  # Whether the IMAP server uses StartTLS
  start_tls: false

  # The mailbox where incoming mail will end up. Usually "inbox".
  mailbox: "inbox"
  # The IDLE command timeout.
  idle_timeout: 60

Enable mail_room in the init script at /etc/default/gitlab:

sudo mkdir -p /etc/default
echo 'mail_room_enabled=true' | sudo tee -a /etc/default/gitlab

Restart GitLab:
```
sudo service gitlab restart
```

Verify that everything is configured correctly:

sudo -u git -H bundle exec rake gitlab:incoming_email:check RAILS_ENV=production

Reply by email should now be working.

Development

Go to the GitLab installation directory.