From 260906e3501048bb6909a0d8329926e17cf2377f Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Mon, 22 Sep 2025 12:28:09 +0200 Subject: [PATCH 1/2] [SOGo][Web] Enable SOGo URL Encryption --- data/Dockerfiles/sogo/bootstrap-sogo.sh | 4 ++++ data/web/inc/triggers.user.inc.php | 4 ++-- data/web/sogo-auth.php | 5 +---- docker-compose.yml | 2 +- 4 files changed, 8 insertions(+), 7 deletions(-) diff --git a/data/Dockerfiles/sogo/bootstrap-sogo.sh b/data/Dockerfiles/sogo/bootstrap-sogo.sh index 96d8a6919..ad667fca6 100755 --- a/data/Dockerfiles/sogo/bootstrap-sogo.sh +++ b/data/Dockerfiles/sogo/bootstrap-sogo.sh @@ -50,6 +50,10 @@ cat < /var/lib/sogo/GNUstep/Defaults/sogod.plist YES SOGoEncryptionKey ${RAND_PASS} + SOGoURLEncryptionEnabled + YES + SOGoURLEncryptionPassphrase + ${RAND_PASS} OCSAdminURL mysql://${DBUSER}:${DBPASS}@%2Fvar%2Frun%2Fmysqld%2Fmysqld.sock/${DBNAME}/sogo_admin OCSCacheFolderURL diff --git a/data/web/inc/triggers.user.inc.php b/data/web/inc/triggers.user.inc.php index 4dee75a37..36176c694 100644 --- a/data/web/inc/triggers.user.inc.php +++ b/data/web/inc/triggers.user.inc.php @@ -80,7 +80,7 @@ if (isset($_POST["verify_tfa_login"])) { intval($user_details['attributes']['force_pw_update']) != 1 && getenv('SKIP_SOGO') != "y" && !$is_dual) { - header("Location: /SOGo/so/{$_SESSION['mailcow_cc_username']}"); + header("Location: /SOGo/so/"); die(); } else { header("Location: /user"); @@ -146,7 +146,7 @@ if (isset($_POST["login_user"]) && isset($_POST["pass_user"])) { intval($user_details['attributes']['force_pw_update']) != 1 && getenv('SKIP_SOGO') != "y" && !$is_dual) { - header("Location: /SOGo/so/{$login_user}"); + header("Location: /SOGo/so/"); die(); } else { header("Location: /user"); diff --git a/data/web/sogo-auth.php b/data/web/sogo-auth.php index 00709fe5f..962627baf 100644 --- a/data/web/sogo-auth.php +++ b/data/web/sogo-auth.php @@ -64,7 +64,7 @@ elseif (isset($_GET['login'])) { ':remote_addr' => ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR']) )); // redirect to sogo (sogo will get the correct credentials via nginx auth_request - header("Location: /SOGo/so/{$login}"); + header("Location: /SOGo/so/"); exit; } } @@ -81,10 +81,7 @@ elseif (isset($_SERVER['HTTP_X_ORIGINAL_URI']) && strcasecmp(substr($_SERVER['HT } require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/sessions.inc.php'; - // extract email address from "/SOGo/so/user@domain/xy" - $url_parts = explode("/", $_SERVER['HTTP_X_ORIGINAL_URI']); $email_list = array( - $url_parts[3], // Requested mailbox ($_SESSION['mailcow_cc_username'] ?? ''), // Current user ($_SESSION["dual-login"]["username"] ?? ''), // Dual login user ); diff --git a/docker-compose.yml b/docker-compose.yml index 215a196f9..eab49fd69 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -200,7 +200,7 @@ services: - phpfpm sogo-mailcow: - image: ghcr.io/mailcow/sogo:1.135 + image: ghcr.io/mailcow/sogo:1.136 environment: - DBNAME=${DBNAME} - DBUSER=${DBUSER} From 610609378f2138aac35abd23db8063fdc63d7ef1 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Mon, 22 Sep 2025 12:58:05 +0200 Subject: [PATCH 2/2] [SOGo][Web] Set URL encryption key in mailcow.conf --- _modules/scripts/new_options.sh | 11 ++++++----- data/Dockerfiles/sogo/bootstrap-sogo.sh | 2 +- docker-compose.yml | 1 + generate_config.sh | 4 ++++ 4 files changed, 12 insertions(+), 6 deletions(-) diff --git a/_modules/scripts/new_options.sh b/_modules/scripts/new_options.sh index a3f47dc61..30c747b70 100644 --- a/_modules/scripts/new_options.sh +++ b/_modules/scripts/new_options.sh @@ -43,6 +43,7 @@ adapt_new_options() { "ALLOW_ADMIN_EMAIL_LOGIN" "SKIP_HTTP_VERIFICATION" "SOGO_EXPIRE_SESSION" + "SOGO_URL_ENCRYPTION_KEY" "REDIS_PORT" "REDISPASS" "DOVECOT_MASTER_USER" @@ -94,7 +95,6 @@ adapt_new_options() { echo '# Max log lines per service to keep in Redis logs' >> mailcow.conf echo "LOG_LINES=9999" >> mailcow.conf ;; - IPV4_NETWORK) echo '# Internal IPv4 /24 subnet, format n.n.n. (expands to n.n.n.0/24)' >> mailcow.conf echo "IPV4_NETWORK=172.22.1" >> mailcow.conf @@ -276,21 +276,22 @@ adapt_new_options() { echo '# A COMPLETE DOCKER STACK REBUILD (compose down && compose up -d) IS NEEDED TO APPLY THIS.' >> mailcow.conf echo ENABLE_IPV6=${IPV6_BOOL} >> mailcow.conf ;; - SKIP_CLAMD) echo '# Skip ClamAV (clamd-mailcow) anti-virus (Rspamd will auto-detect a missing ClamAV container) - y/n' >> mailcow.conf echo 'SKIP_CLAMD=n' >> mailcow.conf ;; - SKIP_OLEFY) echo '# Skip Olefy (olefy-mailcow) anti-virus for Office documents (Rspamd will auto-detect a missing Olefy container) - y/n' >> mailcow.conf echo 'SKIP_OLEFY=n' >> mailcow.conf ;; - REDISPASS) echo "REDISPASS=$(LC_ALL=C /dev/null | head -c 28)" >> mailcow.conf ;; - + SOGO_URL_ENCRYPTION_KEY) + echo '# SOGo URL encryption key (exactly 16 characters, limited to A–Z, a–z, 0–9)' >> mailcow.conf + echo '# This key is used to encrypt email addresses within SOGo URLs' >> mailcow.conf + echo "SOGO_URL_ENCRYPTION_KEY=$(LC_ALL=C /dev/null | head -c 16)" >> mailcow.conf + ;; *) echo "${option}=" >> mailcow.conf ;; diff --git a/data/Dockerfiles/sogo/bootstrap-sogo.sh b/data/Dockerfiles/sogo/bootstrap-sogo.sh index ad667fca6..af7d2a4db 100755 --- a/data/Dockerfiles/sogo/bootstrap-sogo.sh +++ b/data/Dockerfiles/sogo/bootstrap-sogo.sh @@ -53,7 +53,7 @@ cat < /var/lib/sogo/GNUstep/Defaults/sogod.plist SOGoURLEncryptionEnabled YES SOGoURLEncryptionPassphrase - ${RAND_PASS} + ${SOGO_URL_ENCRYPTION_KEY} OCSAdminURL mysql://${DBUSER}:${DBPASS}@%2Fvar%2Frun%2Fmysqld%2Fmysqld.sock/${DBNAME}/sogo_admin OCSCacheFolderURL diff --git a/docker-compose.yml b/docker-compose.yml index eab49fd69..a0cf85e6a 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -213,6 +213,7 @@ services: - ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n} - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1} - SOGO_EXPIRE_SESSION=${SOGO_EXPIRE_SESSION:-480} + - SOGO_URL_ENCRYPTION_KEY=${SOGO_URL_ENCRYPTION_KEY:-SOGoSuperSecret0} - SKIP_SOGO=${SKIP_SOGO:-n} - MASTER=${MASTER:-y} - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-} diff --git a/generate_config.sh b/generate_config.sh index 2dba91d51..9a0bd132b 100755 --- a/generate_config.sh +++ b/generate_config.sh @@ -436,6 +436,10 @@ MAILDIR_SUB=Maildir # SOGo session timeout in minutes SOGO_EXPIRE_SESSION=480 +# SOGo URL encryption key (exactly 16 characters, limited to A–Z, a–z, 0–9) +# This key is used to encrypt email addresses within SOGo URLs +SOGO_URL_ENCRYPTION_KEY=$(LC_ALL=C /dev/null | head -c 16) + # DOVECOT_MASTER_USER and DOVECOT_MASTER_PASS must both be provided. No special chars. # Empty by default to auto-generate master user and password on start. # User expands to DOVECOT_MASTER_USER@mailcow.local