From 004c3cf1e28f88f8168a46c21a6fe8c5524401c7 Mon Sep 17 00:00:00 2001 From: Vegard Hagen Date: Thu, 31 Jul 2025 19:56:20 +0200 Subject: [PATCH] fix(authelia): obfuscate smtp relay username to avoid getting "leaked" credentials emails Also rotate both username and password Signed-off-by: Vegard Hagen --- k8s/infra/auth/authelia/smtp-credentials.yaml | 3 ++- k8s/infra/auth/authelia/values.yaml | 4 +++- k8s/infra/auth/lldap/smtp-credentials.yaml | 4 ++-- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/k8s/infra/auth/authelia/smtp-credentials.yaml b/k8s/infra/auth/authelia/smtp-credentials.yaml index a1b8650..071e07b 100644 --- a/k8s/infra/auth/authelia/smtp-credentials.yaml +++ b/k8s/infra/auth/authelia/smtp-credentials.yaml @@ -5,7 +5,8 @@ metadata: namespace: authelia spec: encryptedData: - password: AgAHXSnsiZu9pG5QJUkSpQfuXaqDazQVQNe11rvEqVGKlAPk/Ceo2HU0bHb6F/f3tOcv9m+taYWHgVs7NI4D6XEHoNfgdd7GzJXk6dq5NyAKasmiN5M811ibPFPSqkSJ04S7iQfTONrCfjuoVPP4H6IVfh0RVGZc2DQiOwvofKAKhfAwv3FbAs2UoQdgz2sXsEKeKDrQWxFA9vcUt6yM15CWxew/WbfHHrzI2qrqvuMm5Ep0mUVyW/QCeNjeUrWUTyh0ViuXxxkp39HuCxZvpoFfTwfo+5a4eTRN2ud3baHZH8GvmoOC7Sp93cLX4FJWT6LAQo7LeFtCRKAKKxgQQcdzmZYJ9rTEXT+hcmLYajtAdLxWQvDj2ICNVZgQmJi6imDnoObTrTbYSHNZAiXhasclPsEFiY9Mg5NUcsD8X4z1zEYWpNqyozKe0hXjverYxVRZeCXuv3Og/7WCi0of/GLOcAmIl6+hvk8k+UwpO6VvsGmYAZkG6ZWILkb9qXVYcLR/iqpLZfo63/QYQUvt1VTI3An5rrIEEuY8rlBToua1lyPWLEcjR/iNzc/Hpf31fqPVT1Li1M6uqvvpu2zDySzxV8RWVtJZswJ+31lrfqOzyGuRjeBEMIrANilE+Wuw2F0OJOrsK19g1Z8qGzvvDWjLaA3bbHUrMIYCUnYSlCCszzhTl5Lw0i+3o2ySUnKVRB6Vegm3m9y3sMlMvBcjog5o5k8vCEw6rHJLqnuJpZvArShN6iA4 + password: AgBGCyls7uWK4Y0XhKtdUoKS1L2wul78r1bBSSp1oJV6ah6DLcP1GNHMDuQsUaaeH4LD/5JihwBHJnEyZlC+eaBG1JOTtFidURWOpDAg8lMyKKeEg81KnKgtKeq86YhDXhN4CbZ0hBB4rnFcq2IYhHBPmmjqqE56v/VFlDKHftj7XKngz0iLhl76RjeHZJRVOITkhh638q1Mrjqs/AkvHLcrjHmA7i6ZxKBxlS5FwInIlCZunNvQdtjVrH6Uqe2isuuwoXkiFV8ncw2Exi6+3FtEwoH+xyz9VGu3+jGEV2aRwy1RJH9GVTuLKw5WiHVH1mjrXXLCk3jE8FmY9U5W7MfJthd8Wu6vgaBEweivzRx8KSllkUHuNg8fVOSiii38g1TXHWoQ9hQvKnV7NH12mc5EmlUoFQKhgDNqIOm6RY3m9fr/fYkV6D5Wpthd7RObqwyVlUaSDthG1bYLZt2Q72042E1TqL2zAIHVVMB7gZ/TeuVr/3cI0q31VDTbs7qcgn3ishhWdgtLN8sF/a5if7FbiaaT7oLdvY5KWBRpTmjLKhn4VvCnacR+hMaQ+z1YeHWCo1kWuJz5DcNFc8uDUlzPsL87L1sLBcTFcfnkfXpALdUlAibd6ghGxrg4KVqLgwmPkE9XMB0u/mHLm+5Txw4Ci6/hZSkcq4qBsmG0TJFEM+Rdi8YlDBkbUdGfTKBG6/+q0PPQQMgT0XeMt0oYR0K7oGHMq5NU+sHqmJjGKykN2zcYDcWN + username: AgCjKb0Hm2WUu8LkX8bIJOjBY5Kl+aZX2c9QhmI2m5rALbhNIBjsWESsJyr+VCWaE6wb0YG4PNe4Kkvav3bQdalY7JEFL/EkAt27hLkquayY0685VXFix7W/xkT6gTYB9/oxZG5NCnVB6mhaiozZfeQnz8erZuDoVLz05ud7sVeW3Yl7otJfbj/jBV5PSb1oMvcJWvsAki82hzpsC7uvAjk8WjubnOVgD+4hEqBjbQ8tMkqmAJ3d/8+xjlgs4ZujAkjm8O3xVcOq4eqxBDfPVT/Imcxgr5J1tAXQ9rD5SCcxkcuYNl7wLCUC2052cP5MwgrRj5KC9uP/ujb21fmAINw5CXpKCnYfiY5uBAa22TMzg+VmsORAS1WZlE+F3FhSgvnZj1iokfWVBoY5EYytMTi8OAtMsE5J86n/lecqKgcYn3vrEQ6HoU06JZYZuml/TMQmLj+i4FLX4nR1dShCfzkzU5hxDY3jG9zu+1z+F0ZIUs2dv8y12vlQEYd0cmqI9e2ohmP8R/CTF/Eg7oZjwVc4Ss4X74KTrHx4qifnV6RRA6DAuulqyBqv7+tTLdd9vQEEGX1FNUMNn7bgTe8xJl/yoWf9GcM5VOEun27zDAaunKUeDdzvT0De4AGYVJqVipQFtWzaF9iM7BoFGGG8JA0I/JmAyEK/X7zrcJbVs84+Hw6bLbDsjj1nX6k8nnycYdV7sPSA2TncCLK9AyEYamDTMY7semPIXfLh template: metadata: name: smtp-credentials diff --git a/k8s/infra/auth/authelia/values.yaml b/k8s/infra/auth/authelia/values.yaml index 3651115..210c929 100644 --- a/k8s/infra/auth/authelia/values.yaml +++ b/k8s/infra/auth/authelia/values.yaml @@ -10,6 +10,9 @@ pod: env: - name: TZ value: Europe/Oslo + - name: AUTHELIA_NOTIFIER_SMTP_USERNAME + valueFrom: + secretKeyRef: { name: smtp-credentials, key: username } extraVolumeMounts: - name: consent mountPath: /config/assets/locales/en/consent.json @@ -53,7 +56,6 @@ configMap: address: smtp://smtp.mailersend.net:587 sender: Authelia disable_html_emails: false - username: MS_aGoHwE@stonegarden.dev password: { secret_name: smtp-credentials } authentication_backend: diff --git a/k8s/infra/auth/lldap/smtp-credentials.yaml b/k8s/infra/auth/lldap/smtp-credentials.yaml index 339fdba..50be0a3 100644 --- a/k8s/infra/auth/lldap/smtp-credentials.yaml +++ b/k8s/infra/auth/lldap/smtp-credentials.yaml @@ -5,8 +5,8 @@ metadata: namespace: lldap spec: encryptedData: - LLDAP_SMTP_OPTIONS__PASSWORD: AgCH99rWEHwFf8YLLINz5HpVIqYjQ62R17aVjwDP5RG/ZOa/e0t8T4SBeSfaCPME1hDm2TM9xHdAgBLUOBUcWs1XxSpJDiT3zJYeKQ0m4QZsr8cAWqj30b2Jp+ZRUj4jCDOYnd5w73R8MD8XXb+Wsb5frzdRezvrX71EtuC05aEc/3PxN0Uv4LaF9vW4x7yiPRDW0Hrvt8KR56qR3ludXZjEwW5GhKGP/7jaCz+xpA2X59bPb1Ox7Aw1ExifR/UmR4AN84tmDaIoWD3pcpI7pItwrnQaT4jRNrgokMYaE3qAyRKpcEu0ESUdmSJgocnBcdoJw9DwlcoBnMtbL0O5zIzmNTo6n9jvWN5N+vrpAWLXLJLj1Lt8RwKdNsawKNk7SIL9U8gaVOKbn1Z0AFdu7PMUdo/g6aoORpQRTaVtsZsB51SBuxdsyaKVYFYHYr8KRljbEwCinODst5BqkwJHrlp83BhBaS8wyXC95FCKv6lF1+cxWnDBFEtUDMWkfDHrI0sbhvjeMCAzk5eH7md3a1y7EqWg+rJ8jVnP6SE+cQUF0HqsxR7hl6nc1LqHT2DUlW+Ih8a1RhdGbUsDG74YLAxAJDyo3Hw+R6E6Tqr5ouYfaFD28pgM/U5qDE5Ql0waY43xd1SP9Y6NTNkymrvgVoVeSlwyXH59+apBqdJxBRkv9bTvLIpDvUt/VKf90vEWTZVtGeKco9nx81vHvdSm4vT0cNvJtjjVVstF4o+ZyCAy3euffm1Y - LLDAP_SMTP_OPTIONS__USER: AgCZMdLWN7d5MWIMlvpK0o5ax/q7yMUk6VYqn6XIGmN/H3Kjf8v6OuJT0/OjFoCiBCuo9ZLdqOYa/b/z7FZgRrFzfFSor5M2HdYTWWZ8UTe2Hn90tJMauOyhBegKH5E2Dx3K+wAWrI+ZuEKsNVPxZjWOkdIseioa0H6HgT7kYTeGnJONqvCuiZgxcp6goiRkk8SG1dbW81QDUnVX9sIf6TMKp9CI05fddHKoitOr79N96aY1KTrmhtdp0XU5qVLQEEqm0OYpruPVY9lYzmJ3EqNfM5uj+kAxE/Y4DqFGnuKnxV7xcxBVo8ha+H4LwD1nKglgA2/0Q7xn1jwpJ1MnRKujN+u3yvau+gCdoBWlrwPmGf9uC5mw4Vpr59R99dDG1MqG2Msbz4m3Yaooigdi2EU73kWTGhZ339oaTAIviqCGvIfNtKMz8sOpTsN4YcLeyrsKK7d7tw+cZtTM3M/yuQ+E3AiUVrulk69DAS4VXArGQdZN1QV0mfD8EblscuKmVwwJ5LBXT2lYiqdDVqkAztm+i/ik7l65BIbu2IkWVgx6hJXQsbe+jTzXJvG+dd9kFRJR7nBEsC5zoIQqOkwrd42PwuvCcny/7K0NKOFNBhw2o227O1wGtyem9YeaOtn3Kvo6ijn5Dl+QZ7VZwqPzFQ1G8/mGBwJ9okAkCpctMojtFzlcNNcs9cGQcsmxyfOZnzs679nkofDwlifPrqb3Lxi7H4f+nBmMKObI + LLDAP_SMTP_OPTIONS__PASSWORD: AgAtjT1BBkaq+bIykilTSy+pQGoJTWPJrm4Ho2w5GmFwO6fKx+t6LE+VO+pDGf4R543nV8yjXFU/0bsdwJnPTpKkADs7LjkEU6FYLD1XQC/9uy3Nt3I3T9CFU5Xp5QZf2jc7qC/0ePENTMfM1YgwfQA4sWdTPoPfZ4G2OKuiD5vmUclUjy3rfCvpig8HwEsAgIxF+34x7wq2UqNGKoUnRRydUL3IqcQJbVRA6eUp4xzk45R0dZIeLeViwNRK3HPM5tBHb9OSyi4QuHg+1Ovaf+R8mT57tJRQzxkTuzLJ0Zcai99i+xzq1CQab2ZnEhtNBMnVkZt2DhvK7h/bydVfsCMKJKwaZ5sPGPWpRbVO2xwToWj4UdUA1SLPd5uP+trYAUDZgT5K6f/Sl1rdjv0OubABejAGwIbg2hatSTUM3FqrtwIkNJ71S9xeYdWfU55Tzy5S7KFcbQ60BhjYU00r/8QMJ6a7Bek6ydhBcBjrnkUcplF2q+yFJpyeOBehJwAQi4KLTOGOAuIrxi2hw1NKssRH4vT7Aj2aTR8ea3NvkjyBQvgmZnHDQLm6xybFuTnUIpBjTzM5PSMsLabgbCNATy91Qh7IcWIUtDHGbkDu/FEWw4DsvZbhpDTrvEi5HruPtSoDch1POM20JBUoVBzmERqg1CHn1llZbCeBLuEjlO19XNDRhzqP16DRrN5SX1+f1/BZYyiDVApbINKDlpR/D3X4CCh0JcUPd1vam+pDAVeT24VWu/4R + LLDAP_SMTP_OPTIONS__USER: AgB+S7DgyD8ipdc9fT1qPKsaRcm88tVMsK4QgUqSnTG21ExNPknjO0F9rjCly4M9ibiw6eMbOt+ss7iRsD1NS7qEQo0DsEHS78BYDE4W/GtTZjNwE4CFnk4Ugya/30sELIWsIqngx1UsZFGxjJJ5+2yFmkYGaXLHFpHHOAf+4or+aYUJO6451869EFljZ4LN4sP7Z4SaCzd49KnNDzg+mnqjwO/bSYxtxCAFg41eM4QZPkz4KthzOdyjAODDsrEaF8+e2quNf41OKeMPX9XmCVk5a31g9ESjp+jxRpfK94pntwIKAZTMNYSvCI+uvkVUq6J/SdqUgZX7gZ40XTQxwto8MaCP9QBEc5prKNizhij3J7/Mpuvp6FORmpK6YlEcfxDsHYRf9RQyMWknLkrKmelvVmVT9KgVGDRnIHAoA/THKERKc8/RdpACSle52JUa0W6S9nq2m2YwV/7IpW14eNSuZVqGZEereWjl6WC6OGICu5V3Uz88cLGTiiLCDtm+LR2WlyH1H01HURz5ilWiWVby3PTjbBEbOpjiEKs56x37SmE5nwHjVfAjcZBMm5n8jX8GaWsQ4Zo6366IJTaLlGdPUZ5kXs0e/ofqZtqw1s+8FsUHj2wvAmiFOtRzCaE42se+IihwRbp1l6/KbhTg9h24Ep0FKK5EnEc8eg/KbYbKNnenIcncWb6wM04WA+MkApXJvqksYrIpWqlqFd/Z/sm3/Gj5ii4dY/4t template: metadata: name: smtp-credentials