Securing SMTP Server to Telegram Integration

🔒 Introduction to SMTP-Telegram Security

When integrating an SMTP server with Telegram for email forwarding, security should be your top priority. This guide outlines best practices to secure your SMTP server and Telegram bot integration, protecting sensitive email data and preventing unauthorized access.

Security Warning: Insecure SMTP servers can lead to data breaches, unauthorized email access, and potential exploitation as spam relays. Always implement proper security measures before deploying to production.

🛡️ Security Improvement Areas

Secure the SMTP Server

🔐 Use TLS (STARTTLS or SMTPS)

Your current server disables STARTTLS and allows insecure authentication. To secure it:

Enable STARTTLS:

// In your SMTP server configuration
server.enableSTARTTLS = true;
server.enableAuth = true;

Generate a self-signed certificate for testing:

openssl req -new -x509 -keyout server.key -out server.cert -days 365 -nodes

Alternative: Use SMTPS (implicit SSL on port 465)

// In your SMTP server configuration
server = new SMTPServer({
  secure: true,
  key: fs.readFileSync('server.key'),
  cert: fs.readFileSync('server.cert')
});

🔐 Validate Sender (optional)

Enable a whitelist or authentication to prevent spam:

server = new SMTPServer({
  onAuth: async (auth, session, callback) => {
    // Check credentials against secure database
    if (auth.username === 'allowed_user' && 
        auth.password === 'secure_password') {
      return callback(null, { user: auth.username });
    }
    return callback(new Error('Invalid credentials'));
  }
});

Harden Telegram Bot Security

🔐 Secure Bot Tokens

Move bot tokens out of source files:

Example .env file:

TELEGRAM_BOT_TOKEN=your_bot_token_here
ALLOWED_CHAT_IDS=123456789,987654321

Load using dotenv:

// Install: npm install dotenv
require('dotenv').config();

// In Node.js (index.js)
const bot = new TelegramBot(process.env.TELEGRAM_BOT_TOKEN, { polling: true });

// In Python (email_to_telegram.py)
import os
from dotenv import load_dotenv

load_dotenv()
bot_token = os.getenv("TELEGRAM_BOT_TOKEN")

Sanitize and Encrypt Email Storage

📁 Protect Files

Set restricted file permissions:

// In Node.js
const fs = require('fs');
fs.writeFileSync('emails.json', JSON.stringify(emails), { mode: 0o600 });

// In Linux/Unix
chmod 600 emails.json

🔐 Optionally Encrypt Email Content

Use symmetric encryption for sensitive email content:

// In Node.js
const crypto = require('crypto');

function encryptData(data, key) {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipheriv('aes-256-cbc', Buffer.from(key), iv);
  let encrypted = cipher.update(data, 'utf8', 'hex');
  encrypted += cipher.final('hex');
  return iv.toString('hex') + ':' + encrypted;
}

function decryptData(encryptedData, key) {
  const [ivHex, encrypted] = encryptedData.split(':');
  const iv = Buffer.from(ivHex, 'hex');
  const decipher = crypto.createDecipheriv('aes-256-cbc', Buffer.from(key), iv);
  let decrypted = decipher.update(encrypted, 'hex', 'utf8');
  decrypted += decipher.final('utf8');
  return decrypted;
}

Avoid Code Injection & Content Attacks

🧼 Escape Content in Telegram Bot

In email_to_telegram.py, escape special Markdown characters:

def escape_markdown(text):
    # Escape Markdown special characters
    special_chars = ['_', '*', '[', ']', '(', ')', '~', '`', '>', '#', '+', '-', '=', '|', '{', '}', '.', '!']
    for char in special_chars:
        text = text.replace(char, f'\\{char}')
    return text

# Use when sending messages
safe_subject = escape_markdown(email_subject)
safe_body = escape_markdown(email_body)
bot.send_message(chat_id, f"*Subject:* {safe_subject}\n\n{safe_body}", parse_mode="MarkdownV2")

Secure File Handling for Attachments

🔍 Validate MIME Types

Ignore potentially dangerous file types:

def is_safe_attachment(filename, mime_type):
    dangerous_extensions = ['.exe', '.bat', '.cmd', '.sh', '.js', '.vbs', '.ps1']
    dangerous_mimes = ['application/x-msdownload', 'application/x-executable']
    
    if any(filename.lower().endswith(ext) for ext in dangerous_extensions):
        return False
        
    if mime_type in dangerous_mimes:
        return False
        
    return True

🧹 Sanitize Filenames

Clean filenames before saving or sending:

import re
import os

def sanitize_filename(filename):
    # Remove path traversal attempts
    filename = os.path.basename(filename)
    
    # Replace potentially dangerous characters
    filename = re.sub(r'[^\w\.-]', '_', filename)
    
    # Ensure filename isn't too long
    if len(filename) > 255:
        name, ext = os.path.splitext(filename)
        filename = name[:min(len(name), 255 - len(ext))] + ext
    
    return filename

Add Logging + Rate Limiting

📘 Logging

Add detailed logs with timestamps:

// In Node.js
const logEvent = (type, message, data = {}) => {
  const timestamp = new Date().toISOString();
  const logEntry = {
    timestamp,
    type,
    message,
    data
  };
  
  console.log(JSON.stringify(logEntry));
  fs.appendFileSync('security.log', JSON.stringify(logEntry) + '\n');
};

// Example usage
logEvent('AUTH_FAILURE', 'Failed login attempt', { ip: session.remoteAddress, user: auth.username });

🛡️ Rate Limiting

Implement rate limiting to prevent abuse:

// Simple in-memory rate limiter
const ipAttempts = {};

function checkRateLimit(ip, maxAttempts = 5, windowMs = 60000) {
  const now = Date.now();
  
  if (!ipAttempts[ip]) {
    ipAttempts[ip] = [];
  }
  
  // Clean old attempts
  ipAttempts[ip] = ipAttempts[ip].filter(timestamp => now - timestamp < windowMs);
  
  // Check if too many attempts
  if (ipAttempts[ip].length >= maxAttempts) {
    logEvent('RATE_LIMIT', 'Rate limit exceeded', { ip });
    return false;
  }
  
  // Add this attempt
  ipAttempts[ip].push(now);
  return true;
}

📊 Security Implementation Checklist

Feature	Status
TLS / STARTTLS or SMTPS	⚠️ Not enabled yet
Token management with .env	❌ Not yet used
Secure file permissions	❌ Needs setup
Sanitize content & filenames	⚠️ Partial
Attachment filtering	❌ Missing
Bot Markdown escaping	⚠️ Partial
Logs with timestamps	❌ Basic
Rate limiting	❌ Not added

🚀 Next Steps

To fully secure your SMTP to Telegram integration, prioritize these actions:

Add STARTTLS configuration to your index.js with certificate generation
Refactor all bot/token scripts to use .env for secure credential storage
Implement filename & MIME filtering for attachments
Set up proper logging and monitoring
Add rate limiting to prevent abuse

Secure your communications. Protect your data.

Tech Discussions

Search This Blog