- Fixed rsync backups not working with the default port.
- Reverted “Improve error messages in the management tools when external command-line tools are run.” because of the possibility of user secrets being included in error messages.
- Fix for TLS certificate SHA fingerprint not being displayed during setup.
**Before upgrading**, you must **first upgrade your existing Ubuntu 18.04 box to Mail-in-a-Box v0.51 or later**, if you haven’t already done so. That may not be possible after Ubuntu 18.04 reaches its end of life in April 2023, so please complete the upgrade well before then. (If you are not using Nextcloud’s contacts or calendar, you can migrate to the latest version of Mail-in-a-Box from any previous version.)
- dovecot is upgraded to 2.3.16, postfix to 3.6.4, opendmark to 1.4 (which adds ARC-Authentication-Results headers), and spampd to 2.53 (alleviating a mail delivery rate limiting bug).
- Nextcloud is upgraded to 23.0.4 (contacts to 4.2.0, calendar to 3.5.0).
- Roundcube is upgraded to 1.6.0.
- certbot is upgraded to 1.21 (via the Ubuntu repository instead of a PPA).
- “SMTPUTF8” is now disabled in Postfix. Because Dovecot still does not support SMTPUTF8, incoming mail to internationalized addresses was bouncing. This fixes incoming mail to internationalized domains (which was probably working prior to v0.40), but it will prevent sending outbound mail to addresses with internationalized local-parts.
- Forwarded mail using mail filter rules (in Roundcube; “sieve” rules) stopped re-writing the envelope address at some point, causing forwarded mail to often be marked as spam by the final recipient. These forwards will now re-write the envelope as the Mail-in-a-Box user receiving the mail to comply with SPF/DMARC rules.
- Sending mail is now possible on port 465 with the “SSL” or “TLS” option in mail clients, and this is now the recommended setting. Port 587 with STARTTLS remains available but should be avoided when configuring new mail clients.
- Roundcube’s login cookie is updated to use a new encryption algorithm (AES-256-CBC instead of DES-EDE-CBC).
- The ECDSAP256SHA256 DNSSEC algorithm is now available. If a DS record is set for any of your domain names that have DNS hosted on your box, you will be prompted by status checks to update the DS record at your convenience.
- Null MX records are added for domains that do not serve mail.
- Incoming emails with SPF/DKIM/DMARC failures now get a higher spam score, and these messages are more likely to appear in the junk folder, since they are often spam/phishing.
- Two-factor authentication can now be enabled for logins to the control panel. However, keep in mind that many online services (including domain name registrars, cloud server providers, and TLS certificate providers) may allow an attacker to take over your account or issue a fraudulent TLS certificate with only access to your email address, and this new two-factor authentication does not protect access to your inbox. It therefore remains very important that user accounts with administrative email addresses have strong passwords.
- TLS certificate expiry dates are now shown in ISO8601 format for clarity.
- An MTA-STS policy for incoming mail is now published (in DNS and over HTTPS) when the primary hostname and email address domain both have a signed TLS certificate installed, allowing senders to know that an encrypted connection should be enforced.
- The per-IP connection limit to the IMAP server has been doubled to allow more devices to connect at once, especially with multiple users behind a NAT.
- autoconfig and autodiscover subdomains and CalDAV/CardDAV SRV records are no longer generated for domains that don’t have user accounts since they are unnecessary.
- IPv6 addresses can now be specified for secondary DNS nameservers in the control panel.
- TLS certificates are now provisioned in groups by parent domain to limit easy domain enumeration and make provisioning more resilient to errors for particular domains.
- Roundcube is updated to version 1.4.7 fixing a cross-site scripting (XSS) vulnerability with HTML messages with malicious svg/namespace (CVE-2020-15562) (https://roundcube.net/news/2020/07/05/security-updates-1.4.7-1.3.14-and-1.2.11).
- SSH connections are now rate-limited at the firewall level (in addition to fail2ban).
- Nightly backups now occur on a random minute in the 3am hour (in the system time zone). The minute is chosen during Mail-in-a-Box installation/upgrade and remains the same until the next upgrade.
- Fix for mail log statistics report on leap days.
- Fix Mozilla autoconfig useGlobalPreferredServer setting.
- TLS settings have been upgraded following Mozilla’s recommendations for servers. TLS1.2 and 1.3 are now the only supported protocols for web, IMAP, and SMTP (submission).
- Fixed an issue starting services when Mail-in-a-Box isn’t on the root filesystem.
- Changed some performance options affecting Roundcube and Nextcloud.
- A security issue was discovered in rsync backups. If you have enabled rsync backups, the file `id_rsa_miab` may have been copied to your backup destination. This file can be used to access your backup destination. If the file was copied to your backup destination, we recommend that you delete the file on your backup destination, delete `/root/.ssh/id_rsa_miab` on your Mail-in-a-Box, then re-run Mail-in-a-Box setup, and re-configure your SSH public key at your backup destination according to the instructions in the Mail-in-a-Box control panel.
- Brute force attack prevention was missing for the managesieve service.
This is the first release for Ubuntu 18.04. This version and versions going forward can **only** be installed on Ubuntu 18.04; however, upgrades of existing Ubuntu 14.04 boxes to the latest version supporting Ubuntu 14.04 (v0.30) continue to work as normal.
When **upgrading**, you **must first upgrade your existing Ubuntu 14.04 Mail-in-a-Box box** to the latest release supporting Ubuntu 14.04 --- that’s v0.30 --- before you migrate to Ubuntu 18.04. If you are running an older version of Mail-in-a-Box which has an old version of ownCloud or Nextcloud, you will _not_ be able to upgrade your data because older versions of ownCloud and Nextcloud that are required to perform the upgrade _cannot_ be run on Ubuntu 18.04. To upgrade from Ubuntu 14.04 to Ubuntu 18.04, you **must create a fresh Ubuntu 18.04 machine** before installing this version. In-place upgrades of servers are not supported. Since Ubuntu’s support for Ubuntu 14.04 has almost ended, everyone is encouraged to create a new Ubuntu 18.04 machine and migrate to it.
- Mail-in-a-Box now targets Ubuntu 18.04 LTS, which will have support from Ubuntu through 2022.
- Some of the system packages updated in virtue of using Ubuntu 18.04 include postfix (2.11=>3.3) nsd (4.0=>4.1), nginx (1.4=>1.14), PHP (7.0=>7.2), Python (3.4=>3.6), fail2ban (0.8=>0.10), Duplicity (0.6=>0.7).
- [Unofficial Bash Strict Mode](http://redsymbol.net/articles/unofficial-bash-strict-mode/) is turned on for setup, which might catch previously uncaught issues during setup.
- IMAP server-side full text search is no longer supported because we were using a custom-built `dovecot-lucene` package that we are no longer maintaining.
- Sending email is now disabled on port 25 --- you must log in to port 587 to send email, per the long-standing mail instructions.
- Greylisting may delay more emails from new senders. We were using a custom-built postgrey package previously that whitelisted sending domains in dnswl.org, but we are no longer maintaining that package.
- The users page now documents that passwords should only have ASCII characters to prevent character encoding mismaches between clients and the server.
- The users page no longer shows user mailbox sizes because this was extremely slow for very large mailboxes.
- The Mail-in-a-Box version is now shown in the system status checks even when the new-version check is disabled.
- The alises page now warns that alises should not be used to forward mail off of the box. Mail filters within Roundcube are better for that.
- The explanation of greylisting has been improved.
- Starting with v0.28, TLS certificate provisioning wouldn’t work on new boxes until the mailinabox setup command was run a second time because of a problem with the non-interactive setup.
- Update to Nextcloud 13.0.6.
- Update to Roundcube 1.3.7.
- Update to Z-Push 2.4.4.
- Backup dates listed in the control panel now use an internationalized format.
- Upgrades from v0.21c (February 1, 2017) or earlier were broken because the intermediate versions of ownCloud used in setup were no longer available from ownCloud.
- Some download errors had no output --- there is more output on error now.
- The background service for the control panel was not restarting on updates, leaving the old version running. This was broken in v0.26 and is now fixed.
- Installing your own TLS/SSL certificate had been broken since v0.24 because the new version of openssl became stricter about CSR generation parameters.
- Fix new installations which broke at the step of asking for the user’s desired email address, which was broken by v0.26’s changes related to the control panel.
- Fix the provisioning of TLS certificates by pinning a Python package we rely on (acme) to an earlier version because our code isn’t yet compatible with its current version.
- Reduce munin’s log_level from debug to warning to prevent massive log files.
- HTTPS, IMAP, and POP’s TLS settings have been updated to Mozilla’s intermediate cipher list recommendation. Some extremely old devices that use less secure TLS ciphers may no longer be able to connect to IMAP/POP.
- Updated web HSTS header to use longer six month duration.
- Adding attachments in Roundcube broke after the last update for some users after rebooting because a temporary directory was deleted on reboot. The temporary directory is now moved from /tmp to /var so that it is persistent.
- We now run `apt-get autoremove` at the start of setup to clear out old packages, especially old kernels that take up a lot of space. On the first run, this step may take a long time.
- We now fetch Z-Push from its tagged git repository, fixing an installation problem.
- Some old PHP5 packages are removed from setup, fixing an installation bug where Apache would get installed.
- Python 3 packages for the control panel are now installed using a virtualenv to prevent installation errors due to conflicts in the cryptography/openssl packages between OS-installed packages and pip-installed packages.
This update is a security update addressing [CVE-2017-16651, a vulnerability in Roundcube webmail that allows logged-in users to access files on the local filesystem](https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10).
- Updated to [Roundcube 1.3.1](https://roundcube.net/news/2017/06/26/roundcube-webmail-1.3.0-released), but unfortunately dropping the Vacation plugin because it has not been supported by its author and is not compatible with Roundcube 1.3, and updated the persistent login plugin.
- Updated to [Z-Push 2.3.8](http://download.z-push.org/final/2.3/z-push-2.3.8.txt).
- Dovecot now uses stronger 2048 bit DH params for better forward secrecy.
Installations and upgrades started failing about 10 days ago with the error “ImportError: No module named ‘packaging’” after an upstream package (Python’s setuptools) was updated by its maintainers. The updated package conflicted with Ubuntu 14.04’s version of another package (Python’s pip). This update upgrades both packages to remove the conflict.
If you already encountered the error during installation or upgrade of Mail-in-a-Box, this update may not correct the problem on your existing system. See https://discourse.mailinabox.email/t/v0-21c-release-fixes-python-package-installation-issue/1881 for help if the problem persists after upgrading to this version of Mail-in-a-Box.
- A remote code execution vulnerability is corrected in how the munin system monitoring graphs are generated for the control panel. The vulnerability involves an administrative user visiting a carefully crafted URL.
- Add SRV records for CardDAV/CalDAV to facilitate autoconfiguration (e.g. in DavDroid, whose latest version didn’t seem to work to configure with entering just a hostname).
- Domain aliases (and misconfigured aliases/catch-alls with non-existent local targets) would accept mail and deliver it to new mailbox folders on disk even if the target address didn’t correspond with an existing mail user, instead of rejecting the mail. This issue was introduced in v0.18.
- The Munin Monitoring link in the control panel now opens a new window.
- Munin system monitoring graphs are now zoomable.
- When a reboot is required (due to Ubuntu security updates automatically installed), a Reboot Box button now appears on the System Status Checks page of the control panel.
- It is now possible to add SRV and secondary MX records in the Custom DNS page.
- A swap file is now created if system memory is less than 2GB, 5GB of free disk space is available, and if no swap file yet exists.
- We now install Roundcube from the official GitHub repository instead of our own mirror, which we had previously created to solve problems with SourceForge.
- DKIM was incorrectly set up on machines where “localhost” was defined as something other than “127.0.0.1”.
- Block web access to the configuration parameters (config.php). There is no immediate impact (see [#776](https://github.com/mail-in-a-box/mailinabox/pull/776)), although advanced users may want to take note.
- When there’s a problem delivering an outgoing message, a new ‘warning’ bounce will come after 3 hours and the box will stop trying after 2 days (instead of 5).
- On multi-homed machines, Postfix now binds to the right network interface when sending outbound mail so that SPF checks on the receiving end will pass.
- Mail sent from addresses on subdomains of other domains hosted by this box would not be DKIM-signed and so would fail DMARC checks by recipients, since version v0.15.
- TLS certificate provisioning would crash if DNS propagation was in progress and a challenge failed; might have shown the wrong error when provisioning fails.
- Backup times were displayed with the wrong time zone.
- Thresholds for displaying messages when the system is running low on memory have been reduced from 30% to 20% for a warning and from 15% to 10% for an error.
- Backups to some AWS S3 regions broke in version 0.15 because we reverted the version of boto. That’s now fixed.
- On low-usage systems, don’t hold backups for quite so long by taking a full backup more often.
- Nightly status checks might fail on systems not configured with a default Unicode locale.
- If domains need a TLS certificate and the user hasn’t installed one yet using Let’s Encrypt, the administrator would get a nightly email with weird interactive text asking them to agree to Let’s Encrypt’s ToS. Now just say that the provisioning can’t be done automatically.
- Reduce the number of background processes used by the management daemon to lower memory consumption.
- Auto-create aliases for abuse@, as required by RFC2142.
- The DANE TLSA record is changed to use the certificate subject public key rather than the whole certificate, which means the record remains valid after certificate changes (so long as the private key remains the same, which it does for us).
- When IPv6 is enabled, check that system services are accessible over IPv6 too, that the box’s hostname resolves over IPv6, and that reverse DNS is setup correctly for IPv6.
- Explanatory text for setting up secondary nameserver is added/fixed.
- DNS checks now have a timeout in case a DNS server is not responding, so the checks don’t stall indefinitely.
- Better messages if external DNS is used and, weirdly, custom secondary nameservers are set.
- Add POP to the mail client settings documentation.
- The box’s IP address is added to the fail2ban whitelist so that the status checks don’t trigger the machine banning itself, which results in the status checks showing services down even though they are running.
- For SSL certificates, rather than asking you what country you are in during setup, ask at the time a CSR is generated. The default system self-signed certificate now omits a country in the subject (it was never needed). The CSR_COUNTRY Mail-in-a-Box setting is dropped entirely.
- Nightly backups and system status checks are now moved to 3am in the system’s timezone.
- fail2ban’s recidive jail is now active, which guards against persistent brute force login attacks over long periods of time.
- Setup (first run only) now asks for your timezone to set the system time.
- The Exchange/ActiveSync server is now taken offline during nightly backups (along with SMTP and IMAP).
- The machine’s random number generator (/dev/urandom) is now seeded with Ubuntu Pollinate and a blocking read on /dev/random.
- DNSSEC key generation during install now uses /dev/urandom (instead of /dev/random), which is faster.
- The $STORAGE_ROOT/ssl directory is flattened by a migration script and the system SSL certificate path is now a symlink to the actual certificate.
- If ownCloud sends out email, it will use the box’s administrative address now (admin@yourboxname).
- Z-Push (Exchange/ActiveSync) logs now exclude warnings and are now rotated to save disk space.
- Fix pip command that might have not installed all necessary Python packages.
- The control panel and backup would not work on Google Compute Engine because GCE installs a conflicting boto package.
- Added a new command `management/backup.py --restore` to restore files from a backup to a target directory (command line arguments are passed to `duplicity restore`).
- Spamassassin’s network-based tests (Pyzor, others) and DKIM tests are now enabled. (Pyzor had always been installed but was not active due to a misconfiguration.)
- Moving spam out of the Spam folder and into Trash would incorrectly train Spamassassin that those messages were not spam.
- Automatically create the Sent and Archive folders for new users.
- The HTML5_Notifier plugin for Roundcube is now included, which when turned on in Roundcube settings provides desktop notifications for new mail.
- The Exchange/ActiveSync backend Z-Push has been updated to fix a problem with CC’d emails not being sent to the CC recipients.
- When a new domain is added to the box, rather than applying a new self-signed certificate for that domain, the SSL certificate for the box’s primary hostname will be used instead.
- If a custom DNS record is set on a domain or ‘www’+domain, web would not be served for that domain. If the custom DNS record is just the box’s IP address, that’s a configuration mistake, but allow it and let web continue to be served.
- Accommodate really long domain names by increasing an nginx setting.
- Added an option to check for new Mail-in-a-Box versions within status checks. It is off by default so that boxes don’t “phone home” without permission.
- Added a random password generator on the users page to simplify creating new accounts.
- When S3 backup credentials are set, the credentials are now no longer ever sent back from the box to the client, for better security.
- Fixed the jumpiness when a modal is displayed.
- Focus is put into the login form fields when the login form is displayed.
- Status checks now include a warning if a custom DNS record has been set on a domain that would normally serve web and as a result that domain no longer is serving web.
- Status checks now check that secondary nameservers, if specified, are actually serving the domains.
- Some errors in the control panel when there is invalid data in the database or an improperly named archived user account have been suppressed.
- Added subresource integrity attributes to all remotely-sourced resources (i.e. via CDNs) to guard against CDNs being used as an attack vector.
Another ownCloud 8.1.1 issue was found. New installations left ownCloud improperly setup (“You are accessing the server from an untrusted domain.”). Upgrading to this version will fix that.
- The secondary nameservers option in the control panel now accepts more than one nameserver and a special xfr:IP format to specify zone-transfer-only IP addresses.
- A TLSA record is added for HTTPS for DNSSEC-aware clients that support it.
- Backups can now be turned off, or stored in Amazon S3, through new control panel options.
- Munin was not working on machines confused about their hostname and had lots of errors related to PANGO, NTP peers and network interfaces that were not up.
- ownCloud updated to version 8.1.1 (with upgrade work-around), its memcached caching enabled.
- When upgrading, network checks like blocked port 25 are now skipped.
- Tweaks to the intrusion detection rules for IMAP.
- Mail-in-a-Box’s setup is a lot quieter, hiding lots of irrelevant messages.
v0.12c was posted to work around the current Sourceforge.net outage: pyzor’s remote server is now hard-coded rather than accessing a file hosted on Sourceforge, and roundcube is now downloaded from a Mail-in-a-Box mirror rather than from Sourceforge.
- The administrator@ alias was incorrectly created starting with v0.11. If your first install was v0.11, check that the administrator@ alias forwards mail to you.
- Intrusion detection rules (fail2ban) are relaxed (i.e. less is blocked).
- SSL certificates could not be installed for the new automatic ‘www.’ redirect domains.
- PHP’s default character encoding is changed from no default to UTF8. The effect of this change is unclear but should prevent possible future text conversion issues.
- User-installed SSL private keys in the BEGIN PRIVATE KEY format were not accepted.
- SSL certificates with SAN domains with IDNA encoding were broken in v0.11.
- Some IDNA functionality was using IDNA 2003 rather than IDNA 2008.
- Users can no longer spoof arbitrary email addresses in outbound mail. When sending mail, the email address configured in your mail client must match the SMTP login username being used, or the email address must be an alias with the SMTP login username listed as one of the alias’s targets.
- This update replaces your DKIM signing key with a stronger key. Because of DNS caching/propagation, mail sent within a few hours after this update could be marked as spam by recipients. If you use External DNS, you will need to update your DNS records.
- The box will now install software from a new Mail-in-a-Box PPA on Launchpad.net, where we are distributing two of our own packages: a patched postgrey and dovecot-lucene.
- The munin system monitoring tool is now installed and accessible at /admin/munin.
- ownCloud updated to version 8.0.4. The ownCloud installation step now is reslient to download problems. The ownCloud configuration file is now stored in STORAGE_ROOT to fix loss of data when moving STORAGE_ROOT to a new machine.
- The setup scripts now run `apt-get update` prior to installing anything to ensure the apt database is in sync with the packages actually available.
- Internationalized Domain Names (IDNs) should now work in email. If you had custom DNS or custom web settings for internationalized domains, check that they are still working.
- It is now possible to set multiple TXT and other types of records on the same domain in the control panel.
- The custom DNS API was completely rewritten to support setting multiple records of the same type on a domain. Any existing client code using the DNS API will have to be rewritten. (Existing code will just get 404s back.)
- On some systems the `nsd` service failed to start if network inferfaces were not ready.
- In order to guard against misconfiguration that can lead to domain control validation hijacking, email addresses that begin with admin, administrator, postmaster, hostmaster, and webmaster can no longer be used for (new) mail user accounts, and aliases for these addresses may direct mail only to the box’s administrator(s).
- Backups now use duplicity’s built-in gpg symmetric AES256 encryption rather than my home-brewed encryption. Old backups will be incorporated inside the first backup after this update but then deleted from disk (i.e. your backups from the previous few days will be backed up).
- There was a race condition between backups and the new nightly status checks.
- The control panel would sometimes lock up with an unnecessary loading indicator.
- You can no longer delete your own account from the control panel.
- All Mail-in-a-Box release tags are now signed on github, instructions for verifying the signature are added to the README, and the integrity of some packages downloaded during setup is now verified against a SHA1 hash stored in the tag itself.
- The new check that system services are running mistakenly checked that the Dovecot Managesieve service is publicly accessible. Although the service binds to the public network interface we don’t open the port in ufw. On some machines it seems that ufw blocks the connection from the status checks (which seems correct) and on some machines (mine) it doesn’t, which is why I didn’t notice the problem.
- The current backup chain will now try to predict how many days until it is deleted (always at least 3 days after the next full backup).
- The list of aliases that forward to a user are removed from the Mail Users page because when there are many alises it is slow and times-out.
- Some status check errors are turned into warnings, especially those that might not apply if External DNS is used.
- If the box manages mail for a domain and a subdomain of that domain, outbound mail from the subdomain was not DKIM-signed and would therefore fail DMARC tests on the receiving end, possibly result in the mail heading into spam folders.
- Auto-configuration for Mozilla Thunderbird, Evolution, KMail, and Kontact is now available.
- Domains that only have a catch-all alias or domain alias no longer automatically create/require admin@ and postmaster@ addresses since they’ll forward anyway.
- Roundcube is updated to version 1.1.0.
- Authentication-Results headers for DMARC are now added to incoming mail.
- If a custom CNAME record is set on a ‘www’ subdomain, the default A/AAAA records were preventing the CNAME from working.
- If a custom DNS A record overrides one provided by the box, the a corresponding default IPv6 record by the box is removed since it will probably be incorrect.
- Internationalized domain names (IDNs) are now supported for DNS and web, but email is not yet tested.
- New control panel for setting custom DNS settings (without having to use the API).
- Status checks showed a false positive for Spamhause blacklists and for secondary DNS in some cases.
- Status checks would fail to load if openssh-sever was not pre-installed, but openssh-server is not required.
- The local DNS cache is cleared before running the status checks using ‘rncd’ now rather than restarting ‘bind9’, which should be faster and wont interrupt other services.
- Multi-domain and wildcard certificate can now be installed through the control panel.
- The DNS API now allows the setting of SRV records.
- The maximum size of outbound mail sent via webmail and Exchange/ActiveSync has been increased to 128 MB, the same as when using SMTP.
- Spam is no longer wrapped as an attachment inside a scary Spamassassin explanation. The original message is simply moved straight to the Spam folder unchanged.
- There is a new iOS/Mac OS X Configuration Profile link in the control panel which makes it easier to configure IMAP/SMTP/CalDAV/CardDAV on iOS devices and Macs.
- “Domain aliases” can now be configured in the control panel.
- Updated to [Roundcube 1.0.3](http://trac.roundcube.net/wiki/Changelog).
- IMAP/SMTP is now recommended even on iOS devices as Exchange/ActiveSync is terribly buggy.
- On-disk backups are now retained for a minimum of 3 days instead of 14. Beyond that the user is responsible for making off-site copies.
- IMAP no longer supports the legacy SSLv3 protocol. SSLv3 is now known to be insecure. I don’t believe any modern devices will be affected by this. HTTPS and SMTP submission already had SSLv3 disabled.
