From fcff1f5d2c599b448e94a6f5ee7388829725c727 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sat, 11 Apr 2020 19:12:40 +0100 Subject: [PATCH 001/411] Change environment to Debian 10 --- Vagrantfile | 7 ++++++- setup/preflight.sh | 6 +++--- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/Vagrantfile b/Vagrantfile index 467fb95e..5f9d780f 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -2,7 +2,12 @@ # vi: set ft=ruby : Vagrant.configure("2") do |config| - config.vm.box = "ubuntu/bionic64" + # Recreate our conditions + config.vm.box = "generic/debian10" + config.vm.provider "hyperv" do |v| + v.memory = 1024 + v.cpus = 1 + end # Network config: Since it's a mail server, the machine must be connected # to the public web. However, we currently don't want to expose SSH since diff --git a/setup/preflight.sh b/setup/preflight.sh index 2547c410..bb755f9e 100644 --- a/setup/preflight.sh +++ b/setup/preflight.sh @@ -7,9 +7,9 @@ if [[ $EUID -ne 0 ]]; then exit fi -# Check that we are running on Ubuntu 18.04 LTS (or 18.04.xx). -if [ "`lsb_release -d | sed 's/.*:\s*//' | sed 's/18\.04\.[0-9]/18.04/' `" != "Ubuntu 18.04 LTS" ]; then - echo "Mail-in-a-Box only supports being installed on Ubuntu 18.04, sorry. You are running:" +# Check that we are running on Debian GNU/Linux +if [ "`lsb_release -d | sed 's/.*:\s*//' | sed -r 's/ [[:digit:]]+ (.*)//' `" != "Debian GNU/Linux" ]; then + echo "Mail-in-a-Box only supports being installed on Debian (ideally, 10 or later), sorry. You are running:" echo lsb_release -d | sed 's/.*:\s*//' echo From 9fb02090bf6653abf9d176e4abf351883683ab13 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sat, 11 Apr 2020 19:23:33 +0100 Subject: [PATCH 002/411] Remove operations not applicable to Debian Signed-off-by: David Duque --- setup/system.sh | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/setup/system.sh b/setup/system.sh index 28043b16..66804919 100755 --- a/setup/system.sh +++ b/setup/system.sh @@ -86,12 +86,9 @@ if [ ! -f /usr/bin/add-apt-repository ]; then apt_install software-properties-common fi -# Ensure the universe repository is enabled since some of our packages -# come from there and minimal Ubuntu installs may have it turned off. -hide_output add-apt-repository -y universe +# N/A to Debian -# Install the certbot PPA. -hide_output add-apt-repository -y ppa:certbot/certbot +# Certbot doesn't require a PPA in Debian # ### Update Packages From 0568bcc5d392504afd31fae30452a84c126b36f6 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 12 Apr 2020 00:44:19 +0100 Subject: [PATCH 003/411] Early configuration of the nsd service --- setup/dns.sh | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/setup/dns.sh b/setup/dns.sh index 5d86227a..48453d21 100755 --- a/setup/dns.sh +++ b/setup/dns.sh @@ -16,11 +16,14 @@ source /etc/mailinabox.conf # load global vars # * ldnsutils: Helper utilities for signing DNSSEC zones. # * openssh-client: Provides ssh-keyscan which we use to create SSHFP records. echo "Installing nsd (DNS server)..." -apt_install nsd ldnsutils openssh-client +apt_install ldnsutils openssh-client # Prepare nsd's configuration. mkdir -p /var/run/nsd +mkdir -p /etc/nsd +mkdir -p /etc/nsd/zones +touch /etc/nsd/nsd.conf cat > /etc/nsd/nsd.conf << EOF; # Do not edit. Overwritten by Mail-in-a-Box setup. @@ -64,6 +67,9 @@ done echo "include: /etc/nsd/zones.conf" >> /etc/nsd/nsd.conf; +# Attempting a late install of nsd (after configuration) +apt_install nsd + # Create DNSSEC signing keys. mkdir -p "$STORAGE_ROOT/dns/dnssec"; From 5c93d698b4fa727f6944f480303e828763ecc049 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 12 Apr 2020 00:50:31 +0100 Subject: [PATCH 004/411] Update PHP version (7.2 -> 7.3) --- setup/web.sh | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/setup/web.sh b/setup/web.sh index e6aac6ef..893dd25f 100755 --- a/setup/web.sh +++ b/setup/web.sh @@ -2,6 +2,8 @@ # HTTP: Turn on a web server serving static files ################################################# +PHP_VERSION="7.3" # Expected php version + source setup/functions.sh # load our functions source /etc/mailinabox.conf # load global vars @@ -46,15 +48,15 @@ tools/editconf.py /etc/nginx/nginx.conf -s \ ssl_protocols="TLSv1.2 TLSv1.3;" # Tell PHP not to expose its version number in the X-Powered-By header. -tools/editconf.py /etc/php/7.2/fpm/php.ini -c ';' \ +tools/editconf.py /etc/php/$PHP_VERSION/fpm/php.ini -c ';' \ expose_php=Off # Set PHPs default charset to UTF-8, since we use it. See #367. -tools/editconf.py /etc/php/7.2/fpm/php.ini -c ';' \ +tools/editconf.py /etc/php/$PHP_VERSION/fpm/php.ini -c ';' \ default_charset="UTF-8" # Configure the path environment for php-fpm -tools/editconf.py /etc/php/7.2/fpm/pool.d/www.conf -c ';' \ +tools/editconf.py /etc/php/$PHP_VERSION/fpm/pool.d/www.conf -c ';' \ env[PATH]=/usr/local/bin:/usr/bin:/bin \ # Configure php-fpm based on the amount of memory the machine has @@ -64,7 +66,7 @@ tools/editconf.py /etc/php/7.2/fpm/pool.d/www.conf -c ';' \ TOTAL_PHYSICAL_MEM=$(head -n 1 /proc/meminfo | awk '{print $2}' || /bin/true) if [ $TOTAL_PHYSICAL_MEM -lt 1000000 ] then - tools/editconf.py /etc/php/7.2/fpm/pool.d/www.conf -c ';' \ + tools/editconf.py /etc/php/$PHP_VERSION/fpm/pool.d/www.conf -c ';' \ pm=ondemand \ pm.max_children=8 \ pm.start_servers=2 \ @@ -72,7 +74,7 @@ then pm.max_spare_servers=3 elif [ $TOTAL_PHYSICAL_MEM -lt 2000000 ] then - tools/editconf.py /etc/php/7.2/fpm/pool.d/www.conf -c ';' \ + tools/editconf.py /etc/php/$PHP_VERSION/fpm/pool.d/www.conf -c ';' \ pm=ondemand \ pm.max_children=16 \ pm.start_servers=4 \ @@ -80,14 +82,14 @@ then pm.max_spare_servers=6 elif [ $TOTAL_PHYSICAL_MEM -lt 3000000 ] then - tools/editconf.py /etc/php/7.2/fpm/pool.d/www.conf -c ';' \ + tools/editconf.py /etc/php/$PHP_VERSION/fpm/pool.d/www.conf -c ';' \ pm=dynamic \ pm.max_children=60 \ pm.start_servers=6 \ pm.min_spare_servers=3 \ pm.max_spare_servers=9 else - tools/editconf.py /etc/php/7.2/fpm/pool.d/www.conf -c ';' \ + tools/editconf.py /etc/php/$PHP_VERSION/fpm/pool.d/www.conf -c ';' \ pm=dynamic \ pm.max_children=120 \ pm.start_servers=12 \ @@ -132,7 +134,7 @@ chown -R $STORAGE_USER $STORAGE_ROOT/www # Start services. restart_service nginx -restart_service php7.2-fpm +restart_service php$PHP_VERSION-fpm # Open ports. ufw_allow http From 6cee029d15cc7fdbbc44a24b4099b22069514605 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 12 Apr 2020 00:56:55 +0100 Subject: [PATCH 005/411] Move php version to functions.sh --- setup/functions.sh | 2 ++ setup/web.sh | 2 -- setup/webmail.sh | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/setup/functions.sh b/setup/functions.sh index b36d14bc..cdf89bed 100644 --- a/setup/functions.sh +++ b/setup/functions.sh @@ -214,3 +214,5 @@ function git_clone { mv $TMPPATH/$SUBDIR $TARGETPATH rm -rf $TMPPATH } + +export PHP_VERSION="7.3" # Expected php version diff --git a/setup/web.sh b/setup/web.sh index 893dd25f..55db74c2 100755 --- a/setup/web.sh +++ b/setup/web.sh @@ -2,8 +2,6 @@ # HTTP: Turn on a web server serving static files ################################################# -PHP_VERSION="7.3" # Expected php version - source setup/functions.sh # load our functions source /etc/mailinabox.conf # load global vars diff --git a/setup/webmail.sh b/setup/webmail.sh index 89ed1722..86120c25 100755 --- a/setup/webmail.sh +++ b/setup/webmail.sh @@ -198,4 +198,4 @@ chmod 664 $STORAGE_ROOT/mail/roundcube/roundcube.sqlite # Enable PHP modules. phpenmod -v php mcrypt imap -restart_service php7.2-fpm +restart_service php$PHP_VERSION-fpm From 5f1343864cd404f4691d45fbc9c681926be6e9f1 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 12 Apr 2020 01:02:14 +0100 Subject: [PATCH 006/411] Use local PHP version --- setup/nextcloud.sh | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/setup/nextcloud.sh b/setup/nextcloud.sh index 3ab21176..92a2c753 100755 --- a/setup/nextcloud.sh +++ b/setup/nextcloud.sh @@ -112,7 +112,7 @@ fi if [ ! -d /usr/local/lib/owncloud/ ] || [[ ! ${CURRENT_NEXTCLOUD_VER} =~ ^$nextcloud_ver ]]; then # Stop php-fpm if running. If theyre not running (which happens on a previously failed install), dont bail. - service php7.2-fpm stop &> /dev/null || /bin/true + service php$PHP_VERSION-fpm stop &> /dev/null || /bin/true # Backup the existing ownCloud/Nextcloud. # Create a backup directory to store the current installation and database to @@ -239,7 +239,7 @@ fi # * We need to set the timezone to the system timezone to allow fail2ban to ban # users within the proper timeframe # * We need to set the logdateformat to something that will work correctly with fail2ban -# * mail_domain' needs to be set every time we run the setup. Making sure we are setting +# * mail_domain' needs to be set every time we run the setup. Making sure we are setting # the correct domain name if the domain is being change from the previous setup. # Use PHP to read the settings file, modify it, and write out the new settings array. TIMEZONE=$(cat /etc/timezone) @@ -285,7 +285,7 @@ if [ \( $? -ne 0 \) -a \( $? -ne 3 \) ]; then exit 1; fi # Set PHP FPM values to support large file uploads # (semicolon is the comment character in this file, hashes produce deprecation warnings) -tools/editconf.py /etc/php/7.2/fpm/php.ini -c ';' \ +tools/editconf.py /etc/php/$PHP_VERSION/fpm/php.ini -c ';' \ upload_max_filesize=16G \ post_max_size=16G \ output_buffering=16384 \ @@ -294,7 +294,7 @@ tools/editconf.py /etc/php/7.2/fpm/php.ini -c ';' \ short_open_tag=On # Set Nextcloud recommended opcache settings -tools/editconf.py /etc/php/7.2/cli/conf.d/10-opcache.ini -c ';' \ +tools/editconf.py /etc/php/$PHP_VERSION/cli/conf.d/10-opcache.ini -c ';' \ opcache.enable=1 \ opcache.enable_cli=1 \ opcache.interned_strings_buffer=8 \ @@ -304,8 +304,8 @@ tools/editconf.py /etc/php/7.2/cli/conf.d/10-opcache.ini -c ';' \ opcache.revalidate_freq=1 # If apc is explicitly disabled we need to enable it -if grep -q apc.enabled=0 /etc/php/7.2/mods-available/apcu.ini; then - tools/editconf.py /etc/php/7.2/mods-available/apcu.ini -c ';' \ +if grep -q apc.enabled=0 /etc/php/$PHP_VERSION/mods-available/apcu.ini; then + tools/editconf.py /etc/php/$PHP_VERSION/mods-available/apcu.ini -c ';' \ apc.enabled=1 fi @@ -330,4 +330,4 @@ rm -f /etc/cron.hourly/mailinabox-owncloud # ``` # Enable PHP modules and restart PHP. -restart_service php7.2-fpm +restart_service php$PHP_VERSION-fpm From 8667a574d4d74725eb395d557b10c5a1f93482a6 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 12 Apr 2020 01:04:55 +0100 Subject: [PATCH 007/411] Use local PHP version (ZPush) --- setup/zpush.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup/zpush.sh b/setup/zpush.sh index a1253d2d..136ccb1e 100755 --- a/setup/zpush.sh +++ b/setup/zpush.sh @@ -102,7 +102,7 @@ EOF # Restart service. -restart_service php7.2-fpm +restart_service php$PHP_VERSION-fpm # Fix states after upgrade From fa6e941e5670c7228f2966261a1b1f674554c93f Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 12 Apr 2020 01:41:01 +0100 Subject: [PATCH 008/411] README update --- README.md | 35 +++++++++++++++++++++++++++++++---- 1 file changed, 31 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 4eef7ed9..30314637 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,32 @@ -Mail-in-a-Box -============= +(Power) Mail-in-a-Box +===================== + +This is a fork of MiaB (duh), hacked and tuned to my needs: + +βœ… - **Done** + +πŸ‘¨β€πŸ’» - **Not there yet, but soon!** + +πŸ’€ - **I did not begin this part yet!** + +- βœ… Proper support for Debian (I recommend Debian Buster or later, but if it works on your machine, it works!); + +- - I changed the pre-flight checks to accept Debian and Debian only. If you think you can also make this fork Ubuntu-compatible, shoot a PR or something. + +- πŸ’€ Native support for SMTP relays (For example: SendGrid); + +- πŸ’€ Ability for "static" pages to use PHP (e.g. host a domain shortener); + +- πŸ’€ Custom pages should not have their pages defaulting to the MiaB services (`/admin`, `/mail`, etc.); + +- πŸ’€ Possibility of disabling some services (\*cough\* NextCloud \*cough\*); + +- πŸ’€ Anything else I might need to use; + +All in all, I think I should rename this to something like "Central [Clown Computing](https://www.urbandictionary.com/define.php?term=clown%20computing)", since I'm trying to cram as many services as possible into that poor machine (Spending 5$ is better than spending 10$) + +Original Documentation +====================== By [@JoshData](https://github.com/JoshData) and [contributors](https://github.com/mail-in-a-box/mailinabox/graphs/contributors). @@ -15,7 +42,7 @@ Our goals are to: * Promote [decentralization](http://redecentralize.org/), innovation, and privacy on the web. * Have automated, auditable, and [idempotent](https://web.archive.org/web/20190518072631/https://sharknet.us/2014/02/01/automated-configuration-management-challenges-with-idempotency/) configuration. * **Not** make a totally unhackable, NSA-proof server. -* **Not** make something customizable by power users. +* ~~**Not** make something customizable by power users.~~ Additionally, this project has a [Code of Conduct](CODE_OF_CONDUCT.md), which supersedes the goals above. Please review it when joining our community. @@ -84,7 +111,7 @@ Post your question on the [discussion forum](https://discourse.mailinabox.email/ Contributing and Development ---------------------------- -Mail-in-a-Box is an open source project. Your contributions and pull requests are welcome. See [CONTRIBUTING](CONTRIBUTING.md) to get started. +Mail-in-a-Box is an open source project. Your contributions and pull requests are welcome. See [CONTRIBUTING](CONTRIBUTING.md) to get started. The Acknowledgements From edb03b78628ece64343157150251e0b1185f46af Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 12 Apr 2020 23:54:35 +0100 Subject: [PATCH 009/411] Misc changes --- management/templates/system-status.html | 281 ++++++++++++------------ setup/mail-postfix.sh | 4 +- 2 files changed, 147 insertions(+), 138 deletions(-) diff --git a/management/templates/system-status.html b/management/templates/system-status.html index dc9233a5..a56d0cd5 100644 --- a/management/templates/system-status.html +++ b/management/templates/system-status.html @@ -1,160 +1,169 @@

System Status Checks

-
+
- + - + -
-
+
+
- - - - - -
+ + + + + +
-
+
diff --git a/setup/mail-postfix.sh b/setup/mail-postfix.sh index 0a66cb0f..f7641b5b 100755 --- a/setup/mail-postfix.sh +++ b/setup/mail-postfix.sh @@ -58,7 +58,7 @@ tools/editconf.py /etc/postfix/main.cf \ smtp_bind_address=$PRIVATE_IP \ smtp_bind_address6=$PRIVATE_IPV6 \ myhostname=$PRIMARY_HOSTNAME\ - smtpd_banner="\$myhostname ESMTP Hi, I'm a Mail-in-a-Box (Ubuntu/Postfix; see https://mailinabox.email/)" \ + smtpd_banner="\$myhostname ESMTP Hi, I'm a Power Mail-in-a-Box (Debian/Postfix)" \ mydestination=localhost # Tweak some queue settings: @@ -100,7 +100,7 @@ tools/editconf.py /etc/postfix/master.cf -s -w \ # Install the `outgoing_mail_header_filters` file required by the new 'authclean' service. cp conf/postfix_outgoing_mail_header_filters /etc/postfix/outgoing_mail_header_filters -# Modify the `outgoing_mail_header_filters` file to use the local machine name and ip +# Modify the `outgoing_mail_header_filters` file to use the local machine name and ip # on the first received header line. This may help reduce the spam score of email by # removing the 127.0.0.1 reference. sed -i "s/PRIMARY_HOSTNAME/$PRIMARY_HOSTNAME/" /etc/postfix/outgoing_mail_header_filters From 8d7f6bfb19787a790bd186a15ed1a6ca72da7b24 Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 00:55:48 +0100 Subject: [PATCH 010/411] Change all occurrences of PHP 7.2 to PHP 7.3 --- conf/nginx-top.conf | 2 +- management/backup.py | 4 ++-- tools/owncloud-restore.sh | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/conf/nginx-top.conf b/conf/nginx-top.conf index 4d888366..435b5f7b 100644 --- a/conf/nginx-top.conf +++ b/conf/nginx-top.conf @@ -7,6 +7,6 @@ ## your own --- please do not ask for help from us. upstream php-fpm { - server unix:/var/run/php/php7.2-fpm.sock; + server unix:/var/run/php/php7.3-fpm.sock; } diff --git a/management/backup.py b/management/backup.py index e1651552..1bec8638 100755 --- a/management/backup.py +++ b/management/backup.py @@ -247,7 +247,7 @@ def perform_backup(full_backup): if quit: sys.exit(code) - service_command("php7.2-fpm", "stop", quit=True) + service_command("php7.3-fpm", "stop", quit=True) service_command("postfix", "stop", quit=True) service_command("dovecot", "stop", quit=True) @@ -281,7 +281,7 @@ def perform_backup(full_backup): # Start services again. service_command("dovecot", "start", quit=False) service_command("postfix", "start", quit=False) - service_command("php7.2-fpm", "start", quit=False) + service_command("php7.3-fpm", "start", quit=False) # Remove old backups. This deletes all backup data no longer needed # from more than 3 days ago. diff --git a/tools/owncloud-restore.sh b/tools/owncloud-restore.sh index 4b0ba4de..27fe1f38 100755 --- a/tools/owncloud-restore.sh +++ b/tools/owncloud-restore.sh @@ -26,7 +26,7 @@ if [ ! -f $1/config.php ]; then fi echo "Restoring backup from $1" -service php7.2-fpm stop +service php7.3-fpm stop # remove the current ownCloud/Nextcloud installation rm -rf /usr/local/lib/owncloud/ @@ -45,5 +45,5 @@ chown www-data.www-data $STORAGE_ROOT/owncloud/config.php sudo -u www-data php /usr/local/lib/owncloud/occ maintenance:mode --off -service php7.2-fpm start +service php7.3-fpm start echo "Done" From 0d17caccfea124e109e49d3c0e29e77429b8b298 Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 01:07:16 +0100 Subject: [PATCH 011/411] Downgrade port 25 blockage error to warn; mention SMTP relays --- management/status_checks.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/management/status_checks.py b/management/status_checks.py index a9d0595c..4e599887 100755 --- a/management/status_checks.py +++ b/management/status_checks.py @@ -278,9 +278,9 @@ def run_network_checks(env, output): if ret == 0: output.print_ok("Outbound mail (SMTP port 25) is not blocked.") else: - output.print_error("""Outbound mail (SMTP port 25) seems to be blocked by your network. You - will not be able to send any mail. Many residential networks block port 25 to prevent hijacked - machines from being able to send spam. A quick connection test to Google's mail server on port 25 + output.print_warning("""Outbound mail (SMTP port 25) seems to be blocked by your network. You + will not be able to send any mail without a SMTP relay. Many residential networks block port 25 to prevent + hijacked machines from being able to send spam. A quick connection test to Google's mail server on port 25 failed.""") # Stop if the IPv4 address is listed in the ZEN Spamhaus Block List. From 974c9bba61e24749869160fead2e9e5b7cf7d0a7 Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 01:16:23 +0100 Subject: [PATCH 012/411] Fix status check colors, add SMTP relay stub --- .editorconfig | 3 + management/templates/index.html | 705 ++++++++++++------------ management/templates/smtp-relays.html | 6 + management/templates/system-status.html | 276 +++++----- 4 files changed, 506 insertions(+), 484 deletions(-) create mode 100644 management/templates/smtp-relays.html diff --git a/.editorconfig b/.editorconfig index fbe828c3..85e5fd9c 100644 --- a/.editorconfig +++ b/.editorconfig @@ -12,6 +12,9 @@ charset = utf-8 trim_trailing_whitespace = true insert_final_newline = true +[*.html] +indent_style = tab + [Makefile] indent_style = tab indent_size = 4 diff --git a/management/templates/index.html b/management/templates/index.html index 2c0d5a9a..5649ccfc 100644 --- a/management/templates/index.html +++ b/management/templates/index.html @@ -1,396 +1,409 @@ - - - - - {{hostname}} - Mail-in-a-Box Control Panel + + + + - + {{hostname}} - Mail-in-a-Box Control Panel - - - - - + h4:first-child { + margin-top: 6px; + } - - + .admin_panel { + display: none; + } - + table.table { + margin: 1.5em 0; + } -
-
- {% include "system-status.html" %} -
+ ol li { + margin-bottom: 1em; + } + + + -
- {% include "system-backup.html" %} -
+ -
- {% include "external-dns.html" %} -
+ + -
- {% include "custom-dns.html" %} -
+ -
- {% include "login.html" %} -
+
+
+ {% include "system-status.html" %} +
-
- {% include "mail-guide.html" %} -
+
+ {% include "system-backup.html" %} +
-
- {% include "users.html" %} -
+
+ {% include "external-dns.html" %} +
-
- {% include "aliases.html" %} -
+
+ {% include "custom-dns.html" %} +
-
- {% include "sync-guide.html" %} -
+
+ {% include "login.html" %} +
-
- {% include "web.html" %} -
+
+ {% include "mail-guide.html" %} +
-
- {% include "ssl.html" %} -
+
+ {% include "users.html" %} +
-
+
+ {% include "aliases.html" %} +
- -
+
+ {% include "sync-guide.html" %} +
- +
+ {% include "web.html" %} +
- +
+ {% include "ssl.html" %} +
- - +
- + -var ajax_num_executing_requests = 0; -function ajax_with_indicator(options) { - setTimeout("if (ajax_num_executing_requests > 0) $('#ajax_loading_indicator').fadeIn()", 100); - function hide_loading_indicator() { - ajax_num_executing_requests--; - if (ajax_num_executing_requests == 0) - $('#ajax_loading_indicator').stop(true).hide(); // stop() prevents an ongoing fade from causing the thing to be shown again after this call - } - var old_success = options.success; - var old_error = options.error; - options.success = function(data) { - hide_loading_indicator(); - if (data.status == "error") - show_modal_error("Error", data.message); - else if (old_success) - old_success(data); - }; - options.error = function(jqxhr) { - hide_loading_indicator(); - if (!old_error) - show_modal_error("Error", "Something went wrong, sorry.") - else - old_error(jqxhr.responseText, jqxhr); - }; - ajax_num_executing_requests++; - $.ajax(options); - return false; // handy when called from onclick -} + + - - diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html new file mode 100644 index 00000000..b578b7cf --- /dev/null +++ b/management/templates/smtp-relays.html @@ -0,0 +1,6 @@ + + +

SMTP Relays

+ +

Coming Soonβ„’

diff --git a/management/templates/system-status.html b/management/templates/system-status.html index a56d0cd5..09e94b7e 100644 --- a/management/templates/system-status.html +++ b/management/templates/system-status.html @@ -1,169 +1,169 @@

System Status Checks

-
+
- + - + -
-
+
+
- - - - - -
+ + + + + +
-
+
From 4aa671c20b6f57f2468c7ca761bf4c29cd6d9d2e Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 01:18:19 +0100 Subject: [PATCH 013/411] Working on SMTP relays! --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 30314637..219a909c 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ This is a fork of MiaB (duh), hacked and tuned to my needs: - - I changed the pre-flight checks to accept Debian and Debian only. If you think you can also make this fork Ubuntu-compatible, shoot a PR or something. -- πŸ’€ Native support for SMTP relays (For example: SendGrid); +- πŸ‘¨β€πŸ’» Native support for SMTP relays (For example: SendGrid); - πŸ’€ Ability for "static" pages to use PHP (e.g. host a domain shortener); From cd4c478986ca9faebd5d8906c66c5eb36780761d Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 01:24:36 +0100 Subject: [PATCH 014/411] Add smtp relay html page --- management/templates/index.html | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/management/templates/index.html b/management/templates/index.html index 5649ccfc..68efdfb0 100644 --- a/management/templates/index.html +++ b/management/templates/index.html @@ -125,6 +125,10 @@
+
+ {% include "smtp-relays.html" %} +
+
{% include "system-status.html" %}
From 4a20d50eea13a5c6b22036acd0f60fa087782b54 Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 15:34:14 +0100 Subject: [PATCH 015/411] SMTP Relay Host stub --- management/templates/smtp-relays.html | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index b578b7cf..82f9092f 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -3,4 +3,22 @@

SMTP Relays

-

Coming Soonβ„’

+

SMTP Relays are third-party services you can hand off the responsability of getting the mail delivered. They + can be useful when, for example, port 25 is blocked.

+ +

Here, you can configure an authenticated SMTP relay (for example, SendGrid) over port 587.

+ +
+ SMTP Relay Configuration +
+
+ + +
+ +
+ +
+
+
From 664267357af36b15555ceed239c91f834e9a9993 Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 15:53:47 +0100 Subject: [PATCH 016/411] SMTP Relay Host stub progress --- management/templates/smtp-relays.html | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index 82f9092f..5b7d62f1 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -10,11 +10,23 @@ target="_blank">SendGrid) over port 587.

- SMTP Relay Configuration +

SMTP Relay Configuration

- +
+ +
+ + +
+ +
+ + +
+ +
From 30221bdb11d1a57f8d7674a624b8d1ee6703f4a7 Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 15:57:56 +0100 Subject: [PATCH 017/411] SMTP Relay Host stub progress --- management/templates/smtp-relays.html | 32 +++++++++++++++++---------- 1 file changed, 20 insertions(+), 12 deletions(-) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index 5b7d62f1..7fdb7e66 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -13,20 +13,28 @@

SMTP Relay Configuration

- -
- -
+ + + +
+ +
+ - -
- -
+ + +
+ +
+ - -
- -
+ + +
+ +
+ +
From aa62c6349e93a6203e8bc18240af46550202b1ef Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 16:13:26 +0100 Subject: [PATCH 018/411] SMTP Relay Host stub progress --- management/templates/smtp-relays.html | 38 ++++++++++++++++++--------- 1 file changed, 25 insertions(+), 13 deletions(-) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index 7fdb7e66..fe8052cc 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -13,26 +13,38 @@

SMTP Relay Configuration

- +
- -
- -
+ + - -
- -
+ + - -
- -
+ +
+ + +
+ +
+
+ + +
+ +
+
+ + +
+ +
+
From 3278c8cf94c9e4536dd6d3c9292db20131546fc6 Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 16:18:26 +0100 Subject: [PATCH 019/411] SMTP Relay Host stub progress --- management/templates/smtp-relays.html | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index fe8052cc..b3f9a305 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -13,7 +13,7 @@

SMTP Relay Configuration

- +
+ + + + + + From 9d23f67e8a665412a294b9910393cd282482845f Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 18:05:49 +0100 Subject: [PATCH 021/411] SMTP Relay Host stub progress --- management/templates/smtp-relays.html | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index d28fe42d..6cb883d8 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -35,9 +35,13 @@ - - + + From 6393075f1144e38e75c58d6c4d40dcefd809211a Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 18:09:04 +0100 Subject: [PATCH 022/411] SMTP Relay Host stub progress --- management/templates/smtp-relays.html | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index 6cb883d8..19e47a30 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -36,11 +36,13 @@ From 51c288dcd5f5a7363b1b99284f55fb4eb1e2fad1 Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 18:14:39 +0100 Subject: [PATCH 023/411] SMTP Relay Host stub progress --- management/templates/smtp-relays.html | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index 19e47a30..22ddc410 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -21,22 +21,22 @@

SMTP Relay Configuration

-
@@ -27,7 +27,7 @@
- +
@@ -38,7 +38,7 @@
- +
From 10993b915464e71afb18b4edd68b67e526b5f452 Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 17:55:00 +0100 Subject: [PATCH 020/411] SMTP Relay Host stub progress --- management/templates/smtp-relays.html | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index b3f9a305..d28fe42d 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -1,6 +1,14 @@ + +

SMTP Relays

SMTP Relays are third-party services you can hand off the responsability of getting the mail delivered. They @@ -23,6 +31,13 @@

:587
+ + + +
- + - +
+ +
+
- +
- +
:587:587
- +
From 6e462f6523225b6308801930119573be460b2711 Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 18:21:33 +0100 Subject: [PATCH 024/411] SMTP Relay Host stub progress --- management/templates/smtp-relays.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index 22ddc410..9a18deb5 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -14,7 +14,7 @@

SMTP Relays are third-party services you can hand off the responsability of getting the mail delivered. They can be useful when, for example, port 25 is blocked.

-

Here, you can configure an authenticated SMTP relay (for example, Here, you can configure an authenticated SMTP relay (for example, SendGrid) over port 587.

@@ -70,7 +70,7 @@
-
+
From c004e55c76fe350248b3e79f81bea6ab1e3d3690 Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 18:29:14 +0100 Subject: [PATCH 025/411] SMTP Relay Host stub progress --- management/daemon.py | 12 +++++++++++- management/templates/smtp-relays.html | 24 ++++++++++++++++++++---- 2 files changed, 31 insertions(+), 5 deletions(-) diff --git a/management/daemon.py b/management/daemon.py index 572b6b4a..481873b7 100755 --- a/management/daemon.py +++ b/management/daemon.py @@ -334,7 +334,7 @@ def ssl_get_status(): # What domains can we provision certificates for? What unexpected problems do we have? provision, cant_provision = get_certificates_to_provision(env, show_valid_certs=False) - + # What's the current status of TLS certificates on all of the domain? domains_status = get_web_domains_info(env) domains_status = [ @@ -520,6 +520,16 @@ def privacy_status_set(): utils.write_settings(config, env) return "OK" +@app.route('/system/smtp/relay', methods=["GET"]) +@authorized_personnel_only +def smtp_relay_get(): + pass + +@app.route('/system/smtp/relay', methods=["POST"]) +@authorized_personnel_only +def smtp_relay_set(): + pass + # MUNIN @app.route('/munin/') diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index 9a18deb5..5942ecae 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -2,10 +2,14 @@ @@ -22,6 +26,18 @@
+ + + + + From ee688eb184ca8cf96757676e64c36c764d471420 Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 18:36:56 +0100 Subject: [PATCH 026/411] SMTP Relay Host stub progress --- management/templates/smtp-relays.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index 5942ecae..c2148754 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -8,8 +8,8 @@ document.getElementById("relay_host").disabled = !use_relay document.getElementById("relay_use_auth").disabled = !use_relay - document.getElementById("relay_auth_user").disabled = !use_relay && !use_auth - document.getElementById("relay_auth_pass").disabled = !use_relay && !use_auth + document.getElementById("relay_auth_user").disabled = !(use_relay && use_auth) + document.getElementById("relay_auth_pass").disabled = !(use_relay && use_auth) } From 109d8735c73bc36bbb2cff01073a743b5683b858 Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 13 Apr 2020 19:32:38 +0100 Subject: [PATCH 027/411] Change admin panel footer --- management/templates/index.html | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/management/templates/index.html b/management/templates/index.html index 68efdfb0..35f27479 100644 --- a/management/templates/index.html +++ b/management/templates/index.html @@ -176,7 +176,8 @@
From 14ee44e8e2ad6a40a6c08354aaf4f807e54a6fcc Mon Sep 17 00:00:00 2001 From: David Duque Date: Tue, 14 Apr 2020 09:52:01 +0100 Subject: [PATCH 028/411] HTML JS Cleanup --- management/templates/index.html | 3 ++- management/templates/smtp-relays.html | 33 +++++++++++++++++++++------ 2 files changed, 28 insertions(+), 8 deletions(-) diff --git a/management/templates/index.html b/management/templates/index.html index 35f27479..780e8cb2 100644 --- a/management/templates/index.html +++ b/management/templates/index.html @@ -376,9 +376,10 @@ var current_panel = null; var switch_back_to_panel = null; function show_panel(panelid) { - if (panelid.getAttribute) + if (panelid.getAttribute) { // we might be passed an HTMLElement . panelid = panelid.getAttribute('href').substring(1); + } $('.admin_panel').hide(); $('#panel_' + panelid).show(); diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index c2148754..74b3e86d 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -2,15 +2,34 @@

SMTP Relays

From 687721caf83f3d4f2bc4e313ff2db613dd895a96 Mon Sep 17 00:00:00 2001 From: David Duque Date: Tue, 14 Apr 2020 10:03:44 +0100 Subject: [PATCH 029/411] Load SMTP settings when entering the page --- management/templates/smtp-relays.html | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index 74b3e86d..846ee649 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -8,15 +8,6 @@ const relay_auth_user = document.getElementById("relay_auth_user") const relay_auth_pass = document.getElementById("relay_auth_pass") - api( - "/system/smtp/relay", - "GET", - {}, - data => { - - } - ) - function checkfields() { let relay_enabled = use_relay.checked let auth_enabled = relay_use_auth.checked @@ -27,8 +18,20 @@ relay_auth_pass.disabled = !(relay_enabled && auth_enabled) } - checkfields() + api( + "/system/smtp/relay", + "GET", + {}, + data => { + use_relay.checked = data.enabled + relay_host.value = data.host + relay_use_auth.checked = data.auth_enabled + relay_auth_user.value = data.user + relay_auth_pass.value = "" + checkfields() + } + ) From bb26a2d12cae45c7c47ecd51adc164da0f646649 Mon Sep 17 00:00:00 2001 From: David Duque Date: Tue, 14 Apr 2020 10:08:11 +0100 Subject: [PATCH 030/411] Push script zone to the end of the document --- management/templates/smtp-relays.html | 67 +++++++++++++-------------- 1 file changed, 33 insertions(+), 34 deletions(-) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index 846ee649..97b31373 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -1,40 +1,6 @@ - -

SMTP Relays

SMTP Relays are third-party services you can hand off the responsability of getting the mail delivered. They @@ -113,3 +79,36 @@ + + From 21196620b636a3e13ac3d69005adde5624ed9d07 Mon Sep 17 00:00:00 2001 From: David Duque Date: Wed, 15 Apr 2020 15:02:20 +0100 Subject: [PATCH 031/411] Code debug --- management/templates/smtp-relays.html | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index 97b31373..b50d336c 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -93,7 +93,7 @@ relay_host.disabled = !relay_enabled relay_use_auth.disabled = !relay_enabled - relay_auth_auth.disabled = !(relay_enabled && auth_enabled) + relay_auth_user.disabled = !(relay_enabled && auth_enabled) relay_auth_pass.disabled = !(relay_enabled && auth_enabled) } @@ -102,6 +102,7 @@ "GET", {}, data => { + console.log("Hi!") use_relay.checked = data.enabled relay_host.value = data.host relay_use_auth.checked = data.auth_enabled From 68768ed1126df701c1074cd1cfaa7c5c69a74fbb Mon Sep 17 00:00:00 2001 From: David Duque Date: Wed, 15 Apr 2020 18:01:33 +0100 Subject: [PATCH 032/411] Fix attempt --- management/templates/smtp-relays.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index b50d336c..85ec1603 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -97,7 +97,7 @@ relay_auth_pass.disabled = !(relay_enabled && auth_enabled) } - api( + $(api( "/system/smtp/relay", "GET", {}, @@ -111,5 +111,5 @@ checkfields() } - ) + )) From 03472788fd1405832190373fdcff8f82ac187314 Mon Sep 17 00:00:00 2001 From: David Duque Date: Thu, 16 Apr 2020 12:45:55 +0100 Subject: [PATCH 033/411] WIP --- management/templates/smtp-relays.html | 33 +++++++++++++++------------ 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index 85ec1603..118e6b30 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -13,7 +13,7 @@

SMTP Relay Configuration

-
+ + +
+ +
+
@@ -41,7 +57,7 @@
+ onclick="checkfields();">
+
") + api( + "/system/smtp/relay", + "GET", + {}, + data => { + console.log("Hi!") + use_relay.checked = data.enabled + relay_host.value = data.host + relay_use_auth.checked = data.auth_enabled + relay_auth_user.value = data.user + relay_auth_pass.value = "" - checkfields() - } - )) + checkfields() + } + ) + } From bf83bd6ff77e569bd48a5f4501572d615af52320 Mon Sep 17 00:00:00 2001 From: David Duque Date: Thu, 16 Apr 2020 12:56:27 +0100 Subject: [PATCH 034/411] MiaB SMTP Daemon: Just return something for now --- management/daemon.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/management/daemon.py b/management/daemon.py index 481873b7..e4aa5456 100755 --- a/management/daemon.py +++ b/management/daemon.py @@ -7,7 +7,7 @@ from flask import Flask, request, render_template, abort, Response, send_from_di import auth, utils, multiprocessing.pool from mailconfig import get_mail_users, get_mail_users_ex, get_admins, add_mail_user, set_mail_password, remove_mail_user -from mailconfig import get_mail_user_privileges, add_remove_mail_user_privilege +from mailconfig import get_mail_user_privileges, add_remove_mail_user_privilege, open_database from mailconfig import get_mail_aliases, get_mail_aliases_ex, get_mail_domains, add_mail_alias, remove_mail_alias env = utils.load_environment() @@ -523,7 +523,13 @@ def privacy_status_set(): @app.route('/system/smtp/relay', methods=["GET"]) @authorized_personnel_only def smtp_relay_get(): - pass + # Just return something for now. + return { + enabled = False, + host = "", + auth_enabled = True, + user = "" + } @app.route('/system/smtp/relay', methods=["POST"]) @authorized_personnel_only From 09b3c378856ba19e7592f3cd85233e4ba9a44495 Mon Sep 17 00:00:00 2001 From: David Duque Date: Thu, 16 Apr 2020 14:04:45 +0100 Subject: [PATCH 035/411] Oops --- management/daemon.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/management/daemon.py b/management/daemon.py index e4aa5456..b267dbdb 100755 --- a/management/daemon.py +++ b/management/daemon.py @@ -525,10 +525,10 @@ def privacy_status_set(): def smtp_relay_get(): # Just return something for now. return { - enabled = False, - host = "", - auth_enabled = True, - user = "" + "enabled": False, + "host": "", + "auth_enabled": True, + "user": "" } @app.route('/system/smtp/relay', methods=["POST"]) From fcf5544fc8c381bcd01e7e0c6b47c4455fb75324 Mon Sep 17 00:00:00 2001 From: David Duque Date: Thu, 16 Apr 2020 14:09:24 +0100 Subject: [PATCH 036/411] WIP --- management/templates/smtp-relays.html | 1 - 1 file changed, 1 deletion(-) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index 118e6b30..2bc4524e 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -98,7 +98,6 @@ } function show_smtp_relays() { - $('#smtp-relays tbody').html("") api( "/system/smtp/relay", "GET", From 785280c86be85c4a2fece5c330be58d44f8cce71 Mon Sep 17 00:00:00 2001 From: David Duque Date: Thu, 16 Apr 2020 17:01:49 +0100 Subject: [PATCH 037/411] Submission --- management/templates/smtp-relays.html | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/management/templates/smtp-relays.html b/management/templates/smtp-relays.html index 2bc4524e..d87ea363 100644 --- a/management/templates/smtp-relays.html +++ b/management/templates/smtp-relays.html @@ -11,7 +11,7 @@

SMTP Relay Configuration

- +
@@ -97,19 +97,22 @@ relay_auth_pass.disabled = !(relay_enabled && auth_enabled) } - $(api( - "/system/smtp/relay", - "GET", - {}, - data => { - console.log("Hi!") - use_relay.checked = data.enabled - relay_host.value = data.host - relay_use_auth.checked = data.auth_enabled - relay_auth_user.value = data.user - relay_auth_pass.value = "" + function show_smtp_relays() { + $('#smtp-relays tbody').html("
Loading...
Loading...
@@ -103,7 +103,6 @@ "GET", {}, data => { - console.log("Hi!") use_relay.checked = data.enabled relay_host.value = data.host relay_use_auth.checked = data.auth_enabled @@ -114,4 +113,23 @@ } ) } + + function set_smtp_relay_config() { + api( + "/system/smtp/relay", + "POST", + { + enabled: use_relay.checked, + host: relay_host.value, + auth_enabled: relay_use_auth.checked, + user: relay_auth_user.value, + key: relay_auth_pass.value + }, + () => { + show_modal_error("Done!", "The configuration has been updated and Postfix was restarted successfully. Please make sure everything is functioning as intended.", () => { + return false + }) + } + ) + } From 7ffc889c080e378e6bc3eb54d384edf7a69c24fa Mon Sep 17 00:00:00 2001 From: David Duque Date: Thu, 16 Apr 2020 19:52:01 +0100 Subject: [PATCH 038/411] Bump web dependencies (#1) - Bootstrap: 3.3.7 -> 4.4.1 - - New admin panel style and respective corrections applied. - JQuery: 2.1.4 -> 3.5.0 --- README.md | 2 + management/templates/index.html | 64 ++++----- management/templates/login.html | 226 ++++++++++++++++---------------- setup/management.sh | 8 +- 4 files changed, 153 insertions(+), 147 deletions(-) diff --git a/README.md b/README.md index 219a909c..dd3fba23 100644 --- a/README.md +++ b/README.md @@ -21,6 +21,8 @@ This is a fork of MiaB (duh), hacked and tuned to my needs: - πŸ’€ Possibility of disabling some services (\*cough\* NextCloud \*cough\*); +- βœ… Bumped the bootstrap and jQuery dependencies' versions - and we've got a brand new admin panel now! + - πŸ’€ Anything else I might need to use; All in all, I think I should rename this to something like "Central [Clown Computing](https://www.urbandictionary.com/define.php?term=clown%20computing)", since I'm trying to cram as many services as possible into that poor machine (Spending 5$ is better than spending 10$) diff --git a/management/templates/index.html b/management/templates/index.html index 780e8cb2..5aa8442a 100644 --- a/management/templates/index.html +++ b/management/templates/index.html @@ -69,7 +69,6 @@ margin-bottom: 1em; } - @@ -78,46 +77,51 @@ "); + var n = $(""); if (i == 0) n.addClass('first') if (r[i].type == "heading") n.addClass(r[i].type) From 7984d103a420fdb11cb425708d00d72148052098 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sat, 25 Apr 2020 04:13:46 +0100 Subject: [PATCH 095/411] Test --- management/templates/system-status.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/management/templates/system-status.html b/management/templates/system-status.html index 82f0dada..4c0df601 100644 --- a/management/templates/system-status.html +++ b/management/templates/system-status.html @@ -103,7 +103,7 @@ function (r) { $('#system-checks tbody').html(""); for (var i = 0; i < r.length; i++) { - var n = $(""); + var n = $(""); if (i == 0) n.addClass('first') if (r[i].type == "heading") n.addClass(r[i].type) From e75d89113ac3e716d8fecdcca36f98f2777313f0 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sat, 25 Apr 2020 04:17:55 +0100 Subject: [PATCH 096/411] Test --- management/templates/system-status.html | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/management/templates/system-status.html b/management/templates/system-status.html index 4c0df601..abb13fdd 100644 --- a/management/templates/system-status.html +++ b/management/templates/system-status.html @@ -31,7 +31,7 @@ word-wrap: break-word; } - #system-checks a.showhide { + #system-checks .showhide { display: none; font-size: 85%; } @@ -103,7 +103,7 @@ function (r) { $('#system-checks tbody').html(""); for (var i = 0; i < r.length; i++) { - var n = $(""); + var n = $(""); if (i == 0) n.addClass('first') if (r[i].type == "heading") n.addClass(r[i].type) @@ -116,7 +116,7 @@ $('#system-checks tbody').append(n); if (r[i].extra.length > 0) { - n.find('a.showhide').show().text("show more").click(function () { + n.find('.showhide').show().text("show more").click(function () { $(this).hide(); $(this).parent().find('.extra').fadeIn(); return false; From ad9979f9c6cfbca7b14ece1c9d80a63923db09e4 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sat, 25 Apr 2020 04:26:24 +0100 Subject: [PATCH 097/411] Make the Show More link an actual button --- management/templates/system-status.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/management/templates/system-status.html b/management/templates/system-status.html index abb13fdd..c83b649f 100644 --- a/management/templates/system-status.html +++ b/management/templates/system-status.html @@ -103,7 +103,7 @@ function (r) { $('#system-checks tbody').html(""); for (var i = 0; i < r.length; i++) { - var n = $(""); + var n = $(""); if (i == 0) n.addClass('first') if (r[i].type == "heading") n.addClass(r[i].type) @@ -116,7 +116,7 @@ $('#system-checks tbody').append(n); if (r[i].extra.length > 0) { - n.find('.showhide').show().text("show more").click(function () { + n.find('.showhide').show().text("Show More").click(function () { $(this).hide(); $(this).parent().find('.extra').fadeIn(); return false; From b66ade73c8624c2e82c988e1a7dcffc04714b468 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 17 May 2020 02:33:26 +0100 Subject: [PATCH 098/411] Begin support for Ubuntu LTS --- setup/bootstrap.sh | 18 ++++-------------- setup/functions.sh | 9 ++++++++- setup/preflight.sh | 5 +++-- 3 files changed, 15 insertions(+), 17 deletions(-) diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh index 499722d0..c3729112 100644 --- a/setup/bootstrap.sh +++ b/setup/bootstrap.sh @@ -7,23 +7,13 @@ ######################################################### if [ -z "$TAG" ]; then - # If a version to install isn't explicitly given as an environment - # variable, then install the latest version. But the latest version - # depends on the operating system. Existing Ubuntu 14.04 users need - # to be able to upgrade to the latest version supporting Ubuntu 14.04, - # in part because an upgrade is required before jumping to Ubuntu 18.04. - # New users on Ubuntu 18.04 need to get the latest version number too. - # - # Also, the system status checks read this script for TAG = (without the - # space, but if we put it in a comment it would confuse the status checks!) - # to get the latest version, so the first such line must be the one that we - # want to display in status checks. - if [ "`lsb_release -d | sed 's/.*:\s*//' `" == "Debian GNU/Linux 10 (buster)" ]; then + # Make s + OS=`lsb_release -d | sed 's/.*:\s*//'` + if [ "$OS" == "Debian GNU/Linux 10 (buster)" -o "$OS" == "Ubuntu 20.04 LTS"]; then # This machine is running Ubuntu 18.04. TAG=v0.44.POWER.5 - else - echo "This script must be run on a system running Debian 10." + echo "This script must be run on a system running Debian 10 OR Ubuntu 20.04 LTS." exit 1 fi fi diff --git a/setup/functions.sh b/setup/functions.sh index cdf89bed..509d3dc0 100644 --- a/setup/functions.sh +++ b/setup/functions.sh @@ -215,4 +215,11 @@ function git_clone { rm -rf $TMPPATH } -export PHP_VERSION="7.3" # Expected php version +OS=`lsb_release -d | sed 's/.*:\s*//' ` + +# Expected php version +if [ "$OS" == "Debian GNU/Linux 10 (buster)" ]; then + export PHP_VERSION="7.3" +elif [ "$OS" == "Ubuntu 20.04 LTS" ]; then + export PHP_VERSION="7.4" +fi diff --git a/setup/preflight.sh b/setup/preflight.sh index 8e3fbdd7..51952693 100644 --- a/setup/preflight.sh +++ b/setup/preflight.sh @@ -8,8 +8,9 @@ if [[ $EUID -ne 0 ]]; then fi # Check that we are running on Debian GNU/Linux -if [ "`lsb_release -d | sed 's/.*:\s*//' `" != "Debian GNU/Linux 10 (buster)" ]; then - echo "Mail-in-a-Box only supports being installed on Debian 10, sorry. You are running:" +OS=`lsb_release -d | sed 's/.*:\s*//' ` +if [ "$OS" != "Debian GNU/Linux 10 (buster)" -a "$OS" != "Ubuntu 20.04 LTS" ]; then + echo "Mail-in-a-Box only supports being installed on Debian 10 or Ubuntu 20.04 LTS, sorry. You are running:" echo lsb_release -d | sed 's/.*:\s*//' echo From 98b50ce333eb15342ac771e128b5c2f4ff256500 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 17 May 2020 02:38:00 +0100 Subject: [PATCH 099/411] Syntax function fix --- setup/bootstrap.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh index c3729112..028398ac 100644 --- a/setup/bootstrap.sh +++ b/setup/bootstrap.sh @@ -9,7 +9,7 @@ if [ -z "$TAG" ]; then # Make s OS=`lsb_release -d | sed 's/.*:\s*//'` - if [ "$OS" == "Debian GNU/Linux 10 (buster)" -o "$OS" == "Ubuntu 20.04 LTS"]; then + if [ "$OS" == "Debian GNU/Linux 10 (buster)" -o "$OS" == "Ubuntu 20.04 LTS" ]; then # This machine is running Ubuntu 18.04. TAG=v0.44.POWER.5 else From 959281c635e71f3432d3f4373e5bb3c073eeb164 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 17 May 2020 02:38:18 +0100 Subject: [PATCH 100/411] Version bump --- setup/bootstrap.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh index 028398ac..d974413d 100644 --- a/setup/bootstrap.sh +++ b/setup/bootstrap.sh @@ -11,7 +11,7 @@ if [ -z "$TAG" ]; then OS=`lsb_release -d | sed 's/.*:\s*//'` if [ "$OS" == "Debian GNU/Linux 10 (buster)" -o "$OS" == "Ubuntu 20.04 LTS" ]; then # This machine is running Ubuntu 18.04. - TAG=v0.44.POWER.5 + TAG=v0.44.POWER.6 else echo "This script must be run on a system running Debian 10 OR Ubuntu 20.04 LTS." exit 1 From 1513655bc47dcd5cb5bb6a5e83b9d72454e6209a Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 17 May 2020 02:45:35 +0100 Subject: [PATCH 101/411] Make sure that the OS in the admin panel matches the actual system OS --- management/templates/index.html | 4 ++-- setup/preflight.sh | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/management/templates/index.html b/management/templates/index.html index 1bbd0378..d88eb569 100644 --- a/management/templates/index.html +++ b/management/templates/index.html @@ -180,8 +180,8 @@
diff --git a/setup/preflight.sh b/setup/preflight.sh index 51952693..6a3101d1 100644 --- a/setup/preflight.sh +++ b/setup/preflight.sh @@ -18,6 +18,8 @@ if [ "$OS" != "Debian GNU/Linux 10 (buster)" -a "$OS" != "Ubuntu 20.04 LTS" ]; t exit 1 fi +sed -i "s/__OSTAG__/$OS/g" management/templates/index.html + # Check that we have enough memory. # # /proc/meminfo reports free memory in kibibytes. Our baseline will be 512 MB, From baa5d32dea6cc08964c40d7ef490b1f634a0eace Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 17 May 2020 02:58:19 +0100 Subject: [PATCH 102/411] Make sure /etc/default/bind9 exists --- setup/system.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/setup/system.sh b/setup/system.sh index 4d1dd08e..cc8706b3 100755 --- a/setup/system.sh +++ b/setup/system.sh @@ -302,6 +302,7 @@ fi #NODOC # * The listen-on directive in named.conf.options restricts `bind9` to # binding to the loopback interface instead of all interfaces. apt_install bind9 +touch /etc/default/bind9 management/editconf.py /etc/default/bind9 \ "OPTIONS=\"-u bind -4\"" if ! grep -q "listen-on " /etc/bind/named.conf.options; then From 117bdb746441b5a0e45d67fc52b832572c743806 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 17 May 2020 15:04:17 +0100 Subject: [PATCH 103/411] Update Nextcloud to the latest version Nextcloud 17 doesn't support PHP 7.4 (and therefore Ubuntu 20.04 LTS) --- setup/nextcloud.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/setup/nextcloud.sh b/setup/nextcloud.sh index 938cc70c..e7d02cfc 100755 --- a/setup/nextcloud.sh +++ b/setup/nextcloud.sh @@ -91,8 +91,8 @@ InstallNextcloud() { } # Nextcloud Version to install. Checks are done down below to step through intermediate versions. -nextcloud_ver=17.0.6 -nextcloud_hash=50b98d2c2f18510b9530e558ced9ab51eb4f11b0 +nextcloud_ver=18.0.4 +nextcloud_hash=6a1c671600d6a839d53cbcfac64eb3858936bbad # Current Nextcloud Version, #1623 # Checking /usr/local/lib/owncloud/version.php shows version of the Nextcloud application, not the DB From c95b91af5a0b50a2a2ede98abe72b9219e62b780 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 17 May 2020 15:14:43 +0100 Subject: [PATCH 104/411] Force python3-pip --- setup/management.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup/management.sh b/setup/management.sh index c16e43d3..ac8e908c 100755 --- a/setup/management.sh +++ b/setup/management.sh @@ -29,7 +29,7 @@ done # # certbot installs EFF's certbot which we use to # provision free TLS certificates. -apt_install duplicity python-pip virtualenv certbot +apt_install duplicity python3-pip virtualenv certbot hide_output pip2 install --upgrade boto # Create a virtualenv for the installation of Python 3 packages From a51e968d31231f7206691ac5c3381f7cd9e1ade1 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 17 May 2020 15:20:14 +0100 Subject: [PATCH 105/411] Use pip3 --- setup/management.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup/management.sh b/setup/management.sh index ac8e908c..1f8b1db2 100755 --- a/setup/management.sh +++ b/setup/management.sh @@ -30,7 +30,7 @@ done # certbot installs EFF's certbot which we use to # provision free TLS certificates. apt_install duplicity python3-pip virtualenv certbot -hide_output pip2 install --upgrade boto +hide_output pip3 install --upgrade boto # Create a virtualenv for the installation of Python 3 packages # used by the management daemon. From 211d3ff8a8e7448040565db7752365f1d40a966c Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 24 May 2020 23:22:30 +0100 Subject: [PATCH 106/411] Fix os tag issues --- setup/preflight.sh | 2 +- setup/questions.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/setup/preflight.sh b/setup/preflight.sh index 6a3101d1..013eb038 100644 --- a/setup/preflight.sh +++ b/setup/preflight.sh @@ -18,7 +18,7 @@ if [ "$OS" != "Debian GNU/Linux 10 (buster)" -a "$OS" != "Ubuntu 20.04 LTS" ]; t exit 1 fi -sed -i "s/__OSTAG__/$OS/g" management/templates/index.html +sed -i "s|__OSTAG__|${OS}|g" management/templates/index.html # Check that we have enough memory. # diff --git a/setup/questions.sh b/setup/questions.sh index bd315fb5..0ed55154 100644 --- a/setup/questions.sh +++ b/setup/questions.sh @@ -21,7 +21,7 @@ if [ -z "${NONINTERACTIVE:-}" ]; then "Hello and thanks for deploying a (Power) Mail-in-a-Box! \n\nI'm going to ask you a few questions. \n\nTo change your answers later, just run 'sudo mailinabox' from the command line. - \n\nNOTE: You should only install this on a brand new Debian installation 100% dedicated to Mail-in-a-Box. Mail-in-a-Box will, for example, remove apache2." + \n\nNOTE: You should only install this on a brand new Debian/Ubuntu installation 100% dedicated to Mail-in-a-Box. Mail-in-a-Box will, for example, remove apache2." fi # The box needs a name. From 235ebe9a4abe79ea659b28841e3bc1f4d35b212e Mon Sep 17 00:00:00 2001 From: David Duque Date: Thu, 28 May 2020 15:47:02 +0100 Subject: [PATCH 107/411] Secondary nameservers: Allow IPv6 --- management/dns_update.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/management/dns_update.py b/management/dns_update.py index 7d053d5e..9f664172 100755 --- a/management/dns_update.py +++ b/management/dns_update.py @@ -905,6 +905,8 @@ def set_secondary_dns(hostnames, env): # Resolve hostname. try: response = resolver.query(item, "A") + except (dns.resolver.NoNameservers, dns.resolver.NXDOMAIN, dns.resolver.NoAnswer): + response = resolver.query(item, "AAAA") except (dns.resolver.NoNameservers, dns.resolver.NXDOMAIN, dns.resolver.NoAnswer): raise ValueError("Could not resolve the IP address of %s." % item) else: @@ -912,12 +914,14 @@ def set_secondary_dns(hostnames, env): try: if "/" in item[4:]: v = ipaddress.ip_network(item[4:]) # raises a ValueError if there's a problem - if not isinstance(v, ipaddress.IPv4Network): raise ValueError("That's an IPv6 subnet.") + if not isinstance(v, ipaddress.IPv4Network) and not isinstance(v, ipaddress.IPv6Network): + raise ValueError("That's neither an IPv4 or IPv6 subnet.") else: v = ipaddress.ip_address(item[4:]) # raises a ValueError if there's a problem - if not isinstance(v, ipaddress.IPv4Address): raise ValueError("That's an IPv6 address.") + if not isinstance(v, ipaddress.IPv4Network) and not isinstance(v, ipaddress.IPv6Network): + raise ValueError("That's neither an IPv4 or IPv6 address.") except ValueError: - raise ValueError("'%s' is not an IPv4 address or subnet." % item[4:]) + raise ValueError("'%s' is not an IPv4 or IPv6 address or subnet." % item[4:]) # Set. set_custom_dns_record("_secondary_nameserver", "A", " ".join(hostnames), "set", env) From 8ca58798e46b84b9f80ff3641ddf12c52d7d3145 Mon Sep 17 00:00:00 2001 From: David Duque Date: Thu, 28 May 2020 16:17:10 +0100 Subject: [PATCH 108/411] Typo fix --- management/dns_update.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/management/dns_update.py b/management/dns_update.py index 9f664172..6d2c957e 100755 --- a/management/dns_update.py +++ b/management/dns_update.py @@ -918,7 +918,7 @@ def set_secondary_dns(hostnames, env): raise ValueError("That's neither an IPv4 or IPv6 subnet.") else: v = ipaddress.ip_address(item[4:]) # raises a ValueError if there's a problem - if not isinstance(v, ipaddress.IPv4Network) and not isinstance(v, ipaddress.IPv6Network): + if not isinstance(v, ipaddress.IPv4Address) and not isinstance(v, ipaddress.IPv6Address): raise ValueError("That's neither an IPv4 or IPv6 address.") except ValueError: raise ValueError("'%s' is not an IPv4 or IPv6 address or subnet." % item[4:]) From d01069f7f2986523bbfb041917421a4c4f686985 Mon Sep 17 00:00:00 2001 From: David Duque Date: Fri, 12 Jun 2020 09:27:08 +0100 Subject: [PATCH 109/411] Automatically agree to ToS on SSL provision --- management/ssl_certificates.py | 1 + management/templates/ssl.html | 1 + 2 files changed, 2 insertions(+) diff --git a/management/ssl_certificates.py b/management/ssl_certificates.py index 76b0f8fa..ed6b58e9 100755 --- a/management/ssl_certificates.py +++ b/management/ssl_certificates.py @@ -320,6 +320,7 @@ def provision_certificates(env, limit_domains): "certonly", #"-v", # just enough to see ACME errors "--non-interactive", # will fail if user hasn't registered during Mail-in-a-Box setup + "--agree-tos", # Automatically agrees to Let's Encrypt TOS "-d", ",".join(domain_list), # first will be main domain diff --git a/management/templates/ssl.html b/management/templates/ssl.html index a6b913ee..92cce670 100644 --- a/management/templates/ssl.html +++ b/management/templates/ssl.html @@ -12,6 +12,7 @@ From 0ccbf1b809ece7f1753e7e6b11b722527cd192a5 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 21 Jun 2020 15:05:17 +0100 Subject: [PATCH 110/411] Only spawn a thread pool when strictly needed For --check-primary-hostname, the pool is not used. When exiting, the other processes are left alive and will hang. --- management/status_checks.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/management/status_checks.py b/management/status_checks.py index 21aa58dc..64f28b7b 100755 --- a/management/status_checks.py +++ b/management/status_checks.py @@ -983,12 +983,13 @@ if __name__ == "__main__": from utils import load_environment env = load_environment() - pool = multiprocessing.pool.Pool(processes=10) if len(sys.argv) == 1: + pool = multiprocessing.pool.Pool(processes=10) run_checks(False, env, ConsoleOutput(), pool) elif sys.argv[1] == "--show-changes": + pool = multiprocessing.pool.Pool(processes=10) run_and_output_changes(env, pool) elif sys.argv[1] == "--check-primary-hostname": From 5d6c23cff9ed5ce2668f1fc0624bd76f7a0bf79b Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 21 Jun 2020 15:18:46 +0100 Subject: [PATCH 111/411] Finalize php configuration --- conf/nginx-custom.conf | 3 +++ conf/nginx-top.conf | 2 +- management/templates/index.html | 2 +- setup/functions.sh | 2 ++ setup/preflight.sh | 2 +- 5 files changed, 8 insertions(+), 3 deletions(-) diff --git a/conf/nginx-custom.conf b/conf/nginx-custom.conf index 83737884..fbb2dd15 100644 --- a/conf/nginx-custom.conf +++ b/conf/nginx-custom.conf @@ -2,6 +2,9 @@ root $ROOT; index index.html index.htm; + # If you want to use the PHP socket, use the "php-fpm" alias. + + # DON'T DELETE THE LINE BELOW # ADDITIONAL DIRECTIVES HERE # Disable viewing dotfiles (.htaccess, .svn, .git, etc.) diff --git a/conf/nginx-top.conf b/conf/nginx-top.conf index 435b5f7b..a4d09292 100644 --- a/conf/nginx-top.conf +++ b/conf/nginx-top.conf @@ -7,6 +7,6 @@ ## your own --- please do not ask for help from us. upstream php-fpm { - server unix:/var/run/php/php7.3-fpm.sock; + server unix:/var/run/php/php!!___PHPVER___!!-fpm.sock; } diff --git a/management/templates/index.html b/management/templates/index.html index d88eb569..f4fa9a52 100644 --- a/management/templates/index.html +++ b/management/templates/index.html @@ -180,7 +180,7 @@
diff --git a/setup/functions.sh b/setup/functions.sh index 509d3dc0..634f3332 100644 --- a/setup/functions.sh +++ b/setup/functions.sh @@ -223,3 +223,5 @@ if [ "$OS" == "Debian GNU/Linux 10 (buster)" ]; then elif [ "$OS" == "Ubuntu 20.04 LTS" ]; then export PHP_VERSION="7.4" fi + +sed -i "s|!!___PHPVER___!!|${PHP_VERSION}|g" conf/nginx-top.conf diff --git a/setup/preflight.sh b/setup/preflight.sh index 013eb038..785ec72d 100644 --- a/setup/preflight.sh +++ b/setup/preflight.sh @@ -18,7 +18,7 @@ if [ "$OS" != "Debian GNU/Linux 10 (buster)" -a "$OS" != "Ubuntu 20.04 LTS" ]; t exit 1 fi -sed -i "s|__OSTAG__|${OS}|g" management/templates/index.html +sed -i "s|!!___DIST_TAG___!!|${OS}|g" management/templates/index.html # Check that we have enough memory. # From 74554bcbf3758fbcf50dbfad285fa259283f9da0 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 21 Jun 2020 15:45:34 +0100 Subject: [PATCH 112/411] Version bump --- README.md | 8 +++----- setup/bootstrap.sh | 3 +-- 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index beaeebba..67c1ee4e 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ ## Installation -- **PRE-REQUISITES:** Debian 10 (Buster) fresh installation +- **PRE-REQUISITES:** Debian 10 (Buster) or Ubuntu 20.04 LTS fresh installation Update packages: ```sh @@ -22,7 +22,7 @@ Install Power-Mail-in-a-Box (short link) curl -L https://dvn.pt/powermiab | sudo bash ``` -## Current Version: v0.44.POWER.5 (Tracking v0.44) +## Current Version: v0.44.POWER.7 (Tracking v0.44) This is a fork of MiaB (duh), hacked and tuned to my needs: @@ -32,9 +32,7 @@ This is a fork of MiaB (duh), hacked and tuned to my needs: πŸ’€ - **I did not begin this part yet!** -- βœ… Proper support for Debian (I recommend Debian Buster or later, but if it works on your machine, it works!); - -- - I changed the pre-flight checks to accept Debian and Debian only. If you think you can also make this fork Ubuntu-compatible, shoot a PR or something. +- βœ… Proper support for Debian (I recommend Debian Buster or later, but if it works on your machine, it works!) AND Ubuntu 20.04 LTS; - βœ… Native support for SMTP relays (For example: SendGrid); diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh index d974413d..bc1830f8 100644 --- a/setup/bootstrap.sh +++ b/setup/bootstrap.sh @@ -10,8 +10,7 @@ if [ -z "$TAG" ]; then # Make s OS=`lsb_release -d | sed 's/.*:\s*//'` if [ "$OS" == "Debian GNU/Linux 10 (buster)" -o "$OS" == "Ubuntu 20.04 LTS" ]; then - # This machine is running Ubuntu 18.04. - TAG=v0.44.POWER.6 + TAG=v0.44.POWER.7 else echo "This script must be run on a system running Debian 10 OR Ubuntu 20.04 LTS." exit 1 From 9a4cf4d7afeee7a71aebf7755a9b38ea4173926c Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 21 Jun 2020 16:02:17 +0100 Subject: [PATCH 113/411] Update dependencies --- setup/management.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/setup/management.sh b/setup/management.sh index 362cb345..ab7eb21d 100755 --- a/setup/management.sh +++ b/setup/management.sh @@ -69,18 +69,18 @@ rm -rf $assets_dir mkdir -p $assets_dir # jQuery CDN URL -jquery_version=3.5.0 +jquery_version=3.5.1 jquery_url=https://code.jquery.com # Get jQuery -wget_verify $jquery_url/jquery-$jquery_version.min.js 1d6ae46f2ffa213dede37a521b011ec1cd8d1ad3 $assets_dir/jquery.min.js +wget_verify $jquery_url/jquery-$jquery_version.min.js c8e1c8b386dc5b7a9184c763c88d19a346eb3342 $assets_dir/jquery.min.js # Bootstrap CDN URL -bootstrap_version=4.4.1 +bootstrap_version=4.5.0 bootstrap_url=https://github.com/twbs/bootstrap/releases/download/v$bootstrap_version/bootstrap-$bootstrap_version-dist.zip # Get Bootstrap -wget_verify $bootstrap_url 52759c9d307308da862ac29e1c41bfcfe81313eb /tmp/bootstrap.zip +wget_verify $bootstrap_url 240002ac66f2f6579f266bd07277573d2ad2e63a /tmp/bootstrap.zip unzip -q /tmp/bootstrap.zip -d $assets_dir mv $assets_dir/bootstrap-$bootstrap_version-dist $assets_dir/bootstrap rm -f /tmp/bootstrap.zip From 7b357fa71bde3d9276dd89a3724803a27b48781d Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 21 Jun 2020 22:49:14 +0100 Subject: [PATCH 114/411] Version bump (v0.46 rc) --- setup/bootstrap.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh index bc1830f8..20755773 100644 --- a/setup/bootstrap.sh +++ b/setup/bootstrap.sh @@ -10,7 +10,7 @@ if [ -z "$TAG" ]; then # Make s OS=`lsb_release -d | sed 's/.*:\s*//'` if [ "$OS" == "Debian GNU/Linux 10 (buster)" -o "$OS" == "Ubuntu 20.04 LTS" ]; then - TAG=v0.44.POWER.7 + TAG=v0.46.POWER.RC.1 else echo "This script must be run on a system running Debian 10 OR Ubuntu 20.04 LTS." exit 1 From 7864055490b16504a5da539d99a153ce55d84b92 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sat, 27 Jun 2020 19:39:03 +0100 Subject: [PATCH 115/411] Upgrade Nextcloud --- setup/nextcloud.sh | 16 ++++++++-------- setup/questions.sh | 2 +- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/setup/nextcloud.sh b/setup/nextcloud.sh index e7d02cfc..d424737b 100755 --- a/setup/nextcloud.sh +++ b/setup/nextcloud.sh @@ -25,8 +25,8 @@ InstallNextcloud() { echo "Upgrading to Nextcloud version $version" echo - # Download and verify - wget_verify https://download.nextcloud.com/server/releases/nextcloud-$version.zip $hash /tmp/nextcloud.zip + # Download and verify + wget_verify https://download.nextcloud.com/server/releases/nextcloud-$version.zip $hash /tmp/nextcloud.zip # Remove the current owncloud/Nextcloud rm -rf /usr/local/lib/owncloud @@ -51,7 +51,7 @@ InstallNextcloud() { # Starting with Nextcloud 15, the app user_external is no longer included in Nextcloud core, # we will install from their github repository. if [[ $version =~ ^1[567] ]]; then - wget_verify https://github.com/nextcloud/user_external/releases/download/v0.7.0/user_external-0.7.0.tar.gz 555a94811daaf5bdd336c5e48a78aa8567b86437 /tmp/user_external.tgz + wget_verify https://github.com/nextcloud/user_external/releases/download/v0.10.0/user_external-0.10.0.tar.gz 133c0d65aba1b09c28b21d05477c122041a9abc2 /tmp/user_external.tgz tar -xf /tmp/user_external.tgz -C /usr/local/lib/owncloud/apps/ rm /tmp/user_external.tgz fi @@ -91,8 +91,8 @@ InstallNextcloud() { } # Nextcloud Version to install. Checks are done down below to step through intermediate versions. -nextcloud_ver=18.0.4 -nextcloud_hash=6a1c671600d6a839d53cbcfac64eb3858936bbad +nextcloud_ver=19.0.0 +nextcloud_hash=d2c631327873ce42ff6a90f9916396f1f7202ea1 # Current Nextcloud Version, #1623 # Checking /usr/local/lib/owncloud/version.php shows version of the Nextcloud application, not the DB @@ -152,9 +152,9 @@ if [ ! -d /usr/local/lib/owncloud/ ] || [[ ! ${CURRENT_NEXTCLOUD_VER} =~ ^$nextc CURRENT_NEXTCLOUD_VER="15.0.8" fi if [[ ${CURRENT_NEXTCLOUD_VER} =~ ^15 ]]; then - InstallNextcloud 16.0.6 0bb3098455ec89f5af77a652aad553ad40a88819 - CURRENT_NEXTCLOUD_VER="16.0.6" - fi + InstallNextcloud 16.0.6 0bb3098455ec89f5af77a652aad553ad40a88819 + CURRENT_NEXTCLOUD_VER="16.0.6" + fi fi InstallNextcloud $nextcloud_ver $nextcloud_hash diff --git a/setup/questions.sh b/setup/questions.sh index 0ed55154..5e3da75e 100644 --- a/setup/questions.sh +++ b/setup/questions.sh @@ -9,7 +9,7 @@ if [ -z "${NONINTERACTIVE:-}" ]; then if [ ! -f /usr/bin/dialog ] || [ ! -f /usr/bin/python3 ] || [ ! -f /usr/bin/pip3 ]; then echo Installing packages needed for setup... apt-get -q -q update - apt_get_quiet install dialog python3 python3-pip || exit 1 + apt_get_quiet install dialog file python3 python3-pip || exit 1 fi # Installing email_validator is repeated in setup/management.sh, but in setup/management.sh From 7af4ab0f4fb0506de580f87adf17bdd7aea8ecb9 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sat, 27 Jun 2020 20:27:49 +0100 Subject: [PATCH 116/411] Version bump --- setup/bootstrap.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh index 20755773..2e57e84b 100644 --- a/setup/bootstrap.sh +++ b/setup/bootstrap.sh @@ -10,7 +10,7 @@ if [ -z "$TAG" ]; then # Make s OS=`lsb_release -d | sed 's/.*:\s*//'` if [ "$OS" == "Debian GNU/Linux 10 (buster)" -o "$OS" == "Ubuntu 20.04 LTS" ]; then - TAG=v0.46.POWER.RC.1 + TAG=v0.46.POWER.0 else echo "This script must be run on a system running Debian 10 OR Ubuntu 20.04 LTS." exit 1 From fcb44dafa3a96e9f3061be13e35d3125683debea Mon Sep 17 00:00:00 2001 From: David Duque Date: Sat, 27 Jun 2020 21:32:36 +0100 Subject: [PATCH 117/411] Let's encrypt certbot hotfix --- README.md | 4 +++- management/ssl_certificates.py | 5 +++-- setup/bootstrap.sh | 2 +- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index c39a71f8..a7a1f360 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,7 @@ Install Power-Mail-in-a-Box (short link) curl -L https://dvn.pt/powermiab | sudo bash ``` -## Current Version: v0.44.POWER.7 (Tracking v0.44) +## Current Version: v0.46.POWER.1 (Tracking v0.46) This is a fork of MiaB (duh), hacked and tuned to my needs: @@ -44,6 +44,8 @@ This is a fork of MiaB (duh), hacked and tuned to my needs: - - Custom pages will no longer have their pages defaulting to the MiaB services (`/admin`, `/mail`, etc.); +- βœ… Updated NextCloud to the latest version available; + - πŸ’€ Possibility of disabling some services (\*cough\* NextCloud \*cough\*); - πŸ’€ Anything else I might need to use; diff --git a/management/ssl_certificates.py b/management/ssl_certificates.py index 857069ed..708ccc7d 100755 --- a/management/ssl_certificates.py +++ b/management/ssl_certificates.py @@ -216,12 +216,12 @@ def get_certificates_to_provision(env, limit_domains=None, show_valid_certs=True response = query_dns(domain, rtype) if response != normalize_ip(value): bad_dns.append("%s (%s)" % (response, rtype)) - + if bad_dns: domains_cant_provision[domain] = "The domain name does not resolve to this machine: " \ + (", ".join(bad_dns)) \ + "." - + else: # DNS is all good. @@ -347,6 +347,7 @@ def provision_certificates(env, limit_domains): #"-v", # just enough to see ACME errors "--non-interactive", # will fail if user hasn't registered during Mail-in-a-Box setup "--agree-tos", # Automatically agrees to Let's Encrypt TOS + "--register-unsafely-without-email", # The daemon takes care of renewals "-d", ",".join(domain_list), # first will be main domain diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh index 2e57e84b..90163a96 100644 --- a/setup/bootstrap.sh +++ b/setup/bootstrap.sh @@ -10,7 +10,7 @@ if [ -z "$TAG" ]; then # Make s OS=`lsb_release -d | sed 's/.*:\s*//'` if [ "$OS" == "Debian GNU/Linux 10 (buster)" -o "$OS" == "Ubuntu 20.04 LTS" ]; then - TAG=v0.46.POWER.0 + TAG=v0.46.POWER.1 else echo "This script must be run on a system running Debian 10 OR Ubuntu 20.04 LTS." exit 1 From 7f305ee02eb4678c81f55afe41941aef595a6f0e Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 28 Jun 2020 09:57:28 +0100 Subject: [PATCH 118/411] Add /.well-known/mta-sts.txt to all nginx dotfiles --- conf/nginx-custom.conf | 13 +++++++++++++ conf/nginx-primaryonly.conf | 24 ++++++++++++------------ 2 files changed, 25 insertions(+), 12 deletions(-) diff --git a/conf/nginx-custom.conf b/conf/nginx-custom.conf index fbb2dd15..d09c3b86 100644 --- a/conf/nginx-custom.conf +++ b/conf/nginx-custom.conf @@ -7,6 +7,19 @@ # DON'T DELETE THE LINE BELOW # ADDITIONAL DIRECTIVES HERE + location = /.well-known/mta-sts.txt { + alias /var/lib/mailinabox/mta-sts.txt; + } + location = /robots.txt { + log_not_found off; + access_log off; + } + + location = /favicon.ico { + log_not_found off; + access_log off; + } + # Disable viewing dotfiles (.htaccess, .svn, .git, etc.) # This block is placed at the end. Nginx's precedence rules means this block # takes precedence over all non-regex matches and only regex matches that diff --git a/conf/nginx-primaryonly.conf b/conf/nginx-primaryonly.conf index 288fce40..31bf0095 100644 --- a/conf/nginx-primaryonly.conf +++ b/conf/nginx-primaryonly.conf @@ -22,20 +22,20 @@ rewrite ^(/cloud/oc[sm]-provider)/$ $1/index.php redirect; location /cloud/ { alias /usr/local/lib/owncloud/; - location ~ ^/cloud/(build|tests|config|lib|3rdparty|templates|data|README)/ { - deny all; - } - location ~ ^/cloud/(?:\.|autotest|occ|issue|indie|db_|console) { - deny all; - } + location ~ ^/cloud/(build|tests|config|lib|3rdparty|templates|data|README)/ { + deny all; + } + location ~ ^/cloud/(?:\.|autotest|occ|issue|indie|db_|console) { + deny all; + } # Enable paths for service and cloud federation discovery # Resolves warning in Nextcloud Settings panel - location ~ ^/cloud/(oc[sm]-provider)?/([^/]+\.php)$ { - index index.php; - include fastcgi_params; - fastcgi_param SCRIPT_FILENAME /usr/local/lib/owncloud/$1/$2; - fastcgi_pass php-fpm; - } + location ~ ^/cloud/(oc[sm]-provider)?/([^/]+\.php)$ { + index index.php; + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME /usr/local/lib/owncloud/$1/$2; + fastcgi_pass php-fpm; + } } location ~ ^(/cloud)((?:/ocs)?/[^/]+\.php)(/.*)?$ { # note: ~ has precendence over a regular location block From ffc7e8d77e02887935aedd217628d9dd9b2dd584 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 28 Jun 2020 10:05:25 +0100 Subject: [PATCH 119/411] Add comments explaining --- conf/nginx-custom.conf | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/conf/nginx-custom.conf b/conf/nginx-custom.conf index d09c3b86..addb8155 100644 --- a/conf/nginx-custom.conf +++ b/conf/nginx-custom.conf @@ -7,14 +7,16 @@ # DON'T DELETE THE LINE BELOW # ADDITIONAL DIRECTIVES HERE + # Ensure we have the MTA-STS policy enabled location = /.well-known/mta-sts.txt { alias /var/lib/mailinabox/mta-sts.txt; } + + # Disable error logs for these location = /robots.txt { log_not_found off; access_log off; } - location = /favicon.ico { log_not_found off; access_log off; From 3876cbac8a65e20f2420fe9025d1de1e78f65d25 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sun, 28 Jun 2020 10:06:50 +0100 Subject: [PATCH 120/411] Version bump --- README.md | 2 +- setup/bootstrap.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index a7a1f360..0e0644df 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,7 @@ Install Power-Mail-in-a-Box (short link) curl -L https://dvn.pt/powermiab | sudo bash ``` -## Current Version: v0.46.POWER.1 (Tracking v0.46) +## Current Version: v0.46.POWER.2 (Tracking v0.46) This is a fork of MiaB (duh), hacked and tuned to my needs: diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh index 90163a96..cbe5a33a 100644 --- a/setup/bootstrap.sh +++ b/setup/bootstrap.sh @@ -10,7 +10,7 @@ if [ -z "$TAG" ]; then # Make s OS=`lsb_release -d | sed 's/.*:\s*//'` if [ "$OS" == "Debian GNU/Linux 10 (buster)" -o "$OS" == "Ubuntu 20.04 LTS" ]; then - TAG=v0.46.POWER.1 + TAG=v0.46.POWER.2 else echo "This script must be run on a system running Debian 10 OR Ubuntu 20.04 LTS." exit 1 From b98111b4e1511146276727c69f86bae881a9c6ec Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 29 Jun 2020 09:13:50 +0100 Subject: [PATCH 121/411] Fix unassigned php version --- management/backup.py | 4 ++-- management/daily_tasks.sh | 6 +++--- setup/functions.sh | 1 + 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/management/backup.py b/management/backup.py index 1bec8638..90a64588 100755 --- a/management/backup.py +++ b/management/backup.py @@ -247,7 +247,7 @@ def perform_backup(full_backup): if quit: sys.exit(code) - service_command("php7.3-fpm", "stop", quit=True) + service_command("php!!___PHPVER___!!-fpm", "stop", quit=True) service_command("postfix", "stop", quit=True) service_command("dovecot", "stop", quit=True) @@ -281,7 +281,7 @@ def perform_backup(full_backup): # Start services again. service_command("dovecot", "start", quit=False) service_command("postfix", "start", quit=False) - service_command("php7.3-fpm", "start", quit=False) + service_command("php!!___PHPVER___!!-fpm", "start", quit=False) # Remove old backups. This deletes all backup data no longer needed # from more than 3 days ago. diff --git a/management/daily_tasks.sh b/management/daily_tasks.sh index db496399..dee8b602 100755 --- a/management/daily_tasks.sh +++ b/management/daily_tasks.sh @@ -12,14 +12,14 @@ export LC_TYPE=en_US.UTF-8 # On Mondays, i.e. once a week, send the administrator a report of total emails # sent and received so the admin might notice server abuse. if [ `date "+%u"` -eq 1 ]; then - management/mail_log.py -t week | management/email_administrator.py "Mail-in-a-Box Usage Report" + management/mail_log.py -t week | management/email_administrator.py "Mail-in-a-Box Usage Report" fi # Take a backup. management/backup.py 2>&1 | management/email_administrator.py "Backup Status" # Provision any new certificates for new domains or domains with expiring certificates. -management/ssl_certificates.py -q 2>&1 | management/email_administrator.py "TLS Certificate Provisioning Result" +management/ssl_certificates.py -q 2>&1 | management/email_administrator.py "TLS Certificate Provisioning Result" # Run status checks and email the administrator if anything changed. -management/status_checks.py --show-changes 2>&1 | management/email_administrator.py "Status Checks Change Notice" +management/status_checks.py --show-changes 2>&1 | management/email_administrator.py "Status Checks Change Notice" diff --git a/setup/functions.sh b/setup/functions.sh index 3cfe9e1e..7097ad64 100644 --- a/setup/functions.sh +++ b/setup/functions.sh @@ -232,3 +232,4 @@ elif [ "$OS" == "Ubuntu 20.04 LTS" ]; then fi sed -i "s|!!___PHPVER___!!|${PHP_VERSION}|g" conf/nginx-top.conf +sed -i "s|!!___PHPVER___!!|${PHP_VERSION}|g" management/backup.py From 1d4d03637f2cba4da6a5c59544d92699b8ca5f55 Mon Sep 17 00:00:00 2001 From: David Duque Date: Mon, 29 Jun 2020 09:47:38 +0100 Subject: [PATCH 122/411] Version bump --- README.md | 19 +++++++++++++++++-- setup/bootstrap.sh | 2 +- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 0e0644df..76415ca0 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ sudo apt update sudo apt full-upgrade ``` -Make sure that the `en_US.UTF-8` locale exists and is set as primary +Make sure that the `en_US.UTF-8` locale exists and is set as primary (this depends on the image you use) ```sh sudo apt install locales sudo dpkg-reconfigure locales @@ -22,7 +22,12 @@ Install Power-Mail-in-a-Box (short link) curl -L https://dvn.pt/powermiab | sudo bash ``` -## Current Version: v0.46.POWER.2 (Tracking v0.46) +If that doesn't work: +```sh +curl https://raw.githubusercontent.com/ddavness/power-mailinabox/master/setup/bootstrap.sh | sudo bash +``` + +## Current Version: v0.46.POWER.3 (Tracking v0.46) This is a fork of MiaB (duh), hacked and tuned to my needs: @@ -48,6 +53,16 @@ This is a fork of MiaB (duh), hacked and tuned to my needs: - πŸ’€ Possibility of disabling some services (\*cough\* NextCloud \*cough\*); +### Ideas section: + +- πŸ’€ AXFR Transfers using TSIG? + +- πŸ’€ Expand DNS options? + +- πŸ’€ More complete webmail configuration via the admin panel? + +- πŸ’€ Encrypting backups using user-provided PGP keys? + - πŸ’€ Anything else I might need to use; All in all, I think I should rename this to something like "Central [Clown Computing](https://www.urbandictionary.com/define.php?term=clown%20computing)", since I'm trying to cram as many services as possible into that poor machine (Spending 5$ is better than spending 10$) diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh index cbe5a33a..1f76258c 100644 --- a/setup/bootstrap.sh +++ b/setup/bootstrap.sh @@ -10,7 +10,7 @@ if [ -z "$TAG" ]; then # Make s OS=`lsb_release -d | sed 's/.*:\s*//'` if [ "$OS" == "Debian GNU/Linux 10 (buster)" -o "$OS" == "Ubuntu 20.04 LTS" ]; then - TAG=v0.46.POWER.2 + TAG=v0.46.POWER.3 else echo "This script must be run on a system running Debian 10 OR Ubuntu 20.04 LTS." exit 1 From 3dfdb9a30981ef98005018812858cc7ccbde5339 Mon Sep 17 00:00:00 2001 From: David Duque Date: Fri, 3 Jul 2020 19:01:16 +0100 Subject: [PATCH 123/411] Update Vagrantfile to pull from development branch --- Vagrantfile | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/Vagrantfile b/Vagrantfile index 5f9d780f..2d6d3a0d 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -26,8 +26,22 @@ Vagrant.configure("2") do |config| export PRIMARY_HOSTNAME=auto #export SKIP_NETWORK_CHECKS=1 + if [ ! git ] + then + apt update + apt install git + fi + + if [ ! -d /mailinabox ]; + then + git clone https://github.com/ddavness/power-mailinabox.git /mailinabox + fi + # Start the setup script. - cd /vagrant + cd /mailinabox + git checkout development + git pull + setup/start.sh SH end From dd017c44c76fabee28799dd5450ab3f3bebf396c Mon Sep 17 00:00:00 2001 From: David Duque Date: Wed, 8 Jul 2020 15:00:04 +0100 Subject: [PATCH 124/411] Update ideas section and roadmap --- README.md | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 76415ca0..77f276a1 100644 --- a/README.md +++ b/README.md @@ -51,17 +51,25 @@ This is a fork of MiaB (duh), hacked and tuned to my needs: - βœ… Updated NextCloud to the latest version available; -- πŸ’€ Possibility of disabling some services (\*cough\* NextCloud \*cough\*); +- πŸ’€ Encrypting backups using user-provided PGP keys; + +- πŸ’€ Ability to download the backups from the admin panel; ### Ideas section: -- πŸ’€ AXFR Transfers using TSIG? +- πŸ’€ Possibility of making some services optional (if they require more software to be installed) on setup? -- πŸ’€ Expand DNS options? +- - For example, one might simply not use NextCloud/Munin at all, and they're there... just wasting resources. -- πŸ’€ More complete webmail configuration via the admin panel? +- πŸ’€ Restricting access to the admin panel to certain IP's? -- πŸ’€ Encrypting backups using user-provided PGP keys? +- πŸ’€ Customizing MTA names? (because privacy) + +- πŸ’€ AXFR Transfers (for secondary DNS) using TSIG? + +- πŸ’€ Expand DNS record options? + +- πŸ’€ More complete webmail configuration via the admin panel/plugin management? - πŸ’€ Anything else I might need to use; From 4a85250242569ecddd31b0647798f96290d77f6d Mon Sep 17 00:00:00 2001 From: David Duque Date: Wed, 8 Jul 2020 19:31:35 +0100 Subject: [PATCH 125/411] Revert vagrantfile to upstream config --- Vagrantfile | 30 +++++++----------------------- 1 file changed, 7 insertions(+), 23 deletions(-) diff --git a/Vagrantfile b/Vagrantfile index 2d6d3a0d..9e7ac462 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -1,12 +1,11 @@ + # -*- mode: ruby -*- # vi: set ft=ruby : Vagrant.configure("2") do |config| - # Recreate our conditions - config.vm.box = "generic/debian10" - config.vm.provider "hyperv" do |v| - v.memory = 1024 - v.cpus = 1 + config.vm.box = "debian/buster64" + config.vm.provider :virtualbox do |vb| + vb.customize ["modifyvm", :id, "--cpus", 1, "--memory", 1024] end # Network config: Since it's a mail server, the machine must be connected @@ -24,24 +23,9 @@ Vagrant.configure("2") do |config| export PUBLIC_IP=auto export PUBLIC_IPV6=auto export PRIMARY_HOSTNAME=auto - #export SKIP_NETWORK_CHECKS=1 - - if [ ! git ] - then - apt update - apt install git - fi - - if [ ! -d /mailinabox ]; - then - git clone https://github.com/ddavness/power-mailinabox.git /mailinabox - fi - + export SKIP_NETWORK_CHECKS=1 # Start the setup script. - cd /mailinabox - git checkout development - git pull - + cd /vagrant setup/start.sh SH -end +end \ No newline at end of file From 199c2c50babd0b0822a86bee6f2ad06020fe185f Mon Sep 17 00:00:00 2001 From: David Duque Date: Wed, 8 Jul 2020 19:32:24 +0100 Subject: [PATCH 126/411] Backups: Fix backup target selector width --- management/templates/system-backup.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/management/templates/system-backup.html b/management/templates/system-backup.html index 3860edb7..81915fdc 100644 --- a/management/templates/system-backup.html +++ b/management/templates/system-backup.html @@ -12,7 +12,7 @@
-
+

+ + + + From 79e2398d71762cbec404d8686e53fa4268853bad Mon Sep 17 00:00:00 2001 From: David Duque Date: Sat, 11 Jul 2020 08:30:05 +0100 Subject: [PATCH 128/411] Fix comment --- management/backup.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/management/backup.py b/management/backup.py index cbc2ff5f..c9f7d80a 100755 --- a/management/backup.py +++ b/management/backup.py @@ -339,7 +339,8 @@ def perform_backup(full_backup, user_initiated=False): # before the status checks might catch them down. See #381. if user_initiated: # God forgive me for what I'm about to do - lock._release() # We don't need to restart the services + lock._release() + # We don't need to wait for the services to be up in this case else: wait_for_service(25, True, env, 10) wait_for_service(993, True, env, 10) From e224b6b3b2cb4b9fed7ec852749c3d0e0e4ce54b Mon Sep 17 00:00:00 2001 From: David Duque Date: Sat, 11 Jul 2020 08:43:46 +0100 Subject: [PATCH 129/411] Update project status --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index 77f276a1..a61c8113 100644 --- a/README.md +++ b/README.md @@ -51,6 +51,8 @@ This is a fork of MiaB (duh), hacked and tuned to my needs: - βœ… Updated NextCloud to the latest version available; +- πŸ‘¨β€πŸ’» Performing backups immediately from the admin panel (independently from the daily schedule); + - πŸ’€ Encrypting backups using user-provided PGP keys; - πŸ’€ Ability to download the backups from the admin panel; @@ -71,6 +73,10 @@ This is a fork of MiaB (duh), hacked and tuned to my needs: - πŸ’€ More complete webmail configuration via the admin panel/plugin management? +- πŸ’€ Optional TOTP Two-Factor-Authentication for the admin panel/webmail? + +- - Maybe U2F one day, too, but I don't have a capable device for this just yet... + - πŸ’€ Anything else I might need to use; All in all, I think I should rename this to something like "Central [Clown Computing](https://www.urbandictionary.com/define.php?term=clown%20computing)", since I'm trying to cram as many services as possible into that poor machine (Spending 5$ is better than spending 10$) From ccf60c7017b738d94b15b8d74b8808b77e7d5f35 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sat, 11 Jul 2020 09:16:32 +0100 Subject: [PATCH 130/411] Backups: User-initiated and cron-initiated jobs will have the same lockname So that some poor timing (initiating a backup when there's a cron-initiated backup) doesn't screw everything up. --- management/backup.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/management/backup.py b/management/backup.py index c9f7d80a..bfae23b3 100755 --- a/management/backup.py +++ b/management/backup.py @@ -215,7 +215,7 @@ def perform_backup(full_backup, user_initiated=False): # Create an global exclusive lock so that the backup script # cannot be run more than one. - lock = Lock(die=(not user_initiated)) + lock = Lock(name="mailinabox_backup_daemon", die=(not user_initiated)) if user_initiated: # God forgive me for what I'm about to do try: From b562e7eefac7994d00b3fbc00f57c4f23c981717 Mon Sep 17 00:00:00 2001 From: David Duque Date: Sat, 11 Jul 2020 15:45:50 +0100 Subject: [PATCH 131/411] Hide the 'Create Backup' buttons when backups are turned off --- management/templates/system-backup.html | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/management/templates/system-backup.html b/management/templates/system-backup.html index f24f48cd..5d0e3487 100644 --- a/management/templates/system-backup.html +++ b/management/templates/system-backup.html @@ -141,8 +141,9 @@ - - + + + - + + this is a mail-in-a-box + + + +

this is a mail-in-a-box

+

take control of your email at https://mailinabox.email/

+ diff --git a/management/backup.py b/management/backup.py index b23d1532..618a51c5 100755 --- a/management/backup.py +++ b/management/backup.py @@ -10,7 +10,7 @@ import os, os.path, shutil, glob, re, datetime, sys import dateutil.parser, dateutil.relativedelta, dateutil.tz import rtyaml -from exclusiveprocess import Lock, CannotAcquireLock +from exclusiveprocess import Lock from utils import load_environment, shell, wait_for_service, fix_boto, get_php_version @@ -210,22 +210,14 @@ def get_target_type(config): protocol = config["target"].split(":")[0] return protocol -def perform_backup(full_backup, user_initiated=False): +def perform_backup(full_backup): env = load_environment() php_fpm = f"php{get_php_version()}-fpm" # Create an global exclusive lock so that the backup script - # cannot be run more than one. - lock = Lock(name="mailinabox_backup_daemon", die=(not user_initiated)) - if user_initiated: - # God forgive me for what I'm about to do - try: - lock._acquire() - except CannotAcquireLock: - return "Another backup is already being done!" - else: - lock.forever() - + # cannot be run more than once. + Lock(die=True).forever() + config = get_backup_config(env) backup_root = os.path.join(env["STORAGE_ROOT"], 'backup') backup_cache_dir = os.path.join(backup_root, 'cache') @@ -329,14 +321,9 @@ def perform_backup(full_backup, user_initiated=False): # backup. Since it checks that dovecot and postfix are running, block for a # bit (maximum of 10 seconds each) to give each a chance to finish restarting # before the status checks might catch them down. See #381. - if user_initiated: - # God forgive me for what I'm about to do - lock._release() - # We don't need to wait for the services to be up in this case - else: - wait_for_service(25, True, env, 10) - wait_for_service(993, True, env, 10) - + wait_for_service(25, True, env, 10) + wait_for_service(993, True, env, 10) + # Execute a post-backup script that does the copying to a remote server. # Run as the STORAGE_USER user, not as root. Pass our settings in # environment variables so the script has access to STORAGE_ROOT. @@ -346,7 +333,6 @@ def perform_backup(full_backup, user_initiated=False): ['su', env['STORAGE_USER'], '-c', post_script, config["target"]], env=env) - def run_duplicity_verification(): env = load_environment() backup_root = os.path.join(env["STORAGE_ROOT"], 'backup') diff --git a/management/daemon.py b/management/daemon.py index d08dfdb3..f727958b 100755 --- a/management/daemon.py +++ b/management/daemon.py @@ -280,17 +280,50 @@ def dns_set_secondary_nameserver(): @app.route('/dns/custom') @authorized_personnel_only def dns_get_records(qname=None, rtype=None): - from dns_update import get_custom_dns_config - return json_response([ - { - "qname": r[0], - "rtype": r[1], - "value": r[2], - } - for r in get_custom_dns_config(env) - if r[0] != "_secondary_nameserver" - and (not qname or r[0] == qname) - and (not rtype or r[1] == rtype) ]) + # Get the current set of custom DNS records. + from dns_update import get_custom_dns_config, get_dns_zones + records = get_custom_dns_config(env, only_real_records=True) + + # Filter per the arguments for the more complex GET routes below. + records = [r for r in records + if (not qname or r[0] == qname) + and (not rtype or r[1] == rtype) ] + + # Make a better data structure. + records = [ + { + "qname": r[0], + "rtype": r[1], + "value": r[2], + "sort-order": { }, + } for r in records ] + + # To help with grouping by zone in qname sorting, label each record with which zone it is in. + # There's an inconsistency in how we handle zones in get_dns_zones and in sort_domains, so + # do this first before sorting the domains within the zones. + zones = utils.sort_domains([z[0] for z in get_dns_zones(env)], env) + for r in records: + for z in zones: + if r["qname"] == z or r["qname"].endswith("." + z): + r["zone"] = z + break + + # Add sorting information. The 'created' order follows the order in the YAML file on disk, + # which tracs the order entries were added in the control panel since we append to the end. + # The 'qname' sort order sorts by our standard domain name sort (by zone then by qname), + # then by rtype, and last by the original order in the YAML file (since sorting by value + # may not make sense, unless we parse IP addresses, for example). + for i, r in enumerate(records): + r["sort-order"]["created"] = i + domain_sort_order = utils.sort_domains([r["qname"] for r in records], env) + for i, r in enumerate(sorted(records, key = lambda r : ( + zones.index(r["zone"]), + domain_sort_order.index(r["qname"]), + r["rtype"]))): + r["sort-order"]["qname"] = i + + # Return. + return json_response(records) @app.route('/dns/custom/', methods=['GET', 'POST', 'PUT', 'DELETE']) @app.route('/dns/custom//', methods=['GET', 'POST', 'PUT', 'DELETE']) @@ -594,19 +627,6 @@ def backup_set_custom(): request.form.get('min_age', '') )) -@app.route('/system/backup/new', methods=["POST"]) -@authorized_personnel_only -def backup_new(): - from backup import perform_backup, get_backup_config - - # If backups are disabled, don't perform the backup - config = get_backup_config(env) - if config["target"] == "off": - return "Backups are disabled in this machine. Nothing was done." - - msg = perform_backup(request.form.get('full', False) == 'true', True) - return "OK" if msg is None else msg - @app.route('/system/privacy', methods=["GET"]) @authorized_personnel_only def privacy_status_get(): @@ -621,49 +641,6 @@ def privacy_status_set(): utils.write_settings(config, env) return "OK" -@app.route('/system/smtp/relay', methods=["GET"]) -@authorized_personnel_only -def smtp_relay_get(): - config = utils.load_settings(env) - return { - "enabled": config.get("SMTP_RELAY_ENABLED", True), - "host": config.get("SMTP_RELAY_HOST", ""), - "auth_enabled": config.get("SMTP_RELAY_AUTH", False), - "user": config.get("SMTP_RELAY_USER", "") - } - -@app.route('/system/smtp/relay', methods=["POST"]) -@authorized_personnel_only -def smtp_relay_set(): - from editconf import edit_conf - config = utils.load_settings(env) - newconf = request.form - try: - # Write on daemon settings - config["SMTP_RELAY_ENABLED"] = (newconf.get("enabled") == "true") - config["SMTP_RELAY_HOST"] = newconf.get("host") - config["SMTP_RELAY_AUTH"] = (newconf.get("auth_enabled") == "true") - config["SMTP_RELAY_USER"] = newconf.get("user") - utils.write_settings(config, env) - # Write on Postfix configs - edit_conf("/etc/postfix/main.cf", [ - "relayhost=" + (f"[{config['SMTP_RELAY_HOST']}]:587" if config["SMTP_RELAY_ENABLED"] else ""), - "smtp_sasl_auth_enable=" + ("yes" if config["SMTP_RELAY_AUTH"] else "no"), - "smtp_sasl_security_options=" + ("noanonymous" if config["SMTP_RELAY_AUTH"] else "anonymous"), - "smtp_sasl_tls_security_options=" + ("noanonymous" if config["SMTP_RELAY_AUTH"] else "anonymous") - ], delimiter_re=r"\s*=\s*", delimiter="=", comment_char="#") - if config["SMTP_RELAY_AUTH"]: - # Edit the sasl password - with open("/etc/postfix/sasl_passwd", "w") as f: - f.write(f"[{config['SMTP_RELAY_HOST']}]:587 {config['SMTP_RELAY_USER']}:{newconf.get('key')}\n") - utils.shell("check_output", ["/usr/bin/chmod", "600", "/etc/postfix/sasl_passwd"], capture_stderr=True) - utils.shell("check_output", ["/usr/sbin/postmap", "/etc/postfix/sasl_passwd"], capture_stderr=True) - # Restart Postfix - return utils.shell("check_output", ["/usr/bin/systemctl", "restart", "postfix"], capture_stderr=True) - except Exception as e: - return (str(e), 500) - - # MUNIN @app.route('/munin/') diff --git a/management/daily_tasks.sh b/management/daily_tasks.sh index dee8b602..db496399 100755 --- a/management/daily_tasks.sh +++ b/management/daily_tasks.sh @@ -12,14 +12,14 @@ export LC_TYPE=en_US.UTF-8 # On Mondays, i.e. once a week, send the administrator a report of total emails # sent and received so the admin might notice server abuse. if [ `date "+%u"` -eq 1 ]; then - management/mail_log.py -t week | management/email_administrator.py "Mail-in-a-Box Usage Report" + management/mail_log.py -t week | management/email_administrator.py "Mail-in-a-Box Usage Report" fi # Take a backup. management/backup.py 2>&1 | management/email_administrator.py "Backup Status" # Provision any new certificates for new domains or domains with expiring certificates. -management/ssl_certificates.py -q 2>&1 | management/email_administrator.py "TLS Certificate Provisioning Result" +management/ssl_certificates.py -q 2>&1 | management/email_administrator.py "TLS Certificate Provisioning Result" # Run status checks and email the administrator if anything changed. -management/status_checks.py --show-changes 2>&1 | management/email_administrator.py "Status Checks Change Notice" +management/status_checks.py --show-changes 2>&1 | management/email_administrator.py "Status Checks Change Notice" diff --git a/management/dns_update.py b/management/dns_update.py index 6280414f..569de9b1 100755 --- a/management/dns_update.py +++ b/management/dns_update.py @@ -753,7 +753,7 @@ def write_opendkim_tables(domains, env): ######################################################################## -def get_custom_dns_config(env): +def get_custom_dns_config(env, only_real_records=False): try: custom_dns = rtyaml.load(open(os.path.join(env['STORAGE_ROOT'], 'dns/custom.yaml'))) if not isinstance(custom_dns, dict): raise ValueError() # caught below @@ -761,6 +761,8 @@ def get_custom_dns_config(env): return [ ] for qname, value in custom_dns.items(): + if qname == "_secondary_nameserver" and only_real_records: continue # skip fake record + # Short form. Mapping a domain name to a string is short-hand # for creating A records. if isinstance(value, str): diff --git a/management/mail_log.py b/management/mail_log.py index 9e08df77..1626f820 100755 --- a/management/mail_log.py +++ b/management/mail_log.py @@ -44,9 +44,8 @@ TIME_DELTAS = OrderedDict([ ('today', datetime.datetime.now() - datetime.datetime.now().replace(hour=0, minute=0, second=0)) ]) -# Start date > end date! -START_DATE = datetime.datetime.now() -END_DATE = None +END_DATE = NOW = datetime.datetime.now() +START_DATE = None VERBOSE = False @@ -121,7 +120,7 @@ def scan_mail_log(env): pass print("Scanning logs from {:%Y-%m-%d %H:%M:%S} to {:%Y-%m-%d %H:%M:%S}".format( - END_DATE, START_DATE) + START_DATE, END_DATE) ) # Scan the lines in the log files until the date goes out of range @@ -253,7 +252,7 @@ def scan_mail_log(env): if collector["postgrey"]: msg = "Greylisted Email {:%Y-%m-%d %H:%M:%S} and {:%Y-%m-%d %H:%M:%S}" - print_header(msg.format(END_DATE, START_DATE)) + print_header(msg.format(START_DATE, END_DATE)) print(textwrap.fill( "The following mail was greylisted, meaning the emails were temporarily rejected. " @@ -291,7 +290,7 @@ def scan_mail_log(env): if collector["rejected"]: msg = "Blocked Email {:%Y-%m-%d %H:%M:%S} and {:%Y-%m-%d %H:%M:%S}" - print_header(msg.format(END_DATE, START_DATE)) + print_header(msg.format(START_DATE, END_DATE)) data = OrderedDict(sorted(collector["rejected"].items(), key=email_sort)) @@ -344,20 +343,20 @@ def scan_mail_log_line(line, collector): # Replaced the dateutil parser for a less clever way of parser that is roughly 4 times faster. # date = dateutil.parser.parse(date) - - # date = datetime.datetime.strptime(date, '%b %d %H:%M:%S') - # date = date.replace(START_DATE.year) - - # strptime fails on Feb 29 if correct year is not provided. See https://bugs.python.org/issue26460 - date = datetime.datetime.strptime(str(START_DATE.year) + ' ' + date, '%Y %b %d %H:%M:%S') - # print("date:", date) + + # strptime fails on Feb 29 with ValueError: day is out of range for month if correct year is not provided. + # See https://bugs.python.org/issue26460 + date = datetime.datetime.strptime(str(NOW.year) + ' ' + date, '%Y %b %d %H:%M:%S') + # if log date in future, step back a year + if date > NOW: + date = date.replace(year = NOW.year - 1) + #print("date:", date) # Check if the found date is within the time span we are scanning - # END_DATE < START_DATE - if date > START_DATE: + if date > END_DATE: # Don't process, and halt return False - elif date < END_DATE: + elif date < START_DATE: # Don't process, but continue return True @@ -606,7 +605,7 @@ def email_sort(email): def valid_date(string): - """ Validate the given date string fetched from the --startdate argument """ + """ Validate the given date string fetched from the --enddate argument """ try: date = dateutil.parser.parse(string) except ValueError: @@ -820,12 +819,14 @@ if __name__ == "__main__": parser.add_argument("-t", "--timespan", choices=TIME_DELTAS.keys(), default='today', metavar='
- +
+ sort by: + domain name + | + created +
+ @@ -192,36 +198,38 @@ function show_current_custom_dns() { $('#custom-dns-current').fadeIn(); else $('#custom-dns-current').fadeOut(); - - var reverse_fqdn = function(el) { - el.qname = el.qname.split('.').reverse().join('.'); - return el; - } - var sort = function(a, b) { - if(a.qname === b.qname) { - if(a.rtype === b.rtype) { - return a.value > b.value ? 1 : -1; - } - return a.rtype > b.rtype ? 1 : -1; - } - return a.qname > b.qname ? 1 : -1; - } + window.miab_custom_dns_data = data; + show_current_custom_dns_update_after_sort(); + }); +} - data = data.map(reverse_fqdn).sort(sort).map(reverse_fqdn); +function show_current_custom_dns_update_after_sort() { + var data = window.miab_custom_dns_data; + var sort_key = window.miab_custom_dns_data_sort_order || "qname"; - $('#custom-dns-current').find("tbody").text(''); + data.sort(function(a, b) { return a["sort-order"][sort_key] - b["sort-order"][sort_key] }); + + var tbody = $('#custom-dns-current').find("tbody"); + tbody.text(''); + var last_zone = null; for (var i = 0; i < data.length; i++) { + if (sort_key == "qname" && data[i].zone != last_zone) { + var r = $(""); + r.find("th").text(data[i].zone); + tbody.append(r); + last_zone = data[i].zone; + } + var tr = $(""); - $('#custom-dns-current').find("tbody").append(tr); + tbody.append(tr); tr.attr('data-qname', data[i].qname); tr.attr('data-rtype', data[i].rtype); tr.attr('data-value', data[i].value); tr.append($('')); } - }); } function delete_custom_dns_record(elem) { diff --git a/management/templates/external-dns.html b/management/templates/external-dns.html index d596e64a..0634ec82 100644 --- a/management/templates/external-dns.html +++ b/management/templates/external-dns.html @@ -36,7 +36,7 @@ - - - - - - - - - - - - - - - - - - - - - - - - - -
- - -
- -
-
- - -
- -
- 		:587
- - -
- -
-
- - -
- -
-
- - -
- -
-
-
- -
- -
- -
- - diff --git a/management/templates/ssl.html b/management/templates/ssl.html index 92cce670..a6b913ee 100644 --- a/management/templates/ssl.html +++ b/management/templates/ssl.html @@ -12,7 +12,6 @@ diff --git a/management/templates/system-backup.html b/management/templates/system-backup.html index 57e06d13..7cdc3803 100644 --- a/management/templates/system-backup.html +++ b/management/templates/system-backup.html @@ -12,12 +12,13 @@
-
+
@@ -165,11 +166,6 @@ - - - - - + \ No newline at end of file diff --git a/management/templates/system-status.html b/management/templates/system-status.html index 74934713..dc9233a5 100644 --- a/management/templates/system-status.html +++ b/management/templates/system-status.html @@ -1,168 +1,160 @@

System Status Checks

-
-
+
+
- + - +
-
-
+
- - - -
+ + + + + +
diff --git a/management/templates/users.html b/management/templates/users.html index 4b349875..24adf4a1 100644 --- a/management/templates/users.html +++ b/management/templates/users.html @@ -1,7 +1,6 @@

Users

Aliases

@@ -163,7 +163,7 @@ function show_aliases() { var n = $("#alias-template").clone(); n.attr('id', ''); - if (alias.required) n.addClass('alias-required'); + if (alias.auto) n.addClass('alias-auto'); n.attr('data-address', alias.address_display); // this is decoded from IDNA, but will get re-coded to IDNA on the backend n.find('td.address').text(alias.address_display) for (var j = 0; j < alias.forwards_to.length; j++) diff --git a/management/templates/external-dns.html b/management/templates/external-dns.html index 0634ec82..4532c3f5 100644 --- a/management/templates/external-dns.html +++ b/management/templates/external-dns.html @@ -38,7 +38,7 @@ diff --git a/management/templates/index.html b/management/templates/index.html index 03e01687..f9c87f2c 100644 --- a/management/templates/index.html +++ b/management/templates/index.html @@ -62,6 +62,37 @@ ol li { margin-bottom: 1em; } + + .if-logged-in { display: none; } + .if-logged-in-admin { display: none; } + + /* The below only gets used if it is supported */ + @media (prefers-color-scheme: dark) { + /* Invert invert lightness but not hue */ + html { + filter: invert(100%) hue-rotate(180deg); + } + + /* Set explicit background color (necessary for Firefox) */ + html { + background-color: #111; + } + + /* Override Boostrap theme here to give more contrast. The black turns to white by the filter. */ + .form-control { + color: black !important; + } + + /* Revert the invert for the navbar */ + button, div.navbar { + filter: invert(100%) hue-rotate(180deg); + } + + /* Revert the revert for the dropdowns */ + ul.dropdown-menu { + filter: invert(100%) hue-rotate(180deg); + } + } @@ -83,7 +114,7 @@
-
+
+ {% include "welcome.html" %} +
+
{% include "system-status.html" %}
@@ -166,6 +202,10 @@ {% include "ssl.html" %}
+
+ {% include "munin.html" %} +
+
From 6d3d2ceb829908e7ef2c81227c7d65b4078fc215 Mon Sep 17 00:00:00 2001 From: KiekerJan Date: Mon, 5 Dec 2022 15:38:36 +0100 Subject: [PATCH 390/411] store munin files in MiaB storage dir --- setup/munin.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setup/munin.sh b/setup/munin.sh index 537007e2..dad855ac 100755 --- a/setup/munin.sh +++ b/setup/munin.sh @@ -10,9 +10,12 @@ echo "Installing Munin (system monitoring)..." apt_install munin munin-node libcgi-fast-perl munin-plugins-extra # libcgi-fast-perl is needed by /usr/lib/munin/cgi/munin-cgi-graph +mkdir -p $STORAGE_ROOT/munin +chown munin:munin $STORAGE_ROOT/munin + # edit config cat > /etc/munin/munin.conf < Date: Sun, 11 Dec 2022 14:32:17 +0100 Subject: [PATCH 391/411] add alternative dyndns function that determines public ip on curl basis instead of dig --- tools/dyndns/dyndns2.sh | 223 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 223 insertions(+) create mode 100755 tools/dyndns/dyndns2.sh diff --git a/tools/dyndns/dyndns2.sh b/tools/dyndns/dyndns2.sh new file mode 100755 index 00000000..b70d7fd4 --- /dev/null +++ b/tools/dyndns/dyndns2.sh @@ -0,0 +1,223 @@ +#!/bin/bash +# based on dm-dyndns v1.0, dmurphy@dmurphy.com +# Shell script to provide dynamic DNS to a mail-in-the-box platform. +# Requirements: +# curl installed +# oathtool installed if totp is to be used +# OpenDNS myip service availability (myip.opendns.com 15) +# Mailinabox host (see https://mailinabox.email 2) +# Mailinabox admin username/password in the CFGFILE below +# one line file of the format (curl cfg file): +# user = β€œusername:password” +# Dynamic DNS name to be set +# DYNDNSNAMELIST file contains one hostname per line that needs to be set to this IP. + +#----- Contents of dyndns.cfg file below ------ +#----- user credentials ----------------------- +#USER_NAME="admin@mydomain.com" +#USER_PASS="MYADMINPASSWORD" +#----- Contents of dyndns.domain below -------- +# +#------ Contents of dyndns.dynlist below ------ +#vpn.mydomain.com +#nas.mydomain.com +#------ Contents of dyndns.totp --------------- +#- only needed in case of TOTP authentication - +#TOTP_KEY=ABCDEFGABCFEXXXXXXXX + +MYNAME="dyndns" +CFGFILE="$MYNAME.cfg" +TOTPFILE="$MYNAME.totp" +DOMFILE="$MYNAME.domain" +CURLCMD="/usr/bin/curl" +DIGCMD="/usr/bin/dig" +CATCMD="/bin/cat" +OATHTOOLCMD="/usr/bin/oathtool" +DYNDNSNAMELIST="$MYNAME.dynlist" + +IGNORESTR=";; connection timed out; no servers could be reached" + +if [ ! -x $CURLCMD ]; then + echo "$MYNAME: curl command $CURLCMD not found. Check and fix please." + exit 99 +fi + +if [ ! -x $DIGCMD ]; then + echo "$MYNAME: dig command $DIGCMD not found. Check and fix please." + exit 99 +fi + +if [ ! -x $CATCMD ]; then + echo "$MYNAME: cat command $CATCMD not found. Check and fix please." + exit 99 +fi + +DOMAIN=$(cat $DOMFILE) +MIABHOST="box.$DOMAIN" + +noww="$(date +"%F %T")" +echo "$noww: running dynamic dns update for $DOMAIN" + +if [ ! -f $CFGFILE ]; then + echo "$MYNAME: $CFGFILE not found. Check and fix please." + exit 99 +fi + +if [ ! -f $DYNDNSNAMELIST ]; then + echo "$MYNAME: $DYNDNSNAMELIST not found. Check and fix please." + exit 99 +fi + +source $CFGFILE +AUTHSTR="Authorization: Basic $(echo $USER_NAME:$USER_PASS | base64 -w 0)" + +# Test an IP address for validity: +# Usage: +# valid_ipv4 IP_ADDRESS +# if [[ $? -eq 0 ]]; then echo good; else echo bad; fi +# OR +# if valid_ipv4 IP_ADDRESS; then echo good; else echo bad; fi +# +function valid_ipv4() +{ + local ip=$1 + local stat=1 + + if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then + OIFS=$IFS + IFS='.' + ip=($ip) + IFS=$OIFS + [[ ${ip[0]} -le 255 && ${ip[1]} -le 255 \ + && ${ip[2]} -le 255 && ${ip[3]} -le 255 ]] + stat=$? + fi + return $stat +} + +MYIP="`$CURLCMD -4 -s icanhazip.com`" + +if [[ "`valid_ipv4 ${MYIP}`" -ne 0 ]]; then + MYIP="`$CURLCMD -4 -s api64.ipify.org`" +fi + +if [[ "`valid_ipv4 ${MYIP}`" -eq 0 ]]; then + for DYNDNSNAME in `$CATCMD $DYNDNSNAMELIST` + do + PREVIP="`$DIGCMD A +short $DYNDNSNAME @$MIABHOST`" + if [ -z "$PREVIP" ]; then + echo "$MYNAME: dig output was blank." + fi + + if [ "x$PREVIP" == "x$MYIP" ]; then + echo "$MYNAME: $DYNDNSNAME ipv4 hasn't changed." + else + echo "$MYNAME: $DYNDNSNAME changed (previously: $PREVIP, now: $MYIP)" + + STATUS="`$CURLCMD -X PUT -u $USER_NAME:$USER_PASS -s -d $MYIP https://$MIABHOST/admin/dns/custom/$DYNDNSNAME/A`" + + case $STATUS in + "OK") echo "$MYNAME: mailinabox API returned OK, cmd succeeded but no update.";; + "updated DNS: $DOMAIN") echo "$MYNAME: mailinabox API updated $DYNDNSNAME ipv4 OK.";; + "invalid-totp-token"|"missing-totp-token") echo "$MYNAME: invalid TOTP token. Retrying with TOTP token" + if [ ! -x $AOTHTOOLCMD ]; then + echo "$MYNAME: oathtool command $OATHTOOLCMD not found. Check and fix please." + exit 99 + fi + + if [ ! -f $TOTPFILE ]; then + echo "$MYNAME: $TOTPFILE not found. Check and fix please." + exit 99 + fi + + source $TOTPFILE + + TOTP="X-Auth-Token: $(oathtool --totp -b -d 6 $TOTP_KEY)" + STATUST="`$CURLCMD -X PUT -u $USER_NAME:$USER_PASS -H "$TOTP" -s -d $MYIP https://$MIABHOST/admin/dns/custom/$DYNDNSNAME/A`" + + case $STATUST in + "OK") echo "$MYNAME: mailinabox API returned OK, cmd succeeded but no update.";; + "updated DNS: $DOMAIN") echo "$MYNAME: mailinabox API updated $DYNDNSNAME ipv4 OK.";; + "invalid-totp-token") echo "$MYNAME: invalid TOTP token.";; + *) echo "$MYNAME: other status from mailinabox API. Please check: $STATUST (2)";; + esac + ;; + *) echo "$MYNAME: other status from mailinabox API. Please check: $STATUS (1)";; + esac + fi + done +else + echo "$MYNAME: No ipv4 address found." +fi + +# Now to do the same for ipv6 + +function valid_ipv6() +{ + local IP_ADDR=$1 + local stat=1 + + if python3 -c "import ipaddress; ipaddress.IPv6Network('${IP_ADDR}')" 2>/dev/null; then + stat=0 + fi + return $stat +} + +MYIP="`$CURLCMD -6 -s icanhazip.com`" + +if [[ "`valid_ipv6 ${MYIP}`" -ne 0 ]]; then + MYIP="`$CURLCMD -6 -s api64.ipify.org`" +fi + +if [[ "`valid_ipv6 ${MYIP}`" -eq 0 ]]; then + for DYNDNSNAME in `$CATCMD $DYNDNSNAMELIST` + do + PREVIP="`$DIGCMD AAAA +short $DYNDNSNAME @$MIABHOST`" + if [ -z "$PREVIP" ]; then + echo "$MYNAME: dig output was blank." + fi + + if [ "x$PREVIP" = "x$MYIP" ]; then + echo "$MYNAME: $DYNDNSNAME ipv6 hasn't changed." + else + echo "$MYNAME: $DYNDNSNAME changed (previously: $PREVIP, now: $MYIP)" + + STATUS="`$CURLCMD -X PUT -u $USER_NAME:$USER_PASS -s -d $MYIP https://$MIABHOST/admin/dns/custom/$DYNDNSNAME/AAAA`" + + case $STATUS in + "OK") echo "$MYNAME: mailinabox API returned OK, cmd succeeded but no update.";; + "updated DNS: $DOMAIN") echo "$MYNAME: mailinabox API updated $DYNDNSNAME ipv6 OK.";; + "invalid-totp-token"|"missing-totp-token") echo "$MYNAME: invalid TOTP token. Retrying with TOTP token" + if [ ! -x $AOTHTOOLCMD ]; then + echo "$MYNAME: oathtool command $OATHTOOLCMD not found. Check and fix please." + exit 99 + fi + + if [ ! -f $TOTPFILE ]; then + echo "$MYNAME: $TOTPFILE not found. Check and fix please." + exit 99 + fi + + source $TOTPFILE + + TOTP="X-Auth-Token: $(oathtool --totp -b -d 6 $TOTP_KEY)" + STATUST="`$CURLCMD -X PUT -u $USER_NAME:$USER_PASS -H "$TOTP" -s -d $MYIP https://$MIABHOST/admin/dns/custom/$DYNDNSNAME/AAAA`" + + case $STATUST in + "OK") echo "$MYNAME: mailinabox API returned OK, cmd succeeded but no update.";; + "updated DNS: $DOMAIN") echo "$MYNAME: mailinabox API updated $DYNDNSNAME ipv6 OK.";; + "invalid-totp-token") echo "$MYNAME: invalid TOTP token.";; + *) echo "$MYNAME: other status from mailinabox API. Please check: $STATUST (2)";; + esac + ;; + *) echo "$MYNAME: other status from mailinabox API. Please check: $STATUS (1)";; + esac + fi + done +else + echo "$MYNAME: No ipv6 address found." + exit 99 +fi + +exit 0 + From c29593b5ef6f1e39b4283d24f272dc49e947492c Mon Sep 17 00:00:00 2001 From: KiekerJan Date: Sun, 15 Jan 2023 14:10:04 +0100 Subject: [PATCH 392/411] explicitly enable fail2ban which didn't start (#2190) --- setup/system.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/setup/system.sh b/setup/system.sh index d0003f9c..216c2cd8 100755 --- a/setup/system.sh +++ b/setup/system.sh @@ -373,3 +373,5 @@ cp -f conf/fail2ban/filter.d/* /etc/fail2ban/filter.d/ # scripts will ensure the files exist and then fail2ban is given another # restart at the very end of setup. restart_service fail2ban + +systemctl enable fail2ban From 0fc5105da515f6453889d87ab4f0347cbb8b0c58 Mon Sep 17 00:00:00 2001 From: KiekerJan Date: Sun, 15 Jan 2023 14:20:08 +0100 Subject: [PATCH 393/411] Fixes to DNS lookups during status checks when there are timeouts, enforce timeouts better (#2191) * add dns query handling changes * replace exception pass with error message * simplify dns exception catching * Add not set case to blacklist lookup result handling --- management/dns_update.py | 24 +++++++++++++++++------- management/status_checks.py | 13 +++++++++++-- 2 files changed, 28 insertions(+), 9 deletions(-) diff --git a/management/dns_update.py b/management/dns_update.py index 2bfc104f..2fb2baf5 100755 --- a/management/dns_update.py +++ b/management/dns_update.py @@ -992,6 +992,7 @@ def set_custom_dns_record(qname, rtype, value, action, env): def get_secondary_dns(custom_dns, mode=None): resolver = dns.resolver.get_default_resolver() resolver.timeout = 10 + resolver.lifetime = 10 values = [] for qname, rtype, value in custom_dns: @@ -1009,10 +1010,17 @@ def get_secondary_dns(custom_dns, mode=None): # doesn't. if not hostname.startswith("xfr:"): if mode == "xfr": - response = dns.resolver.resolve(hostname+'.', "A", raise_on_no_answer=False) - values.extend(map(str, response)) - response = dns.resolver.resolve(hostname+'.', "AAAA", raise_on_no_answer=False) - values.extend(map(str, response)) + try: + response = resolver.resolve(hostname+'.', "A", raise_on_no_answer=False) + values.extend(map(str, response)) + except dns.exception.DNSException: + pass + + try: + response = resolver.resolve(hostname+'.', "AAAA", raise_on_no_answer=False) + values.extend(map(str, response)) + except dns.exception.DNSException: + pass continue values.append(hostname) @@ -1030,15 +1038,17 @@ def set_secondary_dns(hostnames, env): # Validate that all hostnames are valid and that all zone-xfer IP addresses are valid. resolver = dns.resolver.get_default_resolver() resolver.timeout = 5 + resolver.lifetime = 5 + for item in hostnames: if not item.startswith("xfr:"): # Resolve hostname. try: response = resolver.resolve(item, "A") - except (dns.resolver.NoNameservers, dns.resolver.NXDOMAIN, dns.resolver.NoAnswer): + except (dns.resolver.NoNameservers, dns.resolver.NXDOMAIN, dns.resolver.NoAnswer, dns.resolver.Timeout): try: response = resolver.resolve(item, "AAAA") - except (dns.resolver.NoNameservers, dns.resolver.NXDOMAIN, dns.resolver.NoAnswer): + except (dns.resolver.NoNameservers, dns.resolver.NXDOMAIN, dns.resolver.NoAnswer, dns.resolver.Timeout): raise ValueError("Could not resolve the IP address of %s." % item) else: # Validate IP address. @@ -1071,7 +1081,7 @@ def get_custom_dns_records(custom_dns, qname, rtype): def build_recommended_dns(env): ret = [] for (domain, zonefile, records) in build_zones(env): - # remove records that we don't dislay + # remove records that we don't display records = [r for r in records if r[3] is not False] # put Required at the top, then Recommended, then everythiing else diff --git a/management/status_checks.py b/management/status_checks.py index 0d555441..4b3713ba 100755 --- a/management/status_checks.py +++ b/management/status_checks.py @@ -308,6 +308,8 @@ def run_network_checks(env, output): output.print_ok("IP address is not blacklisted by zen.spamhaus.org.") elif zen == "[timeout]": output.print_warning("Connection to zen.spamhaus.org timed out. We could not determine whether your server's IP address is blacklisted. Please try again later.") + elif zen == "[Not Set]": + output.print_warning("Could not connect to zen.spamhaus.org. We could not determine whether your server's IP address is blacklisted. Please try again later.") else: output.print_error("""The IP address of this machine %s is listed in the Spamhaus Block List (code %s), which may prevent recipients from receiving your email. See http://www.spamhaus.org/query/ip/%s.""" @@ -541,7 +543,7 @@ def check_dns_zone(domain, env, output, dns_zonefiles): for ns in custom_secondary_ns: # We must first resolve the nameserver to an IP address so we can query it. ns_ips = query_dns(ns, "A") - if not ns_ips: + if not ns_ips or ns_ips in {'[Not Set]', '[timeout]'}: output.print_error("Secondary nameserver %s is not valid (it doesn't resolve to an IP address)." % ns) continue # Choose the first IP if nameserver returns multiple @@ -744,6 +746,8 @@ def check_mail_domain(domain, env, output): output.print_ok("Domain is not blacklisted by dbl.spamhaus.org.") elif dbl == "[timeout]": output.print_warning("Connection to dbl.spamhaus.org timed out. We could not determine whether the domain {} is blacklisted. Please try again later.".format(domain)) + elif dbl == "[Not Set]": + output.print_warning("Could not connect to dbl.spamhaus.org. We could not determine whether the domain {} is blacklisted. Please try again later.".format(domain)) else: output.print_error("""This domain is listed in the Spamhaus Domain Block List (code %s), which may prevent recipients from receiving your mail. @@ -788,12 +792,17 @@ def query_dns(qname, rtype, nxdomain='[Not Set]', at=None, as_list=False): # running bind server), or if the 'at' argument is specified, use that host # as the nameserver. resolver = dns.resolver.get_default_resolver() - if at: + + # Make sure at is not a string that cannot be used as a nameserver + if at and at not in {'[Not set]', '[timeout]'}: resolver = dns.resolver.Resolver() resolver.nameservers = [at] # Set a timeout so that a non-responsive server doesn't hold us back. resolver.timeout = 5 + # The number of seconds to spend trying to get an answer to the question. If the + # lifetime expires a dns.exception.Timeout exception will be raised. + resolver.lifetime = 5 # Do the query. try: From 15872487621a66e900d550ba095b8cdd12c5fcc0 Mon Sep 17 00:00:00 2001 From: KiekerJan Date: Sun, 15 Jan 2023 14:22:43 +0100 Subject: [PATCH 394/411] Disable Roundcube password plugin since it was corrupting the user database (#2198) --- setup/webmail.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup/webmail.sh b/setup/webmail.sh index 791bda57..90e97aed 100755 --- a/setup/webmail.sh +++ b/setup/webmail.sh @@ -134,7 +134,7 @@ cat > $RCM_CONFIG < ~256 bits for AES-256, see above -\$config['plugins'] = array('html5_notifier', 'archive', 'zipdownload', 'password', 'managesieve', 'jqueryui', 'persistent_login', 'carddav'); +\$config['plugins'] = array('html5_notifier', 'archive', 'zipdownload', 'managesieve', 'jqueryui', 'persistent_login', 'carddav'); \$config['skin'] = 'elastic'; \$config['login_autocomplete'] = 2; \$config['login_username_filter'] = 'email'; From 57047d96e95c7c1f71da3b80f78d487f1c0acb61 Mon Sep 17 00:00:00 2001 From: Hugh Secker-Walker Date: Sun, 15 Jan 2023 08:25:36 -0500 Subject: [PATCH 395/411] chore(setup): Update obsolete chown group syntax (#2202) Co-authored-by: Hugh Secker-Walker --- setup/mail-dovecot.sh | 4 ++-- setup/munin.sh | 4 ++-- setup/nextcloud.sh | 6 +++--- setup/start.sh | 2 +- setup/webmail.sh | 10 +++++----- tools/owncloud-restore.sh | 4 ++-- 6 files changed, 15 insertions(+), 15 deletions(-) diff --git a/setup/mail-dovecot.sh b/setup/mail-dovecot.sh index a4bb563b..8d45a50b 100755 --- a/setup/mail-dovecot.sh +++ b/setup/mail-dovecot.sh @@ -202,13 +202,13 @@ chmod -R o-rwx /etc/dovecot # Ensure mailbox files have a directory that exists and are owned by the mail user. mkdir -p $STORAGE_ROOT/mail/mailboxes -chown -R mail.mail $STORAGE_ROOT/mail/mailboxes +chown -R mail:mail $STORAGE_ROOT/mail/mailboxes # Same for the sieve scripts. mkdir -p $STORAGE_ROOT/mail/sieve mkdir -p $STORAGE_ROOT/mail/sieve/global_before mkdir -p $STORAGE_ROOT/mail/sieve/global_after -chown -R mail.mail $STORAGE_ROOT/mail/sieve +chown -R mail:mail $STORAGE_ROOT/mail/sieve # Allow the IMAP/POP ports in the firewall. ufw_allow imaps diff --git a/setup/munin.sh b/setup/munin.sh index 6799cad6..90f93521 100755 --- a/setup/munin.sh +++ b/setup/munin.sh @@ -34,8 +34,8 @@ contact.admin.always_send warning critical EOF # The Debian installer touches these files and chowns them to www-data:adm for use with spawn-fcgi -chown munin. /var/log/munin/munin-cgi-html.log -chown munin. /var/log/munin/munin-cgi-graph.log +chown munin /var/log/munin/munin-cgi-html.log +chown munin /var/log/munin/munin-cgi-graph.log # ensure munin-node knows the name of this machine # and reduce logging level to warning diff --git a/setup/nextcloud.sh b/setup/nextcloud.sh index 13afc6b7..50d1130a 100755 --- a/setup/nextcloud.sh +++ b/setup/nextcloud.sh @@ -110,7 +110,7 @@ InstallNextcloud() { # Make sure permissions are correct or the upgrade step won't run. # $STORAGE_ROOT/owncloud may not yet exist, so use -f to suppress # that error. - chown -f -R www-data.www-data $STORAGE_ROOT/owncloud /usr/local/lib/owncloud || /bin/true + chown -f -R www-data:www-data $STORAGE_ROOT/owncloud /usr/local/lib/owncloud || /bin/true # If this isn't a new installation, immediately run the upgrade script. # Then check for success (0=ok and 3=no upgrade needed, both are success). @@ -259,7 +259,7 @@ EOF EOF # Set permissions - chown -R www-data.www-data $STORAGE_ROOT/owncloud /usr/local/lib/owncloud + chown -R www-data:www-data $STORAGE_ROOT/owncloud /usr/local/lib/owncloud # Execute Nextcloud's setup step, which creates the Nextcloud sqlite database. # It also wipes it if it exists. And it updates config.php with database @@ -311,7 +311,7 @@ var_export(\$CONFIG); echo ";"; ?> EOF -chown www-data.www-data $STORAGE_ROOT/owncloud/config.php +chown www-data:www-data $STORAGE_ROOT/owncloud/config.php # Enable/disable apps. Note that this must be done after the Nextcloud setup. # The firstrunwizard gave Josh all sorts of problems, so disabling that. diff --git a/setup/start.sh b/setup/start.sh index 0626ab01..960ec55d 100755 --- a/setup/start.sh +++ b/setup/start.sh @@ -85,7 +85,7 @@ f=$STORAGE_ROOT while [[ $f != / ]]; do chmod a+rx "$f"; f=$(dirname "$f"); done; if [ ! -f $STORAGE_ROOT/mailinabox.version ]; then setup/migrate.py --current > $STORAGE_ROOT/mailinabox.version - chown $STORAGE_USER.$STORAGE_USER $STORAGE_ROOT/mailinabox.version + chown $STORAGE_USER:$STORAGE_USER $STORAGE_ROOT/mailinabox.version fi # Save the global options in /etc/mailinabox.conf so that standalone diff --git a/setup/webmail.sh b/setup/webmail.sh index 90e97aed..274f7506 100755 --- a/setup/webmail.sh +++ b/setup/webmail.sh @@ -170,7 +170,7 @@ EOF # Create writable directories. mkdir -p /var/log/roundcubemail /var/tmp/roundcubemail $STORAGE_ROOT/mail/roundcube -chown -R www-data.www-data /var/log/roundcubemail /var/tmp/roundcubemail $STORAGE_ROOT/mail/roundcube +chown -R www-data:www-data /var/log/roundcubemail /var/tmp/roundcubemail $STORAGE_ROOT/mail/roundcube # Ensure the log file monitored by fail2ban exists, or else fail2ban can't start. sudo -u www-data touch /var/log/roundcubemail/errors.log @@ -194,14 +194,14 @@ usermod -a -G dovecot www-data # set permissions so that PHP can use users.sqlite # could use dovecot instead of www-data, but not sure it matters -chown root.www-data $STORAGE_ROOT/mail +chown root:www-data $STORAGE_ROOT/mail chmod 775 $STORAGE_ROOT/mail -chown root.www-data $STORAGE_ROOT/mail/users.sqlite +chown root:www-data $STORAGE_ROOT/mail/users.sqlite chmod 664 $STORAGE_ROOT/mail/users.sqlite # Fix Carddav permissions: -chown -f -R root.www-data ${RCM_PLUGIN_DIR}/carddav -# root.www-data need all permissions, others only read +chown -f -R root:www-data ${RCM_PLUGIN_DIR}/carddav +# root:www-data need all permissions, others only read chmod -R 774 ${RCM_PLUGIN_DIR}/carddav # Run Roundcube database migration script (database is created if it does not exist) diff --git a/tools/owncloud-restore.sh b/tools/owncloud-restore.sh index 108c8b77..cdeec4e9 100755 --- a/tools/owncloud-restore.sh +++ b/tools/owncloud-restore.sh @@ -40,8 +40,8 @@ cp "$1/owncloud.db" $STORAGE_ROOT/owncloud/ cp "$1/config.php" $STORAGE_ROOT/owncloud/ ln -sf $STORAGE_ROOT/owncloud/config.php /usr/local/lib/owncloud/config/config.php -chown -f -R www-data.www-data $STORAGE_ROOT/owncloud /usr/local/lib/owncloud -chown www-data.www-data $STORAGE_ROOT/owncloud/config.php +chown -f -R www-data:www-data $STORAGE_ROOT/owncloud /usr/local/lib/owncloud +chown www-data:www-data $STORAGE_ROOT/owncloud/config.php sudo -u www-data php$PHP_VER /usr/local/lib/owncloud/occ maintenance:mode --off From 820a39b8657215101c2fa658c8c7361ba97361f5 Mon Sep 17 00:00:00 2001 From: Hugh Secker-Walker Date: Sun, 15 Jan 2023 08:28:43 -0500 Subject: [PATCH 396/411] chore(python open): Refactor open and gzip.open to use context manager (#2203) Co-authored-by: Hugh Secker-Walker --- management/backup.py | 6 ++++-- management/cli.py | 3 ++- management/dns_update.py | 3 ++- management/mail_log.py | 3 ++- management/ssl_certificates.py | 3 ++- management/status_checks.py | 9 +++++--- management/utils.py | 7 ++++-- management/web_update.py | 24 ++++++++++++--------- tools/editconf.py | 3 ++- tools/parse-nginx-log-bootstrap-accesses.py | 10 +++------ tools/readable_bash.py | 18 +++++++++------- 11 files changed, 52 insertions(+), 37 deletions(-) diff --git a/management/backup.py b/management/backup.py index 8a82c4ad..ad0e267b 100755 --- a/management/backup.py +++ b/management/backup.py @@ -531,7 +531,8 @@ def get_backup_config(env, for_save=False, for_ui=False): # Merge in anything written to custom.yaml. try: - custom_config = rtyaml.load(open(os.path.join(backup_root, 'custom.yaml'))) + with open(os.path.join(backup_root, 'custom.yaml'), 'r') as f: + custom_config = rtyaml.load(f) if not isinstance(custom_config, dict): raise ValueError() # caught below config.update(custom_config) except: @@ -556,7 +557,8 @@ def get_backup_config(env, for_save=False, for_ui=False): config["target"] = "file://" + config["file_target_directory"] ssh_pub_key = os.path.join('/root', '.ssh', 'id_rsa_miab.pub') if os.path.exists(ssh_pub_key): - config["ssh_pub_key"] = open(ssh_pub_key, 'r').read() + with open(ssh_pub_key, 'r') as f: + config["ssh_pub_key"] = f.read() return config diff --git a/management/cli.py b/management/cli.py index 1b91b003..b32089c6 100755 --- a/management/cli.py +++ b/management/cli.py @@ -47,7 +47,8 @@ def read_password(): return first def setup_key_auth(mgmt_uri): - key = open('/var/lib/mailinabox/api.key').read().strip() + with open('/var/lib/mailinabox/api.key', 'r') as f: + key = f.read().strip() auth_handler = urllib.request.HTTPBasicAuthHandler() auth_handler.add_password( diff --git a/management/dns_update.py b/management/dns_update.py index 2fb2baf5..6eaff52f 100755 --- a/management/dns_update.py +++ b/management/dns_update.py @@ -815,7 +815,8 @@ def write_opendkim_tables(domains, env): def get_custom_dns_config(env, only_real_records=False): try: - custom_dns = rtyaml.load(open(os.path.join(env['STORAGE_ROOT'], 'dns/custom.yaml'))) + with open(os.path.join(env['STORAGE_ROOT'], 'dns/custom.yaml'), 'r') as f: + custom_dns = rtyaml.load(f) if not isinstance(custom_dns, dict): raise ValueError() # caught below except: return [ ] diff --git a/management/mail_log.py b/management/mail_log.py index bdf757cc..1a963966 100755 --- a/management/mail_log.py +++ b/management/mail_log.py @@ -73,7 +73,8 @@ def scan_files(collector): continue elif fn[-3:] == '.gz': tmp_file = tempfile.NamedTemporaryFile() - shutil.copyfileobj(gzip.open(fn), tmp_file) + with gzip.open(fn, 'rb') as f: + shutil.copyfileobj(f, tmp_file) if VERBOSE: print("Processing file", fn, "...") diff --git a/management/ssl_certificates.py b/management/ssl_certificates.py index ab4f2dc8..19f0266a 100755 --- a/management/ssl_certificates.py +++ b/management/ssl_certificates.py @@ -535,7 +535,8 @@ def check_certificate(domain, ssl_certificate, ssl_private_key, warn_if_expiring # Second, check that the certificate matches the private key. if ssl_private_key is not None: try: - priv_key = load_pem(open(ssl_private_key, 'rb').read()) + with open(ssl_private_key, 'rb') as f: + priv_key = load_pem(f.read()) except ValueError as e: return ("The private key file %s is not a private key file: %s" % (ssl_private_key, str(e)), None) diff --git a/management/status_checks.py b/management/status_checks.py index 4b3713ba..033834dd 100755 --- a/management/status_checks.py +++ b/management/status_checks.py @@ -207,7 +207,8 @@ def check_ssh_password(env, output): # the configuration file. if not os.path.exists("/etc/ssh/sshd_config"): return - sshd = open("/etc/ssh/sshd_config").read() + with open("/etc/ssh/sshd_config", "r") as f: + sshd = f.read() if re.search("\nPasswordAuthentication\s+yes", sshd) \ or not re.search("\nPasswordAuthentication\s+no", sshd): output.print_error("""The SSH server on this machine permits password-based login. A more secure @@ -594,7 +595,8 @@ def check_dnssec(domain, env, output, dns_zonefiles, is_checking_primary=False): # record that we suggest using is for the KSK (and that's how the DS records were generated). # We'll also give the nice name for the key algorithm. dnssec_keys = load_env_vars_from_file(os.path.join(env['STORAGE_ROOT'], 'dns/dnssec/%s.conf' % alg_name_map[ds_alg])) - dnsssec_pubkey = open(os.path.join(env['STORAGE_ROOT'], 'dns/dnssec/' + dnssec_keys['KSK'] + '.key')).read().split("\t")[3].split(" ")[3] + with open(os.path.join(env['STORAGE_ROOT'], 'dns/dnssec/' + dnssec_keys['KSK'] + '.key'), 'r') as f: + dnsssec_pubkey = f.read().split("\t")[3].split(" ")[3] expected_ds_records[ (ds_keytag, ds_alg, ds_digalg, ds_digest) ] = { "record": rr_ds, @@ -956,7 +958,8 @@ def run_and_output_changes(env, pool): # Load previously saved status checks. cache_fn = "/var/cache/mailinabox/status_checks.json" if os.path.exists(cache_fn): - prev = json.load(open(cache_fn)) + with open(cache_fn, 'r') as f: + prev = json.load(f) # Group the serial output into categories by the headings. def group_by_heading(lines): diff --git a/management/utils.py b/management/utils.py index fc04ed4d..b5ca7e59 100644 --- a/management/utils.py +++ b/management/utils.py @@ -14,7 +14,9 @@ def load_env_vars_from_file(fn): # Load settings from a KEY=VALUE file. import collections env = collections.OrderedDict() - for line in open(fn): env.setdefault(*line.strip().split("=", 1)) + with open(fn, 'r') as f: + for line in f: + env.setdefault(*line.strip().split("=", 1)) return env def save_environment(env): @@ -34,7 +36,8 @@ def load_settings(env): import rtyaml fn = os.path.join(env['STORAGE_ROOT'], 'settings.yaml') try: - config = rtyaml.load(open(fn, "r")) + with open(fn, "r") as f: + config = rtyaml.load(f) if not isinstance(config, dict): raise ValueError() # caught below return config except: diff --git a/management/web_update.py b/management/web_update.py index 7230182b..e23bb2d8 100644 --- a/management/web_update.py +++ b/management/web_update.py @@ -63,7 +63,8 @@ def get_web_domains_with_root_overrides(env): root_overrides = { } nginx_conf_custom_fn = os.path.join(env["STORAGE_ROOT"], "www/custom.yaml") if os.path.exists(nginx_conf_custom_fn): - custom_settings = rtyaml.load(open(nginx_conf_custom_fn)) + with open(nginx_conf_custom_fn, 'r') as f: + custom_settings = rtyaml.load(f) for domain, settings in custom_settings.items(): for type, value in [('redirect', settings.get('redirects', {}).get('/')), ('proxy', settings.get('proxies', {}).get('/'))]: @@ -75,13 +76,18 @@ def do_web_update(env): # Pre-load what SSL certificates we will use for each domain. ssl_certificates = get_ssl_certificates(env) + # Helper for reading config files and templates + def read_conf(conf_fn): + with open(os.path.join(os.path.dirname(__file__), "../conf", conf_fn), "r") as f: + return f.read() + # Build an nginx configuration file. - nginx_conf = open(os.path.join(os.path.dirname(__file__), "../conf/nginx-top.conf")).read() + nginx_conf = read_conf("nginx-top.conf") # Load the templates. - template0 = open(os.path.join(os.path.dirname(__file__), "../conf/nginx.conf")).read() - template1 = open(os.path.join(os.path.dirname(__file__), "../conf/nginx-alldomains.conf")).read() - template2 = open(os.path.join(os.path.dirname(__file__), "../conf/nginx-primaryonly.conf")).read() + template0 = read_conf("nginx.conf") + template1 = read_conf("nginx-alldomains.conf") + template2 = read_conf("nginx-primaryonly.conf") template3 = "\trewrite ^(.*) https://$REDIRECT_DOMAIN$1 permanent;\n" # Add the PRIMARY_HOST configuration first so it becomes nginx's default server. @@ -141,11 +147,8 @@ def make_domain_config(domain, templates, ssl_certificates, env): def hashfile(filepath): import hashlib sha1 = hashlib.sha1() - f = open(filepath, 'rb') - try: + with open(filepath, 'rb') as f: sha1.update(f.read()) - finally: - f.close() return sha1.hexdigest() nginx_conf_extra += "\t# ssl files sha1: %s / %s\n" % (hashfile(tls_cert["private-key"]), hashfile(tls_cert["certificate"])) @@ -153,7 +156,8 @@ def make_domain_config(domain, templates, ssl_certificates, env): hsts = "yes" nginx_conf_custom_fn = os.path.join(env["STORAGE_ROOT"], "www/custom.yaml") if os.path.exists(nginx_conf_custom_fn): - yaml = rtyaml.load(open(nginx_conf_custom_fn)) + with open(nginx_conf_custom_fn, 'r') as f: + yaml = rtyaml.load(f) if domain in yaml: yaml = yaml[domain] diff --git a/tools/editconf.py b/tools/editconf.py index dc184966..ec112b02 100755 --- a/tools/editconf.py +++ b/tools/editconf.py @@ -76,7 +76,8 @@ for setting in settings: found = set() buf = "" -input_lines = list(open(filename)) +with open(filename, "r") as f: + input_lines = list(f) while len(input_lines) > 0: line = input_lines.pop(0) diff --git a/tools/parse-nginx-log-bootstrap-accesses.py b/tools/parse-nginx-log-bootstrap-accesses.py index b08bc253..c61ed79e 100755 --- a/tools/parse-nginx-log-bootstrap-accesses.py +++ b/tools/parse-nginx-log-bootstrap-accesses.py @@ -17,13 +17,8 @@ accesses = set() # Scan the current and rotated access logs. for fn in glob.glob("/var/log/nginx/access.log*"): # Gunzip if necessary. - if fn.endswith(".gz"): - f = gzip.open(fn) - else: - f = open(fn, "rb") - # Loop through the lines in the access log. - with f: + with (gzip.open if fn.endswith(".gz") else open)(fn, "rb") as f: for line in f: # Find lines that are GETs on the bootstrap script by either curl or wget. # (Note that we purposely skip ...?ping=1 requests which is the admin panel querying us for updates.) @@ -43,7 +38,8 @@ for date, ip in accesses: # Since logs are rotated, store the statistics permanently in a JSON file. # Load in the stats from an existing file. if os.path.exists(outfn): - existing_data = json.load(open(outfn)) + with open(outfn, "r") as f: + existing_data = json.load(f) for date, count in existing_data: if date not in by_date: by_date[date] = count diff --git a/tools/readable_bash.py b/tools/readable_bash.py index 1fcdd5cd..3cb5908c 100644 --- a/tools/readable_bash.py +++ b/tools/readable_bash.py @@ -124,13 +124,14 @@ def generate_documentation(): """) parser = Source.parser() - for line in open("setup/start.sh"): - try: - fn = parser.parse_string(line).filename() - except: - continue - if fn in ("setup/start.sh", "setup/preflight.sh", "setup/questions.sh", "setup/firstuser.sh", "setup/management.sh"): - continue + with open("setup/start.sh", "r") as start_file: + for line in start_file: + try: + fn = parser.parse_string(line).filename() + except: + continue + if fn in ("setup/start.sh", "setup/preflight.sh", "setup/questions.sh", "setup/firstuser.sh", "setup/management.sh"): + continue import sys print(fn, file=sys.stderr) @@ -401,7 +402,8 @@ class BashScript(Grammar): @staticmethod def parse(fn): if fn in ("setup/functions.sh", "/etc/mailinabox.conf"): return "" - string = open(fn).read() + with open(fn, "r") as f: + string = f.read() # tokenize string = re.sub(".* #NODOC\n", "", string) From 02b34ce699d1fd7749a2f7c01b26058b436f7240 Mon Sep 17 00:00:00 2001 From: Hugh Secker-Walker Date: Sun, 15 Jan 2023 10:01:07 -0500 Subject: [PATCH 397/411] fix(backup-display): Fix parsing of rsync target in system-backup.html, fixes #2206 (#2207) --- management/templates/system-backup.html | 38 +++++++++++++++++++++---- 1 file changed, 32 insertions(+), 6 deletions(-) diff --git a/management/templates/system-backup.html b/management/templates/system-backup.html index 5450b6e5..0ecc87bd 100644 --- a/management/templates/system-backup.html +++ b/management/templates/system-backup.html @@ -259,12 +259,11 @@ function show_custom_backup() { } else if (r.target == "off") { $("#backup-target-type").val("off"); } else if (r.target.substring(0, 8) == "rsync://") { - $("#backup-target-type").val("rsync"); - var path = r.target.substring(8).split('//'); - var host_parts = path.shift().split('@'); - $("#backup-target-rsync-user").val(host_parts[0]); - $("#backup-target-rsync-host").val(host_parts[1]); - $("#backup-target-rsync-path").val('/'+path[0]); + const spec = url_split(r.target); + $("#backup-target-type").val(spec.scheme); + $("#backup-target-rsync-user").val(spec.user); + $("#backup-target-rsync-host").val(spec.host); + $("#backup-target-rsync-path").val(spec.path); } else if (r.target.substring(0, 5) == "s3://") { $("#backup-target-type").val("s3"); var hostpath = r.target.substring(5).split('/'); @@ -344,4 +343,31 @@ function init_inputs(target_type) { set_host($('#backup-target-s3-host-select').val()); } } + +// Return a two-element array of the substring preceding and the substring following +// the first occurence of separator in string. Return [undefined, string] if the +// separator does not appear in string. +const split1_rest = (string, separator) => { + const index = string.indexOf(separator); + return (index >= 0) ? [string.substring(0, index), string.substring(index + separator.length)] : [undefined, string]; +}; + +// Note: The manifest JS URL class does not work in some security-conscious +// settings, e.g. Brave browser, so we roll our own that handles only what we need. +// +// Use greedy separator parsing to get parts of a MIAB backup target url. +// Note: path will not include a leading forward slash '/' +const url_split = url => { + const [ scheme, scheme_rest ] = split1_rest(url, '://'); + const [ user, user_rest ] = split1_rest(scheme_rest, '@'); + const [ host, path ] = split1_rest(user_rest, '/'); + + return { + scheme, + user, + host, + path, + } +}; + From a2565227f24ba5d12db2e62455bef68b62cbdcb4 Mon Sep 17 00:00:00 2001 From: Hugh Secker-Walker Date: Sun, 15 Jan 2023 10:03:05 -0500 Subject: [PATCH 398/411] feat(rsync-port): Add support for non-standard ssh port for rsync backup (#2208) --- management/backup.py | 25 +++++++++++++++++++++---- management/templates/system-backup.html | 4 ++++ 2 files changed, 25 insertions(+), 4 deletions(-) diff --git a/management/backup.py b/management/backup.py index ad0e267b..3c4c38d7 100755 --- a/management/backup.py +++ b/management/backup.py @@ -213,9 +213,18 @@ def get_duplicity_additional_args(env): config = get_backup_config(env) if get_target_type(config) == 'rsync': + # Extract a port number for the ssh transport. Duplicity accepts the + # optional port number syntax in the target, but it doesn't appear to act + # on it, so we set the ssh port explicitly via the duplicity options. + from urllib.parse import urlsplit + try: + port = urlsplit(config["target"]).port + except ValueError: + port = 22 + return [ - "--ssh-options= -i /root/.ssh/id_rsa_miab", - "--rsync-options= -e \"/usr/bin/ssh -oStrictHostKeyChecking=no -oBatchMode=yes -p 22 -i /root/.ssh/id_rsa_miab\"", + f"--ssh-options= -i /root/.ssh/id_rsa_miab -p {port}", + f"--rsync-options= -e \"/usr/bin/ssh -oStrictHostKeyChecking=no -oBatchMode=yes -p {port} -i /root/.ssh/id_rsa_miab\"", ] elif get_target_type(config) == 's3': # See note about hostname in get_duplicity_target_url. @@ -408,6 +417,14 @@ def list_target_files(config): rsync_fn_size_re = re.compile(r'.* ([^ ]*) [^ ]* [^ ]* (.*)') rsync_target = '{host}:{path}' + # Strip off any trailing port specifier because it's not valid in rsync's + # DEST syntax. Explicitly set the port number for the ssh transport. + user_host, *_ = target.netloc.rsplit(':', 1) + try: + port = target.port + except ValueError: + port = 22 + target_path = target.path if not target_path.endswith('/'): target_path = target_path + '/' @@ -416,11 +433,11 @@ def list_target_files(config): rsync_command = [ 'rsync', '-e', - '/usr/bin/ssh -i /root/.ssh/id_rsa_miab -oStrictHostKeyChecking=no -oBatchMode=yes', + f'/usr/bin/ssh -i /root/.ssh/id_rsa_miab -oStrictHostKeyChecking=no -oBatchMode=yes -p {port}', '--list-only', '-r', rsync_target.format( - host=target.netloc, + host=user_host, path=target_path) ] diff --git a/management/templates/system-backup.html b/management/templates/system-backup.html index 0ecc87bd..ad534f41 100644 --- a/management/templates/system-backup.html +++ b/management/templates/system-backup.html @@ -45,6 +45,10 @@
+
+ The hostname at your rsync provider, e.g. da2327.rsync.net. Optionally includes a colon + and the provider's non-standard ssh port number, e.g. u215843.your-storagebox.de:23. +
From 7a79153afebca82a3abd35e3ca3185e57468b5e9 Mon Sep 17 00:00:00 2001 From: Steven Conaway Date: Sun, 15 Jan 2023 08:05:13 -0700 Subject: [PATCH 399/411] Remove old darkmode background color (#2218) Removing this old background color solves the problem of the bottom of short pages (like `/admin`'s login page) being white. The background was being set to black, which would be inverted, so it'd appear white. Since the `filter:` css has [~97% support](https://caniuse.com/?search=filter), I think that this change should be made. Tested on latest versions of Chrome (mac and iOS), Firefox, and Safari (mac and iOS). --- management/templates/index.html | 5 ----- 1 file changed, 5 deletions(-) diff --git a/management/templates/index.html b/management/templates/index.html index f9c87f2c..323789ca 100644 --- a/management/templates/index.html +++ b/management/templates/index.html @@ -72,11 +72,6 @@ html { filter: invert(100%) hue-rotate(180deg); } - - /* Set explicit background color (necessary for Firefox) */ - html { - background-color: #111; - } /* Override Boostrap theme here to give more contrast. The black turns to white by the filter. */ .form-control { From 20ec6c20800ef089d6f681a20b95dda6c1c61de6 Mon Sep 17 00:00:00 2001 From: jcm-shove-it Date: Sun, 15 Jan 2023 16:05:36 +0100 Subject: [PATCH 400/411] Updated security.md to reflect the support of ubuntu 22.04 (#2219) --- security.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security.md b/security.md index ac508c93..8782343e 100644 --- a/security.md +++ b/security.md @@ -1,7 +1,7 @@ Mail-in-a-Box Security Guide ============================ -Mail-in-a-Box turns a fresh Ubuntu 18.04 LTS 64-bit machine into a mail server appliance by installing and configuring various components. +Mail-in-a-Box turns a fresh Ubuntu 22.04 LTS 64-bit machine into a mail server appliance by installing and configuring various components. This page documents the security posture of Mail-in-a-Box. The term β€œbox” is used below to mean a configured Mail-in-a-Box. From 26709a3c1dba9cadbd88636b002d95c2f6bd2b14 Mon Sep 17 00:00:00 2001 From: Joshua Tauberer Date: Tue, 13 Dec 2022 08:03:39 -0500 Subject: [PATCH 401/411] Improve error messages in the management tools when external command-line tools are run --- management/utils.py | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/management/utils.py b/management/utils.py index b5ca7e59..f452c16d 100644 --- a/management/utils.py +++ b/management/utils.py @@ -122,13 +122,16 @@ def shell(method, cmd_args, env={}, capture_stderr=False, return_bytes=False, tr if method == "check_output" and input is not None: kwargs['input'] = input - if not trap: + try: ret = getattr(subprocess, method)(cmd_args, **kwargs) - else: - try: - ret = getattr(subprocess, method)(cmd_args, **kwargs) - code = 0 - except subprocess.CalledProcessError as e: + code = 0 + except subprocess.CalledProcessError as e: + if not trap: + # Reformat exception. + msg = "Command failed with exit code {}: {}".format(e.returncode, subprocess.list2cmdline(cmd_args)) + if e.output: msg += "\n\nOutput:\n" + e.output + raise Exception(msg) + else: ret = e.output code = e.returncode if not return_bytes and isinstance(ret, bytes): ret = ret.decode("utf8") From b3743a31e9309920e40e3780fdfb33a3657400f0 Mon Sep 17 00:00:00 2001 From: Joshua Tauberer Date: Sun, 15 Jan 2023 08:15:31 -0500 Subject: [PATCH 402/411] Add a status checks check that fail2ban is running using fail2ban-client --- management/status_checks.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/management/status_checks.py b/management/status_checks.py index 033834dd..b31a9818 100755 --- a/management/status_checks.py +++ b/management/status_checks.py @@ -95,6 +95,12 @@ def run_services_checks(env, output, pool): fatal = fatal or fatal2 output2.playback(output) + # Check fail2ban. + code, ret = shell('check_output', ["fail2ban-client", "status"], capture_stderr=True, trap=True) + if code != 0: + output.print_error("fail2ban is not running.") + all_running = False + if all_running: output.print_ok("All system services are running.") From 61d1ea1ea7eba12b2b621895556ed5226c820735 Mon Sep 17 00:00:00 2001 From: Joshua Tauberer Date: Sun, 15 Jan 2023 10:16:56 -0500 Subject: [PATCH 403/411] Changelog entries --- CHANGELOG.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index c4033df1..9f4ae42d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,27 @@ CHANGELOG ========= +In Development +-------------- + +System: + +* fail2ban didn't start after setup. + +Mail: + +* Disable Roundcube password plugin since it was corrupting the user database. + +Control panel: + +* Fix changing existing backup settings when the rsync type is used. +* Allow setting a custom port for rsync backups. +* Fixes to DNS lookups during status checks when there are timeouts, enforce timeouts better. +* A new check is added to ensure fail2ban is running. +* Fixed a color. +* Disable Roundcube password plugin since it was corrupting the user database +* Improve error messages in the management tools when external command-line tools are run. + Version 60.1 (October 30, 2022) ------------------------------- From 5e3e4a2161157237b24a5856f7282bcece2ccff4 Mon Sep 17 00:00:00 2001 From: Joshua Tauberer Date: Sat, 21 Jan 2023 08:19:57 -0500 Subject: [PATCH 404/411] v61 --- CHANGELOG.md | 5 ++--- README.md | 2 +- setup/bootstrap.sh | 2 +- 3 files changed, 4 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9f4ae42d..11d86ce6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,8 +1,8 @@ CHANGELOG ========= -In Development --------------- +Version 61 (January 21, 2023) +----------------------------- System: @@ -19,7 +19,6 @@ Control panel: * Fixes to DNS lookups during status checks when there are timeouts, enforce timeouts better. * A new check is added to ensure fail2ban is running. * Fixed a color. -* Disable Roundcube password plugin since it was corrupting the user database * Improve error messages in the management tools when external command-line tools are run. Version 60.1 (October 30, 2022) diff --git a/README.md b/README.md index 42792025..1f423011 100644 --- a/README.md +++ b/README.md @@ -60,7 +60,7 @@ Clone this repository and checkout the tag corresponding to the most recent rele $ git clone https://github.com/mail-in-a-box/mailinabox $ cd mailinabox - $ git checkout v60.1 + $ git checkout v61 Begin the installation. diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh index 1c6d475a..4414d7bb 100644 --- a/setup/bootstrap.sh +++ b/setup/bootstrap.sh @@ -23,7 +23,7 @@ if [ -z "$TAG" ]; then if [ "$UBUNTU_VERSION" == "Ubuntu 22.04 LTS" ]; then # This machine is running Ubuntu 22.04, which is supported by # Mail-in-a-Box versions 60 and later. - TAG=v60.1 + TAG=v61 elif [ "$UBUNTU_VERSION" == "Ubuntu 18.04 LTS" ]; then # This machine is running Ubuntu 18.04, which is supported by # Mail-in-a-Box versions 0.40 through 5x. From 4408cb1fba463aa3fdaba518a74468430dd06895 Mon Sep 17 00:00:00 2001 From: Hugh Secker-Walker Date: Sat, 28 Jan 2023 11:04:46 -0500 Subject: [PATCH 405/411] fix(rsync-backup): Provide default port 22 for rsync usage in backup.py (#2226) Co-authored-by: Hugh Secker-Walker --- management/backup.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/management/backup.py b/management/backup.py index 3c4c38d7..99c3d60e 100755 --- a/management/backup.py +++ b/management/backup.py @@ -221,7 +221,9 @@ def get_duplicity_additional_args(env): port = urlsplit(config["target"]).port except ValueError: port = 22 - + if port is None: + port = 22 + return [ f"--ssh-options= -i /root/.ssh/id_rsa_miab -p {port}", f"--rsync-options= -e \"/usr/bin/ssh -oStrictHostKeyChecking=no -oBatchMode=yes -p {port} -i /root/.ssh/id_rsa_miab\"", @@ -424,6 +426,8 @@ def list_target_files(config): port = target.port except ValueError: port = 22 + if port is None: + port = 22 target_path = target.path if not target_path.endswith('/'): From 7af713592a67a712580d11ae5f76d40ce8927b89 Mon Sep 17 00:00:00 2001 From: Hugh Secker-Walker Date: Sat, 28 Jan 2023 11:11:17 -0500 Subject: [PATCH 406/411] feat(status page): Add summary of ok/error/warning counts (#2204) * feat(status page): Add summary of ok/error/warning counts * simplify a bit --------- Co-authored-by: Hugh Secker-Walker Co-authored-by: Joshua Tauberer --- management/templates/system-status.html | 38 ++++++++++++++++++++----- 1 file changed, 31 insertions(+), 7 deletions(-) diff --git a/management/templates/system-status.html b/management/templates/system-status.html index dc9233a5..12c8aa0b 100644 --- a/management/templates/system-status.html +++ b/management/templates/system-status.html @@ -10,13 +10,13 @@ border-top: none; padding-top: 0; } -#system-checks .status-error td { +#system-checks .status-error td, .summary-error { color: #733; } -#system-checks .status-warning td { +#system-checks .status-warning td, .summary-warning { color: #770; } -#system-checks .status-ok td { +#system-checks .status-ok td, .summary-ok { color: #040; } #system-checks div.extra { @@ -52,6 +52,9 @@
+
+
+ @@ -64,6 +67,9 @@