From 6d6f3ea3919d81abfd1a6eddd8787c98b761e1bb Mon Sep 17 00:00:00 2001
From: mike <mike@cyberstalk.me>
Date: Wed, 13 Jan 2016 22:20:33 -0500
Subject: [PATCH 001/165] Added ability to use munin's dynazoom

---
 management/daemon.py | 79 ++++++++++++++++++++++++++++++++++++++++++--
 setup/munin.sh       |  3 ++
 2 files changed, 80 insertions(+), 2 deletions(-)

diff --git a/management/daemon.py b/management/daemon.py
index 1099a596..bc19e2ec 100755
--- a/management/daemon.py
+++ b/management/daemon.py
@@ -1,10 +1,10 @@
 #!/usr/bin/python3
 
 import os, os.path, re, json
-
+import subprocess
 from functools import wraps
 
-from flask import Flask, request, render_template, abort, Response, send_from_directory
+from flask import Flask, request, render_template, abort, Response, send_from_directory, make_response
 
 import auth, utils
 from mailconfig import get_mail_users, get_mail_users_ex, get_admins, add_mail_user, set_mail_password, remove_mail_user
@@ -507,6 +507,81 @@ def munin(filename=""):
 	if filename == "": filename = "index.html"
 	return send_from_directory("/var/cache/munin/www", filename)
 
+# MUNIN CGI-GRAPH
+
+@app.route('/munin/cgi-graph/')
+@app.route('/munin/cgi-graph/<path:filename>')
+@authorized_personnel_only
+def munin_cgi(filename=""):
+	""" Relay munin cgi dynazoom requests
+
+	/usr/lib/munin/cgi/munin-cgi-graph is a perl cgi script in the munin package
+	that is responsible for generating binary png images _and_ associated HTTP
+	headers based on parameters in the requesting URL. All output is written
+	to stdout which munin_cgi splits into response headers and binary response
+	data.
+
+	munin-cgi-graph reads environment variables as well as passed input to determin
+	what it should do. It expects a path to be in the env-var PATH_INFO, and a
+	querystring to be in the env-var QUERY_STRING as well as passed as input to the
+	command.
+
+	munin-cgi-graph has several failure modes. Some write HTTP 404 Status headers
+	and others return nonzero exit codes. munin_cgi has some basic handling, and
+	logs errors to app.logger.
+
+	= Reasoning =
+	Situating munin_cgi between the user-agent and munin-cgi-graph enables keeping
+	the cgi script behind mailinabox's auth mechanisms and avoids additional
+	support infrastructure like spawn-fcgi.
+
+	= Configuration =
+	A single configuration change is all that is required to enable the
+	functionality of munin_cgi. In the munin.conf file (/etc/munin/munin.conf) add
+	the following line above your server listings:
+	`cgiurl_graph /admin/munin/cgi-graph`
+	This will tell munin to override the default path for dynazoom requests.
+	"""
+
+	COMMAND = 'su - munin --preserve-environment --shell=/bin/bash -c "/usr/lib/munin/cgi/munin-cgi-graph \'%s\'"'
+	# su changes user, we use the munin user here
+	# --preserve-environment retains the environment, which is where Popen's `env` data is
+	# --shell=/bin/bash ensures the shell used is bash
+	# -c "/usr/lib/munin/cgi/munin-cgi-graph" passes the command to run as munin
+	# \'%s\' is a placeholder for where the request's querystring will be added
+
+	if filename == "":
+		return ("a path must be specified", 404)
+
+	query_str = request.query_string.decode("utf-8", 'ignore')
+
+	env = {'PATH_INFO': '/%s/' % filename, 'QUERY_STRING': query_str}
+	cmd = COMMAND % (query_str if not query_str.startswith('&') else query_str[1:])
+	process = subprocess.Popen(cmd, env=env, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, close_fds=True)
+	stdout, stderr = process.communicate()
+
+	if process.returncode != 0:
+		# nonzero returncode indicates error
+		app.logger.error("munin_cgi: munin-cgi-graph returned nonzero exit code, %s", process.returncode)
+		return ("error processing graph image", 500)
+
+	# /usr/lib/munin/cgi/munin-cgi-graph returns both headers and binary png when successful.
+	# Per http://www.libpng.org/pub/png/spec/1.2/PNG-Structure.html PNG files always start
+	# with the same 8 bytes (137 80 78 71 13 10 26 10) or b'\x89PNG\r\n\x1a\n' So we split
+	# the output of munin-cgi-graph where the PNG begins
+	bin_start = stdout.find(b'\x89PNG\r\n\x1a\n')
+	str_headers = stdout[:bin_start].decode("utf-8")
+	# decode the byte str containing response headers
+	bin_image = stdout[bin_start:]
+	response = make_response(bin_image)
+	for line in str_headers.splitlines():
+		if line:
+			name, value = line.split(':',1)
+			response.headers[name] = value
+	if 'Status' in response.headers and '404' in response.headers['Status']:
+		app.logger.warning("munin_cgi: munin-cgi-graph returned 404 status code. PATH_INFO=%s", env['PATH_INFO'])
+	return response
+
 # APP
 
 if __name__ == '__main__':
diff --git a/setup/munin.sh b/setup/munin.sh
index 0cee9bad..0f2dec04 100755
--- a/setup/munin.sh
+++ b/setup/munin.sh
@@ -19,6 +19,9 @@ tmpldir /etc/munin/templates
 
 includedir /etc/munin/munin-conf.d
 
+# path dynazoom uses for requests
+cgiurl_graph /admin/munin/cgi-graph
+
 # a simple host tree
 [$PRIMARY_HOSTNAME]
 address 127.0.0.1

From 8932aaf4ef3d24b7009419c89cbf7919627680ee Mon Sep 17 00:00:00 2001
From: mike <mike@cyberstalk.me>
Date: Wed, 13 Jan 2016 23:55:45 -0500
Subject: [PATCH 002/165] needed libcgi-fast-perl and chown log files

---
 management/daemon.py | 19 +++----------------
 setup/munin.sh       |  7 ++++++-
 2 files changed, 9 insertions(+), 17 deletions(-)

diff --git a/management/daemon.py b/management/daemon.py
index bc19e2ec..bd917692 100755
--- a/management/daemon.py
+++ b/management/daemon.py
@@ -514,33 +514,20 @@ def munin(filename=""):
 @authorized_personnel_only
 def munin_cgi(filename=""):
 	""" Relay munin cgi dynazoom requests
-
 	/usr/lib/munin/cgi/munin-cgi-graph is a perl cgi script in the munin package
 	that is responsible for generating binary png images _and_ associated HTTP
 	headers based on parameters in the requesting URL. All output is written
 	to stdout which munin_cgi splits into response headers and binary response
 	data.
-
-	munin-cgi-graph reads environment variables as well as passed input to determin
+	munin-cgi-graph reads environment variables as well as passed input to determine
 	what it should do. It expects a path to be in the env-var PATH_INFO, and a
 	querystring to be in the env-var QUERY_STRING as well as passed as input to the
 	command.
-
-	munin-cgi-graph has several failure modes. Some write HTTP 404 Status headers
-	and others return nonzero exit codes. munin_cgi has some basic handling, and
-	logs errors to app.logger.
-
-	= Reasoning =
+	munin-cgi-graph has several failure modes. Some write HTTP Status headers and
+	others return nonzero exit codes.
 	Situating munin_cgi between the user-agent and munin-cgi-graph enables keeping
 	the cgi script behind mailinabox's auth mechanisms and avoids additional
 	support infrastructure like spawn-fcgi.
-
-	= Configuration =
-	A single configuration change is all that is required to enable the
-	functionality of munin_cgi. In the munin.conf file (/etc/munin/munin.conf) add
-	the following line above your server listings:
-	`cgiurl_graph /admin/munin/cgi-graph`
-	This will tell munin to override the default path for dynazoom requests.
 	"""
 
 	COMMAND = 'su - munin --preserve-environment --shell=/bin/bash -c "/usr/lib/munin/cgi/munin-cgi-graph \'%s\'"'
diff --git a/setup/munin.sh b/setup/munin.sh
index 0f2dec04..b1c5c8ba 100755
--- a/setup/munin.sh
+++ b/setup/munin.sh
@@ -7,7 +7,8 @@ source /etc/mailinabox.conf # load global vars
 
 # install Munin
 echo "Installing Munin (system monitoring)..."
-apt_install munin munin-node
+apt_install munin munin-node libcgi-fast-perl
+# libcgi-fast-perl is needed by /usr/lib/munin/cgi/munin-cgi-graph
 
 # edit config
 cat > /etc/munin/munin.conf <<EOF;
@@ -32,6 +33,10 @@ contact.admin.command mail -s "Munin notification ${var:host}" administrator@$PR
 contact.admin.always_send warning critical
 EOF
 
+# The Debian installer touches these files and chowns them to www-data:adm for use with spawn-fcgi
+chown munin. /var/log/munin/munin-cgi-html.log
+chown munin. /var/log/munin/munin-cgi-graph.log
+
 # ensure munin-node knows the name of this machine
 tools/editconf.py /etc/munin/munin-node.conf -s \
 	host_name=$PRIMARY_HOSTNAME

From 6b408ef82438d2f2c8194b2c0fb772b9e67ba3c6 Mon Sep 17 00:00:00 2001
From: mike <mike@cyberstalk.me>
Date: Thu, 14 Jan 2016 10:24:04 -0500
Subject: [PATCH 003/165] Use utils.shell instead of subprocess.Popen

---
 management/daemon.py | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/management/daemon.py b/management/daemon.py
index bd917692..fd2d6b4d 100755
--- a/management/daemon.py
+++ b/management/daemon.py
@@ -530,24 +530,31 @@ def munin_cgi(filename=""):
 	support infrastructure like spawn-fcgi.
 	"""
 
-	COMMAND = 'su - munin --preserve-environment --shell=/bin/bash -c "/usr/lib/munin/cgi/munin-cgi-graph \'%s\'"'
+	COMMAND = 'su - munin --preserve-environment --shell=/bin/bash -c /usr/lib/munin/cgi/munin-cgi-graph "%s"'
 	# su changes user, we use the munin user here
 	# --preserve-environment retains the environment, which is where Popen's `env` data is
 	# --shell=/bin/bash ensures the shell used is bash
 	# -c "/usr/lib/munin/cgi/munin-cgi-graph" passes the command to run as munin
-	# \'%s\' is a placeholder for where the request's querystring will be added
+	# "%s" is a placeholder for where the request's querystring will be added
 
 	if filename == "":
 		return ("a path must be specified", 404)
 
 	query_str = request.query_string.decode("utf-8", 'ignore')
+	query_str = query_str[1:] if query_str.startswith('&') else query_str[1:]
+	# I don't know if this is strictly necessary
 
 	env = {'PATH_INFO': '/%s/' % filename, 'QUERY_STRING': query_str}
-	cmd = COMMAND % (query_str if not query_str.startswith('&') else query_str[1:])
-	process = subprocess.Popen(cmd, env=env, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, close_fds=True)
-	stdout, stderr = process.communicate()
+	cmd = COMMAND % query_str
+	code, binout = utils.shell('check_output',
+							   cmd.split(' ', 5),
+							   # Using a maxsplit of 5 keeps the last 2 arguments together
+							   input=query_str.encode('UTF-8'),
+							   env=env,
+							   return_bytes=True,
+							   trap=True)
 
-	if process.returncode != 0:
+	if code != 0:
 		# nonzero returncode indicates error
 		app.logger.error("munin_cgi: munin-cgi-graph returned nonzero exit code, %s", process.returncode)
 		return ("error processing graph image", 500)
@@ -556,10 +563,10 @@ def munin_cgi(filename=""):
 	# Per http://www.libpng.org/pub/png/spec/1.2/PNG-Structure.html PNG files always start
 	# with the same 8 bytes (137 80 78 71 13 10 26 10) or b'\x89PNG\r\n\x1a\n' So we split
 	# the output of munin-cgi-graph where the PNG begins
-	bin_start = stdout.find(b'\x89PNG\r\n\x1a\n')
-	str_headers = stdout[:bin_start].decode("utf-8")
+	bin_start = binout.find(b'\x89PNG\r\n\x1a\n')
+	str_headers = binout[:bin_start].decode("utf-8")
 	# decode the byte str containing response headers
-	bin_image = stdout[bin_start:]
+	bin_image = binout[bin_start:]
 	response = make_response(bin_image)
 	for line in str_headers.splitlines():
 		if line:

From 8ea2f5a766223fc2b12c7dfc394f578b3d88253e Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Thu, 25 Feb 2016 21:56:27 +0100
Subject: [PATCH 004/165] Allow a server to be rebooted when a reboot is
 required

---
 management/daemon.py                    | 18 ++++++++++++-
 management/templates/system-status.html | 34 +++++++++++++++++++++++--
 2 files changed, 49 insertions(+), 3 deletions(-)

diff --git a/management/daemon.py b/management/daemon.py
index 6de0a59a..823bce5e 100755
--- a/management/daemon.py
+++ b/management/daemon.py
@@ -391,7 +391,6 @@ def ssl_provision_certs():
 def web_get_domains():
 	from web_update import get_web_domains_info
 	return json_response(get_web_domains_info(env))
-
 @app.route('/web/update', methods=['POST'])
 @authorized_personnel_only
 def web_update():
@@ -456,6 +455,23 @@ def do_updates():
 		"DEBIAN_FRONTEND": "noninteractive"
 	})
 
+@app.route('/system/reboot', methods=["GET"])
+@authorized_personnel_only
+def needs_reboot():
+	if os.path.isfile("/var/run/reboot-required"):
+		return json_response(True)
+	else:
+		return json_response(False)
+
+@app.route('/system/reboot', methods=["POST"])
+@authorized_personnel_only
+def do_reboot():
+	if os.path.isfile("/var/run/reboot-required"):
+		return utils.shell("check_output", ["/sbin/shutdown", "-r", "now"], capture_stderr=True)
+	else:
+		return "No reboot is required"
+
+
 @app.route('/system/backup/status')
 @authorized_personnel_only
 def backup_status():
diff --git a/management/templates/system-status.html b/management/templates/system-status.html
index 9fe9d08e..efc8ad90 100644
--- a/management/templates/system-status.html
+++ b/management/templates/system-status.html
@@ -1,5 +1,9 @@
 <h2>System Status Checks</h2>
 
+<div id="system-reboot-required" style="display: none">
+  <button type="button" class="btn btn-danger" onclick="confirm_reboot(); return false;">Reboot required</button>
+</div>
+
 <style>
 #system-checks .heading td {
   font-weight: bold;
@@ -34,7 +38,10 @@
   font-family: monospace;
   white-space: pre-wrap;
 }
-
+#system-reboot-required {
+  max-width: 20em;
+  margin-bottom: 1em;
+}
 #system-privacy-setting {
   float: right;
   max-width: 20em;
@@ -47,7 +54,6 @@
 	<p style="line-height: 125%"><small>(When enabled, status checks phone-home to check for a new release of Mail-in-a-Box.)</small></p>
 </div>
 
-
 <table id="system-checks" class="table" style="max-width: 60em">
   <thead>
   </thead>
@@ -70,6 +76,14 @@ function show_system_status() {
       $('#system-privacy-setting p').toggle(r);
     });
 
+  api(
+    "/system/reboot",
+    "GET",
+    { },
+    function(r) {
+      $('#system-reboot-required').toggle(r);
+    });
+
   api(
     "/system/status",
     "POST",
@@ -122,4 +136,20 @@ function enable_privacy(status) {
     });
   return false; // disable link
 }
+
+function confirm_reboot() {
+  show_modal_confirm(
+    "Reboot server",
+    $("<p>This will reboot your server, until the server is fully restarted your users will not be able to send and receive email. The reboot can't be cancelled</p>"),
+    "Reboot now",
+    function() {
+      api(
+        "/system/reboot",
+        "POST",
+        { },
+        function(r) {
+          show_modal_error("Reboot", "Please refresh the page after a minute or so." + r);
+        });
+    });
+}
 </script>

From b71ad85e9fd2e51ceb7dafbea872e0c846eff2dc Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Fri, 26 Feb 2016 09:51:22 +0100
Subject: [PATCH 005/165] Restore an empty line

---
 management/daemon.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/management/daemon.py b/management/daemon.py
index 823bce5e..b416b3ee 100755
--- a/management/daemon.py
+++ b/management/daemon.py
@@ -391,6 +391,7 @@ def ssl_provision_certs():
 def web_get_domains():
 	from web_update import get_web_domains_info
 	return json_response(get_web_domains_info(env))
+
 @app.route('/web/update', methods=['POST'])
 @authorized_personnel_only
 def web_update():

From 6a48cdcdf351832762aa92ed634e114d3a2453e9 Mon Sep 17 00:00:00 2001
From: c0h1b4 <dwidman@gmail.com>
Date: Tue, 1 Mar 2016 10:40:39 -0300
Subject: [PATCH 006/165] Fix for putty Line Drawing issues

Fix for putty (Windows) Line Drawing characters to be shown correctly.
---
 setup/start.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/setup/start.sh b/setup/start.sh
index 3a93ac22..3bd01898 100755
--- a/setup/start.sh
+++ b/setup/start.sh
@@ -24,6 +24,8 @@ export LC_ALL=en_US.UTF-8
 export LANG=en_US.UTF-8
 export LC_TYPE=en_US.UTF-8
 
+# Fix for putty Line Drawing characters to be shown correctly
+export NCURSES_NO_UTF8_ACS=1
 # Recall the last settings used if we're running this a second time.
 if [ -f /etc/mailinabox.conf ]; then
 	# Run any system migrations before proceeding. Since this is a second run,

From 49ea9cddd13df466e2cdc6240681213f57c02e92 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sun, 6 Mar 2016 14:39:34 -0500
Subject: [PATCH 007/165] ssl_certificates: also forgot to catch
 free_tls_certificates.client.RateLimited

---
 management/ssl_certificates.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/management/ssl_certificates.py b/management/ssl_certificates.py
index 28cc3f72..c49443b9 100755
--- a/management/ssl_certificates.py
+++ b/management/ssl_certificates.py
@@ -365,7 +365,7 @@ def provision_certificates(env, agree_to_tos_url=None, logger=None, show_extende
 				"message": "Something unexpected went wrong. It looks like your local Let's Encrypt account data is corrupted. There was a problem with the file " + e.account_file_path + ".",
 			})
 
-		except (client.InvalidDomainName, client.NeedToTakeAction, client.ChallengeFailed, acme.messages.Error, requests.exceptions.RequestException) as e:
+		except (client.InvalidDomainName, client.NeedToTakeAction, client.ChallengeFailed, client.RateLimited, acme.messages.Error, requests.exceptions.RequestException) as e:
 			ret_item.update({
 				"result": "error",
 				"message": "Something unexpected went wrong: " + str(e),

From 0bc5d20e8f952918f711eda29fd3744aae721113 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Fri, 11 Mar 2016 15:10:31 +0100
Subject: [PATCH 008/165] Add check for user overrides to wgetrc

---
 setup/preflight.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/setup/preflight.sh b/setup/preflight.sh
index e854249e..c83af345 100644
--- a/setup/preflight.sh
+++ b/setup/preflight.sh
@@ -40,3 +40,9 @@ if [ -n "$MOUNTED_TMP_AS_NO_EXEC" ]; then
 	echo "Mail-in-a-Box has to have exec rights on /tmp, please mount /tmp with exec"
 	exit
 fi
+
+# Check that no .wgetrc exists
+if [ -e ~/.wgetrc ]; then
+	echo "Mail-in-a-Box expects no default overrides to wget"
+	exit
+fi

From 33a9fb6aa2a466a3f169617e72a169d32fdc6362 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Fri, 11 Mar 2016 15:14:37 +0100
Subject: [PATCH 009/165] Add a better message

---
 setup/preflight.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup/preflight.sh b/setup/preflight.sh
index c83af345..e395ddee 100644
--- a/setup/preflight.sh
+++ b/setup/preflight.sh
@@ -43,6 +43,6 @@ fi
 
 # Check that no .wgetrc exists
 if [ -e ~/.wgetrc ]; then
-	echo "Mail-in-a-Box expects no default overrides to wget"
+	echo "Mail-in-a-Box expects no overrides to wget defaults, ~/.wgetrc exists"
 	exit
 fi

From e343061cf4b15847f8ce308837e2a9bf4b71cd69 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Sun, 13 Mar 2016 18:23:10 +0100
Subject: [PATCH 010/165] Prevent clickjacking of management interface

---
 conf/nginx-primaryonly.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/conf/nginx-primaryonly.conf b/conf/nginx-primaryonly.conf
index 2fb9972e..9f040c0d 100644
--- a/conf/nginx-primaryonly.conf
+++ b/conf/nginx-primaryonly.conf
@@ -6,6 +6,7 @@
 	location /admin/ {
 		proxy_pass http://127.0.0.1:10222/;
 		proxy_set_header X-Forwarded-For $remote_addr;
+		add_header X-Frame-Options "SAMEORIGIN";
 	}
 
 	# ownCloud configuration.

From 44705a32b7368a4accdaf4a2ed6c707c69ccd430 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Sun, 13 Mar 2016 18:40:02 +0100
Subject: [PATCH 011/165] Never allow admin panel to be inside a frame, use
 both modern and old headers. Also set no content sniffing

---
 conf/nginx-primaryonly.conf | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/conf/nginx-primaryonly.conf b/conf/nginx-primaryonly.conf
index 9f040c0d..8fd546af 100644
--- a/conf/nginx-primaryonly.conf
+++ b/conf/nginx-primaryonly.conf
@@ -6,7 +6,9 @@
 	location /admin/ {
 		proxy_pass http://127.0.0.1:10222/;
 		proxy_set_header X-Forwarded-For $remote_addr;
-		add_header X-Frame-Options "SAMEORIGIN";
+		add_header X-Frame-Options "DENY";
+		add_header X-Content-Type-Options nosniff;
+		add_header Content-Security-Policy "frame-ancestors 'none';";
 	}
 
 	# ownCloud configuration.

From f69d6e90153e8bb56a932b1675d0e4321df32b4c Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Mon, 14 Mar 2016 07:00:33 +0100
Subject: [PATCH 012/165] Add a preflight check for supported architecture

---
 setup/preflight.sh | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/setup/preflight.sh b/setup/preflight.sh
index e395ddee..ae8512cb 100644
--- a/setup/preflight.sh
+++ b/setup/preflight.sh
@@ -46,3 +46,17 @@ if [ -e ~/.wgetrc ]; then
 	echo "Mail-in-a-Box expects no overrides to wget defaults, ~/.wgetrc exists"
 	exit
 fi
+
+# Check that we are running on x86_64, any other architecture is unsupported and
+# will fail later in the setup when we try to install the custom build lucene packages.
+#
+# Set ARM=1 to ignore this check if you have built the packages yourself. If you do this
+# you are on your own!
+ARCHITECTURE=$(uname -m)
+if [ "$ARCHITECTURE" != "x86_64" ]; then
+if [ -z "$ARM" ]; then
+	echo "Mail-in-a-Box only supports x86_64 and will not work on any architecture like ARM."
+	echo "Your architecture is $ARCHITECTURE"
+	exit
+fi
+fi

From 35a593af13726cb84e79e7320b0286dd51b2ce2a Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Mon, 14 Mar 2016 07:14:09 +0100
Subject: [PATCH 013/165] Improve preflight message

---
 setup/preflight.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup/preflight.sh b/setup/preflight.sh
index ae8512cb..c3351471 100644
--- a/setup/preflight.sh
+++ b/setup/preflight.sh
@@ -55,7 +55,7 @@ fi
 ARCHITECTURE=$(uname -m)
 if [ "$ARCHITECTURE" != "x86_64" ]; then
 if [ -z "$ARM" ]; then
-	echo "Mail-in-a-Box only supports x86_64 and will not work on any architecture like ARM."
+	echo "Mail-in-a-Box only supports x86_64 and will not work on any other architecture, like ARM."
 	echo "Your architecture is $ARCHITECTURE"
 	exit
 fi

From 84f4509b48a2482c56ce30bfd2bb1916b1734dd3 Mon Sep 17 00:00:00 2001
From: yodax <michael@kroes.email>
Date: Sun, 20 Mar 2016 05:55:58 +0100
Subject: [PATCH 014/165] Configure bayes_file_mode in spamassassin/local.cf

---
 setup/spamassassin.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/setup/spamassassin.sh b/setup/spamassassin.sh
index 27576766..ca264c0d 100755
--- a/setup/spamassassin.sh
+++ b/setup/spamassassin.sh
@@ -78,9 +78,13 @@ tools/editconf.py /etc/spamassassin/local.cf -s \
 # * Writable by the debian-spamd user, which runs /etc/cron.daily/spamassassin.
 #
 # We'll have these files owned by spampd and grant access to the other two processes.
+#
+# Spamassassin will change the access rights back to the defaults, so we must also configure
+# the filemode in the config file.
 
 tools/editconf.py /etc/spamassassin/local.cf -s \
-	bayes_path=$STORAGE_ROOT/mail/spamassassin/bayes
+	bayes_path=$STORAGE_ROOT/mail/spamassassin/bayes \
+	bayes_file_mode=0660
 
 mkdir -p $STORAGE_ROOT/mail/spamassassin
 chown -R spampd:spampd $STORAGE_ROOT/mail/spamassassin

From 84638ab11e7e793b01bf1452c67a5dffe7daf6ea Mon Sep 17 00:00:00 2001
From: "Robert G. Jakabosky" <bobby@sharedrealm.com>
Date: Sun, 20 Mar 2016 08:19:59 +0800
Subject: [PATCH 015/165] Fix creation of custom MX records.

---
 management/dns_update.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/management/dns_update.py b/management/dns_update.py
index 6f4de318..957e8290 100755
--- a/management/dns_update.py
+++ b/management/dns_update.py
@@ -175,9 +175,6 @@ def build_zone(domain, all_domains, additional_records, www_redirect_domains, en
 		for value in build_sshfp_records():
 			records.append((None, "SSHFP", value, "Optional. Provides an out-of-band method for verifying an SSH key before connecting. Use 'VerifyHostKeyDNS yes' (or 'VerifyHostKeyDNS ask') when connecting with ssh."))
 
-	# The MX record says where email for the domain should be delivered: Here!
-	records.append((None,  "MX",  "10 %s." % env["PRIMARY_HOSTNAME"], "Required. Specifies the hostname (and priority) of the machine that handles @%s mail." % domain))
-
 	# Add DNS records for any subdomains of this domain. We should not have a zone for
 	# both a domain and one of its subdomains.
 	subdomains = [d for d in all_domains if d.endswith("." + domain)]
@@ -244,6 +241,10 @@ def build_zone(domain, all_domains, additional_records, www_redirect_domains, en
 	# Don't pin the list of records that has_rec checks against anymore.
 	has_rec_base = records
 
+	# The MX record says where email for the domain should be delivered: Here!
+	if not has_rec(None, "MX"):
+		records.append((None,  "MX",  "10 %s." % env["PRIMARY_HOSTNAME"], "Required. Specifies the hostname (and priority) of the machine that handles @%s mail." % domain))
+
 	# SPF record: Permit the box ('mx', see above) to send mail on behalf of
 	# the domain, and no one else.
 	# Skip if the user has set a custom SPF record.

From 72fcb005b208f18577e2bff52ce34531ee95d249 Mon Sep 17 00:00:00 2001
From: "Robert G. Jakabosky" <bobby@sharedrealm.com>
Date: Tue, 22 Mar 2016 03:07:14 +0800
Subject: [PATCH 016/165] Check MX priority.

---
 management/dns_update.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/management/dns_update.py b/management/dns_update.py
index 957e8290..836ad0d4 100755
--- a/management/dns_update.py
+++ b/management/dns_update.py
@@ -242,7 +242,7 @@ def build_zone(domain, all_domains, additional_records, www_redirect_domains, en
 	has_rec_base = records
 
 	# The MX record says where email for the domain should be delivered: Here!
-	if not has_rec(None, "MX"):
+	if not has_rec(None, "MX", prefix="10 "):
 		records.append((None,  "MX",  "10 %s." % env["PRIMARY_HOSTNAME"], "Required. Specifies the hostname (and priority) of the machine that handles @%s mail." % domain))
 
 	# SPF record: Permit the box ('mx', see above) to send mail on behalf of

From bd86d44c8b5949a2a3817e2a657933cf21206a10 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 23 Mar 2016 16:07:34 -0400
Subject: [PATCH 017/165] simplify the munin_cgi wrapper / add changelog entry

---
 CHANGELOG.md         |  2 ++
 management/daemon.py | 25 +++++++------------------
 2 files changed, 9 insertions(+), 18 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ff42710a..36234c2f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,8 @@
 CHANGELOG
 =========
 
+* Munin system monitoring graphs are now zoomable.
+
 In Development
 --------------
 
diff --git a/management/daemon.py b/management/daemon.py
index fd2d6b4d..0d54d322 100755
--- a/management/daemon.py
+++ b/management/daemon.py
@@ -507,12 +507,9 @@ def munin(filename=""):
 	if filename == "": filename = "index.html"
 	return send_from_directory("/var/cache/munin/www", filename)
 
-# MUNIN CGI-GRAPH
-
-@app.route('/munin/cgi-graph/')
 @app.route('/munin/cgi-graph/<path:filename>')
 @authorized_personnel_only
-def munin_cgi(filename=""):
+def munin_cgi(filename):
 	""" Relay munin cgi dynazoom requests
 	/usr/lib/munin/cgi/munin-cgi-graph is a perl cgi script in the munin package
 	that is responsible for generating binary png images _and_ associated HTTP
@@ -541,8 +538,6 @@ def munin_cgi(filename=""):
 		return ("a path must be specified", 404)
 
 	query_str = request.query_string.decode("utf-8", 'ignore')
-	query_str = query_str[1:] if query_str.startswith('&') else query_str[1:]
-	# I don't know if this is strictly necessary
 
 	env = {'PATH_INFO': '/%s/' % filename, 'QUERY_STRING': query_str}
 	cmd = COMMAND % query_str
@@ -560,18 +555,12 @@ def munin_cgi(filename=""):
 		return ("error processing graph image", 500)
 
 	# /usr/lib/munin/cgi/munin-cgi-graph returns both headers and binary png when successful.
-	# Per http://www.libpng.org/pub/png/spec/1.2/PNG-Structure.html PNG files always start
-	# with the same 8 bytes (137 80 78 71 13 10 26 10) or b'\x89PNG\r\n\x1a\n' So we split
-	# the output of munin-cgi-graph where the PNG begins
-	bin_start = binout.find(b'\x89PNG\r\n\x1a\n')
-	str_headers = binout[:bin_start].decode("utf-8")
-	# decode the byte str containing response headers
-	bin_image = binout[bin_start:]
-	response = make_response(bin_image)
-	for line in str_headers.splitlines():
-		if line:
-			name, value = line.split(':',1)
-			response.headers[name] = value
+	# A double-Windows-style-newline always indicates the end of HTTP headers.
+	headers, image_bytes = binout.split(b'\r\n\r\n', 1)
+	response = make_response(image_bytes)
+	for line in headers.splitlines():
+		name, value = line.decode("utf8").split(':', 1)
+		response.headers[name] = value
 	if 'Status' in response.headers and '404' in response.headers['Status']:
 		app.logger.warning("munin_cgi: munin-cgi-graph returned 404 status code. PATH_INFO=%s", env['PATH_INFO'])
 	return response

From 67555679bd9fd7a1da29a1f05728720c7843a5ad Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 23 Mar 2016 16:37:15 -0400
Subject: [PATCH 018/165] move the reboot button, fix grammar, refactor check
 for DRY, add changelog entry

---
 CHANGELOG.md                            |  2 ++
 management/daemon.py                    | 10 ++++--
 management/status_checks.py             |  5 ++-
 management/templates/system-status.html | 41 ++++++++++++++-----------
 4 files changed, 36 insertions(+), 22 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6f8bdc9d..88b4840e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,8 @@
 CHANGELOG
 =========
 
+* When a reboot is required (due to Ubuntu security updates automatically installed), a Reboot Box button now appears.
+
 v0.17 (February 25, 2016)
 -------------------------
 
diff --git a/management/daemon.py b/management/daemon.py
index b416b3ee..ded40a41 100755
--- a/management/daemon.py
+++ b/management/daemon.py
@@ -456,10 +456,12 @@ def do_updates():
 		"DEBIAN_FRONTEND": "noninteractive"
 	})
 
+
 @app.route('/system/reboot', methods=["GET"])
 @authorized_personnel_only
 def needs_reboot():
-	if os.path.isfile("/var/run/reboot-required"):
+	from status_checks import is_reboot_needed_due_to_package_installation
+	if is_reboot_needed_due_to_package_installation():
 		return json_response(True)
 	else:
 		return json_response(False)
@@ -467,10 +469,12 @@ def needs_reboot():
 @app.route('/system/reboot', methods=["POST"])
 @authorized_personnel_only
 def do_reboot():
-	if os.path.isfile("/var/run/reboot-required"):
+	# To keep the attack surface low, we don't allow a remote reboot if one isn't necessary.
+	from status_checks import is_reboot_needed_due_to_package_installation
+	if is_reboot_needed_due_to_package_installation():
 		return utils.shell("check_output", ["/sbin/shutdown", "-r", "now"], capture_stderr=True)
 	else:
-		return "No reboot is required"
+		return "No reboot is required, so it is not allowed."
 
 
 @app.route('/system/backup/status')
diff --git a/management/status_checks.py b/management/status_checks.py
index 1feea68a..36a87ea1 100755
--- a/management/status_checks.py
+++ b/management/status_checks.py
@@ -185,10 +185,13 @@ def check_ssh_password(env, output):
 	else:
 		output.print_ok("SSH disallows password-based login.")
 
+def is_reboot_needed_due_to_package_installation():
+	return os.path.exists("/var/run/reboot-required")
+
 def check_software_updates(env, output):
 	# Check for any software package updates.
 	pkgs = list_apt_updates(apt_update=False)
-	if os.path.exists("/var/run/reboot-required"):
+	if is_reboot_needed_due_to_package_installation():
 		output.print_error("System updates have been installed and a reboot of the machine is required.")
 	elif len(pkgs) == 0:
 		output.print_ok("System software is up to date.")
diff --git a/management/templates/system-status.html b/management/templates/system-status.html
index efc8ad90..dc9233a5 100644
--- a/management/templates/system-status.html
+++ b/management/templates/system-status.html
@@ -1,9 +1,5 @@
 <h2>System Status Checks</h2>
 
-<div id="system-reboot-required" style="display: none">
-  <button type="button" class="btn btn-danger" onclick="confirm_reboot(); return false;">Reboot required</button>
-</div>
-
 <style>
 #system-checks .heading td {
   font-weight: bold;
@@ -38,22 +34,24 @@
   font-family: monospace;
   white-space: pre-wrap;
 }
-#system-reboot-required {
-  max-width: 20em;
-  margin-bottom: 1em;
-}
-#system-privacy-setting {
-  float: right;
-  max-width: 20em;
-  margin-bottom: 1em;
-}
 </style>
 
+<div class="row">
+	<div class="col-md-push-9 col-md-3">
+
+<div id="system-reboot-required" style="display: none; margin-bottom: 1em;">
+	<button type="button" class="btn btn-danger" onclick="confirm_reboot(); return false;">Reboot Box</button>
+	<div>No reboot is necessary.</div>
+</div>
+
 <div id="system-privacy-setting" style="display: none">
 	<div><a onclick="return enable_privacy(!current_privacy_setting)" href="#"><span>Enable/Disable</span> New-Version Check</a></div>
 	<p style="line-height: 125%"><small>(When enabled, status checks phone-home to check for a new release of Mail-in-a-Box.)</small></p>
 </div>
 
+	</div> <!-- /col -->
+	<div class="col-md-pull-3 col-md-8">
+
 <table id="system-checks" class="table" style="max-width: 60em">
   <thead>
   </thead>
@@ -61,6 +59,9 @@
   </tbody>
 </table>
 
+	</div> <!-- /col -->
+</div> <!-- /row -->
+
 <script>
 function show_system_status() {
   $('#system-checks tbody').html("<tr><td colspan='2' class='text-muted'>Loading...</td></tr>")
@@ -81,7 +82,9 @@ function show_system_status() {
     "GET",
     { },
     function(r) {
-      $('#system-reboot-required').toggle(r);
+      $('#system-reboot-required').show(); // show when r becomes available
+      $('#system-reboot-required').find('button').toggle(r);
+      $('#system-reboot-required').find('div').toggle(!r);
     });
 
   api(
@@ -139,16 +142,18 @@ function enable_privacy(status) {
 
 function confirm_reboot() {
   show_modal_confirm(
-    "Reboot server",
-    $("<p>This will reboot your server, until the server is fully restarted your users will not be able to send and receive email. The reboot can't be cancelled</p>"),
-    "Reboot now",
+    "Reboot",
+    $("<p>This will reboot your Mail-in-a-Box <code>{{hostname}}</code>.</p> <p>Until the machine is fully restarted, your users will not be able to send and receive email, and you will not be able to connect to this control panel or with SSH. The reboot cannot be cancelled.</p>"),
+    "Reboot Now",
     function() {
       api(
         "/system/reboot",
         "POST",
         { },
         function(r) {
-          show_modal_error("Reboot", "Please refresh the page after a minute or so." + r);
+          var msg = "<p>Please reload this page after a minute or so.</p>";
+          if (r) msg = "<p>The reboot command said:</p> <pre>" + $("<pre/>").text(r).html() + "</pre>"; // successful reboots don't produce any output; the output must be HTML-escaped
+          show_modal_error("Reboot", msg);
         });
     });
 }

From c01f903413a54d0fc25d957a20a282c866ab0fcb Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 23 Mar 2016 16:50:27 -0400
Subject: [PATCH 019/165] edit NCURSES_NO_UTF8_ACS's comment, add changelog
 entry

---
 CHANGELOG.md   | 2 ++
 setup/start.sh | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7c99020b..5277a980 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,8 @@
 CHANGELOG
 =========
 
+* Setup dialogs did not appear correctly when connecting to SSH using Putty on Windows.
+
 v0.17b (March 1, 2016)
 ----------------------
 
diff --git a/setup/start.sh b/setup/start.sh
index 3bd01898..09dc8956 100755
--- a/setup/start.sh
+++ b/setup/start.sh
@@ -24,8 +24,9 @@ export LC_ALL=en_US.UTF-8
 export LANG=en_US.UTF-8
 export LC_TYPE=en_US.UTF-8
 
-# Fix for putty Line Drawing characters to be shown correctly
+# Fix so line drawing characters are shown correctly in Putty on Windows. See #744.
 export NCURSES_NO_UTF8_ACS=1
+
 # Recall the last settings used if we're running this a second time.
 if [ -f /etc/mailinabox.conf ]; then
 	# Run any system migrations before proceeding. Since this is a second run,

From 696bbe4e82ffb39971090fe7f2f1fa6301be8d4f Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Mon, 14 Mar 2016 11:18:12 +0100
Subject: [PATCH 020/165] Add a swap file to the system if system memory is
 less than 2GB, 5GB of free disk space is available, and if no swap file yet
 exists

---
 CHANGELOG.md    |  3 +++
 setup/system.sh | 54 +++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 57 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7c99020b..ff50216c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,9 @@
 CHANGELOG
 =========
 
+* A swap file is now created if system memory is less than 2GB, 5GB of free disk space is available, and if no swap file yet exists.
+
+
 v0.17b (March 1, 2016)
 ----------------------
 
diff --git a/setup/system.sh b/setup/system.sh
index 1aeec458..c2fa1b9d 100755
--- a/setup/system.sh
+++ b/setup/system.sh
@@ -4,6 +4,60 @@ source setup/functions.sh # load our functions
 # Basic System Configuration
 # -------------------------
 
+# ### Add swap space to the system
+
+# If the physical memory of the system is below 2GB it is wise to create a
+# swap file. This will make the system more resiliant to memory spikes and
+# prevent for instance spam filtering from crashing
+
+# We will create a 1G file, this should be a good balance between disk usage
+# and buffers for the system. We will only allocate this file if there is more
+# than 5GB of disk space available
+
+# The following checks are performed:
+# - Check if swap is currently mountend by looking at /proc/swaps
+# - Check if the user intents to activate swap on next boot by checking fstab entries.
+# - Check if a swapfile already exists
+# - Check if the root file system is not btrfs, might be an incompatible version with
+#   swapfiles. User should hanle it them selves.
+# - Check the memory requirements
+# - Check available diskspace
+
+# See https://www.digitalocean.com/community/tutorials/how-to-add-swap-on-ubuntu-14-04
+# for reference
+
+SWAP_MOUNTED=$(cat /proc/swaps | tail -n+2)
+SWAP_IN_FSTAB=$(grep "swap" /etc/fstab)
+ROOT_IS_BTRFS=$(grep "\/ .*btrfs" /proc/mounts)
+TOTAL_PHYSICAL_MEM=$(head -n 1 /proc/meminfo | awk '{print $2}')
+AVAILABLE_DISK_SPACE=$(df / --output=avail | tail -n 1)
+if
+	[ -z "$SWAP_MOUNTED" ] &&
+	[ -z "$SWAP_IN_FSTAB" ] &&
+	[ ! -e /swapfile ] &&
+	[ -z "$ROOT_IS_BTRFS" ] &&
+	[ $TOTAL_PHYSICAL_MEM -lt 1900000 ] &&
+	[ $AVAILABLE_DISK_SPACE -gt 5242880 ]
+then
+	echo "Adding a swap file to the system..."
+
+	# Allocate and activate the swap file. Allocate in 1KB chuncks
+	# doing it in one go, could fail on low memory systems
+	dd if=/dev/zero of=/swapfile bs=1024 count=$[1024*1024] status=none
+	if [ -e /swapfile ]; then
+		chmod 600 /swapfile
+		hide_output mkswap /swapfile
+		swapon /swapfile
+	fi
+
+	# Check if swap is mounted then activate on boot
+	if swapon -s | grep -q "\/swapfile"; then
+		echo "/swapfile   none    swap    sw    0   0" >> /etc/fstab
+	else
+		echo "ERROR: Swap allocation failed"
+	fi
+fi
+
 # ### Add Mail-in-a-Box's PPA.
 
 # We've built several .deb packages on our own that we want to include.

From 313a86d0fa3f66eed1ab7d7c0cb1b14d8cb7fbde Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 23 Mar 2016 17:16:50 -0400
Subject: [PATCH 021/165] add changelog entry for bayes file permissions

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7c99020b..a91dbf81 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,8 @@
 CHANGELOG
 =========
 
+* Fixed a long-standing issue with training the spam filter not working (because of a file permissions issue).
+
 v0.17b (March 1, 2016)
 ----------------------
 

From df92a10ebab66ee0511c2fbe604c623055c83326 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 23 Mar 2016 17:31:24 -0400
Subject: [PATCH 022/165] install roundcube from our own mirror, hosted in
 Josh's AWS S3 account, because sourceforge is down all the time

fixes #750, see #701, see #370
---
 CHANGELOG.md     | 1 +
 setup/webmail.sh | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0c3189b1..f8c91d77 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Setup:
 
 * A swap file is now created if system memory is less than 2GB, 5GB of free disk space is available, and if no swap file yet exists.
 * Setup dialogs did not appear correctly when connecting to SSH using Putty on Windows.
+* We now install Roundcube from our own mirror because Sourceforge's downloads experience frequent intermittant unavailability.
 
 v0.17b (March 1, 2016)
 ----------------------
diff --git a/setup/webmail.sh b/setup/webmail.sh
index 2bef9f98..58faad58 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -51,7 +51,7 @@ fi
 if [ $needs_update == 1 ]; then
 	# install roundcube
 	wget_verify \
-		https://downloads.sourceforge.net/project/roundcubemail/roundcubemail/$VERSION/roundcubemail-$VERSION.tar.gz \
+		https://s3.amazonaws.com/joshdata/mail-in-a-box/public/roundcubemail-$VERSION.tar.gz \
 		$HASH \
 		/tmp/roundcube.tgz
 	tar -C /usr/local/lib --no-same-owner -zxf /tmp/roundcube.tgz

From d7d8bda0a40e82c3e11c4447b5113964a9bd9673 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Fri, 25 Mar 2016 13:37:55 +0100
Subject: [PATCH 023/165] Instructions on how to create a web site for a domain
 weren't rendered. Users would miss the step about manually creating the
 directory to put files in there and wouldn't see anything happen

---
 management/templates/web.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/management/templates/web.html b/management/templates/web.html
index 6f594eeb..6a09ef0e 100644
--- a/management/templates/web.html
+++ b/management/templates/web.html
@@ -82,7 +82,7 @@ function show_change_web_root(elem) {
   var root = $(elem).parents('tr').attr('data-custom-web-root');
   show_modal_confirm(
     'Change Root Directory for ' + domain,
-    $('<p>You can change the static directory for <tt>' + domain + '</tt> to:</p> <p><tt>' + root + '</tt></p> <p>First create this directory on the server. Then click Update to scan for the directory and update web settings.'),
+    $('<p>You can change the static directory for <tt>' + domain + '</tt> to:</p> <p><tt>' + root + '</tt></p> <p>First create this directory on the server. Then click Update to scan for the directory and update web settings.</p>'),
     'Update',
     function() { do_web_update(); });
 }

From f6e0af124f60ce46f49a2343344d970417dd7e32 Mon Sep 17 00:00:00 2001
From: david <david@socialnerds.org>
Date: Fri, 25 Mar 2016 20:16:51 +0100
Subject: [PATCH 024/165] updated html5_notifier version to 0.6.2 in setup

---
 setup/webmail.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup/webmail.sh b/setup/webmail.sh
index 58faad58..053dbacc 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -38,7 +38,7 @@ VERSION=1.1.4
 HASH=4883c8bb39fadf8af94ffb09ee426cba9f8ef2e3
 VACATION_SIEVE_VERSION=91ea6f52216390073d1f5b70b5f6bea0bfaee7e5
 PERSISTENT_LOGIN_VERSION=1e9d724476a370ce917a2fcd5b3217b0c306c24e
-HTML5_NOTIFIER_VERSION=046eb388dd63b1ec77a3ee485757fc25ae9e684d
+HTML5_NOTIFIER_VERSION=4b370e3cd60dabd2f428a26f45b677ad1b7118d5
 UPDATE_KEY=$VERSION:$VACATION_SIEVE_VERSION:$PERSISTENT_LOGIN_VERSION:$HTML5_NOTIFIER_VERSION:a
 needs_update=0 #NODOC
 if [ ! -f /usr/local/lib/roundcubemail/version ]; then

From 454a2b167bfca0c07363632cf2b2270057bd9fec Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Sat, 26 Mar 2016 09:04:51 +0100
Subject: [PATCH 025/165] Stop fail2ban recidive from sending emails, like all
 other jails

---
 conf/fail2ban/jail.local | 1 +
 1 file changed, 1 insertion(+)

diff --git a/conf/fail2ban/jail.local b/conf/fail2ban/jail.local
index b9340e52..d2a12f33 100644
--- a/conf/fail2ban/jail.local
+++ b/conf/fail2ban/jail.local
@@ -27,3 +27,4 @@ maxretry = 20
 [recidive]
 enabled  = true
 maxretry = 10
+action   = iptables-allports[name=recidive]

From 4d7229ccb01a506b89e240479b244a6b3faa50c6 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Sat, 26 Mar 2016 13:37:33 +0100
Subject: [PATCH 026/165] Add documentation on why the notification was removed
 from the recidive jail

---
 conf/fail2ban/jail.local | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/conf/fail2ban/jail.local b/conf/fail2ban/jail.local
index d2a12f33..cc741c80 100644
--- a/conf/fail2ban/jail.local
+++ b/conf/fail2ban/jail.local
@@ -28,3 +28,13 @@ maxretry = 20
 enabled  = true
 maxretry = 10
 action   = iptables-allports[name=recidive]
+# In the recidive section of jail.conf the action contains:
+#
+# action   = iptables-allports[name=recidive]
+#            sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log]
+#
+# The last line on the action will sent an email to the configured address. This mail will
+# notify the administrator that someone has been repeatedly triggering one of the other jails.
+# By default we don't configure this address and no action is required from the admin anyway.
+# So the notification is ommited. This will prevent message appearing in the mail.log that mail
+# can't be delivered to fail2ban@$HOSTNAME.

From f292e8fc5bac5fd1a3e1158c2a34d81ebb650801 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Sat, 26 Mar 2016 14:06:43 +0100
Subject: [PATCH 027/165] Add generic login failed message

---
 management/daemon.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/management/daemon.py b/management/daemon.py
index 690f8b0f..5400925f 100755
--- a/management/daemon.py
+++ b/management/daemon.py
@@ -43,7 +43,7 @@ def authorized_personnel_only(viewfunc):
 		except ValueError as e:
 			# Authentication failed.
 			privs = []
-			error = str(e)
+			error = "Incorrect username or password"
 
 		# Authorized to access an API view?
 		if "admin" in privs:
@@ -119,7 +119,7 @@ def me():
 	except ValueError as e:
 		return json_response({
 			"status": "invalid",
-			"reason": str(e),
+			"reason": "Incorrect username or password",
 			})
 
 	resp = {

From c910a58f07fc26589943afb9e59a9fa44edbb7b2 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Sat, 26 Mar 2016 14:15:28 +0100
Subject: [PATCH 028/165] Set the hostname of the box during the setup

---
 setup/system.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/setup/system.sh b/setup/system.sh
index c2fa1b9d..d8d814a1 100755
--- a/setup/system.sh
+++ b/setup/system.sh
@@ -4,6 +4,18 @@ source setup/functions.sh # load our functions
 # Basic System Configuration
 # -------------------------
 
+# ### Set hostname of the box
+
+# If the hostname is not correctly resolvable sudo can't be used. This will result in
+# errors during the install
+#
+# First set the hostname in the configuration file, then activate the setting
+# Also make sure that the loopback device resolves to the hostname
+
+echo $PRIMARY_HOSTNAME > /etc/hostname
+hostname $PRIMARY_HOSTNAME
+sed -i "s/127\.0\.1\.1.*/127.0.1.1\t$PRIMARY_HOSTNAME/" /etc/hosts
+
 # ### Add swap space to the system
 
 # If the physical memory of the system is below 2GB it is wise to create a

From 3210ccdcac9791c8c8e9c950a482cf1d69a714be Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Sat, 26 Mar 2016 15:41:20 +0100
Subject: [PATCH 029/165] Don't set the hostname on the loopback 127.0.1.1

---
 setup/system.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/setup/system.sh b/setup/system.sh
index d8d814a1..1a7b3e9d 100755
--- a/setup/system.sh
+++ b/setup/system.sh
@@ -14,7 +14,6 @@ source setup/functions.sh # load our functions
 
 echo $PRIMARY_HOSTNAME > /etc/hostname
 hostname $PRIMARY_HOSTNAME
-sed -i "s/127\.0\.1\.1.*/127.0.1.1\t$PRIMARY_HOSTNAME/" /etc/hosts
 
 # ### Add swap space to the system
 

From c5e8a975cd90ecab3481cf6cf5bfa94243b15da5 Mon Sep 17 00:00:00 2001
From: Tibor Blaho <btibor91@users.noreply.github.com>
Date: Thu, 31 Mar 2016 00:07:48 +0200
Subject: [PATCH 030/165] Fix denied ownCloud nginx locations

---
 conf/nginx-primaryonly.conf | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/conf/nginx-primaryonly.conf b/conf/nginx-primaryonly.conf
index 8fd546af..55c80eba 100644
--- a/conf/nginx-primaryonly.conf
+++ b/conf/nginx-primaryonly.conf
@@ -18,8 +18,11 @@
 	rewrite ^(/cloud/core/doc/[^\/]+/)$ $1/index.html;
 	location /cloud/ {
 		alias /usr/local/lib/owncloud/;
-		location ~ ^/(data|config|\.ht|db_structure\.xml|README) {
-			deny all;
+	 	location ~ ^/cloud/(build|tests|config|lib|3rdparty|templates|data|README)/ {
+	 		deny all;
+	 	}
+	 	location ~ ^/cloud/(?:\.|autotest|occ|issue|indie|db_|console) {
+	 		deny all;
 	 	}
 	}
 	location ~ ^(/cloud)((?:/ocs)?/[^/]+\.php)(/.*)?$ {

From eb8cfaab756ba7593378b8195904288182ea2d64 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Thu, 31 Mar 2016 10:20:13 -0400
Subject: [PATCH 031/165] changelog entry for html5_notifier bump

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f8c91d77..2f6a4e3f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@ In Development
 Mail:
 
 * Fixed a long-standing issue with training the spam filter not working (because of a file permissions issue).
+* Update the Roundcube html5_notifier plugin from version 0.6 to 0.6.2 to fix Roundcube getting stuck for some people.
 
 Control panel:
 

From 7fa9baf308565b3dc90acb29c4325cd78042c8fd Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 23 Mar 2016 16:51:01 -0400
Subject: [PATCH 032/165] hotfix merge #744 - Fix for putty Line Drawing issues

---
 CHANGELOG.md   | 7 +++++++
 setup/start.sh | 3 +++
 2 files changed, 10 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7c99020b..cc31fd74 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,13 @@
 CHANGELOG
 =========
 
+In Development
+--------------
+
+Setup:
+
+* Setup dialogs did not appear correctly when connecting to SSH using Putty on Windows.
+
 v0.17b (March 1, 2016)
 ----------------------
 
diff --git a/setup/start.sh b/setup/start.sh
index ab6d3055..cbcb9329 100755
--- a/setup/start.sh
+++ b/setup/start.sh
@@ -23,6 +23,9 @@ export LC_ALL=en_US.UTF-8
 export LANG=en_US.UTF-8
 export LC_TYPE=en_US.UTF-8
 
+# Fix so line drawing characters are shown correctly in Putty on Windows. See #744.
+export NCURSES_NO_UTF8_ACS=1
+
 # Recall the last settings used if we're running this a second time.
 if [ -f /etc/mailinabox.conf ]; then
 	# Run any system migrations before proceeding. Since this is a second run,

From aa1fdaddaf83e05a2d03ceb7dea5df1be80b9fae Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 23 Mar 2016 16:53:48 -0400
Subject: [PATCH 033/165] hotfix merge #755 - Prevent click jacking of the
 management interface

---
 CHANGELOG.md                | 4 ++++
 conf/nginx-primaryonly.conf | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cc31fd74..cf5578d0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@ CHANGELOG
 In Development
 --------------
 
+Control panel:
+
+* Prevent click-jacking of the management interface by adding HTTP headers.
+
 Setup:
 
 * Setup dialogs did not appear correctly when connecting to SSH using Putty on Windows.
diff --git a/conf/nginx-primaryonly.conf b/conf/nginx-primaryonly.conf
index 2fb9972e..8fd546af 100644
--- a/conf/nginx-primaryonly.conf
+++ b/conf/nginx-primaryonly.conf
@@ -6,6 +6,9 @@
 	location /admin/ {
 		proxy_pass http://127.0.0.1:10222/;
 		proxy_set_header X-Forwarded-For $remote_addr;
+		add_header X-Frame-Options "DENY";
+		add_header X-Content-Type-Options nosniff;
+		add_header Content-Security-Policy "frame-ancestors 'none';";
 	}
 
 	# ownCloud configuration.

From b3223136f443a0330b5da48d0d06da62af728720 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 23 Mar 2016 17:31:24 -0400
Subject: [PATCH 034/165] hotfix - install roundcube from our own mirror,
 hosted in Josh's AWS S3 account, because sourceforge is down all the time

fixes #750, see #701, see #370

was df92a10ebab66ee0511c2fbe604c623055c83326
---
 CHANGELOG.md     | 1 +
 setup/webmail.sh | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cf5578d0..b20c863d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@ Control panel:
 Setup:
 
 * Setup dialogs did not appear correctly when connecting to SSH using Putty on Windows.
+* We now install Roundcube from our own mirror because Sourceforge's downloads experience frequent intermittant unavailability.
 
 v0.17b (March 1, 2016)
 ----------------------
diff --git a/setup/webmail.sh b/setup/webmail.sh
index 2bef9f98..58faad58 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -51,7 +51,7 @@ fi
 if [ $needs_update == 1 ]; then
 	# install roundcube
 	wget_verify \
-		https://downloads.sourceforge.net/project/roundcubemail/roundcubemail/$VERSION/roundcubemail-$VERSION.tar.gz \
+		https://s3.amazonaws.com/joshdata/mail-in-a-box/public/roundcubemail-$VERSION.tar.gz \
 		$HASH \
 		/tmp/roundcube.tgz
 	tar -C /usr/local/lib --no-same-owner -zxf /tmp/roundcube.tgz

From 703e6795e81b6d927d4565a6beac62d4dfd1c350 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sat, 26 Mar 2016 07:42:18 -0400
Subject: [PATCH 035/165] hotfix merge #769 - update the Roundcube
 html5_notifier plugin from version 0.6 to 0.6.2

fixes Roundcube getting stuck for some people, hopefully fixes #693
---
 CHANGELOG.md     | 4 ++++
 setup/webmail.sh | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b20c863d..6469817e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@ CHANGELOG
 In Development
 --------------
 
+Mail:
+
+* Roundcube html5_notifier plugin updated from version 0.6 to 0.6.2 to fix Roundcube getting stuck for some people.
+
 Control panel:
 
 * Prevent click-jacking of the management interface by adding HTTP headers.
diff --git a/setup/webmail.sh b/setup/webmail.sh
index 58faad58..053dbacc 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -38,7 +38,7 @@ VERSION=1.1.4
 HASH=4883c8bb39fadf8af94ffb09ee426cba9f8ef2e3
 VACATION_SIEVE_VERSION=91ea6f52216390073d1f5b70b5f6bea0bfaee7e5
 PERSISTENT_LOGIN_VERSION=1e9d724476a370ce917a2fcd5b3217b0c306c24e
-HTML5_NOTIFIER_VERSION=046eb388dd63b1ec77a3ee485757fc25ae9e684d
+HTML5_NOTIFIER_VERSION=4b370e3cd60dabd2f428a26f45b677ad1b7118d5
 UPDATE_KEY=$VERSION:$VACATION_SIEVE_VERSION:$PERSISTENT_LOGIN_VERSION:$HTML5_NOTIFIER_VERSION:a
 needs_update=0 #NODOC
 if [ ! -f /usr/local/lib/roundcubemail/version ]; then

From 3843f63416b3f185f1505a16c4798b30148e40b2 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sat, 26 Mar 2016 09:22:02 -0400
Subject: [PATCH 036/165] hotfix merge #772 - yodax/generic-login-message

Make control panel login failed messages generic - don't reveal if an email address has an account on the system.
---
 CHANGELOG.md         | 1 +
 management/daemon.py | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6469817e..661ca739 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@ Mail:
 Control panel:
 
 * Prevent click-jacking of the management interface by adding HTTP headers.
+* Failed login no longer reveals whether an account exists on the system.
 
 Setup:
 
diff --git a/management/daemon.py b/management/daemon.py
index 6de0a59a..04c68a0e 100755
--- a/management/daemon.py
+++ b/management/daemon.py
@@ -49,7 +49,7 @@ def authorized_personnel_only(viewfunc):
 		except ValueError as e:
 			# Authentication failed.
 			privs = []
-			error = str(e)
+			error = "Incorrect username or password"
 
 		# Authorized to access an API view?
 		if "admin" in privs:
@@ -125,7 +125,7 @@ def me():
 	except ValueError as e:
 		return json_response({
 			"status": "invalid",
-			"reason": str(e),
+			"reason": "Incorrect username or password",
 			})
 
 	resp = {

From e65c77588e45378e8b85e55d35e3653aa1c41ec9 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Thu, 31 Mar 2016 10:20:21 -0400
Subject: [PATCH 037/165] hotfix merge #776 - some owncloud paths were
 improperly exposed over http

---
 conf/nginx-primaryonly.conf | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/conf/nginx-primaryonly.conf b/conf/nginx-primaryonly.conf
index 8fd546af..55c80eba 100644
--- a/conf/nginx-primaryonly.conf
+++ b/conf/nginx-primaryonly.conf
@@ -18,8 +18,11 @@
 	rewrite ^(/cloud/core/doc/[^\/]+/)$ $1/index.html;
 	location /cloud/ {
 		alias /usr/local/lib/owncloud/;
-		location ~ ^/(data|config|\.ht|db_structure\.xml|README) {
-			deny all;
+	 	location ~ ^/cloud/(build|tests|config|lib|3rdparty|templates|data|README)/ {
+	 		deny all;
+	 	}
+	 	location ~ ^/cloud/(?:\.|autotest|occ|issue|indie|db_|console) {
+	 		deny all;
 	 	}
 	}
 	location ~ ^(/cloud)((?:/ocs)?/[^/]+\.php)(/.*)?$ {

From 86881c0107d574d94392666418a762014d071b62 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Thu, 31 Mar 2016 10:46:06 -0400
Subject: [PATCH 038/165] v0.17c

---
 CHANGELOG.md       | 10 ++++++++--
 README.md          |  4 ++--
 setup/bootstrap.sh |  2 +-
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 661ca739..bc577bd2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,14 @@
 CHANGELOG
 =========
 
-In Development
---------------
+v0.17c (April 1, 2016)
+----------------------
+
+This update addresses some minor security concerns and some installation issues.
+
+ownCoud:
+
+* Block web access to the configuration parameters (config.php). There is no immediate impact (see [#776](https://github.com/mail-in-a-box/mailinabox/pull/776)), although advanced users may want to take note.
 
 Mail:
 
diff --git a/README.md b/README.md
index d8329054..a12e48bb 100644
--- a/README.md
+++ b/README.md
@@ -59,7 +59,7 @@ by me:
 	$ curl -s https://keybase.io/joshdata/key.asc | gpg --import
 	gpg: key C10BDD81: public key "Joshua Tauberer <jt@occams.info>" imported
 
-	$ git verify-tag v0.17b
+	$ git verify-tag v0.17c
 	gpg: Signature made ..... using RSA key ID C10BDD81
 	gpg: Good signature from "Joshua Tauberer <jt@occams.info>"
 	gpg: WARNING: This key is not certified with a trusted signature!
@@ -72,7 +72,7 @@ and on my [personal homepage](https://razor.occams.info/). (Of course, if this r
 
 Checkout the tag corresponding to the most recent release:
 
-	$ git checkout v0.17b
+	$ git checkout v0.17c
 
 Begin the installation.
 
diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh
index 6ff21c50..3e793576 100644
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -7,7 +7,7 @@
 #########################################################
 
 if [ -z "$TAG" ]; then
-	TAG=v0.17b
+	TAG=v0.17c
 fi
 
 # Are we running as root?

From c9f30e805997caf4c6987df3af6f206120a50456 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Sat, 2 Apr 2016 13:41:16 +0200
Subject: [PATCH 039/165] Add status checks for ufw

---
 management/status_checks.py | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/management/status_checks.py b/management/status_checks.py
index 36a87ea1..4757b31a 100755
--- a/management/status_checks.py
+++ b/management/status_checks.py
@@ -168,6 +168,31 @@ def run_system_checks(rounded_values, env, output):
 	check_system_aliases(env, output)
 	check_free_disk_space(rounded_values, env, output)
 	check_free_memory(rounded_values, env, output)
+	check_ufw(env, output)
+
+def check_ufw(env, output):
+	ufw = shell('check_output', ['ufw', 'status']).splitlines()
+
+	if ufw[0] == "Status: active":
+		ports_that_should_be_allowed = ["22", "53", "25", "587", "993", "995", "4190", "80", "443"]
+		not_allowed_ports = []
+
+		for port in ports_that_should_be_allowed:
+			if not is_port_allowed(ufw, port):
+				not_allowed_ports.append(port)
+		if len(not_allowed_ports) == 1:
+			output.print_error("Port %s should be allowed in the firewall, please rerun the setup." % (not_allowed_ports[0]))
+		elif len(not_allowed_ports) > 1:
+			output.print_error("Ports %s should be allowed in the firewall, please rerun the setup." % (", ".join(not_allowed_ports)))
+		else:
+			output.print_ok("Firewall is active")
+	else:
+		output.print_warning("""The firewall is disabled on this machine, this might be because the system
+			is protected by an external firewall. We can't protect against bruteforce attacks using fail2ban 
+			without the local firewall active. Via ssh please try to run: ufw enable""")
+
+def is_port_allowed(ufw, port):
+	return any(item.startswith(port) for item in ufw)
 
 def check_ssh_password(env, output):
 	# Check that SSH login with password is disabled. The openssh-server

From 703a963ae55a742942f1014931c704ca1fbf438a Mon Sep 17 00:00:00 2001
From: msgerbs <msgerbs@users.noreply.github.com>
Date: Tue, 5 Apr 2016 00:54:26 -0500
Subject: [PATCH 040/165] Add SRV record to the Custom DNS page

Add SRV to the drop-down to add a custom DNS zone. I made this change on my up-to-date install and it worked without any issues.
---
 management/templates/custom-dns.html | 1 +
 1 file changed, 1 insertion(+)

diff --git a/management/templates/custom-dns.html b/management/templates/custom-dns.html
index f1244810..bd5643c3 100644
--- a/management/templates/custom-dns.html
+++ b/management/templates/custom-dns.html
@@ -36,6 +36,7 @@
         <option value="CNAME" data-hint="Enter another domain name followed by a period at the end (e.g. mypage.github.io.).">CNAME (DNS forwarding)</option>
         <option value="TXT" data-hint="Enter arbitrary text.">TXT (text record)</option>
         <option value="MX" data-hint="Enter record in the form of PRIORIY DOMAIN., including trailing period (e.g. 20 mx.example.com.).">MX (mail exchanger)</option>
+        <option value="SRV" data-hint="Enter record in the form of PRIORIY WEIGHT PORT TARGET., including trailing period (e.g. 10 10 5060 sip.example.com.).">SRV (service record)</option>
       </select>
     </div>
   </div>

From 22395bdb8bca4049b8e28d376f225db95b4aa3a6 Mon Sep 17 00:00:00 2001
From: kurt89523 <kurt@dietrich.xyz>
Date: Wed, 6 Apr 2016 17:31:59 -0700
Subject: [PATCH 041/165] Update to ownCloud v8.2.3

---
 setup/owncloud.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/setup/owncloud.sh b/setup/owncloud.sh
index c71c3ffb..94dd70b6 100755
--- a/setup/owncloud.sh
+++ b/setup/owncloud.sh
@@ -17,8 +17,8 @@ apt_install \
 apt-get purge -qq -y owncloud*
 
 # Install ownCloud from source of this version:
-owncloud_ver=8.1.1
-owncloud_hash=34077e78575a3e689825a00964ee37fbf83fbdda
+owncloud_ver=8.2.3
+owncloud_hash=bfdf6166fbf6fc5438dc358600e7239d1c970613
 
 # Migrate <= v0.10 setups that stored the ownCloud config.php in /usr/local rather than
 # in STORAGE_ROOT. Move the file to STORAGE_ROOT.
@@ -52,8 +52,8 @@ if [ ! -d /usr/local/lib/owncloud/ ] \
 	# The two apps we actually want are not in ownCloud core. Clone them from
 	# their github repositories.
 	mkdir -p /usr/local/lib/owncloud/apps
-	git_clone https://github.com/owncloudarchive/contacts 4ff855e7c2075309041bead09fbb9eb7df678244 '' /usr/local/lib/owncloud/apps/contacts
-	git_clone https://github.com/owncloudarchive/calendar ec53139b144c0f842c33813305612e8006c42ea5 '' /usr/local/lib/owncloud/apps/calendar
+	git_clone https://github.com/owncloudarchive/contacts 9ba2e667ae8c7ea36d8c4a4c3413c374beb24b1b '' /usr/local/lib/owncloud/apps/contacts
+	git_clone https://github.com/owncloudarchive/calendar 2086e738a3b7b868ec59cd61f0f88b49c3f21dd1 '' /usr/local/lib/owncloud/apps/calendar
 
 	# Fix weird permissions.
 	chmod 750 /usr/local/lib/owncloud/{apps,config}

From bc40134b7b790a9597447e2ee71e3d928485af4c Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Thu, 7 Apr 2016 10:55:20 +0200
Subject: [PATCH 042/165] Remove comment about loopback interface

---
 setup/system.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/setup/system.sh b/setup/system.sh
index 1a7b3e9d..cc152524 100755
--- a/setup/system.sh
+++ b/setup/system.sh
@@ -10,7 +10,6 @@ source setup/functions.sh # load our functions
 # errors during the install
 #
 # First set the hostname in the configuration file, then activate the setting
-# Also make sure that the loopback device resolves to the hostname
 
 echo $PRIMARY_HOSTNAME > /etc/hostname
 hostname $PRIMARY_HOSTNAME

From 736b3de221b2e5e8ec53732666355801350ede6d Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Thu, 7 Apr 2016 16:03:28 +0200
Subject: [PATCH 043/165] Improve matching of ufw output. Reuse network service
 list. Improve messages

---
 management/status_checks.py | 73 +++++++++++++++++--------------------
 1 file changed, 34 insertions(+), 39 deletions(-)

diff --git a/management/status_checks.py b/management/status_checks.py
index 4757b31a..f8873d8a 100755
--- a/management/status_checks.py
+++ b/management/status_checks.py
@@ -18,6 +18,29 @@ from mailconfig import get_mail_domains, get_mail_aliases
 
 from utils import shell, sort_domains, load_env_vars_from_file, load_settings
 
+def get_services():
+	return [
+		{ "name": "Local DNS (bind9)", "port": 53, "public": False, },
+		#{ "name": "NSD Control", "port": 8952, "public": False, },
+		{ "name": "Local DNS Control (bind9/rndc)", "port": 953, "public": False, },
+		{ "name": "Dovecot LMTP LDA", "port": 10026, "public": False, },
+		{ "name": "Postgrey", "port": 10023, "public": False, },
+		{ "name": "Spamassassin", "port": 10025, "public": False, },
+		{ "name": "OpenDKIM", "port": 8891, "public": False, },
+		{ "name": "OpenDMARC", "port": 8893, "public": False, },
+		{ "name": "Memcached", "port": 11211, "public": False, },
+		{ "name": "Mail-in-a-Box Management Daemon", "port": 10222, "public": False, },
+		{ "name": "SSH Login (ssh)", "port": get_ssh_port(), "public": True, },
+		{ "name": "Public DNS (nsd4)", "port": 53, "public": True, },
+		{ "name": "Incoming Mail (SMTP/postfix)", "port": 25, "public": True, },
+		{ "name": "Outgoing Mail (SMTP 587/postfix)", "port": 587, "public": True, },
+		#{ "name": "Postfix/master", "port": 10587, "public": True, },
+		{ "name": "IMAPS (dovecot)", "port": 993, "public": True, },
+		{ "name": "Mail Filters (Sieve/dovecot)", "port": 4190, "public": True, },
+		{ "name": "HTTP Web (nginx)", "port": 80, "public": True, },
+		{ "name": "HTTPS Web (nginx)", "port": 443, "public": True, },
+	]
+
 def run_checks(rounded_values, env, output, pool):
 	# run systems checks
 	output.add_heading("System")
@@ -61,33 +84,9 @@ def get_ssh_port():
 
 def run_services_checks(env, output, pool):
 	# Check that system services are running.
-
-	services = [
-		{ "name": "Local DNS (bind9)", "port": 53, "public": False, },
-		#{ "name": "NSD Control", "port": 8952, "public": False, },
-		{ "name": "Local DNS Control (bind9/rndc)", "port": 953, "public": False, },
-		{ "name": "Dovecot LMTP LDA", "port": 10026, "public": False, },
-		{ "name": "Postgrey", "port": 10023, "public": False, },
-		{ "name": "Spamassassin", "port": 10025, "public": False, },
-		{ "name": "OpenDKIM", "port": 8891, "public": False, },
-		{ "name": "OpenDMARC", "port": 8893, "public": False, },
-		{ "name": "Memcached", "port": 11211, "public": False, },
-		{ "name": "Mail-in-a-Box Management Daemon", "port": 10222, "public": False, },
-
-		{ "name": "SSH Login (ssh)", "port": get_ssh_port(), "public": True, },
-		{ "name": "Public DNS (nsd4)", "port": 53, "public": True, },
-		{ "name": "Incoming Mail (SMTP/postfix)", "port": 25, "public": True, },
-		{ "name": "Outgoing Mail (SMTP 587/postfix)", "port": 587, "public": True, },
-		#{ "name": "Postfix/master", "port": 10587, "public": True, },
-		{ "name": "IMAPS (dovecot)", "port": 993, "public": True, },
-		{ "name": "Mail Filters (Sieve/dovecot)", "port": 4190, "public": True, },
-		{ "name": "HTTP Web (nginx)", "port": 80, "public": True, },
-		{ "name": "HTTPS Web (nginx)", "port": 443, "public": True, },
-	]
-
 	all_running = True
 	fatal = False
-	ret = pool.starmap(check_service, ((i, service, env) for i, service in enumerate(services)), chunksize=1)
+	ret = pool.starmap(check_service, ((i, service, env) for i, service in enumerate(get_services())), chunksize=1)
 	for i, running, fatal2, output2 in sorted(ret):
 		if output2 is None: continue # skip check (e.g. no port was set, e.g. no sshd)
 		all_running = all_running and running
@@ -174,25 +173,21 @@ def check_ufw(env, output):
 	ufw = shell('check_output', ['ufw', 'status']).splitlines()
 
 	if ufw[0] == "Status: active":
-		ports_that_should_be_allowed = ["22", "53", "25", "587", "993", "995", "4190", "80", "443"]
-		not_allowed_ports = []
+		not_allowed_ports = 0
+		for service in get_services():
+			if service["public"] and not is_port_allowed(ufw, service["port"]):
+				not_allowed_ports += 1
+				output.print_error("Port %s (%s) should be allowed in the firewall, please re-run the setup." % (service["port"], service["name"]))
 
-		for port in ports_that_should_be_allowed:
-			if not is_port_allowed(ufw, port):
-				not_allowed_ports.append(port)
-		if len(not_allowed_ports) == 1:
-			output.print_error("Port %s should be allowed in the firewall, please rerun the setup." % (not_allowed_ports[0]))
-		elif len(not_allowed_ports) > 1:
-			output.print_error("Ports %s should be allowed in the firewall, please rerun the setup." % (", ".join(not_allowed_ports)))
-		else:
+		if not_allowed_ports == 0:
 			output.print_ok("Firewall is active")
 	else:
-		output.print_warning("""The firewall is disabled on this machine, this might be because the system
-			is protected by an external firewall. We can't protect against bruteforce attacks using fail2ban 
-			without the local firewall active. Via ssh please try to run: ufw enable""")
+		output.print_warning("""The firewall is disabled on this machine. This might be because the system
+			is protected by an external firewall. We can't protect the system against bruteforce attacks
+			without the local firewall active. Connect to the system via ssh and try to run: ufw enable.""")
 
 def is_port_allowed(ufw, port):
-	return any(item.startswith(port) for item in ufw)
+	return any(re.match(str(port) +"[/ \t].*", item) for item in ufw)
 
 def check_ssh_password(env, output):
 	# Check that SSH login with password is disabled. The openssh-server

From 7e0f534aea203a57b06d4c45ef0e9f6ce0fd2695 Mon Sep 17 00:00:00 2001
From: aspdye <aspdye@users.noreply.github.com>
Date: Fri, 8 Apr 2016 14:04:15 +0200
Subject: [PATCH 044/165] Add ownCloud update to changelog

---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b997d16b..cd138c23 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@ CHANGELOG
 In Development
 --------------
 
+ownCloud:
+
+* Update ownCloud to 8.2.3 
+
 Mail:
 
 * Fixed a long-standing issue with training the spam filter not working (because of a file permissions issue).

From 74fea6b93e64407310c7839c79ba81adfc7e0cbd Mon Sep 17 00:00:00 2001
From: aspdye <aspdye@users.noreply.github.com>
Date: Sat, 9 Apr 2016 10:23:20 +0200
Subject: [PATCH 045/165] Hostname as Roundcube Name

---
 setup/webmail.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup/webmail.sh b/setup/webmail.sh
index 053dbacc..50923d87 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -99,7 +99,7 @@ cat > /usr/local/lib/roundcubemail/config/config.inc.php <<EOF;
 \$config['smtp_user'] = '%u';
 \$config['smtp_pass'] = '%p';
 \$config['support_url'] = 'https://mailinabox.email/';
-\$config['product_name'] = 'Mail-in-a-Box/Roundcube Webmail';
+\$config['product_name'] = '$PRIMARY_HOSTNAME Webmail';
 \$config['des_key'] = '$SECRET_KEY';
 \$config['plugins'] = array('html5_notifier', 'archive', 'zipdownload', 'password', 'managesieve', 'jqueryui', 'vacation_sieve', 'persistent_login');
 \$config['skin'] = 'classic';

From f65d9d3196b591612354999db237d97f66115a99 Mon Sep 17 00:00:00 2001
From: aspdye <aspdye@users.noreply.github.com>
Date: Sat, 9 Apr 2016 13:27:27 +0200
Subject: [PATCH 046/165] Upgrade Bootstrap 3.3.5 to 3.3.6

---
 management/templates/index.html | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/management/templates/index.html b/management/templates/index.html
index ef0821fd..3b7cd0c5 100644
--- a/management/templates/index.html
+++ b/management/templates/index.html
@@ -9,7 +9,7 @@
 
         <meta name="robots" content="noindex, nofollow">
 
-        <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css" integrity="sha256-MfvZlkHCEqatNoGiOXveE8FIwMzZg4W85qfrfIFBfYc=" crossorigin="anonymous">
+        <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css" integrity="sha384-1q8mTJOASx8j1Au+a5WDVnPi2lkFfwwEAa8hDDdjZlpLegxhjVME1fgjWPGmkzs7" crossorigin="anonymous">
         <style>
 	    body {
 		overflow-y: scroll;
@@ -63,7 +63,7 @@
 	       margin-bottom: 1em;
 	    }
         </style>
-        <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap-theme.min.css" integrity="sha256-bHQiqcFbnJb1Qhh61RY9cMh6kR0gTuQY6iFOBj1yj00=" crossorigin="anonymous">
+        <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap-theme.min.css" integrity="sha384-fLW2N01lMqjakBkx3l/M9EahuwpSfeNvV63J5ezn3uZzapT0u7EYsXMjQV+0En5r" crossorigin="anonymous">
     </head>
     <body>
 
@@ -192,7 +192,7 @@
         </div>
 
         <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js" integrity="sha256-rsPUGdUPBXgalvIj4YKJrrUlmLXbOb6Cp7cdxn1qeUc=" crossorigin="anonymous"></script>
-        <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/bootstrap.min.js" integrity="sha256-Sk3nkD6mLTMOF0EOpNtsIry+s1CsaqQC1rVLTAy+0yc=" crossorigin="anonymous"></script>
+        <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js" integrity="sha384-0mSbJDEHialfmuBBQP6A4Qrprq5OVfW37PRR3j5ELqxss1yVqOtnepnHVP9aJ7xS" crossorigin="anonymous"></script>
 
         <script>
 var global_modal_state = null;

From d3818d1db6684455403587304e5b96533b16d304 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 13 Apr 2016 18:42:53 -0400
Subject: [PATCH 047/165] changelog entries

---
 CHANGELOG.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cd138c23..dd4fdfec 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,9 +16,16 @@ Control panel:
 
 * Munin system monitoring graphs are now zoomable.
 * When a reboot is required (due to Ubuntu security updates automatically installed), a Reboot Box button now appears.
+* It is now possible to add SRV and secondary MX records in the Custom DNS page.
+* Other minor fixes.
+
+System:
+
+* The fail2ban recidive jail, which blocks long-duration brute force attacks, now no longer sends the administrator emails (which were not helpful).
 
 Setup:
 
+* The system hostname is now set during setup.
 * A swap file is now created if system memory is less than 2GB, 5GB of free disk space is available, and if no swap file yet exists.
 
 v0.17c (April 1, 2016)

From 0ebf33e9df3f5e0aa9b83be34b6b857dd10bf791 Mon Sep 17 00:00:00 2001
From: aspdye <aspdye@users.noreply.github.com>
Date: Sat, 23 Apr 2016 11:35:02 +0200
Subject: [PATCH 048/165] Make clear that Let's Encrypt is reccomended!

---
 management/templates/ssl.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/management/templates/ssl.html b/management/templates/ssl.html
index e9ef5895..5f919f42 100644
--- a/management/templates/ssl.html
+++ b/management/templates/ssl.html
@@ -55,7 +55,7 @@
 
 <h3 id="ssl_install_header">Install Certificate</h3>
 
-<p>There are many places where you can get a free or cheap certificate. We recommend <a href="https://www.namecheap.com/security/ssl-certificates/domain-validation.aspx">Namecheap&rsquo;s $9 certificate</a>, <a href="https://www.startssl.com/">StartSSL&rsquo;s free express lane</a> or <a href="https://buy.wosign.com/free/">WoSign&rsquo;s free TLS</a></a>.</p>
+<p>There are many other places where you can get a free or cheap certificate. If you don't want to use our automatic Let's Encrypt integration, you can give <a href="https://www.namecheap.com/security/ssl-certificates/domain-validation.aspx">Namecheap&rsquo;s $9 certificate</a>, <a href="https://www.startssl.com/">StartSSL&rsquo;s free express lane</a>, <a href="https://buy.wosign.com/free/">WoSign&rsquo;s free TLS</a></a> or any other certificate reseller a try.</p>
 
 <p>Which domain are you getting a certificate for?</p>
 

From 79a39d86f9b8e5549b89fbe966e0a42f822e1849 Mon Sep 17 00:00:00 2001
From: aspdye <aspdye@users.noreply.github.com>
Date: Sat, 23 Apr 2016 15:18:21 +0200
Subject: [PATCH 049/165] reseller -> provider

---
 management/templates/ssl.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/management/templates/ssl.html b/management/templates/ssl.html
index 5f919f42..d7e656c7 100644
--- a/management/templates/ssl.html
+++ b/management/templates/ssl.html
@@ -55,7 +55,7 @@
 
 <h3 id="ssl_install_header">Install Certificate</h3>
 
-<p>There are many other places where you can get a free or cheap certificate. If you don't want to use our automatic Let's Encrypt integration, you can give <a href="https://www.namecheap.com/security/ssl-certificates/domain-validation.aspx">Namecheap&rsquo;s $9 certificate</a>, <a href="https://www.startssl.com/">StartSSL&rsquo;s free express lane</a>, <a href="https://buy.wosign.com/free/">WoSign&rsquo;s free TLS</a></a> or any other certificate reseller a try.</p>
+<p>There are many other places where you can get a free or cheap certificate. If you don't want to use our automatic Let's Encrypt integration, you can give <a href="https://www.namecheap.com/security/ssl-certificates/domain-validation.aspx">Namecheap&rsquo;s $9 certificate</a>, <a href="https://www.startssl.com/">StartSSL&rsquo;s free express lane</a>, <a href="https://buy.wosign.com/free/">WoSign&rsquo;s free TLS</a></a> or any other certificate provider a try.</p>
 
 <p>Which domain are you getting a certificate for?</p>
 

From 8548ede638312dc53490e92215a9f21517c8e273 Mon Sep 17 00:00:00 2001
From: aspdye <aspdye@users.noreply.github.com>
Date: Sun, 24 Apr 2016 12:31:28 +0200
Subject: [PATCH 050/165] Merge pull #806 - Update Roundcube to 1.1.5

---
 CHANGELOG.md     | 3 +++
 setup/webmail.sh | 6 +++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dd4fdfec..b4fa8198 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ ownCloud:
 
 Mail:
 
+* Roundcube is updated to version 1.1.5
 * Fixed a long-standing issue with training the spam filter not working (because of a file permissions issue).
 
 Control panel:
@@ -27,6 +28,8 @@ Setup:
 
 * The system hostname is now set during setup.
 * A swap file is now created if system memory is less than 2GB, 5GB of free disk space is available, and if no swap file yet exists.
+* We now install Roundcube from the official GitHub repository instead of our own mirror, we have created to solve problems with SourceForge.
+
 
 v0.17c (April 1, 2016)
 ----------------------
diff --git a/setup/webmail.sh b/setup/webmail.sh
index 50923d87..e6434555 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -34,8 +34,8 @@ apt-get purge -qq -y roundcube* #NODOC
 # Install Roundcube from source if it is not already present or if it is out of date.
 # Combine the Roundcube version number with the commit hash of vacation_sieve to track
 # whether we have the latest version.
-VERSION=1.1.4
-HASH=4883c8bb39fadf8af94ffb09ee426cba9f8ef2e3
+VERSION=1.1.5
+HASH=8A59D196EF0AA6D9C717B00699215135ABCB99CF
 VACATION_SIEVE_VERSION=91ea6f52216390073d1f5b70b5f6bea0bfaee7e5
 PERSISTENT_LOGIN_VERSION=1e9d724476a370ce917a2fcd5b3217b0c306c24e
 HTML5_NOTIFIER_VERSION=4b370e3cd60dabd2f428a26f45b677ad1b7118d5
@@ -51,7 +51,7 @@ fi
 if [ $needs_update == 1 ]; then
 	# install roundcube
 	wget_verify \
-		https://s3.amazonaws.com/joshdata/mail-in-a-box/public/roundcubemail-$VERSION.tar.gz \
+		https://github.com/roundcube/roundcubemail/releases/download/$VERSION/roundcubemail-$VERSION.tar.gz \
 		$HASH \
 		/tmp/roundcube.tgz
 	tar -C /usr/local/lib --no-same-owner -zxf /tmp/roundcube.tgz

From e7fffc66c73baf25d023469818943dea089ad1b0 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Fri, 6 May 2016 08:51:53 -0400
Subject: [PATCH 051/165] changelog tweaks, fixes #805

---
 CHANGELOG.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b4fa8198..a7bfc445 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,7 +10,7 @@ ownCloud:
 
 Mail:
 
-* Roundcube is updated to version 1.1.5
+* Roundcube is updated to version 1.1.5 and the Roundcube login screen now says "[hostname] Webmail" instead of "Mail-in-a-Box/Roundcube webmail".
 * Fixed a long-standing issue with training the spam filter not working (because of a file permissions issue).
 
 Control panel:
@@ -28,7 +28,7 @@ Setup:
 
 * The system hostname is now set during setup.
 * A swap file is now created if system memory is less than 2GB, 5GB of free disk space is available, and if no swap file yet exists.
-* We now install Roundcube from the official GitHub repository instead of our own mirror, we have created to solve problems with SourceForge.
+* We now install Roundcube from the official GitHub repository instead of our own mirror, which we had previously created to solve problems with SourceForge.
 
 
 v0.17c (April 1, 2016)

From 6d259a6e122abed011210e1de749d3b73626d4c7 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Fri, 6 May 2016 09:06:52 -0400
Subject: [PATCH 052/165] use "127.0.0.1" throughout rather than mixing use of
 an IP address and "localhost"

On some machines localhost is defined as something other than 127.0.0.1, and if we mix "127.0.0.1" and "localhost" then some connections won't be to to the address a service is actually running on.

This was the case with DKIM: It was running on "localhost" but Postfix was connecting to it at 127.0.0.1. (https://discourse.mailinabox.email/t/opendkim-is-not-running-port-8891/1188/12.)

I suppose "localhost" could be an alias to an IPv6 address? We don't really want local services binding on IPv6, so use "127.0.0.1" to be explicit and don't use "localhost" to be sure we get an IPv4 address.

Fixes #797
---
 CHANGELOG.md                      | 2 +-
 conf/zpush/backend_caldav.php     | 2 +-
 conf/zpush/backend_carddav.php    | 2 +-
 conf/zpush/backend_imap.php       | 4 ++--
 management/email_administrator.py | 2 +-
 setup/dkim.sh                     | 2 +-
 setup/owncloud.sh                 | 4 ++--
 setup/start.sh                    | 2 +-
 setup/webmail.sh                  | 6 +++---
 9 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a7bfc445..031801ef 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,7 +29,7 @@ Setup:
 * The system hostname is now set during setup.
 * A swap file is now created if system memory is less than 2GB, 5GB of free disk space is available, and if no swap file yet exists.
 * We now install Roundcube from the official GitHub repository instead of our own mirror, which we had previously created to solve problems with SourceForge.
-
+* DKIM was incorrectly set up on machines where "localhost" was defined as something other than "127.0.0.1".
 
 v0.17c (April 1, 2016)
 ----------------------
diff --git a/conf/zpush/backend_caldav.php b/conf/zpush/backend_caldav.php
index 7bddded9..b10ebc3e 100644
--- a/conf/zpush/backend_caldav.php
+++ b/conf/zpush/backend_caldav.php
@@ -6,7 +6,7 @@
 ************************************************/
 
 define('CALDAV_PROTOCOL', 'https');
-define('CALDAV_SERVER', 'localhost');
+define('CALDAV_SERVER', '127.0.0.1');
 define('CALDAV_PORT', '443');
 define('CALDAV_PATH', '/caldav/calendars/%u/');
 define('CALDAV_PERSONAL', 'PRINCIPAL');
diff --git a/conf/zpush/backend_carddav.php b/conf/zpush/backend_carddav.php
index edf32901..4b166ad5 100644
--- a/conf/zpush/backend_carddav.php
+++ b/conf/zpush/backend_carddav.php
@@ -7,7 +7,7 @@
 
 
 define('CARDDAV_PROTOCOL', 'https'); /* http or https */
-define('CARDDAV_SERVER', 'localhost');
+define('CARDDAV_SERVER', '127.0.0.1');
 define('CARDDAV_PORT', '443');
 define('CARDDAV_PATH', '/carddav/addressbooks/%u/');
 define('CARDDAV_DEFAULT_PATH', '/carddav/addressbooks/%u/contacts/'); /* subdirectory of the main path */
diff --git a/conf/zpush/backend_imap.php b/conf/zpush/backend_imap.php
index 3f69f53e..84dc7358 100644
--- a/conf/zpush/backend_imap.php
+++ b/conf/zpush/backend_imap.php
@@ -5,7 +5,7 @@
 * Descr     :   IMAP backend configuration file
 ************************************************/
 
-define('IMAP_SERVER', 'localhost');
+define('IMAP_SERVER', '127.0.0.1');
 define('IMAP_PORT', 993);
 define('IMAP_OPTIONS', '/ssl/norsh/novalidate-cert');
 define('IMAP_DEFAULTFROM', '');
@@ -44,7 +44,7 @@ define('IMAP_FROM_LDAP_FROM', '#givenname #sn <#mail>');
 define('IMAP_SMTP_METHOD', 'sendmail');
 
 global $imap_smtp_params;
-$imap_smtp_params = array('host' => 'ssl://localhost', 'port' => 587, 'auth' => true, 'username' => 'imap_username', 'password' => 'imap_password');
+$imap_smtp_params = array('host' => 'ssl://127.0.0.1', 'port' => 587, 'auth' => true, 'username' => 'imap_username', 'password' => 'imap_password');
 
 define('MAIL_MIMEPART_CRLF', "\r\n");
 
diff --git a/management/email_administrator.py b/management/email_administrator.py
index 84d27460..b16fda1d 100755
--- a/management/email_administrator.py
+++ b/management/email_administrator.py
@@ -33,7 +33,7 @@ msg['Subject'] = "[%s] %s" % (env['PRIMARY_HOSTNAME'], subject)
 msg.set_payload(content, "UTF-8")
 
 # send
-smtpclient = smtplib.SMTP('localhost', 25)
+smtpclient = smtplib.SMTP('127.0.0.1', 25)
 smtpclient.ehlo()
 smtpclient.sendmail(
         admin_addr, # MAIL FROM
diff --git a/setup/dkim.sh b/setup/dkim.sh
index ed56c765..830e9e18 100755
--- a/setup/dkim.sh
+++ b/setup/dkim.sh
@@ -31,7 +31,7 @@ ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts
 InternalHosts           refile:/etc/opendkim/TrustedHosts
 KeyTable                refile:/etc/opendkim/KeyTable
 SigningTable            refile:/etc/opendkim/SigningTable
-Socket                  inet:8891@localhost
+Socket                  inet:8891@127.0.0.1
 RequireSafeKeys         false
 EOF
 fi
diff --git a/setup/owncloud.sh b/setup/owncloud.sh
index 94dd70b6..cc58a5ca 100755
--- a/setup/owncloud.sh
+++ b/setup/owncloud.sh
@@ -108,12 +108,12 @@ if [ ! -f $STORAGE_ROOT/owncloud/owncloud.db ]; then
   'user_backends' => array(
     array(
       'class'=>'OC_User_IMAP',
-      'arguments'=>array('{localhost:993/imap/ssl/novalidate-cert}')
+      'arguments'=>array('{127.0.0.1:993/imap/ssl/novalidate-cert}')
     )
   ),
   'memcache.local' => '\\OC\\Memcache\\Memcached',
   "memcached_servers" => array (
-    array('localhost', 11211),
+    array('127.0.0.1', 11211),
   ),
   'mail_smtpmode' => 'sendmail',
   'mail_smtpsecure' => '',
diff --git a/setup/start.sh b/setup/start.sh
index 09dc8956..9d19a411 100755
--- a/setup/start.sh
+++ b/setup/start.sh
@@ -112,7 +112,7 @@ source setup/management.sh
 source setup/munin.sh
 
 # Ping the management daemon to write the DNS and nginx configuration files.
-until nc -z -w 4 localhost 10222
+until nc -z -w 4 127.0.0.1 10222
 do
 	echo Waiting for the Mail-in-a-Box management daemon to start...
 	sleep 2
diff --git a/setup/webmail.sh b/setup/webmail.sh
index e6434555..a325b1c4 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -91,10 +91,10 @@ cat > /usr/local/lib/roundcubemail/config/config.inc.php <<EOF;
 \$config['log_dir'] = '/var/log/roundcubemail/';
 \$config['temp_dir'] = '/tmp/roundcubemail/';
 \$config['db_dsnw'] = 'sqlite:///$STORAGE_ROOT/mail/roundcube/roundcube.sqlite?mode=0640';
-\$config['default_host'] = 'ssl://localhost';
+\$config['default_host'] = 'ssl://127.0.0.1';
 \$config['default_port'] = 993;
 \$config['imap_timeout'] = 15;
-\$config['smtp_server'] = 'tls://localhost';
+\$config['smtp_server'] = 'tls://127.0.0.1';
 \$config['smtp_port'] = 587;
 \$config['smtp_user'] = '%u';
 \$config['smtp_pass'] = '%p';
@@ -121,7 +121,7 @@ cat > /usr/local/lib/roundcubemail/plugins/vacation_sieve/config.inc.php <<EOF;
     'transfer' => array(
         'mode' =>  'managesieve',
         'ms_activate_script' => true,
-        'host'   => 'localhost',
+        'host'   => '127.0.0.1',
         'port'   => '4190',
         'usetls' => false,
         'path' => 'vacation',

From ae8cd4efdf1f47c9d39b56566440f3fd5077a1fd Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sun, 24 Apr 2016 18:46:37 -0400
Subject: [PATCH 053/165] support 'dovecot -A' iteration of all users

---
 setup/mail-users.sh | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/setup/mail-users.sh b/setup/mail-users.sh
index e312983e..f9cbdbe5 100755
--- a/setup/mail-users.sh
+++ b/setup/mail-users.sh
@@ -38,17 +38,19 @@ passdb {
   args = /etc/dovecot/dovecot-sql.conf.ext
 }
 userdb {
-  driver = static
-  args = uid=mail gid=mail home=$STORAGE_ROOT/mail/mailboxes/%d/%n
+  driver = sql
+  args = /etc/dovecot/dovecot-sql.conf.ext
 }
 EOF
 
-# Configure the SQL to query for a user's password.
+# Configure the SQL to query for a user's metadata and password.
 cat > /etc/dovecot/dovecot-sql.conf.ext << EOF;
 driver = sqlite
 connect = $db_path
 default_pass_scheme = SHA512-CRYPT
 password_query = SELECT email as user, password FROM users WHERE email='%u';
+user_query = SELECT email AS user, "mail" as uid, "mail" as gid, "$STORAGE_ROOT/mail/mailboxes/%d/%n" as home FROM users;
+iterate_query = SELECT email AS user FROM users;
 EOF
 chmod 0600 /etc/dovecot/dovecot-sql.conf.ext # per Dovecot instructions
 

From 69bd137b4e0993cf3b8a0a16f34a62b235466a09 Mon Sep 17 00:00:00 2001
From: Marc Schiller <m4rc.schiller@gmail.com>
Date: Wed, 11 May 2016 10:11:16 +0200
Subject: [PATCH 054/165] Added a pre-backup script to complement post-backup
 script.

---
 management/backup.py | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/management/backup.py b/management/backup.py
index 2bb499ef..be87a429 100755
--- a/management/backup.py
+++ b/management/backup.py
@@ -2,9 +2,10 @@
 
 # This script performs a backup of all user data:
 # 1) System services are stopped.
-# 2) An incremental encrypted backup is made using duplicity.
-# 3) The stopped services are restarted.
-# 4) STORAGE_ROOT/backup/after-backup is executd if it exists.
+# 2) STORAGE_ROOT/backup/before-backup is executed if it exists.
+# 3) An incremental encrypted backup is made using duplicity.
+# 4) The stopped services are restarted.
+# 5) STORAGE_ROOT/backup/after-backup is executed if it exists.
 
 import os, os.path, shutil, glob, re, datetime, sys
 import dateutil.parser, dateutil.relativedelta, dateutil.tz
@@ -258,6 +259,15 @@ def perform_backup(full_backup):
 	service_command("postfix", "stop", quit=True)
 	service_command("dovecot", "stop", quit=True)
 
+	# Execute a pre-backup script that copies files outside the homedir.
+	# Run as the STORAGE_USER user, not as root. Pass our settings in
+	# environment variables so the script has access to STORAGE_ROOT.
+	pre_script = os.path.join(backup_root, 'before-backup')
+	if os.path.exists(pre_script):
+		shell('check_call',
+			['su', env['STORAGE_USER'], '-c', pre_script, config["target"]],
+			env=env)
+
 	# Run a backup of STORAGE_ROOT (but excluding the backups themselves!).
 	# --allow-source-mismatch is needed in case the box's hostname is changed
 	# after the first backup. See #396.

From 94b7c807927f6a893a59b3bea2057176a8fa0e7a Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sun, 15 May 2016 20:41:31 -0400
Subject: [PATCH 055/165] v0.18

---
 CHANGELOG.md       | 8 ++++----
 README.md          | 2 +-
 setup/bootstrap.sh | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 031801ef..aca3c3fb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,12 +1,12 @@
 CHANGELOG
 =========
 
-In Development
---------------
+v0.18 (May 15, 2016)
+--------------------
 
 ownCloud:
 
-* Update ownCloud to 8.2.3 
+* Updated to ownCloud to 8.2.3 
 
 Mail:
 
@@ -16,7 +16,7 @@ Mail:
 Control panel:
 
 * Munin system monitoring graphs are now zoomable.
-* When a reboot is required (due to Ubuntu security updates automatically installed), a Reboot Box button now appears.
+* When a reboot is required (due to Ubuntu security updates automatically installed), a Reboot Box button now appears on the System Status Checks page of the control panel.
 * It is now possible to add SRV and secondary MX records in the Custom DNS page.
 * Other minor fixes.
 
diff --git a/README.md b/README.md
index a12e48bb..a3f70ca9 100644
--- a/README.md
+++ b/README.md
@@ -59,7 +59,7 @@ by me:
 	$ curl -s https://keybase.io/joshdata/key.asc | gpg --import
 	gpg: key C10BDD81: public key "Joshua Tauberer <jt@occams.info>" imported
 
-	$ git verify-tag v0.17c
+	$ git verify-tag v0.18
 	gpg: Signature made ..... using RSA key ID C10BDD81
 	gpg: Good signature from "Joshua Tauberer <jt@occams.info>"
 	gpg: WARNING: This key is not certified with a trusted signature!
diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh
index 3e793576..3a8e0a9b 100644
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -7,7 +7,7 @@
 #########################################################
 
 if [ -z "$TAG" ]; then
-	TAG=v0.17c
+	TAG=v0.18
 fi
 
 # Are we running as root?

From 1ad5892acde05b01806b79e798fdb684298ff425 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Mon, 16 May 2016 07:14:45 -0400
Subject: [PATCH 056/165] can't change roundcube's default_host setting,
 partially reverts 6d259a6e122abed011210e1de749d3b73626d4c7

The default_host setting is a part of the internal username key. We can't change that without causing Roundcube to create new internal user accounts.
---
 CHANGELOG.md     | 2 ++
 setup/webmail.sh | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index aca3c3fb..a37bd11a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,8 @@ CHANGELOG
 v0.18 (May 15, 2016)
 --------------------
 
+v0.18b was released immediately after fixing a Roundcube user accounts issue.
+
 ownCloud:
 
 * Updated to ownCloud to 8.2.3 
diff --git a/setup/webmail.sh b/setup/webmail.sh
index a325b1c4..a69fdb32 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -91,7 +91,7 @@ cat > /usr/local/lib/roundcubemail/config/config.inc.php <<EOF;
 \$config['log_dir'] = '/var/log/roundcubemail/';
 \$config['temp_dir'] = '/tmp/roundcubemail/';
 \$config['db_dsnw'] = 'sqlite:///$STORAGE_ROOT/mail/roundcube/roundcube.sqlite?mode=0640';
-\$config['default_host'] = 'ssl://127.0.0.1';
+\$config['default_host'] = 'ssl://localhost';
 \$config['default_port'] = 993;
 \$config['imap_timeout'] = 15;
 \$config['smtp_server'] = 'tls://127.0.0.1';

From 867d9c466950b3bc18ce9b803810494851d16775 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Mon, 16 May 2016 07:17:20 -0400
Subject: [PATCH 057/165] v0.18b

---
 README.md          | 2 +-
 setup/bootstrap.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index a3f70ca9..51a5abb5 100644
--- a/README.md
+++ b/README.md
@@ -59,7 +59,7 @@ by me:
 	$ curl -s https://keybase.io/joshdata/key.asc | gpg --import
 	gpg: key C10BDD81: public key "Joshua Tauberer <jt@occams.info>" imported
 
-	$ git verify-tag v0.18
+	$ git verify-tag v0.18b
 	gpg: Signature made ..... using RSA key ID C10BDD81
 	gpg: Good signature from "Joshua Tauberer <jt@occams.info>"
 	gpg: WARNING: This key is not certified with a trusted signature!
diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh
index 3a8e0a9b..674840d7 100644
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -7,7 +7,7 @@
 #########################################################
 
 if [ -z "$TAG" ]; then
-	TAG=v0.18
+	TAG=v0.18b
 fi
 
 # Are we running as root?

From 490b36d86ce1d3fe0a6be0951dbb90c91c7c8a64 Mon Sep 17 00:00:00 2001
From: aspdye <aspdye@users.noreply.github.com>
Date: Wed, 18 May 2016 01:46:10 +0200
Subject: [PATCH 058/165] Fix #819 (#823)

---
 management/templates/users.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/management/templates/users.html b/management/templates/users.html
index 010a1edf..b369fa89 100644
--- a/management/templates/users.html
+++ b/management/templates/users.html
@@ -170,7 +170,7 @@ function users_set_password(elem) {
     yourpw = "<p class='text-danger'>If you change your own password, you will be logged out of this control panel and will need to log in again.</p>";
 
   show_modal_confirm(
-    "Archive User",
+    "Set Password",
     $("<p>Set a new password for <b>" + email + "</b>?</p> <p><label for='users_set_password_pw' style='display: block; font-weight: normal'>New Password:</label><input type='password' id='users_set_password_pw'></p><p><small>Passwords must be at least four characters and may not contain spaces.</small>" + yourpw + "</p>"),
     "Set Password",
     function() {

From ff7d4196a6d6ef3b55bb8667ffc60c63fb036351 Mon Sep 17 00:00:00 2001
From: Arnaud <arnaud.gueneley@gmail.com>
Date: Wed, 18 May 2016 01:46:45 +0200
Subject: [PATCH 059/165] target to blank for munin link in tempalte (#822)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

adding :
target="_blank"
to
<li><a href="/admin/munin">Munin Monitoring</a></li> on line 96
Why ?
Because when you click on munin link, and follow links, you lose your index, or click back many times...
So i propose my pull request.
Et voilà ^^
---
 management/templates/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/management/templates/index.html b/management/templates/index.html
index 3b7cd0c5..09684774 100644
--- a/management/templates/index.html
+++ b/management/templates/index.html
@@ -93,7 +93,7 @@
                 <li class="dropdown-header">Advanced Pages</li>
                 <li><a href="#custom_dns" onclick="return show_panel(this);">Custom DNS</a></li>
                 <li><a href="#external_dns" onclick="return show_panel(this);">External DNS</a></li>
-                <li><a href="/admin/munin">Munin Monitoring</a></li>
+                <li><a href="/admin/munin" target="_blank">Munin Monitoring</a></li>
               </ul>
             </li>
             <li class="dropdown">

From 66675ff2e9635fd6f4d13277dbad105e3d89e55a Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Thu, 2 Jun 2016 07:42:53 -0400
Subject: [PATCH 060/165] Dovecot LMTP accepted all mail regardless of whether
 destination was a user, broken by ae8cd4ef, fixes #852

In the earlier commit, I added a Dovecot userdb lookup. Without a userdb lookup, Dovecot would use the password db for user lookups. With a userdb lookup we can support iterating over users.

But I forgot the WHERE clause in the query, resulting in every incoming message being accepted if the user database contained any users at all. Since the mailbox path template is the same for all users, mail was delivered correctly except that mail that should have been rejected was delivered too.
---
 CHANGELOG.md        | 12 ++++++++++--
 setup/mail-users.sh |  2 +-
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a37bd11a..0b5a1141 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,11 +1,19 @@
 CHANGELOG
 =========
 
+In Development
+--------------
+
+* Domain aliases (and misconfigured aliases/catch-alls with non-existent local targets) would accept mail and deliver it to new mailbox folders on disk, even if the target address didn't correspond with an existing mail user. This issue was introduced in v0.18.
+
+v0.18b (May 16, 2016)
+---------------------
+
+* Fixed a Roundcube user accounts issue introduced in v0.18.
+
 v0.18 (May 15, 2016)
 --------------------
 
-v0.18b was released immediately after fixing a Roundcube user accounts issue.
-
 ownCloud:
 
 * Updated to ownCloud to 8.2.3 
diff --git a/setup/mail-users.sh b/setup/mail-users.sh
index f9cbdbe5..ef9b8118 100755
--- a/setup/mail-users.sh
+++ b/setup/mail-users.sh
@@ -49,7 +49,7 @@ driver = sqlite
 connect = $db_path
 default_pass_scheme = SHA512-CRYPT
 password_query = SELECT email as user, password FROM users WHERE email='%u';
-user_query = SELECT email AS user, "mail" as uid, "mail" as gid, "$STORAGE_ROOT/mail/mailboxes/%d/%n" as home FROM users;
+user_query = SELECT email AS user, "mail" as uid, "mail" as gid, "$STORAGE_ROOT/mail/mailboxes/%d/%n" as home FROM users WHERE email='%u';
 iterate_query = SELECT email AS user FROM users;
 EOF
 chmod 0600 /etc/dovecot/dovecot-sql.conf.ext # per Dovecot instructions

From 6666d28c44d69e10e7f8bfb3896d2d3f5336c2ea Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Thu, 2 Jun 2016 15:47:45 -0400
Subject: [PATCH 061/165] v0.18c

---
 CHANGELOG.md       | 8 +++++---
 README.md          | 4 ++--
 setup/bootstrap.sh | 2 +-
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0b5a1141..18598eb0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,10 +1,12 @@
 CHANGELOG
 =========
 
-In Development
---------------
+v0.18c (June 2, 2016)
+---------------------
 
-* Domain aliases (and misconfigured aliases/catch-alls with non-existent local targets) would accept mail and deliver it to new mailbox folders on disk, even if the target address didn't correspond with an existing mail user. This issue was introduced in v0.18.
+* Domain aliases (and misconfigured aliases/catch-alls with non-existent local targets) would accept mail and deliver it to new mailbox folders on disk even if the target address didn't correspond with an existing mail user, instead of rejecting the mail. This issue was introduced in v0.18.
+* The Munin Monitoring link in the control panel now opens a new window.
+* Added an undocumented before-backup script.
 
 v0.18b (May 16, 2016)
 ---------------------
diff --git a/README.md b/README.md
index 51a5abb5..ad912a28 100644
--- a/README.md
+++ b/README.md
@@ -59,7 +59,7 @@ by me:
 	$ curl -s https://keybase.io/joshdata/key.asc | gpg --import
 	gpg: key C10BDD81: public key "Joshua Tauberer <jt@occams.info>" imported
 
-	$ git verify-tag v0.18b
+	$ git verify-tag v0.18c
 	gpg: Signature made ..... using RSA key ID C10BDD81
 	gpg: Good signature from "Joshua Tauberer <jt@occams.info>"
 	gpg: WARNING: This key is not certified with a trusted signature!
@@ -72,7 +72,7 @@ and on my [personal homepage](https://razor.occams.info/). (Of course, if this r
 
 Checkout the tag corresponding to the most recent release:
 
-	$ git checkout v0.17c
+	$ git checkout v0.18c
 
 Begin the installation.
 
diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh
index 674840d7..8061329b 100644
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -7,7 +7,7 @@
 #########################################################
 
 if [ -z "$TAG" ]; then
-	TAG=v0.18b
+	TAG=v0.18c
 fi
 
 # Are we running as root?

From d5b38a27e643c95b6347f9509d0fbc605fb29424 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Thu, 2 Jun 2016 07:47:32 -0400
Subject: [PATCH 062/165] run roundcube's database migration script on every
 update

There hasn't been a sqlite migration yet, since Mail-in-a-Box's creation, but with Roundcube 1.2 there will be.
---
 setup/webmail.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/setup/webmail.sh b/setup/webmail.sh
index a69fdb32..e6344ccc 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -157,6 +157,12 @@ chmod 775 $STORAGE_ROOT/mail
 chown root.www-data $STORAGE_ROOT/mail/users.sqlite 
 chmod 664 $STORAGE_ROOT/mail/users.sqlite 
 
+# Run Roundcube database migration script, if the database exists (it's created by
+# Roundcube on first use).
+if [ -f $STORAGE_ROOT/mail/roundcube/roundcube.sqlite ]; then
+	/usr/local/lib/roundcubemail/bin/updatedb.sh --dir /usr/local/lib/roundcubemail/SQL --package roundcube
+fi
+
 # Enable PHP modules.
 php5enmod mcrypt
 restart_service php5-fpm

From 61744095a8ed9cdb3997ec41b3e9f8ab80387fe2 Mon Sep 17 00:00:00 2001
From: aspdye <aspdye@users.noreply.github.com>
Date: Tue, 24 May 2016 08:15:51 +0200
Subject: [PATCH 063/165] Update Roundcube to 1.2.0

closes #840
---
 CHANGELOG.md     | 7 +++++++
 setup/webmail.sh | 4 ++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 18598eb0..e3568cd3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,13 @@
 CHANGELOG
 =========
 
+In Development
+--------------
+
+Mail:
+
+* Roundcube is updated to version 1.2.0.
+
 v0.18c (June 2, 2016)
 ---------------------
 
diff --git a/setup/webmail.sh b/setup/webmail.sh
index e6344ccc..bf29c6ab 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -34,8 +34,8 @@ apt-get purge -qq -y roundcube* #NODOC
 # Install Roundcube from source if it is not already present or if it is out of date.
 # Combine the Roundcube version number with the commit hash of vacation_sieve to track
 # whether we have the latest version.
-VERSION=1.1.5
-HASH=8A59D196EF0AA6D9C717B00699215135ABCB99CF
+VERSION=1.2.0
+HASH=2088985fb613b4e4e3373933ca44b26fce0489fb
 VACATION_SIEVE_VERSION=91ea6f52216390073d1f5b70b5f6bea0bfaee7e5
 PERSISTENT_LOGIN_VERSION=1e9d724476a370ce917a2fcd5b3217b0c306c24e
 HTML5_NOTIFIER_VERSION=4b370e3cd60dabd2f428a26f45b677ad1b7118d5

From fac8477ba1f7528ba43de7ac78eba4817a9e4906 Mon Sep 17 00:00:00 2001
From: Chris Blankenship <chris@dscoduc.com>
Date: Tue, 26 Apr 2016 10:49:25 -0700
Subject: [PATCH 064/165] Configured Dovecot to log into its own logfile

---
 conf/fail2ban/jail.local | 1 +
 setup/mail-dovecot.sh    | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/conf/fail2ban/jail.local b/conf/fail2ban/jail.local
index cc741c80..dc338803 100644
--- a/conf/fail2ban/jail.local
+++ b/conf/fail2ban/jail.local
@@ -23,6 +23,7 @@ enabled = true
 filter  = dovecotimap
 findtime = 30
 maxretry = 20
+logpath  = /var/log/mail.log
 
 [recidive]
 enabled  = true
diff --git a/setup/mail-dovecot.sh b/setup/mail-dovecot.sh
index e4fbf16f..2c5533ec 100755
--- a/setup/mail-dovecot.sh
+++ b/setup/mail-dovecot.sh
@@ -38,7 +38,8 @@ apt_install \
 # would be 20 users). Set it to 250 times the number of cores this
 # machine has, so on a two-core machine that's 500 processes/100 users).
 tools/editconf.py /etc/dovecot/conf.d/10-master.conf \
-	default_process_limit=$(echo "`nproc` * 250" | bc)
+	default_process_limit=$(echo "`nproc` * 250" | bc) \
+	log_path=/var/log/mail.log
 
 # The inotify `max_user_instances` default is 128, which constrains
 # the total number of watched (IMAP IDLE push) folders by open connections.

From 01fa8cf72c2123e42e83a615f3c8c90c74a2c55c Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Wed, 13 Apr 2016 17:52:13 -0400
Subject: [PATCH 065/165] add fail2ban jails for ownCloud, postfix submission,
 roundcube, and the Mail-in-a-Box management daemon

(tests squashed into this commit by josh)
---
 CHANGELOG.md                                  |   4 +
 conf/fail2ban/{ => filter.d}/dovecotimap.conf |   0
 .../filter.d/miab-management-daemon.conf      |  12 ++
 conf/fail2ban/filter.d/miab-munin.conf        |   7 +
 conf/fail2ban/filter.d/miab-owncloud.conf     |   7 +
 .../filter.d/miab-postfix-submission.conf     |   7 +
 conf/fail2ban/filter.d/miab-roundcube.conf    |   9 +
 conf/fail2ban/{jail.local => jails.conf}      |  65 ++++--
 management/daemon.py                          |  25 ++-
 setup/owncloud.sh                             |   5 +
 setup/system.sh                               |  10 +-
 tests/fail2ban.py                             | 193 ++++++++++++++++++
 12 files changed, 326 insertions(+), 18 deletions(-)
 rename conf/fail2ban/{ => filter.d}/dovecotimap.conf (100%)
 create mode 100644 conf/fail2ban/filter.d/miab-management-daemon.conf
 create mode 100644 conf/fail2ban/filter.d/miab-munin.conf
 create mode 100644 conf/fail2ban/filter.d/miab-owncloud.conf
 create mode 100644 conf/fail2ban/filter.d/miab-postfix-submission.conf
 create mode 100644 conf/fail2ban/filter.d/miab-roundcube.conf
 rename conf/fail2ban/{jail.local => jails.conf} (58%)
 create mode 100644 tests/fail2ban.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e3568cd3..5e157947 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ Mail:
 
 * Roundcube is updated to version 1.2.0.
 
+System:
+
+* fail2ban jails added for SMTP submission, Roundcube, ownCloud, the control panel, and munin.
+
 v0.18c (June 2, 2016)
 ---------------------
 
diff --git a/conf/fail2ban/dovecotimap.conf b/conf/fail2ban/filter.d/dovecotimap.conf
similarity index 100%
rename from conf/fail2ban/dovecotimap.conf
rename to conf/fail2ban/filter.d/dovecotimap.conf
diff --git a/conf/fail2ban/filter.d/miab-management-daemon.conf b/conf/fail2ban/filter.d/miab-management-daemon.conf
new file mode 100644
index 00000000..0b0489c2
--- /dev/null
+++ b/conf/fail2ban/filter.d/miab-management-daemon.conf
@@ -0,0 +1,12 @@
+# Fail2Ban filter Mail-in-a-Box management daemon
+
+[INCLUDES]
+
+before = common.conf
+
+[Definition]
+
+_daemon = mailinabox
+
+failregex = Mail-in-a-Box Management Daemon: Failed login attempt from ip <HOST> - timestamp .*
+ignoreregex =
diff --git a/conf/fail2ban/filter.d/miab-munin.conf b/conf/fail2ban/filter.d/miab-munin.conf
new file mode 100644
index 00000000..b254cc62
--- /dev/null
+++ b/conf/fail2ban/filter.d/miab-munin.conf
@@ -0,0 +1,7 @@
+[INCLUDES]
+
+before = common.conf
+
+[Definition]
+failregex=<HOST> - .*GET /admin/munin/.* HTTP/1.1\" 401.*
+ignoreregex =
diff --git a/conf/fail2ban/filter.d/miab-owncloud.conf b/conf/fail2ban/filter.d/miab-owncloud.conf
new file mode 100644
index 00000000..a9a13f2c
--- /dev/null
+++ b/conf/fail2ban/filter.d/miab-owncloud.conf
@@ -0,0 +1,7 @@
+[INCLUDES]
+
+before = common.conf
+
+[Definition]
+failregex=Login failed: .*Remote IP: '<HOST>[\)']
+ignoreregex =
diff --git a/conf/fail2ban/filter.d/miab-postfix-submission.conf b/conf/fail2ban/filter.d/miab-postfix-submission.conf
new file mode 100644
index 00000000..236e1331
--- /dev/null
+++ b/conf/fail2ban/filter.d/miab-postfix-submission.conf
@@ -0,0 +1,7 @@
+[INCLUDES]
+
+before = common.conf
+
+[Definition]
+failregex=postfix/submission/smtpd.*warning.*\[<HOST>\]: .* authentication (failed|aborted)
+ignoreregex =
diff --git a/conf/fail2ban/filter.d/miab-roundcube.conf b/conf/fail2ban/filter.d/miab-roundcube.conf
new file mode 100644
index 00000000..c6979c85
--- /dev/null
+++ b/conf/fail2ban/filter.d/miab-roundcube.conf
@@ -0,0 +1,9 @@
+[INCLUDES]
+
+before = common.conf
+
+[Definition]
+
+failregex = IMAP Error: Login failed for .*? from <HOST>\. AUTHENTICATE.*
+
+ignoreregex = 
diff --git a/conf/fail2ban/jail.local b/conf/fail2ban/jails.conf
similarity index 58%
rename from conf/fail2ban/jail.local
rename to conf/fail2ban/jails.conf
index dc338803..7cc90975 100644
--- a/conf/fail2ban/jail.local
+++ b/conf/fail2ban/jails.conf
@@ -1,4 +1,5 @@
-# Fail2Ban configuration file for Mail-in-a-Box
+# Fail2Ban configuration file for Mail-in-a-Box. Do not edit.
+# This file is re-generated on updates.
 
 [DEFAULT]
 # Whitelist our own IP addresses. 127.0.0.1/8 is the default. But our status checks
@@ -6,24 +7,52 @@
 # ours too. The string is substituted during installation.
 ignoreip = 127.0.0.1/8 PUBLIC_IP
 
-# JAILS
-
-[ssh]
-maxretry = 7
-bantime = 3600
-
-[ssh-ddos]
-enabled  = true
-
-[sasl]
-enabled  = true
-
 [dovecot]
 enabled = true
 filter  = dovecotimap
+logpath = /var/log/mail.log
 findtime = 30
 maxretry = 20
+
+[miab-management]
+enabled = true
+filter = miab-management-daemon
+port = http,https
+logpath = /var/log/syslog
+maxretry = 20
+findtime = 30
+
+[miab-munin]
+enabled  = true
+port     = http,https
+filter   = miab-munin
+logpath  = /var/log/nginx/access.log
+maxretry = 20
+findtime = 30
+
+[miab-owncloud]
+enabled  = true
+port     = http,https
+filter   = miab-owncloud
+logpath  = STORAGE_ROOT/owncloud/owncloud.log
+maxretry = 20
+findtime = 30
+
+[miab-postfix587]
+enabled  = true
+port     = 587
+filter   = miab-postfix-submission
 logpath  = /var/log/mail.log
+maxretry = 20
+findtime = 30
+
+[miab-roundcube]
+enabled  = true
+port     = http,https
+filter   = miab-roundcube
+logpath  = /var/log/roundcubemail/errors
+maxretry = 20
+findtime = 30
 
 [recidive]
 enabled  = true
@@ -39,3 +68,13 @@ action   = iptables-allports[name=recidive]
 # By default we don't configure this address and no action is required from the admin anyway.
 # So the notification is ommited. This will prevent message appearing in the mail.log that mail
 # can't be delivered to fail2ban@$HOSTNAME.
+
+[sasl]
+enabled  = true
+
+[ssh]
+maxretry = 7
+bantime = 3600
+
+[ssh-ddos]
+enabled  = true
diff --git a/management/daemon.py b/management/daemon.py
index 5400925f..9bc6429b 100755
--- a/management/daemon.py
+++ b/management/daemon.py
@@ -1,7 +1,8 @@
 #!/usr/bin/python3
 
-import os, os.path, re, json
+import os, os.path, re, json, time
 import subprocess
+
 from functools import wraps
 
 from flask import Flask, request, render_template, abort, Response, send_from_directory, make_response
@@ -45,6 +46,9 @@ def authorized_personnel_only(viewfunc):
 			privs = []
 			error = "Incorrect username or password"
 
+			# Write a line in the log recording the failed login
+			log_failed_login(request)
+
 		# Authorized to access an API view?
 		if "admin" in privs:
 			# Call view func.
@@ -117,6 +121,9 @@ def me():
 	try:
 		email, privs = auth_service.authenticate(request, env)
 	except ValueError as e:
+		# Log the failed login
+		log_failed_login(request)
+
 		return json_response({
 			"status": "invalid",
 			"reason": "Incorrect username or password",
@@ -583,6 +590,22 @@ def munin_cgi(filename):
 		app.logger.warning("munin_cgi: munin-cgi-graph returned 404 status code. PATH_INFO=%s", env['PATH_INFO'])
 	return response
 
+def log_failed_login(request):
+	# We need to figure out the ip to list in the message, all our calls are routed
+	# through nginx who will put the original ip in X-Forwarded-For.
+	# During setup we call the management interface directly to determine the user
+	# status. So we can't always use X-Forwarded-For because during setup that header
+	# will not be present.
+	if request.headers.getlist("X-Forwarded-For"):
+		ip = request.headers.getlist("X-Forwarded-For")[0]
+	else:
+		ip = request.remote_addr
+
+	# We need to add a timestamp to the log message, otherwise /dev/log will eat the "duplicate"
+	# message.
+	app.logger.warning( "Mail-in-a-Box Management Daemon: Failed login attempt from ip %s - timestamp %s" % (ip, time.time()))
+
+
 # APP
 
 if __name__ == '__main__':
diff --git a/setup/owncloud.sh b/setup/owncloud.sh
index cc58a5ca..eb12d5c9 100755
--- a/setup/owncloud.sh
+++ b/setup/owncloud.sh
@@ -163,7 +163,10 @@ fi
 #   so set it here. It also can change if the box's PRIMARY_HOSTNAME changes, so
 #   this will make sure it has the right value.
 # * Some settings weren't included in previous versions of Mail-in-a-Box.
+# * We need to set the timezone to the system timezone to allow fail2ban to ban
+#   users within the proper timeframe
 # Use PHP to read the settings file, modify it, and write out the new settings array.
+TIMEZONE=$(cat /etc/timezone)
 CONFIG_TEMP=$(/bin/mktemp)
 php <<EOF > $CONFIG_TEMP && mv $CONFIG_TEMP $STORAGE_ROOT/owncloud/config.php;
 <?php
@@ -175,6 +178,8 @@ include("$STORAGE_ROOT/owncloud/config.php");
 \$CONFIG['overwrite.cli.url'] = '/cloud';
 \$CONFIG['mail_from_address'] = 'administrator'; # just the local part, matches our master administrator address
 
+\$CONFIG['logtimezone'] = '$TIMEZONE';
+
 echo "<?php\n\\\$CONFIG = ";
 var_export(\$CONFIG);
 echo ";";
diff --git a/setup/system.sh b/setup/system.sh
index cc152524..d9f84fda 100755
--- a/setup/system.sh
+++ b/setup/system.sh
@@ -291,10 +291,12 @@ restart_service resolvconf
 
 # ### Fail2Ban Service
 
-# Configure the Fail2Ban installation to prevent dumb bruce-force attacks against dovecot, postfix and ssh
-cat conf/fail2ban/jail.local \
+# Configure the Fail2Ban installation to prevent dumb bruce-force attacks against dovecot, postfix, ssh, etc.
+rm -f /etc/fail2ban/jail.local # we used to use this file but don't anymore
+cat conf/fail2ban/jails.conf \
 	| sed "s/PUBLIC_IP/$PUBLIC_IP/g" \
-	> /etc/fail2ban/jail.local
-cp conf/fail2ban/dovecotimap.conf /etc/fail2ban/filter.d/dovecotimap.conf
+	| sed "s#STORAGE_ROOT#$STORAGE_ROOT#" \
+	> /etc/fail2ban/jail.d/mailinabox.conf
+cp -f conf/fail2ban/filter.d/* /etc/fail2ban/filter.d/
 
 restart_service fail2ban
diff --git a/tests/fail2ban.py b/tests/fail2ban.py
new file mode 100644
index 00000000..f4b48293
--- /dev/null
+++ b/tests/fail2ban.py
@@ -0,0 +1,193 @@
+# Test that a box's fail2ban setting are working
+# correctly by attempting a bunch of failed logins.
+# Specify SSH login information the command line -
+# we use that to reset fail2ban after each test,
+# and we extract the hostname from that to open
+# connections to.
+######################################################################
+
+import sys, os, time, functools
+
+# parse command line
+
+if len(sys.argv) < 2:
+	print("Usage: tests/fail2ban.py user@hostname")
+	sys.exit(1)
+
+ssh_user, hostname = sys.argv[1].split("@", 1)
+
+# define some test types
+
+import socket
+socket.setdefaulttimeout(10)
+
+class IsBlocked(Exception):
+	"""Tests raise this exception when it appears that a fail2ban
+	jail is in effect, i.e. on a connection refused error."""
+	pass
+
+def smtp_test():
+	import smtplib
+
+	try:
+		server = smtplib.SMTP(hostname, 587)
+	except ConnectionRefusedError:
+		# looks like fail2ban worked
+		raise IsBlocked()
+	server.starttls()
+	server.ehlo_or_helo_if_needed()
+
+	try:
+		server.login("fakeuser", "fakepassword")
+		raise Exception("authentication didn't fail")
+	except smtplib.SMTPAuthenticationError:
+		# athentication should fail
+		pass
+
+	try:
+		server.quit()
+	except:
+		# ignore errors here
+		pass
+
+def imap_test():
+	import imaplib
+
+	try:
+		M = imaplib.IMAP4_SSL(hostname)
+	except ConnectionRefusedError:
+		# looks like fail2ban worked
+		raise IsBlocked()
+
+	try:
+		M.login("fakeuser", "fakepassword")
+		raise Exception("authentication didn't fail")
+	except imaplib.IMAP4.error:
+		# authentication should fail
+		pass
+	finally:
+		M.logout() # shuts down connection, has nothing to do with login()
+
+def http_test(url, expected_status, postdata=None, qsargs=None, auth=None):
+	import urllib.parse
+	import requests
+	from requests.auth import HTTPBasicAuth
+
+	# form request
+	url = urllib.parse.urljoin("https://" + hostname, url)
+	if qsargs: url += "?" + urllib.parse.urlencode(qsargs)
+	urlopen = requests.get if not postdata else requests.post
+
+	try:
+		# issue request
+		r = urlopen(
+			url,
+			auth=HTTPBasicAuth(*auth) if auth else None,
+			data=postdata,
+			headers={'User-Agent': 'Mail-in-a-Box fail2ban tester'},
+			timeout=4)
+	except requests.exceptions.ConnectionError as e:
+		if "Connection refused" in str(e):
+			raise IsBlocked()
+		raise # some other unexpected condition
+
+	# return response status code
+	if r.status_code != expected_status:
+		r.raise_for_status() # anything but 200
+		raise IOError("Got unexpected status code %s." % r.status_code)
+
+# define how to run a test
+
+def restart_fail2ban_service(final=False):
+	# Log in over SSH to restart fail2ban.
+	command = "sudo fail2ban-client reload"
+	if not final:
+		# Stop recidive jails during testing.
+		command += " && sudo fail2ban-client stop recidive"
+	os.system("ssh %s@%s \"%s\"" % (ssh_user, hostname, command))
+
+def testfunc_runner(i, testfunc, *args):
+	print(i+1, end=" ", flush=True)
+	testfunc(*args)
+
+def run_test(testfunc, args, count, within_seconds, parallel):
+	# Run testfunc count times in within_seconds seconds (and actually
+	# within a little less time so we're sure we're under the limit).
+	#
+	# Because some services are slow, like IMAP, we can't necessarily
+	# run testfunc sequentially and still get to count requests within
+	# the required time. So we split the requests across threads.
+
+	import requests.exceptions
+	from multiprocessing import Pool
+
+	restart_fail2ban_service()
+
+	# Log.
+	print(testfunc.__name__, " ".join(str(a) for a in args), "...")
+
+	# Record the start time so we can know how to evenly space our
+	# calls to testfunc.
+	start_time = time.time()
+
+	with Pool(parallel) as p:
+		# Distribute the requests across the pool.
+		asyncresults = []
+		for i in range(count):
+			ar = p.apply_async(testfunc_runner, [i, testfunc] + list(args))
+			asyncresults.append(ar)
+
+		# Wait for all runs to finish.
+		p.close()
+		p.join()
+
+		# Check for errors.
+		for ar in asyncresults:
+			try:
+				ar.get()
+			except IsBlocked:
+				print("Test machine prematurely blocked!")
+				return False
+
+	# Did we make enough requests within the limit?
+	if (time.time()-start_time) > within_seconds:
+		raise Exception("Test failed to make %s requests in %d seconds." % (count, within_seconds))
+
+	# Wait a moment for the block to be put into place.
+	time.sleep(4)
+
+	# The next call should fail.
+	print("*", end=" ", flush=True)
+	try:
+		testfunc(*args)
+	except IsBlocked:
+		# Success -- this one is supposed to be refused.
+		print("blocked [OK]")
+		return True # OK
+
+	print("not blocked!")
+	return False
+
+######################################################################
+
+if __name__ == "__main__":
+	# run tests
+
+	# SMTP bans at 10 even though we say 20 in the config because we get
+	# doubled-up warnings in the logs, we'll let that be for now
+	run_test(smtp_test, [], 10, 30, 8)
+
+	# IMAP
+	run_test(imap_test, [], 20, 30, 4)
+
+	# Mail-in-a-Box contorl panel
+	run_test(http_test, ["/admin/me", 200], 20, 30, 1)
+
+	# Munin via the Mail-in-a-Box contorl panel
+	run_test(http_test, ["/admin/munin/", 401], 20, 30, 1)
+
+	# ownCloud
+	run_test(http_test, ["/cloud/remote.php/caldav/calendars/user@domain/personal", 401], 20, 30, 1)
+
+	# restart fail2ban so that this client machine is no longer blocked
+	restart_fail2ban_service(final=True)

From 946cd63e8ec05d6b4b975f1556ce1895ee463cd2 Mon Sep 17 00:00:00 2001
From: Rinze <git@elit.nl>
Date: Fri, 10 Jun 2016 10:32:32 +0200
Subject: [PATCH 066/165] Mail log management script cleanup

---
 management/mail_log.py | 245 ++++++++++++++++++++++++-----------------
 1 file changed, 146 insertions(+), 99 deletions(-)

diff --git a/management/mail_log.py b/management/mail_log.py
index 22fb87af..8e6fec60 100755
--- a/management/mail_log.py
+++ b/management/mail_log.py
@@ -1,136 +1,183 @@
 #!/usr/bin/python3
 
+import os.path
+import re
 from collections import defaultdict
-import re, os.path
+
 import dateutil.parser
 
 import mailconfig
 import utils
 
+
 def scan_mail_log(logger, env):
-	collector = {
-		"other-services": set(),
-		"imap-logins": { },
-		"postgrey": { },
-		"rejected-mail": { },
-		"activity-by-hour": { "imap-logins": defaultdict(int), "smtp-sends": defaultdict(int) },
-	}
+    """ Scan the system's mail log files and collect interesting data
 
-	collector["real_mail_addresses"] = set(mailconfig.get_mail_users(env)) | set(alias[0] for alias in mailconfig.get_mail_aliases(env))
+    This function scans the 2 most recent mail log files in /var/log/.
 
-	for fn in ('/var/log/mail.log.1', '/var/log/mail.log'):
-		if not os.path.exists(fn): continue
-		with open(fn, 'rb') as log:
-			for line in log:
-				line = line.decode("utf8", errors='replace')
-				scan_mail_log_line(line.strip(), collector)
+    Args:
+        logger (ConsoleOutput): Object used for writing messages to the console
+        env (dict): Dictionary containing MiaB settings
+    """
 
-	if collector["imap-logins"]:
-		logger.add_heading("Recent IMAP Logins")
-		logger.print_block("The most recent login from each remote IP adddress is show.")
-		for k in utils.sort_email_addresses(collector["imap-logins"], env):
-			for ip, date in sorted(collector["imap-logins"][k].items(), key = lambda kv : kv[1]):
-				logger.print_line(k + "\t" + str(date) + "\t" + ip)
+    collector = {
+        "other-services": set(),
+        "imap-logins": {},
+        "postgrey": {},
+        "rejected-mail": {},
+        "activity-by-hour": {
+            "imap-logins": defaultdict(int),
+            "smtp-sends": defaultdict(int),
+        },
+        "real_mail_addresses": (
+            set(mailconfig.get_mail_users(env)) | set(alias[0] for alias in mailconfig.get_mail_aliases(env))
+        )
+    }
 
-	if collector["postgrey"]:
-		logger.add_heading("Greylisted Mail")
-		logger.print_block("The following mail was greylisted, meaning the emails were temporarily rejected. Legitimate senders will try again within ten minutes.")
-		logger.print_line("recipient" + "\t" + "received" + "\t" + "sender" + "\t" + "delivered")
-		for recipient in utils.sort_email_addresses(collector["postgrey"], env):
-			for (client_address, sender), (first_date, delivered_date) in sorted(collector["postgrey"][recipient].items(), key = lambda kv : kv[1][0]):
-				logger.print_line(recipient + "\t" + str(first_date) + "\t" + sender + "\t" + (("delivered " + str(delivered_date)) if delivered_date else "no retry yet"))
+    for fn in ('/var/log/mail.log.1', '/var/log/mail.log'):
+        if not os.path.exists(fn):
+            continue
+        with open(fn, 'rb') as log:
+            for line in log:
+                line = line.decode("utf8", errors='replace')
+                scan_mail_log_line(line.strip(), collector)
 
-	if collector["rejected-mail"]:
-		logger.add_heading("Rejected Mail")
-		logger.print_block("The following incoming mail was rejected.")
-		for k in utils.sort_email_addresses(collector["rejected-mail"], env):
-			for date, sender, message in collector["rejected-mail"][k]:
-				logger.print_line(k + "\t" + str(date) + "\t" + sender + "\t" + message)
+    if collector["imap-logins"]:
+        logger.add_heading("Recent IMAP Logins")
+        logger.print_block("The most recent login from each remote IP adddress is shown")
+        for k in utils.sort_email_addresses(collector["imap-logins"], env):
+            for ip, date in sorted(collector["imap-logins"][k].items(), key=lambda kv: kv[1]):
+                logger.print_line(k + "\t" + str(date) + "\t" + ip)
 
-	logger.add_heading("Activity by Hour")
-	for h in range(24):
-		logger.print_line("%d\t%d\t%d" % (h, collector["activity-by-hour"]["imap-logins"][h], collector["activity-by-hour"]["smtp-sends"][h] ))
+    if collector["postgrey"]:
+        logger.add_heading("Greylisted Mail")
+        logger.print_block("The following mail was greylisted, meaning the emails were temporarily rejected. "
+                           "Legitimate senders will try again within ten minutes.")
+        logger.print_line("recipient" + "\t" + "received" + 3 * "\t" + "sender" + 6 * "\t" + "delivered")
+        for recipient in utils.sort_email_addresses(collector["postgrey"], env):
+            sorted_recipients = sorted(collector["postgrey"][recipient].items(), key=lambda kv: kv[1][0])
+            for (client_address, sender), (first_date, delivered_date) in sorted_recipients:
+                logger.print_line(
+                    recipient + "\t" + str(first_date) + "\t" + sender + "\t" +
+                    (("delivered " + str(delivered_date)) if delivered_date else "no retry yet")
+                )
+
+    if collector["rejected-mail"]:
+        logger.add_heading("Rejected Mail")
+        logger.print_block("The following incoming mail was rejected.")
+        for k in utils.sort_email_addresses(collector["rejected-mail"], env):
+            for date, sender, message in collector["rejected-mail"][k]:
+                logger.print_line(k + "\t" + str(date) + "\t" + sender + "\t" + message)
+
+    logger.add_heading("Activity by Hour")
+    for h in range(24):
+        logger.print_line(
+            "%d\t%d\t%d" % (
+                h,
+                collector["activity-by-hour"]["imap-logins"][h],
+                collector["activity-by-hour"]["smtp-sends"][h]
+            )
+        )
+
+    if len(collector["other-services"]) > 0:
+        logger.add_heading("Other")
+        logger.print_block("Unrecognized services in the log: " + ", ".join(collector["other-services"]))
 
-	if len(collector["other-services"]) > 0:
-		logger.add_heading("Other")
-		logger.print_block("Unrecognized services in the log: " + ", ".join(collector["other-services"]))
 
 def scan_mail_log_line(line, collector):
-	m = re.match(r"(\S+ \d+ \d+:\d+:\d+) (\S+) (\S+?)(\[\d+\])?: (.*)", line)
-	if not m: return
+    """ Scan a log line and extract interesting data """
 
-	date, system, service, pid, log = m.groups()
-	date = dateutil.parser.parse(date)
-	
-	if service == "dovecot":
-		scan_dovecot_line(date, log, collector)
+    m = re.match(r"(\S+ \d+ \d+:\d+:\d+) (\S+) (\S+?)(\[\d+\])?: (.*)", line)
 
-	elif service == "postgrey":
-		scan_postgrey_line(date, log, collector)
+    if not m:
+        return
 
-	elif service == "postfix/smtpd":
-		scan_postfix_smtpd_line(date, log, collector)
+    date, system, service, pid, log = m.groups()
+    date = dateutil.parser.parse(date)
 
-	elif service == "postfix/submission/smtpd":
-		scan_postfix_submission_line(date, log, collector)
+    if service == "dovecot":
+        scan_dovecot_line(date, log, collector)
+    elif service == "postgrey":
+        scan_postgrey_line(date, log, collector)
+    elif service == "postfix/smtpd":
+        scan_postfix_smtpd_line(date, log, collector)
+    elif service == "postfix/submission/smtpd":
+        scan_postfix_submission_line(date, log, collector)
+    elif service in ("postfix/qmgr", "postfix/pickup", "postfix/cleanup", "postfix/scache", "spampd", "postfix/anvil",
+                     "postfix/master", "opendkim", "postfix/lmtp", "postfix/tlsmgr"):
+        # nothing to look at
+        pass
+    else:
+        collector["other-services"].add(service)
 
-	elif service in ("postfix/qmgr", "postfix/pickup", "postfix/cleanup",
-			"postfix/scache", "spampd", "postfix/anvil", "postfix/master",
-			"opendkim", "postfix/lmtp", "postfix/tlsmgr"):
-		# nothing to look at
-		pass
 
-	else:
-		collector["other-services"].add(service)
+def scan_dovecot_line(date, line, collector):
+    """ Scan a dovecot log line and extract interesting data """
+
+    m = re.match("imap-login: Login: user=<(.*?)>, method=PLAIN, rip=(.*?),", line)
+
+    if m:
+        login, ip = m.group(1), m.group(2)
+        if ip != "127.0.0.1":  # local login from webmail/zpush
+            collector["imap-logins"].setdefault(login, {})[ip] = date
+        collector["activity-by-hour"]["imap-logins"][date.hour] += 1
 
-def scan_dovecot_line(date, log, collector):
-	m = re.match("imap-login: Login: user=<(.*?)>, method=PLAIN, rip=(.*?),", log)
-	if m:
-		login, ip = m.group(1), m.group(2)
-		if ip != "127.0.0.1": # local login from webmail/zpush
-			collector["imap-logins"].setdefault(login, {})[ip] = date
-		collector["activity-by-hour"]["imap-logins"][date.hour] += 1
 
 def scan_postgrey_line(date, log, collector):
-	m = re.match("action=(greylist|pass), reason=(.*?), (?:delay=\d+, )?client_name=(.*), client_address=(.*), sender=(.*), recipient=(.*)", log)
-	if m:
-		action, reason, client_name, client_address, sender, recipient = m.groups()
-		key = (client_address, sender)
-		if action == "greylist" and reason == "new":
-			collector["postgrey"].setdefault(recipient, {})[key] = (date, None)
-		elif action == "pass" and reason == "triplet found" and key in collector["postgrey"].get(recipient, {}):
-			collector["postgrey"][recipient][key] = (collector["postgrey"][recipient][key][0], date)
+    """ Scan a postgrey log line and extract interesting data """
+
+    m = re.match("action=(greylist|pass), reason=(.*?), (?:delay=\d+, )?client_name=(.*), client_address=(.*), "
+                 "sender=(.*), recipient=(.*)",
+                 log)
+
+    if m:
+        action, reason, client_name, client_address, sender, recipient = m.groups()
+        key = (client_address, sender)
+        if action == "greylist" and reason == "new":
+            collector["postgrey"].setdefault(recipient, {})[key] = (date, None)
+        elif action == "pass" and reason == "triplet found" and key in collector["postgrey"].get(recipient, {}):
+            collector["postgrey"][recipient][key] = (collector["postgrey"][recipient][key][0], date)
+
 
 def scan_postfix_smtpd_line(date, log, collector):
-	m = re.match("NOQUEUE: reject: RCPT from .*?: (.*?); from=<(.*?)> to=<(.*?)>", log)
-	if m:
-		message, sender, recipient = m.groups()
-		if recipient in collector["real_mail_addresses"]:
-			# only log mail to real recipients
+    """ Scan a postfix smtpd log line and extract interesting data """
 
-			# skip this, is reported in the greylisting report
-			if "Recipient address rejected: Greylisted" in message:
-				return
+    m = re.match("NOQUEUE: reject: RCPT from .*?: (.*?); from=<(.*?)> to=<(.*?)>", log)
 
-			# simplify this one
-			m = re.search(r"Client host \[(.*?)\] blocked using zen.spamhaus.org; (.*)", message)
-			if m:
-				message = "ip blocked: " + m.group(2)
+    if m:
+        message, sender, recipient = m.groups()
+        if recipient in collector["real_mail_addresses"]:
+            # only log mail to real recipients
 
-			# simplify this one too
-			m = re.search(r"Sender address \[.*@(.*)\] blocked using dbl.spamhaus.org; (.*)", message)
-			if m:
-				message = "domain blocked: " + m.group(2)
+            # skip this, is reported in the greylisting report
+            if "Recipient address rejected: Greylisted" in message:
+                return
+
+            # simplify this one
+            m = re.search(r"Client host \[(.*?)\] blocked using zen.spamhaus.org; (.*)", message)
+            if m:
+                message = "ip blocked: " + m.group(2)
+
+            # simplify this one too
+            m = re.search(r"Sender address \[.*@(.*)\] blocked using dbl.spamhaus.org; (.*)", message)
+            if m:
+                message = "domain blocked: " + m.group(2)
+
+            collector["rejected-mail"].setdefault(recipient, []).append((date, sender, message))
 
-			collector["rejected-mail"].setdefault(recipient, []).append( (date, sender, message) )
 
 def scan_postfix_submission_line(date, log, collector):
-	m = re.match("([A-Z0-9]+): client=(\S+), sasl_method=PLAIN, sasl_username=(\S+)", log)
-	if m:
-		procid, client, user = m.groups()
-		collector["activity-by-hour"]["smtp-sends"][date.hour] += 1
+    """ Scan a postfix submission log line and extract interesting data """
+
+    m = re.match("([A-Z0-9]+): client=(\S+), sasl_method=PLAIN, sasl_username=(\S+)", log)
+
+    if m:
+        # procid, client, user = m.groups()
+        collector["activity-by-hour"]["smtp-sends"][date.hour] += 1
+
 
 if __name__ == "__main__":
-	from status_checks import ConsoleOutput
-	env = utils.load_environment()
-	scan_mail_log(ConsoleOutput(), env)
+    from status_checks import ConsoleOutput
+
+    env_vars = utils.load_environment()
+    scan_mail_log(ConsoleOutput(), env_vars)

From ae1b56d23fe6c7f607cfe453dfbe861f95bf3805 Mon Sep 17 00:00:00 2001
From: Rinze <git@elit.nl>
Date: Fri, 10 Jun 2016 11:19:03 +0200
Subject: [PATCH 067/165] Added POP3 support to mail log management script

---
 management/mail_log.py | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/management/mail_log.py b/management/mail_log.py
index 8e6fec60..427b8905 100755
--- a/management/mail_log.py
+++ b/management/mail_log.py
@@ -23,10 +23,12 @@ def scan_mail_log(logger, env):
     collector = {
         "other-services": set(),
         "imap-logins": {},
+        "pop3-logins": {},
         "postgrey": {},
         "rejected-mail": {},
         "activity-by-hour": {
             "imap-logins": defaultdict(int),
+            "pop3-logins": defaultdict(int),
             "smtp-sends": defaultdict(int),
         },
         "real_mail_addresses": (
@@ -44,11 +46,18 @@ def scan_mail_log(logger, env):
 
     if collector["imap-logins"]:
         logger.add_heading("Recent IMAP Logins")
-        logger.print_block("The most recent login from each remote IP adddress is shown")
+        logger.print_block("The most recent login from each remote IP adddress is shown.")
         for k in utils.sort_email_addresses(collector["imap-logins"], env):
             for ip, date in sorted(collector["imap-logins"][k].items(), key=lambda kv: kv[1]):
                 logger.print_line(k + "\t" + str(date) + "\t" + ip)
 
+    if collector["pop3-logins"]:
+        logger.add_heading("Recent POP3 Logins")
+        logger.print_block("The most recent login from each remote IP adddress is shown.")
+        for k in utils.sort_email_addresses(collector["pop3-logins"], env):
+            for ip, date in sorted(collector["pop3-logins"][k].items(), key=lambda kv: kv[1]):
+                logger.print_line(k + "\t" + str(date) + "\t" + ip)
+
     if collector["postgrey"]:
         logger.add_heading("Greylisted Mail")
         logger.print_block("The following mail was greylisted, meaning the emails were temporarily rejected. "
@@ -70,11 +79,14 @@ def scan_mail_log(logger, env):
                 logger.print_line(k + "\t" + str(date) + "\t" + sender + "\t" + message)
 
     logger.add_heading("Activity by Hour")
+    logger.print_block("Logins and sent mail per hour.")
+    logger.print_block("Hour\tIMAP\tPOP3\tSent")
     for h in range(24):
         logger.print_line(
-            "%d\t%d\t%d" % (
+            "%d\t%d\t\t%d\t\t%d" % (
                 h,
                 collector["activity-by-hour"]["imap-logins"][h],
+                collector["activity-by-hour"]["pop3-logins"][h],
                 collector["activity-by-hour"]["smtp-sends"][h]
             )
         )
@@ -114,13 +126,14 @@ def scan_mail_log_line(line, collector):
 def scan_dovecot_line(date, line, collector):
     """ Scan a dovecot log line and extract interesting data """
 
-    m = re.match("imap-login: Login: user=<(.*?)>, method=PLAIN, rip=(.*?),", line)
+    m = re.match("(imap|pop3)-login: Login: user=<(.*?)>, method=PLAIN, rip=(.*?),", line)
 
     if m:
-        login, ip = m.group(1), m.group(2)
+        prot, login, ip = m.group(1), m.group(2), m.group(3)
+        logins_key = "%s-logins" % prot
         if ip != "127.0.0.1":  # local login from webmail/zpush
-            collector["imap-logins"].setdefault(login, {})[ip] = date
-        collector["activity-by-hour"]["imap-logins"][date.hour] += 1
+            collector[logins_key].setdefault(login, {})[ip] = date
+        collector["activity-by-hour"][logins_key][date.hour] += 1
 
 
 def scan_postgrey_line(date, log, collector):

From 1c84e0aeb65e7a557d003972e3660148af416750 Mon Sep 17 00:00:00 2001
From: Rinze <git@elit.nl>
Date: Fri, 10 Jun 2016 13:08:57 +0200
Subject: [PATCH 068/165] Added received mail count to hourly activity overview
 in mail log management script

---
 management/mail_log.py | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/management/mail_log.py b/management/mail_log.py
index 427b8905..0a9d5099 100755
--- a/management/mail_log.py
+++ b/management/mail_log.py
@@ -30,6 +30,7 @@ def scan_mail_log(logger, env):
             "imap-logins": defaultdict(int),
             "pop3-logins": defaultdict(int),
             "smtp-sends": defaultdict(int),
+            "smtp-receives": defaultdict(int),
         },
         "real_mail_addresses": (
             set(mailconfig.get_mail_users(env)) | set(alias[0] for alias in mailconfig.get_mail_aliases(env))
@@ -79,15 +80,16 @@ def scan_mail_log(logger, env):
                 logger.print_line(k + "\t" + str(date) + "\t" + sender + "\t" + message)
 
     logger.add_heading("Activity by Hour")
-    logger.print_block("Logins and sent mail per hour.")
-    logger.print_block("Hour\tIMAP\tPOP3\tSent")
+    logger.print_block("Dovecot logins and Postfix mail traffic per hour.")
+    logger.print_block("Hour\tIMAP\tPOP3\tSent\tReceived")
     for h in range(24):
         logger.print_line(
-            "%d\t%d\t\t%d\t\t%d" % (
+            "%d\t%d\t\t%d\t\t%d\t\t%d" % (
                 h,
                 collector["activity-by-hour"]["imap-logins"][h],
                 collector["activity-by-hour"]["pop3-logins"][h],
-                collector["activity-by-hour"]["smtp-sends"][h]
+                collector["activity-by-hour"]["smtp-sends"][h],
+                collector["activity-by-hour"]["smtp-receives"][h],
             )
         )
 
@@ -113,6 +115,8 @@ def scan_mail_log_line(line, collector):
         scan_postgrey_line(date, log, collector)
     elif service == "postfix/smtpd":
         scan_postfix_smtpd_line(date, log, collector)
+    elif service == "postfix/cleanup":
+        scan_postfix_cleanup_line(date, log, collector)
     elif service == "postfix/submission/smtpd":
         scan_postfix_submission_line(date, log, collector)
     elif service in ("postfix/qmgr", "postfix/pickup", "postfix/cleanup", "postfix/scache", "spampd", "postfix/anvil",
@@ -155,6 +159,8 @@ def scan_postgrey_line(date, log, collector):
 def scan_postfix_smtpd_line(date, log, collector):
     """ Scan a postfix smtpd log line and extract interesting data """
 
+    # Check if the incomming mail was rejected
+
     m = re.match("NOQUEUE: reject: RCPT from .*?: (.*?); from=<(.*?)> to=<(.*?)>", log)
 
     if m:
@@ -162,7 +168,7 @@ def scan_postfix_smtpd_line(date, log, collector):
         if recipient in collector["real_mail_addresses"]:
             # only log mail to real recipients
 
-            # skip this, is reported in the greylisting report
+            # skip this, if reported in the greylisting report
             if "Recipient address rejected: Greylisted" in message:
                 return
 
@@ -179,6 +185,15 @@ def scan_postfix_smtpd_line(date, log, collector):
             collector["rejected-mail"].setdefault(recipient, []).append((date, sender, message))
 
 
+def scan_postfix_cleanup_line(date, _, collector):
+    """ Scan a postfix cleanup log line and extract interesting data
+
+    It is assumed that every log of postfix/cleanup indicates an email that was successfulfy received by Postfix.
+
+    """
+
+    collector["activity-by-hour"]["smtp-receives"][date.hour] += 1
+
 def scan_postfix_submission_line(date, log, collector):
     """ Scan a postfix submission log line and extract interesting data """
 

From 3055f9a79c138c930dc2758444df5daa3d313d54 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sun, 12 Jun 2016 08:50:31 -0400
Subject: [PATCH 069/165] drop SSLv3, RC4 ciphers from SMTP port 25

Per http://googleappsupdates.blogspot.ro/2016/05/disabling-support-for-sslv3-and-rc4-for.html, Google is about to do the same.

fixes #611
---
 CHANGELOG.md          |   1 +
 security.md           |   2 +-
 setup/mail-postfix.sh |   3 +-
 tests/tls_results.txt | 111 ++++++++++++++++--------------------------
 4 files changed, 45 insertions(+), 72 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e3568cd3..a09110cf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@ In Development
 Mail:
 
 * Roundcube is updated to version 1.2.0.
+* SSLv3 and RC4 are now no longer supported in incoming and outgoing mail (SMTP port 25).
 
 v0.18c (June 2, 2016)
 ---------------------
diff --git a/security.md b/security.md
index 3616a5fd..a196441f 100644
--- a/security.md
+++ b/security.md
@@ -101,7 +101,7 @@ Incoming Mail
 
 ### Encryption
 
-As discussed above, there is no way to require on-the-wire encryption of mail. When the box receives an incoming email (SMTP on port 25), it offers encryption (STARTTLS) but cannot require that senders use it because some senders may not support STARTTLS at all and other senders may support STARTTLS but not with the latest protocols/ciphers. To give senders the best chance at making use of encryption, the box offers protocols back to SSLv3 and ciphers with key lengths as low as 112 bits. Modern clients (senders) will make use of the 256-bit ciphers and Diffie-Hellman ciphers with a 2048-bit key for forward secrecy, however. ([source](setup/mail-postfix.sh))
+As discussed above, there is no way to require on-the-wire encryption of mail. When the box receives an incoming email (SMTP on port 25), it offers encryption (STARTTLS) but cannot require that senders use it because some senders may not support STARTTLS at all and other senders may support STARTTLS but not with the latest protocols/ciphers. To give senders the best chance at making use of encryption, the box offers protocols back to TLSv1 and ciphers with key lengths as low as 112 bits. Modern clients (senders) will make use of the 256-bit ciphers and Diffie-Hellman ciphers with a 2048-bit key for perfect forward secrecy, however. ([source](setup/mail-postfix.sh))
 
 ### DANE
 
diff --git a/setup/mail-postfix.sh b/setup/mail-postfix.sh
index a3b87a98..96d2971a 100755
--- a/setup/mail-postfix.sh
+++ b/setup/mail-postfix.sh
@@ -122,8 +122,9 @@ tools/editconf.py /etc/postfix/main.cf \
 	smtpd_tls_cert_file=$STORAGE_ROOT/ssl/ssl_certificate.pem \
 	smtpd_tls_key_file=$STORAGE_ROOT/ssl/ssl_private_key.pem \
 	smtpd_tls_dh1024_param_file=$STORAGE_ROOT/ssl/dh2048.pem \
+	smtpd_tls_protocols=\!SSLv2,\!SSLv3 \
 	smtpd_tls_ciphers=medium \
-	smtpd_tls_exclude_ciphers=aNULL \
+	smtpd_tls_exclude_ciphers=aNULL,RC4 \
 	smtpd_tls_received_header=yes
 
 # Prevent non-authenticated users from sending mail that requires being
diff --git a/tests/tls_results.txt b/tests/tls_results.txt
index c6419936..9869bd36 100644
--- a/tests/tls_results.txt
+++ b/tests/tls_results.txt
@@ -33,7 +33,6 @@ PORT 25
                  AES256-SHA256                 -              256 bits      250 2.0.0 Ok                       
                  AES256-SHA                    -              256 bits      250 2.0.0 Ok                       
                  AES256-GCM-SHA384             -              256 bits      250 2.0.0 Ok                       
-                 ECDHE-RSA-RC4-SHA             ECDH-256 bits  128 bits      250 2.0.0 Ok                       
                  ECDHE-RSA-AES128-SHA256       ECDH-256 bits  128 bits      250 2.0.0 Ok                       
                  ECDHE-RSA-AES128-SHA          ECDH-256 bits  128 bits      250 2.0.0 Ok                       
                  ECDHE-RSA-AES128-GCM-SHA256   ECDH-256 bits  128 bits      250 2.0.0 Ok                       
@@ -43,8 +42,6 @@ PORT 25
                  DHE-RSA-AES128-SHA            DH-2048 bits   128 bits      250 2.0.0 Ok                       
                  DHE-RSA-AES128-GCM-SHA256     DH-2048 bits   128 bits      250 2.0.0 Ok                       
                  SEED-SHA                      -              128 bits      250 2.0.0 Ok                       
-                 RC4-SHA                       -              128 bits      250 2.0.0 Ok                       
-                 RC4-MD5                       -              128 bits      250 2.0.0 Ok                       
                  CAMELLIA128-SHA               -              128 bits      250 2.0.0 Ok                       
                  AES128-SHA256                 -              128 bits      250 2.0.0 Ok                       
                  AES128-SHA                    -              128 bits      250 2.0.0 Ok                       
@@ -62,37 +59,11 @@ PORT 25
                  DHE-RSA-AES256-SHA            DH-2048 bits   256 bits      250 2.0.0 Ok                       
                  CAMELLIA256-SHA               -              256 bits      250 2.0.0 Ok                       
                  AES256-SHA                    -              256 bits      250 2.0.0 Ok                       
-                 ECDHE-RSA-RC4-SHA             ECDH-256 bits  128 bits      250 2.0.0 Ok                       
                  ECDHE-RSA-AES128-SHA          ECDH-256 bits  128 bits      250 2.0.0 Ok                       
                  DHE-RSA-SEED-SHA              DH-2048 bits   128 bits      250 2.0.0 Ok                       
                  DHE-RSA-CAMELLIA128-SHA       DH-2048 bits   128 bits      250 2.0.0 Ok                       
                  DHE-RSA-AES128-SHA            DH-2048 bits   128 bits      250 2.0.0 Ok                       
                  SEED-SHA                      -              128 bits      250 2.0.0 Ok                       
-                 RC4-SHA                       -              128 bits      250 2.0.0 Ok                       
-                 RC4-MD5                       -              128 bits      250 2.0.0 Ok                       
-                 CAMELLIA128-SHA               -              128 bits      250 2.0.0 Ok                       
-                 AES128-SHA                    -              128 bits      250 2.0.0 Ok                       
-                 ECDHE-RSA-DES-CBC3-SHA        ECDH-256 bits  112 bits      250 2.0.0 Ok                       
-                 EDH-RSA-DES-CBC3-SHA          DH-2048 bits   112 bits      250 2.0.0 Ok                       
-                 DES-CBC3-SHA                  -              112 bits      250 2.0.0 Ok                       
-
-  * SSLV3 Cipher Suites:
-      Preferred:                       
-                 ECDHE-RSA-AES256-SHA          ECDH-256 bits  256 bits      250 2.0.0 Ok                       
-      Accepted:                        
-                 ECDHE-RSA-AES256-SHA          ECDH-256 bits  256 bits      250 2.0.0 Ok                       
-                 DHE-RSA-CAMELLIA256-SHA       DH-2048 bits   256 bits      250 2.0.0 Ok                       
-                 DHE-RSA-AES256-SHA            DH-2048 bits   256 bits      250 2.0.0 Ok                       
-                 CAMELLIA256-SHA               -              256 bits      250 2.0.0 Ok                       
-                 AES256-SHA                    -              256 bits      250 2.0.0 Ok                       
-                 ECDHE-RSA-RC4-SHA             ECDH-256 bits  128 bits      250 2.0.0 Ok                       
-                 ECDHE-RSA-AES128-SHA          ECDH-256 bits  128 bits      250 2.0.0 Ok                       
-                 DHE-RSA-SEED-SHA              DH-2048 bits   128 bits      250 2.0.0 Ok                       
-                 DHE-RSA-CAMELLIA128-SHA       DH-2048 bits   128 bits      250 2.0.0 Ok                       
-                 DHE-RSA-AES128-SHA            DH-2048 bits   128 bits      250 2.0.0 Ok                       
-                 SEED-SHA                      -              128 bits      250 2.0.0 Ok                       
-                 RC4-SHA                       -              128 bits      250 2.0.0 Ok                       
-                 RC4-MD5                       -              128 bits      250 2.0.0 Ok                       
                  CAMELLIA128-SHA               -              128 bits      250 2.0.0 Ok                       
                  AES128-SHA                    -              128 bits      250 2.0.0 Ok                       
                  ECDHE-RSA-DES-CBC3-SHA        ECDH-256 bits  112 bits      250 2.0.0 Ok                       
@@ -108,23 +79,23 @@ PORT 25
                  DHE-RSA-AES256-SHA            DH-2048 bits   256 bits      250 2.0.0 Ok                       
                  CAMELLIA256-SHA               -              256 bits      250 2.0.0 Ok                       
                  AES256-SHA                    -              256 bits      250 2.0.0 Ok                       
-                 ECDHE-RSA-RC4-SHA             ECDH-256 bits  128 bits      250 2.0.0 Ok                       
                  ECDHE-RSA-AES128-SHA          ECDH-256 bits  128 bits      250 2.0.0 Ok                       
                  DHE-RSA-SEED-SHA              DH-2048 bits   128 bits      250 2.0.0 Ok                       
                  DHE-RSA-CAMELLIA128-SHA       DH-2048 bits   128 bits      250 2.0.0 Ok                       
                  DHE-RSA-AES128-SHA            DH-2048 bits   128 bits      250 2.0.0 Ok                       
                  SEED-SHA                      -              128 bits      250 2.0.0 Ok                       
-                 RC4-SHA                       -              128 bits      250 2.0.0 Ok                       
-                 RC4-MD5                       -              128 bits      250 2.0.0 Ok                       
                  CAMELLIA128-SHA               -              128 bits      250 2.0.0 Ok                       
                  AES128-SHA                    -              128 bits      250 2.0.0 Ok                       
                  ECDHE-RSA-DES-CBC3-SHA        ECDH-256 bits  112 bits      250 2.0.0 Ok                       
                  EDH-RSA-DES-CBC3-SHA          DH-2048 bits   112 bits      250 2.0.0 Ok                       
-                 DES-CBC3-SHA                  -              112 bits      250 2.0.0 Ok
+                 DES-CBC3-SHA                  -              112 bits      250 2.0.0 Ok                       
 
-  Should Not Offer: DHE-RSA-SEED-SHA, ECDHE-RSA-RC4-SHA, EDH-RSA-DES-CBC3-SHA, RC4-MD5, RC4-SHA, SEED-SHA
-  Could Also Offer: DHE-DSS-AES128-GCM-SHA256, DHE-DSS-AES128-SHA, DHE-DSS-AES128-SHA256, DHE-DSS-AES256-GCM-SHA384, DHE-DSS-AES256-SHA, DHE-DSS-AES256-SHA256, DHE-DSS-CAMELLIA128-SHA, DHE-DSS-CAMELLIA256-SHA, ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES128-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES256-SHA, ECDHE-ECDSA-AES256-SHA384, ECDHE-ECDSA-DES-CBC3-SHA, SRP-3DES-EDE-CBC-SHA, SRP-AES-128-CBC-SHA, SRP-AES-256-CBC-SHA, SRP-DSS-3DES-EDE-CBC-SHA, SRP-DSS-AES-128-CBC-SHA, SRP-DSS-AES-256-CBC-SHA, SRP-RSA-3DES-EDE-CBC-SHA, SRP-RSA-AES-128-CBC-SHA, SRP-RSA-AES-256-CBC-SHA
-  Supported Clients: OpenSSL/1.0.2, Yahoo Slurp/Jan 2015, BingPreview/Jan 2015, OpenSSL/1.0.1l, YandexBot/Jan 2015, Android/4.4.2, Safari/8/iOS 8.1.2, Safari/7/OS X 10.9, Safari/8/OS X 10.10, Safari/7/iOS 7.1, Safari/6/iOS 6.0.1, Baidu/Jan 2015, Firefox/31.3.0 ESR/Win 7, Android/5.0.0, IE/11/Win 7, Java/8u31, Googlebot/Feb 2015, Chrome/42/OS X, IE Mobile/11/Win Phone 8.1, IE/11/Win 8.1, Android/4.0.4, Android/4.1.1, Safari/6.0.4/OS X 10.8.4, Android/4.3, Android/4.2.2, Safari/5.1.9/OS X 10.6.8, Java/7u25, OpenSSL/0.9.8y, Firefox/37/OS X, IE/7/Vista, IE/8-10/Win 7, IE Mobile/10/Win Phone 8.0, Java/6u45, Android/2.3.7, IE/8/XP
+  * SSLV3 Cipher Suites:
+      Server rejected all cipher suites.
+
+  Should Not Offer: DHE-RSA-SEED-SHA, EDH-RSA-DES-CBC3-SHA, SEED-SHA
+  Could Also Offer: DH-DSS-AES128-GCM-SHA256, DH-DSS-AES128-SHA, DH-DSS-AES128-SHA256, DH-DSS-AES256-GCM-SHA384, DH-DSS-AES256-SHA, DH-DSS-AES256-SHA256, DH-DSS-CAMELLIA128-SHA, DH-DSS-CAMELLIA256-SHA, DH-DSS-DES-CBC3-SHA, DH-RSA-AES128-GCM-SHA256, DH-RSA-AES128-SHA, DH-RSA-AES128-SHA256, DH-RSA-AES256-GCM-SHA384, DH-RSA-AES256-SHA, DH-RSA-AES256-SHA256, DH-RSA-CAMELLIA128-SHA, DH-RSA-CAMELLIA256-SHA, DH-RSA-DES-CBC3-SHA, DHE-DSS-AES128-GCM-SHA256, DHE-DSS-AES128-SHA, DHE-DSS-AES128-SHA256, DHE-DSS-AES256-GCM-SHA384, DHE-DSS-AES256-SHA, DHE-DSS-AES256-SHA256, DHE-DSS-CAMELLIA128-SHA, DHE-DSS-CAMELLIA256-SHA, ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES128-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES256-SHA, ECDHE-ECDSA-AES256-SHA384, ECDHE-ECDSA-DES-CBC3-SHA, SRP-3DES-EDE-CBC-SHA, SRP-AES-128-CBC-SHA, SRP-AES-256-CBC-SHA, SRP-DSS-3DES-EDE-CBC-SHA, SRP-DSS-AES-128-CBC-SHA, SRP-DSS-AES-256-CBC-SHA, SRP-RSA-3DES-EDE-CBC-SHA, SRP-RSA-AES-128-CBC-SHA, SRP-RSA-AES-256-CBC-SHA
+  Supported Clients: OpenSSL/1.0.2, OpenSSL/1.0.1l, BingPreview/Jan 2015, Yahoo Slurp/Jan 2015, YandexBot/Jan 2015, Android/4.4.2, Safari/7/iOS 7.1, Safari/8/OS X 10.10, Safari/8/iOS 8.1.2, Safari/7/OS X 10.9, Safari/6/iOS 6.0.1, Firefox/31.3.0 ESR/Win 7, Baidu/Jan 2015, IE/11/Win 8.1, IE/11/Win 7, IE Mobile/11/Win Phone 8.1, Android/5.0.0, Java/8u31, Chrome/42/OS X, Googlebot/Feb 2015, Android/4.1.1, Android/4.0.4, Safari/6.0.4/OS X 10.8.4, Android/4.2.2, Android/4.3, Safari/5.1.9/OS X 10.6.8, Firefox/37/OS X, OpenSSL/0.9.8y, Java/7u25, IE/8-10/Win 7, IE/7/Vista, IE Mobile/10/Win Phone 8.0, Android/2.3.7, Java/6u45, IE/8/XP
 
 PORT 587
 --------
@@ -192,9 +163,6 @@ PORT 587
                  CAMELLIA128-SHA               -              128 bits      250 2.0.0 Ok                       
                  AES128-SHA                    -              128 bits      250 2.0.0 Ok                       
 
-  * SSLV3 Cipher Suites:
-      Server rejected all cipher suites.
-
   * TLSV1 Cipher Suites:
       Preferred:                       
                  ECDHE-RSA-AES256-SHA          ECDH-256 bits  256 bits      250 2.0.0 Ok                       
@@ -210,11 +178,14 @@ PORT 587
                  DHE-RSA-AES128-SHA            DH-2048 bits   128 bits      250 2.0.0 Ok                       
                  SEED-SHA                      -              128 bits      250 2.0.0 Ok                       
                  CAMELLIA128-SHA               -              128 bits      250 2.0.0 Ok                       
-                 AES128-SHA                    -              128 bits      250 2.0.0 Ok
+                 AES128-SHA                    -              128 bits      250 2.0.0 Ok                       
+
+  * SSLV3 Cipher Suites:
+      Server rejected all cipher suites.
 
   Should Not Offer: AES128-GCM-SHA256, AES128-SHA, AES128-SHA256, AES256-GCM-SHA384, AES256-SHA, AES256-SHA256, CAMELLIA128-SHA, CAMELLIA256-SHA, DHE-RSA-CAMELLIA128-SHA, DHE-RSA-CAMELLIA256-SHA, DHE-RSA-SEED-SHA, SEED-SHA
   Could Also Offer: DHE-DSS-AES128-GCM-SHA256, DHE-DSS-AES128-SHA256, DHE-DSS-AES256-GCM-SHA384, DHE-DSS-AES256-SHA, ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES128-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES256-SHA, ECDHE-ECDSA-AES256-SHA384
-  Supported Clients: OpenSSL/1.0.2, Yahoo Slurp/Jan 2015, BingPreview/Jan 2015, OpenSSL/1.0.1l, YandexBot/Jan 2015, Android/4.4.2, Safari/8/iOS 8.1.2, Safari/7/OS X 10.9, Safari/8/OS X 10.10, Safari/7/iOS 7.1, IE Mobile/11/Win Phone 8.1, IE/11/Win 8.1, IE/11/Win 7, Safari/6/iOS 6.0.1, Firefox/31.3.0 ESR/Win 7, Baidu/Jan 2015, Android/5.0.0, Chrome/42/OS X, Java/8u31, Googlebot/Feb 2015, Firefox/37/OS X, Android/4.0.4, Android/4.1.1, Safari/6.0.4/OS X 10.8.4, Android/4.3, Android/4.2.2, Safari/5.1.9/OS X 10.6.8, OpenSSL/0.9.8y, IE/7/Vista, IE/8-10/Win 7, IE Mobile/10/Win Phone 8.0, Java/7u25, Java/6u45, Android/2.3.7
+  Supported Clients: OpenSSL/1.0.2, OpenSSL/1.0.1l, BingPreview/Jan 2015, Yahoo Slurp/Jan 2015, YandexBot/Jan 2015, Android/4.4.2, Safari/7/iOS 7.1, IE/11/Win 8.1, Safari/8/iOS 8.1.2, IE/11/Win 7, IE Mobile/11/Win Phone 8.1, Safari/8/OS X 10.10, Safari/7/OS X 10.9, Safari/6/iOS 6.0.1, Firefox/31.3.0 ESR/Win 7, Baidu/Jan 2015, Chrome/42/OS X, Android/5.0.0, Java/8u31, Googlebot/Feb 2015, Firefox/37/OS X, Android/4.0.4, Android/4.1.1, Safari/6.0.4/OS X 10.8.4, Android/4.2.2, Android/4.3, Safari/5.1.9/OS X 10.6.8, IE/8-10/Win 7, IE/7/Vista, IE Mobile/10/Win Phone 8.0, OpenSSL/0.9.8y, Java/7u25, Java/6u45, Android/2.3.7
 
 PORT 443
 --------
@@ -226,22 +197,22 @@ PORT 443
       Client-initiated Renegotiations:   OK - Rejected
       Secure Renegotiation:              OK - Supported
 
-  * HTTP Strict Transport Security:
-      OK - HSTS header received:         max-age=31536000
+  * OpenSSL Heartbleed:
+      OK - Not vulnerable to Heartbleed  
 
   * Session Resumption:
       With Session IDs:                  OK - Supported (5 successful, 0 failed, 0 errors, 5 total attempts).
       With TLS Session Tickets:          OK - Supported
 
-  * OpenSSL Heartbleed:
-      OK - Not vulnerable to Heartbleed  
+  * HTTP Strict Transport Security:
+      OK - HSTS header received:         max-age=31536000
+
+Unhandled exception when processing --chrome_sha1: 
+exceptions.TypeError - Incorrect padding
 
   * SSLV2 Cipher Suites:
       Server rejected all cipher suites.
 
-  * Google Chrome SHA-1 Deprecation Status:
-      OK - Leaf certificate expires before 2016.
-
   * TLSV1_2 Cipher Suites:
       Preferred:                       
                  ECDHE-RSA-AES128-GCM-SHA256   ECDH-256 bits  128 bits      HTTP 200 OK                        
@@ -270,9 +241,6 @@ PORT 443
                  DHE-RSA-AES128-SHA            DH-2048 bits   128 bits      HTTP 200 OK                        
                  DES-CBC3-SHA                  -              112 bits      HTTP 200 OK                        
 
-  * SSLV3 Cipher Suites:
-      Server rejected all cipher suites.
-
   * TLSV1 Cipher Suites:
       Preferred:                       
                  ECDHE-RSA-AES128-SHA          ECDH-256 bits  128 bits      HTTP 200 OK                        
@@ -281,11 +249,14 @@ PORT 443
                  DHE-RSA-AES256-SHA            DH-2048 bits   256 bits      HTTP 200 OK                        
                  ECDHE-RSA-AES128-SHA          ECDH-256 bits  128 bits      HTTP 200 OK                        
                  DHE-RSA-AES128-SHA            DH-2048 bits   128 bits      HTTP 200 OK                        
-                 DES-CBC3-SHA                  -              112 bits      HTTP 200 OK
+                 DES-CBC3-SHA                  -              112 bits      HTTP 200 OK                        
+
+  * SSLV3 Cipher Suites:
+      Server rejected all cipher suites.
 
   Should Not Offer: (none -- good)
-  Could Also Offer: AES128-GCM-SHA256, AES128-SHA, AES128-SHA256, AES256-GCM-SHA384, AES256-SHA, AES256-SHA256, CAMELLIA128-SHA, CAMELLIA256-SHA, DHE-DSS-AES128-GCM-SHA256, DHE-DSS-AES128-SHA, DHE-DSS-AES128-SHA256, DHE-DSS-AES256-GCM-SHA384, DHE-DSS-AES256-SHA, DHE-DSS-AES256-SHA256, DHE-DSS-CAMELLIA128-SHA, DHE-DSS-CAMELLIA256-SHA, DHE-RSA-CAMELLIA128-SHA, DHE-RSA-CAMELLIA256-SHA, ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES128-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES256-SHA, ECDHE-ECDSA-AES256-SHA384, SRP-AES-128-CBC-SHA, SRP-AES-256-CBC-SHA, SRP-DSS-AES-128-CBC-SHA, SRP-DSS-AES-256-CBC-SHA, SRP-RSA-AES-128-CBC-SHA, SRP-RSA-AES-256-CBC-SHA
-  Supported Clients: YandexBot/Jan 2015, OpenSSL/1.0.2, Yahoo Slurp/Jan 2015, BingPreview/Jan 2015, OpenSSL/1.0.1l, Android/4.4.2, Safari/8/iOS 8.1.2, Safari/8/OS X 10.10, Safari/7/OS X 10.9, Safari/7/iOS 7.1, Safari/6/iOS 6.0.1, Android/5.0.0, Chrome/42/OS X, IE/11/Win 8.1, IE/11/Win 7, Java/8u31, IE Mobile/11/Win Phone 8.1, Googlebot/Feb 2015, Firefox/37/OS X, Firefox/31.3.0 ESR/Win 7, Android/4.2.2, Android/4.0.4, Baidu/Jan 2015, Safari/5.1.9/OS X 10.6.8, Android/4.1.1, Safari/6.0.4/OS X 10.8.4, Android/4.3, OpenSSL/0.9.8y, IE/7/Vista, IE/8-10/Win 7, IE Mobile/10/Win Phone 8.0, Java/7u25, Java/6u45, Android/2.3.7, IE/8/XP
+  Could Also Offer: AES128-GCM-SHA256, AES128-SHA, AES128-SHA256, AES256-GCM-SHA384, AES256-SHA, AES256-SHA256, CAMELLIA128-SHA, CAMELLIA256-SHA, DH-DSS-AES128-GCM-SHA256, DH-DSS-AES128-SHA, DH-DSS-AES128-SHA256, DH-DSS-AES256-GCM-SHA384, DH-DSS-AES256-SHA, DH-DSS-AES256-SHA256, DH-DSS-CAMELLIA128-SHA, DH-DSS-CAMELLIA256-SHA, DH-RSA-AES128-GCM-SHA256, DH-RSA-AES128-SHA, DH-RSA-AES128-SHA256, DH-RSA-AES256-GCM-SHA384, DH-RSA-AES256-SHA, DH-RSA-AES256-SHA256, DH-RSA-CAMELLIA128-SHA, DH-RSA-CAMELLIA256-SHA, DHE-DSS-AES128-GCM-SHA256, DHE-DSS-AES128-SHA, DHE-DSS-AES128-SHA256, DHE-DSS-AES256-GCM-SHA384, DHE-DSS-AES256-SHA, DHE-DSS-AES256-SHA256, DHE-DSS-CAMELLIA128-SHA, DHE-DSS-CAMELLIA256-SHA, DHE-RSA-CAMELLIA128-SHA, DHE-RSA-CAMELLIA256-SHA, ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES128-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES256-SHA, ECDHE-ECDSA-AES256-SHA384, SRP-AES-128-CBC-SHA, SRP-AES-256-CBC-SHA, SRP-DSS-AES-128-CBC-SHA, SRP-DSS-AES-256-CBC-SHA, SRP-RSA-AES-128-CBC-SHA, SRP-RSA-AES-256-CBC-SHA
+  Supported Clients: OpenSSL/1.0.2, OpenSSL/1.0.1l, BingPreview/Jan 2015, YandexBot/Jan 2015, Yahoo Slurp/Jan 2015, Android/4.4.2, Safari/7/iOS 7.1, Safari/8/OS X 10.10, Safari/8/iOS 8.1.2, Safari/7/OS X 10.9, Safari/6/iOS 6.0.1, Chrome/42/OS X, IE/11/Win 8.1, IE/11/Win 7, Android/5.0.0, Java/8u31, IE Mobile/11/Win Phone 8.1, Googlebot/Feb 2015, Firefox/31.3.0 ESR/Win 7, Firefox/37/OS X, Android/4.1.1, Android/4.0.4, Baidu/Jan 2015, Safari/6.0.4/OS X 10.8.4, Android/4.2.2, Android/4.3, Safari/5.1.9/OS X 10.6.8, IE/8-10/Win 7, IE/7/Vista, OpenSSL/0.9.8y, IE Mobile/10/Win Phone 8.0, Java/7u25, Android/2.3.7, Java/6u45, IE/8/XP
 
 PORT 993
 --------
@@ -299,13 +270,13 @@ _nassl.OpenSSLError - error:140940F5:SSL routines:ssl3_read_bytes:unexpected rec
   * OpenSSL Heartbleed:
       OK - Not vulnerable to Heartbleed  
 
-  * SSLV2 Cipher Suites:
-      Server rejected all cipher suites.
-
   * Session Resumption:
       With Session IDs:                  NOT SUPPORTED (0 successful, 5 failed, 0 errors, 5 total attempts).
       With TLS Session Tickets:          NOT SUPPORTED - TLS ticket assigned but not accepted.
 
+  * SSLV2 Cipher Suites:
+      Server rejected all cipher suites.
+
   * TLSV1_2 Cipher Suites:
       Preferred:                       
                  ECDHE-RSA-AES256-SHA          ECDH-384 bits  256 bits                                         
@@ -336,9 +307,6 @@ _nassl.OpenSSLError - error:140940F5:SSL routines:ssl3_read_bytes:unexpected rec
                  CAMELLIA128-SHA               -              128 bits                                         
                  AES128-SHA                    -              128 bits                                         
 
-  * SSLV3 Cipher Suites:
-      Server rejected all cipher suites.
-
   * TLSV1 Cipher Suites:
       Preferred:                       
                  ECDHE-RSA-AES256-SHA          ECDH-384 bits  256 bits                                         
@@ -352,11 +320,14 @@ _nassl.OpenSSLError - error:140940F5:SSL routines:ssl3_read_bytes:unexpected rec
                  DHE-RSA-CAMELLIA128-SHA       DH-1024 bits   128 bits                                         
                  DHE-RSA-AES128-SHA            DH-1024 bits   128 bits                                         
                  CAMELLIA128-SHA               -              128 bits                                         
-                 AES128-SHA                    -              128 bits
+                 AES128-SHA                    -              128 bits                                         
+
+  * SSLV3 Cipher Suites:
+      Server rejected all cipher suites.
 
   Should Not Offer: AES128-SHA, AES256-SHA, CAMELLIA128-SHA, CAMELLIA256-SHA, DHE-RSA-CAMELLIA128-SHA, DHE-RSA-CAMELLIA256-SHA
   Could Also Offer: DHE-DSS-AES128-GCM-SHA256, DHE-DSS-AES128-SHA256, DHE-DSS-AES256-GCM-SHA384, DHE-DSS-AES256-SHA, DHE-RSA-AES128-GCM-SHA256, DHE-RSA-AES128-SHA256, DHE-RSA-AES256-GCM-SHA384, DHE-RSA-AES256-SHA256, ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES128-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES256-SHA, ECDHE-ECDSA-AES256-SHA384, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES128-SHA256, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES256-SHA384
-  Supported Clients: OpenSSL/1.0.2, Baidu/Jan 2015, Yahoo Slurp/Jan 2015, BingPreview/Jan 2015, OpenSSL/1.0.1l, Firefox/31.3.0 ESR/Win 7, Googlebot/Feb 2015, Android/4.2.2, Android/5.0.0, Android/4.0.4, Safari/8/iOS 8.1.2, Safari/7/OS X 10.9, YandexBot/Jan 2015, Safari/8/OS X 10.10, Safari/7/iOS 7.1, Chrome/42/OS X, Safari/5.1.9/OS X 10.6.8, Android/4.1.1, Firefox/37/OS X, Safari/6.0.4/OS X 10.8.4, Android/4.3, Safari/6/iOS 6.0.1, Android/4.4.2, OpenSSL/0.9.8y, IE Mobile/11/Win Phone 8.1, IE/7/Vista, IE/11/Win 8.1, IE/11/Win 7, IE/8-10/Win 7, IE Mobile/10/Win Phone 8.0, Java/8u31, Java/7u25, Java/6u45, Android/2.3.7
+  Supported Clients: OpenSSL/1.0.2, Firefox/31.3.0 ESR/Win 7, OpenSSL/1.0.1l, BingPreview/Jan 2015, Yahoo Slurp/Jan 2015, Baidu/Jan 2015, Safari/7/iOS 7.1, Chrome/42/OS X, Googlebot/Feb 2015, Android/4.0.4, Safari/8/iOS 8.1.2, Android/4.1.1, Android/5.0.0, Safari/6/iOS 6.0.1, YandexBot/Jan 2015, Safari/6.0.4/OS X 10.8.4, Android/4.2.2, Safari/8/OS X 10.10, Firefox/37/OS X, Safari/7/OS X 10.9, Android/4.3, Safari/5.1.9/OS X 10.6.8, Android/4.4.2, IE/8-10/Win 7, IE/7/Vista, IE/11/Win 8.1, IE/11/Win 7, OpenSSL/0.9.8y, IE Mobile/10/Win Phone 8.0, IE Mobile/11/Win Phone 8.1, Java/7u25, Java/8u31, Java/6u45, Android/2.3.7
 
 PORT 995
 --------
@@ -370,13 +341,13 @@ _nassl.OpenSSLError - error:140940F5:SSL routines:ssl3_read_bytes:unexpected rec
   * OpenSSL Heartbleed:
       OK - Not vulnerable to Heartbleed  
 
-  * SSLV2 Cipher Suites:
-      Server rejected all cipher suites.
-
   * Session Resumption:
       With Session IDs:                  NOT SUPPORTED (0 successful, 5 failed, 0 errors, 5 total attempts).
       With TLS Session Tickets:          NOT SUPPORTED - TLS ticket assigned but not accepted.
 
+  * SSLV2 Cipher Suites:
+      Server rejected all cipher suites.
+
   * TLSV1_2 Cipher Suites:
       Preferred:                       
                  ECDHE-RSA-AES256-SHA          ECDH-384 bits  256 bits                                         
@@ -407,9 +378,6 @@ _nassl.OpenSSLError - error:140940F5:SSL routines:ssl3_read_bytes:unexpected rec
                  CAMELLIA128-SHA               -              128 bits                                         
                  AES128-SHA                    -              128 bits                                         
 
-  * SSLV3 Cipher Suites:
-      Server rejected all cipher suites.
-
   * TLSV1 Cipher Suites:
       Preferred:                       
                  ECDHE-RSA-AES256-SHA          ECDH-384 bits  256 bits                                         
@@ -423,9 +391,12 @@ _nassl.OpenSSLError - error:140940F5:SSL routines:ssl3_read_bytes:unexpected rec
                  DHE-RSA-CAMELLIA128-SHA       DH-1024 bits   128 bits                                         
                  DHE-RSA-AES128-SHA            DH-1024 bits   128 bits                                         
                  CAMELLIA128-SHA               -              128 bits                                         
-                 AES128-SHA                    -              128 bits
+                 AES128-SHA                    -              128 bits                                         
+
+  * SSLV3 Cipher Suites:
+      Server rejected all cipher suites.
 
   Should Not Offer: AES128-SHA, AES256-SHA, CAMELLIA128-SHA, CAMELLIA256-SHA, DHE-RSA-CAMELLIA128-SHA, DHE-RSA-CAMELLIA256-SHA
   Could Also Offer: DHE-DSS-AES128-GCM-SHA256, DHE-DSS-AES128-SHA256, DHE-DSS-AES256-GCM-SHA384, DHE-DSS-AES256-SHA, DHE-RSA-AES128-GCM-SHA256, DHE-RSA-AES128-SHA256, DHE-RSA-AES256-GCM-SHA384, DHE-RSA-AES256-SHA256, ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES128-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES256-SHA, ECDHE-ECDSA-AES256-SHA384, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES128-SHA256, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES256-SHA384
-  Supported Clients: OpenSSL/1.0.2, Baidu/Jan 2015, Yahoo Slurp/Jan 2015, BingPreview/Jan 2015, OpenSSL/1.0.1l, Firefox/31.3.0 ESR/Win 7, Googlebot/Feb 2015, Android/4.2.2, Android/5.0.0, Android/4.0.4, Safari/8/iOS 8.1.2, Safari/7/OS X 10.9, YandexBot/Jan 2015, Safari/8/OS X 10.10, Safari/7/iOS 7.1, Chrome/42/OS X, Safari/5.1.9/OS X 10.6.8, Android/4.1.1, Firefox/37/OS X, Safari/6.0.4/OS X 10.8.4, Android/4.3, Safari/6/iOS 6.0.1, Android/4.4.2, OpenSSL/0.9.8y, IE Mobile/11/Win Phone 8.1, IE/7/Vista, IE/11/Win 8.1, IE/11/Win 7, IE/8-10/Win 7, IE Mobile/10/Win Phone 8.0, Java/8u31, Java/7u25, Java/6u45, Android/2.3.7
+  Supported Clients: OpenSSL/1.0.2, Firefox/31.3.0 ESR/Win 7, OpenSSL/1.0.1l, BingPreview/Jan 2015, Yahoo Slurp/Jan 2015, Baidu/Jan 2015, Safari/7/iOS 7.1, Chrome/42/OS X, Googlebot/Feb 2015, Android/4.0.4, Safari/8/iOS 8.1.2, Android/4.1.1, Android/5.0.0, Safari/6/iOS 6.0.1, YandexBot/Jan 2015, Safari/6.0.4/OS X 10.8.4, Android/4.2.2, Safari/8/OS X 10.10, Firefox/37/OS X, Safari/7/OS X 10.9, Android/4.3, Safari/5.1.9/OS X 10.6.8, Android/4.4.2, IE/8-10/Win 7, IE/7/Vista, IE/11/Win 8.1, IE/11/Win 7, OpenSSL/0.9.8y, IE Mobile/10/Win Phone 8.0, IE Mobile/11/Win Phone 8.1, Java/7u25, Java/8u31, Java/6u45, Android/2.3.7
 

From 6b73bb5d80fb5e8d42ba1921fdd383eafa168dd9 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sun, 12 Jun 2016 08:59:53 -0400
Subject: [PATCH 070/165] outbound SMTP connections should use the same TLS
 settings as inbound: drop SSLv2, SSLv3, anonymous ciphers, RC4

---
 security.md           | 2 +-
 setup/mail-postfix.sh | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/security.md b/security.md
index a196441f..a56df082 100644
--- a/security.md
+++ b/security.md
@@ -80,7 +80,7 @@ The first step in resolving the destination server for an email address is perfo
 
 ### Encryption
 
-The box (along with the vast majority of mail servers) uses [opportunistic encryption](https://en.wikipedia.org/wiki/Opportunistic_encryption), meaning the mail is encrypted in transit and protected from passive eavesdropping, but it is not protected from an active man-in-the-middle attack. Modern encryption settings will be used to the extent the recipient server supports them. ([source](setup/mail-postfix.sh))
+The box (along with the vast majority of mail servers) uses [opportunistic encryption](https://en.wikipedia.org/wiki/Opportunistic_encryption), meaning the mail is encrypted in transit and protected from passive eavesdropping, but it is not protected from an active man-in-the-middle attack. Modern encryption settings (TLSv1 and later, no RC4) will be used to the extent the recipient server supports them. ([source](setup/mail-postfix.sh))
 
 ### DANE
 
diff --git a/setup/mail-postfix.sh b/setup/mail-postfix.sh
index 96d2971a..f9457519 100755
--- a/setup/mail-postfix.sh
+++ b/setup/mail-postfix.sh
@@ -159,6 +159,9 @@ tools/editconf.py /etc/postfix/main.cf \
 # even if we don't know if it's to the right party, than to not encrypt at all. Instead we'll
 # now see notices about trusted certs. The CA file is provided by the package `ca-certificates`.
 tools/editconf.py /etc/postfix/main.cf \
+	smtp_tls_protocols=\!SSLv2,\!SSLv3 \
+	smtp_tls_ciphers=medium \
+	smtp_tls_exclude_ciphers=aNULL,RC4 \
 	smtp_tls_security_level=dane \
 	smtp_dns_support_level=dnssec \
 	smtp_tls_CAfile=/etc/ssl/certs/ca-certificates.crt \

From 5f5f00af4ac054d3b2ec51b38303ca5da73387e1 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sun, 12 Jun 2016 09:08:08 -0400
Subject: [PATCH 071/165] for DANE, the smtp_tls_mandatory_protocols setting
 seems like it also needs to be set (unlike the cipher settings, this isn't
 documented to be in addition to the non-mandatory setting)

---
 setup/mail-postfix.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/setup/mail-postfix.sh b/setup/mail-postfix.sh
index f9457519..d62478e1 100755
--- a/setup/mail-postfix.sh
+++ b/setup/mail-postfix.sh
@@ -160,6 +160,7 @@ tools/editconf.py /etc/postfix/main.cf \
 # now see notices about trusted certs. The CA file is provided by the package `ca-certificates`.
 tools/editconf.py /etc/postfix/main.cf \
 	smtp_tls_protocols=\!SSLv2,\!SSLv3 \
+	smtp_tls_mandatory_protocols=\!SSLv2,\!SSLv3 \
 	smtp_tls_ciphers=medium \
 	smtp_tls_exclude_ciphers=aNULL,RC4 \
 	smtp_tls_security_level=dane \

From bf5e9200f8b6f4f9790b9e30df429b1467580ef1 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Sun, 26 Jun 2016 13:26:42 +0200
Subject: [PATCH 072/165] Update owncloud url to use webdav and increase http
 timeout

---
 tests/fail2ban.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/fail2ban.py b/tests/fail2ban.py
index f4b48293..feda2796 100644
--- a/tests/fail2ban.py
+++ b/tests/fail2ban.py
@@ -85,7 +85,7 @@ def http_test(url, expected_status, postdata=None, qsargs=None, auth=None):
 			auth=HTTPBasicAuth(*auth) if auth else None,
 			data=postdata,
 			headers={'User-Agent': 'Mail-in-a-Box fail2ban tester'},
-			timeout=4)
+			timeout=8)
 	except requests.exceptions.ConnectionError as e:
 		if "Connection refused" in str(e):
 			raise IsBlocked()
@@ -187,7 +187,7 @@ if __name__ == "__main__":
 	run_test(http_test, ["/admin/munin/", 401], 20, 30, 1)
 
 	# ownCloud
-	run_test(http_test, ["/cloud/remote.php/caldav/calendars/user@domain/personal", 401], 20, 30, 1)
+	run_test(http_test, ["/cloud/remote.php/webdav", 401, None, None, ["aa", "aa"]], 20, 30, 1)
 
 	# restart fail2ban so that this client machine is no longer blocked
 	restart_fail2ban_service(final=True)

From d9ac321f257dd052a36b4905b876a37c7fb90550 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Sun, 26 Jun 2016 14:17:12 +0200
Subject: [PATCH 073/165] Owncloud needs more time to detect blocks. It doesn't
 respond as fast as the other services. Also owncloud logs UTC (since latest
 update) even though the timezone is not UTC. Also to detect a block, we get a
 timeout instead of a refused)

---
 conf/fail2ban/jails.conf | 2 +-
 setup/owncloud.sh        | 2 ++
 tests/fail2ban.py        | 8 +++++---
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/conf/fail2ban/jails.conf b/conf/fail2ban/jails.conf
index 7cc90975..0146b64c 100644
--- a/conf/fail2ban/jails.conf
+++ b/conf/fail2ban/jails.conf
@@ -36,7 +36,7 @@ port     = http,https
 filter   = miab-owncloud
 logpath  = STORAGE_ROOT/owncloud/owncloud.log
 maxretry = 20
-findtime = 30
+findtime = 120
 
 [miab-postfix587]
 enabled  = true
diff --git a/setup/owncloud.sh b/setup/owncloud.sh
index eb12d5c9..e8d1df1f 100755
--- a/setup/owncloud.sh
+++ b/setup/owncloud.sh
@@ -126,6 +126,7 @@ if [ ! -f $STORAGE_ROOT/owncloud/owncloud.db ]; then
   'mail_from_address' => 'owncloud',
   'mail_domain' => '$PRIMARY_HOSTNAME',
   'logtimezone' => '$TIMEZONE',
+  'logdateformat' => 'Y-m-d H:i:s',
 );
 ?>
 EOF
@@ -179,6 +180,7 @@ include("$STORAGE_ROOT/owncloud/config.php");
 \$CONFIG['mail_from_address'] = 'administrator'; # just the local part, matches our master administrator address
 
 \$CONFIG['logtimezone'] = '$TIMEZONE';
+\$CONFIG['logdateformat'] = 'Y-m-d H:i:s';
 
 echo "<?php\n\\\$CONFIG = ";
 var_export(\$CONFIG);
diff --git a/tests/fail2ban.py b/tests/fail2ban.py
index feda2796..0f2f1e9f 100644
--- a/tests/fail2ban.py
+++ b/tests/fail2ban.py
@@ -86,6 +86,8 @@ def http_test(url, expected_status, postdata=None, qsargs=None, auth=None):
 			data=postdata,
 			headers={'User-Agent': 'Mail-in-a-Box fail2ban tester'},
 			timeout=8)
+	except requests.exceptions.ConnectTimeout as e:
+		raise IsBlocked()
 	except requests.exceptions.ConnectionError as e:
 		if "Connection refused" in str(e):
 			raise IsBlocked()
@@ -180,14 +182,14 @@ if __name__ == "__main__":
 	# IMAP
 	run_test(imap_test, [], 20, 30, 4)
 
-	# Mail-in-a-Box contorl panel
+	# Mail-in-a-Box control panel
 	run_test(http_test, ["/admin/me", 200], 20, 30, 1)
 
-	# Munin via the Mail-in-a-Box contorl panel
+	# Munin via the Mail-in-a-Box control panel
 	run_test(http_test, ["/admin/munin/", 401], 20, 30, 1)
 
 	# ownCloud
-	run_test(http_test, ["/cloud/remote.php/webdav", 401, None, None, ["aa", "aa"]], 20, 30, 1)
+	run_test(http_test, ["/cloud/remote.php/webdav", 401, None, None, ["aa", "aa"]], 20, 120, 1)
 
 	# restart fail2ban so that this client machine is no longer blocked
 	restart_fail2ban_service(final=True)

From fb14e30feb0ee224c79adda729dd82d3371ab262 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Mon, 27 Jun 2016 05:19:12 +0200
Subject: [PATCH 074/165] Remove owncloud log configuration from initial setup
 and only apply it during the configuration updates. This applies to both the
 timezone and the log format

---
 setup/owncloud.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/setup/owncloud.sh b/setup/owncloud.sh
index e8d1df1f..79045242 100755
--- a/setup/owncloud.sh
+++ b/setup/owncloud.sh
@@ -92,7 +92,6 @@ if [ ! -f $STORAGE_ROOT/owncloud/owncloud.db ]; then
 	mkdir -p $STORAGE_ROOT/owncloud
 
 	# Create an initial configuration file.
-	TIMEZONE=$(cat /etc/timezone)
 	instanceid=oc$(echo $PRIMARY_HOSTNAME | sha1sum | fold -w 10 | head -n 1)
 	cat > $STORAGE_ROOT/owncloud/config.php <<EOF;
 <?php
@@ -125,8 +124,6 @@ if [ ! -f $STORAGE_ROOT/owncloud/owncloud.db ]; then
   'mail_smtppassword' => '',
   'mail_from_address' => 'owncloud',
   'mail_domain' => '$PRIMARY_HOSTNAME',
-  'logtimezone' => '$TIMEZONE',
-  'logdateformat' => 'Y-m-d H:i:s',
 );
 ?>
 EOF
@@ -166,6 +163,7 @@ fi
 # * Some settings weren't included in previous versions of Mail-in-a-Box.
 # * We need to set the timezone to the system timezone to allow fail2ban to ban
 #   users within the proper timeframe
+# * We need to set the logdateformat to something that will work correctly with fail2ban
 # Use PHP to read the settings file, modify it, and write out the new settings array.
 TIMEZONE=$(cat /etc/timezone)
 CONFIG_TEMP=$(/bin/mktemp)

From b58fb54725ce75c70a8e7e7f81a70fbae840cfb9 Mon Sep 17 00:00:00 2001
From: schlypel <schlypel@users.noreply.github.com>
Date: Wed, 29 Jun 2016 13:34:54 +0200
Subject: [PATCH 075/165] added API info to aliases page template

---
 management/templates/aliases.html | 34 +++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/management/templates/aliases.html b/management/templates/aliases.html
index dc916f95..d5a123ff 100644
--- a/management/templates/aliases.html
+++ b/management/templates/aliases.html
@@ -106,6 +106,40 @@
   </table>
 </div>
 
+<h3>Mail alias API</h3>
+
+<p>Use your box&rsquo;s Mail alias API to add/remove aliases.</p>
+
+<p>Usage:</p>
+
+<pre>curl -X <b>VERB</b> [-d "<b>value</b>"] --user {email}:{password} https://{{hostname}}/admin/mail/aliases[<b>action</b>]</pre>
+
+<p>(Brackets denote an optional argument.)</p>
+<p>(Adding <code>?format=json</code> will give json encoded results)</p>
+
+<h4>Verbs</h4>
+
+<table class="table">
+<thead><th>Verb</th> <th>Action</th><th></th></thead>
+<tr><td>GET</td><td></td> <td>Returns a list of existing mail aliases.</td></tr>
+<tr><td>POST</td><td>/add</td> <td>Adds a new mail alias. Required parameters are <code>address</code> and <code>forward_to</code>.</td></tr>
+<tr><td>POST</td><td>/remove</td> <td>Removes a mail alias. Required parameter is <code>address</code>.</td></tr>
+</table>
+
+<h4>Examples:</h4>
+
+<p>Try these examples. For simplicity the examples omit the <code>--user me@mydomain.com:yourpassword</code> command line argument which you must fill in with your email address and password.</p>
+
+<pre># Gives a json encoded list of all mail users
+curl -X GET https://{{hostname}}/admin/mail/users?format=json
+
+# adds a new email alias
+curl -X POST -d "address=new_alias@mydomail.com" -d "forward_to=my_email@mydomain.com" https://{{hostname}}/admin/mail/aliases/add
+
+# removes a email alias
+curl -X POST -d "address=new_alias@mydomail.com" https://{{hostname}}/admin/mail/aliases/remove
+</pre>
+
 
 <script>
 function show_aliases() {

From 3249a55f3a6f30fecc379659bc542d4b284ac52e Mon Sep 17 00:00:00 2001
From: schlypel <schlypel@users.noreply.github.com>
Date: Wed, 29 Jun 2016 13:35:42 +0200
Subject: [PATCH 076/165] added API info to users page template

---
 management/templates/users.html | 41 +++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/management/templates/users.html b/management/templates/users.html
index b369fa89..793f0ff0 100644
--- a/management/templates/users.html
+++ b/management/templates/users.html
@@ -84,6 +84,47 @@
   </table>
 </div>
 
+<h3>Mail user API</h3>
+
+<p>Use your box&rsquo;s Mail user API to add/change/remove users.</p>
+
+<p>Usage:</p>
+
+<pre>curl -X <b>VERB</b> [-d "<b>value</b>"] --user {email}:{password} https://{{hostname}}/admin/mail/users[<b>action</b>]</pre>
+
+<p>(Brackets denote an optional argument.)</p>
+<p>(Adding <code>?format=json</code> will give json encoded results)</p>
+
+<h4>Verbs</h4>
+
+<table class="table">
+<thead><th>Verb</th> <th>Action</th><th></th></thead>
+<tr><td>GET</td><td></td> <td>Returns a list of existing mail users.</td></tr>
+<tr><td>POST</td><td>/add</td> <td>Adds a new mail user. Required parameters are <code>email</code> and <code>password</code>.</td></tr>
+<tr><td>POST</td><td>/remove</td> <td>Removes a mail user. Required parameter is <code>email</code>.</td></tr>
+<tr><td>POST</td><td>/privileges/add</td> <td>Used to make a mail user an admin. Required parameters are <code>email</code> and <code>privilege=admin</code>.</td></tr>
+<tr><td>POST</td><td>/privileges/remove</td> <td>Used to remove the admin privilege from a mail user. Required parameter is <code>email</code>.</td></tr>
+</table>
+
+<h4>Examples:</h4>
+
+<p>Try these examples. For simplicity the examples omit the <code>--user me@mydomain.com:yourpassword</code> command line argument which you must fill in with your email address and password.</p>
+
+<pre># Gives a json encoded list of all mail users
+curl -X GET https://{{hostname}}/admin/mail/users?format=json
+
+# adds a new email user
+curl -X POST -d "email=new_user@mydomail.com" -d "password=s3curE_pa5Sw0rD" https://{{hostname}}/admin/mail/users/add
+
+# removes a email user
+curl -X POST -d "email=new_user@mydomail.com" https://{{hostname}}/admin/mail/users/remove
+
+# adds admin privilege to an email user
+curl -X POST -d "email=new_user@mydomail.com" -d "privilege=admin" https://{{hostname}}/admin/mail/users/privileges/add
+
+# removes admin privilege from an email user
+curl -X POST -d "email=new_user@mydomail.com" https://{{hostname}}/admin/mail/users/privileges/remove
+</pre>
 
 <script>
 function show_users() {

From 4e3cfead4621d97c74cb05c91496f4a7f1cd8db9 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Fri, 29 Jul 2016 15:01:40 +0200
Subject: [PATCH 077/165] Add HSTS to the control panel headers (#879)

---
 conf/nginx-primaryonly.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/conf/nginx-primaryonly.conf b/conf/nginx-primaryonly.conf
index 55c80eba..eb446251 100644
--- a/conf/nginx-primaryonly.conf
+++ b/conf/nginx-primaryonly.conf
@@ -9,6 +9,7 @@
 		add_header X-Frame-Options "DENY";
 		add_header X-Content-Type-Options nosniff;
 		add_header Content-Security-Policy "frame-ancestors 'none';";
+		add_header Strict-Transport-Security max-age=31536000;
 	}
 
 	# ownCloud configuration.

From 9c8f2e75fccfbaece0c46b365d2c47f8829b9b3a Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Fri, 29 Jul 2016 15:07:16 +0200
Subject: [PATCH 078/165] allow i686 as a supported architecture

This is checked during preflight. See https://github.com/mail-in-a-box/mailinabox/issues/885 (#889)
---
 setup/preflight.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/setup/preflight.sh b/setup/preflight.sh
index c3351471..4f73fffc 100644
--- a/setup/preflight.sh
+++ b/setup/preflight.sh
@@ -47,15 +47,15 @@ if [ -e ~/.wgetrc ]; then
 	exit
 fi
 
-# Check that we are running on x86_64, any other architecture is unsupported and
+# Check that we are running on x86_64 or i686, any other architecture is unsupported and
 # will fail later in the setup when we try to install the custom build lucene packages.
 #
 # Set ARM=1 to ignore this check if you have built the packages yourself. If you do this
 # you are on your own!
 ARCHITECTURE=$(uname -m)
-if [ "$ARCHITECTURE" != "x86_64" ]; then
+if [ "$ARCHITECTURE" != "x86_64" ] && [ "$ARCHITECTURE" != "i686" ]; then
 if [ -z "$ARM" ]; then
-	echo "Mail-in-a-Box only supports x86_64 and will not work on any other architecture, like ARM."
+	echo "Mail-in-a-Box only supports x86_64 or i686 and will not work on any other architecture, like ARM."
 	echo "Your architecture is $ARCHITECTURE"
 	exit
 fi

From 6de7d59f14b95c8326e8cc778fac89cc92fcab4e Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Fri, 29 Jul 2016 09:12:01 -0400
Subject: [PATCH 079/165] changelog entries

---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 969b3917..5c273885 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,9 +9,15 @@ Mail:
 * Roundcube is updated to version 1.2.0.
 * SSLv3 and RC4 are now no longer supported in incoming and outgoing mail (SMTP port 25).
 
+Control panel:
+
+* The users and aliases APIs are now documented on their control panel pages.
+* The HSTS header was missing.
+
 System:
 
 * fail2ban jails added for SMTP submission, Roundcube, ownCloud, the control panel, and munin.
+* Mail-in-a-Box can now be installed on the i686 architecture.
 
 v0.18c (June 2, 2016)
 ---------------------

From b044dda28f7585fa5e356c359b0b108f59ed3aa7 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Fri, 29 Jul 2016 09:23:36 -0400
Subject: [PATCH 080/165] put the ufw status checks in the network section, add
 a punctuation mark, add changelog entry

---
 CHANGELOG.md                | 1 +
 management/status_checks.py | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5c273885..babb04ed 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ Control panel:
 
 * The users and aliases APIs are now documented on their control panel pages.
 * The HSTS header was missing.
+* New status checks were added for the ufw firewall.
 
 System:
 
diff --git a/management/status_checks.py b/management/status_checks.py
index f8873d8a..13cbab12 100755
--- a/management/status_checks.py
+++ b/management/status_checks.py
@@ -167,7 +167,6 @@ def run_system_checks(rounded_values, env, output):
 	check_system_aliases(env, output)
 	check_free_disk_space(rounded_values, env, output)
 	check_free_memory(rounded_values, env, output)
-	check_ufw(env, output)
 
 def check_ufw(env, output):
 	ufw = shell('check_output', ['ufw', 'status']).splitlines()
@@ -180,7 +179,7 @@ def check_ufw(env, output):
 				output.print_error("Port %s (%s) should be allowed in the firewall, please re-run the setup." % (service["port"], service["name"]))
 
 		if not_allowed_ports == 0:
-			output.print_ok("Firewall is active")
+			output.print_ok("Firewall is active.")
 	else:
 		output.print_warning("""The firewall is disabled on this machine. This might be because the system
 			is protected by an external firewall. We can't protect the system against bruteforce attacks
@@ -260,6 +259,8 @@ def run_network_checks(env, output):
 
 	output.add_heading("Network")
 
+	check_ufw(env, output)
+
 	# Stop if we cannot make an outbound connection on port 25. Many residential
 	# networks block outbound port 25 to prevent their network from sending spam.
 	# See if we can reach one of Google's MTAs with a 5-second timeout.

From cf3e1cd59587be1c815c16f65d5228c36d152247 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sun, 31 Jul 2016 20:53:57 -0400
Subject: [PATCH 081/165] add SRV records for CardDAV/CalDAV

DavDroid's latest version's account configuration no longer just asked for a hostname. Its email address & password configuration mode did not work without a SRV record.
---
 CHANGELOG.md             | 4 ++++
 management/dns_update.py | 7 +++++++
 2 files changed, 11 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index babb04ed..929f2913 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,10 @@ Control panel:
 * The HSTS header was missing.
 * New status checks were added for the ufw firewall.
 
+DNS:
+
+* Add SRV records for CardDAV/CalDAV to facilitate autoconfiguration (e.g. in DavDroid, whose latest version didn't seem to work to configure with entering just a hostname).
+
 System:
 
 * fail2ban jails added for SMTP submission, Roundcube, ownCloud, the control panel, and munin.
diff --git a/management/dns_update.py b/management/dns_update.py
index 836ad0d4..d7bbdfd0 100755
--- a/management/dns_update.py
+++ b/management/dns_update.py
@@ -274,6 +274,13 @@ def build_zone(domain, all_domains, additional_records, www_redirect_domains, en
 		if not has_rec(dmarc_qname, "TXT", prefix="v=DMARC1; "):
 			records.append((dmarc_qname, "TXT", 'v=DMARC1; p=reject', "Recommended. Prevents use of this domain name for outbound mail by specifying that the SPF rule should be honoured for mail from @%s." % (qname + "." + domain)))
 
+	# Add CardDAV/CalDAV SRV records on the non-primary hostname that points to the primary hostname.
+	# The SRV record format is priority (0, whatever), weight (0, whatever), port, service provider hostname (w/ trailing dot).
+	if domain != env["PRIMARY_HOSTNAME"]:
+		for dav in ("card", "cal"):
+			qname = "_" + dav + "davs._tcp"
+			if not has_rec(qname, "SRV"):
+				records.append((qname, "SRV", "0 0 443 " + env["PRIMARY_HOSTNAME"] + ".", "Recommended. Specifies the hostname of the server that handles CardDAV/CalDAV services for email addresses on this domain."))
 
 	# Sort the records. The None records *must* go first in the nsd zone file. Otherwise it doesn't matter.
 	records.sort(key = lambda rec : list(reversed(rec[0].split(".")) if rec[0] is not None else ""))

From 1aca6fe08fadd40f878824f61361abef60251088 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Mon, 8 Aug 2016 07:28:10 -0400
Subject: [PATCH 082/165] some minor tweaks to the new users/aliases API
 documentation

---
 management/templates/aliases.html       | 29 +++++++++----------
 management/templates/custom-dns.html    |  4 +--
 management/templates/ssl.html           |  6 ++--
 management/templates/system-backup.html |  2 +-
 management/templates/users.html         | 37 +++++++++++++------------
 5 files changed, 40 insertions(+), 38 deletions(-)

diff --git a/management/templates/aliases.html b/management/templates/aliases.html
index d5a123ff..bf8e63cd 100644
--- a/management/templates/aliases.html
+++ b/management/templates/aliases.html
@@ -106,37 +106,38 @@
   </table>
 </div>
 
-<h3>Mail alias API</h3>
+<h3>Mail aliases API (advanced)</h3>
 
-<p>Use your box&rsquo;s Mail alias API to add/remove aliases.</p>
+<p>Use your box&rsquo;s mail aliases API to add and remove mail aliases from the command-line or custom services you build.</p>
 
 <p>Usage:</p>
 
-<pre>curl -X <b>VERB</b> [-d "<b>value</b>"] --user {email}:{password} https://{{hostname}}/admin/mail/aliases[<b>action</b>]</pre>
+<pre>curl -X <b>VERB</b> [-d "<b>parameters</b>"] --user {email}:{password} https://{{hostname}}/admin/mail/aliases[<b>action</b>]</pre>
 
-<p>(Brackets denote an optional argument.)</p>
-<p>(Adding <code>?format=json</code> will give json encoded results)</p>
+<p>Brackets denote an optional argument. Please note that the POST body <code>parameters</code> must be URL-encoded.</p>
 
-<h4>Verbs</h4>
+<p>The email and password given to the <code>--user</code> option must be an administrative user on this system.</p>
 
-<table class="table">
+<h4 style="margin-bottom: 0">Verbs</h4>
+
+<table class="table" style="margin-top: .5em">
 <thead><th>Verb</th> <th>Action</th><th></th></thead>
-<tr><td>GET</td><td></td> <td>Returns a list of existing mail aliases.</td></tr>
-<tr><td>POST</td><td>/add</td> <td>Adds a new mail alias. Required parameters are <code>address</code> and <code>forward_to</code>.</td></tr>
-<tr><td>POST</td><td>/remove</td> <td>Removes a mail alias. Required parameter is <code>address</code>.</td></tr>
+<tr><td>GET</td><td><i>(none)</i></td> <td>Returns a list of existing mail aliases. Adding <code>?format=json</code> to the URL will give JSON-encoded results.</td></tr>
+<tr><td>POST</td><td>/add</td> <td>Adds a new mail alias. Required POST-body parameters are <code>address</code> and <code>forward_to</code>.</td></tr>
+<tr><td>POST</td><td>/remove</td> <td>Removes a mail alias. Required POST-body parameter is <code>address</code>.</td></tr>
 </table>
 
 <h4>Examples:</h4>
 
 <p>Try these examples. For simplicity the examples omit the <code>--user me@mydomain.com:yourpassword</code> command line argument which you must fill in with your email address and password.</p>
 
-<pre># Gives a json encoded list of all mail users
-curl -X GET https://{{hostname}}/admin/mail/users?format=json
+<pre># Gives a JSON-encoded list of all mail aliases
+curl -X GET https://{{hostname}}/admin/mail/aliases?format=json
 
-# adds a new email alias
+# Adds a new alias
 curl -X POST -d "address=new_alias@mydomail.com" -d "forward_to=my_email@mydomain.com" https://{{hostname}}/admin/mail/aliases/add
 
-# removes a email alias
+# Removes an alias
 curl -X POST -d "address=new_alias@mydomail.com" https://{{hostname}}/admin/mail/aliases/remove
 </pre>
 
diff --git a/management/templates/custom-dns.html b/management/templates/custom-dns.html
index bd5643c3..df3d82e5 100644
--- a/management/templates/custom-dns.html
+++ b/management/templates/custom-dns.html
@@ -10,7 +10,7 @@
 
 <p>It is possible to set custom DNS records on domains hosted here.</p>
 
-<h3>Set Custom DNS Records</h3>
+<h3>Set custom DNS records</h3>
 
 <p>You can set additional DNS records, such as if you have a website running on another server, to add DKIM records for external mail providers, or for various confirmation-of-ownership tests.</p>
 
@@ -66,7 +66,7 @@
   </tbody>
 </table>
 
-<h3>Using a Secondary Nameserver</h3>
+<h3>Using a secondary nameserver</h3>
 
 <p>If your TLD requires you to have two separate nameservers, you can either set up <a href="#" onclick="return show_panel('external_dns')">external DNS</a> and ignore the DNS server on this box entirely, or use the DNS server on this box but add a secondary (aka &ldquo;slave&rdquo;) nameserver.</p>
 <p>If you choose to use a seconday nameserver, you must find a seconday nameserver service provider. Your domain name registrar or virtual cloud provider may provide this service for you. Once you set up the seconday nameserver service, enter the hostname (not the IP address) of <em>their</em> secondary nameserver in the box below.</p>
diff --git a/management/templates/ssl.html b/management/templates/ssl.html
index d7e656c7..cefc82fd 100644
--- a/management/templates/ssl.html
+++ b/management/templates/ssl.html
@@ -8,7 +8,7 @@
 <p>You need a TLS certificate for this box&rsquo;s hostname ({{hostname}}) and every other domain name and subdomain that this box is hosting a website for (see the list below).</p>
 
 <div id="ssl_provision">
-<h3>Provision a Certificate</h3>
+<h3>Provision a certificate</h3>
 
 <div id="ssl_provision_p" style="display: none; margin-top: 1.5em">
   <button onclick='return provision_tls_cert();' class='btn btn-primary' style="float: left; margin: 0 1.5em 1em 0;">Provision</button>
@@ -36,7 +36,7 @@
 </div>
 </div>
 
-<h3>Certificate Status</h3>
+<h3>Certificate status</h3>
 
 <p style="margin-top: 1.5em">Certificates expire after a period of time. All certificates will be automatically renewed through <a href="https://letsencrypt.org/" target="_blank">Let&rsquo;s Encrypt</a> 14 days prior to expiration.</p>
 
@@ -53,7 +53,7 @@
 </table>
 
 
-<h3 id="ssl_install_header">Install Certificate</h3>
+<h3 id="ssl_install_header">Install certificate</h3>
 
 <p>There are many other places where you can get a free or cheap certificate. If you don't want to use our automatic Let's Encrypt integration, you can give <a href="https://www.namecheap.com/security/ssl-certificates/domain-validation.aspx">Namecheap&rsquo;s $9 certificate</a>, <a href="https://www.startssl.com/">StartSSL&rsquo;s free express lane</a>, <a href="https://buy.wosign.com/free/">WoSign&rsquo;s free TLS</a></a> or any other certificate provider a try.</p>
 
diff --git a/management/templates/system-backup.html b/management/templates/system-backup.html
index dc925916..8fceafe6 100644
--- a/management/templates/system-backup.html
+++ b/management/templates/system-backup.html
@@ -74,7 +74,7 @@
   </div>
 </form>
 
-<h3>Available Backups</h3>
+<h3>Available backups</h3>
 
 <p>The backup location currently contains the backups listed below. The total size of the backups is currently <span id="backup-total-size"></span>.</p>
 
diff --git a/management/templates/users.html b/management/templates/users.html
index 793f0ff0..2cda327c 100644
--- a/management/templates/users.html
+++ b/management/templates/users.html
@@ -84,45 +84,46 @@
   </table>
 </div>
 
-<h3>Mail user API</h3>
+<h3>Mail user API (advanced)</h3>
 
-<p>Use your box&rsquo;s Mail user API to add/change/remove users.</p>
+<p>Use your box&rsquo;s mail user API to add/change/remove users from the command-line or custom services you build.</p>
 
 <p>Usage:</p>
 
-<pre>curl -X <b>VERB</b> [-d "<b>value</b>"] --user {email}:{password} https://{{hostname}}/admin/mail/users[<b>action</b>]</pre>
+<pre>curl -X <b>VERB</b> [-d "<b>parameters</b>"] --user {email}:{password} https://{{hostname}}/admin/mail/users[<b>action</b>]</pre>
 
-<p>(Brackets denote an optional argument.)</p>
-<p>(Adding <code>?format=json</code> will give json encoded results)</p>
+<p>Brackets denote an optional argument. Please note that the POST body <code>parameters</code> must be URL-encoded.</p>
 
-<h4>Verbs</h4>
+<p>The email and password given to the <code>--user</code> option must be an administrative user on this system.</p>
 
-<table class="table">
+<h4 style="margin-bottom: 0">Verbs</h4>
+
+<table class="table" style="margin-top: .5em">
 <thead><th>Verb</th> <th>Action</th><th></th></thead>
-<tr><td>GET</td><td></td> <td>Returns a list of existing mail users.</td></tr>
-<tr><td>POST</td><td>/add</td> <td>Adds a new mail user. Required parameters are <code>email</code> and <code>password</code>.</td></tr>
-<tr><td>POST</td><td>/remove</td> <td>Removes a mail user. Required parameter is <code>email</code>.</td></tr>
-<tr><td>POST</td><td>/privileges/add</td> <td>Used to make a mail user an admin. Required parameters are <code>email</code> and <code>privilege=admin</code>.</td></tr>
-<tr><td>POST</td><td>/privileges/remove</td> <td>Used to remove the admin privilege from a mail user. Required parameter is <code>email</code>.</td></tr>
+<tr><td>GET</td><td><i>(none)</i></td> <td>Returns a list of existing mail users. Adding <code>?format=json</code> to the URL will give JSON-encoded results.</td></tr>
+<tr><td>POST</td><td>/add</td> <td>Adds a new mail user. Required POST-body parameters are <code>email</code> and <code>password</code>.</td></tr>
+<tr><td>POST</td><td>/remove</td> <td>Removes a mail user. Required POST-by parameter is <code>email</code>.</td></tr>
+<tr><td>POST</td><td>/privileges/add</td> <td>Used to make a mail user an admin. Required POST-body parameters are <code>email</code> and <code>privilege=admin</code>.</td></tr>
+<tr><td>POST</td><td>/privileges/remove</td> <td>Used to remove the admin privilege from a mail user. Required POST-body parameter is <code>email</code>.</td></tr>
 </table>
 
 <h4>Examples:</h4>
 
-<p>Try these examples. For simplicity the examples omit the <code>--user me@mydomain.com:yourpassword</code> command line argument which you must fill in with your email address and password.</p>
+<p>Try these examples. For simplicity the examples omit the <code>--user me@mydomain.com:yourpassword</code> command line argument which you must fill in with your administrative email address and password.</p>
 
-<pre># Gives a json encoded list of all mail users
+<pre># Gives a JSON-encoded list of all mail users
 curl -X GET https://{{hostname}}/admin/mail/users?format=json
 
-# adds a new email user
+# Adds a new email user
 curl -X POST -d "email=new_user@mydomail.com" -d "password=s3curE_pa5Sw0rD" https://{{hostname}}/admin/mail/users/add
 
-# removes a email user
+# Removes a email user
 curl -X POST -d "email=new_user@mydomail.com" https://{{hostname}}/admin/mail/users/remove
 
-# adds admin privilege to an email user
+# Adds admin privilege to an email user
 curl -X POST -d "email=new_user@mydomail.com" -d "privilege=admin" https://{{hostname}}/admin/mail/users/privileges/add
 
-# removes admin privilege from an email user
+# Removes admin privilege from an email user
 curl -X POST -d "email=new_user@mydomail.com" https://{{hostname}}/admin/mail/users/privileges/remove
 </pre>
 

From fc5cc9753b40c95cb9323d5d3e95a2326af8df9d Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Mon, 8 Aug 2016 07:32:02 -0400
Subject: [PATCH 083/165] roundcube 1.2.1

---
 CHANGELOG.md     | 2 +-
 setup/webmail.sh | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 929f2913..040966e0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,7 @@ In Development
 
 Mail:
 
-* Roundcube is updated to version 1.2.0.
+* Roundcube is updated to version 1.2.1.
 * SSLv3 and RC4 are now no longer supported in incoming and outgoing mail (SMTP port 25).
 
 Control panel:
diff --git a/setup/webmail.sh b/setup/webmail.sh
index bf29c6ab..8307149b 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -34,8 +34,8 @@ apt-get purge -qq -y roundcube* #NODOC
 # Install Roundcube from source if it is not already present or if it is out of date.
 # Combine the Roundcube version number with the commit hash of vacation_sieve to track
 # whether we have the latest version.
-VERSION=1.2.0
-HASH=2088985fb613b4e4e3373933ca44b26fce0489fb
+VERSION=1.2.1
+HASH=81fbfba4683522f6e54006d0300a48e6da3f3bbd
 VACATION_SIEVE_VERSION=91ea6f52216390073d1f5b70b5f6bea0bfaee7e5
 PERSISTENT_LOGIN_VERSION=1e9d724476a370ce917a2fcd5b3217b0c306c24e
 HTML5_NOTIFIER_VERSION=4b370e3cd60dabd2f428a26f45b677ad1b7118d5

From 81b5af6b64bc9797b3a018565779466d27c3bad0 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Mon, 8 Aug 2016 07:55:46 -0400
Subject: [PATCH 084/165] document fail2ban filters in security.md

---
 security.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/security.md b/security.md
index a56df082..e89eeeb9 100644
--- a/security.md
+++ b/security.md
@@ -69,6 +69,16 @@ The [setup guide video](https://mailinabox.email/) explains how to verify the ho
 
 If DNSSEC is enabled at the box's domain name's registrar, the SSHFP record that the box automatically puts into DNS can also be used to verify the host key fingerprint by setting `VerifyHostKeyDNS yes` in your `ssh/.config` file or by logging in with `ssh -o VerifyHostKeyDNS=yes`. ([source](management/dns_update.py))
 
+### Brute-force attack mitigation
+
+`fail2ban` provides some protection from brute-force login attacks (repeated logins that guess account passwords) by blocking offending IP addresses at the network level.
+
+The following services are protected: SSH, IMAP (dovecot), SMTP submission (postfix), webmail (roundcube), ownCloud/CalDAV/CardDAV (over HTTP), and the Mail-in-a-Box control panel & munin (over HTTP).
+
+Some other services running on the box may be missing fail2ban filters.
+
+`fail2ban` only blocks IPv4 addresses, however. If the box has a public IPv6 address, it is not protected from these attacks.
+
 Outbound Mail
 -------------
 

From d38b732b0a38639207ce5b102faa4f8c943411b0 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Mon, 8 Aug 2016 08:19:42 -0400
Subject: [PATCH 085/165] add a Code of Conduct

---
 CODE_OF_CONDUCT.md | 48 ++++++++++++++++++++++++++++++++++++++++++++++
 CONTRIBUTING.md    |  4 ++++
 README.md          |  4 ++--
 3 files changed, 54 insertions(+), 2 deletions(-)
 create mode 100644 CODE_OF_CONDUCT.md

diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 00000000..f71659ad
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,48 @@
+# Mail-in-a-Box Code of Conduct
+
+Mail-in-a-Box is an open source community project about working, as a group, to empower ourselves and others to have control over our own digital communications. Just as we hope to increase technological diversity on the Internet through decentralization, we also believe that diverse viewpoints and voices among our community members foster innovation and creative solutions to the challenges we face.
+
+We are committed to providing a safe, welcoming, and harrassment-free space for collaboration, for everyone, without regard to age, disability, economic situation, ethnicity, gender identity and expression, language fluency, level of knowledge or experience, nationality, personal appearance, race, religion, sexual identity and orientation, or any other attribute. Community comes first. This policy supersedes all other project goals.
+
+The maintainers of Mail-in-a-Box share the dual responsibility of leading by example and enforcing these policies as necessary to maintain an open and welcoming environment.
+
+## Scope
+
+This Code of Conduct applies to all places where Mail-in-a-Box community activity is ocurring, including in on Github, in discussion forums, on Slack, on social media, and in real life. The Code of Conduct applies not only on websites/at events run by the Mail-in-a-Box community (e.g. our Github organization, our Slack team) but also at any other location where the Mail-in-a-Box community is present (e.g. in issues of other Github organizations where Mail-in-a-Box community members are discussing problems related to Mail-in-a-Box, or real-life professional conferences), or whenever a Mail-in-a-Box community member is representing Mail-in-a-Box to the public at large or acting on behalf of Mail-in-a-Box.
+
+This code does not apply to activity on a server running Mail-in-a-Box software, unless your server is hosting a service for the Mail-in-a-Box community at large.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Showing empathy towards other community members
+* Making room for new and quieter voices
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or advances
+* Trolling, insulting/derogatory/unwelcome comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic address, without explicit permission
+* Aggressive and micro-aggressive behavior, such as unconstructive criticism, providing corrections that do not improve the conversation (sometimes referred to as "well actually"s), repeatedly interrupting or talking over someone else, feigning surprise at someone's lack of knowledge or awareness about a topic, or subtle prejudice (for example, comments like "That's so easy my grandmother could do it.", which is prejudicial toward grandmothers).
+* Other conduct which could reasonably be considered inappropriate in a professional setting
+* Retaliating against anyone who reports a violation of this code.
+
+We will not tolerate harassment. Harassment is any unwelcome or hostile behavior towards another person for any reason. This includes, but is not limited to, offensive verbal comments related to personal characteristics or choices, sexual images or comments, deliberate intimidation, bullying, stalking, following, harassing photography or recording, sustained disruption of discussion or events, nonconsensual publication of private comments, inappropriate physical contact, or unwelcome sexual attention. Conduct need not be intentional to be harassment.
+
+## Enforcement
+
+We will remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not consistent with this Code of Conduct. We may ban, temporarily or permanently, any contributor for violating this code, when appropriate.
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project lead, [Joshua Tauberer](https://razor.occams.info/). All reports will be treated confidentially, impartially, consistently, and swiftly.
+
+Because the need for confidentiality for all parties involved in an enforcement action outweighs the goals of openness, limited information will be shared with the Mail-in-a-Box community regarding enforcement actions that have taken place.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant, version 1.4](http://contributor-covenant.org/version/1/4) and the code of conduct of [Code for DC](http://codefordc.org/resources/codeofconduct.html).
+
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index a0b40f9c..8e8614a3 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -5,3 +5,7 @@ This project is in the public domain. Copyright and related rights in the work w
 All contributions to this project must be released under the same CC0 wavier. By submitting a pull request or patch, you are agreeing to comply with this waiver of copyright interest.
 
 [CC0]: http://creativecommons.org/publicdomain/zero/1.0/
+
+## Code of Conduct
+
+This project has a [Code of Conduct](CODE_OF_CONDUCT.md). Please review it when joining our community.
diff --git a/README.md b/README.md
index ad912a28..9b1af52a 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@ Mail-in-a-Box helps individuals take back control of their email by defining a o
 
 * * *
 
-I am trying to:
+Our goals are to:
 
 * Make deploying a good mail server easy.
 * Promote [decentralization](http://redecentralize.org/), innovation, and privacy on the web.
@@ -17,7 +17,7 @@ I am trying to:
 * **Not** make a totally unhackable, NSA-proof server.
 * **Not** make something customizable by power users.
 
-This setup is what has been powering my own personal email since September 2013.
+Additionally, this project has a [Code of Conduct](CODE_OF_CONDUCT.md), which supersedes the goals above. Please review it when joining our community.
 
 The Box
 -------

From 6c22c0533eb021d3d06e31bf118a7d68353cbf8d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marius=20Blu=CC=88m?= <marius@lineone.io>
Date: Tue, 9 Aug 2016 00:53:15 +0200
Subject: [PATCH 086/165] Upgrade ownCloud from 8.2.3 to 8.2.7
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marius Blüm <marius@lineone.io>
---
 setup/owncloud.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/setup/owncloud.sh b/setup/owncloud.sh
index 79045242..2e590b00 100755
--- a/setup/owncloud.sh
+++ b/setup/owncloud.sh
@@ -17,8 +17,8 @@ apt_install \
 apt-get purge -qq -y owncloud*
 
 # Install ownCloud from source of this version:
-owncloud_ver=8.2.3
-owncloud_hash=bfdf6166fbf6fc5438dc358600e7239d1c970613
+owncloud_ver=8.2.7
+owncloud_hash=723ba3f46dad219109cdf28dcc016fcd8a6bc434
 
 # Migrate <= v0.10 setups that stored the ownCloud config.php in /usr/local rather than
 # in STORAGE_ROOT. Move the file to STORAGE_ROOT.

From 6f165d0aeb2c3178a32b69b898f2d37f410a2524 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marius=20Blu=CC=88m?= <marius@lineone.io>
Date: Tue, 9 Aug 2016 00:58:10 +0200
Subject: [PATCH 087/165] Update Changelog
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marius Blüm <marius@lineone.io>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 929f2913..a90557a5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@ CHANGELOG
 In Development
 --------------
 
+ownCloud:
+
+* Updated to ownCloud to 8.2.7
+
 Mail:
 
 * Roundcube is updated to version 1.2.0.

From cdd0a821eb9b694a426da99c152817de209ada01 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sat, 13 Aug 2016 17:27:10 -0400
Subject: [PATCH 088/165] v0.19

closes #898
---
 CHANGELOG.md       | 4 ++--
 README.md          | 4 ++--
 setup/bootstrap.sh | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 040966e0..ebed0675 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,8 @@
 CHANGELOG
 =========
 
-In Development
---------------
+v0.19 (August 13, 2016)
+-----------------------
 
 Mail:
 
diff --git a/README.md b/README.md
index ad912a28..6f6937fa 100644
--- a/README.md
+++ b/README.md
@@ -59,7 +59,7 @@ by me:
 	$ curl -s https://keybase.io/joshdata/key.asc | gpg --import
 	gpg: key C10BDD81: public key "Joshua Tauberer <jt@occams.info>" imported
 
-	$ git verify-tag v0.18c
+	$ git verify-tag v0.19
 	gpg: Signature made ..... using RSA key ID C10BDD81
 	gpg: Good signature from "Joshua Tauberer <jt@occams.info>"
 	gpg: WARNING: This key is not certified with a trusted signature!
@@ -72,7 +72,7 @@ and on my [personal homepage](https://razor.occams.info/). (Of course, if this r
 
 Checkout the tag corresponding to the most recent release:
 
-	$ git checkout v0.18c
+	$ git checkout v0.19
 
 Begin the installation.
 
diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh
index 8061329b..47fbb6ec 100644
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -7,7 +7,7 @@
 #########################################################
 
 if [ -z "$TAG" ]; then
-	TAG=v0.18c
+	TAG=v0.19
 fi
 
 # Are we running as root?

From 4f2d16a31de0b63606709949a91ff44e594f2611 Mon Sep 17 00:00:00 2001
From: ReadmeCritic <frankensteinbot@gmail.com>
Date: Mon, 15 Aug 2016 08:07:09 -0700
Subject: [PATCH 089/165] Update README URLs based on HTTP redirects (#908)

---
 README.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 6f6937fa..579786ab 100644
--- a/README.md
+++ b/README.md
@@ -13,7 +13,7 @@ I am trying to:
 
 * Make deploying a good mail server easy.
 * Promote [decentralization](http://redecentralize.org/), innovation, and privacy on the web.
-* Have automated, auditable, and [idempotent](http://sharknet.us/2014/02/01/automated-configuration-management-challenges-with-idempotency/) configuration.
+* Have automated, auditable, and [idempotent](https://sharknet.us/2014/02/01/automated-configuration-management-challenges-with-idempotency/) configuration.
 * **Not** make a totally unhackable, NSA-proof server.
 * **Not** make something customizable by power users.
 
@@ -28,10 +28,10 @@ It is a one-click email appliance. There are no user-configurable setup options.
 
 The components installed are:
 
-* SMTP ([postfix](http://www.postfix.org/)), IMAP ([dovecot](http://dovecot.org/)), CardDAV/CalDAV ([ownCloud](http://owncloud.org/)), Exchange ActiveSync ([z-push](https://github.com/fmbiete/Z-Push-contrib))
+* SMTP ([postfix](http://www.postfix.org/)), IMAP ([dovecot](http://dovecot.org/)), CardDAV/CalDAV ([ownCloud](https://owncloud.org/)), Exchange ActiveSync ([z-push](https://github.com/fmbiete/Z-Push-contrib))
 * Webmail ([Roundcube](http://roundcube.net/)), static website hosting ([nginx](http://nginx.org/))
 * Spam filtering ([spamassassin](https://spamassassin.apache.org/)), greylisting ([postgrey](http://postgrey.schweikert.ch/))
-* DNS ([nsd4](http://www.nlnetlabs.nl/projects/nsd/)) with [SPF](https://en.wikipedia.org/wiki/Sender_Policy_Framework), DKIM ([OpenDKIM](http://www.opendkim.org/)), [DMARC](https://en.wikipedia.org/wiki/DMARC), [DNSSEC](https://en.wikipedia.org/wiki/DNSSEC), [DANE TLSA](https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities), and [SSHFP](https://tools.ietf.org/html/rfc4255) records automatically set
+* DNS ([nsd4](https://www.nlnetlabs.nl/projects/nsd/)) with [SPF](https://en.wikipedia.org/wiki/Sender_Policy_Framework), DKIM ([OpenDKIM](http://www.opendkim.org/)), [DMARC](https://en.wikipedia.org/wiki/DMARC), [DNSSEC](https://en.wikipedia.org/wiki/DNSSEC), [DANE TLSA](https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities), and [SSHFP](https://tools.ietf.org/html/rfc4255) records automatically set
 * Backups ([duplicity](http://duplicity.nongnu.org/)), firewall ([ufw](https://launchpad.net/ufw)), intrusion protection ([fail2ban](http://www.fail2ban.org/wiki/index.php/Main_Page)), system monitoring ([munin](http://munin-monitoring.org/))
 
 It also includes:
@@ -85,7 +85,7 @@ Post your question on the [discussion forum](https://discourse.mailinabox.email/
 The Acknowledgements
 --------------------
 
-This project was inspired in part by the ["NSA-proof your email in 2 hours"](http://sealedabstract.com/code/nsa-proof-your-e-mail-in-2-hours/) blog post by Drew Crawford, [Sovereign](https://github.com/al3x/sovereign) by Alex Payne, and conversations with <a href="http://twitter.com/shevski" target="_blank">@shevski</a>, <a href="https://github.com/konklone" target="_blank">@konklone</a>, and <a href="https://github.com/gregelin" target="_blank">@GregElin</a>.
+This project was inspired in part by the ["NSA-proof your email in 2 hours"](http://sealedabstract.com/code/nsa-proof-your-e-mail-in-2-hours/) blog post by Drew Crawford, [Sovereign](https://github.com/sovereign/sovereign) by Alex Payne, and conversations with <a href="https://twitter.com/shevski" target="_blank">@shevski</a>, <a href="https://github.com/konklone" target="_blank">@konklone</a>, and <a href="https://github.com/gregelin" target="_blank">@GregElin</a>.
 
 Mail-in-a-Box is similar to [iRedMail](http://www.iredmail.org/) and [Modoboa](https://github.com/tonioo/modoboa).
 

From 942bcfc7c5ef75c9f0d71ad924f1a162537c2f4d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marius=20Bl=C3=BCm?= <marius@lineone.io>
Date: Tue, 16 Aug 2016 00:06:12 +0200
Subject: [PATCH 090/165] Update Bootstrap to 3.3.7 (#909)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marius Blüm <marius@lineone.io>
---
 management/templates/index.html | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/management/templates/index.html b/management/templates/index.html
index 09684774..6dc4f07d 100644
--- a/management/templates/index.html
+++ b/management/templates/index.html
@@ -9,7 +9,7 @@
 
         <meta name="robots" content="noindex, nofollow">
 
-        <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css" integrity="sha384-1q8mTJOASx8j1Au+a5WDVnPi2lkFfwwEAa8hDDdjZlpLegxhjVME1fgjWPGmkzs7" crossorigin="anonymous">
+        <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" integrity="sha384-BVYiiSIFeK1dGmJRAkycuHAHRg32OmUcww7on3RYdg4Va+PmSTsz/K68vbdEjh4u" crossorigin="anonymous">
         <style>
 	    body {
 		overflow-y: scroll;
@@ -63,7 +63,7 @@
 	       margin-bottom: 1em;
 	    }
         </style>
-        <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap-theme.min.css" integrity="sha384-fLW2N01lMqjakBkx3l/M9EahuwpSfeNvV63J5ezn3uZzapT0u7EYsXMjQV+0En5r" crossorigin="anonymous">
+        <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css" integrity="sha384-rHyoN1iRsVXV4nD0JutlnGaslCJuC7uwjduW9SVrLvRYooPp2bWYgmgJQIXwl/Sp" crossorigin="anonymous">
     </head>
     <body>
 
@@ -192,7 +192,7 @@
         </div>
 
         <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js" integrity="sha256-rsPUGdUPBXgalvIj4YKJrrUlmLXbOb6Cp7cdxn1qeUc=" crossorigin="anonymous"></script>
-        <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js" integrity="sha384-0mSbJDEHialfmuBBQP6A4Qrprq5OVfW37PRR3j5ELqxss1yVqOtnepnHVP9aJ7xS" crossorigin="anonymous"></script>
+        <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js" integrity="sha384-Tc5IQib027qvyjSMfHjOMaLkfuWVxZxUPnCJA7l2mCWNIpG9mGCD8wGNIcPD7Txa" crossorigin="anonymous"></script>
 
         <script>
 var global_modal_state = null;

From 440a5450103535a88e86231c0133b097cdf7aa31 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Mon, 15 Aug 2016 20:09:05 -0400
Subject: [PATCH 091/165] some improvements suggested by the community

---
 CODE_OF_CONDUCT.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
index f71659ad..2efdfdb9 100644
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -4,11 +4,11 @@ Mail-in-a-Box is an open source community project about working, as a group, to
 
 We are committed to providing a safe, welcoming, and harrassment-free space for collaboration, for everyone, without regard to age, disability, economic situation, ethnicity, gender identity and expression, language fluency, level of knowledge or experience, nationality, personal appearance, race, religion, sexual identity and orientation, or any other attribute. Community comes first. This policy supersedes all other project goals.
 
-The maintainers of Mail-in-a-Box share the dual responsibility of leading by example and enforcing these policies as necessary to maintain an open and welcoming environment.
+The maintainers of Mail-in-a-Box share the dual responsibility of leading by example and enforcing these policies as necessary to maintain an open and welcoming environment. All community members should be excellent to each other.
 
 ## Scope
 
-This Code of Conduct applies to all places where Mail-in-a-Box community activity is ocurring, including in on Github, in discussion forums, on Slack, on social media, and in real life. The Code of Conduct applies not only on websites/at events run by the Mail-in-a-Box community (e.g. our Github organization, our Slack team) but also at any other location where the Mail-in-a-Box community is present (e.g. in issues of other Github organizations where Mail-in-a-Box community members are discussing problems related to Mail-in-a-Box, or real-life professional conferences), or whenever a Mail-in-a-Box community member is representing Mail-in-a-Box to the public at large or acting on behalf of Mail-in-a-Box.
+This Code of Conduct applies to all places where Mail-in-a-Box community activity is ocurring, including on GitHub, in discussion forums, on Slack, on social media, and in real life. The Code of Conduct applies not only on websites/at events run by the Mail-in-a-Box community (e.g. our GitHub organization, our Slack team) but also at any other location where the Mail-in-a-Box community is present (e.g. in issues of other GitHub organizations where Mail-in-a-Box community members are discussing problems related to Mail-in-a-Box, or real-life professional conferences), or whenever a Mail-in-a-Box community member is representing Mail-in-a-Box to the public at large or acting on behalf of Mail-in-a-Box.
 
 This code does not apply to activity on a server running Mail-in-a-Box software, unless your server is hosting a service for the Mail-in-a-Box community at large.
 

From 83d8dbca3edc65de072d64b6380fbd49b2f83e2b Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Thu, 18 Aug 2016 08:32:14 -0400
Subject: [PATCH 092/165] fail2ban won't start until the roundcube log file is
 created

fixes #911
---
 CHANGELOG.md      |  5 +++++
 setup/start.sh    |  9 ++++++++-
 setup/system.sh   |  5 +++++
 setup/webmail.sh  |  3 +++
 tests/fail2ban.py | 19 ++++++++++---------
 5 files changed, 31 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ebed0675..dca1d1e1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,11 @@
 CHANGELOG
 =========
 
+In Development
+--------------
+
+* fail2ban won't start if Roundcube had not yet been used - new installations probably do not have fail2ban running.
+
 v0.19 (August 13, 2016)
 -----------------------
 
diff --git a/setup/start.sh b/setup/start.sh
index 9d19a411..790afe18 100755
--- a/setup/start.sh
+++ b/setup/start.sh
@@ -111,15 +111,22 @@ source setup/zpush.sh
 source setup/management.sh
 source setup/munin.sh
 
-# Ping the management daemon to write the DNS and nginx configuration files.
+# Wait for the management daemon to start...
 until nc -z -w 4 127.0.0.1 10222
 do
 	echo Waiting for the Mail-in-a-Box management daemon to start...
 	sleep 2
 done
+
+# ...and then have it write the DNS and nginx configuration files and start those
+# services.
 tools/dns_update
 tools/web_update
 
+# Give fail2ban another restart. The log files may not all have been present when
+# fail2ban was first configured, but they should exist now.
+restart_service fail2ban
+
 # If DNS is already working, try to provision TLS certficates from Let's Encrypt.
 # Suppress extra reasons why domains aren't getting a new certificate.
 management/ssl_certificates.py -q
diff --git a/setup/system.sh b/setup/system.sh
index d9f84fda..293ac68d 100755
--- a/setup/system.sh
+++ b/setup/system.sh
@@ -299,4 +299,9 @@ cat conf/fail2ban/jails.conf \
 	> /etc/fail2ban/jail.d/mailinabox.conf
 cp -f conf/fail2ban/filter.d/* /etc/fail2ban/filter.d/
 
+# On first installation, the log files that the jails look at don't all exist.
+# e.g., The roundcube error log isn't normally created until someone logs into
+# Roundcube for the first time. This causes fail2ban to fail to start. Later
+# scripts will ensure the files exist and then fail2ban is given another
+# restart at the very end of setup.
 restart_service fail2ban
diff --git a/setup/webmail.sh b/setup/webmail.sh
index 8307149b..cdbc18ae 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -133,6 +133,9 @@ EOF
 mkdir -p /var/log/roundcubemail /tmp/roundcubemail $STORAGE_ROOT/mail/roundcube
 chown -R www-data.www-data /var/log/roundcubemail /tmp/roundcubemail $STORAGE_ROOT/mail/roundcube
 
+# Ensure the log file monitored by fail2ban exists, or else fail2ban can't start.
+sudo -u www-data touch /var/log/roundcubemail/errors
+
 # Password changing plugin settings
 # The config comes empty by default, so we need the settings 
 # we're not planning to change in config.inc.dist...
diff --git a/tests/fail2ban.py b/tests/fail2ban.py
index 0f2f1e9f..fb74e706 100644
--- a/tests/fail2ban.py
+++ b/tests/fail2ban.py
@@ -1,20 +1,20 @@
 # Test that a box's fail2ban setting are working
 # correctly by attempting a bunch of failed logins.
-# Specify SSH login information the command line -
-# we use that to reset fail2ban after each test,
-# and we extract the hostname from that to open
-# connections to.
+#
+# Specify a SSH login command (which we use to reset
+# fail2ban after each test) and the hostname to
+# try to log in to.
 ######################################################################
 
 import sys, os, time, functools
 
 # parse command line
 
-if len(sys.argv) < 2:
-	print("Usage: tests/fail2ban.py user@hostname")
+if len(sys.argv) != 3:
+	print("Usage: tests/fail2ban.py \"ssh user@hostname\" hostname")
 	sys.exit(1)
 
-ssh_user, hostname = sys.argv[1].split("@", 1)
+ssh_command, hostname = sys.argv[1:3]
 
 # define some test types
 
@@ -85,7 +85,8 @@ def http_test(url, expected_status, postdata=None, qsargs=None, auth=None):
 			auth=HTTPBasicAuth(*auth) if auth else None,
 			data=postdata,
 			headers={'User-Agent': 'Mail-in-a-Box fail2ban tester'},
-			timeout=8)
+			timeout=8,
+			verify=False) # don't bother with HTTPS validation, it may not be configured yet
 	except requests.exceptions.ConnectTimeout as e:
 		raise IsBlocked()
 	except requests.exceptions.ConnectionError as e:
@@ -106,7 +107,7 @@ def restart_fail2ban_service(final=False):
 	if not final:
 		# Stop recidive jails during testing.
 		command += " && sudo fail2ban-client stop recidive"
-	os.system("ssh %s@%s \"%s\"" % (ssh_user, hostname, command))
+	os.system("%s \"%s\"" % (ssh_command, command))
 
 def testfunc_runner(i, testfunc, *args):
 	print(i+1, end=" ", flush=True)

From 7c9f3e0b23506e322220ff586449aa58c420385f Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Thu, 18 Aug 2016 08:36:28 -0400
Subject: [PATCH 093/165] v0.19a

---
 CHANGELOG.md       | 6 ++++--
 README.md          | 4 ++--
 setup/bootstrap.sh | 2 +-
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dca1d1e1..f9d6a19c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,10 @@
 CHANGELOG
 =========
 
-In Development
---------------
+v0.19a (August 18, 2016)
+------------------------
+
+This update corrects a security issue in v0.19.
 
 * fail2ban won't start if Roundcube had not yet been used - new installations probably do not have fail2ban running.
 
diff --git a/README.md b/README.md
index 6f6937fa..2078af09 100644
--- a/README.md
+++ b/README.md
@@ -59,7 +59,7 @@ by me:
 	$ curl -s https://keybase.io/joshdata/key.asc | gpg --import
 	gpg: key C10BDD81: public key "Joshua Tauberer <jt@occams.info>" imported
 
-	$ git verify-tag v0.19
+	$ git verify-tag v0.19a
 	gpg: Signature made ..... using RSA key ID C10BDD81
 	gpg: Good signature from "Joshua Tauberer <jt@occams.info>"
 	gpg: WARNING: This key is not certified with a trusted signature!
@@ -72,7 +72,7 @@ and on my [personal homepage](https://razor.occams.info/). (Of course, if this r
 
 Checkout the tag corresponding to the most recent release:
 
-	$ git checkout v0.19
+	$ git checkout v0.19a
 
 Begin the installation.
 
diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh
index 47fbb6ec..26ca8e94 100644
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -7,7 +7,7 @@
 #########################################################
 
 if [ -z "$TAG" ]; then
-	TAG=v0.19
+	TAG=v0.19a
 fi
 
 # Are we running as root?

From 35a360ef0b0d8de3d20327ef0e4b6459492efd07 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Fri, 19 Aug 2016 12:42:43 -0400
Subject: [PATCH 094/165] simplify how munin-cgi-graph is called to reduce the
 attack surface area

Seems like if REQUEST_METHOD is set to GET, then we can drop two redundant ways the query string is given. munin-cgi-graph itself reads the environment variables only, but its calls to Perl's CGI::param will look at the command line if REQUEST_METHOD is not used, otherwise it uses environment variables like CGI used to work.

Since this is all behind admin auth anyway, there isn't a public vulnerability. #914 was opened without comment which lead me to notice the redundancy and worry about a vulnerability, before I realized this is admin-only anyway.
---
 management/daemon.py | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/management/daemon.py b/management/daemon.py
index 9bc6429b..3c712303 100755
--- a/management/daemon.py
+++ b/management/daemon.py
@@ -541,10 +541,9 @@ def munin_cgi(filename):
 	headers based on parameters in the requesting URL. All output is written
 	to stdout which munin_cgi splits into response headers and binary response
 	data.
-	munin-cgi-graph reads environment variables as well as passed input to determine
+	munin-cgi-graph reads environment variables to determine
 	what it should do. It expects a path to be in the env-var PATH_INFO, and a
-	querystring to be in the env-var QUERY_STRING as well as passed as input to the
-	command.
+	querystring to be in the env-var QUERY_STRING.
 	munin-cgi-graph has several failure modes. Some write HTTP Status headers and
 	others return nonzero exit codes.
 	Situating munin_cgi between the user-agent and munin-cgi-graph enables keeping
@@ -552,7 +551,7 @@ def munin_cgi(filename):
 	support infrastructure like spawn-fcgi.
 	"""
 
-	COMMAND = 'su - munin --preserve-environment --shell=/bin/bash -c /usr/lib/munin/cgi/munin-cgi-graph "%s"'
+	COMMAND = 'su - munin --preserve-environment --shell=/bin/bash -c /usr/lib/munin/cgi/munin-cgi-graph'
 	# su changes user, we use the munin user here
 	# --preserve-environment retains the environment, which is where Popen's `env` data is
 	# --shell=/bin/bash ensures the shell used is bash
@@ -564,12 +563,10 @@ def munin_cgi(filename):
 
 	query_str = request.query_string.decode("utf-8", 'ignore')
 
-	env = {'PATH_INFO': '/%s/' % filename, 'QUERY_STRING': query_str}
-	cmd = COMMAND % query_str
+	env = {'PATH_INFO': '/%s/' % filename, 'REQUEST_METHOD': 'GET', 'QUERY_STRING': query_str}
 	code, binout = utils.shell('check_output',
-							   cmd.split(' ', 5),
-							   # Using a maxsplit of 5 keeps the last 2 arguments together
-							   input=query_str.encode('UTF-8'),
+							   COMMAND.split(" ", 5),
+							   # Using a maxsplit of 5 keeps the last arguments together
 							   env=env,
 							   return_bytes=True,
 							   trap=True)

From a14b17794bd9a02e07f9aff2f6213a6e7d26fc2d Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Fri, 19 Aug 2016 12:42:43 -0400
Subject: [PATCH 095/165] simplify how munin-cgi-graph is called to reduce the
 attack surface area

Seems like if REQUEST_METHOD is set to GET, then we can drop two redundant ways the query string is given. munin-cgi-graph itself reads the environment variables only, but its calls to Perl's CGI::param will look at the command line if REQUEST_METHOD is not used, otherwise it uses environment variables like CGI used to work.

Since this is all behind admin auth anyway, there isn't a public vulnerability. #914 was opened without comment which lead me to notice the redundancy and worry about a vulnerability, before I realized this is admin-only anyway.

The vulnerability was created by 6d6f3ea3919d81abfd1a6eddd8787c98b761e1bb.

See #914.

This is the v0.19b hotfix commit.
---
 CHANGELOG.md         |  2 ++
 management/daemon.py | 15 ++++++---------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f9d6a19c..9c81343d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,8 @@
 CHANGELOG
 =========
 
+A remote code execution vulnerability is corrected in how the munin system monitoring graphs are generated for the control panel. The vulnerability involves an administrative user visiting a carefully crafted URL.
+
 v0.19a (August 18, 2016)
 ------------------------
 
diff --git a/management/daemon.py b/management/daemon.py
index 9bc6429b..3c712303 100755
--- a/management/daemon.py
+++ b/management/daemon.py
@@ -541,10 +541,9 @@ def munin_cgi(filename):
 	headers based on parameters in the requesting URL. All output is written
 	to stdout which munin_cgi splits into response headers and binary response
 	data.
-	munin-cgi-graph reads environment variables as well as passed input to determine
+	munin-cgi-graph reads environment variables to determine
 	what it should do. It expects a path to be in the env-var PATH_INFO, and a
-	querystring to be in the env-var QUERY_STRING as well as passed as input to the
-	command.
+	querystring to be in the env-var QUERY_STRING.
 	munin-cgi-graph has several failure modes. Some write HTTP Status headers and
 	others return nonzero exit codes.
 	Situating munin_cgi between the user-agent and munin-cgi-graph enables keeping
@@ -552,7 +551,7 @@ def munin_cgi(filename):
 	support infrastructure like spawn-fcgi.
 	"""
 
-	COMMAND = 'su - munin --preserve-environment --shell=/bin/bash -c /usr/lib/munin/cgi/munin-cgi-graph "%s"'
+	COMMAND = 'su - munin --preserve-environment --shell=/bin/bash -c /usr/lib/munin/cgi/munin-cgi-graph'
 	# su changes user, we use the munin user here
 	# --preserve-environment retains the environment, which is where Popen's `env` data is
 	# --shell=/bin/bash ensures the shell used is bash
@@ -564,12 +563,10 @@ def munin_cgi(filename):
 
 	query_str = request.query_string.decode("utf-8", 'ignore')
 
-	env = {'PATH_INFO': '/%s/' % filename, 'QUERY_STRING': query_str}
-	cmd = COMMAND % query_str
+	env = {'PATH_INFO': '/%s/' % filename, 'REQUEST_METHOD': 'GET', 'QUERY_STRING': query_str}
 	code, binout = utils.shell('check_output',
-							   cmd.split(' ', 5),
-							   # Using a maxsplit of 5 keeps the last 2 arguments together
-							   input=query_str.encode('UTF-8'),
+							   COMMAND.split(" ", 5),
+							   # Using a maxsplit of 5 keeps the last arguments together
 							   env=env,
 							   return_bytes=True,
 							   trap=True)

From ba75ff7820c652d6ba935ff0619d055cccec3ae6 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sat, 20 Aug 2016 11:42:03 -0400
Subject: [PATCH 096/165] v0.19b

---
 CHANGELOG.md       | 5 +++++
 README.md          | 4 ++--
 setup/bootstrap.sh | 2 +-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9c81343d..129090e5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,11 @@
 CHANGELOG
 =========
 
+v0.19b (August 20, 2016)
+------------------------
+
+This update corrects a security issue introduced in v0.18.
+
 A remote code execution vulnerability is corrected in how the munin system monitoring graphs are generated for the control panel. The vulnerability involves an administrative user visiting a carefully crafted URL.
 
 v0.19a (August 18, 2016)
diff --git a/README.md b/README.md
index 2078af09..fa29cb51 100644
--- a/README.md
+++ b/README.md
@@ -59,7 +59,7 @@ by me:
 	$ curl -s https://keybase.io/joshdata/key.asc | gpg --import
 	gpg: key C10BDD81: public key "Joshua Tauberer <jt@occams.info>" imported
 
-	$ git verify-tag v0.19a
+	$ git verify-tag v0.19b
 	gpg: Signature made ..... using RSA key ID C10BDD81
 	gpg: Good signature from "Joshua Tauberer <jt@occams.info>"
 	gpg: WARNING: This key is not certified with a trusted signature!
@@ -72,7 +72,7 @@ and on my [personal homepage](https://razor.occams.info/). (Of course, if this r
 
 Checkout the tag corresponding to the most recent release:
 
-	$ git checkout v0.19a
+	$ git checkout v0.19b
 
 Begin the installation.
 
diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh
index 26ca8e94..7d180bfe 100644
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -7,7 +7,7 @@
 #########################################################
 
 if [ -z "$TAG" ]; then
-	TAG=v0.19a
+	TAG=v0.19b
 fi
 
 # Are we running as root?

From fc0abd5b4d73d1ba92a5f7267f59b38ae99916a8 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Mon, 22 Aug 2016 19:18:23 -0400
Subject: [PATCH 097/165] confirm that fail2ban is protecting pop3s, closes
 #629

---
 tests/fail2ban.py | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/tests/fail2ban.py b/tests/fail2ban.py
index fb74e706..ec9530f1 100644
--- a/tests/fail2ban.py
+++ b/tests/fail2ban.py
@@ -68,6 +68,28 @@ def imap_test():
 	finally:
 		M.logout() # shuts down connection, has nothing to do with login()
 
+
+def pop_test():
+	import poplib
+	try:
+		M = poplib.POP3_SSL(hostname)
+	except ConnectionRefusedError:
+		# looks like fail2ban worked
+		raise IsBlocked()
+	try:
+		M.user('fakeuser')
+		try:
+			M.pass_('fakepassword')
+		except poplib.error_proto as e:
+			# Authentication should fail.
+			M = None # don't .quit()
+			return
+		M.list()
+		raise Exception("authentication didn't fail")
+	finally:
+		if M:
+			M.quit()
+
 def http_test(url, expected_status, postdata=None, qsargs=None, auth=None):
 	import urllib.parse
 	import requests
@@ -183,6 +205,9 @@ if __name__ == "__main__":
 	# IMAP
 	run_test(imap_test, [], 20, 30, 4)
 
+	# POP
+	run_test(pop_test, [], 20, 30, 4)
+
 	# Mail-in-a-Box control panel
 	run_test(http_test, ["/admin/me", 200], 20, 30, 1)
 

From d73d1c69002240bea6490d432853c849cc3eb55f Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 24 Aug 2016 07:47:55 -0400
Subject: [PATCH 098/165] changelog typos

---
 CHANGELOG.md | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1d0e6e0a..b3a59d67 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,7 +13,7 @@ v0.19b (August 20, 2016)
 
 This update corrects a security issue introduced in v0.18.
 
-A remote code execution vulnerability is corrected in how the munin system monitoring graphs are generated for the control panel. The vulnerability involves an administrative user visiting a carefully crafted URL.
+* A remote code execution vulnerability is corrected in how the munin system monitoring graphs are generated for the control panel. The vulnerability involves an administrative user visiting a carefully crafted URL.
 
 v0.19a (August 18, 2016)
 ------------------------
@@ -148,7 +148,6 @@ v0.16 (January 30, 2016)
 ------------------------
 
 This update primarily adds automatic SSL (now "TLS") certificate provisioning from Let's Encrypt (https://letsencrypt.org/).
-* The Sieve port is now open so tools like the Thunderbird Sieve program can be used to edit mail filters.
 
 Control Panel:
 
@@ -587,4 +586,4 @@ v0.02 (September 21, 2014)
 v0.01 (August 19, 2014)
 -----------------------
 
-First release.
+First versioned release after a year of unversioned development.

From 00bd23eb04eab5ae8235034dced95661f085bf76 Mon Sep 17 00:00:00 2001
From: "cs@twoflower" <cristian.sirbu@gmail.com>
Date: Thu, 15 Sep 2016 17:01:21 +0100
Subject: [PATCH 099/165] fix status_checks.py free disk space reporting #932

---
 management/status_checks.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/management/status_checks.py b/management/status_checks.py
index 13cbab12..527495c7 100755
--- a/management/status_checks.py
+++ b/management/status_checks.py
@@ -229,15 +229,15 @@ def check_free_disk_space(rounded_values, env, output):
 	st = os.statvfs(env['STORAGE_ROOT'])
 	bytes_total = st.f_blocks * st.f_frsize
 	bytes_free = st.f_bavail * st.f_frsize
-	if not rounded_values:
-		disk_msg = "The disk has %s GB space remaining." % str(round(bytes_free/1024.0/1024.0/1024.0*10.0)/10)
-	else:
-		disk_msg = "The disk has less than %s%% space left." % str(round(bytes_free/bytes_total/10 + .5)*10)
+	disk_msg = "The disk has %.2f GB space remaining." % (bytes_free/1024.0/1024.0/1024.0)
 	if bytes_free > .3 * bytes_total:
+		if rounded_values: disk_msg = "The disk has more than 30% free space."
 		output.print_ok(disk_msg)
 	elif bytes_free > .15 * bytes_total:
+		if rounded_values: disk_msg = "The disk has less than 30% free space."
 		output.print_warning(disk_msg)
 	else:
+		if rounded_values: disk_msg = "The disk has less than 15% free space."
 		output.print_error(disk_msg)
 
 def check_free_memory(rounded_values, env, output):
@@ -472,7 +472,7 @@ def check_dns_zone(domain, env, output, dns_zonefiles):
 				% (existing_ns, correct_ns) )
 
 	# Check that each custom secondary nameserver resolves the IP address.
-	
+
 	if custom_secondary_ns and not probably_external_dns:
 		for ns in custom_secondary_ns:
 			# We must first resolve the nameserver to an IP address so we can query it.
@@ -897,7 +897,7 @@ class FileOutput:
 class ConsoleOutput(FileOutput):
 	def __init__(self):
 		self.buf = sys.stdout
-		
+
 		# Do nice line-wrapping according to the size of the terminal.
 		# The 'stty' program queries standard input for terminal information.
 		if sys.stdin.isatty():

From 102b2d46abc1b00d690b872a9d4cd97ac79b9a8a Mon Sep 17 00:00:00 2001
From: Scott Bronson <brons_github@rinspin.com>
Date: Sun, 18 Sep 2016 05:10:49 -0700
Subject: [PATCH 100/165] typo fix: seconday -> secondary (#939)

---
 management/templates/custom-dns.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/management/templates/custom-dns.html b/management/templates/custom-dns.html
index df3d82e5..61cee904 100644
--- a/management/templates/custom-dns.html
+++ b/management/templates/custom-dns.html
@@ -69,7 +69,7 @@
 <h3>Using a secondary nameserver</h3>
 
 <p>If your TLD requires you to have two separate nameservers, you can either set up <a href="#" onclick="return show_panel('external_dns')">external DNS</a> and ignore the DNS server on this box entirely, or use the DNS server on this box but add a secondary (aka &ldquo;slave&rdquo;) nameserver.</p>
-<p>If you choose to use a seconday nameserver, you must find a seconday nameserver service provider. Your domain name registrar or virtual cloud provider may provide this service for you. Once you set up the seconday nameserver service, enter the hostname (not the IP address) of <em>their</em> secondary nameserver in the box below.</p>
+<p>If you choose to use a secondary nameserver, you must find a secondary nameserver service provider. Your domain name registrar or virtual cloud provider may provide this service for you. Once you set up the secondary nameserver service, enter the hostname (not the IP address) of <em>their</em> secondary nameserver in the box below.</p>
 
 <form class="form-horizontal" role="form" onsubmit="do_set_secondary_dns(); return false;">
   <div class="form-group">

From d8316119ebea429a01e189cd95466fed19cb16d8 Mon Sep 17 00:00:00 2001
From: Corey Hinshaw <hinshaw.25@osu.edu>
Date: Mon, 19 Sep 2016 11:10:44 -0400
Subject: [PATCH 101/165] Use Roundcube identities to populate Z-Push From name

---
 conf/zpush/backend_imap.php | 16 +++++++++-------
 setup/webmail.sh            |  7 ++-----
 setup/zpush.sh              |  1 +
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/conf/zpush/backend_imap.php b/conf/zpush/backend_imap.php
index 84dc7358..b1867625 100644
--- a/conf/zpush/backend_imap.php
+++ b/conf/zpush/backend_imap.php
@@ -8,7 +8,7 @@
 define('IMAP_SERVER', '127.0.0.1');
 define('IMAP_PORT', 993);
 define('IMAP_OPTIONS', '/ssl/norsh/novalidate-cert');
-define('IMAP_DEFAULTFROM', '');
+define('IMAP_DEFAULTFROM', 'sql');
 
 define('SYSTEM_MIME_TYPES_MAPPING', '/etc/mime.types');
 define('IMAP_AUTOSEEN_ON_DELETE', false);
@@ -23,15 +23,16 @@ define('IMAP_FOLDER_TRASH', 'TRASH');
 define('IMAP_FOLDER_SPAM', 'SPAM');
 define('IMAP_FOLDER_ARCHIVE', 'ARCHIVE');
 
-
-// not used
-define('IMAP_FROM_SQL_DSN', '');
+define('IMAP_FROM_SQL_DSN', 'sqlite:STORAGE_ROOT/mail/roundcube/roundcube.sqlite');
 define('IMAP_FROM_SQL_USER', '');
 define('IMAP_FROM_SQL_PASSWORD', '');
 define('IMAP_FROM_SQL_OPTIONS', serialize(array(PDO::ATTR_PERSISTENT => true)));
-define('IMAP_FROM_SQL_QUERY', "select first_name, last_name, mail_address from users where mail_address = '#username@#domain'");
-define('IMAP_FROM_SQL_FIELDS', serialize(array('first_name', 'last_name', 'mail_address')));
-define('IMAP_FROM_SQL_FROM', '#first_name #last_name <#mail_address>');
+define('IMAP_FROM_SQL_QUERY', "SELECT name, email FROM identities i INNER JOIN users u ON i.user_id = u.user_id WHERE u.username = '#username' AND i.standard = 1 AND i.del = 0 AND i.name <> ''");
+define('IMAP_FROM_SQL_FIELDS', serialize(array('name', 'email')));
+define('IMAP_FROM_SQL_FROM', '#name <#email>');
+define('IMAP_FROM_SQL_FULLNAME', '#name');
+
+// not used
 define('IMAP_FROM_LDAP_SERVER', '');
 define('IMAP_FROM_LDAP_SERVER_PORT', '389');
 define('IMAP_FROM_LDAP_USER', 'cn=zpush,ou=servers,dc=zpush,dc=org');
@@ -40,6 +41,7 @@ define('IMAP_FROM_LDAP_BASE', 'dc=zpush,dc=org');
 define('IMAP_FROM_LDAP_QUERY', '(mail=#username@#domain)');
 define('IMAP_FROM_LDAP_FIELDS', serialize(array('givenname', 'sn', 'mail')));
 define('IMAP_FROM_LDAP_FROM', '#givenname #sn <#mail>');
+define('IMAP_FROM_LDAP_FULLNAME', '#givenname #sn');
 
 define('IMAP_SMTP_METHOD', 'sendmail');
 
diff --git a/setup/webmail.sh b/setup/webmail.sh
index cdbc18ae..306fbd6d 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -160,11 +160,8 @@ chmod 775 $STORAGE_ROOT/mail
 chown root.www-data $STORAGE_ROOT/mail/users.sqlite 
 chmod 664 $STORAGE_ROOT/mail/users.sqlite 
 
-# Run Roundcube database migration script, if the database exists (it's created by
-# Roundcube on first use).
-if [ -f $STORAGE_ROOT/mail/roundcube/roundcube.sqlite ]; then
-	/usr/local/lib/roundcubemail/bin/updatedb.sh --dir /usr/local/lib/roundcubemail/SQL --package roundcube
-fi
+# Run Roundcube database migration script (database is created if it does not exist)
+/usr/local/lib/roundcubemail/bin/updatedb.sh --dir /usr/local/lib/roundcubemail/SQL --package roundcube
 
 # Enable PHP modules.
 php5enmod mcrypt
diff --git a/setup/zpush.sh b/setup/zpush.sh
index 33aadc0c..5cc12c51 100755
--- a/setup/zpush.sh
+++ b/setup/zpush.sh
@@ -53,6 +53,7 @@ cp conf/zpush/backend_combined.php /usr/local/lib/z-push/backend/combined/config
 # Configure IMAP
 rm -f /usr/local/lib/z-push/backend/imap/config.php
 cp conf/zpush/backend_imap.php /usr/local/lib/z-push/backend/imap/config.php
+sed -i "s%STORAGE_ROOT%$STORAGE_ROOT%" /usr/local/lib/z-push/backend/imap/config.php
 
 # Configure CardDav
 rm -f /usr/local/lib/z-push/backend/carddav/config.php

From 163daea41cdbfe521a5c7f271e4e48edf740bc57 Mon Sep 17 00:00:00 2001
From: Mathis Hoffmann <mathis@hoffpost.de>
Date: Thu, 22 Sep 2016 21:59:10 +0200
Subject: [PATCH 102/165] dnspython exception with IPv6 addresses

see #945, merges #947
---
 management/ssl_certificates.py | 11 +++++++++++
 management/status_checks.py    | 16 ++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/management/ssl_certificates.py b/management/ssl_certificates.py
index c49443b9..8de929cd 100755
--- a/management/ssl_certificates.py
+++ b/management/ssl_certificates.py
@@ -238,6 +238,17 @@ def get_certificates_to_provision(env, show_extended_problems=True, force_domain
 			except Exception as e:
 				problems[domain] = "DNS isn't configured properly for this domain: DNS lookup had an error: %s." % str(e)
 				return False
+
+			# Unfortunately, the response.__str__ returns bytes
+			# instead of string, if it resulted from an AAAA-query.
+			# We need to convert manually, until this is fixed:
+			# https://github.com/rthalley/dnspython/issues/204
+			#
+			# BEGIN HOTFIX
+			if isinstance(response[0].to_text(), bytes):
+				 response = [response[0].to_text().decode('utf-8')]
+			# END HOTFIX
+
 			if len(response) != 1 or str(response[0]) != value:
 				problems[domain] = "Domain control validation cannot be performed for this domain because DNS points the domain to another machine (%s %s)." % (rtype, ", ".join(str(r) for r in response))
 				return False
diff --git a/management/status_checks.py b/management/status_checks.py
index 527495c7..4077066a 100755
--- a/management/status_checks.py
+++ b/management/status_checks.py
@@ -680,6 +680,22 @@ def query_dns(qname, rtype, nxdomain='[Not Set]', at=None):
 	# periods from responses since that's how qnames are encoded in DNS but is
 	# confusing for us. The order of the answers doesn't matter, so sort so we
 	# can compare to a well known order.
+
+	# Unfortunately, the response.__str__ returns bytes
+	# instead of string, if it resulted from an AAAA-query.
+	# We need to convert manually, until this is fixed:
+	# https://github.com/rthalley/dnspython/issues/204
+	#
+	# BEGIN HOTFIX
+	response_new = []
+	for r in response:
+	        if isinstance(r.to_text(), bytes):
+	                response_new.append(r.to_text().decode('utf-8'))
+	        else:
+	                response_new.append(r)
+	response = response_new
+	# END HOTFIX
+
 	return "; ".join(sorted(str(r).rstrip('.') for r in response))
 
 def check_ssl_cert(domain, rounded_time, ssl_certificates, env, output):

From c26bc841a26592b7e173a3b7a05211f6d63af517 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Fri, 23 Sep 2016 07:37:17 -0400
Subject: [PATCH 103/165] more for dnspython exception with IPv6 addresses

fixes #945, corrects prev commit (#947) in case of multiple AAAA records, adds changelog
---
 CHANGELOG.md                   |  4 ++++
 management/ssl_certificates.py | 11 +++++++----
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b3a59d67..d8423b75 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ ownCloud:
 
 * Updated to ownCloud to 8.2.7.
 
+Control Panel:
+
+* Fixed a crash that occurs when there are IPv6 DNS records due to a bug in dnspython 1.14.0.
+
 v0.19b (August 20, 2016)
 ------------------------
 
diff --git a/management/ssl_certificates.py b/management/ssl_certificates.py
index 8de929cd..fd1f88c5 100755
--- a/management/ssl_certificates.py
+++ b/management/ssl_certificates.py
@@ -245,12 +245,15 @@ def get_certificates_to_provision(env, show_extended_problems=True, force_domain
 			# https://github.com/rthalley/dnspython/issues/204
 			#
 			# BEGIN HOTFIX
-			if isinstance(response[0].to_text(), bytes):
-				 response = [response[0].to_text().decode('utf-8')]
+			def rdata__str__(r):
+				s = r.to_text()
+				if isinstance(s, bytes):
+					 s = s.decode('utf-8')
+				return s
 			# END HOTFIX
 
-			if len(response) != 1 or str(response[0]) != value:
-				problems[domain] = "Domain control validation cannot be performed for this domain because DNS points the domain to another machine (%s %s)." % (rtype, ", ".join(str(r) for r in response))
+			if len(response) != 1 or rdata__str__(response[0]) != value:
+				problems[domain] = "Domain control validation cannot be performed for this domain because DNS points the domain to another machine (%s %s)." % (rtype, ", ".join(rdata__str__(r) for r in response))
 				return False
 
 		return True

From 3cd5a6eee7e9a1163252d13873530e2bd0859837 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Fri, 23 Sep 2016 07:46:01 -0400
Subject: [PATCH 104/165] changelog entries

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d8423b75..18dbc3d8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@ ownCloud:
 Control Panel:
 
 * Fixed a crash that occurs when there are IPv6 DNS records due to a bug in dnspython 1.14.0.
+* Improved the wonky low disk space check.
 
 v0.19b (August 20, 2016)
 ------------------------

From 4e4fe90fc7ba7246a7ab49aead67be7f4c435b2e Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Fri, 23 Sep 2016 07:49:13 -0400
Subject: [PATCH 105/165] v0.20

---
 CHANGELOG.md       | 4 ++--
 README.md          | 4 ++--
 setup/bootstrap.sh | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 18dbc3d8..1e61c9e3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,8 @@
 CHANGELOG
 =========
 
-In Development
---------------
+v0.20 (September 23, 2016)
+--------------------------
 
 ownCloud:
 
diff --git a/README.md b/README.md
index a2d5d31e..0883e52e 100644
--- a/README.md
+++ b/README.md
@@ -59,7 +59,7 @@ by me:
 	$ curl -s https://keybase.io/joshdata/key.asc | gpg --import
 	gpg: key C10BDD81: public key "Joshua Tauberer <jt@occams.info>" imported
 
-	$ git verify-tag v0.19b
+	$ git verify-tag v0.20
 	gpg: Signature made ..... using RSA key ID C10BDD81
 	gpg: Good signature from "Joshua Tauberer <jt@occams.info>"
 	gpg: WARNING: This key is not certified with a trusted signature!
@@ -72,7 +72,7 @@ and on my [personal homepage](https://razor.occams.info/). (Of course, if this r
 
 Checkout the tag corresponding to the most recent release:
 
-	$ git checkout v0.19b
+	$ git checkout v0.20
 
 Begin the installation.
 
diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh
index 7d180bfe..d3e7712a 100644
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -7,7 +7,7 @@
 #########################################################
 
 if [ -z "$TAG" ]; then
-	TAG=v0.19b
+	TAG=v0.20
 fi
 
 # Are we running as root?

From 5f0376bfbf77620e593d013827a25a63957f55df Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marius=20Bl=C3=BCm?= <marius@lineone.io>
Date: Fri, 23 Sep 2016 21:11:37 +0200
Subject: [PATCH 106/165] Fix typo in alias-page, fixes #943 (merges #949)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marius Blüm <marius@lineone.io>
---
 management/templates/aliases.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/management/templates/aliases.html b/management/templates/aliases.html
index bf8e63cd..78556df8 100644
--- a/management/templates/aliases.html
+++ b/management/templates/aliases.html
@@ -123,7 +123,7 @@
 <table class="table" style="margin-top: .5em">
 <thead><th>Verb</th> <th>Action</th><th></th></thead>
 <tr><td>GET</td><td><i>(none)</i></td> <td>Returns a list of existing mail aliases. Adding <code>?format=json</code> to the URL will give JSON-encoded results.</td></tr>
-<tr><td>POST</td><td>/add</td> <td>Adds a new mail alias. Required POST-body parameters are <code>address</code> and <code>forward_to</code>.</td></tr>
+<tr><td>POST</td><td>/add</td> <td>Adds a new mail alias. Required POST-body parameters are <code>address</code> and <code>forwards_to</code>.</td></tr>
 <tr><td>POST</td><td>/remove</td> <td>Removes a mail alias. Required POST-body parameter is <code>address</code>.</td></tr>
 </table>
 
@@ -135,7 +135,7 @@
 curl -X GET https://{{hostname}}/admin/mail/aliases?format=json
 
 # Adds a new alias
-curl -X POST -d "address=new_alias@mydomail.com" -d "forward_to=my_email@mydomain.com" https://{{hostname}}/admin/mail/aliases/add
+curl -X POST -d "address=new_alias@mydomail.com" -d "forwards_to=my_email@mydomain.com" https://{{hostname}}/admin/mail/aliases/add
 
 # Removes an alias
 curl -X POST -d "address=new_alias@mydomail.com" https://{{hostname}}/admin/mail/aliases/remove

From 02feeafe6ab6c8da60e506354880b12cefac78ea Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Fri, 23 Sep 2016 21:14:21 +0200
Subject: [PATCH 107/165] change bayes_file_mode to world writable (merges
 #931)

fixes #534, again, hopefully
---
 setup/spamassassin.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup/spamassassin.sh b/setup/spamassassin.sh
index ca264c0d..6c29fe8e 100755
--- a/setup/spamassassin.sh
+++ b/setup/spamassassin.sh
@@ -84,7 +84,7 @@ tools/editconf.py /etc/spamassassin/local.cf -s \
 
 tools/editconf.py /etc/spamassassin/local.cf -s \
 	bayes_path=$STORAGE_ROOT/mail/spamassassin/bayes \
-	bayes_file_mode=0660
+	bayes_file_mode=0666
 
 mkdir -p $STORAGE_ROOT/mail/spamassassin
 chown -R spampd:spampd $STORAGE_ROOT/mail/spamassassin

From 3ac4b8aca853426473288c5928ad42dc6b6bf882 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marius=20Blu=CC=88m?= <marius@lineone.io>
Date: Tue, 27 Sep 2016 15:06:50 +0200
Subject: [PATCH 108/165] Remove Certificate Providers / Fix #950
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marius Blüm <marius@lineone.io>
---
 management/templates/ssl.html | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/management/templates/ssl.html b/management/templates/ssl.html
index cefc82fd..0cc4d59a 100644
--- a/management/templates/ssl.html
+++ b/management/templates/ssl.html
@@ -55,7 +55,7 @@
 
 <h3 id="ssl_install_header">Install certificate</h3>
 
-<p>There are many other places where you can get a free or cheap certificate. If you don't want to use our automatic Let's Encrypt integration, you can give <a href="https://www.namecheap.com/security/ssl-certificates/domain-validation.aspx">Namecheap&rsquo;s $9 certificate</a>, <a href="https://www.startssl.com/">StartSSL&rsquo;s free express lane</a>, <a href="https://buy.wosign.com/free/">WoSign&rsquo;s free TLS</a></a> or any other certificate provider a try.</p>
+<p>If you don't want to use our automatic Let's Encrypt integration, you can give any other certificate provider a try. You can generate the needed CSR below.</p>
 
 <p>Which domain are you getting a certificate for?</p>
 
@@ -108,7 +108,7 @@ function show_tls(keep_provisioning_shown) {
       $('#ssl_provision_p').toggle(res.can_provision.length > 0);
       if (res.can_provision.length > 0)
           $('#ssl_provision_p span').text(res.can_provision.join(", "));
-      
+
       $('#ssl_provision_problems_div').toggle(res.cant_provision.length > 0);
       $('#ssl_provision_problems tbody').text("");
       for (var i = 0; i < res.cant_provision.length; i++) {
@@ -260,7 +260,7 @@ function provision_tls_cert() {
             }
           }
           ready_to_finish();
-          
+
           // don't re-enable the Provision button -- user must use the Retry button when it becomes enabled
           may_reenable_provision_button = false;
 
@@ -268,7 +268,7 @@ function provision_tls_cert() {
           n.find("p").addClass("text-success").text("The TLS certificate was provisioned and installed.");
           setTimeout("show_tls(true)", 1); // update main table of certificate statuses, call with arg keep_provisioning_shown true so that we don't clear what we just outputted
         }
-        
+
         // display the detailed log info in case of problems
         var trace = $("<div class='small text-muted' style='margin-top: 1.5em'>Log:</div>");
         n.append(trace);

From da5497cd1cce54e4601d616e333de98b04b95d2e Mon Sep 17 00:00:00 2001
From: yodax <michael@kroes.email>
Date: Wed, 28 Sep 2016 08:37:24 +0200
Subject: [PATCH 109/165] Update changelog entries

---
 CHANGELOG.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1e61c9e3..85693229 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,13 @@
 CHANGELOG
 =========
 
+In Development
+--------------
+
+Control panel:
+
+* Remove recommendations for Certificate Providers
+
 v0.20 (September 23, 2016)
 --------------------------
 

From 8b5eba21c0f49957461e57f02d90383268b77be2 Mon Sep 17 00:00:00 2001
From: Steve Gregg <sgregg85@users.noreply.github.com>
Date: Wed, 5 Oct 2016 18:43:50 -0400
Subject: [PATCH 110/165] Correct typo of "PRIORITY" in the template (#965)

---
 management/templates/custom-dns.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/management/templates/custom-dns.html b/management/templates/custom-dns.html
index 61cee904..30b29890 100644
--- a/management/templates/custom-dns.html
+++ b/management/templates/custom-dns.html
@@ -35,8 +35,8 @@
         <option value="AAAA" data-hint="Enter an IPv6 address.">AAAA (IPv6 address)</option>
         <option value="CNAME" data-hint="Enter another domain name followed by a period at the end (e.g. mypage.github.io.).">CNAME (DNS forwarding)</option>
         <option value="TXT" data-hint="Enter arbitrary text.">TXT (text record)</option>
-        <option value="MX" data-hint="Enter record in the form of PRIORIY DOMAIN., including trailing period (e.g. 20 mx.example.com.).">MX (mail exchanger)</option>
-        <option value="SRV" data-hint="Enter record in the form of PRIORIY WEIGHT PORT TARGET., including trailing period (e.g. 10 10 5060 sip.example.com.).">SRV (service record)</option>
+        <option value="MX" data-hint="Enter record in the form of PRIORITY DOMAIN., including trailing period (e.g. 20 mx.example.com.).">MX (mail exchanger)</option>
+        <option value="SRV" data-hint="Enter record in the form of PRIORITY WEIGHT PORT TARGET., including trailing period (e.g. 10 10 5060 sip.example.com.).">SRV (service record)</option>
       </select>
     </div>
   </div>

From a658abc95fc63ab42364ffb0587ce046d1ddce52 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Sat, 8 Oct 2016 20:35:19 +0200
Subject: [PATCH 111/165] Fix status checks for ufw when the system doesn't
 support iptables (#961)

---
 CHANGELOG.md                | 1 +
 management/status_checks.py | 9 ++++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 85693229..d1750be0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@ In Development
 Control panel:
 
 * Remove recommendations for Certificate Providers
+* Status checks failed if the system doesn't support iptables
 
 v0.20 (September 23, 2016)
 --------------------------
diff --git a/management/status_checks.py b/management/status_checks.py
index 4077066a..f138b5e9 100755
--- a/management/status_checks.py
+++ b/management/status_checks.py
@@ -169,8 +169,15 @@ def run_system_checks(rounded_values, env, output):
 	check_free_memory(rounded_values, env, output)
 
 def check_ufw(env, output):
-	ufw = shell('check_output', ['ufw', 'status']).splitlines()
+	code, ufw = shell('check_output', ['ufw', 'status'], trap=True)
 
+	if code != 0:
+		# The command failed, it's safe to say the firewall is disabled
+		output.print_warning("""The firewall is not working on this machine. An error was received
+					while trying to check the firewall. To investigate run 'sudo ufw status'.""")
+		return
+
+	ufw = ufw.splitlines()
 	if ufw[0] == "Status: active":
 		not_allowed_ports = 0
 		for service in get_services():

From bbe27df413c64ae0be3585263c7edee0b1511294 Mon Sep 17 00:00:00 2001
From: rxcomm <rxcomm@users.noreply.github.com>
Date: Sat, 15 Oct 2016 14:36:13 -0500
Subject: [PATCH 112/165] SSHFP record creation should scan nonstandard SSH
 port if necessary (#974)

* sshfp records from nonstandard ports

If port 22 is not open, dns_update.py will not create SSHFP records
because it only scans port 22 for keys. This commit modifies
dns_update.py to parse the sshd_config file for open ports, and
then obtains keys from one of them (even if port 22 is not open).

* modified test of s per JoshData request

* edit CHANGELOG per JoshData

* fix typo
---
 CHANGELOG.md             |  1 +
 management/dns_update.py | 13 ++++++++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d1750be0..1dccf38c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ Control panel:
 
 * Remove recommendations for Certificate Providers
 * Status checks failed if the system doesn't support iptables
+* Add support for SSHFP records when sshd listens on non-standard ports
 
 v0.20 (September 23, 2016)
 --------------------------
diff --git a/management/dns_update.py b/management/dns_update.py
index d7bbdfd0..784a5b08 100755
--- a/management/dns_update.py
+++ b/management/dns_update.py
@@ -348,7 +348,18 @@ def build_sshfp_records():
 	# like the known_hosts file: hostname, keytype, fingerprint. The order
 	# of the output is arbitrary, so sort it to prevent spurrious updates
 	# to the zone file (that trigger bumping the serial number).
-	keys = shell("check_output", ["ssh-keyscan", "localhost"])
+
+	# scan the sshd_config and find the ssh ports (port 22 may be closed)
+	with open('/etc/ssh/sshd_config', 'r') as f:
+		ports = []
+		t = f.readlines()
+		for line in t:
+			s = line.split()
+			if len(s) == 2 and s[0] == 'Port':
+				ports = ports + [s[1]]
+	# the keys are the same at each port, so we only need to get
+	# them at the first port found (may not be port 22)
+	keys = shell("check_output", ["ssh-keyscan", "-p", ports[0], "localhost"])
 	for key in sorted(keys.split("\n")):
 		if key.strip() == "" or key[0] == "#": continue
 		try:

From fd6226187a59b1b5783fd9db82a96cab79420301 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Sat, 15 Oct 2016 21:41:25 +0200
Subject: [PATCH 113/165] lower memory requirements to 512MB, display a warning
 if system memory is below 768MB. (#952)

---
 CHANGELOG.md       |  4 ++++
 setup/preflight.sh | 14 ++++++++++----
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1dccf38c..504e58b7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,10 @@ Control panel:
 * Status checks failed if the system doesn't support iptables
 * Add support for SSHFP records when sshd listens on non-standard ports
 
+System:
+
+* Lower memory requirements to 512MB, display a warning if system memory is below 768MB.
+
 v0.20 (September 23, 2016)
 --------------------------
 
diff --git a/setup/preflight.sh b/setup/preflight.sh
index 4f73fffc..4be2ec41 100644
--- a/setup/preflight.sh
+++ b/setup/preflight.sh
@@ -19,20 +19,26 @@ fi
 
 # Check that we have enough memory.
 #
-# /proc/meminfo reports free memory in kibibytes. Our baseline will be 768 MB,
-# which is 750000 kibibytes.
+# /proc/meminfo reports free memory in kibibytes. Our baseline will be 512 MB,
+# which is 500000 kibibytes.
+#
+# We will display a warning if the memory is below 768 MB which is 750000 kibibytes
 #
 # Skip the check if we appear to be running inside of Vagrant, because that's really just for testing.
 TOTAL_PHYSICAL_MEM=$(head -n 1 /proc/meminfo | awk '{print $2}')
-if [ $TOTAL_PHYSICAL_MEM -lt 750000 ]; then
+if [ $TOTAL_PHYSICAL_MEM -lt 500000 ]; then
 if [ ! -d /vagrant ]; then
 	TOTAL_PHYSICAL_MEM=$(expr \( \( $TOTAL_PHYSICAL_MEM \* 1024 \) / 1000 \) / 1000)
 	echo "Your Mail-in-a-Box needs more memory (RAM) to function properly."
-	echo "Please provision a machine with at least 768 MB, 1 GB recommended."
+	echo "Please provision a machine with at least 512 MB, 1 GB recommended."
 	echo "This machine has $TOTAL_PHYSICAL_MEM MB memory."
 	exit
 fi
 fi
+if [ $TOTAL_PHYSICAL_MEM -lt 750000 ]; then
+	echo "WARNING: Your Mail-in-a-Box has less than 768 MB of memory."
+	echo "         It might run unreliably when under heavy load."
+fi
 
 # Check that tempfs is mounted with exec
 MOUNTED_TMP_AS_NO_EXEC=$(grep "/tmp.*noexec" /proc/mounts)

From 2151d814531c8e725b0e4886333deb12007c2a3e Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Tue, 18 Oct 2016 12:04:13 +0200
Subject: [PATCH 114/165] update to ownCloud 9.1.1 (with intermediate upgrades)
 (#894)

[this is a squashed merge from-]

* Install owncoud 9.1 and provide an upgrade path from 8.2. This also disables memcached and goes with apc. The upgrade fails with memcached.

* Remove php apc setting

* Add dav migrations for each user

* Add some comments to the code

* When upgrading owncloud from 8.2.3 to 9.1.0 the backup of 8.2.3 was overwritten when going from 9.0 to 9.1

* Add upgrade path from 8.1.1. Only do an upgrade check if owncloud was previously installed.

* Stop php5-fpm before owncloud upgrade to prevent database locks

* Fix fail2ban tests for owncloud 9

* When upgrading owncloud copy the database to the user-data/owncloud-backup directory

* Remove not need unzip directives during owncloud extraction. Directory is removed beforehand so a normal extraction is fine

* Improve backup of owncloud installation and provide a post installation restore script. Update the owncloud version number to 9.1.1. Update the calendar and contacts apps to the latest versions

* Separate the ownCloud upgrades visually in the console output.
---
 setup/owncloud.sh         | 117 ++++++++++++++++++++++++++++++--------
 tests/fail2ban.py         |   8 +--
 tools/owncloud-restore.sh |  49 ++++++++++++++++
 3 files changed, 146 insertions(+), 28 deletions(-)
 create mode 100755 tools/owncloud-restore.sh

diff --git a/setup/owncloud.sh b/setup/owncloud.sh
index 2e590b00..deb46cb9 100755
--- a/setup/owncloud.sh
+++ b/setup/owncloud.sh
@@ -16,10 +16,6 @@ apt_install \
 
 apt-get purge -qq -y owncloud*
 
-# Install ownCloud from source of this version:
-owncloud_ver=8.2.7
-owncloud_hash=723ba3f46dad219109cdf28dcc016fcd8a6bc434
-
 # Migrate <= v0.10 setups that stored the ownCloud config.php in /usr/local rather than
 # in STORAGE_ROOT. Move the file to STORAGE_ROOT.
 if [ ! -f $STORAGE_ROOT/owncloud/config.php ] \
@@ -32,28 +28,34 @@ if [ ! -f $STORAGE_ROOT/owncloud/config.php ] \
 	ln -sf $STORAGE_ROOT/owncloud/config.php /usr/local/lib/owncloud/config/config.php
 fi
 
-# Check if ownCloud dir exist, and check if version matches owncloud_ver (if either doesn't - install/upgrade)
-if [ ! -d /usr/local/lib/owncloud/ ] \
-	|| ! grep -q $owncloud_ver /usr/local/lib/owncloud/version.php; then
+InstallOwncloud() {
+	echo
+	echo "Upgrading to ownCloud version $1"
+	echo
+
+        version=$1
+        hash=$2
+
+	# Remove the current owncloud
+	rm -rf /usr/local/lib/owncloud
 
 	# Download and verify
-	wget_verify https://download.owncloud.org/community/owncloud-$owncloud_ver.zip $owncloud_hash /tmp/owncloud.zip
-
-	# Clear out the existing ownCloud.
-	if [ -d /usr/local/lib/owncloud/ ]; then
-		echo "upgrading ownCloud to $owncloud_ver (backing up existing ownCloud directory to /tmp/owncloud-backup-$$)..."
-		mv /usr/local/lib/owncloud /tmp/owncloud-backup-$$
-	fi
+	wget_verify https://download.owncloud.org/community/owncloud-$version.zip $hash /tmp/owncloud.zip
 
 	# Extract ownCloud
-	unzip -u -o -q /tmp/owncloud.zip -d /usr/local/lib #either extracts new or replaces current files
+	unzip -q /tmp/owncloud.zip -d /usr/local/lib
 	rm -f /tmp/owncloud.zip
 
-	# The two apps we actually want are not in ownCloud core. Clone them from
+	# The two apps we actually want are not in ownCloud core. Download the releases from
 	# their github repositories.
 	mkdir -p /usr/local/lib/owncloud/apps
-	git_clone https://github.com/owncloudarchive/contacts 9ba2e667ae8c7ea36d8c4a4c3413c374beb24b1b '' /usr/local/lib/owncloud/apps/contacts
-	git_clone https://github.com/owncloudarchive/calendar 2086e738a3b7b868ec59cd61f0f88b49c3f21dd1 '' /usr/local/lib/owncloud/apps/calendar
+	wget_verify https://github.com/owncloud/contacts/releases/download/v1.4.0.0/contacts.tar.gz c1c22d29699456a45db447281682e8bc3f10e3e7 /tmp/contacts.tgz
+	tar xf /tmp/contacts.tgz -C /usr/local/lib/owncloud/apps/
+	rm /tmp/contacts.tgz
+
+        wget_verify https://github.com/nextcloud/calendar/releases/download/v1.4.0/calendar.tar.gz c84f3170efca2a99ea6254de34b0af3cb0b3a821 /tmp/calendar.tgz
+	tar xf /tmp/calendar.tgz -C /usr/local/lib/owncloud/apps/
+	rm /tmp/calendar.tgz
 
 	# Fix weird permissions.
 	chmod 750 /usr/local/lib/owncloud/{apps,config}
@@ -69,7 +71,7 @@ if [ ! -d /usr/local/lib/owncloud/ ] \
 
 	# If this isn't a new installation, immediately run the upgrade script.
 	# Then check for success (0=ok and 3=no upgrade needed, both are success).
-	if [ -f $STORAGE_ROOT/owncloud/owncloud.db ]; then
+	if [ -e $STORAGE_ROOT/owncloud/owncloud.db ]; then
 		# ownCloud 8.1.1 broke upgrades. It may fail on the first attempt, but
 		# that can be OK.
 		sudo -u www-data php /usr/local/lib/owncloud/occ upgrade
@@ -81,6 +83,76 @@ if [ ! -d /usr/local/lib/owncloud/ ] \
 			echo "...which seemed to work."
 		fi
 	fi
+}
+
+owncloud_ver=9.1.1
+
+# Check if ownCloud dir exist, and check if version matches owncloud_ver (if either doesn't - install/upgrade)
+if [ ! -d /usr/local/lib/owncloud/ ] \
+        || ! grep -q $owncloud_ver /usr/local/lib/owncloud/version.php; then
+
+	# Stop php-fpm
+	hide_output service php5-fpm stop
+
+        # Backup the existing ownCloud.
+	# Create a backup directory to store the current installation and database to
+	BACKUP_DIRECTORY=$STORAGE_ROOT/owncloud-backup/`date +"%Y-%m-%d-%T"`
+	mkdir -p "$BACKUP_DIRECTORY"
+	if [ -d /usr/local/lib/owncloud/ ]; then
+		echo "upgrading ownCloud to $owncloud_ver (backing up existing ownCloud installation, configuration and database to directory to $BACKUP_DIRECTORY..."
+		cp -r /usr/local/lib/owncloud "$BACKUP_DIRECTORY/owncloud-install"
+	fi
+	if [ -e /home/user-data/owncloud/owncloud.db ]; then
+		cp /home/user-data/owncloud/owncloud.db $BACKUP_DIRECTORY
+        fi
+        if [ -e /home/user-data/owncloud/config.php ]; then
+                cp /home/user-data/owncloud/config.php $BACKUP_DIRECTORY
+        fi
+
+	# We only need to check if we do upgrades when owncloud was previously installed
+	if [ -e /usr/local/lib/owncloud/version.php ]; then
+		if grep -q "8.1.[0-9]" /usr/local/lib/owncloud/version.php; then
+			echo "We are running 8.1.x, upgrading to 8.2.3 first"
+			InstallOwncloud 8.2.3 bfdf6166fbf6fc5438dc358600e7239d1c970613
+		fi
+
+		# If we are upgrading from 8.2.x we should go to 9.0 first. Owncloud doesn't support skipping minor versions
+		if grep -q "8.2.[0-9]" /usr/local/lib/owncloud/version.php; then
+			echo "We are running version 8.2.x, upgrading to 9.0.2 first"
+
+			# We need to disable memcached. The upgrade and install fails
+			# with memcached
+			CONFIG_TEMP=$(/bin/mktemp)
+			php <<EOF > $CONFIG_TEMP && mv $CONFIG_TEMP $STORAGE_ROOT/owncloud/config.php;
+			<?php
+				include("$STORAGE_ROOT/owncloud/config.php");
+
+				\$CONFIG['memcache.local'] = '\OC\Memcache\APC';
+
+				echo "<?php\n\\\$CONFIG = ";
+				var_export(\$CONFIG);
+				echo ";";
+			?>
+EOF
+			chown www-data.www-data $STORAGE_ROOT/owncloud/config.php
+
+			# We can now install owncloud 9.0.2
+			InstallOwncloud 9.0.2 72a3d15d09f58c06fa8bee48b9e60c9cd356f9c5
+
+			# The owncloud 9 migration doesn't migrate calendars and contacts
+			# The option to migrate these are removed in 9.1
+			# So the migrations should be done when we have 9.0 installed
+			sudo -u www-data php /usr/local/lib/owncloud/occ dav:migrate-addressbooks
+			# The following migration has to be done for each owncloud user
+			for directory in $STORAGE_ROOT/owncloud/*@*/ ; do
+				username=$(basename "${directory}")
+				sudo -u www-data php /usr/local/lib/owncloud/occ dav:migrate-calendar $username
+			done
+			sudo -u www-data php /usr/local/lib/owncloud/occ dav:sync-birthday-calendar
+		fi
+	fi
+
+	InstallOwncloud $owncloud_ver 72ed9812432f01b3a459c4afc33f5c76b71eec09
 fi
 
 # ### Configuring ownCloud
@@ -110,10 +182,7 @@ if [ ! -f $STORAGE_ROOT/owncloud/owncloud.db ]; then
       'arguments'=>array('{127.0.0.1:993/imap/ssl/novalidate-cert}')
     )
   ),
-  'memcache.local' => '\\OC\\Memcache\\Memcached',
-  "memcached_servers" => array (
-    array('127.0.0.1', 11211),
-  ),
+  'memcache.local' => '\OC\Memcache\APC',
   'mail_smtpmode' => 'sendmail',
   'mail_smtpsecure' => '',
   'mail_smtpauthtype' => 'LOGIN',
@@ -173,7 +242,7 @@ include("$STORAGE_ROOT/owncloud/config.php");
 
 \$CONFIG['trusted_domains'] = array('$PRIMARY_HOSTNAME');
 
-\$CONFIG['memcache.local'] = '\\OC\\Memcache\\Memcached';
+\$CONFIG['memcache.local'] = '\OC\Memcache\APC';
 \$CONFIG['overwrite.cli.url'] = '/cloud';
 \$CONFIG['mail_from_address'] = 'administrator'; # just the local part, matches our master administrator address
 
diff --git a/tests/fail2ban.py b/tests/fail2ban.py
index ec9530f1..0a3c1da4 100644
--- a/tests/fail2ban.py
+++ b/tests/fail2ban.py
@@ -10,11 +10,11 @@ import sys, os, time, functools
 
 # parse command line
 
-if len(sys.argv) != 3:
-	print("Usage: tests/fail2ban.py \"ssh user@hostname\" hostname")
+if len(sys.argv) != 4:
+	print("Usage: tests/fail2ban.py \"ssh user@hostname\" hostname owncloud_user")
 	sys.exit(1)
 
-ssh_command, hostname = sys.argv[1:3]
+ssh_command, hostname, owncloud_user = sys.argv[1:4]
 
 # define some test types
 
@@ -215,7 +215,7 @@ if __name__ == "__main__":
 	run_test(http_test, ["/admin/munin/", 401], 20, 30, 1)
 
 	# ownCloud
-	run_test(http_test, ["/cloud/remote.php/webdav", 401, None, None, ["aa", "aa"]], 20, 120, 1)
+	run_test(http_test, ["/cloud/remote.php/webdav", 401, None, None, [owncloud_user, "aa"]], 20, 120, 1)
 
 	# restart fail2ban so that this client machine is no longer blocked
 	restart_fail2ban_service(final=True)
diff --git a/tools/owncloud-restore.sh b/tools/owncloud-restore.sh
new file mode 100755
index 00000000..0e6a0756
--- /dev/null
+++ b/tools/owncloud-restore.sh
@@ -0,0 +1,49 @@
+#!/bin/bash
+#
+# This script will restore the backup made during an installation
+source /etc/mailinabox.conf # load global vars
+
+if [ -z "$1" ]; then
+	echo "Usage: owncloud-restore.sh <backup directory>"
+	echo
+	echo "WARNING: This will restore the database to the point of the installation!"
+	echo "         This means that you will lose all changes made by users after that point"
+	echo
+	echo
+	echo "Backups are stored here: $STORAGE_ROOT/owncloud-backup/"
+	echo
+	echo "Available backups:"
+	echo
+	find $STORAGE_ROOT/owncloud-backup/* -maxdepth 0 -type d
+	echo
+	echo "Supply the directory that was created during the last installation as the only commandline argument"
+	exit
+fi
+
+if [ ! -f $1/config.php ]; then
+	echo "This isn't a valid backup location"
+	exit
+fi
+
+echo "Restoring backup from $1"
+service php5-fpm stop
+
+# remove the current owncloud installation
+rm -rf /usr/local/lib/owncloud/
+# restore the current owncloud application
+cp -r  "$1/owncloud-install" /usr/local/lib/owncloud
+
+# restore access rights
+chmod 750 /usr/local/lib/owncloud/{apps,config}
+
+cp "$1/owncloud.db" $STORAGE_ROOT/owncloud/
+cp "$1/config.php" $STORAGE_ROOT/owncloud/
+
+ln -sf $STORAGE_ROOT/owncloud/config.php /usr/local/lib/owncloud/config/config.php
+chown -f -R www-data.www-data $STORAGE_ROOT/owncloud /usr/local/lib/owncloud
+chown www-data.www-data $STORAGE_ROOT/owncloud/config.php
+
+sudo -u www-data php /usr/local/lib/owncloud/occ maintenance:mode --off
+
+service php5-fpm start
+echo "Done"

From 4b07a6aa8fd38b60fd395cc809c3ab3bee73923e Mon Sep 17 00:00:00 2001
From: Tristan Hill <stan3@users.noreply.github.com>
Date: Tue, 18 Oct 2016 19:15:33 +0100
Subject: [PATCH 115/165] disable nested checker checks (#972)

fixes #967
---
 CHANGELOG.md          | 4 ++++
 setup/mail-postfix.sh | 6 ++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 504e58b7..1c820724 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,10 @@ System:
 
 * Lower memory requirements to 512MB, display a warning if system memory is below 768MB.
 
+Mail:
+
+* Turn off header filters for forwarded email.
+
 v0.20 (September 23, 2016)
 --------------------------
 
diff --git a/setup/mail-postfix.sh b/setup/mail-postfix.sh
index d62478e1..ca52edbd 100755
--- a/setup/mail-postfix.sh
+++ b/setup/mail-postfix.sh
@@ -91,7 +91,8 @@ tools/editconf.py /etc/postfix/main.cf \
 # * Give it a different name in syslog to distinguish it from the port 25 smtpd server.
 # * Add a new cleanup service specific to the submission service ('authclean')
 #   that filters out privacy-sensitive headers on mail being sent out by
-#   authenticated users.
+#   authenticated users.  By default Postfix also applies this to attached
+#   emails but we turn this off by setting nested_header_checks empty.
 tools/editconf.py /etc/postfix/master.cf -s -w \
 	"submission=inet n       -       -       -       -       smtpd
 	  -o syslog_name=postfix/submission
@@ -100,7 +101,8 @@ tools/editconf.py /etc/postfix/master.cf -s -w \
 	  -o smtpd_tls_ciphers=high -o smtpd_tls_exclude_ciphers=aNULL,DES,3DES,MD5,DES+MD5,RC4 -o smtpd_tls_mandatory_protocols=!SSLv2,!SSLv3
 	  -o cleanup_service_name=authclean" \
 	"authclean=unix  n       -       -       -       0       cleanup
-	  -o header_checks=pcre:/etc/postfix/outgoing_mail_header_filters"
+	  -o header_checks=pcre:/etc/postfix/outgoing_mail_header_filters
+	  -o nested_header_checks="
 
 # Install the `outgoing_mail_header_filters` file required by the new 'authclean' service.
 cp conf/postfix_outgoing_mail_header_filters /etc/postfix/outgoing_mail_header_filters

From 155bcfc654609ff3941a1a345259dc54d4d700e3 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Fri, 21 Oct 2016 16:12:46 +0200
Subject: [PATCH 116/165] Add ownCloud 9.1.1 to the changelog (#984)

---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1c820724..4dbabcdb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@ CHANGELOG
 In Development
 --------------
 
+ownCloud:
+
+* Update ownCloud to version 9.1.1
+
 Control panel:
 
 * Remove recommendations for Certificate Providers

From 2b00478b8b7f39953db4ca954990c498cc0d5c08 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Mon, 24 Oct 2016 13:59:34 +0200
Subject: [PATCH 117/165] Check if apc is disabled during ownCloud setup, if so
 enable it (#983)

---
 setup/owncloud.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/setup/owncloud.sh b/setup/owncloud.sh
index deb46cb9..b0a59ade 100755
--- a/setup/owncloud.sh
+++ b/setup/owncloud.sh
@@ -281,6 +281,12 @@ tools/editconf.py /etc/php5/fpm/php.ini -c ';' \
 	max_execution_time=600 \
 	short_open_tag=On
 
+# If apc is explicitly disabled we need to enable it
+if grep -q apc.enabled=0 /etc/php5/mods-available/apcu.ini; then
+	tools/editconf.py /etc/php5/mods-available/apcu.ini -c ';' \
+		apc.enabled=1
+fi
+
 # Set up a cron job for owncloud.
 cat > /etc/cron.hourly/mailinabox-owncloud << EOF;
 #!/bin/bash

From 6ea1a06a129751fa6472d1509661f5ad8e0fc8c7 Mon Sep 17 00:00:00 2001
From: Scott Bronson <brons_github@rinspin.com>
Date: Tue, 8 Nov 2016 18:41:02 -0800
Subject: [PATCH 118/165] suppress Ubuntu's upgrade prompts (#992)

On every login we're notified:

  New release '16.04.1 LTS' available.
  Run 'do-release-upgrade' to upgrade to it.

Disable this so that an eager yet inattentive admin
doesn't accidentally follow these instructions.
---
 setup/system.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/setup/system.sh b/setup/system.sh
index 293ac68d..bde013a3 100755
--- a/setup/system.sh
+++ b/setup/system.sh
@@ -119,6 +119,12 @@ apt_install python3 python3-dev python3-pip \
 	haveged pollinate \
 	unattended-upgrades cron ntp fail2ban
 
+# ### Suppress Upgrade Prompts
+# Since Mail-in-a-Box might jump straight to 18.04 LTS, there's no need
+# to be reminded about 16.04 on every login.
+tools/editconf.py /etc/update-manager/release-upgrades Prompt=never
+rm -f /var/lib/ubuntu-release-upgrader/release-upgrade-available
+
 # ### Set the system timezone
 #
 # Some systems are missing /etc/timezone, which we cat into the configs for

From 3b78a8d9d67f7f7f2697d20d740f6c94a344ce21 Mon Sep 17 00:00:00 2001
From: yodax <michael@kroes.email>
Date: Fri, 28 Oct 2016 11:20:05 +0200
Subject: [PATCH 119/165] If ufw isn't installed on the machine the status
 checks shouldn't fail

---
 management/status_checks.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/management/status_checks.py b/management/status_checks.py
index f138b5e9..ed1a403e 100755
--- a/management/status_checks.py
+++ b/management/status_checks.py
@@ -169,6 +169,10 @@ def run_system_checks(rounded_values, env, output):
 	check_free_memory(rounded_values, env, output)
 
 def check_ufw(env, output):
+	if not os.path.isfile('/usr/sbin/ufw'):
+		output.print_warning("""The ufw program was not installed. If your system is able to run iptables, rerun the setup.""")
+		return
+
 	code, ufw = shell('check_output', ['ufw', 'status'], trap=True)
 
 	if code != 0:

From 041b5f883fbdb3dcde5085964813d490b29197d2 Mon Sep 17 00:00:00 2001
From: guyzmo <guyzmo+github+pub@m0g.net>
Date: Sat, 12 Nov 2016 15:28:55 +0100
Subject: [PATCH 120/165] Support for rsync+ssh backup target (#678)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Added support for backup to a remote server using rsync

* updated web interface to get data from user
* added way to list files from server

It’s not using the “username” field of the yaml configuration
file to minimise the amount of patches needed. So the username
is actually sorted within the rsync URL.

Signed-off-by: Bernard `Guyzmo` Pratz <guyzmo+github@m0g.net>

* Added ssh key generation upon installation for root user.

Signed-off-by: Bernard `Guyzmo` Pratz <guyzmo+github@m0g.net>

* Removed stale blank lines, and fixed typo

Signed-off-by: Bernard `Guyzmo` Pratz <guyzmo+github@m0g.net>

* fix backup-location lines, by switching it from id to class

* Various web UI fixes

- fixed user field being shadowed ;
- fixed settings reading comparaison ;
- fixed forgotten min-age field.

Signed-off-by: Bernard `Guyzmo` Pratz <guyzmo+github@m0g.net>

* Added SSH Public Key shown on the web interface UI

Signed-off-by: Bernard `Guyzmo` Pratz <guyzmo+github@m0g.net>

* trailing spaces.

Signed-off-by: Bernard `Guyzmo` Pratz <guyzmo+github@m0g.net>

* fixed the extraneous environment

Signed-off-by: Bernard `Guyzmo` Pratz <guyzmo+github@m0g.net>

* Updated key setup

- made key lower in bits, but stronger (using -a option),
- made ssh-keygen run in background using nohup,
- added independent key file, as id_rsa_miab,
- added ssh-options to all duplicity calls to use the id_rsa_miab keyfile,
- changed path to the public key display

Signed-off-by: Bernard `Guyzmo` Pratz <guyzmo+github@m0g.net>

* added rsync options for ssh identity support

Signed-off-by: Bernard `Guyzmo` Pratz <guyzmo+github@m0g.net>

* removed strict host checking for all backup operations

Signed-off-by: Bernard `Guyzmo` Pratz <guyzmo+github@m0g.net>

* Remove nohup from ssh-keygen so errors aren't hidden. Also only generate a key if none exists yet

* Add trailing slash when checking a remote backup. Also check if we actually can read the remote size

* Factorisation of the repeated rsync/ssh options

cf https://github.com/mail-in-a-box/mailinabox/pull/678#discussion_r81478919

* Updated message SSH key creation

https://github.com/mail-in-a-box/mailinabox/pull/678#discussion_r81478886
---
 management/backup.py                    | 69 +++++++++++++++-----
 management/templates/system-backup.html | 84 +++++++++++++++++++++----
 setup/system.sh                         |  6 ++
 3 files changed, 131 insertions(+), 28 deletions(-)

diff --git a/management/backup.py b/management/backup.py
index be87a429..c1ba03c5 100755
--- a/management/backup.py
+++ b/management/backup.py
@@ -30,6 +30,11 @@ def backup_status(env):
 	backups = { }
 	backup_cache_dir = os.path.join(backup_root, 'cache')
 
+	rsync_ssh_options = [
+		"--ssh-options='-i /root/.ssh/id_rsa_miab'",
+		"--rsync-options=-e \"/usr/bin/ssh -oStrictHostKeyChecking=no -oBatchMode=yes -p 22 -i /root/.ssh/id_rsa_miab\"",
+	]
+
 	def reldate(date, ref, clip):
 		if ref < date: return clip
 		rd = dateutil.relativedelta.relativedelta(ref, date)
@@ -52,6 +57,7 @@ def backup_status(env):
 			"size": 0, # collection-status doesn't give us the size
 			"volumes": keys[2], # number of archive volumes for this backup (not really helpful)
 		}
+
 	code, collection_status = shell('check_output', [
 		"/usr/bin/duplicity",
 		"collection-status",
@@ -59,7 +65,7 @@ def backup_status(env):
 		"--gpg-options", "--cipher-algo=AES256",
 		"--log-fd", "1",
 		config["target"],
-		],
+		] + rsync_ssh_options,
 		get_env(env),
 		trap=True)
 	if code != 0:
@@ -177,24 +183,24 @@ def get_passphrase(env):
 	with open(os.path.join(backup_root, 'secret_key.txt')) as f:
 		passphrase = f.readline().strip()
 	if len(passphrase) < 43: raise Exception("secret_key.txt's first line is too short!")
-	
+
 	return passphrase
 
 def get_env(env):
 	config = get_backup_config(env)
-	
+
 	env = { "PASSPHRASE" : get_passphrase(env) }
-	
+
 	if get_target_type(config) == 's3':
 		env["AWS_ACCESS_KEY_ID"] = config["target_user"]
 		env["AWS_SECRET_ACCESS_KEY"] = config["target_pass"]
-	
+
 	return env
-	
+
 def get_target_type(config):
 	protocol = config["target"].split(":")[0]
 	return protocol
-	
+
 def perform_backup(full_backup):
 	env = load_environment()
 
@@ -204,7 +210,7 @@ def perform_backup(full_backup):
 	backup_cache_dir = os.path.join(backup_root, 'cache')
 	backup_dir = os.path.join(backup_root, 'encrypted')
 
-	# Are backups dissbled?
+	# Are backups disabled?
 	if config["target"] == "off":
 		return
 
@@ -283,7 +289,7 @@ def perform_backup(full_backup):
 			env["STORAGE_ROOT"],
 			config["target"],
 			"--allow-source-mismatch"
-			],
+			] + rsync_ssh_options,
 			get_env(env))
 	finally:
 		# Start services again.
@@ -305,7 +311,7 @@ def perform_backup(full_backup):
 		"--archive-dir", backup_cache_dir,
 		"--force",
 		config["target"]
-		],
+		] + rsync_ssh_options,
 		get_env(env))
 
 	# From duplicity's manual:
@@ -320,7 +326,7 @@ def perform_backup(full_backup):
 		"--archive-dir", backup_cache_dir,
 		"--force",
 		config["target"]
-		],
+		] + rsync_ssh_options,
 		get_env(env))
 
 	# Change ownership of backups to the user-data user, so that the after-bcakup
@@ -359,7 +365,7 @@ def run_duplicity_verification():
 		"--exclude", backup_root,
 		config["target"],
 		env["STORAGE_ROOT"],
-	], get_env(env))
+	] + rsync_ssh_options, get_env(env))
 
 def run_duplicity_restore(args):
 	env = load_environment()
@@ -370,7 +376,7 @@ def run_duplicity_restore(args):
 		"restore",
 		"--archive-dir", backup_cache_dir,
 		config["target"],
-		] + args,
+		] + rsync_ssh_options + args,
 	get_env(env))
 
 def list_target_files(config):
@@ -383,6 +389,34 @@ def list_target_files(config):
 	if p.scheme == "file":
 		return [(fn, os.path.getsize(os.path.join(p.path, fn))) for fn in os.listdir(p.path)]
 
+	elif p.scheme == "rsync":
+		rsync_fn_size_re = re.compile(r'.*    ([^ ]*) [^ ]* [^ ]* (.*)')
+		rsync_target = '{host}:{path}'
+
+		_, target_host, target_path = config['target'].split('//')
+		target_path = '/' + target_path
+		if not target_path.endswith('/'):
+			target_path += '/'
+
+		rsync_command = [ 'rsync',
+					'-e',
+					'/usr/bin/ssh -i /root/.ssh/id_rsa_miab -oStrictHostKeyChecking=no -oBatchMode=yes',
+					'--list-only',
+					'-r',
+					rsync_target.format(
+						host=target_host,
+						path=target_path)
+				]
+
+		code, listing = shell('check_output', rsync_command, trap=True)
+		if code == 0:
+			for l in listing.split('\n'):
+				match = rsync_fn_size_re.match(l)
+				if match:
+					yield (match.groups()[1], int(match.groups()[0].replace(',','')))
+		else:
+			raise ValueError("Connection to rsync host failed")
+
 	elif p.scheme == "s3":
 		# match to a Region
 		fix_boto() # must call prior to importing boto
@@ -425,7 +459,7 @@ def list_target_files(config):
 
 def backup_set_custom(env, target, target_user, target_pass, min_age):
 	config = get_backup_config(env, for_save=True)
-	
+
 	# min_age must be an int
 	if isinstance(min_age, str):
 		min_age = int(min_age)
@@ -443,11 +477,11 @@ def backup_set_custom(env, target, target_user, target_pass, min_age):
 			list_target_files(config)
 	except ValueError as e:
 		return str(e)
-	
+
 	write_backup_config(env, config)
 
 	return "OK"
-	
+
 def get_backup_config(env, for_save=False, for_ui=False):
 	backup_root = os.path.join(env["STORAGE_ROOT"], 'backup')
 
@@ -482,6 +516,9 @@ def get_backup_config(env, for_save=False, for_ui=False):
 	if config["target"] == "local":
 		# Expand to the full URL.
 		config["target"] = "file://" + config["file_target_directory"]
+	ssh_pub_key = os.path.join('/root', '.ssh', 'id_rsa_miab.pub')
+	if os.path.exists(ssh_pub_key):
+		config["ssh_pub_key"] = open(ssh_pub_key, 'r').read()
 
 	return config
 
diff --git a/management/templates/system-backup.html b/management/templates/system-backup.html
index 8fceafe6..63a220e8 100644
--- a/management/templates/system-backup.html
+++ b/management/templates/system-backup.html
@@ -16,16 +16,60 @@
       <select class="form-control" rows="1" id="backup-target-type" onchange="toggle_form()">
         <option value="off">Nowhere (Disable Backups)</option>
         <option value="local">{{hostname}}</option>
+        <option value="rsync">rsync</option>
         <option value="s3">Amazon S3</option>
       </select>
     </div>
   </div>
+  <!-- LOCAL BACKUP -->
   <div class="form-group backup-target-local">
     <div class="col-sm-10 col-sm-offset-2">
-      <p>Backups are stored on this machine&rsquo;s own hard disk. You are responsible for periodically using SFTP (FTP over SSH) to copy the backup files from <tt id="backup-location"></tt> to a safe location. These files are encrypted, so they are safe to store anywhere.</p>
+      <p>Backups are stored on this machine&rsquo;s own hard disk. You are responsible for periodically using SFTP (FTP over SSH) to copy the backup files from <tt class="backup-location"></tt> to a safe location. These files are encrypted, so they are safe to store anywhere.</p>
       <p>Separately copy the encryption password from <tt class="backup-encpassword-file"></tt> to a safe and secure location. You will need this file to decrypt backup files.</p>
     </div>
   </div>
+  <!-- RSYNC BACKUP -->
+  <div class="form-group backup-target-rsync">
+    <div class="col-sm-10 col-sm-offset-2">
+
+      <p>Backups synced to a remote machine using rsync over SSH, with local
+      copies in <tt class="backup-location"></tt>. These files are encrypted, so
+      they are safe to store anywhere.</p> <p>Separately copy the encryption
+      password from <tt class="backup-encpassword-file"></tt> to a safe and
+      secure location. You will need this file to decrypt backup files.</p>
+
+    </div>
+  </div>
+  <div class="form-group backup-target-rsync">
+    <label for="backup-target-rsync-host" class="col-sm-2 control-label">Hostname</label>
+    <div class="col-sm-8">
+      <input type="text" placeholder="hostname.local" class="form-control" rows="1" id="backup-target-rsync-host">
+    </div>
+  </div>
+  <div class="form-group backup-target-rsync">
+    <label for="backup-target-rsync-path" class="col-sm-2 control-label">Path</label>
+    <div class="col-sm-8">
+        <input type="text" placeholder="/backups/{{hostname}}" class="form-control" rows="1" id="backup-target-rsync-path">
+    </div>
+  </div>
+  <div class="form-group backup-target-rsync">
+    <label for="backup-target-rsync-user" class="col-sm-2 control-label">Username</label>
+    <div class="col-sm-8">
+      <input type="text" class="form-control" rows="1" id="backup-target-rsync-user">
+    </div>
+  </div>
+  <div class="form-group backup-target-rsync">
+    <label for="ssh-pub-key" class="col-sm-2 control-label">Public SSH Key</label>
+    <div class="col-sm-8">
+      <input type="text" class="form-control" rows="1" id="ssh-pub-key" readonly>
+      <div class="small" style="margin-top: 2px">
+        Copy the Public SSH Key above, and paste it within the <tt>~/.ssh/authorized_keys</tt>
+        of target user on the backup server specified above. That way you'll enable secure and
+        passwordless authentication from your mail-in-a-box server and your backup server.
+      </div>
+    </div>
+  </div>
+  <!-- S3 BACKUP -->
   <div class="form-group backup-target-s3">
     <div class="col-sm-10 col-sm-offset-2">
       <p>Backups are stored in an Amazon Web Services S3 bucket. You must have an AWS account already.</p>
@@ -60,7 +104,8 @@
       <input type="text" class="form-control" rows="1" id="backup-target-pass">
     </div>
   </div>
-  <div class="form-group backup-target-local backup-target-s3">
+  <!-- Common -->
+  <div class="form-group backup-target-local backup-target-rsync backup-target-s3">
     <label for="min-age" class="col-sm-2 control-label">Days:</label>
     <div class="col-sm-8">
       <input type="number" class="form-control" rows="1" id="min-age">
@@ -92,7 +137,7 @@
 
 function toggle_form() {
   var target_type = $("#backup-target-type").val();
-  $(".backup-target-local, .backup-target-s3").hide();
+  $(".backup-target-local, .backup-target-rsync, .backup-target-s3").hide();
   $(".backup-target-" + target_type).show();
 }
 
@@ -114,7 +159,7 @@ function nice_size(bytes) {
 
 function show_system_backup() {
   show_custom_backup()
-  
+
   $('#backup-status tbody').html("<tr><td colspan='2' class='text-muted'>Loading...</td></tr>")
   api(
     "/system/backup/status",
@@ -160,28 +205,37 @@ function show_system_backup() {
 }
 
 function show_custom_backup() {
-    $(".backup-target-local, .backup-target-s3").hide();
+    $(".backup-target-local, .backup-target-rsync, .backup-target-s3").hide();
     api(
       "/system/backup/config",
       "GET",
       { },
       function(r) {
+        $("#backup-target-user").val(r.target_user);
+        $("#backup-target-pass").val(r.target_pass);
+        $("#min-age").val(r.min_age_in_days);
+        $(".backup-location").text(r.file_target_directory);
+        $(".backup-encpassword-file").text(r.enc_pw_file);
+        $("#ssh-pub-key").val(r.ssh_pub_key);
+
         if (r.target == "file://" + r.file_target_directory) {
           $("#backup-target-type").val("local");
         } else if (r.target == "off") {
           $("#backup-target-type").val("off");
+        } else if (r.target.substring(0, 8) == "rsync://") {
+          $("#backup-target-type").val("rsync");
+          var path = r.target.substring(8).split('//');
+          var [ user, host ] = path.shift().split('@');
+          $("#backup-target-rsync-user").val(user);
+          $("#backup-target-rsync-host").val(host);
+          $("#backup-target-rsync-path").val('/'+path);
         } else if (r.target.substring(0, 5) == "s3://") {
           $("#backup-target-type").val("s3");
-	  var hostpath = r.target.substring(5).split('/');
+          var hostpath = r.target.substring(5).split('/');
           var host = hostpath.shift();
           $("#backup-target-s3-host").val(host);
           $("#backup-target-s3-path").val(hostpath.join('/'));
         }
-        $("#backup-target-user").val(r.target_user);
-        $("#backup-target-pass").val(r.target_pass);
-        $("#min-age").val(r.min_age_in_days);
-        $('#backup-location').text(r.file_target_directory);
-        $('.backup-encpassword-file').text(r.enc_pw_file);
         toggle_form()
       })
 }
@@ -190,12 +244,18 @@ function set_custom_backup() {
   var target_type = $("#backup-target-type").val();
   var target_user = $("#backup-target-user").val();
   var target_pass = $("#backup-target-pass").val();
-  
+
   var target;
   if (target_type == "local" || target_type == "off")
     target = target_type;
   else if (target_type == "s3")
     target = "s3://" + $("#backup-target-s3-host").val() + "/" + $("#backup-target-s3-path").val();
+  else if (target_type == "rsync") {
+    target = "rsync://" + $("#backup-target-rsync-user").val() + "@" + $("#backup-target-rsync-host").val()
+                                                                + "/" + $("#backup-target-rsync-path").val();
+    target_user = '';
+  }
+
 
   var min_age = $("#min-age").val();
   api(
diff --git a/setup/system.sh b/setup/system.sh
index bde013a3..53fae9d6 100755
--- a/setup/system.sh
+++ b/setup/system.sh
@@ -214,6 +214,12 @@ pollinate  -q -r
 
 # Between these two, we really ought to be all set.
 
+# We need an ssh key to store backups via rsync, if it doesn't exist create one
+if [ ! -f /root/.ssh/id_rsa_miab ]; then
+	echo 'Creating SSH key for backup…'
+	ssh-keygen -t rsa -b 2048 -a 100 -f /root/.ssh/id_rsa_miab -N '' -q
+fi
+
 # ### Package maintenance
 #
 # Allow apt to install system updates automatically every day.

From abb6a1a07025f1440d1b5e00c4bd47a20c1b23f6 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sat, 12 Nov 2016 09:34:52 -0500
Subject: [PATCH 121/165] changelog entries

---
 CHANGELOG.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4dbabcdb..cf6e527e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,17 +10,21 @@ ownCloud:
 
 Control panel:
 
+* Backups can now be made using rsync-over-ssh!
 * Remove recommendations for Certificate Providers
-* Status checks failed if the system doesn't support iptables
+* Status checks failed if the system doesn't support iptables or doesn't have ufw installed.
 * Add support for SSHFP records when sshd listens on non-standard ports
 
 System:
 
+* Ubuntu's "Upgrade to 16.04" notice is suppressed since you should not do that.
 * Lower memory requirements to 512MB, display a warning if system memory is below 768MB.
 
 Mail:
 
 * Turn off header filters for forwarded email.
+* Another go at fixing a long-standing issue with training the spam filter not working (because of a file permissions issue).
+* Exchange/ActiveSync will now use your display name set in Roundcube in the From: line of outgoing email.
 
 v0.20 (September 23, 2016)
 --------------------------

From 96b3a2980078ed34e40dbf799175fb26193c1c4c Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sat, 12 Nov 2016 09:58:49 -0500
Subject: [PATCH 122/165] rsync backup broke other things

---
 management/backup.py                    | 14 ++++++++------
 management/templates/system-backup.html |  8 ++++----
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/management/backup.py b/management/backup.py
index c1ba03c5..e93b6fcb 100755
--- a/management/backup.py
+++ b/management/backup.py
@@ -13,6 +13,11 @@ import rtyaml
 
 from utils import exclusive_process, load_environment, shell, wait_for_service, fix_boto
 
+rsync_ssh_options = [
+	"--ssh-options='-i /root/.ssh/id_rsa_miab'",
+	"--rsync-options=-e \"/usr/bin/ssh -oStrictHostKeyChecking=no -oBatchMode=yes -p 22 -i /root/.ssh/id_rsa_miab\"",
+]
+
 def backup_status(env):
 	# Root folder
 	backup_root = os.path.join(env["STORAGE_ROOT"], 'backup')
@@ -30,11 +35,6 @@ def backup_status(env):
 	backups = { }
 	backup_cache_dir = os.path.join(backup_root, 'cache')
 
-	rsync_ssh_options = [
-		"--ssh-options='-i /root/.ssh/id_rsa_miab'",
-		"--rsync-options=-e \"/usr/bin/ssh -oStrictHostKeyChecking=no -oBatchMode=yes -p 22 -i /root/.ssh/id_rsa_miab\"",
-	]
-
 	def reldate(date, ref, clip):
 		if ref < date: return clip
 		rd = dateutil.relativedelta.relativedelta(ref, date)
@@ -410,10 +410,12 @@ def list_target_files(config):
 
 		code, listing = shell('check_output', rsync_command, trap=True)
 		if code == 0:
+			ret = []
 			for l in listing.split('\n'):
 				match = rsync_fn_size_re.match(l)
 				if match:
-					yield (match.groups()[1], int(match.groups()[0].replace(',','')))
+					ret.append( (match.groups()[1], int(match.groups()[0].replace(',',''))) )
+			return ret
 		else:
 			raise ValueError("Connection to rsync host failed")
 
diff --git a/management/templates/system-backup.html b/management/templates/system-backup.html
index 63a220e8..0ccb4bd6 100644
--- a/management/templates/system-backup.html
+++ b/management/templates/system-backup.html
@@ -225,10 +225,10 @@ function show_custom_backup() {
         } else if (r.target.substring(0, 8) == "rsync://") {
           $("#backup-target-type").val("rsync");
           var path = r.target.substring(8).split('//');
-          var [ user, host ] = path.shift().split('@');
-          $("#backup-target-rsync-user").val(user);
-          $("#backup-target-rsync-host").val(host);
-          $("#backup-target-rsync-path").val('/'+path);
+          var host_parts = path.shift().split('@');
+          $("#backup-target-rsync-user").val(host_parts[0]);
+          $("#backup-target-rsync-host").val(host_parts[1]);
+          $("#backup-target-rsync-path").val('/'+path[0]);
         } else if (r.target.substring(0, 5) == "s3://") {
           $("#backup-target-type").val("s3");
           var hostpath = r.target.substring(5).split('/');

From c3605f6211176088483a668e6c48412e624a6994 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Sun, 13 Nov 2016 23:36:33 +0100
Subject: [PATCH 123/165] Check if update-manager release-upgrades
 configuration file is present before editing (#996)

---
 setup/system.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/setup/system.sh b/setup/system.sh
index 53fae9d6..c7e67473 100755
--- a/setup/system.sh
+++ b/setup/system.sh
@@ -122,8 +122,10 @@ apt_install python3 python3-dev python3-pip \
 # ### Suppress Upgrade Prompts
 # Since Mail-in-a-Box might jump straight to 18.04 LTS, there's no need
 # to be reminded about 16.04 on every login.
-tools/editconf.py /etc/update-manager/release-upgrades Prompt=never
-rm -f /var/lib/ubuntu-release-upgrader/release-upgrade-available
+if [ -f /etc/update-manager/release-upgrades ]; then
+	tools/editconf.py /etc/update-manager/release-upgrades Prompt=never
+	rm -f /var/lib/ubuntu-release-upgrader/release-upgrade-available
+fi
 
 # ### Set the system timezone
 #

From 59913a5e4c5983f7bf5004b66fae883a8b63ac2b Mon Sep 17 00:00:00 2001
From: Christian Koptein <koptein@users.noreply.github.com>
Date: Mon, 28 Nov 2016 13:24:57 +0100
Subject: [PATCH 124/165] Added Hacker-News Reference Nov 2016 (#1014)

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 0883e52e..89f0cdb1 100644
--- a/README.md
+++ b/README.md
@@ -95,5 +95,5 @@ The History
 * In 2007 I wrote a relatively popular Mozilla Thunderbird extension that added client-side SPF and DKIM checks to mail to warn users about possible phishing: [add-on page](https://addons.mozilla.org/en-us/thunderbird/addon/sender-verification-anti-phish/), [source](https://github.com/JoshData/thunderbird-spf).
 * In August 2013 I began Mail-in-a-Box by combining my own mail server configuration with the setup in ["NSA-proof your email in 2 hours"](http://sealedabstract.com/code/nsa-proof-your-e-mail-in-2-hours/) and making the setup steps reproducible with bash scripts.
 * Mail-in-a-Box was a semifinalist in the 2014 [Knight News Challenge](https://www.newschallenge.org/challenge/2014/submissions/mail-in-a-box), but it was not selected as a winner.
-* Mail-in-a-Box hit the front page of Hacker News in [April](https://news.ycombinator.com/item?id=7634514) 2014, [September](https://news.ycombinator.com/item?id=8276171) 2014, and [May](https://news.ycombinator.com/item?id=9624267) 2015.
+* Mail-in-a-Box hit the front page of Hacker News in [April](https://news.ycombinator.com/item?id=7634514) 2014, [September](https://news.ycombinator.com/item?id=8276171) 2014, [May](https://news.ycombinator.com/item?id=9624267) 2015, and [November](https://news.ycombinator.com/item?id=13050500) 2016.
 * FastCompany mentioned Mail-in-a-Box a [roundup of privacy projects](http://www.fastcompany.com/3047645/your-own-private-cloud) on June 26, 2015.

From df93d82d0f2726918cd5c7fee4dd1cea4fbe808f Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 30 Nov 2016 12:42:24 -0500
Subject: [PATCH 125/165] v0.21 released

---
 CHANGELOG.md       | 22 ++++++++++++----------
 README.md          |  4 ++--
 setup/bootstrap.sh |  2 +-
 3 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cf6e527e..8a8bcbfc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,27 +4,29 @@ CHANGELOG
 In Development
 --------------
 
+This version updates ownCloud, which may include security fixes, and makes some other smaller improvements.
+
+Mail:
+
+* Header privacy filters were improperly running on the contents of forwarded email --- that's fixed.
+* We have another go at fixing a long-standing issue with training the spam filter (because of a file permissions issue).
+* Exchange/ActiveSync will now use your display name set in Roundcube in the From: line of outgoing email.
+
 ownCloud:
 
-* Update ownCloud to version 9.1.1
+* Updated ownCloud to version 9.1.1.
 
 Control panel:
 
 * Backups can now be made using rsync-over-ssh!
-* Remove recommendations for Certificate Providers
 * Status checks failed if the system doesn't support iptables or doesn't have ufw installed.
-* Add support for SSHFP records when sshd listens on non-standard ports
+* Added support for SSHFP records when sshd listens on non-standard ports.
+* Recommendations for TLS certificate providers were removed now that everyone mostly uses Let's Encrypt.
 
 System:
 
 * Ubuntu's "Upgrade to 16.04" notice is suppressed since you should not do that.
-* Lower memory requirements to 512MB, display a warning if system memory is below 768MB.
-
-Mail:
-
-* Turn off header filters for forwarded email.
-* Another go at fixing a long-standing issue with training the spam filter not working (because of a file permissions issue).
-* Exchange/ActiveSync will now use your display name set in Roundcube in the From: line of outgoing email.
+* Lowered memory requirements to 512MB, display a warning if system memory is below 768MB.
 
 v0.20 (September 23, 2016)
 --------------------------
diff --git a/README.md b/README.md
index 89f0cdb1..225be813 100644
--- a/README.md
+++ b/README.md
@@ -59,7 +59,7 @@ by me:
 	$ curl -s https://keybase.io/joshdata/key.asc | gpg --import
 	gpg: key C10BDD81: public key "Joshua Tauberer <jt@occams.info>" imported
 
-	$ git verify-tag v0.20
+	$ git verify-tag v0.21
 	gpg: Signature made ..... using RSA key ID C10BDD81
 	gpg: Good signature from "Joshua Tauberer <jt@occams.info>"
 	gpg: WARNING: This key is not certified with a trusted signature!
@@ -72,7 +72,7 @@ and on my [personal homepage](https://razor.occams.info/). (Of course, if this r
 
 Checkout the tag corresponding to the most recent release:
 
-	$ git checkout v0.20
+	$ git checkout v0.21
 
 Begin the installation.
 
diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh
index d3e7712a..bcd87b86 100644
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -7,7 +7,7 @@
 #########################################################
 
 if [ -z "$TAG" ]; then
-	TAG=v0.20
+	TAG=v0.21
 fi
 
 # Are we running as root?

From e03b071e8b5944451564c623b4866b180602c30e Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 30 Nov 2016 12:50:38 -0500
Subject: [PATCH 126/165] missed changelog header

---
 CHANGELOG.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8a8bcbfc..5db8c31b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,8 @@
 CHANGELOG
 =========
 
-In Development
---------------
+v0.21 (November 30, 2016)
+-------------------------
 
 This version updates ownCloud, which may include security fixes, and makes some other smaller improvements.
 

From 3af5e550350eeb80b9504a7392944c3eef91614d Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Wed, 30 Nov 2016 18:54:27 +0100
Subject: [PATCH 127/165] Upgrade to ownCloud 9.1.2 (#1010)

* Update owncloud to 9.1.2

* Upgrade to ownCloud 9.1.2 from 9.1.1 would fail because the guid of 9.1.1 matched with the regex for the version of 8.x
---
 setup/owncloud.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/setup/owncloud.sh b/setup/owncloud.sh
index b0a59ade..58b46d19 100755
--- a/setup/owncloud.sh
+++ b/setup/owncloud.sh
@@ -85,7 +85,7 @@ InstallOwncloud() {
 	fi
 }
 
-owncloud_ver=9.1.1
+owncloud_ver=9.1.2
 
 # Check if ownCloud dir exist, and check if version matches owncloud_ver (if either doesn't - install/upgrade)
 if [ ! -d /usr/local/lib/owncloud/ ] \
@@ -111,13 +111,13 @@ if [ ! -d /usr/local/lib/owncloud/ ] \
 
 	# We only need to check if we do upgrades when owncloud was previously installed
 	if [ -e /usr/local/lib/owncloud/version.php ]; then
-		if grep -q "8.1.[0-9]" /usr/local/lib/owncloud/version.php; then
+		if grep -q "8\.1\.[0-9]" /usr/local/lib/owncloud/version.php; then
 			echo "We are running 8.1.x, upgrading to 8.2.3 first"
 			InstallOwncloud 8.2.3 bfdf6166fbf6fc5438dc358600e7239d1c970613
 		fi
 
 		# If we are upgrading from 8.2.x we should go to 9.0 first. Owncloud doesn't support skipping minor versions
-		if grep -q "8.2.[0-9]" /usr/local/lib/owncloud/version.php; then
+		if grep -q "8\.2\.[0-9]" /usr/local/lib/owncloud/version.php; then
 			echo "We are running version 8.2.x, upgrading to 9.0.2 first"
 
 			# We need to disable memcached. The upgrade and install fails
@@ -152,7 +152,7 @@ EOF
 		fi
 	fi
 
-	InstallOwncloud $owncloud_ver 72ed9812432f01b3a459c4afc33f5c76b71eec09
+	InstallOwncloud $owncloud_ver ba9b1cdb681b8a3607d928cbe56f52e3888d9296
 fi
 
 # ### Configuring ownCloud

From b6f90e10c1c89187de41bfa4c9bc561b525e35d7 Mon Sep 17 00:00:00 2001
From: Leo Koppelkamm <hello@leo-koppelkamm.de>
Date: Wed, 30 Nov 2016 18:55:03 +0100
Subject: [PATCH 128/165] Allow larger messages to be checked by SpamAssassin
 (#1006)

Additionally, add the spam report headers to all emails, in order to make it easier to debug false negatives.
---
 setup/spamassassin.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/setup/spamassassin.sh b/setup/spamassassin.sh
index 6c29fe8e..e7e09f4e 100755
--- a/setup/spamassassin.sh
+++ b/setup/spamassassin.sh
@@ -48,7 +48,7 @@ echo "public.pyzor.org:24441" > /etc/spamassassin/pyzor/servers
 # * Disable localmode so Pyzor, DKIM and DNS checks can be used.
 tools/editconf.py /etc/default/spampd \
 	DESTPORT=10026 \
-	ADDOPTS="\"--maxsize=500\"" \
+	ADDOPTS="\"--maxsize=2000\"" \
 	LOCALONLY=0
 
 # Spamassassin normally wraps spam as an attachment inside a fresh
@@ -63,7 +63,8 @@ tools/editconf.py /etc/default/spampd \
 # Tell Spamassassin not to modify the original message except for adding
 # the X-Spam-Status mail header and related headers.
 tools/editconf.py /etc/spamassassin/local.cf -s \
-	report_safe=0
+	report_safe=0 \
+	add_header="all Report _REPORT_"
 
 # Bayesean learning
 # -----------------

From 61105b1ec37b750dcb9f044b32431e7ee19252c6 Mon Sep 17 00:00:00 2001
From: wsteitz <wsteitz@gmail.com>
Date: Wed, 30 Nov 2016 18:55:18 +0100
Subject: [PATCH 129/165] remove all references to justtesting.email (#1003)
 (#1005)

---
 Vagrantfile        | 6 ++----
 setup/questions.sh | 3 ---
 2 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/Vagrantfile b/Vagrantfile
index c6ef0ab9..c6610402 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -15,13 +15,11 @@ Vagrant.configure("2") do |config|
   config.vm.provision :shell, :inline => <<-SH
 	# Set environment variables so that the setup script does
 	# not ask any questions during provisioning. We'll let the
-	# machine figure out its own public IP and it'll take a
-	# subdomain on our justtesting.email domain so we can get
-	# started quickly.
+	# machine figure out its own public IP.
     export NONINTERACTIVE=1
     export PUBLIC_IP=auto
     export PUBLIC_IPV6=auto
-    export PRIMARY_HOSTNAME=auto-easy
+    export PRIMARY_HOSTNAME=auto
     #export SKIP_NETWORK_CHECKS=1
 
     # Start the setup script.
diff --git a/setup/questions.sh b/setup/questions.sh
index 2c000d74..57da5c92 100644
--- a/setup/questions.sh
+++ b/setup/questions.sh
@@ -180,9 +180,6 @@ if [ "$PUBLIC_IPV6" = "auto" ]; then
 fi
 if [ "$PRIMARY_HOSTNAME" = "auto" ]; then
 	PRIMARY_HOSTNAME=$(get_default_hostname)
-elif [ "$PRIMARY_HOSTNAME" = "auto-easy" ]; then
-	# Generate a probably-unique subdomain under our justtesting.email domain.
-	PRIMARY_HOSTNAME=`echo $PUBLIC_IP | sha1sum | cut -c1-5`.justtesting.email
 fi
 
 # Set STORAGE_USER and STORAGE_ROOT to default values (user-data and /home/user-data), unless

From d91368c478ff6a2160ff9a04f61c851aea5998a4 Mon Sep 17 00:00:00 2001
From: Corey Hinshaw <coreyhinshaw@gmail.com>
Date: Mon, 5 Dec 2016 17:31:20 -0500
Subject: [PATCH 130/165] Change ownership of roundcube DB after running
 migrations (#1024)

* Fix #1023 by changing ownership of roundcube DB after running migrations

* Set mode of roundcube sqlite database during setup
---
 setup/webmail.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/setup/webmail.sh b/setup/webmail.sh
index 306fbd6d..074a5aef 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -162,6 +162,8 @@ chmod 664 $STORAGE_ROOT/mail/users.sqlite
 
 # Run Roundcube database migration script (database is created if it does not exist)
 /usr/local/lib/roundcubemail/bin/updatedb.sh --dir /usr/local/lib/roundcubemail/SQL --package roundcube
+chown www-data:www-data $STORAGE_ROOT/mail/roundcube/roundcube.sqlite
+chmod 664 $STORAGE_ROOT/mail/roundcube/roundcube.sqlite
 
 # Enable PHP modules.
 php5enmod mcrypt

From 384c3b5e3dc7a3eb12e37fe8af0e65a449f01529 Mon Sep 17 00:00:00 2001
From: Corey Hinshaw <coreyhinshaw@gmail.com>
Date: Mon, 5 Dec 2016 17:31:20 -0500
Subject: [PATCH 131/165] Change ownership of roundcube DB after running
 migrations (#1024)

* Fix #1023 by changing ownership of roundcube DB after running migrations

* Set mode of roundcube sqlite database during setup
---
 setup/webmail.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/setup/webmail.sh b/setup/webmail.sh
index 306fbd6d..074a5aef 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -162,6 +162,8 @@ chmod 664 $STORAGE_ROOT/mail/users.sqlite
 
 # Run Roundcube database migration script (database is created if it does not exist)
 /usr/local/lib/roundcubemail/bin/updatedb.sh --dir /usr/local/lib/roundcubemail/SQL --package roundcube
+chown www-data:www-data $STORAGE_ROOT/mail/roundcube/roundcube.sqlite
+chmod 664 $STORAGE_ROOT/mail/roundcube/roundcube.sqlite
 
 # Enable PHP modules.
 php5enmod mcrypt

From ab2367e98ac3d91707ed0d32fd26b1a2de269768 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Mon, 5 Dec 2016 17:36:11 -0500
Subject: [PATCH 132/165] v0.21b

---
 CHANGELOG.md       | 5 +++++
 README.md          | 4 ++--
 setup/bootstrap.sh | 2 +-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5db8c31b..5901e3f0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,11 @@
 CHANGELOG
 =========
 
+v0.21b (December 4, 2016)
+-------------------------
+
+This update corrects a first-time installation issue introduced in v0.21 caused by the new Exchange/ActiveSync feature.
+
 v0.21 (November 30, 2016)
 -------------------------
 
diff --git a/README.md b/README.md
index 225be813..173a159f 100644
--- a/README.md
+++ b/README.md
@@ -59,7 +59,7 @@ by me:
 	$ curl -s https://keybase.io/joshdata/key.asc | gpg --import
 	gpg: key C10BDD81: public key "Joshua Tauberer <jt@occams.info>" imported
 
-	$ git verify-tag v0.21
+	$ git verify-tag v0.21b
 	gpg: Signature made ..... using RSA key ID C10BDD81
 	gpg: Good signature from "Joshua Tauberer <jt@occams.info>"
 	gpg: WARNING: This key is not certified with a trusted signature!
@@ -72,7 +72,7 @@ and on my [personal homepage](https://razor.occams.info/). (Of course, if this r
 
 Checkout the tag corresponding to the most recent release:
 
-	$ git checkout v0.21
+	$ git checkout v0.21b
 
 Begin the installation.
 
diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh
index bcd87b86..51aa7af0 100644
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -7,7 +7,7 @@
 #########################################################
 
 if [ -z "$TAG" ]; then
-	TAG=v0.21
+	TAG=v0.21b
 fi
 
 # Are we running as root?

From cd717ec94e2ab92be0f9c8886bb0c6ec52534dbf Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 7 Dec 2016 06:54:53 -0500
Subject: [PATCH 133/165] nightly TLS certificate provisioning should omit
 warnings about domains it cant provision for

---
 management/daily_tasks.sh      | 2 +-
 management/ssl_certificates.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/management/daily_tasks.sh b/management/daily_tasks.sh
index 3cea74b1..c0e88a8c 100755
--- a/management/daily_tasks.sh
+++ b/management/daily_tasks.sh
@@ -13,7 +13,7 @@ export LC_TYPE=en_US.UTF-8
 management/backup.py | management/email_administrator.py "Backup Status"
 
 # Provision any new certificates for new domains or domains with expiring certificates.
-management/ssl_certificates.py --headless | management/email_administrator.py "Error Provisioning TLS Certificate"
+management/ssl_certificates.py -q --headless | management/email_administrator.py "Error Provisioning TLS Certificate"
 
 # Run status checks and email the administrator if anything changed.
 management/status_checks.py --show-changes | management/email_administrator.py "Status Checks Change Notice"
diff --git a/management/ssl_certificates.py b/management/ssl_certificates.py
index fd1f88c5..d7317aea 100755
--- a/management/ssl_certificates.py
+++ b/management/ssl_certificates.py
@@ -426,7 +426,7 @@ def provision_certificates_cmdline():
 	if args and args[0] == "-v":
 		verbose = True
 		args.pop(0)
-	if args and args[0] == "q":
+	if args and args[0] == "-q":
 		show_extended_problems = False
 		args.pop(0)
 	if args and args[0] == "--headless":

From 99d0afd650cac385b681790c98e2254bda863071 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 7 Dec 2016 06:58:51 -0500
Subject: [PATCH 134/165] secondary nameserver check fails if domain has custom
 DNS (round-robin) multiple A records

fixes #834
---
 management/dns_update.py    | 4 ++--
 management/status_checks.py | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/management/dns_update.py b/management/dns_update.py
index 784a5b08..c231c8c4 100755
--- a/management/dns_update.py
+++ b/management/dns_update.py
@@ -881,10 +881,10 @@ def set_secondary_dns(hostnames, env):
 	return do_dns_update(env)
 
 
-def get_custom_dns_record(custom_dns, qname, rtype):
+def get_custom_dns_records(custom_dns, qname, rtype):
 	for qname1, rtype1, value in custom_dns:
 		if qname1 == qname and rtype1 == rtype:
-			return value
+			yield value
 	return None
 
 ########################################################################
diff --git a/management/status_checks.py b/management/status_checks.py
index ed1a403e..06e1f6d6 100755
--- a/management/status_checks.py
+++ b/management/status_checks.py
@@ -11,7 +11,7 @@ import dateutil.parser, dateutil.tz
 import idna
 import psutil
 
-from dns_update import get_dns_zones, build_tlsa_record, get_custom_dns_config, get_secondary_dns, get_custom_dns_record
+from dns_update import get_dns_zones, build_tlsa_record, get_custom_dns_config, get_secondary_dns, get_custom_dns_records
 from web_update import get_web_domains, get_domains_with_a_records
 from ssl_certificates import get_ssl_certificates, get_domain_ssl_files, check_certificate
 from mailconfig import get_mail_domains, get_mail_aliases
@@ -459,7 +459,7 @@ def check_dns_zone(domain, env, output, dns_zonefiles):
 	# half working.)
 
 	custom_dns_records = list(get_custom_dns_config(env)) # generator => list so we can reuse it
-	correct_ip = get_custom_dns_record(custom_dns_records, domain, "A") or env['PUBLIC_IP']
+	correct_ip = "; ".join(sorted(get_custom_dns_records(custom_dns_records, domain, "A"))) or env['PUBLIC_IP']
 	custom_secondary_ns = get_secondary_dns(custom_dns_records, mode="NS")
 	secondary_ns = custom_secondary_ns or ["ns2." + env['PRIMARY_HOSTNAME']]
 

From 34d58fb720174a5a81b411dcee8daf86b25a7c94 Mon Sep 17 00:00:00 2001
From: guyzmo <guyzmo+github+pub@m0g.net>
Date: Sat, 17 Dec 2016 15:29:48 +0100
Subject: [PATCH 135/165] Fix/rsync issues (#1036)

* Fixed issue with relative path for rsync relative names

Actually using the parsed URL `path` part, instead of doing a lousy split().
Renamed the `p` variable into something more sensible (`target`).

Fixes: #1019

* Added more verbose error messages upon rsync failures

fixes #1033

* Added command to test file listing
---
 management/backup.py | 48 ++++++++++++++++++++++++++++++--------------
 1 file changed, 33 insertions(+), 15 deletions(-)

diff --git a/management/backup.py b/management/backup.py
index e93b6fcb..1cd2e13a 100755
--- a/management/backup.py
+++ b/management/backup.py
@@ -382,21 +382,21 @@ def run_duplicity_restore(args):
 def list_target_files(config):
 	import urllib.parse
 	try:
-		p = urllib.parse.urlparse(config["target"])
+		target = urllib.parse.urlparse(config["target"])
 	except ValueError:
 		return "invalid target"
 
-	if p.scheme == "file":
-		return [(fn, os.path.getsize(os.path.join(p.path, fn))) for fn in os.listdir(p.path)]
+	if target.scheme == "file":
+		return [(fn, os.path.getsize(os.path.join(target.path, fn))) for fn in os.listdir(target.path)]
 
-	elif p.scheme == "rsync":
+	elif target.scheme == "rsync":
 		rsync_fn_size_re = re.compile(r'.*    ([^ ]*) [^ ]* [^ ]* (.*)')
 		rsync_target = '{host}:{path}'
 
-		_, target_host, target_path = config['target'].split('//')
-		target_path = '/' + target_path
-		if not target_path.endswith('/'):
-			target_path += '/'
+		if not target.path.endswith('/'):
+			target_path = target.path + '/'
+		if target.path.startswith('/'):
+			target_path = target.path[1:]
 
 		rsync_command = [ 'rsync',
 					'-e',
@@ -404,11 +404,11 @@ def list_target_files(config):
 					'--list-only',
 					'-r',
 					rsync_target.format(
-						host=target_host,
+						host=target.netloc,
 						path=target_path)
 				]
 
-		code, listing = shell('check_output', rsync_command, trap=True)
+		code, listing = shell('check_output', rsync_command, trap=True, capture_stderr=True)
 		if code == 0:
 			ret = []
 			for l in listing.split('\n'):
@@ -417,21 +417,33 @@ def list_target_files(config):
 					ret.append( (match.groups()[1], int(match.groups()[0].replace(',',''))) )
 			return ret
 		else:
-			raise ValueError("Connection to rsync host failed")
+			if 'Permission denied (publickey).' in listing:
+				reason = "Invalid user or check you correctly copied the SSH key."
+			elif 'No such file or directory' in listing:
+				reason = "Provided path {} is invalid.".format(target_path)
+			elif 'Network is unreachable' in listing:
+				reason = "The IP address {} is unreachable.".format(target.hostname)
+			elif 'Could not resolve hostname':
+				reason = "The hostname {} cannot be resolved.".format(target.hostname)
+			else:
+				reason = "Unknown error." \
+						"Please check running 'python management/backup.py --verify'" \
+						"from mailinabox sources to debug the issue."
+			raise ValueError("Connection to rsync host failed: {}".format(reason))
 
-	elif p.scheme == "s3":
+	elif target.scheme == "s3":
 		# match to a Region
 		fix_boto() # must call prior to importing boto
 		import boto.s3
 		from boto.exception import BotoServerError
 		for region in boto.s3.regions():
-			if region.endpoint == p.hostname:
+			if region.endpoint == target.hostname:
 				break
 		else:
 			raise ValueError("Invalid S3 region/host.")
 
-		bucket = p.path[1:].split('/')[0]
-		path = '/'.join(p.path[1:].split('/')[1:]) + '/'
+		bucket = target.path[1:].split('/')[0]
+		path = '/'.join(target.path[1:].split('/')[1:]) + '/'
 
 		# If no prefix is specified, set the path to '', otherwise boto won't list the files
 		if path == '/':
@@ -536,6 +548,12 @@ if __name__ == "__main__":
 		# are readable, and b) report if they are up to date.
 		run_duplicity_verification()
 
+	elif sys.argv[-1] == "--list":
+		# Run duplicity's verification command to check a) the backup files
+		# are readable, and b) report if they are up to date.
+		for fn, size in list_target_files(get_backup_config(load_environment())):
+			print("{}\t{}".format(fn, size))
+
 	elif sys.argv[-1] == "--status":
 		# Show backup status.
 		ret = backup_status(load_environment())

From 18c253eeda2792a52d764deb908e4b5c3aa56518 Mon Sep 17 00:00:00 2001
From: Bill Cromie <bill.cromie@gmail.com>
Date: Tue, 20 Dec 2016 16:32:06 -0500
Subject: [PATCH 136/165] adding a fully qualified domain name for the hostname
 and ignoring the .vagrant dir (#1027)

---
 .gitignore  | 1 +
 Vagrantfile | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index e22c1d9f..f3cdb1bc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,4 @@ management/__pycache__/
 tools/__pycache__/
 externals/
 .env
+.vagrant
diff --git a/Vagrantfile b/Vagrantfile
index c6610402..39264100 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -9,7 +9,7 @@ Vagrant.configure("2") do |config|
   # to the public web. However, we currently don't want to expose SSH since
   # the machine's box will let anyone log into it. So instead we'll put the
   # machine on a private network.
-  config.vm.hostname = "mailinabox"
+  config.vm.hostname = "mailinabox.lan"
   config.vm.network "private_network", ip: "192.168.50.4"
 
   config.vm.provision :shell, :inline => <<-SH

From 41601a592f385890d27467aa5614205976a1bfe5 Mon Sep 17 00:00:00 2001
From: Michael Kroes <michael@kroes.email>
Date: Sun, 15 Jan 2017 16:35:33 +0100
Subject: [PATCH 137/165] Improve error handling when doing update checks
 (#1065)

* Added an error message to handle exceptions when the setup script is trying to determine the latest Miab version
---
 management/status_checks.py | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/management/status_checks.py b/management/status_checks.py
index 06e1f6d6..3027ea71 100755
--- a/management/status_checks.py
+++ b/management/status_checks.py
@@ -793,8 +793,13 @@ def what_version_is_this(env):
 def get_latest_miab_version():
 	# This pings https://mailinabox.email/setup.sh and extracts the tag named in
 	# the script to determine the current product version.
-	import urllib.request
-	return re.search(b'TAG=(.*)', urllib.request.urlopen("https://mailinabox.email/setup.sh?ping=1").read()).group(1).decode("utf8")
+    from urllib.request import urlopen, HTTPError, URLError
+    from socket import timeout
+
+    try:
+        return re.search(b'TAG=(.*)', urlopen("https://mailinabox.email/setup.sh?ping=1", timeout=5).read()).group(1).decode("utf8")
+    except (HTTPError, URLError, timeout):
+        return None
 
 def check_miab_version(env, output):
 	config = load_settings(env)
@@ -811,6 +816,8 @@ def check_miab_version(env, output):
 
 		if this_ver == latest_ver:
 			output.print_ok("Mail-in-a-Box is up to date. You are running version %s." % this_ver)
+		elif latest_ver is None:
+			output.print_error("Latest Mail-in-a-Box version could not be determined. You are running version %s." % this_ver)
 		else:
 			output.print_error("A new version of Mail-in-a-Box is available. You are running version %s. The latest version is %s. For upgrade instructions, see https://mailinabox.email. "
 				% (this_ver, latest_ver))

From 584cfe42c4ae6a74f3cd05837e095d31565c5b0c Mon Sep 17 00:00:00 2001
From: Jonathan Chun <jonathanchun@jonathanchun.com>
Date: Sun, 15 Jan 2017 10:41:12 -0500
Subject: [PATCH 138/165] compare IPv6 addresses correctly with normalization
 (#1052)

---
 management/ssl_certificates.py |  4 ++--
 management/status_checks.py    | 16 +++++++++++-----
 2 files changed, 13 insertions(+), 7 deletions(-)
 mode change 100755 => 100644 management/status_checks.py

diff --git a/management/ssl_certificates.py b/management/ssl_certificates.py
index d7317aea..b0355cfc 100755
--- a/management/ssl_certificates.py
+++ b/management/ssl_certificates.py
@@ -4,7 +4,6 @@
 import os, os.path, re, shutil
 
 from utils import shell, safe_domain_name, sort_domains
-
 import idna
 
 # SELECTING SSL CERTIFICATES FOR USE IN WEB
@@ -214,6 +213,7 @@ def get_certificates_to_provision(env, show_extended_problems=True, force_domain
 
 	# Filter out domains that we can't provision a certificate for.
 	def can_provision_for_domain(domain):
+		from status_checks import normalize_ip
 		# Let's Encrypt doesn't yet support IDNA domains.
 		# We store domains in IDNA (ASCII). To see if this domain is IDNA,
 		# we'll see if its IDNA-decoded form is different.
@@ -252,7 +252,7 @@ def get_certificates_to_provision(env, show_extended_problems=True, force_domain
 				return s
 			# END HOTFIX
 
-			if len(response) != 1 or rdata__str__(response[0]) != value:
+			if len(response) != 1 or normalize_ip(rdata__str__(response[0])) != normalize_ip(value):
 				problems[domain] = "Domain control validation cannot be performed for this domain because DNS points the domain to another machine (%s %s)." % (rtype, ", ".join(rdata__str__(r) for r in response))
 				return False
 
diff --git a/management/status_checks.py b/management/status_checks.py
old mode 100755
new mode 100644
index 3027ea71..30b9a285
--- a/management/status_checks.py
+++ b/management/status_checks.py
@@ -393,7 +393,7 @@ def check_primary_hostname_dns(domain, env, output, dns_domains, dns_zonefiles):
 
 	# Check that PRIMARY_HOSTNAME resolves to PUBLIC_IP[V6] in public DNS.
 	ipv6 = query_dns(domain, "AAAA") if env.get("PUBLIC_IPV6") else None
-	if ip == env['PUBLIC_IP'] and ipv6 in (None, env['PUBLIC_IPV6']):
+	if ip == env['PUBLIC_IP'] and normalize_ip(ipv6) in (None, normalize_ip(env['PUBLIC_IPV6'])):
 		output.print_ok("Domain resolves to box's IP address. [%s ↦ %s]" % (env['PRIMARY_HOSTNAME'], my_ips))
 	else:
 		output.print_error("""This domain must resolve to your box's IP address (%s) in public DNS but it currently resolves
@@ -700,10 +700,11 @@ def query_dns(qname, rtype, nxdomain='[Not Set]', at=None):
 	# BEGIN HOTFIX
 	response_new = []
 	for r in response:
-	        if isinstance(r.to_text(), bytes):
-	                response_new.append(r.to_text().decode('utf-8'))
-	        else:
-	                response_new.append(r)
+		s = r.to_text()
+		if isinstance(s, bytes):
+			s = s.decode('utf-8')
+		response_new.append(s)
+	
 	response = response_new
 	# END HOTFIX
 
@@ -890,6 +891,11 @@ def run_and_output_changes(env, pool):
 	with open(cache_fn, "w") as f:
 		json.dump(cur.buf, f, indent=True)
 
+def normalize_ip(ip):
+	# Use ipaddress module to normalize the IPv6 notation and ensure we are matching IPv6 addresses written in different representations according to rfc5952.
+	import ipaddress
+	return str(ipaddress.ip_address(ip))
+
 class FileOutput:
 	def __init__(self, buf, width):
 		self.buf = buf

From bd0635728cb2945ce43408f14b7ab451406615cf Mon Sep 17 00:00:00 2001
From: guyzmo <guyzmo+github+pub@m0g.net>
Date: Sun, 15 Jan 2017 16:44:13 +0100
Subject: [PATCH 139/165] added editorconfig setup (#1037)

---
 .editorconfig | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 .editorconfig

diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 00000000..593ae64e
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,30 @@
+# EditorConfig helps developers define and maintain consistent
+# coding styles between different editors and IDEs
+# editorconfig.org
+
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[Makefile]
+indent_style = tabs
+indent_size = 4
+
+[Vagrantfile]
+indent_size = 2
+
+[*.rb]
+indent_size = 2
+
+[*.py]
+indent_style = tabs
+
+[*.js]
+indent_size = 2
+

From 2647febbf5caa179df63a647768b3b6989881731 Mon Sep 17 00:00:00 2001
From: Bill Cromie <bill.cromie@gmail.com>
Date: Sun, 15 Jan 2017 09:46:33 -0600
Subject: [PATCH 140/165] cardav plugin for roundcube (#1029)

---
 setup/webmail.sh | 77 ++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 62 insertions(+), 15 deletions(-)

diff --git a/setup/webmail.sh b/setup/webmail.sh
index 074a5aef..f9dd5305 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -39,7 +39,17 @@ HASH=81fbfba4683522f6e54006d0300a48e6da3f3bbd
 VACATION_SIEVE_VERSION=91ea6f52216390073d1f5b70b5f6bea0bfaee7e5
 PERSISTENT_LOGIN_VERSION=1e9d724476a370ce917a2fcd5b3217b0c306c24e
 HTML5_NOTIFIER_VERSION=4b370e3cd60dabd2f428a26f45b677ad1b7118d5
-UPDATE_KEY=$VERSION:$VACATION_SIEVE_VERSION:$PERSISTENT_LOGIN_VERSION:$HTML5_NOTIFIER_VERSION:a
+CARDDAV_VERSION=2.0.4
+# sha1sum of the rcmcarddav plugin release
+CARDDAV_HASH=d93f3cfb3038a519e71c7c3212c1d16f5da609a4
+
+UPDATE_KEY=$VERSION:$VACATION_SIEVE_VERSION:$PERSISTENT_LOGIN_VERSION:$HTML5_NOTIFIER_VERSION:$CARDDAV_VERSION:a
+
+# paths that are often reused.
+RCM_DIR=/usr/local/lib/roundcubemail
+RCM_PLUGIN_DIR=${RCM_DIR}/plugins
+RCM_CONFIG=${RCM_DIR}/config/config.inc.php
+
 needs_update=0 #NODOC
 if [ ! -f /usr/local/lib/roundcubemail/version ]; then
 	# not installed yet #NODOC
@@ -56,20 +66,30 @@ if [ $needs_update == 1 ]; then
 		/tmp/roundcube.tgz
 	tar -C /usr/local/lib --no-same-owner -zxf /tmp/roundcube.tgz
 	rm -rf /usr/local/lib/roundcubemail
-	mv /usr/local/lib/roundcubemail-$VERSION/ /usr/local/lib/roundcubemail
+	mv /usr/local/lib/roundcubemail-$VERSION/ $RCM_DIR
 	rm -f /tmp/roundcube.tgz
 
 	# install roundcube autoreply/vacation plugin
-	git_clone https://github.com/arodier/Roundcube-Plugins.git $VACATION_SIEVE_VERSION plugins/vacation_sieve /usr/local/lib/roundcubemail/plugins/vacation_sieve
+	git_clone https://github.com/arodier/Roundcube-Plugins.git $VACATION_SIEVE_VERSION plugins/vacation_sieve ${RCM_PLUGIN_DIR}/vacation_sieve
 
 	# install roundcube persistent_login plugin
-	git_clone https://github.com/mfreiholz/Roundcube-Persistent-Login-Plugin.git $PERSISTENT_LOGIN_VERSION '' /usr/local/lib/roundcubemail/plugins/persistent_login
+	git_clone https://github.com/mfreiholz/Roundcube-Persistent-Login-Plugin.git $PERSISTENT_LOGIN_VERSION '' ${RCM_PLUGIN_DIR}/persistent_login
 
 	# install roundcube html5_notifier plugin
-	git_clone https://github.com/kitist/html5_notifier.git $HTML5_NOTIFIER_VERSION '' /usr/local/lib/roundcubemail/plugins/html5_notifier
+	git_clone https://github.com/kitist/html5_notifier.git $HTML5_NOTIFIER_VERSION '' ${RCM_PLUGIN_DIR}/html5_notifier
+
+	# download and verify the full release of the carddav plugin
+	wget_verify \
+		https://github.com/blind-coder/rcmcarddav/releases/download/v${CARDDAV_VERSION}/carddav-${CARDDAV_VERSION}.zip \
+		$CARDDAV_HASH \
+		/tmp/carddav.zip
+
+	# unzip and cleanup
+	unzip -q /tmp/carddav.zip -d ${RCM_PLUGIN_DIR}
+	rm -f /tmp/carddav.zip
 
 	# record the version we've installed
-	echo $UPDATE_KEY > /usr/local/lib/roundcubemail/version
+	echo $UPDATE_KEY > ${RCM_DIR}/version
 fi
 
 # ### Configuring Roundcube
@@ -82,7 +102,7 @@ SECRET_KEY=$(dd if=/dev/urandom bs=1 count=18 2>/dev/null | base64 | fold -w 24
 # For security, temp and log files are not stored in the default locations
 # which are inside the roundcube sources directory. We put them instead
 # in normal places.
-cat > /usr/local/lib/roundcubemail/config/config.inc.php <<EOF;
+cat > $RCM_CONFIG <<EOF;
 <?php
 /*
  * Do not edit. Written by Mail-in-a-Box. Regenerated on updates.
@@ -101,7 +121,7 @@ cat > /usr/local/lib/roundcubemail/config/config.inc.php <<EOF;
 \$config['support_url'] = 'https://mailinabox.email/';
 \$config['product_name'] = '$PRIMARY_HOSTNAME Webmail';
 \$config['des_key'] = '$SECRET_KEY';
-\$config['plugins'] = array('html5_notifier', 'archive', 'zipdownload', 'password', 'managesieve', 'jqueryui', 'vacation_sieve', 'persistent_login');
+\$config['plugins'] = array('html5_notifier', 'archive', 'zipdownload', 'password', 'managesieve', 'jqueryui', 'vacation_sieve', 'persistent_login', 'carddav');
 \$config['skin'] = 'classic';
 \$config['login_autocomplete'] = 2;
 \$config['password_charset'] = 'UTF-8';
@@ -109,6 +129,28 @@ cat > /usr/local/lib/roundcubemail/config/config.inc.php <<EOF;
 ?>
 EOF
 
+# Configure CardDav
+cat > ${RCM_PLUGIN_DIR}/carddav/config.inc.php <<EOF;
+<?php
+/* Do not edit. Written by Mail-in-a-Box. Regenerated on updates. */
+\$prefs['ownCloud'] = array(
+	 // required attributes
+	 'name'         =>  'ownCloud',
+	 // will be substituted for the roundcube username
+	 'username'     =>  '%u',
+	 // will be substituted for the roundcube password
+	 'password'     =>  '%p',
+	 // %u will be substituted for the CardDAV username
+	 'url'          =>  'https://${PRIMARY_HOSTNAME}/cloud/remote.php/carddav/addressbooks/%u/contacts',
+	 'active'       =>  true,
+	 'readonly'     =>  false,
+	 'refresh_time' => '02:00:00',
+	 'fixed'        =>  array('username','password'),
+	 'preemptive_auth' => '1',
+	 'hide'        =>  false,
+);
+EOF
+
 # Configure vaction_sieve.
 cat > /usr/local/lib/roundcubemail/plugins/vacation_sieve/config.inc.php <<EOF;
 <?php
@@ -137,12 +179,12 @@ chown -R www-data.www-data /var/log/roundcubemail /tmp/roundcubemail $STORAGE_RO
 sudo -u www-data touch /var/log/roundcubemail/errors
 
 # Password changing plugin settings
-# The config comes empty by default, so we need the settings 
+# The config comes empty by default, so we need the settings
 # we're not planning to change in config.inc.dist...
-cp /usr/local/lib/roundcubemail/plugins/password/config.inc.php.dist \
-	/usr/local/lib/roundcubemail/plugins/password/config.inc.php
+cp ${RCM_PLUGIN_DIR}/password/config.inc.php.dist \
+	${RCM_PLUGIN_DIR}/password/config.inc.php
 
-tools/editconf.py /usr/local/lib/roundcubemail/plugins/password/config.inc.php \
+tools/editconf.py ${RCM_PLUGIN_DIR}/password/config.inc.php \
 	"\$config['password_minimum_length']=6;" \
 	"\$config['password_db_dsn']='sqlite:///$STORAGE_ROOT/mail/users.sqlite';" \
 	"\$config['password_query']='UPDATE users SET password=%D WHERE email=%u';" \
@@ -157,11 +199,16 @@ usermod -a -G dovecot www-data
 # could use dovecot instead of www-data, but not sure it matters
 chown root.www-data $STORAGE_ROOT/mail
 chmod 775 $STORAGE_ROOT/mail
-chown root.www-data $STORAGE_ROOT/mail/users.sqlite 
-chmod 664 $STORAGE_ROOT/mail/users.sqlite 
+chown root.www-data $STORAGE_ROOT/mail/users.sqlite
+chmod 664 $STORAGE_ROOT/mail/users.sqlite
+
+# Fix Carddav permissions:
+chown -f -R root.www-data ${RCM_PLUGIN_DIR}/carddav
+# root.www-data need all permissions, others only read
+chmod -R 774 ${RCM_PLUGIN_DIR}/carddav
 
 # Run Roundcube database migration script (database is created if it does not exist)
-/usr/local/lib/roundcubemail/bin/updatedb.sh --dir /usr/local/lib/roundcubemail/SQL --package roundcube
+${RCM_DIR}/bin/updatedb.sh --dir ${RCM_DIR}/SQL --package roundcube
 chown www-data:www-data $STORAGE_ROOT/mail/roundcube/roundcube.sqlite
 chmod 664 $STORAGE_ROOT/mail/roundcube/roundcube.sqlite
 

From 09577816f886b05ab42f30948e2ed6c5b45df736 Mon Sep 17 00:00:00 2001
From: Bill Cromie <bill.cromie@gmail.com>
Date: Sun, 15 Jan 2017 09:47:36 -0600
Subject: [PATCH 141/165] adds optional vagrant-cachier if you have the plugin
 installed (#1028)

---
 Vagrantfile | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/Vagrantfile b/Vagrantfile
index 39264100..b4bcb257 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -5,6 +5,12 @@ Vagrant.configure("2") do |config|
   config.vm.box = "ubuntu14.04"
   config.vm.box_url = "http://cloud-images.ubuntu.com/vagrant/trusty/current/trusty-server-cloudimg-amd64-vagrant-disk1.box"
 
+  if Vagrant.has_plugin?("vagrant-cachier")
+    # Configure cached packages to be shared between instances of the same base box.
+    # More info on http://fgrehm.viewdocs.io/vagrant-cachier/usage
+    config.cache.scope = :box
+  end
+
   # Network config: Since it's a mail server, the machine must be connected
   # to the public web. However, we currently don't want to expose SSH since
   # the machine's box will let anyone log into it. So instead we'll put the

From a081d040822ce0f58e0554b6a28e36945cde0275 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sun, 1 Jan 2017 17:11:31 -0500
Subject: [PATCH 142/165] move the custom exclusive process code from utils.py
 into a new python package named exclusiveprocess

---
 management/backup.py           |  8 +++-
 management/ssl_certificates.py |  6 ++-
 management/utils.py            | 70 ----------------------------------
 setup/management.sh            |  2 +-
 4 files changed, 11 insertions(+), 75 deletions(-)

diff --git a/management/backup.py b/management/backup.py
index 1cd2e13a..92f8a740 100755
--- a/management/backup.py
+++ b/management/backup.py
@@ -10,8 +10,9 @@
 import os, os.path, shutil, glob, re, datetime, sys
 import dateutil.parser, dateutil.relativedelta, dateutil.tz
 import rtyaml
+from exclusiveprocess import Lock
 
-from utils import exclusive_process, load_environment, shell, wait_for_service, fix_boto
+from utils import load_environment, shell, wait_for_service, fix_boto
 
 rsync_ssh_options = [
 	"--ssh-options='-i /root/.ssh/id_rsa_miab'",
@@ -204,7 +205,10 @@ def get_target_type(config):
 def perform_backup(full_backup):
 	env = load_environment()
 
-	exclusive_process("backup")
+	# Create an global exclusive lock so that the backup script
+	# cannot be run more than one.
+	Lock(die=True).forever()
+
 	config = get_backup_config(env)
 	backup_root = os.path.join(env["STORAGE_ROOT"], 'backup')
 	backup_cache_dir = os.path.join(backup_root, 'cache')
diff --git a/management/ssl_certificates.py b/management/ssl_certificates.py
index b0355cfc..0d282d0c 100755
--- a/management/ssl_certificates.py
+++ b/management/ssl_certificates.py
@@ -411,9 +411,11 @@ def provision_certificates(env, agree_to_tos_url=None, logger=None, show_extende
 
 def provision_certificates_cmdline():
 	import sys
-	from utils import load_environment, exclusive_process
+	from exclusiveprocess import Lock
 
-	exclusive_process("update_tls_certificates")
+	from utils import load_environment
+
+	Lock(die=True).forever()
 	env = load_environment()
 
 	verbose = False
diff --git a/management/utils.py b/management/utils.py
index d590abb5..652b48f6 100644
--- a/management/utils.py
+++ b/management/utils.py
@@ -106,76 +106,6 @@ def sort_email_addresses(email_addresses, env):
     ret.extend(sorted(email_addresses)) # whatever is left
     return ret
 
-def exclusive_process(name):
-    # Ensure that a process named `name` does not execute multiple
-    # times concurrently.
-    import os, sys, atexit
-    pidfile = '/var/run/mailinabox-%s.pid' % name
-    mypid = os.getpid()
-
-    # Attempt to get a lock on ourself so that the concurrency check
-    # itself is not executed in parallel.
-    with open(__file__, 'r+') as flock:
-        # Try to get a lock. This blocks until a lock is acquired. The
-        # lock is held until the flock file is closed at the end of the
-        # with block.
-        os.lockf(flock.fileno(), os.F_LOCK, 0)
-
-        # While we have a lock, look at the pid file. First attempt
-        # to write our pid to a pidfile if no file already exists there.
-        try:
-            with open(pidfile, 'x') as f:
-                # Successfully opened a new file. Since the file is new
-                # there is no concurrent process. Write our pid.
-                f.write(str(mypid))
-                atexit.register(clear_my_pid, pidfile)
-                return
-        except FileExistsError:
-            # The pid file already exixts, but it may contain a stale
-            # pid of a terminated process.
-            with open(pidfile, 'r+') as f:
-                # Read the pid in the file.
-                existing_pid = None
-                try:
-                    existing_pid = int(f.read().strip())
-                except ValueError:
-                    pass # No valid integer in the file.
-
-                # Check if the pid in it is valid.
-                if existing_pid:
-                    if is_pid_valid(existing_pid):
-                        print("Another %s is already running (pid %d)." % (name, existing_pid), file=sys.stderr)
-                        sys.exit(1)
-
-                # Write our pid.
-                f.seek(0)
-                f.write(str(mypid))
-                f.truncate()
-                atexit.register(clear_my_pid, pidfile)
- 
-
-def clear_my_pid(pidfile):
-    import os
-    os.unlink(pidfile)
-
-
-def is_pid_valid(pid):
-    """Checks whether a pid is a valid process ID of a currently running process."""
-    # adapted from http://stackoverflow.com/questions/568271/how-to-check-if-there-exists-a-process-with-a-given-pid
-    import os, errno
-    if pid <= 0: raise ValueError('Invalid PID.')
-    try:
-        os.kill(pid, 0)
-    except OSError as err:
-        if err.errno == errno.ESRCH: # No such process
-            return False
-        elif err.errno == errno.EPERM: # Not permitted to send signal
-            return True
-        else: # EINVAL
-            raise
-    else:
-        return True
-
 def shell(method, cmd_args, env={}, capture_stderr=False, return_bytes=False, trap=False, input=None):
     # A safe way to execute processes.
     # Some processes like apt-get require being given a sane PATH.
diff --git a/setup/management.sh b/setup/management.sh
index cfc6aad4..7299ec50 100755
--- a/setup/management.sh
+++ b/setup/management.sh
@@ -16,7 +16,7 @@ apt_install build-essential libssl-dev libffi-dev python3-dev
 # The first line is the packages that Josh maintains himself!
 # NOTE: email_validator is repeated in setup/questions.sh, so please keep the versions synced.
 hide_output pip3 install --upgrade \
-	rtyaml "email_validator>=1.0.0" "free_tls_certificates>=0.1.3" \
+	rtyaml "email_validator>=1.0.0" "free_tls_certificates>=0.1.3" "exclusiveprocess" \
 	"idna>=2.0.0" "cryptography>=1.0.2" boto psutil
 
 # duplicity uses python 2 so we need to get the python 2 package of boto to have backups to S3.

From cd59de6314824f646dddb6550cf9c55bfa223382 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sun, 15 Jan 2017 11:17:17 -0500
Subject: [PATCH 143/165] update roundcube to 1.2.3

---
 setup/webmail.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/setup/webmail.sh b/setup/webmail.sh
index f9dd5305..56efc59b 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -34,8 +34,8 @@ apt-get purge -qq -y roundcube* #NODOC
 # Install Roundcube from source if it is not already present or if it is out of date.
 # Combine the Roundcube version number with the commit hash of vacation_sieve to track
 # whether we have the latest version.
-VERSION=1.2.1
-HASH=81fbfba4683522f6e54006d0300a48e6da3f3bbd
+VERSION=1.2.3
+HASH=b0c3c4ba25596b2637c058b8254b58292755ec52
 VACATION_SIEVE_VERSION=91ea6f52216390073d1f5b70b5f6bea0bfaee7e5
 PERSISTENT_LOGIN_VERSION=1e9d724476a370ce917a2fcd5b3217b0c306c24e
 HTML5_NOTIFIER_VERSION=4b370e3cd60dabd2f428a26f45b677ad1b7118d5

From e694f57673d199da70a7c30f92f55c2842686acf Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sun, 15 Jan 2017 11:23:59 -0500
Subject: [PATCH 144/165] changelog entries

---
 CHANGELOG.md | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5901e3f0..55a5f901 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,17 @@
 CHANGELOG
 =========
 
+In Development
+--------------
+
+* The CardDAV plugin has been added to Roundcube so that your ownCloud contacts are available in webmail.
+* Upgraded to ownCloud 9.1.2.
+* Upgraded to Roundcube 1.2.3.
+* The status checks page crashed when the mailinabox.email website was down - that's fixed.
+* Allow larger messages to be checked by SpamAssassin.
+* Made nightly re-provisioning of TLS certificates less noisy.
+* Fixed bugs in rsync backup method.
+
 v0.21b (December 4, 2016)
 -------------------------
 

From a24977a96ed3ac7db37a27e43630e48717e909ca Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 18 Jan 2017 07:51:59 -0500
Subject: [PATCH 145/165] normalize_ip for ipv6 still not correct, was broken
 if box has no IPv6 address

---
 management/status_checks.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 mode change 100644 => 100755 management/status_checks.py

diff --git a/management/status_checks.py b/management/status_checks.py
old mode 100644
new mode 100755
index 30b9a285..d29e89ef
--- a/management/status_checks.py
+++ b/management/status_checks.py
@@ -393,7 +393,7 @@ def check_primary_hostname_dns(domain, env, output, dns_domains, dns_zonefiles):
 
 	# Check that PRIMARY_HOSTNAME resolves to PUBLIC_IP[V6] in public DNS.
 	ipv6 = query_dns(domain, "AAAA") if env.get("PUBLIC_IPV6") else None
-	if ip == env['PUBLIC_IP'] and normalize_ip(ipv6) in (None, normalize_ip(env['PUBLIC_IPV6'])):
+	if ip == env['PUBLIC_IP'] and not (ipv6 and env['PUBLIC_IPV6'] and normalize_ip(ipv6) != normalize_ip(env['PUBLIC_IPV6'])):
 		output.print_ok("Domain resolves to box's IP address. [%s ↦ %s]" % (env['PRIMARY_HOSTNAME'], my_ips))
 	else:
 		output.print_error("""This domain must resolve to your box's IP address (%s) in public DNS but it currently resolves

From a3c71fe14f79edde0ed0fd92a304336fcd50a439 Mon Sep 17 00:00:00 2001
From: wsteitz <wsteitz@gmail.com>
Date: Sun, 22 Jan 2017 16:37:54 +0100
Subject: [PATCH 146/165] move unzip installation from owncload to system setup
 (#1077)

---
 setup/owncloud.sh | 2 +-
 setup/system.sh   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/setup/owncloud.sh b/setup/owncloud.sh
index 58b46d19..2179c7ec 100755
--- a/setup/owncloud.sh
+++ b/setup/owncloud.sh
@@ -12,7 +12,7 @@ echo "Installing ownCloud (contacts/calendar)..."
 apt_install \
 	dbconfig-common \
 	php5-cli php5-sqlite php5-gd php5-imap php5-curl php-pear php-apc curl libapr1 libtool libcurl4-openssl-dev php-xml-parser \
-	php5 php5-dev php5-gd php5-fpm memcached php5-memcached unzip
+	php5 php5-dev php5-gd php5-fpm memcached php5-memcached
 
 apt-get purge -qq -y owncloud*
 
diff --git a/setup/system.sh b/setup/system.sh
index c7e67473..c0af3215 100755
--- a/setup/system.sh
+++ b/setup/system.sh
@@ -116,7 +116,7 @@ apt_get_quiet upgrade
 echo Installing system packages...
 apt_install python3 python3-dev python3-pip \
 	netcat-openbsd wget curl git sudo coreutils bc \
-	haveged pollinate \
+	haveged pollinate unzip \
 	unattended-upgrades cron ntp fail2ban
 
 # ### Suppress Upgrade Prompts

From 32d6728dc9bb9e0c585cab5b880f0cdb788ada65 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 1 Feb 2017 09:14:01 -0500
Subject: [PATCH 147/165] fix pip breaking due to setuptools/pip/cryptography
 problem

pip<6.1 + setuptools>=34 have a problem with packages that
try to update setuptools during installation, like cryptography.
See https://github.com/pypa/pip/issues/4253. The Ubuntu 14.04
package versions are pip 1.5.4 and setuptools 3.3. When we
install cryptography under those versions, it tries to update
setuptools to version 34, which became available about 10 days
ago, and then pip gets permanently broken with errors like
"ImportError: No module named 'packaging'".

The easiest work-around on systems that aren't already broken is
to upgrade pip and setuptools individually before we install any
package that tries to update setuptools.

Also try to detect a broken system and forcibly remove setuptools
first before trying to install/upgrade pip.

fixes #1080, fixes #1081, fixes #1086
see #1083
see https://discourse.mailinabox.email/t/error-with-pip-and-python/1880
see https://discourse.mailinabox.email/t/error-installing-mib/1875
---
 setup/management.sh | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/setup/management.sh b/setup/management.sh
index cfc6aad4..02909dfe 100755
--- a/setup/management.sh
+++ b/setup/management.sh
@@ -4,7 +4,10 @@ source setup/functions.sh
 
 echo "Installing Mail-in-a-Box system management daemon..."
 
-# Install packages.
+# DEPENDENCIES
+
+# Install Python packages that are available from the Ubuntu
+# apt repository:
 # flask, yaml, dnspython, and dateutil are all for our Python 3 management daemon itself.
 # duplicity does backups. python-pip is so we can 'pip install boto' for Python 2, for duplicity, so it can do backups to AWS S3.
 apt_install python3-flask links duplicity libyaml-dev python3-dnspython python3-dateutil python-pip
@@ -12,6 +15,29 @@ apt_install python3-flask links duplicity libyaml-dev python3-dnspython python3-
 # These are required to pip install cryptography.
 apt_install build-essential libssl-dev libffi-dev python3-dev
 
+# pip<6.1 + setuptools>=34 have a problem with packages that
+# try to update setuptools during installation, like cryptography.
+# See https://github.com/pypa/pip/issues/4253. The Ubuntu 14.04
+# package versions are pip 1.5.4 and setuptools 3.3. When we
+# install cryptography under those versions, it tries to update
+# setuptools to version 34, which now creates the conflict, and
+# then pip gets permanently broken with errors like
+# "ImportError: No module named 'packaging'".
+#
+# Let's test for the error:
+if ! python3 -c "from pkg_resources import load_entry_point" 2&> /dev/null; then
+	# This system seems to be broken already.
+	echo "Fixing broken pip and setuptools..."
+	rm -rf /usr/local/lib/python3.4/dist-packages/{pkg_resources,setuptools}*
+	apt-get install --reinstall python3-setuptools python3-pip python3-pkg-resources
+fi
+#
+# The easiest work-around on systems that aren't already broken is
+# to upgrade pip (to >=9.0.1) and setuptools (to >=34.1) individually
+# before we install any package that tries to update setuptools.
+hide_output pip3 install --upgrade pip
+hide_output pip3 install --upgrade setuptools
+
 # Install other Python 3 packages used by the management daemon.
 # The first line is the packages that Josh maintains himself!
 # NOTE: email_validator is repeated in setup/questions.sh, so please keep the versions synced.
@@ -24,6 +50,8 @@ hide_output pip3 install --upgrade \
 # S3 api used in some regions, which breaks backups to those regions.  See #627, #653.
 hide_output pip install --upgrade boto
 
+# CONFIGURATION
+
 # Create a backup directory and a random key for encrypting backups.
 mkdir -p $STORAGE_ROOT/backup
 if [ ! -f $STORAGE_ROOT/backup/secret_key.txt ]; then

From 2e00530944e3bb7e7dfddb68d523d28e5408a80a Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 1 Feb 2017 11:00:54 -0500
Subject: [PATCH 148/165] upgrade acme package

---
 setup/management.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/setup/management.sh b/setup/management.sh
index 02909dfe..902e64b6 100755
--- a/setup/management.sh
+++ b/setup/management.sh
@@ -41,9 +41,12 @@ hide_output pip3 install --upgrade setuptools
 # Install other Python 3 packages used by the management daemon.
 # The first line is the packages that Josh maintains himself!
 # NOTE: email_validator is repeated in setup/questions.sh, so please keep the versions synced.
+# Force acme to be updated because it seems to need it after the
+# pip/setuptools breakage (see above) and the ACME protocol may
+# have changed (I got an error on one of my systems).
 hide_output pip3 install --upgrade \
 	rtyaml "email_validator>=1.0.0" "free_tls_certificates>=0.1.3" \
-	"idna>=2.0.0" "cryptography>=1.0.2" boto psutil
+	"idna>=2.0.0" "cryptography>=1.0.2" acme boto psutil
 
 # duplicity uses python 2 so we need to get the python 2 package of boto to have backups to S3.
 # boto from the Ubuntu package manager is too out-of-date -- it doesn't support the newer

From 3c05fc94ffd24f810e218fac1b522c3bdfc6d69d Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 1 Feb 2017 10:07:15 -0500
Subject: [PATCH 149/165] v0.21c

---
 CHANGELOG.md       | 7 +++++++
 README.md          | 4 ++--
 setup/bootstrap.sh | 2 +-
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5901e3f0..7bb1c6c7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,13 @@
 CHANGELOG
 =========
 
+v0.21c (February 1, 2017)
+-------------------------
+
+Installations and upgrades started failing about 10 days ago with the error "ImportError: No module named 'packaging'" after an upstream package (Python's setuptools) was updated by its maintainers. The updated package conflicted with Ubuntu 14.04's version of another package (Python's pip). This update upgrades both packages to remove the conflict.
+
+If you already encountered the error during installation or upgrade of Mail-in-a-Box, this update may not correct the problem on your existing system. See https://discourse.mailinabox.email/t/v0-21c-release-fixes-python-package-installation-issue/1881 for help if the problem persists after upgrading to this version of Mail-in-a-Box.
+
 v0.21b (December 4, 2016)
 -------------------------
 
diff --git a/README.md b/README.md
index 173a159f..81d8952d 100644
--- a/README.md
+++ b/README.md
@@ -59,7 +59,7 @@ by me:
 	$ curl -s https://keybase.io/joshdata/key.asc | gpg --import
 	gpg: key C10BDD81: public key "Joshua Tauberer <jt@occams.info>" imported
 
-	$ git verify-tag v0.21b
+	$ git verify-tag v0.21c
 	gpg: Signature made ..... using RSA key ID C10BDD81
 	gpg: Good signature from "Joshua Tauberer <jt@occams.info>"
 	gpg: WARNING: This key is not certified with a trusted signature!
@@ -72,7 +72,7 @@ and on my [personal homepage](https://razor.occams.info/). (Of course, if this r
 
 Checkout the tag corresponding to the most recent release:
 
-	$ git checkout v0.21b
+	$ git checkout v0.21c
 
 Begin the installation.
 
diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh
index 51aa7af0..25d59f53 100644
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -7,7 +7,7 @@
 #########################################################
 
 if [ -z "$TAG" ]; then
-	TAG=v0.21b
+	TAG=v0.21c
 fi
 
 # Are we running as root?

From f2ff14100e851af3f4743b8c8663e19707dbfaf7 Mon Sep 17 00:00:00 2001
From: Norman S <norman@nstanke.at>
Date: Fri, 10 Feb 2017 15:43:11 +0100
Subject: [PATCH 150/165] Change password min-length to four characters (#1094)

in order to correlate with the management interface.
---
 setup/webmail.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup/webmail.sh b/setup/webmail.sh
index 56efc59b..b0b916f7 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -185,7 +185,7 @@ cp ${RCM_PLUGIN_DIR}/password/config.inc.php.dist \
 	${RCM_PLUGIN_DIR}/password/config.inc.php
 
 tools/editconf.py ${RCM_PLUGIN_DIR}/password/config.inc.php \
-	"\$config['password_minimum_length']=6;" \
+	"\$config['password_minimum_length']=4;" \
 	"\$config['password_db_dsn']='sqlite:///$STORAGE_ROOT/mail/users.sqlite';" \
 	"\$config['password_query']='UPDATE users SET password=%D WHERE email=%u';" \
 	"\$config['password_dovecotpw']='/usr/bin/doveadm pw';" \

From f6b20a810f7afd2859b4355ae72531be89502daf Mon Sep 17 00:00:00 2001
From: Norman S <norman@nstanke.at>
Date: Fri, 10 Feb 2017 15:44:40 +0100
Subject: [PATCH 151/165] Enforce pip to use python 2.7 for boto (#1093)

---
 setup/management.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup/management.sh b/setup/management.sh
index a521dd85..26c2c38e 100755
--- a/setup/management.sh
+++ b/setup/management.sh
@@ -51,7 +51,7 @@ hide_output pip3 install --upgrade \
 # duplicity uses python 2 so we need to get the python 2 package of boto to have backups to S3.
 # boto from the Ubuntu package manager is too out-of-date -- it doesn't support the newer
 # S3 api used in some regions, which breaks backups to those regions.  See #627, #653.
-hide_output pip install --upgrade boto
+hide_output pip2 install --upgrade boto
 
 # CONFIGURATION
 

From 36bef2ee16362eec1a0051f2b96034b1fbc63963 Mon Sep 17 00:00:00 2001
From: Dominik Murzynowski <github@domyno.pl>
Date: Tue, 14 Feb 2017 20:24:59 +0100
Subject: [PATCH 152/165] Change password min-length to 8 characters (#1098)

---
 management/mailconfig.py        | 4 ++--
 management/templates/users.html | 4 ++--
 setup/webmail.sh                | 2 +-
 tools/mail.py                   | 4 ++--
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/management/mailconfig.py b/management/mailconfig.py
index d044c1ab..4cb57027 100755
--- a/management/mailconfig.py
+++ b/management/mailconfig.py
@@ -599,8 +599,8 @@ def validate_password(pw):
 		raise ValueError("No password provided.")
 	if re.search(r"[\s]", pw):
 		raise ValueError("Passwords cannot contain spaces.")
-	if len(pw) < 4:
-		raise ValueError("Passwords must be at least four characters.")
+	if len(pw) < 8:
+		raise ValueError("Passwords must be at least eight characters.")
 
 
 if __name__ == "__main__":
diff --git a/management/templates/users.html b/management/templates/users.html
index 2cda327c..e0545835 100644
--- a/management/templates/users.html
+++ b/management/templates/users.html
@@ -31,7 +31,7 @@
   <button type="submit" class="btn btn-primary">Add User</button>
 </form>
 <ul style="margin-top: 1em; padding-left: 1.5em; font-size: 90%;">
-  <li>Passwords must be at least four characters and may not contain spaces. For best results, <a href="#" onclick="return generate_random_password()">generate a random password</a>.</li>
+  <li>Passwords must be at least eight characters and may not contain spaces. For best results, <a href="#" onclick="return generate_random_password()">generate a random password</a>.</li>
   <li>Use <a href="#" onclick="return show_panel('aliases')">aliases</a> to create email addresses that forward to existing accounts.</li>
   <li>Administrators get access to this control panel.</li>
   <li>User accounts cannot contain any international (non-ASCII) characters, but <a href="#" onclick="return show_panel('aliases');">aliases</a> can.</li>
@@ -296,7 +296,7 @@ function mod_priv(elem, add_remove) {
 function generate_random_password() {
   var pw = "";
   var charset = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789"; // confusable characters skipped
-  for (var i = 0; i < 10; i++)
+  for (var i = 0; i < 12; i++)
     pw += charset.charAt(Math.floor(Math.random() * charset.length));
   show_modal_error("Random Password", "<p>Here, try this:</p> <p><code style='font-size: 110%'>" + pw + "</code></pr");
   return false; // cancel click
diff --git a/setup/webmail.sh b/setup/webmail.sh
index b0b916f7..dd861a35 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -185,7 +185,7 @@ cp ${RCM_PLUGIN_DIR}/password/config.inc.php.dist \
 	${RCM_PLUGIN_DIR}/password/config.inc.php
 
 tools/editconf.py ${RCM_PLUGIN_DIR}/password/config.inc.php \
-	"\$config['password_minimum_length']=4;" \
+	"\$config['password_minimum_length']=8;" \
 	"\$config['password_db_dsn']='sqlite:///$STORAGE_ROOT/mail/users.sqlite';" \
 	"\$config['password_query']='UPDATE users SET password=%D WHERE email=%u';" \
 	"\$config['password_dovecotpw']='/usr/bin/doveadm pw';" \
diff --git a/tools/mail.py b/tools/mail.py
index d0e546ab..566971e4 100755
--- a/tools/mail.py
+++ b/tools/mail.py
@@ -30,8 +30,8 @@ def mgmt(cmd, data=None, is_json=False):
 def read_password():
     while True:
         first = getpass.getpass('password: ')
-        if len(first) < 4:
-            print("Passwords must be at least four characters.")
+        if len(first) < 8:
+            print("Passwords must be at least eight characters.")
             continue
         if re.search(r'[\s]', first):
             print("Passwords cannot contain spaces.")

From 89222d519adfc94763b5d02d27e54d2addc3180e Mon Sep 17 00:00:00 2001
From: Ian Beringer <ianberinger@users.noreply.github.com>
Date: Thu, 16 Feb 2017 00:24:32 +0100
Subject: [PATCH 153/165] Fix date delta display for deltas greater than 1 year
 (#1099)

---
 management/backup.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/management/backup.py b/management/backup.py
index 92f8a740..d6189cfe 100755
--- a/management/backup.py
+++ b/management/backup.py
@@ -39,6 +39,8 @@ def backup_status(env):
 	def reldate(date, ref, clip):
 		if ref < date: return clip
 		rd = dateutil.relativedelta.relativedelta(ref, date)
+		if rd.years > 1: return "%d years, %d months" % (rd.years, rd.months)
+		if rd.years == 1: return "%d year, %d months" % (rd.years, rd.months)
 		if rd.months > 1: return "%d months, %d days" % (rd.months, rd.days)
 		if rd.months == 1: return "%d month, %d days" % (rd.months, rd.days)
 		if rd.days >= 7: return "%d days" % rd.days

From f88c907a29d575784886aa8d5cb8c6c7f10d20f8 Mon Sep 17 00:00:00 2001
From: NatCC <nathan@thechasefamily.co.uk>
Date: Tue, 21 Feb 2017 14:32:28 +0000
Subject: [PATCH 154/165] Update jails.conf - SSH fail2ban jail (#1105)

SSH fail2ban jail is not enabled by default and so the jail does not load.
---
 conf/fail2ban/jails.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/conf/fail2ban/jails.conf b/conf/fail2ban/jails.conf
index 0146b64c..290a75bb 100644
--- a/conf/fail2ban/jails.conf
+++ b/conf/fail2ban/jails.conf
@@ -73,6 +73,7 @@ action   = iptables-allports[name=recidive]
 enabled  = true
 
 [ssh]
+enabled = true
 maxretry = 7
 bantime = 3600
 

From d4baac2363b576cb131ff0f23fd7bf22daba917f Mon Sep 17 00:00:00 2001
From: Manuel <manuel@dejonghe.de>
Date: Wed, 1 Mar 2017 13:57:03 +0100
Subject: [PATCH 155/165] at the end of setup show SHA256 tls cert hash instead
 of SHA1 hash (#1108)

---
 setup/start.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/setup/start.sh b/setup/start.sh
index 790afe18..04096474 100755
--- a/setup/start.sh
+++ b/setup/start.sh
@@ -147,17 +147,17 @@ if management/status_checks.py --check-primary-hostname; then
 	echo https://$PRIMARY_HOSTNAME/admin
 	echo
 	echo "If you have a DNS problem put the box's IP address in the URL"
-	echo "(https://$PUBLIC_IP/admin) but then check the SSL fingerprint:"
-	openssl x509 -in $STORAGE_ROOT/ssl/ssl_certificate.pem -noout -fingerprint \
-        	| sed "s/SHA1 Fingerprint=//"
+	echo "(https://$PUBLIC_IP/admin) but then check the TLS fingerprint:"
+	openssl x509 -in $STORAGE_ROOT/ssl/ssl_certificate.pem -noout -fingerprint -sha256\
+        	| sed "s/SHA256 Fingerprint=//"
 else
 	echo https://$PUBLIC_IP/admin
 	echo
 	echo You will be alerted that the website has an invalid certificate. Check that
 	echo the certificate fingerprint matches:
 	echo
-	openssl x509 -in $STORAGE_ROOT/ssl/ssl_certificate.pem -noout -fingerprint \
-        	| sed "s/SHA1 Fingerprint=//"
+	openssl x509 -in $STORAGE_ROOT/ssl/ssl_certificate.pem -noout -fingerprint -sha256\
+        	| sed "s/SHA256 Fingerprint=//"
 	echo
 	echo Then you can confirm the security exception and continue.
 	echo

From 3830facf78b57fc094c7154c9e1c40a509acea12 Mon Sep 17 00:00:00 2001
From: Jan Schulz-Hofen <yeah@users.noreply.github.com>
Date: Wed, 1 Mar 2017 19:59:48 +0700
Subject: [PATCH 156/165] set dovecot vsz_limit to 1/3 of available memory
 (#1096)

The `default_vsz_limit` is the maximum amount of virtual memory that can be allocated. It should be set *reasonably high* to avoid allocation issues with larger mailboxes. We're setting it to 1/3 of the total available memory (physical mem + swap) to be sure.

See here for discussion:
- https://www.dovecot.org/list/dovecot/2012-August/137569.html
- https://www.dovecot.org/list/dovecot/2011-December/132455.html
---
 setup/mail-dovecot.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/setup/mail-dovecot.sh b/setup/mail-dovecot.sh
index 2c5533ec..b92384f5 100755
--- a/setup/mail-dovecot.sh
+++ b/setup/mail-dovecot.sh
@@ -37,8 +37,16 @@ apt_install \
 # of active IMAP connections (at, say, 5 open connections per user that
 # would be 20 users). Set it to 250 times the number of cores this
 # machine has, so on a two-core machine that's 500 processes/100 users).
+# The `default_vsz_limit` is the maximum amount of virtual memory that
+# can be allocated. It should be set *reasonably high* to avoid allocation
+# issues with larger mailboxes. We're setting it to 1/3 of the total
+# available memory (physical mem + swap) to be sure.
+# See here for discussion:
+# - https://www.dovecot.org/list/dovecot/2012-August/137569.html
+# - https://www.dovecot.org/list/dovecot/2011-December/132455.html
 tools/editconf.py /etc/dovecot/conf.d/10-master.conf \
 	default_process_limit=$(echo "`nproc` * 250" | bc) \
+	default_vsz_limit=$(echo "`free -tom  | tail -1 | awk '{print $2}'` / 3" | bc)M \
 	log_path=/var/log/mail.log
 
 # The inotify `max_user_instances` default is 128, which constrains

From 368b9c50d0f676495fae16feffd723ebd8f6365b Mon Sep 17 00:00:00 2001
From: Sean Watson <seanwatson@users.noreply.github.com>
Date: Wed, 1 Mar 2017 05:02:41 -0800
Subject: [PATCH 157/165] add DSA and ED25519 SSHFP records if those keys are
 present (#1078)

---
 CHANGELOG.md             | 1 +
 management/dns_update.py | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8a33f476..28286d2b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@ In Development
 * Allow larger messages to be checked by SpamAssassin.
 * Made nightly re-provisioning of TLS certificates less noisy.
 * Fixed bugs in rsync backup method.
+* Added support for DSA and ED25519 SSHFP records.
 
 v0.21c (February 1, 2017)
 -------------------------
diff --git a/management/dns_update.py b/management/dns_update.py
index c231c8c4..165f52ef 100755
--- a/management/dns_update.py
+++ b/management/dns_update.py
@@ -342,6 +342,7 @@ def build_sshfp_records():
 		"ssh-rsa": 1,
 		"ssh-dss": 2,
 		"ecdsa-sha2-nistp256": 3,
+		"ssh-ed25519": 4,
 	}
 
 	# Get our local fingerprints by running ssh-keyscan. The output looks
@@ -359,7 +360,7 @@ def build_sshfp_records():
 				ports = ports + [s[1]]
 	# the keys are the same at each port, so we only need to get
 	# them at the first port found (may not be port 22)
-	keys = shell("check_output", ["ssh-keyscan", "-p", ports[0], "localhost"])
+	keys = shell("check_output", ["ssh-keyscan", "-t", "rsa,dsa,ecdsa,ed25519", "-p", ports[0], "localhost"])
 	for key in sorted(keys.split("\n")):
 		if key.strip() == "" or key[0] == "#": continue
 		try:

From 86621392f6870e8734636e628cc725d626441a4d Mon Sep 17 00:00:00 2001
From: Sean Watson <seanwatson@users.noreply.github.com>
Date: Thu, 9 Mar 2017 06:05:52 -0800
Subject: [PATCH 158/165] support SSHFP records for custom domains (#1114)

---
 CHANGELOG.md                         | 1 +
 management/dns_update.py             | 2 +-
 management/templates/custom-dns.html | 3 ++-
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 28286d2b..5faec07d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ In Development
 * Made nightly re-provisioning of TLS certificates less noisy.
 * Fixed bugs in rsync backup method.
 * Added support for DSA and ED25519 SSHFP records.
+* Added support for custom SSHFP records.
 
 v0.21c (February 1, 2017)
 -------------------------
diff --git a/management/dns_update.py b/management/dns_update.py
index 165f52ef..6c16add1 100755
--- a/management/dns_update.py
+++ b/management/dns_update.py
@@ -767,7 +767,7 @@ def set_custom_dns_record(qname, rtype, value, action, env):
 				v = ipaddress.ip_address(value) # raises a ValueError if there's a problem
 				if rtype == "A" and not isinstance(v, ipaddress.IPv4Address): raise ValueError("That's an IPv6 address.")
 				if rtype == "AAAA" and not isinstance(v, ipaddress.IPv6Address): raise ValueError("That's an IPv4 address.")
-		elif rtype in ("CNAME", "TXT", "SRV", "MX"):
+		elif rtype in ("CNAME", "TXT", "SRV", "MX", "SSHFP"):
 			# anything goes
 			pass
 		else:
diff --git a/management/templates/custom-dns.html b/management/templates/custom-dns.html
index 30b29890..ec010001 100644
--- a/management/templates/custom-dns.html
+++ b/management/templates/custom-dns.html
@@ -37,6 +37,7 @@
         <option value="TXT" data-hint="Enter arbitrary text.">TXT (text record)</option>
         <option value="MX" data-hint="Enter record in the form of PRIORITY DOMAIN., including trailing period (e.g. 20 mx.example.com.).">MX (mail exchanger)</option>
         <option value="SRV" data-hint="Enter record in the form of PRIORITY WEIGHT PORT TARGET., including trailing period (e.g. 10 10 5060 sip.example.com.).">SRV (service record)</option>
+        <option value="SSHFP" data-hint="Enter record in the form of ALGORITHM TYPE FINGERPRINT.">SSHFP (SSH fingerprint record)</option>
       </select>
     </div>
   </div>
@@ -124,7 +125,7 @@
 <tr><td>email</td> <td>The email address of any administrative user here.</td></tr>
 <tr><td>password</td> <td>That user&rsquo;s password.</td></tr>
 <tr><td>qname</td> <td>The fully qualified domain name for the record you are trying to set. It must be one of the domain names or a subdomain of one of the domain names hosted on this box. (Add mail users or aliases to add new domains.)</td></tr>
-<tr><td>rtype</td> <td>The resource type. Defaults to <code>A</code> if omitted. Possible values: <code>A</code> (an IPv4 address), <code>AAAA</code> (an IPv6 address), <code>TXT</code> (a text string), <code>CNAME</code> (an alias, which is a fully qualified domain name &mdash; don&rsquo;t forget the final period), <code>MX</code>, or <code>SRV</code>.</td></tr>
+<tr><td>rtype</td> <td>The resource type. Defaults to <code>A</code> if omitted. Possible values: <code>A</code> (an IPv4 address), <code>AAAA</code> (an IPv6 address), <code>TXT</code> (a text string), <code>CNAME</code> (an alias, which is a fully qualified domain name &mdash; don&rsquo;t forget the final period), <code>MX</code>, <code>SRV</code>, or <code>SSHFP</code>.</td></tr>
 <tr><td>value</td> <td>For PUT, POST, and DELETE, the record&rsquo;s value. If the <code>rtype</code> is <code>A</code> or <code>AAAA</code> and <code>value</code> is empty or omitted, the IPv4 or IPv6 address of the remote host is used (be sure to use the <code>-4</code> or <code>-6</code> options to curl). This is handy for dynamic DNS!</td></tr>
 </table>
 

From 423f1907d061d7f0fe82601ae6b49583ed9c7d2e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9o=20Segonds?= <theo.segonds@inria.fr>
Date: Sun, 26 Mar 2017 15:09:00 +0200
Subject: [PATCH 159/165] Fix zpush compatibility list link (#1076)

---
 management/templates/mail-guide.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/management/templates/mail-guide.html b/management/templates/mail-guide.html
index 906e7b2a..d34cc9c3 100644
--- a/management/templates/mail-guide.html
+++ b/management/templates/mail-guide.html
@@ -42,7 +42,7 @@
 
 				<h4>Exchange/ActiveSync settings</h4>
 
-					<p>On iOS devices, devices on this <a href="http://z-push.org/compatibility/">compatibility list</a>, or using Outlook 2007 or later on Windows 7 and later, you may set up your mail as an Exchange or ActiveSync server. However, we&rsquo;ve found this to be more buggy than using IMAP as described above. If you encounter any problems, please use the manual settings above.</p>
+					<p>On iOS devices, devices on this <a href="https://wiki.z-hub.io/display/ZP/Compatibility">compatibility list</a>, or using Outlook 2007 or later on Windows 7 and later, you may set up your mail as an Exchange or ActiveSync server. However, we&rsquo;ve found this to be more buggy than using IMAP as described above. If you encounter any problems, please use the manual settings above.</p>
 
 					<table class="table">
 					<tr><th>Server</th> <td>{{hostname}}</td></tr>

From 9c9cae2096adce40d59869432f270b3d97ee7426 Mon Sep 17 00:00:00 2001
From: Rinze de Laat <info@elit.nl>
Date: Wed, 11 Jan 2017 13:57:14 +0100
Subject: [PATCH 160/165] Added an alternative mail log scanning script for use
 from the command line (and monitoring, at a later stage)

merges #970
---
 CHANGELOG.md           |   1 +
 management/mail_log.py | 940 +++++++++++++++++++++++++++++++++++------
 2 files changed, 806 insertions(+), 135 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5faec07d..cfba9119 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ In Development
 * Fixed bugs in rsync backup method.
 * Added support for DSA and ED25519 SSHFP records.
 * Added support for custom SSHFP records.
+* The management mail_log.py tool has been rewritten.
 
 v0.21c (February 1, 2017)
 -------------------------
diff --git a/management/mail_log.py b/management/mail_log.py
index 0a9d5099..c63692a1 100755
--- a/management/mail_log.py
+++ b/management/mail_log.py
@@ -1,211 +1,881 @@
 #!/usr/bin/python3
-
+import argparse
+import datetime
+import gzip
 import os.path
 import re
-from collections import defaultdict
+import shutil
+import tempfile
+import textwrap
+from collections import defaultdict, OrderedDict
 
 import dateutil.parser
+import time
+
+from dateutil.relativedelta import relativedelta
 
-import mailconfig
 import utils
 
 
-def scan_mail_log(logger, env):
+LOG_FILES = (
+    '/var/log/mail.log',
+    '/var/log/mail.log.1',
+    '/var/log/mail.log.2.gz',
+    '/var/log/mail.log.3.gz',
+    '/var/log/mail.log.4.gz',
+    '/var/log/mail.log.5.gz',
+    '/var/log/mail.log.6.gz',
+)
+
+TIME_DELTAS = OrderedDict([
+    ('all', datetime.timedelta(weeks=52)),
+    ('month', datetime.timedelta(weeks=4)),
+    ('2weeks', datetime.timedelta(days=14)),
+    ('week', datetime.timedelta(days=7)),
+    ('2days', datetime.timedelta(days=2)),
+    ('day', datetime.timedelta(days=1)),
+    ('12hours', datetime.timedelta(hours=12)),
+    ('6hours', datetime.timedelta(hours=6)),
+    ('hour', datetime.timedelta(hours=1)),
+    ('30min', datetime.timedelta(minutes=30)),
+    ('10min', datetime.timedelta(minutes=10)),
+    ('5min', datetime.timedelta(minutes=5)),
+    ('min', datetime.timedelta(minutes=1)),
+    ('today', datetime.datetime.now() - datetime.datetime.now().replace(hour=0, minute=0, second=0))
+])
+
+# Start date > end date!
+START_DATE = datetime.datetime.now()
+END_DATE = None
+
+VERBOSE = False
+
+# List of strings to filter users with
+FILTERS = None
+
+# What to show by default
+SCAN_OUT = True  # Outgoing email
+SCAN_IN = True  # Incoming email
+SCAN_CONN = False  # IMAP and POP3 logins
+SCAN_GREY = False  # Greylisted email
+SCAN_BLOCKED = False  # Rejected email
+
+
+def scan_files(collector):
+    """ Scan files until they run out or the earliest date is reached """
+
+    stop_scan = False
+
+    for fn in LOG_FILES:
+
+        tmp_file = None
+
+        if not os.path.exists(fn):
+            continue
+        elif fn[-3:] == '.gz':
+            tmp_file = tempfile.NamedTemporaryFile()
+            shutil.copyfileobj(gzip.open(fn), tmp_file)
+
+        print("Processing file", fn, "...")
+        fn = tmp_file.name if tmp_file else fn
+
+        for line in reverse_readline(fn):
+            if scan_mail_log_line(line.strip(), collector) is False:
+                if stop_scan:
+                    return
+                stop_scan = True
+            else:
+                stop_scan = False
+
+
+
+def scan_mail_log(env):
     """ Scan the system's mail log files and collect interesting data
 
     This function scans the 2 most recent mail log files in /var/log/.
 
     Args:
-        logger (ConsoleOutput): Object used for writing messages to the console
         env (dict): Dictionary containing MiaB settings
+
     """
 
     collector = {
+        "scan_count": 0,  # Number of lines scanned
+        "parse_count": 0,  # Number of lines parsed (i.e. that had their contents examined)
+        "scan_time": time.time(),  # The time in seconds the scan took
+        "sent_mail": OrderedDict(),  # Data about email sent by users
+        "received_mail": OrderedDict(),  # Data about email received by users
+        "dovecot": OrderedDict(),  # Data about Dovecot activity
+        "postgrey": {},  # Data about greylisting of email addresses
+        "rejected": OrderedDict(),  # Emails that were blocked
+        "known_addresses": None,  # Addresses handled by the Miab installation
         "other-services": set(),
-        "imap-logins": {},
-        "pop3-logins": {},
-        "postgrey": {},
-        "rejected-mail": {},
-        "activity-by-hour": {
-            "imap-logins": defaultdict(int),
-            "pop3-logins": defaultdict(int),
-            "smtp-sends": defaultdict(int),
-            "smtp-receives": defaultdict(int),
-        },
-        "real_mail_addresses": (
-            set(mailconfig.get_mail_users(env)) | set(alias[0] for alias in mailconfig.get_mail_aliases(env))
-        )
     }
 
-    for fn in ('/var/log/mail.log.1', '/var/log/mail.log'):
-        if not os.path.exists(fn):
-            continue
-        with open(fn, 'rb') as log:
-            for line in log:
-                line = line.decode("utf8", errors='replace')
-                scan_mail_log_line(line.strip(), collector)
+    try:
+        import mailconfig
+        collector["known_addresses"] = (set(mailconfig.get_mail_users(env)) |
+                                        set(alias[0] for alias in mailconfig.get_mail_aliases(env)))
+    except ImportError:
+        pass
 
-    if collector["imap-logins"]:
-        logger.add_heading("Recent IMAP Logins")
-        logger.print_block("The most recent login from each remote IP adddress is shown.")
-        for k in utils.sort_email_addresses(collector["imap-logins"], env):
-            for ip, date in sorted(collector["imap-logins"][k].items(), key=lambda kv: kv[1]):
-                logger.print_line(k + "\t" + str(date) + "\t" + ip)
+    print("Scanning from {:%Y-%m-%d %H:%M:%S} back to {:%Y-%m-%d %H:%M:%S}".format(
+        START_DATE, END_DATE)
+    )
 
-    if collector["pop3-logins"]:
-        logger.add_heading("Recent POP3 Logins")
-        logger.print_block("The most recent login from each remote IP adddress is shown.")
-        for k in utils.sort_email_addresses(collector["pop3-logins"], env):
-            for ip, date in sorted(collector["pop3-logins"][k].items(), key=lambda kv: kv[1]):
-                logger.print_line(k + "\t" + str(date) + "\t" + ip)
+    # Scan the lines in the log files until the date goes out of range
+    scan_files(collector)
 
-    if collector["postgrey"]:
-        logger.add_heading("Greylisted Mail")
-        logger.print_block("The following mail was greylisted, meaning the emails were temporarily rejected. "
-                           "Legitimate senders will try again within ten minutes.")
-        logger.print_line("recipient" + "\t" + "received" + 3 * "\t" + "sender" + 6 * "\t" + "delivered")
-        for recipient in utils.sort_email_addresses(collector["postgrey"], env):
-            sorted_recipients = sorted(collector["postgrey"][recipient].items(), key=lambda kv: kv[1][0])
-            for (client_address, sender), (first_date, delivered_date) in sorted_recipients:
-                logger.print_line(
-                    recipient + "\t" + str(first_date) + "\t" + sender + "\t" +
-                    (("delivered " + str(delivered_date)) if delivered_date else "no retry yet")
-                )
+    if not collector["scan_count"]:
+        print("No log lines scanned...")
+        return
 
-    if collector["rejected-mail"]:
-        logger.add_heading("Rejected Mail")
-        logger.print_block("The following incoming mail was rejected.")
-        for k in utils.sort_email_addresses(collector["rejected-mail"], env):
-            for date, sender, message in collector["rejected-mail"][k]:
-                logger.print_line(k + "\t" + str(date) + "\t" + sender + "\t" + message)
+    collector["scan_time"] = time.time() - collector["scan_time"]
 
-    logger.add_heading("Activity by Hour")
-    logger.print_block("Dovecot logins and Postfix mail traffic per hour.")
-    logger.print_block("Hour\tIMAP\tPOP3\tSent\tReceived")
-    for h in range(24):
-        logger.print_line(
-            "%d\t%d\t\t%d\t\t%d\t\t%d" % (
-                h,
-                collector["activity-by-hour"]["imap-logins"][h],
-                collector["activity-by-hour"]["pop3-logins"][h],
-                collector["activity-by-hour"]["smtp-sends"][h],
-                collector["activity-by-hour"]["smtp-receives"][h],
-            )
+    print("{scan_count} Log lines scanned, {parse_count} lines parsed in {scan_time:.2f} "
+          "seconds\n".format(**collector))
+
+    # Print Sent Mail report
+
+    if collector["sent_mail"]:
+        msg = "Sent email between {:%Y-%m-%d %H:%M:%S} and {:%Y-%m-%d %H:%M:%S}"
+        print_header(msg.format(END_DATE, START_DATE))
+
+        data = OrderedDict(sorted(collector["sent_mail"].items(), key=email_sort))
+
+        print_user_table(
+            data.keys(),
+            data=[
+                ("sent", [u["sent_count"] for u in data.values()]),
+                ("hosts", [len(u["hosts"]) for u in data.values()]),
+            ],
+            sub_data=[
+                ("sending hosts", [u["hosts"] for u in data.values()]),
+            ],
+            activity=[
+                ("sent", [u["activity-by-hour"] for u in data.values()]),
+            ],
+            earliest=[u["earliest"] for u in data.values()],
+            latest=[u["latest"] for u in data.values()],
         )
 
-    if len(collector["other-services"]) > 0:
-        logger.add_heading("Other")
-        logger.print_block("Unrecognized services in the log: " + ", ".join(collector["other-services"]))
+        accum = defaultdict(int)
+        data = collector["sent_mail"].values()
+
+        for h in range(24):
+            accum[h] = sum(d["activity-by-hour"][h] for d in data)
+
+        print_time_table(
+            ["sent"],
+            [accum]
+        )
+
+    # Print Received Mail report
+
+    if collector["received_mail"]:
+        msg = "Received email between {:%Y-%m-%d %H:%M:%S} and {:%Y-%m-%d %H:%M:%S}"
+        print_header(msg.format(END_DATE, START_DATE))
+
+        data = OrderedDict(sorted(collector["received_mail"].items(), key=email_sort))
+
+        print_user_table(
+            data.keys(),
+            data=[
+                ("received", [u["received_count"] for u in data.values()]),
+            ],
+            activity=[
+                ("sent", [u["activity-by-hour"] for u in data.values()]),
+            ],
+            earliest=[u["earliest"] for u in data.values()],
+            latest=[u["latest"] for u in data.values()],
+        )
+
+        accum = defaultdict(int)
+        for h in range(24):
+            accum[h] = sum(d["activity-by-hour"][h] for d in data.values())
+
+        print_time_table(
+            ["received"],
+            [accum]
+        )
+
+    # Print Dovecot report
+
+    if collector["dovecot"]:
+        msg = "Email client logins between {:%Y-%m-%d %H:%M:%S} and {:%Y-%m-%d %H:%M:%S}"
+        print_header(msg.format(END_DATE, START_DATE))
+
+        data = OrderedDict(sorted(collector["dovecot"].items(), key=email_sort))
+
+        print_user_table(
+            data.keys(),
+            data=[
+                ("imap", [u["imap"] for u in data.values()]),
+                ("pop3", [u["pop3"] for u in data.values()]),
+            ],
+            sub_data=[
+                ("IMAP IP addresses", [[k + " (%d)" % v for k, v in u["imap-logins"].items()]
+                                       for u in data.values()]),
+                ("POP3 IP addresses", [[k + " (%d)" % v for k, v in u["pop3-logins"].items()]
+                                       for u in data.values()]),
+            ],
+            activity=[
+                ("imap", [u["activity-by-hour"]["imap"] for u in data.values()]),
+                ("pop3", [u["activity-by-hour"]["pop3"] for u in data.values()]),
+            ],
+            earliest=[u["earliest"] for u in data.values()],
+            latest=[u["latest"] for u in data.values()],
+        )
+
+        accum = {"imap": defaultdict(int), "pop3": defaultdict(int), "both": defaultdict(int)}
+        for h in range(24):
+            accum["imap"][h] = sum(d["activity-by-hour"]["imap"][h] for d in data.values())
+            accum["pop3"][h] = sum(d["activity-by-hour"]["pop3"][h] for d in data.values())
+            accum["both"][h] = accum["imap"][h] + accum["pop3"][h]
+
+        print_time_table(
+            ["imap", "pop3", "   +"],
+            [accum["imap"], accum["pop3"], accum["both"]]
+        )
+
+    if collector["postgrey"]:
+        msg = "Greylisted Email {:%Y-%m-%d %H:%M:%S} and {:%Y-%m-%d %H:%M:%S}"
+        print_header(msg.format(END_DATE, START_DATE))
+
+        print(textwrap.fill(
+            "The following mail was greylisted, meaning the emails were temporarily rejected. "
+            "Legitimate senders will try again within ten minutes.",
+            width=80, initial_indent=" ", subsequent_indent=" "
+        ), end='\n\n')
+
+        data = OrderedDict(sorted(collector["postgrey"].items(), key=email_sort))
+        users = []
+        received = []
+        senders = []
+        sender_clients = []
+        delivered_dates = []
+
+        for recipient in data:
+            sorted_recipients = sorted(data[recipient].items(), key=lambda kv: kv[1][0] or kv[1][1])
+            for (client_address, sender), (first_date, delivered_date) in sorted_recipients:
+                if first_date:
+                    users.append(recipient)
+                    received.append(first_date)
+                    senders.append(sender)
+                    delivered_dates.append(delivered_date)
+                    sender_clients.append(client_address)
+
+        print_user_table(
+            users,
+            data=[
+                ("received", received),
+                ("sender", senders),
+                ("delivered", [str(d) or "no retry yet" for d in delivered_dates]),
+                ("sending host", sender_clients)
+            ],
+            delimit=True,
+        )
+
+    if collector["rejected"]:
+        msg = "Blocked Email {:%Y-%m-%d %H:%M:%S} and {:%Y-%m-%d %H:%M:%S}"
+        print_header(msg.format(END_DATE, START_DATE))
+
+        data = OrderedDict(sorted(collector["rejected"].items(), key=email_sort))
+
+        rejects = []
+
+        if VERBOSE:
+            for user_data in data.values():
+                user_rejects = []
+                for date, sender, message in user_data["blocked"]:
+                    if len(sender) > 64:
+                        sender = sender[:32] + "…" + sender[-32:]
+                    user_rejects.append("%s - %s " % (date, sender))
+                    user_rejects.append("  %s" % message)
+                rejects.append(user_rejects)
+
+        print_user_table(
+            data.keys(),
+            data=[
+                ("blocked", [len(u["blocked"]) for u in data.values()]),
+            ],
+            sub_data=[
+                ("blocked emails", rejects),
+            ],
+            earliest=[u["earliest"] for u in data.values()],
+            latest=[u["latest"] for u in data.values()],
+        )
+
+    if collector["other-services"] and VERBOSE and False:
+        print_header("Other services")
+        print("The following unkown services were found in the log file.")
+        print(" ", *sorted(list(collector["other-services"])), sep='\n│ ')
 
 
 def scan_mail_log_line(line, collector):
     """ Scan a log line and extract interesting data """
 
-    m = re.match(r"(\S+ \d+ \d+:\d+:\d+) (\S+) (\S+?)(\[\d+\])?: (.*)", line)
+    m = re.match(r"(\w+[\s]+\d+ \d+:\d+:\d+) ([\w]+ )?([\w\-/]+)[^:]*: (.*)", line)
 
     if not m:
-        return
+        return True
 
-    date, system, service, pid, log = m.groups()
-    date = dateutil.parser.parse(date)
+    date, system, service, log = m.groups()
+    collector["scan_count"] += 1
 
-    if service == "dovecot":
-        scan_dovecot_line(date, log, collector)
+    # print()
+    # print("date:", date)
+    # print("host:", system)
+    # print("service:", service)
+    # print("log:", log)
+
+    # Replaced the dateutil parser for a less clever way of parser that is roughly 4 times faster.
+    # date = dateutil.parser.parse(date)
+    date = datetime.datetime.strptime(date, '%b %d %H:%M:%S')
+    date = date.replace(START_DATE.year)
+
+    # Check if the found date is within the time span we are scanning
+    if date > START_DATE:
+        # Don't process, but continue
+        return True
+    elif date < END_DATE:
+        # Don't process, and halt
+        return False
+
+    if service == "postfix/submission/smtpd":
+        if SCAN_OUT:
+            scan_postfix_submission_line(date, log, collector)
+    elif service == "postfix/lmtp":
+        if SCAN_IN:
+            scan_postfix_lmtp_line(date, log, collector)
+    elif service in ("imap-login", "pop3-login"):
+        if SCAN_CONN:
+            scan_dovecot_line(date, log, collector, service[:4])
     elif service == "postgrey":
-        scan_postgrey_line(date, log, collector)
+        if SCAN_GREY:
+            scan_postgrey_line(date, log, collector)
     elif service == "postfix/smtpd":
-        scan_postfix_smtpd_line(date, log, collector)
-    elif service == "postfix/cleanup":
-        scan_postfix_cleanup_line(date, log, collector)
-    elif service == "postfix/submission/smtpd":
-        scan_postfix_submission_line(date, log, collector)
-    elif service in ("postfix/qmgr", "postfix/pickup", "postfix/cleanup", "postfix/scache", "spampd", "postfix/anvil",
-                     "postfix/master", "opendkim", "postfix/lmtp", "postfix/tlsmgr"):
+        if SCAN_BLOCKED:
+            scan_postfix_smtpd_line(date, log, collector)
+    elif service in ("postfix/qmgr", "postfix/pickup", "postfix/cleanup", "postfix/scache",
+                     "spampd", "postfix/anvil", "postfix/master", "opendkim", "postfix/lmtp",
+                     "postfix/tlsmgr", "anvil"):
         # nothing to look at
-        pass
+        return True
     else:
         collector["other-services"].add(service)
+        return True
 
-
-def scan_dovecot_line(date, line, collector):
-    """ Scan a dovecot log line and extract interesting data """
-
-    m = re.match("(imap|pop3)-login: Login: user=<(.*?)>, method=PLAIN, rip=(.*?),", line)
-
-    if m:
-        prot, login, ip = m.group(1), m.group(2), m.group(3)
-        logins_key = "%s-logins" % prot
-        if ip != "127.0.0.1":  # local login from webmail/zpush
-            collector[logins_key].setdefault(login, {})[ip] = date
-        collector["activity-by-hour"][logins_key][date.hour] += 1
+    collector["parse_count"] += 1
+    return True
 
 
 def scan_postgrey_line(date, log, collector):
     """ Scan a postgrey log line and extract interesting data """
 
-    m = re.match("action=(greylist|pass), reason=(.*?), (?:delay=\d+, )?client_name=(.*), client_address=(.*), "
-                 "sender=(.*), recipient=(.*)",
+    m = re.match("action=(greylist|pass), reason=(.*?), (?:delay=\d+, )?client_name=(.*), "
+                 "client_address=(.*), sender=(.*), recipient=(.*)",
                  log)
 
     if m:
-        action, reason, client_name, client_address, sender, recipient = m.groups()
-        key = (client_address, sender)
-        if action == "greylist" and reason == "new":
-            collector["postgrey"].setdefault(recipient, {})[key] = (date, None)
-        elif action == "pass" and reason == "triplet found" and key in collector["postgrey"].get(recipient, {}):
-            collector["postgrey"][recipient][key] = (collector["postgrey"][recipient][key][0], date)
+
+        action, reason, client_name, client_address, sender, user = m.groups()
+
+        if user_match(user):
+
+            # Might be useful to group services that use a lot of mail different servers on sub
+            # domains like <sub>1.domein.com
+
+            # if '.' in client_name:
+            #     addr = client_name.split('.')
+            #     if len(addr) > 2:
+            #         client_name = '.'.join(addr[1:])
+
+            key = (client_address if client_name == 'unknown' else client_name, sender)
+
+            rep = collector["postgrey"].setdefault(user, {})
+
+            if action == "greylist" and reason == "new":
+                rep[key] = (date, rep[key][1] if key in rep else None)
+            elif action == "pass":
+                rep[key] = (rep[key][0] if key in rep else None, date)
 
 
 def scan_postfix_smtpd_line(date, log, collector):
     """ Scan a postfix smtpd log line and extract interesting data """
 
-    # Check if the incomming mail was rejected
+    # Check if the incoming mail was rejected
 
     m = re.match("NOQUEUE: reject: RCPT from .*?: (.*?); from=<(.*?)> to=<(.*?)>", log)
 
     if m:
-        message, sender, recipient = m.groups()
-        if recipient in collector["real_mail_addresses"]:
-            # only log mail to real recipients
+        message, sender, user = m.groups()
 
-            # skip this, if reported in the greylisting report
-            if "Recipient address rejected: Greylisted" in message:
-                return
+        # skip this, if reported in the greylisting report
+        if "Recipient address rejected: Greylisted" in message:
+            return
 
-            # simplify this one
-            m = re.search(r"Client host \[(.*?)\] blocked using zen.spamhaus.org; (.*)", message)
-            if m:
-                message = "ip blocked: " + m.group(2)
+        # only log mail to known recipients
+        if user_match(user):
+            if collector["known_addresses"] is None or user in collector["known_addresses"]:
+                data = collector["rejected"].get(
+                    user,
+                    {
+                        "blocked": [],
+                        "earliest": None,
+                        "latest": None,
+                    }
+                )
+                # simplify this one
+                m = re.search(
+                    r"Client host \[(.*?)\] blocked using zen.spamhaus.org; (.*)", message
+                )
+                if m:
+                    message = "ip blocked: " + m.group(2)
+                else:
+                    # simplify this one too
+                    m = re.search(
+                        r"Sender address \[.*@(.*)\] blocked using dbl.spamhaus.org; (.*)", message
+                    )
+                    if m:
+                        message = "domain blocked: " + m.group(2)
 
-            # simplify this one too
-            m = re.search(r"Sender address \[.*@(.*)\] blocked using dbl.spamhaus.org; (.*)", message)
-            if m:
-                message = "domain blocked: " + m.group(2)
+                if data["latest"] is None:
+                    data["latest"] = date
+                data["earliest"] = date
+                data["blocked"].append((date, sender, message))
 
-            collector["rejected-mail"].setdefault(recipient, []).append((date, sender, message))
+                collector["rejected"][user] = data
 
 
-def scan_postfix_cleanup_line(date, _, collector):
-    """ Scan a postfix cleanup log line and extract interesting data
+def scan_dovecot_line(date, log, collector, prot):
+    """ Scan a dovecot log line and extract interesting data """
 
-    It is assumed that every log of postfix/cleanup indicates an email that was successfulfy received by Postfix.
+    m = re.match("Info: Login: user=<(.*?)>, method=PLAIN, rip=(.*?),", log)
+
+    if m:
+        # TODO: CHECK DIT
+        user, rip = m.groups()
+
+        if user_match(user):
+            # Get the user data, or create it if the user is new
+            data = collector["dovecot"].get(
+                user,
+                {
+                    "imap": 0,
+                    "pop3": 0,
+                    "earliest": None,
+                    "latest": None,
+                    "imap-logins": defaultdict(int),
+                    "pop3-logins": defaultdict(int),
+                    "activity-by-hour": {
+                        "imap": defaultdict(int),
+                        "pop3": defaultdict(int),
+                    },
+                }
+            )
+
+            data[prot] += 1
+            data["activity-by-hour"][prot][date.hour] += 1
+
+            if data["latest"] is None:
+                data["latest"] = date
+            data["earliest"] = date
+
+            if rip not in ("127.0.0.1", "::1") or True:
+                data["%s-logins" % prot][rip] += 1
+
+            collector["dovecot"][user] = data
+
+
+def scan_postfix_lmtp_line(date, log, collector):
+    """ Scan a postfix lmtp log line and extract interesting data
+
+    It is assumed that every log of postfix/lmtp indicates an email that was successfully
+    received by Postfix.
 
     """
 
-    collector["activity-by-hour"]["smtp-receives"][date.hour] += 1
-
-def scan_postfix_submission_line(date, log, collector):
-    """ Scan a postfix submission log line and extract interesting data """
-
-    m = re.match("([A-Z0-9]+): client=(\S+), sasl_method=PLAIN, sasl_username=(\S+)", log)
+    m = re.match("([A-Z0-9]+): to=<(\S+)>, .* Saved", log)
 
     if m:
-        # procid, client, user = m.groups()
-        collector["activity-by-hour"]["smtp-sends"][date.hour] += 1
+        _, user = m.groups()
+
+        if user_match(user):
+            # Get the user data, or create it if the user is new
+            data = collector["received_mail"].get(
+                user,
+                {
+                    "received_count": 0,
+                    "earliest": None,
+                    "latest": None,
+                    "activity-by-hour": defaultdict(int),
+                }
+            )
+
+            data["received_count"] += 1
+            data["activity-by-hour"][date.hour] += 1
+
+            if data["latest"] is None:
+                data["latest"] = date
+            data["earliest"] = date
+
+            collector["received_mail"][user] = data
+
+
+def scan_postfix_submission_line(date, log, collector):
+    """ Scan a postfix submission log line and extract interesting data
+
+    Lines containing a sasl_method with the values PLAIN or LOGIN are assumed to indicate a sent
+    email.
+
+    """
+
+    # Match both the 'plain' and 'login' sasl methods, since both authentication methods are
+    # allowed by Dovecot
+    m = re.match("([A-Z0-9]+): client=(\S+), sasl_method=(PLAIN|LOGIN), sasl_username=(\S+)", log)
+
+    if m:
+        _, client, method, user = m.groups()
+
+        if user_match(user):
+            # Get the user data, or create it if the user is new
+            data = collector["sent_mail"].get(
+                user,
+                {
+                    "sent_count": 0,
+                    "hosts": set(),
+                    "earliest": None,
+                    "latest": None,
+                    "activity-by-hour": defaultdict(int),
+                }
+            )
+
+            data["sent_count"] += 1
+            data["hosts"].add(client)
+            data["activity-by-hour"][date.hour] += 1
+
+            if data["latest"] is None:
+                data["latest"] = date
+            data["earliest"] = date
+
+            collector["sent_mail"][user] = data
+
+
+# Utility functions
+
+def reverse_readline(filename, buf_size=8192):
+    """ A generator that returns the lines of a file in reverse order
+
+    http://stackoverflow.com/a/23646049/801870
+
+    """
+
+    with open(filename) as fh:
+        segment = None
+        offset = 0
+        fh.seek(0, os.SEEK_END)
+        file_size = remaining_size = fh.tell()
+        while remaining_size > 0:
+            offset = min(file_size, offset + buf_size)
+            fh.seek(file_size - offset)
+            buff = fh.read(min(remaining_size, buf_size))
+            remaining_size -= buf_size
+            lines = buff.split('\n')
+            # the first line of the buffer is probably not a complete line so
+            # we'll save it and append it to the last line of the next buffer
+            # we read
+            if segment is not None:
+                # if the previous chunk starts right from the beginning of line
+                # do not concat the segment to the last line of new chunk
+                # instead, yield the segment first
+                if buff[-1] is not '\n':
+                    lines[-1] += segment
+                else:
+                    yield segment
+            segment = lines[0]
+            for index in range(len(lines) - 1, 0, -1):
+                if len(lines[index]):
+                    yield lines[index]
+        # Don't yield None if the file was empty
+        if segment is not None:
+            yield segment
+
+
+def user_match(user):
+    """ Check if the given user matches any of the filters """
+    return FILTERS is None or any(u in user for u in FILTERS)
+
+
+def email_sort(email):
+    """ Split the given email address into a reverse order tuple, for sorting i.e (domain, name) """
+    return tuple(reversed(email[0].split('@')))
+
+
+def valid_date(string):
+    """ Validate the given date string fetched from the --startdate argument """
+    try:
+        date = dateutil.parser.parse(string)
+    except ValueError:
+        raise argparse.ArgumentTypeError("Unrecognized date and/or time '%s'" % string)
+    return date
+
+
+# Print functions
+
+def print_time_table(labels, data, do_print=True):
+    labels.insert(0, "hour")
+    data.insert(0, [str(h) for h in range(24)])
+
+    temp = "│ {:<%d} " % max(len(l) for l in labels)
+    lines = []
+
+    for label in labels:
+        lines.append(temp.format(label))
+
+    for h in range(24):
+        max_len = max(len(str(d[h])) for d in data)
+        base = "{:>%d} " % max(2, max_len)
+
+        for i, d in enumerate(data):
+            lines[i] += base.format(d[h])
+
+    lines.insert(0, "┬")
+    lines.append("└" + (len(lines[-1]) - 2) * "─")
+
+    if do_print:
+        print("\n".join(lines))
+    else:
+        return lines
+
+
+def print_user_table(users, data=None, sub_data=None, activity=None, latest=None, earliest=None,
+                     delimit=False):
+    str_temp = "{:<32} "
+    lines = []
+    data = data or []
+
+    col_widths = len(data) * [0]
+    col_left = len(data) * [False]
+    vert_pos = 0
+
+    do_accum = all(isinstance(n, (int, float)) for _, d in data for n in d)
+    data_accum = len(data) * ([0] if do_accum else [" "])
+
+    last_user = None
+
+    for row, user in enumerate(users):
+
+        if delimit:
+            if last_user and last_user != user:
+                lines.append(len(lines[-1]) * "…")
+            last_user = user
+
+        line = "{:<32} ".format(user[:31] + "…" if len(user) > 32 else user)
+
+        for col, (l, d) in enumerate(data):
+            if isinstance(d[row], str):
+                col_str = str_temp.format(d[row][:31] + "…" if len(d[row]) > 32 else d[row])
+                col_left[col] = True
+            elif isinstance(d[row], datetime.datetime):
+                col_str = "{:<20}".format(str(d[row]))
+                col_left[col] = True
+            else:
+                temp = "{:>%s}" % max(5, len(l) + 1, len(str(d[row])) + 1)
+                col_str = temp.format(str(d[row]))
+            col_widths[col] = max(col_widths[col], len(col_str))
+            line += col_str
+
+            if do_accum:
+                data_accum[col] += d[row]
+
+        try:
+            if None not in [latest, earliest]:
+                vert_pos = len(line)
+                e = earliest[row]
+                l = latest[row]
+                timespan = relativedelta(l, e)
+                if timespan.months:
+                    temp = " │ {:0.1f} months"
+                    line += temp.format(timespan.months + timespan.days / 30.0)
+                elif timespan.days:
+                    temp = " │ {:0.1f} days"
+                    line += temp.format(timespan.days + timespan.hours / 24.0)
+                elif (e.hour, e.minute) == (l.hour, l.minute):
+                    temp = " │ {:%H:%M}"
+                    line += temp.format(e)
+                else:
+                    temp = " │ {:%H:%M} - {:%H:%M}"
+                    line += temp.format(e, l)
+
+        except KeyError:
+            pass
+
+        lines.append(line.rstrip())
+
+        try:
+            if VERBOSE:
+                if sub_data is not None:
+                    for l, d in sub_data:
+                        if d[row]:
+                            lines.append("┬")
+                            lines.append("│ %s" % l)
+                            lines.append("├─%s─" % (len(l) * "─"))
+                            lines.append("│")
+                            max_len = 0
+                            for v in list(d[row]):
+                                lines.append("│ %s" % v)
+                                max_len = max(max_len, len(v))
+                            lines.append("└" + (max_len + 1) * "─")
+
+                if activity is not None:
+                    lines.extend(print_time_table(
+                        [label for label, _ in activity],
+                        [data[row] for _, data in activity],
+                        do_print=False
+                    ))
+
+        except KeyError:
+            pass
+
+    header = str_temp.format("")
+
+    for col, (l, _) in enumerate(data):
+        if col_left[col]:
+            header += l.ljust(max(5, len(l) + 1, col_widths[col]))
+        else:
+            header += l.rjust(max(5, len(l) + 1, col_widths[col]))
+
+    if None not in (latest, earliest):
+        header += " │ timespan   "
+
+    lines.insert(0, header.rstrip())
+
+    table_width = max(len(l) for l in lines)
+    t_line = table_width * "─"
+    b_line = table_width * "─"
+
+    if vert_pos:
+        t_line = t_line[:vert_pos + 1] + "┼" + t_line[vert_pos + 2:]
+        b_line = b_line[:vert_pos + 1] + ("┬" if VERBOSE else "┼") + b_line[vert_pos + 2:]
+
+    lines.insert(1, t_line)
+    lines.append(b_line)
+
+    # Print totals
+
+    data_accum = [str(a) for a in data_accum]
+    footer = str_temp.format("Totals:" if do_accum else " ")
+    for row, (l, _) in enumerate(data):
+        temp = "{:>%d}" % max(5, len(l) + 1)
+        footer += temp.format(data_accum[row])
+
+    try:
+        if None not in [latest, earliest]:
+            max_l = max(latest)
+            min_e = min(earliest)
+            timespan = relativedelta(max_l, min_e)
+            if timespan.days:
+                temp = " │ {:0.2f} days"
+                footer += temp.format(timespan.days + timespan.hours / 24.0)
+            elif (min_e.hour, min_e.minute) == (max_l.hour, max_l.minute):
+                temp = " │ {:%H:%M}"
+                footer += temp.format(min_e)
+            else:
+                temp = " │ {:%H:%M} - {:%H:%M}"
+                footer += temp.format(min_e, max_l)
+
+    except KeyError:
+        pass
+
+    lines.append(footer)
+
+    print("\n".join(lines))
+
+
+def print_header(msg):
+    print('\n' + msg)
+    print("═" * len(msg), '\n')
 
 
 if __name__ == "__main__":
-    from status_checks import ConsoleOutput
+    try:
+        env_vars = utils.load_environment()
+    except FileNotFoundError:
+        env_vars = {}
 
-    env_vars = utils.load_environment()
-    scan_mail_log(ConsoleOutput(), env_vars)
+    parser = argparse.ArgumentParser(
+        description="Scan the mail log files for interesting data. By default, this script "
+                    "shows today's incoming and outgoing mail statistics. This script was ("
+                    "re)written for the Mail-in-a-box email server."
+                    "https://github.com/mail-in-a-box/mailinabox",
+        add_help=False
+    )
+
+    # Switches to determine what to parse and what to ignore
+
+    parser.add_argument("-r", "--received", help="Scan for received emails.",
+                        action="store_true")
+    parser.add_argument("-s", "--sent", help="Scan for sent emails.",
+                        action="store_true")
+    parser.add_argument("-l", "--logins", help="Scan for IMAP/POP logins.",
+                        action="store_true")
+    parser.add_argument("-g", "--grey", help="Scan for greylisted emails.",
+                        action="store_true")
+    parser.add_argument("-b", "--blocked", help="Scan for blocked emails.",
+                        action="store_true")
+
+    parser.add_argument("-t", "--timespan", choices=TIME_DELTAS.keys(), default='today',
+                        metavar='<time span>',
+                        help="Time span to scan, going back from the start date. Possible values: "
+                             "{}. Defaults to 'today'.".format(", ".join(list(TIME_DELTAS.keys()))))
+    parser.add_argument("-d", "--startdate",  action="store", dest="startdate",
+                        type=valid_date, metavar='<start date>',
+                        help="Date and time to start scanning the log file from. If no date is "
+                             "provided, scanning will start from the current date and time.")
+    parser.add_argument("-u", "--users", action="store", dest="users",
+                        metavar='<email1,email2,email...>',
+                        help="Comma separated list of (partial) email addresses to filter the "
+                             "output with.")
+
+    parser.add_argument('-h', '--help', action='help', help="Print this message and exit.")
+    parser.add_argument("-v", "--verbose", help="Output extra data where available.",
+                        action="store_true")
+
+    args = parser.parse_args()
+
+    if args.startdate is not None:
+        START_DATE = args.startdate
+        if args.timespan == 'today':
+            args.timespan = 'day'
+        print("Setting start date to {}".format(START_DATE))
+
+    END_DATE = START_DATE - TIME_DELTAS[args.timespan]
+
+    VERBOSE = args.verbose
+
+    if args.received or args.sent or args.logins or args.grey or args.blocked:
+        SCAN_IN = args.received
+        if not SCAN_IN:
+            print("Ignoring received emails")
+
+        SCAN_OUT = args.sent
+        if not SCAN_OUT:
+            print("Ignoring sent emails")
+
+        SCAN_CONN = args.logins
+        if not SCAN_CONN:
+            print("Ignoring logins")
+
+        SCAN_GREY = args.grey
+        if SCAN_GREY:
+            print("Showing greylisted emails")
+
+        SCAN_BLOCKED = args.blocked
+        if SCAN_BLOCKED:
+            print("Showing blocked emails")
+
+    if args.users is not None:
+        FILTERS = args.users.strip().split(',')
+
+    scan_mail_log(env_vars)

From 6c3696a54a9962469efbacda11babd83e75d5093 Mon Sep 17 00:00:00 2001
From: yeah <yeah@users.noreply.github.com>
Date: Sun, 26 Mar 2017 20:20:27 +0700
Subject: [PATCH 161/165] Upgrade ownCloud to 9.1.4 to address security
 vulnerabilities, refs #1111 (#1120)

* Move variable assignment up and do not use call arguments directly

* Upgrade ownCloud to latest patch release 9.1.4

also move owncloud hash to its own variable
---
 setup/owncloud.sh | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/setup/owncloud.sh b/setup/owncloud.sh
index 2179c7ec..5cf3714d 100755
--- a/setup/owncloud.sh
+++ b/setup/owncloud.sh
@@ -29,12 +29,13 @@ if [ ! -f $STORAGE_ROOT/owncloud/config.php ] \
 fi
 
 InstallOwncloud() {
-	echo
-	echo "Upgrading to ownCloud version $1"
-	echo
 
-        version=$1
-        hash=$2
+	version=$1
+	hash=$2
+
+	echo
+	echo "Upgrading to ownCloud version $version"
+	echo
 
 	# Remove the current owncloud
 	rm -rf /usr/local/lib/owncloud
@@ -85,7 +86,8 @@ InstallOwncloud() {
 	fi
 }
 
-owncloud_ver=9.1.2
+owncloud_ver=9.1.4
+owncloud_hash=e637cab7b2ca3346164f3506b1a0eb812b4e841a
 
 # Check if ownCloud dir exist, and check if version matches owncloud_ver (if either doesn't - install/upgrade)
 if [ ! -d /usr/local/lib/owncloud/ ] \
@@ -152,7 +154,7 @@ EOF
 		fi
 	fi
 
-	InstallOwncloud $owncloud_ver ba9b1cdb681b8a3607d928cbe56f52e3888d9296
+	InstallOwncloud $owncloud_ver $owncloud_hash
 fi
 
 # ### Configuring ownCloud

From d7d8964afcee6e462edf0e00bd5b55c06568c53a Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sun, 26 Mar 2017 09:31:35 -0400
Subject: [PATCH 162/165] changlog entries

---
 CHANGELOG.md | 32 +++++++++++++++++++++++++++-----
 1 file changed, 27 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cfba9119..a5cd4db7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,17 +4,39 @@ CHANGELOG
 In Development
 --------------
 
+Mail:
+
 * The CardDAV plugin has been added to Roundcube so that your ownCloud contacts are available in webmail.
-* Upgraded to ownCloud 9.1.2.
 * Upgraded to Roundcube 1.2.3.
-* The status checks page crashed when the mailinabox.email website was down - that's fixed.
 * Allow larger messages to be checked by SpamAssassin.
+* Dovecot's vsz memory limit has been increased proportional to system memory.
+* Newly set user passwords must be at least eight characters.
+
+ownCloud:
+
+* Upgraded to ownCloud 9.1.4.
+
+Control Panel/Management:
+
+* The status checks page crashed when the mailinabox.email website was down - that's fixed.
 * Made nightly re-provisioning of TLS certificates less noisy.
-* Fixed bugs in rsync backup method.
-* Added support for DSA and ED25519 SSHFP records.
-* Added support for custom SSHFP records.
+* Fixed bugs in rsync backup method and in the list of recent backups.
+* Fixed incorrect status checks errors about IPv6 addresses.
+* Fixed incorrect status checks errors for secondary nameservers if round-robin custom A records are set.
 * The management mail_log.py tool has been rewritten.
 
+DNS:
+
+* Added support for DSA, ED25519, and custom SSHFP records.
+
+System:
+
+* The SSH fail2ban jail was not activated.
+
+Installation:
+
+* At the end of installation, the SHA256 -- rather than SHA1 -- hash of the system's TLS certificate is shown.
+
 v0.21c (February 1, 2017)
 -------------------------
 

From 653cb7ce10ce5fa54331aa8ebb3c77c9b4476e55 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Sun, 26 Mar 2017 09:50:00 -0400
Subject: [PATCH 163/165] roundcube 1.2.4, persistent login plugin

---
 CHANGELOG.md     | 2 +-
 setup/webmail.sh | 7 +++----
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a5cd4db7..65524f67 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,7 +7,7 @@ In Development
 Mail:
 
 * The CardDAV plugin has been added to Roundcube so that your ownCloud contacts are available in webmail.
-* Upgraded to Roundcube 1.2.3.
+* Upgraded to Roundcube 1.2.4 and updated the persistent login plugin.
 * Allow larger messages to be checked by SpamAssassin.
 * Dovecot's vsz memory limit has been increased proportional to system memory.
 * Newly set user passwords must be at least eight characters.
diff --git a/setup/webmail.sh b/setup/webmail.sh
index dd861a35..0f7b9598 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -34,13 +34,12 @@ apt-get purge -qq -y roundcube* #NODOC
 # Install Roundcube from source if it is not already present or if it is out of date.
 # Combine the Roundcube version number with the commit hash of vacation_sieve to track
 # whether we have the latest version.
-VERSION=1.2.3
-HASH=b0c3c4ba25596b2637c058b8254b58292755ec52
+VERSION=1.2.4
+HASH=e2091ea775b80eda43ab225130d5a2e888c3789a
 VACATION_SIEVE_VERSION=91ea6f52216390073d1f5b70b5f6bea0bfaee7e5
-PERSISTENT_LOGIN_VERSION=1e9d724476a370ce917a2fcd5b3217b0c306c24e
+PERSISTENT_LOGIN_VERSION=c4516c4be37d12ef653de86497304e073a863c2a
 HTML5_NOTIFIER_VERSION=4b370e3cd60dabd2f428a26f45b677ad1b7118d5
 CARDDAV_VERSION=2.0.4
-# sha1sum of the rcmcarddav plugin release
 CARDDAV_HASH=d93f3cfb3038a519e71c7c3212c1d16f5da609a4
 
 UPDATE_KEY=$VERSION:$VACATION_SIEVE_VERSION:$PERSISTENT_LOGIN_VERSION:$HTML5_NOTIFIER_VERSION:$CARDDAV_VERSION:a

From c7badb80d1b232799117806ce160cf14b485ce1e Mon Sep 17 00:00:00 2001
From: yeah <yeah@users.noreply.github.com>
Date: Mon, 27 Mar 2017 00:23:34 +0700
Subject: [PATCH 164/165] Set default user password length to 8 in
 non-interactive setups (#1123)

To comply with #1098 and avoid failed setups while testing with Vagrant
---
 setup/firstuser.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/setup/firstuser.sh b/setup/firstuser.sh
index d0ce9c7e..d24fc370 100644
--- a/setup/firstuser.sh
+++ b/setup/firstuser.sh
@@ -35,7 +35,7 @@ if [ -z "`tools/mail.py user`" ]; then
 		else
 			# Use me@PRIMARY_HOSTNAME
 			EMAIL_ADDR=me@$PRIMARY_HOSTNAME
-			EMAIL_PW=1234
+			EMAIL_PW=12345678
 			echo
 			echo "Creating a new administrative mail account for $EMAIL_ADDR with password $EMAIL_PW."
 			echo
@@ -54,4 +54,4 @@ if [ -z "`tools/mail.py user`" ]; then
 
 	# Create an alias to which we'll direct all automatically-created administrative aliases.
 	tools/mail.py alias add administrator@$PRIMARY_HOSTNAME $EMAIL_ADDR > /dev/null
-fi
\ No newline at end of file
+fi

From 255a65ac98555366874a3ffd7fbcfeb9f6c7d369 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Mon, 27 Mar 2017 08:16:36 -0400
Subject: [PATCH 165/165] suppress rmcarddav's php version check

Since it says "RCMCardDAV requires at least PHP 5.6.18. Older versions might work", let's hope for the best.

Also hiding its preferences panel in settings since if it doesn't work, we don't want folks using it for anything but connecting to ownCloud contacts.
---
 setup/webmail.sh | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/setup/webmail.sh b/setup/webmail.sh
index 0f7b9598..f198cb59 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -132,14 +132,12 @@ EOF
 cat > ${RCM_PLUGIN_DIR}/carddav/config.inc.php <<EOF;
 <?php
 /* Do not edit. Written by Mail-in-a-Box. Regenerated on updates. */
+\$prefs['_GLOBAL']['hide_preferences'] = true;
+\$prefs['_GLOBAL']['suppress_version_warning'] = true;
 \$prefs['ownCloud'] = array(
-	 // required attributes
 	 'name'         =>  'ownCloud',
-	 // will be substituted for the roundcube username
-	 'username'     =>  '%u',
-	 // will be substituted for the roundcube password
-	 'password'     =>  '%p',
-	 // %u will be substituted for the CardDAV username
+	 'username'     =>  '%u', // login username
+	 'password'     =>  '%p', // login password
 	 'url'          =>  'https://${PRIMARY_HOSTNAME}/cloud/remote.php/carddav/addressbooks/%u/contacts',
 	 'active'       =>  true,
 	 'readonly'     =>  false,