mirror of
https://github.com/mail-in-a-box/mailinabox.git
synced 2025-04-01 23:57:05 +00:00
Merge 12f1486141 into 3efd4257b5
This commit is contained in:
bilogic
GitHub
commit
9a1237a29f
@ -291,7 +291,7 @@ def build_zone(domain, domain_properties, additional_records, env, is_zone=True)
|
||||
|
||||
# Append the DKIM TXT record to the zone as generated by OpenDKIM.
|
||||
# Skip if the user has set a DKIM record already.
|
||||
opendkim_record_file = os.path.join(env['STORAGE_ROOT'], 'mail/dkim/mail.txt')
|
||||
opendkim_record_file = os.path.join(env['STORAGE_ROOT'], 'mail/dkim/' + env['DKIM_SELECTOR'] + '.txt')
|
||||
with open(opendkim_record_file, encoding="utf-8") as orf:
|
||||
m = re.match(r'(\S+)\s+IN\s+TXT\s+\( ((?:"[^"]+"\s+)+)\)', orf.read(), re.S)
|
||||
val = "".join(re.findall(r'"([^"]+)"', m.group(2)))
|
||||
@ -752,12 +752,13 @@ def write_opendkim_tables(domains, env):
|
||||
# Append a record to OpenDKIM's KeyTable and SigningTable for each domain
|
||||
# that we send mail from (zones and all subdomains).
|
||||
|
||||
opendkim_key_file = os.path.join(env['STORAGE_ROOT'], 'mail/dkim/mail.private')
|
||||
opendkim_key_file = os.path.join(env['STORAGE_ROOT'], 'mail/dkim/' + env['DKIM_SELECTOR'] + '.private')
|
||||
|
||||
if not os.path.exists(opendkim_key_file):
|
||||
# Looks like OpenDKIM is not installed.
|
||||
return False
|
||||
|
||||
selector=env['DKIM_SELECTOR']
|
||||
config = {
|
||||
# The SigningTable maps email addresses to a key in the KeyTable that
|
||||
# specifies signing information for matching email addresses. Here we
|
||||
@ -777,7 +778,7 @@ def write_opendkim_tables(domains, env):
|
||||
# signing domain must match the sender's From: domain.
|
||||
"KeyTable":
|
||||
"".join(
|
||||
f"{domain} {domain}:mail:{opendkim_key_file}\n"
|
||||
f"{domain} {domain}:{selector}:{opendkim_key_file}\n"
|
||||
for domain in domains
|
||||
),
|
||||
}
|
||||
|
||||
@ -14,7 +14,7 @@ echo "Installing OpenDKIM/OpenDMARC..."
|
||||
apt_install opendkim opendkim-tools opendmarc
|
||||
|
||||
# Make sure configuration directories exist.
|
||||
mkdir -p /etc/opendkim;
|
||||
mkdir -p /etc/opendkim
|
||||
mkdir -p "$STORAGE_ROOT/mail/dkim"
|
||||
|
||||
# Used in InternalHosts and ExternalIgnoreList configuration directives.
|
||||
@ -30,7 +30,7 @@ if grep -q "ExternalIgnoreList" /etc/opendkim.conf; then
|
||||
true # already done #NODOC
|
||||
else
|
||||
# Add various configuration options to the end of `opendkim.conf`.
|
||||
cat >> /etc/opendkim.conf << EOF;
|
||||
cat >>/etc/opendkim.conf <<EOF
|
||||
Canonicalization relaxed/simple
|
||||
MinimumKeyBits 1024
|
||||
ExternalIgnoreList refile:/etc/opendkim/TrustedHosts
|
||||
@ -52,8 +52,8 @@ fi
|
||||
# A 1024-bit key is seen as a minimum standard by several providers
|
||||
# such as Google. But they and others use a 2048 bit key, so we'll
|
||||
# do the same. Keys beyond 2048 bits may exceed DNS record limits.
|
||||
if [ ! -f "$STORAGE_ROOT/mail/dkim/mail.private" ]; then
|
||||
opendkim-genkey -b 2048 -r -s mail -D "$STORAGE_ROOT/mail/dkim"
|
||||
if [ ! -f "$STORAGE_ROOT/mail/dkim/$DKIM_SELECTOR.private" ]; then
|
||||
opendkim-genkey -b 2048 -r -s $DKIM_SELECTOR -D $STORAGE_ROOT/mail/dkim
|
||||
fi
|
||||
|
||||
# Ensure files are owned by the opendkim user and are private otherwise.
|
||||
@ -121,4 +121,3 @@ hide_output systemctl enable opendmarc
|
||||
restart_service opendkim
|
||||
restart_service opendmarc
|
||||
restart_service postfix
|
||||
|
||||
|
||||
@ -38,13 +38,20 @@ if [ -f /etc/mailinabox.conf ]; then
|
||||
cat /etc/mailinabox.conf | sed s/^/DEFAULT_/ >/tmp/mailinabox.prev.conf
|
||||
source /tmp/mailinabox.prev.conf
|
||||
rm -f /tmp/mailinabox.prev.conf
|
||||
|
||||
# Since this is a second run, attempt to read overridden settings from $STORAGE_ROOT/mailinabox.conf
|
||||
if [ -f $DEFAULT_STORAGE_ROOT/mailinabox.conf ]; then
|
||||
cat $DEFAULT_STORAGE_ROOT/mailinabox.conf | sed s/^/DEFAULT_/ >/tmp/mailinabox.prev.conf
|
||||
source /tmp/mailinabox.prev.conf
|
||||
rm -f /tmp/mailinabox.prev.conf
|
||||
fi
|
||||
else
|
||||
FIRST_TIME_SETUP=1
|
||||
fi
|
||||
|
||||
# Put a start script in a global location. We tell the user to run 'mailinabox'
|
||||
# in the first dialog prompt, so we should do this before that starts.
|
||||
cat > /usr/local/bin/mailinabox << EOF;
|
||||
cat >/usr/local/bin/mailinabox <<EOF
|
||||
#!/bin/bash
|
||||
cd $PWD
|
||||
source setup/start.sh
|
||||
@ -82,7 +89,10 @@ if [ ! -d "$STORAGE_ROOT" ]; then
|
||||
mkdir -p "$STORAGE_ROOT"
|
||||
fi
|
||||
f=$STORAGE_ROOT
|
||||
while [[ $f != / ]]; do chmod a+rx "$f"; f=$(dirname "$f"); done;
|
||||
while [[ $f != / ]]; do
|
||||
chmod a+rx "$f"
|
||||
f=$(dirname "$f")
|
||||
done
|
||||
if [ ! -f "$STORAGE_ROOT/mailinabox.version" ]; then
|
||||
setup/migrate.py --current >"$STORAGE_ROOT/mailinabox.version"
|
||||
chown "$STORAGE_USER:$STORAGE_USER" "$STORAGE_ROOT/mailinabox.version"
|
||||
@ -92,7 +102,7 @@ fi
|
||||
# tools know where to look for data. The default MTA_STS_MODE setting
|
||||
# is blank unless set by an environment variable, but see web.sh for
|
||||
# how that is interpreted.
|
||||
cat > /etc/mailinabox.conf << EOF;
|
||||
cat >/etc/mailinabox.conf <<EOF
|
||||
STORAGE_USER=$STORAGE_USER
|
||||
STORAGE_ROOT=$STORAGE_ROOT
|
||||
PRIMARY_HOSTNAME=$PRIMARY_HOSTNAME
|
||||
@ -101,6 +111,7 @@ PUBLIC_IPV6=$PUBLIC_IPV6
|
||||
PRIVATE_IP=$PRIVATE_IP
|
||||
PRIVATE_IPV6=$PRIVATE_IPV6
|
||||
MTA_STS_MODE=${DEFAULT_MTA_STS_MODE:-enforce}
|
||||
DKIM_SELECTOR=${DEFAULT_DKIM_SELECTOR:-mail}
|
||||
EOF
|
||||
|
||||
# Start service configuration.
|
||||
@ -120,8 +131,7 @@ source setup/management.sh
|
||||
source setup/munin.sh
|
||||
|
||||
# Wait for the management daemon to start...
|
||||
until nc -z -w 4 127.0.0.1 10222
|
||||
do
|
||||
until nc -z -w 4 127.0.0.1 10222; do
|
||||
echo "Waiting for the Mail-in-a-Box management daemon to start..."
|
||||
sleep 2
|
||||
done
|
||||
@ -166,16 +176,14 @@ if management/status_checks.py --check-primary-hostname; then
|
||||
echo
|
||||
echo "If you have a DNS problem put the box's IP address in the URL"
|
||||
echo "(https://$PUBLIC_IP/admin) but then check the TLS fingerprint:"
|
||||
openssl x509 -in "$STORAGE_ROOT/ssl/ssl_certificate.pem" -noout -fingerprint -sha256\
|
||||
| sed "s/SHA256 Fingerprint=//i"
|
||||
openssl x509 -in "$STORAGE_ROOT/ssl/ssl_certificate.pem" -noout -fingerprint -sha256 | sed "s/SHA256 Fingerprint=//i"
|
||||
else
|
||||
echo "https://$PUBLIC_IP/admin"
|
||||
echo
|
||||
echo "You will be alerted that the website has an invalid certificate. Check that"
|
||||
echo "the certificate fingerprint matches:"
|
||||
echo
|
||||
openssl x509 -in "$STORAGE_ROOT/ssl/ssl_certificate.pem" -noout -fingerprint -sha256\
|
||||
| sed "s/SHA256 Fingerprint=//i"
|
||||
openssl x509 -in "$STORAGE_ROOT/ssl/ssl_certificate.pem" -noout -fingerprint -sha256 | sed "s/SHA256 Fingerprint=//i"
|
||||
echo
|
||||
echo "Then you can confirm the security exception and continue."
|
||||
echo
|
||||
|
||||
Loading…
Reference in New Issue
Block a user