diff --git a/CHANGELOG.md b/CHANGELOG.md index babb04ed..1698cd03 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,9 +4,16 @@ CHANGELOG In Development -------------- +ownCloud: + +* Updated to ownCloud to 8.2.7. + +v0.19 (August 13, 2016) +----------------------- + Mail: -* Roundcube is updated to version 1.2.0. +* Roundcube is updated to version 1.2.1. * SSLv3 and RC4 are now no longer supported in incoming and outgoing mail (SMTP port 25). Control panel: @@ -15,6 +22,10 @@ Control panel: * The HSTS header was missing. * New status checks were added for the ufw firewall. +DNS: + +* Add SRV records for CardDAV/CalDAV to facilitate autoconfiguration (e.g. in DavDroid, whose latest version didn't seem to work to configure with entering just a hostname). + System: * fail2ban jails added for SMTP submission, Roundcube, ownCloud, the control panel, and munin. diff --git a/README.md b/README.md index ad912a28..6f6937fa 100644 --- a/README.md +++ b/README.md @@ -59,7 +59,7 @@ by me: $ curl -s https://keybase.io/joshdata/key.asc | gpg --import gpg: key C10BDD81: public key "Joshua Tauberer " imported - $ git verify-tag v0.18c + $ git verify-tag v0.19 gpg: Signature made ..... using RSA key ID C10BDD81 gpg: Good signature from "Joshua Tauberer " gpg: WARNING: This key is not certified with a trusted signature! @@ -72,7 +72,7 @@ and on my [personal homepage](https://razor.occams.info/). (Of course, if this r Checkout the tag corresponding to the most recent release: - $ git checkout v0.18c + $ git checkout v0.19 Begin the installation. diff --git a/management/dns_update.py b/management/dns_update.py index 836ad0d4..d7bbdfd0 100755 --- a/management/dns_update.py +++ b/management/dns_update.py @@ -274,6 +274,13 @@ def build_zone(domain, all_domains, additional_records, www_redirect_domains, en if not has_rec(dmarc_qname, "TXT", prefix="v=DMARC1; "): records.append((dmarc_qname, "TXT", 'v=DMARC1; p=reject', "Recommended. Prevents use of this domain name for outbound mail by specifying that the SPF rule should be honoured for mail from @%s." % (qname + "." + domain))) + # Add CardDAV/CalDAV SRV records on the non-primary hostname that points to the primary hostname. + # The SRV record format is priority (0, whatever), weight (0, whatever), port, service provider hostname (w/ trailing dot). + if domain != env["PRIMARY_HOSTNAME"]: + for dav in ("card", "cal"): + qname = "_" + dav + "davs._tcp" + if not has_rec(qname, "SRV"): + records.append((qname, "SRV", "0 0 443 " + env["PRIMARY_HOSTNAME"] + ".", "Recommended. Specifies the hostname of the server that handles CardDAV/CalDAV services for email addresses on this domain.")) # Sort the records. The None records *must* go first in the nsd zone file. Otherwise it doesn't matter. records.sort(key = lambda rec : list(reversed(rec[0].split(".")) if rec[0] is not None else "")) diff --git a/management/templates/aliases.html b/management/templates/aliases.html index d5a123ff..bf8e63cd 100644 --- a/management/templates/aliases.html +++ b/management/templates/aliases.html @@ -106,37 +106,38 @@ -

Mail alias API

+

Mail aliases API (advanced)

-

Use your box’s Mail alias API to add/remove aliases.

+

Use your box’s mail aliases API to add and remove mail aliases from the command-line or custom services you build.

Usage:

-
curl -X VERB [-d "value"] --user {email}:{password} https://{{hostname}}/admin/mail/aliases[action]
+
curl -X VERB [-d "parameters"] --user {email}:{password} https://{{hostname}}/admin/mail/aliases[action]
-

(Brackets denote an optional argument.)

-

(Adding ?format=json will give json encoded results)

+

Brackets denote an optional argument. Please note that the POST body parameters must be URL-encoded.

-

Verbs

+

The email and password given to the --user option must be an administrative user on this system.

- +

Verbs

+ +
- - - + + +
Verb Action
GET Returns a list of existing mail aliases.
POST/add Adds a new mail alias. Required parameters are address and forward_to.
POST/remove Removes a mail alias. Required parameter is address.
GET(none) Returns a list of existing mail aliases. Adding ?format=json to the URL will give JSON-encoded results.
POST/add Adds a new mail alias. Required POST-body parameters are address and forward_to.
POST/remove Removes a mail alias. Required POST-body parameter is address.

Examples:

Try these examples. For simplicity the examples omit the --user me@mydomain.com:yourpassword command line argument which you must fill in with your email address and password.

-
# Gives a json encoded list of all mail users
-curl -X GET https://{{hostname}}/admin/mail/users?format=json
+
# Gives a JSON-encoded list of all mail aliases
+curl -X GET https://{{hostname}}/admin/mail/aliases?format=json
 
-# adds a new email alias
+# Adds a new alias
 curl -X POST -d "address=new_alias@mydomail.com" -d "forward_to=my_email@mydomain.com" https://{{hostname}}/admin/mail/aliases/add
 
-# removes a email alias
+# Removes an alias
 curl -X POST -d "address=new_alias@mydomail.com" https://{{hostname}}/admin/mail/aliases/remove
 

 
diff --git a/management/templates/custom-dns.html b/management/templates/custom-dns.html
index bd5643c3..df3d82e5 100644
--- a/management/templates/custom-dns.html
+++ b/management/templates/custom-dns.html
@@ -10,7 +10,7 @@
 
 
It is possible to set custom DNS records on domains hosted here.

 
-
Set Custom DNS Records

+
Set custom DNS records

 
 
You can set additional DNS records, such as if you have a website running on another server, to add DKIM records for external mail providers, or for various confirmation-of-ownership tests.

 
@@ -66,7 +66,7 @@
   
 
 
-
Using a Secondary Nameserver

+
Using a secondary nameserver

 
 
If your TLD requires you to have two separate nameservers, you can either set up external DNS and ignore the DNS server on this box entirely, or use the DNS server on this box but add a secondary (aka “slave”) nameserver.

 
If you choose to use a seconday nameserver, you must find a seconday nameserver service provider. Your domain name registrar or virtual cloud provider may provide this service for you. Once you set up the seconday nameserver service, enter the hostname (not the IP address) of their secondary nameserver in the box below.

diff --git a/management/templates/ssl.html b/management/templates/ssl.html
index d7e656c7..cefc82fd 100644
--- a/management/templates/ssl.html
+++ b/management/templates/ssl.html
@@ -8,7 +8,7 @@
 
You need a TLS certificate for this box’s hostname ({{hostname}}) and every other domain name and subdomain that this box is hosting a website for (see the list below).

 
 

-
Provision a Certificate

+
Provision a certificate

 
 
 

 
-
Certificate Status

+
Certificate status

 
 
Certificates expire after a period of time. All certificates will be automatically renewed through Let’s Encrypt 14 days prior to expiration.

 
@@ -53,7 +53,7 @@
 
 
 
-
Install Certificate

+
Install certificate

 
 
There are many other places where you can get a free or cheap certificate. If you don't want to use our automatic Let's Encrypt integration, you can give Namecheap’s $9 certificate, StartSSL’s free express lane, WoSign’s free TLS or any other certificate provider a try.

 
diff --git a/management/templates/system-backup.html b/management/templates/system-backup.html
index dc925916..8fceafe6 100644
--- a/management/templates/system-backup.html
+++ b/management/templates/system-backup.html
@@ -74,7 +74,7 @@
   
 
 
-
Available Backups

+
Available backups

 
 
The backup location currently contains the backups listed below. The total size of the backups is currently .

 
diff --git a/management/templates/users.html b/management/templates/users.html
index 793f0ff0..2cda327c 100644
--- a/management/templates/users.html
+++ b/management/templates/users.html
@@ -84,45 +84,46 @@
   
 
 
-
Mail user API

+
Mail user API (advanced)

 
-
Use your box’s Mail user API to add/change/remove users.

+
Use your box’s mail user API to add/change/remove users from the command-line or custom services you build.

 
 
Usage:

 
-
curl -X VERB [-d "value"] --user {email}:{password} https://{{hostname}}/admin/mail/users[action]

+
curl -X VERB [-d "parameters"] --user {email}:{password} https://{{hostname}}/admin/mail/users[action]

 
-
(Brackets denote an optional argument.)

-
(Adding ?format=json will give json encoded results)

+
Brackets denote an optional argument. Please note that the POST body parameters must be URL-encoded.

 
-
Verbs

+
The email and password given to the --user option must be an administrative user on this system.

 
-
+
Verbs

+
+

-
-
-
-
-
+
+
+
+
+

 
Verb Action
GET Returns a list of existing mail users.
POST/add Adds a new mail user. Required parameters are email and password.
POST/remove Removes a mail user. Required parameter is email.
POST/privileges/add Used to make a mail user an admin. Required parameters are email and privilege=admin.
POST/privileges/remove Used to remove the admin privilege from a mail user. Required parameter is email.
GET(none) Returns a list of existing mail users. Adding ?format=json to the URL will give JSON-encoded results.
POST/add Adds a new mail user. Required POST-body parameters are email and password.
POST/remove Removes a mail user. Required POST-by parameter is email.
POST/privileges/add Used to make a mail user an admin. Required POST-body parameters are email and privilege=admin.
POST/privileges/remove Used to remove the admin privilege from a mail user. Required POST-body parameter is email.

 

 
 
Examples:

 
-
Try these examples. For simplicity the examples omit the --user me@mydomain.com:yourpassword command line argument which you must fill in with your email address and password.

+
Try these examples. For simplicity the examples omit the --user me@mydomain.com:yourpassword command line argument which you must fill in with your administrative email address and password.

 
-
# Gives a json encoded list of all mail users
+
# Gives a JSON-encoded list of all mail users
 curl -X GET https://{{hostname}}/admin/mail/users?format=json
 
-# adds a new email user
+# Adds a new email user
 curl -X POST -d "email=new_user@mydomail.com" -d "password=s3curE_pa5Sw0rD" https://{{hostname}}/admin/mail/users/add
 
-# removes a email user
+# Removes a email user
 curl -X POST -d "email=new_user@mydomail.com" https://{{hostname}}/admin/mail/users/remove
 
-# adds admin privilege to an email user
+# Adds admin privilege to an email user
 curl -X POST -d "email=new_user@mydomail.com" -d "privilege=admin" https://{{hostname}}/admin/mail/users/privileges/add
 
-# removes admin privilege from an email user
+# Removes admin privilege from an email user
 curl -X POST -d "email=new_user@mydomail.com" https://{{hostname}}/admin/mail/users/privileges/remove
 

 
diff --git a/security.md b/security.md
index a56df082..e89eeeb9 100644
--- a/security.md
+++ b/security.md
@@ -69,6 +69,16 @@ The [setup guide video](https://mailinabox.email/) explains how to verify the ho
 
 If DNSSEC is enabled at the box's domain name's registrar, the SSHFP record that the box automatically puts into DNS can also be used to verify the host key fingerprint by setting `VerifyHostKeyDNS yes` in your `ssh/.config` file or by logging in with `ssh -o VerifyHostKeyDNS=yes`. ([source](management/dns_update.py))
 
+### Brute-force attack mitigation
+
+`fail2ban` provides some protection from brute-force login attacks (repeated logins that guess account passwords) by blocking offending IP addresses at the network level.
+
+The following services are protected: SSH, IMAP (dovecot), SMTP submission (postfix), webmail (roundcube), ownCloud/CalDAV/CardDAV (over HTTP), and the Mail-in-a-Box control panel & munin (over HTTP).
+
+Some other services running on the box may be missing fail2ban filters.
+
+`fail2ban` only blocks IPv4 addresses, however. If the box has a public IPv6 address, it is not protected from these attacks.
+
 Outbound Mail
 -------------
 
diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh
index 8061329b..47fbb6ec 100644
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -7,7 +7,7 @@
 #########################################################
 
 if [ -z "$TAG" ]; then
-	TAG=v0.18c
+	TAG=v0.19
 fi
 
 # Are we running as root?
diff --git a/setup/webmail.sh b/setup/webmail.sh
index bf29c6ab..8307149b 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -34,8 +34,8 @@ apt-get purge -qq -y roundcube* #NODOC
 # Install Roundcube from source if it is not already present or if it is out of date.
 # Combine the Roundcube version number with the commit hash of vacation_sieve to track
 # whether we have the latest version.
-VERSION=1.2.0
-HASH=2088985fb613b4e4e3373933ca44b26fce0489fb
+VERSION=1.2.1
+HASH=81fbfba4683522f6e54006d0300a48e6da3f3bbd
 VACATION_SIEVE_VERSION=91ea6f52216390073d1f5b70b5f6bea0bfaee7e5
 PERSISTENT_LOGIN_VERSION=1e9d724476a370ce917a2fcd5b3217b0c306c24e
 HTML5_NOTIFIER_VERSION=4b370e3cd60dabd2f428a26f45b677ad1b7118d5