From c50170b816c9300458793ecdb847ab41a9b8b65b Mon Sep 17 00:00:00 2001
From: Richard Willis <willis.rh@gmail.com>
Date: Wed, 29 Jul 2020 15:01:20 +0100
Subject: [PATCH 1/6] Update "Remove Alias" modal title (#1800)
---
management/templates/aliases.html | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/management/templates/aliases.html b/management/templates/aliases.html
index e8d0cb1c..848fcf49 100644
--- a/management/templates/aliases.html
+++ b/management/templates/aliases.html
@@ -288,7 +288,7 @@ function aliases_remove(elem) {
},
function(r) {
// Responses are multiple lines of pre-formatted text.
- show_modal_error("Remove User", $("<pre/>").text(r));
+ show_modal_error("Remove Alias", $("<pre/>").text(r));
show_aliases();
});
});
From 1098e2b48e3cf542f114caed591337d3cddae762 Mon Sep 17 00:00:00 2001
From: Hilko <hija@users.noreply.github.com>
Date: Wed, 29 Jul 2020 16:03:33 +0200
Subject: [PATCH 2/6] Add noindex to www_default meta tags (#1791)
---
conf/www_default.html | 1 +
1 file changed, 1 insertion(+)
diff --git a/conf/www_default.html b/conf/www_default.html
index edefc428..68d0366b 100644
--- a/conf/www_default.html
+++ b/conf/www_default.html
@@ -1,6 +1,7 @@
<html>
<head>
<title>this is a mail-in-a-box</title>
+ <meta name="robots" content="noindex">
</head>
<body>
<h1>this is a mail-in-a-box</h1>
From 2c34a6df2bf0a319502c251eb0f310002f996ca3 Mon Sep 17 00:00:00 2001
From: Hilko <hija@users.noreply.github.com>
Date: Sun, 26 Jul 2020 17:50:59 +0200
Subject: [PATCH 3/6] Update roundcube to 1.4.7
---
setup/webmail.sh | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/setup/webmail.sh b/setup/webmail.sh
index 7054e38e..f2202244 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -28,8 +28,8 @@ apt_install \
# Install Roundcube from source if it is not already present or if it is out of date.
# Combine the Roundcube version number with the commit hash of plugins to track
# whether we have the latest version of everything.
-VERSION=1.4.6
-HASH=44961ef62bb9c9875141ca34704bbc7d6f36373d
+VERSION=1.4.7
+HASH=49F194D25AC7B9BF175BD52285BB61CDE7BAED44
PERSISTENT_LOGIN_VERSION=6b3fc450cae23ccb2f393d0ef67aa319e877e435
HTML5_NOTIFIER_VERSION=4b370e3cd60dabd2f428a26f45b677ad1b7118d5
CARDDAV_VERSION=3.0.3
From 4bbe4af37741b9dba3c766657ca36e198532b506 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Wed, 29 Jul 2020 10:11:47 -0400
Subject: [PATCH 4/6] Update CHANGELOG
---
CHANGELOG.md | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 36656e53..be38130e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,12 +6,29 @@ In Development
Mail:
-* An MTA-STS policy for incoming mail is now published (in DNS and over HTTPS) when the primary hostname and email address domain both have a signed TLS certificate installed.
+* An MTA-STS policy for incoming mail is now published (in DNS and over HTTPS) when the primary hostname and email address domain both have a signed TLS certificate installed, allowing senders to know that an encrypted connection should be enforced.
* MTA-STS reporting is enabled with reports sent to administrator@ the primary hostname.
+* The per-IP connection limit to the IMAP server has been doubled to allow more devices to connect at once, especially with multiple users behind a NAT.
DNS:
* autoconfig and autodiscover subdomains and CalDAV/CardDAV SRV records are no longer generated for domains that don't have user accounts since they are unnecessary.
+* IPv6 addresses can now be specified for secondary DNS nameservers in the control panel.
+
+TLS:
+
+* TLS certificates are now provisioned in groups by parent domain to limit easy domain enumeration and make provisioning more resilient to errors for particular domains.
+
+Control Panel:
+
+* User passwords can now have spaces.
+* Status checks for automatic subdomains have been moved into the section for the parent domain.
+* Typo fixed.
+
+Web:
+
+* The default web page served on fresh installations now adds the `noindex` meta tag.
+* The HSTS header is revised to also be sent on non-success responses.
v0.46 (June 11, 2020)
---------------------
From f253c400120da768fd6268f3df5220b45d4dc24d Mon Sep 17 00:00:00 2001
From: Marcus Bointon <marcus@synchromedia.co.uk>
Date: Sun, 7 Jun 2020 15:47:51 +0200
Subject: [PATCH 5/6] [backport] Add rate limiting of SSH in the firewall
(#1770)
See #1767. Backport of cfc8fb484cfdb3ee581630a869fd93d4e1b3cb03.
---
setup/functions.sh | 9 ++++++++-
setup/system.sh | 4 ++--
tools/readable_bash.py | 8 ++++++--
3 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/setup/functions.sh b/setup/functions.sh
index b36d14bc..90c4c55d 100644
--- a/setup/functions.sh
+++ b/setup/functions.sh
@@ -136,7 +136,14 @@ function get_default_privateip {
function ufw_allow {
if [ -z "${DISABLE_FIREWALL:-}" ]; then
# ufw has completely unhelpful output
- ufw allow $1 > /dev/null;
+ ufw allow "$1" > /dev/null;
+ fi
+}
+
+function ufw_limit {
+ if [ -z "${DISABLE_FIREWALL:-}" ]; then
+ # ufw has completely unhelpful output
+ ufw limit "$1" > /dev/null;
fi
}
diff --git a/setup/system.sh b/setup/system.sh
index 28043b16..4d33deb6 100755
--- a/setup/system.sh
+++ b/setup/system.sh
@@ -256,7 +256,7 @@ if [ -z "${DISABLE_FIREWALL:-}" ]; then
apt_install ufw
# Allow incoming connections to SSH.
- ufw_allow ssh;
+ ufw_limit ssh;
# ssh might be running on an alternate port. Use sshd -T to dump sshd's #NODOC
# settings, find the port it is supposedly running on, and open that port #NODOC
@@ -266,7 +266,7 @@ if [ -z "${DISABLE_FIREWALL:-}" ]; then
if [ "$SSH_PORT" != "22" ]; then
echo Opening alternate SSH port $SSH_PORT. #NODOC
- ufw_allow $SSH_PORT #NODOC
+ ufw_limit $SSH_PORT #NODOC
fi
fi
diff --git a/tools/readable_bash.py b/tools/readable_bash.py
index 5207a78a..1fcdd5cd 100644
--- a/tools/readable_bash.py
+++ b/tools/readable_bash.py
@@ -58,7 +58,7 @@ def generate_documentation():
}
.prose {
- padding-top: 1em;
+ padding-top: 1em;
padding-bottom: 1em;
}
.terminal {
@@ -261,6 +261,10 @@ class UfwAllow(Grammar):
grammar = (ZERO_OR_MORE(SPACE), L("ufw_allow "), REST_OF_LINE, EOL)
def value(self):
return shell_line("ufw allow " + self[2].string)
+class UfwLimit(Grammar):
+ grammar = (ZERO_OR_MORE(SPACE), L("ufw_limit "), REST_OF_LINE, EOL)
+ def value(self):
+ return shell_line("ufw limit " + self[2].string)
class RestartService(Grammar):
grammar = (ZERO_OR_MORE(SPACE), L("restart_service "), REST_OF_LINE, EOL)
def value(self):
@@ -275,7 +279,7 @@ class OtherLine(Grammar):
return "<pre class='shell'><div>" + recode_bash(self.string.strip()) + "</div></pre>\n"
class BashElement(Grammar):
- grammar = Comment | CatEOF | EchoPipe | EchoLine | HideOutput | EditConf | SedReplace | AptGet | UfwAllow | RestartService | OtherLine
+ grammar = Comment | CatEOF | EchoPipe | EchoLine | HideOutput | EditConf | SedReplace | AptGet | UfwAllow | UfwLimit | RestartService | OtherLine
def value(self):
return self[0].value()
From 56d0289ed98e781ff759e62c40ff71327103fd48 Mon Sep 17 00:00:00 2001
From: hija <hilko.j@wwu.de>
Date: Sun, 26 Jul 2020 18:57:04 +0200
Subject: [PATCH 6/6] v0.47
---
CHANGELOG.md | 8 ++++++++
README.md | 4 ++--
setup/bootstrap.sh | 2 +-
3 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 23ddd136..e9b8b759 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,14 @@
CHANGELOG
=========
+v0.47 (July 29, 2020)
+---------------------
+
+Security fixes:
+
+* Roundcube is updated to version 1.4.7 fixing a cross-site scripting (XSS) vulnerability with HTML messages with malicious svg/namespace (CVE-2020-15562) (https://roundcube.net/news/2020/07/05/security-updates-1.4.7-1.3.14-and-1.2.11).
+* SSH connections are now rate-limited at the firewall level (in addition to fail2ban).
+
v0.46 (June 11, 2020)
---------------------
diff --git a/README.md b/README.md
index 1d4452b8..5ef58a29 100644
--- a/README.md
+++ b/README.md
@@ -58,7 +58,7 @@ by him:
$ curl -s https://keybase.io/joshdata/key.asc | gpg --import
gpg: key C10BDD81: public key "Joshua Tauberer <jt@occams.info>" imported
- $ git verify-tag v0.46
+ $ git verify-tag v0.47
gpg: Signature made ..... using RSA key ID C10BDD81
gpg: Good signature from "Joshua Tauberer <jt@occams.info>"
gpg: WARNING: This key is not certified with a trusted signature!
@@ -71,7 +71,7 @@ and on his [personal homepage](https://razor.occams.info/). (Of course, if this
Checkout the tag corresponding to the most recent release:
- $ git checkout v0.46
+ $ git checkout v0.47
Begin the installation.
diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh
index 6aae9500..098de977 100644
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -20,7 +20,7 @@ if [ -z "$TAG" ]; then
# want to display in status checks.
if [ "`lsb_release -d | sed 's/.*:\s*//' | sed 's/18\.04\.[0-9]/18.04/' `" == "Ubuntu 18.04 LTS" ]; then
# This machine is running Ubuntu 18.04.
- TAG=v0.46
+ TAG=v0.47
elif [ "`lsb_release -d | sed 's/.*:\s*//' | sed 's/14\.04\.[0-9]/14.04/' `" == "Ubuntu 14.04 LTS" ]; then
# This machine is running Ubuntu 14.04.