From 81b0e0a64f3ed295205dbc5461bb8f4fc2791e3d Mon Sep 17 00:00:00 2001 From: Nicholas Wilson Date: Sun, 22 Dec 2024 06:26:59 -0600 Subject: [PATCH 01/13] Updated CHANGELOG.md, fix typo(s) (#2459) --- CHANGELOG.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 718e6682..55cd75b8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -73,7 +73,7 @@ Version 64 (September 2, 2023) * Fixed backups to work with the latest duplicity package which was not backwards compatible. * Fixed setting B2 as a backup target with a slash in the application key. * Turned off OpenDMARC diagnostic reports sent in response to incoming mail. -* Fixed some crashes when using an unrelased version of Mail-in-a-Box. +* Fixed some crashes when using an unreleased version of Mail-in-a-Box. * Added z-push administration scripts. Version 63 (July 27, 2023) @@ -1129,7 +1129,7 @@ Control panel: System: * The munin system monitoring tool is now installed and accessible at /admin/munin. -* ownCloud updated to version 8.0.4. The ownCloud installation step now is reslient to download problems. The ownCloud configuration file is now stored in STORAGE_ROOT to fix loss of data when moving STORAGE_ROOT to a new machine. +* ownCloud updated to version 8.0.4. The ownCloud installation step now is resilient to download problems. The ownCloud configuration file is now stored in STORAGE_ROOT to fix loss of data when moving STORAGE_ROOT to a new machine. * The setup scripts now run `apt-get update` prior to installing anything to ensure the apt database is in sync with the packages actually available. @@ -1167,7 +1167,7 @@ DNS: * Internationalized Domain Names (IDNs) should now work in email. If you had custom DNS or custom web settings for internationalized domains, check that they are still working. * It is now possible to set multiple TXT and other types of records on the same domain in the control panel. * The custom DNS API was completely rewritten to support setting multiple records of the same type on a domain. Any existing client code using the DNS API will have to be rewritten. (Existing code will just get 404s back.) -* On some systems the `nsd` service failed to start if network inferfaces were not ready. +* On some systems the `nsd` service failed to start if network interfaces were not ready. System / Control Panel: From d8563be38b2fa047725ee85c7330bdf775101cdd Mon Sep 17 00:00:00 2001 From: Paul Date: Sun, 22 Dec 2024 04:27:36 -0800 Subject: [PATCH 02/13] Disable MOTD advertisements (#2457) Disables MOTD advertisements which use a script to send server information in `wget` headers to Canonical. --- setup/system.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/setup/system.sh b/setup/system.sh index 7467a72c..dd366401 100755 --- a/setup/system.sh +++ b/setup/system.sh @@ -83,6 +83,13 @@ fi # (See https://discourse.mailinabox.email/t/journalctl-reclaim-space-on-small-mailinabox/6728/11.) tools/editconf.py /etc/systemd/journald.conf MaxRetentionSec=10day +# ### Improve server privacy + +# Disable MOTD adverts to prevent revealing server information in MOTD request headers +# See https://ma.ttias.be/what-exactly-being-sent-ubuntu-motd/ +tools/editconf.py /etc/default/motd-news ENABLED=0 +rm -f /var/cache/motd-news + # ### Add PPAs. # We install some non-standard Ubuntu packages maintained by other From ee0d750b8560b0e2e9a9bf0afe52ed12982cb7f2 Mon Sep 17 00:00:00 2001 From: Harm Berntsen Date: Sun, 22 Dec 2024 13:28:04 +0100 Subject: [PATCH 03/13] Add missing php-xml package for Roundcube without Nextcloud (#2441) When the Nextcloud installation is skipped, php8.0-xml will also not be installed. This causes issues for Roundcube because it won't load: `PHP Fatal error: Uncaught Error: Class "DOMDocument" not found in /usr/local/lib/roundcubemail/program/lib/Roundcube/html.php:367`. Installing the package on the Roundcube side as well fixes it for me. --- setup/webmail.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup/webmail.sh b/setup/webmail.sh index 4591119c..db95028b 100644 --- a/setup/webmail.sh +++ b/setup/webmail.sh @@ -23,7 +23,7 @@ echo "Installing Roundcube (webmail)..." apt_install \ dbconfig-common \ php"${PHP_VER}"-cli php"${PHP_VER}"-sqlite3 php"${PHP_VER}"-intl php"${PHP_VER}"-common php"${PHP_VER}"-curl php"${PHP_VER}"-imap \ - php"${PHP_VER}"-gd php"${PHP_VER}"-pspell php"${PHP_VER}"-mbstring libjs-jquery libjs-jquery-mousewheel libmagic1 \ + php"${PHP_VER}"-gd php"${PHP_VER}"-pspell php"${PHP_VER}"-mbstring php"${PHP_VER}"-xml libjs-jquery libjs-jquery-mousewheel libmagic1 \ sqlite3 # Install Roundcube from source if it is not already present or if it is out of date. From 3d59f2d7e0d0c2794f88fc36d5fca11fc757f9a7 Mon Sep 17 00:00:00 2001 From: KiekerJan Date: Sun, 22 Dec 2024 13:28:39 +0100 Subject: [PATCH 04/13] Update roundcube to 1.6.9 (#2440) --- setup/webmail.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/setup/webmail.sh b/setup/webmail.sh index db95028b..a203cb8c 100644 --- a/setup/webmail.sh +++ b/setup/webmail.sh @@ -36,8 +36,8 @@ apt_install \ # https://github.com/mstilkerich/rcmcarddav/releases # The easiest way to get the package hashes is to run this script and get the hash from # the error message. -VERSION=1.6.8 -HASH=00586f5163b3f6c1b0798be745982e3547b1b24a +VERSION=1.6.9 +HASH=b63f74209cf287402f6f44b85877388899261f3c PERSISTENT_LOGIN_VERSION=bde7b6840c7d91de627ea14e81cf4133cbb3c07a # version 5.3 HTML5_NOTIFIER_VERSION=68d9ca194212e15b3c7225eb6085dbcf02fd13d7 # version 0.6.4+ CARDDAV_VERSION=4.4.3 From e36c17fc72249fef1eb6b638c4fa3ad2ad765d32 Mon Sep 17 00:00:00 2001 From: matidau <65836048+matidau@users.noreply.github.com> Date: Sun, 22 Dec 2024 23:42:56 +1100 Subject: [PATCH 05/13] Fixstates only after Z-Push upgrade (#2432) --- setup/zpush.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/setup/zpush.sh b/setup/zpush.sh index 5e0ea2c4..397ee4a9 100755 --- a/setup/zpush.sh +++ b/setup/zpush.sh @@ -110,4 +110,6 @@ restart_service php"$PHP_VER"-fpm # Fix states after upgrade -hide_output php"$PHP_VER" /usr/local/lib/z-push/z-push-admin.php -a fixstates +if [ $needs_update == 1 ]; then + hide_output php"$PHP_VER" /usr/local/lib/z-push/z-push-admin.php -a fixstates +fi From 9f87b36ba182e5ec6e519a4a6c27e9ead8c08469 Mon Sep 17 00:00:00 2001 From: KiekerJan Date: Sun, 22 Dec 2024 13:45:45 +0100 Subject: [PATCH 06/13] add check on SOA record to determine up to date synchronization of secondary nameserver (#2429) --- management/status_checks.py | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/management/status_checks.py b/management/status_checks.py index 51f8e631..96d10c95 100755 --- a/management/status_checks.py +++ b/management/status_checks.py @@ -521,6 +521,8 @@ def check_dns_zone(domain, env, output, dns_zonefiles): # Check that each custom secondary nameserver resolves the IP address. if custom_secondary_ns and not probably_external_dns: + SOARecord = query_dns(domain, "SOA", at=env['PUBLIC_IP'])# Explicitly ask the local dns server. + for ns in custom_secondary_ns: # We must first resolve the nameserver to an IP address so we can query it. ns_ips = query_dns(ns, "A") @@ -530,15 +532,36 @@ def check_dns_zone(domain, env, output, dns_zonefiles): # Choose the first IP if nameserver returns multiple ns_ip = ns_ips.split('; ')[0] + checkSOA = True + # Now query it to see what it says about this domain. ip = query_dns(domain, "A", at=ns_ip, nxdomain=None) if ip == correct_ip: - output.print_ok("Secondary nameserver %s resolved the domain correctly." % ns) + output.print_ok(f"Secondary nameserver {ns} resolved the domain correctly.") elif ip is None: - output.print_error("Secondary nameserver %s is not configured to resolve this domain." % ns) + output.print_error(f"Secondary nameserver {ns} is not configured to resolve this domain.") + # No need to check SOA record if not configured as nameserver + checkSOA = False + elif ip == '[timeout]': + output.print_error(f"Secondary nameserver {ns} did not resolve this domain, result: {ip}") + checkSOA = False else: output.print_error(f"Secondary nameserver {ns} is not configured correctly. (It resolved this domain as {ip}. It should be {correct_ip}.)") + if checkSOA: + # Check that secondary DNS server is synchronized with our primary DNS server. Simplified by checking the SOA record which has a version number + SOASecondary = query_dns(domain, "SOA", at=ns_ip) + + if SOARecord == SOASecondary: + output.print_ok(f"Secondary nameserver {ns} has consistent SOA record.") + elif SOARecord == '[Not Set]': + output.print_error(f"Secondary nameserver {ns} has no SOA record configured.") + elif SOARecord == '[timeout]': + output.print_error(f"Secondary nameserver {ns} timed out on checking SOA record.") + else: + output.print_error(f"""Secondary nameserver {ns} has inconsistent SOA record (primary: {SOARecord} versus secondary: {SOASecondary}). + Check that synchronization between secondary and primary DNS servers is properly set-up.""") + def check_dns_zone_suggestions(domain, env, output, dns_zonefiles, domains_with_a_records): # Warn if a custom DNS record is preventing this or the automatic www redirect from # being served. From 564ed59bb47da24c9ebc50ae9137e6dcbcae9826 Mon Sep 17 00:00:00 2001 From: KiekerJan Date: Sun, 22 Dec 2024 13:48:36 +0100 Subject: [PATCH 07/13] Add check on ipv6 for spamhaus (#2428) --- management/status_checks.py | 41 +++++++++++++++++++++++++++---------- 1 file changed, 30 insertions(+), 11 deletions(-) diff --git a/management/status_checks.py b/management/status_checks.py index 96d10c95..67aaaeb4 100755 --- a/management/status_checks.py +++ b/management/status_checks.py @@ -282,26 +282,45 @@ def run_network_checks(env, output): # The user might have ended up on an IP address that was previously in use # by a spammer, or the user may be deploying on a residential network. We # will not be able to reliably send mail in these cases. - + rev_ip4 = ".".join(reversed(env['PUBLIC_IP'].split('.'))) + zen = query_dns(rev_ip4+'.zen.spamhaus.org', 'A', nxdomain=None, retry = False) + evaluate_spamhaus_lookup(env['PUBLIC_IP'], 'IPv4', rev_ip4, output, zen) + + if not env['PUBLIC_IPV6']: + return + + from ipaddress import IPv6Address + + rev_ip6 = ".".join(reversed(IPv6Address(env['PUBLIC_IPV6']).exploded.split(':'))) + zen = query_dns(rev_ip6+'.zen.spamhaus.org', 'A', nxdomain=None, retry = False) + evaluate_spamhaus_lookup(env['PUBLIC_IPV6'], 'IPv6', rev_ip6, output, zen) + + +def evaluate_spamhaus_lookup(lookupaddress, lookuptype, lookupdomain, output, zen): # See https://www.spamhaus.org/news/article/807/using-our-public-mirrors-check-your-return-codes-now. for # information on spamhaus return codes - rev_ip4 = ".".join(reversed(env['PUBLIC_IP'].split('.'))) - zen = query_dns(rev_ip4+'.zen.spamhaus.org', 'A', nxdomain=None) if zen is None: - output.print_ok("IP address is not blacklisted by zen.spamhaus.org.") + output.print_ok(f"{lookuptype} address is not blacklisted by zen.spamhaus.org.") elif zen == "[timeout]": - output.print_warning("Connection to zen.spamhaus.org timed out. Could not determine whether this box's IP address is blacklisted. Please try again later.") + output.print_warning(f"""Connection to zen.spamhaus.org timed out. Could not determine whether this box's + {lookuptype} address is blacklisted. Please try again later.""") elif zen == "[Not Set]": - output.print_warning("Could not connect to zen.spamhaus.org. Could not determine whether this box's IP address is blacklisted. Please try again later.") + output.print_warning(f"""Could not connect to zen.spamhaus.org. Could not determine whether this box's + {lookuptype} address is blacklisted. Please try again later.""") elif zen == "127.255.255.252": - output.print_warning("Incorrect spamhaus query: %s. Could not determine whether this box's IP address is blacklisted." % (rev_ip4+'.zen.spamhaus.org')) + output.print_warning(f"""Incorrect spamhaus query: {lookupdomain + '.zen.spamhaus.org'}. Could not determine whether + this box's {lookuptype} address is blacklisted.""") elif zen == "127.255.255.254": - output.print_warning("Mail-in-a-Box is configured to use a public DNS server. This is not supported by spamhaus. Could not determine whether this box's IP address is blacklisted.") + output.print_warning(f"""Mail-in-a-Box is configured to use a public DNS server. This is not supported by + spamhaus. Could not determine whether this box's {lookuptype} address is blacklisted.""") elif zen == "127.255.255.255": - output.print_warning("Too many queries have been performed on the spamhaus server. Could not determine whether this box's IP address is blacklisted.") + output.print_warning(f"""Too many queries have been performed on the spamhaus server. Could not determine + whether this box's {lookuptype} address is blacklisted.""") else: - output.print_error("""The IP address of this machine {} is listed in the Spamhaus Block List (code {}), - which may prevent recipients from receiving your email. See http://www.spamhaus.org/query/ip/{}.""".format(env['PUBLIC_IP'], zen, env['PUBLIC_IP'])) + output.print_error(f"""The {lookuptype} address of this machine {lookupaddress} is listed in the Spamhaus Block + List (code {zen}), which may prevent recipients from receiving your email. See + http://www.spamhaus.org/query/ip/{lookupaddress}.""") + def run_domain_checks(rounded_time, env, output, pool, domains_to_check=None): # Get the list of domains we handle mail for. From 4f094f7859cab6ee72792b96313c1c7d4407685d Mon Sep 17 00:00:00 2001 From: zoof Date: Sun, 22 Dec 2024 07:57:59 -0500 Subject: [PATCH 08/13] Change hour of daily tasks to run at 1am and only run full backups on weekends (#2424) * Change hour of daily tasks to run at 1am * Change to only do full backup on weekends --- management/backup.py | 17 +++++++++++------ setup/management.sh | 2 +- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/management/backup.py b/management/backup.py index aae6c00b..238cb2ed 100755 --- a/management/backup.py +++ b/management/backup.py @@ -9,6 +9,7 @@ import os, os.path, re, datetime, sys import dateutil.parser, dateutil.relativedelta, dateutil.tz +from datetime import date import rtyaml from exclusiveprocess import Lock @@ -157,6 +158,8 @@ def should_force_full(config, env): # since the last full backup is greater than half the size # of that full backup. inc_size = 0 + # Check if day of week is a weekend day + weekend = date.today().weekday()>=5 for bak in backup_status(env)["backups"]: if not bak["full"]: # Scan through the incremental backups cumulating @@ -165,12 +168,14 @@ def should_force_full(config, env): else: # ...until we reach the most recent full backup. # Return if we should to a full backup, which is based - # on the size of the increments relative to the full - # backup, as well as the age of the full backup. - if inc_size > .5*bak["size"]: - return True - if dateutil.parser.parse(bak["date"]) + datetime.timedelta(days=config["min_age_in_days"]*10+1) < datetime.datetime.now(dateutil.tz.tzlocal()): - return True + # on whether it is a weekend day, the size of the + # increments relative to the full backup, as well as + # the age of the full backup. + if weekend: + if inc_size > .5*bak["size"]: + return True + if dateutil.parser.parse(bak["date"]) + datetime.timedelta(days=config["min_age_in_days"]*10+1) < datetime.datetime.now(dateutil.tz.tzlocal()): + return True return False else: # If we got here there are no (full) backups, so make one. diff --git a/setup/management.sh b/setup/management.sh index fb359cd3..d8032312 100755 --- a/setup/management.sh +++ b/setup/management.sh @@ -116,7 +116,7 @@ minute=$((RANDOM % 60)) # avoid overloading mailinabox.email cat > /etc/cron.d/mailinabox-nightly << EOF; # Mail-in-a-Box --- Do not edit / will be overwritten on update. # Run nightly tasks: backup, status checks. -$minute 3 * * * root (cd $PWD && management/daily_tasks.sh) +$minute 1 * * * root (cd $PWD && management/daily_tasks.sh) EOF # Start the management server. From 0d7388899c02a3785714bfe75d711f5929b3ded2 Mon Sep 17 00:00:00 2001 From: Tomasz Stanczak Date: Sun, 22 Dec 2024 13:59:58 +0100 Subject: [PATCH 09/13] Allow DSA end EllipticCurve private keys to be used additionally to RSA for HTTPS certificates (#2416) Co-authored-by: Tomasz Stanczak --- management/ssl_certificates.py | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/management/ssl_certificates.py b/management/ssl_certificates.py index c9f1126c..8c1b841e 100755 --- a/management/ssl_certificates.py +++ b/management/ssl_certificates.py @@ -14,7 +14,7 @@ def get_ssl_certificates(env): # that the certificates are good for to the best certificate for # the domain. - from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey + from cryptography.hazmat.primitives.asymmetric import dsa, rsa, ec from cryptography.x509 import Certificate # The certificates are all stored here: @@ -59,13 +59,15 @@ def get_ssl_certificates(env): # Not a valid PEM format for a PEM type we care about. continue - # Is it a private key? - if isinstance(pem, RSAPrivateKey): - private_keys[pem.public_key().public_numbers()] = { "filename": fn, "key": pem } - # Is it a certificate? if isinstance(pem, Certificate): certificates.append({ "filename": fn, "cert": pem }) + # It is a private key + elif (isinstance(pem, rsa.RSAPrivateKey) + or isinstance(pem, dsa.DSAPrivateKey) + or isinstance(pem, ec.EllipticCurvePrivateKey)): + private_keys[pem.public_key().public_numbers()] = { "filename": fn, "key": pem } + # Process the certificates. domains = { } @@ -505,7 +507,7 @@ def check_certificate(domain, ssl_certificate, ssl_private_key, warn_if_expiring # Check that the ssl_certificate & ssl_private_key files are good # for the provided domain. - from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey + from cryptography.hazmat.primitives.asymmetric import rsa, dsa, ec from cryptography.x509 import Certificate # The ssl_certificate file may contain a chain of certificates. We'll @@ -539,7 +541,9 @@ def check_certificate(domain, ssl_certificate, ssl_private_key, warn_if_expiring except ValueError as e: return (f"The private key file {ssl_private_key} is not a private key file: {e!s}", None) - if not isinstance(priv_key, RSAPrivateKey): + if (not isinstance(priv_key, rsa.RSAPrivateKey) + and not isinstance(priv_key, dsa.DSAPrivateKey) + and not isinstance(priv_key, ec.EllipticCurvePrivateKey)): return ("The private key file %s is not a private key file." % ssl_private_key, None) if priv_key.public_key().public_numbers() != cert.public_key().public_numbers(): @@ -639,7 +643,7 @@ def load_pem(pem): msg = "File is not a valid PEM-formatted file." raise ValueError(msg) pem_type = pem_type.group(1) - if pem_type in {b"RSA PRIVATE KEY", b"PRIVATE KEY"}: + if pem_type.endswith(b"PRIVATE KEY"): return serialization.load_pem_private_key(pem, password=None, backend=default_backend()) if pem_type == b"CERTIFICATE": return load_pem_x509_certificate(pem, default_backend()) From 2e0482e1817fd1a167b247a9137b86ee190d2947 Mon Sep 17 00:00:00 2001 From: KiekerJan Date: Sun, 22 Dec 2024 14:01:02 +0100 Subject: [PATCH 10/13] Exclude the owncloud-backup folder from the nightly backup (#2413) --- management/backup.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/management/backup.py b/management/backup.py index 238cb2ed..ac16eade 100755 --- a/management/backup.py +++ b/management/backup.py @@ -325,6 +325,7 @@ def perform_backup(full_backup): "--verbosity", "warning", "--no-print-statistics", "--archive-dir", backup_cache_dir, "--exclude", backup_root, + "--exclude", os.path.join(env["STORAGE_ROOT"], "owncloud-backup"), "--volsize", "250", "--gpg-options", "'--cipher-algo=AES256'", "--allow-source-mismatch", @@ -404,6 +405,7 @@ def run_duplicity_verification(): "--compare-data", "--archive-dir", backup_cache_dir, "--exclude", backup_root, + "--exclude", os.path.join(env["STORAGE_ROOT"], "owncloud-backup"), *get_duplicity_additional_args(env), get_duplicity_target_url(config), env["STORAGE_ROOT"], From e0b93718a33338115e953564170d87af6a55e1f9 Mon Sep 17 00:00:00 2001 From: yeah Date: Sun, 22 Dec 2024 14:02:49 +0100 Subject: [PATCH 11/13] =?UTF-8?q?Revert=20"increase=20timeout=20for=20the?= =?UTF-8?q?=20nginx=20proxy=20that=20provides=20access=20to=20the=20Mail?= =?UTF-8?q?=E2=80=A6"=20(#2411)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reverts #2407 - as per #2316 This reverts commit 2803d8889454fa3a8295c0cfd382cdbe996284d9. --- conf/nginx-primaryonly.conf | 1 - 1 file changed, 1 deletion(-) diff --git a/conf/nginx-primaryonly.conf b/conf/nginx-primaryonly.conf index b361a7b2..36f62aab 100644 --- a/conf/nginx-primaryonly.conf +++ b/conf/nginx-primaryonly.conf @@ -8,7 +8,6 @@ rewrite ^/admin/munin$ /admin/munin/ redirect; location /admin/ { proxy_pass http://127.0.0.1:10222/; - proxy_read_timeout 600s; proxy_set_header X-Forwarded-For $remote_addr; add_header X-Frame-Options "DENY"; add_header X-Content-Type-Options nosniff; From 18721e42d19e87df5b7ba0182525739928dd39fa Mon Sep 17 00:00:00 2001 From: yeah Date: Sun, 22 Dec 2024 14:07:04 +0100 Subject: [PATCH 12/13] Cronjob for cleaning up expired SSL certificates in order to improve page load times with many domains (#2410) Fixes #2316. --- setup/ssl.sh | 9 +++++++++ tools/ssl_cleanup | 17 +++++++++++++++++ 2 files changed, 26 insertions(+) create mode 100755 tools/ssl_cleanup diff --git a/setup/ssl.sh b/setup/ssl.sh index 19a0c048..0aa9b136 100755 --- a/setup/ssl.sh +++ b/setup/ssl.sh @@ -96,3 +96,12 @@ fi if [ ! -f "$STORAGE_ROOT/ssl/dh2048.pem" ]; then openssl dhparam -out "$STORAGE_ROOT/ssl/dh2048.pem" 2048 fi + +# Cleanup expired SSL certificates from $STORAGE_ROOT/ssl daily +cat > /etc/cron.daily/mailinabox-ssl-cleanup << EOF; +#!/bin/bash +# Mail-in-a-Box +# Cleanup expired SSL certificates +$(pwd)/tools/ssl_cleanup +EOF +chmod +x /etc/cron.daily/mailinabox-ssl-cleanup diff --git a/tools/ssl_cleanup b/tools/ssl_cleanup new file mode 100755 index 00000000..5adfa1be --- /dev/null +++ b/tools/ssl_cleanup @@ -0,0 +1,17 @@ +#!/bin/bash +# Cleanup SSL certificates which expired more than 7 days ago from $STORAGE_ROOT/ssl and move them to $STORAGE_ROOT/ssl.expired + +source /etc/mailinabox.conf +shopt -s extglob + +retain_after="$(date --date="7 days ago" +%Y%m%d)" + +mkdir -p $STORAGE_ROOT/ssl.expired +for file in $STORAGE_ROOT/ssl/*-+([0-9])-+([0-9a-f]).pem; do + pem="$(basename "$file")" + not_valid_after="$(cut -d- -f1 <<< "${pem: -21}")" + + if [ "$not_valid_after" -lt "$retain_after" ]; then + mv "$file" "$STORAGE_ROOT/ssl.expired/${pem}" + fi +done From 4c2e4bab29a1030d87f5213b12dcfb38bcec2e83 Mon Sep 17 00:00:00 2001 From: downtownallday Date: Sun, 22 Dec 2024 10:26:09 -0500 Subject: [PATCH 13/13] fix error when glob matches nothing (variable 'file' will have the glob as a value in the for loop and produce the error "mv: cannot stat '/home/user-data/ssl/*-+([0-9])-+([0-9a-f]).pem': No such file or directory") --- tools/ssl_cleanup | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/ssl_cleanup b/tools/ssl_cleanup index 5adfa1be..eb3eba7b 100755 --- a/tools/ssl_cleanup +++ b/tools/ssl_cleanup @@ -7,7 +7,8 @@ shopt -s extglob retain_after="$(date --date="7 days ago" +%Y%m%d)" mkdir -p $STORAGE_ROOT/ssl.expired -for file in $STORAGE_ROOT/ssl/*-+([0-9])-+([0-9a-f]).pem; do +ls $STORAGE_ROOT/ssl/*-+([0-9])-+([0-9a-f]).pem 2>/dev/null | while read file +do pem="$(basename "$file")" not_valid_after="$(cut -d- -f1 <<< "${pem: -21}")"