Joshua Tauberer
28eaf7cba9
Merge branch 'fixes' of github.com:jkaberg/mailinabox into jkaberg-fixes
2014-08-19 11:22:12 +00:00
Joshua Tauberer
46f3d05034
add the network checks to whats_next
...
* zen.spamhaus.org
* dbl.spamhaus.org
* checks if a connection to Google's MTA on port 25 works
2014-08-19 11:16:49 +00:00
Joshua Tauberer
91821adfd7
nameserver checks should be case insensitive
2014-08-18 22:41:27 +00:00
Joshua Tauberer
92acef9b87
fix PHP path for Z-Push so it can see libawl-php
...
broken in 04454b35c6fixes #143
2014-08-17 22:53:46 +00:00
Joshua Tauberer
b30d7ad80a
web-based administrative UI
...
closes #19
2014-08-17 22:46:06 +00:00
Joshua Tauberer
ba8e015795
dns_update: dont restart the opendkim process if nothing changed
2014-08-17 20:42:17 +00:00
Joshua Tauberer
919a5a8f0b
whats_next: when there are multiple responses like for NS records sort the responses so we can compare to a fixed order
2014-08-17 19:55:03 +00:00
Joshua Tauberer
f299825a95
in the nginx override YAML file, change how proxies are specified into a mapping
2014-08-17 19:40:45 +00:00
Joshua Tauberer
04454b35c6
(merge) CardDAV, CalDAV via ownCloud and move to z-push fork fork
...
Merges branch 'owncloud' of github.com:jkaberg/mailinabox
which is pull request #135 , closes #135
thanks @jkaberg, @fmbiete, @owncloud
2014-08-17 15:31:08 -04:00
Joshua Tauberer
56c7d7436e
warn that generating DNSSEC keys takes a while (still slow in some virtualized environments)
2014-08-17 11:50:05 -04:00
Joshua Tauberer
062e8b839e
failed network checks should result in start.sh exiting with a non-zero exit status
2014-08-17 11:50:05 -04:00
Joshua Tauberer
f41ec93cbe
management: dont raise an exception on a poorly formatted authentication header
2014-08-17 11:50:05 -04:00
Joshua Tauberer
7e62131fbc
a bootstrapping script to support a one-line install command
...
based on a script by @jkaberg in #141
2014-08-16 13:31:42 -04:00
Joshua Tauberer
647ab4abeb
remove old notes/dspam.sh file
2014-08-16 13:08:03 -04:00
Joshua Tauberer
73b2751dc4
credit myself since it's not apparent who runs the project once it's been forked
2014-08-16 10:20:57 -04:00
Joshua Tauberer
e1606df237
s/joshdata/mailinabox/ due to repo moving to the org account
2014-08-16 13:16:01 +00:00
Joshua Tauberer
bbd35f4906
ownCloud: do cron the same way we do the others
2014-08-16 13:00:36 +00:00
Joshua Tauberer
ae1e69a5e3
ownCloud: code a way to add admins from our users table, but dont use it
2014-08-16 12:59:29 +00:00
Joshua Tauberer
9e86c67534
make setup/owncloud.sh idempotent: don't wreck user data on second run
2014-08-16 12:38:03 +00:00
Joshua Tauberer
6e380ade17
owncloud will only let users access it from the PRIMARY_HOSTNAME (due to its trusted_domains option being set statically), so only include /cloud in the nginx configuration for PRIMARY_HOSTNAME
2014-08-16 12:33:10 +00:00
Joshua Tauberer
277f98aac8
drop the owncloud mail app for now
2014-08-16 12:19:40 +00:00
Joshua Tauberer
ce4505b72b
remove owncloud step from README, no longer needed since 398b538e2b
2014-08-16 12:14:57 +00:00
Joshua Tauberer
6fdef379ad
owncloud: fix regex in nginx config
...
/cloud/index.php/apps/files/ajax/scan.php would not be parsed right because of two .php's
2014-08-15 23:17:16 +00:00
Joshua Tauberer
8c9f278166
owncloud: support MOD_X_ACCEL_REDIRECT_ENABLED
...
This lets downloads from the file app work.
2014-08-15 23:16:54 +00:00
Joshua Tauberer
398b538e2b
owncloud: automatically set it up with an administrator account that even the box owner doesn't have access to, because we do not want to have the user hit ownCloud's setup page on first visit
2014-08-15 23:07:20 +00:00
Joshua Tauberer
ca45c88a32
owncloud: set forcessl to be true to get the corret HSTS header (would be better if we could prevent ownCloud from sending one)
2014-08-15 22:32:01 +00:00
Joshua Tauberer
5ecbaa2b41
Merge branch 'owncloud' of github.com:jkaberg/mailinabox into owncloud
2014-08-15 18:30:17 -04:00
Joshua Tauberer
a10b828d5c
when modifying php.ini, use ; as the comment char not # because php emits horrid deprecation warnings otherwise
2014-08-15 18:29:05 -04:00
Joshua Tauberer
e625a424fd
whats_next: check that the TLSA record is correct, fixes #139
2014-08-13 19:42:49 +00:00
Joshua Tauberer
d03bc0cefa
more owncloud configuration tweaks
2014-08-13 00:30:09 +00:00
Joshua Tauberer
05cc63b5d5
Merge branch 'owncloud' of github.com:jkaberg/mailinabox into owncloud
...
Conflicts:
conf/nginx.conf
setup/zpush.sh
2014-08-12 23:10:51 +00:00
Joshua Tauberer
c9bf57eacd
Merge branch 'master' into owncloud (php5-fpm)
2014-08-12 13:30:55 +00:00
Joshua Tauberer
791e68a3af
automate more of the initial configuration
2014-08-12 13:29:44 +00:00
Joshua Tauberer
4d64246b22
tweak z-push/owncloud installation scripts: hide output, check if z-push needs an update, dont use /etc/timezone because its contents would need to be escaped before being passed into sed
2014-08-12 13:29:44 +00:00
Joshua Tauberer
9d6dc78b15
keep Roundcube working too, put owncloud at /cloud rather than at /
2014-08-12 13:29:43 +00:00
Joshua Tauberer
cf4f519cc0
zpush/owncloud: inject mail using 'sendmail' not SMTP
2014-08-12 11:18:45 +00:00
Joshua Tauberer
7b81ea1834
simplify zpush configuration files, no need to preserve copyright message
2014-08-12 11:12:10 +00:00
Joshua Tauberer
0eceb2012f
use php5-fpm rather than our own custom launcher script for PHP+FastCGI
2014-08-12 11:00:54 +00:00
Joshua Tauberer
1312b0254b
backup: dont remove old increments because then we lose the backup history right before the last full backup, instead let them disappear along with full backups when a whole chain becomes very old
2014-08-11 11:45:40 +00:00
Joshua Tauberer
f66914d634
backup: automatically take a full backup when the sum of the increments get very large
2014-08-11 11:38:32 +00:00
Joshua Tauberer
b6713d9a17
tools/mail.py should return a non-zero exit status when invalid command line args are given
2014-08-11 11:17:30 +00:00
Joshua Tauberer
58e300e113
backup must be full on the first run because incremental backup will fail, fixes #134
2014-08-11 07:16:58 -04:00
Joshua Tauberer
140c508ff6
increase dovecot imap_idle_notify_interval to 4 minutes
...
Doesn't seem like 2 minutes is a problem, but 4 minutes seems better. A little less bandwidth, possibly less battery usage (though we don't have evidence that's actually true), and the interval should be shorter than any peer timeouts that might occur due to inactivity
fixes #129
2014-08-10 11:39:29 +00:00
Joshua Tauberer
e294f7c181
create the Drafts folder for users so K-9 mail doesn't poll unnecessarily, see #129
2014-08-09 16:49:57 +00:00
Joshua Tauberer
b56f82cb92
make a privileges column in the users table and mark the first user as an admin
2014-08-08 12:31:22 +00:00
Joshua Tauberer
880ec44a0c
if the machine didn't have resolvconf before (my box didn't after an upgrade from Ubuntu 13.xx), make sure it has it now and archive any old resolv.conf since it should now only list 127.0.0.1 for bind9
2014-08-07 14:00:16 +00:00
Joshua Tauberer
5db12be507
migrate the migration state from MIGRATIONID in /etc/mailinabox.conf to STORAGE_ROOT/mailinabox.version so that the data format of STORAGE_ROOT is stored in the directory itself
2014-08-03 17:44:17 -04:00
Joshua Tauberer
64cb00b9d6
add reject_unlisted_recipient before greylisting, fixes #127
2014-08-03 00:06:54 +00:00
Joshua Tauberer
b86656243f
avoid mail.log warnings about untrusted certificates on outgoing mail, fixes #124
2014-08-02 15:39:47 +00:00
Joshua Tauberer
6a512042dc
after creating the local encrypted backup, execute the after-backup script if the user has provided one to copy the files to a remote location
2014-08-02 14:16:08 +00:00
Joshua Tauberer
6d4fab1e6a
whats_next: offer DNSSEC DS parameters rather than the full record and in validation allow for other digests than the one we suggest using
...
fixes #120 (hopefully), in which Gandi generates a SHA1 digest but we were only checking against a SHA256 digest
Also see http://discourse.mailinabox.email/t/how-to-set-ds-record-for-gandi-net/24/1 in which a user asks about the DS parameters that Gandi asks for.
2014-08-01 12:15:05 +00:00
Joshua Tauberer
30178ef019
add a --force flag to dns_update
2014-08-01 12:05:34 +00:00
Joshua Tauberer
cd59025979
dont ask the user for the machine's IP address if we can be sure our guess is right (trust icanhazip to give us the right answer)
2014-07-29 20:07:26 -04:00
Joshua Tauberer
0be92d776e
put a 15-second timeout in asking icanhazip.com for our IP address, although this limit does not seem to actually work (i.e. if I set the limit to 5 seconds, curl still hangs 10+ when I turn off my network connection)
2014-07-29 20:07:26 -04:00
Joshua Tauberer
168c06939d
have nsd bind to the network interaface that is connected to the Internet, rather than all non-loopback network interfaces
...
hopefully fixes #121 ; thanks for the help @sfPlayer1
2014-07-29 20:07:26 -04:00
Joshua Tauberer
c74bef12d2
allow for network checks to be skips in setup while testing using SKIP_NETWORK_CHECKS=1
2014-07-29 20:07:26 -04:00
Joshua Tauberer
6619239280
the SSL private key would be overwritten if ssl_certificate.pem file was deleted; maybe the cause of #98
2014-07-28 15:38:23 -04:00
Joshua Tauberer
834a7b9096
run network checks during setup and stop if there is a bad condition
...
* check that the PUBLIC_IP is not listed in zen.spamhaus.org
* check that the PRIMARY_HOSTNAME is not listed in dbl.spamhaus.org
* check that a connection to Google's MTA is working (i.e. we're not on a residential network that blocks outbound port 25)
2014-07-26 11:26:59 -04:00
Joshua Tauberer
3a7221a69a
handle errors in management API calls properly
...
see #118
2014-07-25 13:53:40 +00:00
Joshua Tauberer
86ec0f6da7
the cron job to re-sign DNSSEC zones was still not working because the script needed a hash-bang line; what I did in 65c3a44e63 didn't actually fix the problem
2014-07-25 12:15:30 +00:00
Joshua Tauberer
f50cf10249
also accept Ubuntu 14.04.1 LTS, the point release that people are automatically pushed to
...
fixes #116
2014-07-22 21:36:59 +00:00
Joshua Tauberer
621fcc2233
use /dev/random for crypto-grade RNG with the help of haveged
...
Rather than pass `-r /dev/random` to ldns-keygen (it was `-r /dev/urandom`),
don't pass `-r` at all since /dev/random is the default.
Merges branch 'master' of github.com:pysiak/mailinabox
2014-07-21 07:31:14 -04:00
Joshua Tauberer
8042ab66ac
dont serve web for domains with custom DNS records that point A/AAAA elsewhere, and in whats_next only check that an A record exists on a domain if we are serving web on the domain
2014-07-20 15:23:17 +00:00
Joshua Tauberer
8354d9732a
in the custom DNS yaml config, treat 'local' as an alias for the box's own IP/IPv6 addresses
2014-07-20 14:53:55 +00:00
Joshua Tauberer
1ad9c70887
refactor custom DNS records
2014-07-20 14:48:20 +00:00
Joshua Tauberer
2e0680de4f
the check for whether a custom DNS setting is valid was in the wrong place
2014-07-20 14:41:02 +00:00
Joshua Tauberer
65c3a44e63
the cron job to re-sign DNSSEC zones wasnt working after adding the API key to the management daemon because the script relied on a bash-ism but cron runs it with (probably) sh
2014-07-19 16:31:05 +00:00
Joshua Tauberer
37fcc5b53d
Add AAAA records for ns1/ns2
...
Merges branch 'patch-1' of https://github.com/sfPlayer1/mailinabox
2014-07-18 11:12:13 +00:00
Joshua Tauberer
42c891032d
don't create a www. subdomain on any domains that are themselves subdomains within a zone, i.e. don't create www.PUBLIC_HOSTNAME if PUBLIC_HOSTNAME is a subdomain of another domain, which is what we normally recommend
2014-07-17 13:08:05 +00:00
Joshua Tauberer
d7a9e7cc17
run management/dns_update.py from the console to dump the DNS records, with explanations, in case the user wants to host DNS off of the box
2014-07-17 13:08:05 +00:00
Joshua Tauberer
7803ac9ca4
write explanatory text as we build DNS zones so we can help the user manage DNS off of the box
2014-07-17 13:08:05 +00:00
Joshua Tauberer
91cf45c843
add a comment
2014-07-16 09:39:13 -04:00
Joshua Tauberer
eac349187d
whats_next: move the admin alias check to the system section
2014-07-16 09:36:56 -04:00
Joshua Tauberer
023cd12e1a
hide lots of unnecessary and scary output during setup
2014-07-16 09:36:56 -04:00
Joshua Tauberer
465aaf2d30
check that we're running as root before doing anything
2014-07-16 09:36:31 -04:00
Joshua Tauberer
5a4f5b1874
move the welcome message to after the system checks
2014-07-16 09:36:31 -04:00
Joshua Tauberer
c716fd27bf
refuse to start if the system has less than 768 MB of RAM, except when testing within Vagrant
2014-07-16 09:36:31 -04:00
Joshua Tauberer
4e5b5f2852
Vagrant typo
2014-07-16 09:36:31 -04:00
Joshua Tauberer
89376b10d0
Merge pull request #111 from h8h/patch-1
...
Output SSL Cert Fingerprint can point to a wrong dir: Better to use $STORAGE_ROOT
2014-07-16 09:36:22 -04:00
Joshua Tauberer
9c7d476915
re-do catch-all aliases, fixes #107 (originally #104 )
...
This reverts pull request #105 from jonessen96/master (84d2023f94
2014-07-13 12:29:43 +00:00
Joshua Tauberer
84d2023f94
Merge pull request #105 from jonessen96/master
...
Fix validate_email not accepting catchalls (empty local part of the address)
2014-07-12 17:05:07 -04:00
Joshua Tauberer
fb357dee33
add z-push to the start script
2014-07-12 00:04:56 +00:00
Joshua Tauberer
2a7669a0d3
z-push: an Exchange ActiveSync server
2014-07-12 00:02:32 +00:00
Joshua Tauberer
67c7391546
Roundcube's classic skin is nicer
2014-07-11 21:52:46 +00:00
Joshua Tauberer
85bd2c8804
use the Dovecot managesieve service to manage sieve scripts
...
This lets roundcube's manageseive plugin do cool things like vacation responses.
Also:
* Run the spam filtering sieve script out of a global sieve file that we'll place in /etc/dovecot. It is no longer necessary to create per-user sieve files for this. Remove them with a new migration. Remove the code that created them.
* Corrects the spam script. Backslashes were double-escaped probably because this script started embedded within the bash script. Not sure how this was working until now.
this adapts work by @h8h in #103
2014-07-10 23:09:07 +00:00
Joshua Tauberer
e713af5f5a
refactor the mail setup scripts
...
As the scripts keep growing, it's time to split them up to
keep them understandable.
This splits mail.sh into mail-postfix.sh, mail-dovecot.sh,
and mail-users.sh, which has all of the user database-related
configurations shared by Dovecot and Postfix. Also from
spamassassin.sh the core sieve configuration is moved into
mail-dovecot.sh and the virtual transport setting is moved
into mail-postfix.sh.
Also revising one of the sed scripts in mail-dovecot to
not insert a new additional # at the start of a line each
time the script is run.
2014-07-10 12:49:28 +00:00
Joshua Tauberer
6f51b49671
remove the hard-coded migration ID from setup.sh
2014-07-10 12:49:19 +00:00
Joshua Tauberer
41b3df6d78
manage hostmaster@ and postmaster@ automatically, create administrator@ during setup instead
...
closes #94
2014-07-09 19:30:17 +00:00
Joshua Tauberer
22a010ecb9
say that certificates are valid too in output
2014-07-09 16:38:56 +00:00
Joshua Tauberer
659b5c8aa3
if the server certificate can be used for a non-primary domain, use it
2014-07-09 16:38:42 +00:00
Joshua Tauberer
6c70b10c15
tell users to restart nginx after plugging in a new cert
2014-07-09 14:05:59 +00:00
Joshua Tauberer
deebda06e1
utils.sort_domains wasn't right
2014-07-09 12:35:12 +00:00
Joshua Tauberer
1a74b81f44
new nginx configuration yaml file to allow proxying of whole domains elsewhere
2014-07-09 12:31:32 +00:00
Joshua Tauberer
04e30ffa78
check that the installed certificate corresponds to the private key
2014-07-08 15:47:54 +00:00
Joshua Tauberer
10fbb2b293
in cf7053c124 I allowed editconf.py to insert a setting where we find it already commented-out in order to get an nginx configuration line in the right place, but it wasn't quite right because when run again we would insert the setting a second time
2014-07-08 00:48:22 +00:00
Joshua Tauberer
3bab63d4ce
update to Roundcube 1.0.1
2014-07-08 00:37:53 +00:00
Joshua Tauberer
7339bf080a
add a web_update script to trigger writing nginx config
2014-07-08 00:34:38 +00:00
Joshua Tauberer
59a9d02fa5
check that installed certificates are for the domains we are using the certificates for
2014-07-07 12:06:11 +00:00
Joshua Tauberer
3d4eadd436
the new migration management in c8856f107d left out the part where we actually keep the system's current MIGRATIONID... it was being lost when setup/start.sh was re-run
2014-07-07 11:29:21 +00:00
Joshua Tauberer
cf7053c124
set nginx server_names_hash_bucket_size to 64, fixes #93
2014-07-07 11:23:41 +00:00
Joshua Tauberer