external/mailinabox
1
0
Fork 0
mirror of https://github.com/mail-in-a-box/mailinabox.git synced 2026-09-13 00:28:01 +02:00
Code Issues Releases Wiki Activity
738 Commits 6 Branches 90 Tags
2b9ce85ba880684a3d6f44a80748fd0dc5463c24
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Joshua Tauberer ebf6c807c5 zpush: missing install of 'git' which is how we fetch Z-Push sources, and git may not otherwise be available in a containerized install 2015-04-04 08:06:33 -04:00
Joshua Tauberer a9ed6d88cf simplify dockerization 2015-04-04 08:06:33 -04:00
Joshua Tauberer e8f81dc905 dockerize (work in progress) 
Docker support was initially worked on in 2bbb7a5e7e, but it never really worked.

This extends f7d7434012800c3572049af82a501743d4aed583 which was an old branch for docker work.
 2015-04-04 08:06:33 -04:00
Joshua Tauberer 5aa0bf2d14 add instructions for verifying the signed tags to the README 2015-04-01 10:38:09 -04:00
Joshua Tauberer f3ad6b4acc Version 0.08 
CHANGELOG
=========

v0.08 (April 1, 2015)
---------------------

Mail:

* The Roundcube vacation_sieve plugin by @arodier is now installed to make it easier to set vacation auto-reply messages from within Roundcube.
* Authentication-Results headers for DMARC, added in v0.07, were mistakenly added for outbound mail --- that's now removed.
* The Trash folder is now created automatically for new mail accounts, addressing a Roundcube error.

DNS:

* Custom DNS TXT records were not always working and they can now override the default SPF, DKIM, and DMARC records.

System:

* ownCloud updated to version 8.0.2.
* Brute-force SSH and IMAP login attempts are now prevented by properly configuring fail2ban.
* Status checks are run each night and any changes from night to night are emailed to the box administrator (the first user account).

Control panel:

* The new check that system services are running mistakenly checked that the Dovecot Managesieve service is publicly accessible. Although the service binds to the public network interface we don't open the port in ufw. On some machines it seems that ufw blocks the connection from the status checks (which seems correct) and on some machines (mine) it doesn't, which is why I didn't notice the problem.
* The current backup chain will now try to predict how many days until it is deleted (always at least 3 days after the next full backup).
* The list of aliases that forward to a user are removed from the Mail Users page because when there are many alises it is slow and times-out.
* Some status check errors are turned into warnings, especially those that might not apply if External DNS is used.
 2015-04-01 10:14:34 -04:00
Joshua Tauberer ec039719de prevent caching of ajax responses in the control panel 
GET requests might be cached. Definitely happens on Internet Explorer. Makes it look like the user is getting unauthorized access.

See https://discourse.mailinabox.email/t/fresh-install-can-login-to-webmail-but-not-admin/394/4.
 2015-03-31 14:52:11 +00:00
Joshua Tauberer 14b16b2f36 allow custom DNS TXT records for SPF, DKIM, and DMARC to override the ones we want to set 
fixes #323
fixes #324
 2015-03-30 01:20:03 +00:00
Joshua Tauberer cbc7e280d6 set the SPF record after custom DNS records so that the SPF record doesn't prevent all custom TXT records from coming in 2015-03-30 01:18:05 +00:00
Joshua Tauberer f4fa9c93a0 Merge pull request #366 from hnk/hnk-patch-read_password 
Change read_password() logic to catch short passwords
 2015-03-29 14:12:07 -04:00
Joshua Tauberer 3d21f2223e status checks: turn missing DNSSEC into a warning instead of an error; omit an error about missing TLSA if DNSSEC isn't in use; if DNSSEC is in use, make a missing TLSA record a warning instead of an error 2015-03-28 11:24:05 -04:00
Joshua Tauberer 710a69b812 turn some nameserver status check errors into warnings if the domain resolves correctly since the user might be using External DNS, closes #330 2015-03-28 11:23:59 -04:00
Joshua Tauberer dd6a8d9998 upgrade to ownCloud 8.0.2 
The contacts and calendar apps are now maintained outside of ownCloud core, so we now pull them in from github tags and must enable them explicitly.
 2015-03-28 11:08:57 -04:00
Joshua Tauberer 9f32e5af0a the install of roundcube vacation_sieve requires that we install git 
see a8669197dd
 2015-03-28 09:54:52 -04:00
Joshua Tauberer 298e19598b small bug in the new system status checks show-changes command 
see 4d22fb9b2a

fixes #360
 2015-03-22 14:03:12 +00:00
Joshua Tauberer 680191d7cb drop the list of aliases from the users control panel page because with more than 50 aliases it seems to be so slow it times out 
see https://discourse.mailinabox.email/t/small-bug-in-admin-panel-when-49-aliases/378
 2015-03-22 13:59:05 +00:00
Joshua Tauberer 81d6d69b85 update CHANGELOG 2015-03-22 13:58:24 +00:00
Joshua Tauberer 6df72bf4ac create the Trash folder on new user creation (fixes #359) 2015-03-22 13:33:17 +00:00
Joshua Tauberer 01f2451349 provide a better error message when creating a user account with non-ASCII characters 2015-03-22 12:33:06 +00:00
Joshua Tauberer dcd971d079 the opendmarc miter should run on incoming mail only 
I added OpenDMARC's milter in fba4d4702e. But this started
setting Authentication-Results headers on outbound mail with failures. Not sure why it
fails at that point, but it shouldn't be set at all. The failure might cause recipients
to junk the mail. See #358.

This commit removes the milter from the SMTP submission (port 587) listener.
 2015-03-21 16:14:01 +00:00
Joshua Tauberer 4d22fb9b2a run status checks each night and email the administrator with the changes from the previous day's results 2015-03-21 16:02:42 +00:00
Joshua Tauberer c18d58b13f backups: predict when the next backup will occur 2015-03-21 15:22:45 +00:00
Joshua Tauberer b539c2df70 Merge pull request #347 from Toilal/feat/start-enhancements 
If the migration file is missing but the storage directory exists, assume this is a fresh directory -- don't bother trying to migrate, and do write the migration file with the current migration ID.
 2015-03-19 11:57:24 -04:00
Joshua Tauberer a8669197dd added Roundcube plugin vacation_sieve 
Merge branch 'master' of https://github.com/zealot128-os/mailinabox

Closes #334
 2015-03-08 19:15:20 +00:00
Joshua Tauberer 2412c92772 enable fail2ban for ssh and dovecot 
Merge branch 'master' of https://github.com/h8h/mailinabox

see #353, #319
 2015-03-08 18:40:17 +00:00
Joshua Tauberer 7c0ca42145 status checks: don't check that dovecot-sieve is publicly accessible 2015-03-08 18:35:33 +00:00
Joshua Tauberer e2fa01e0cf Merge pull request #348 from benschumacher/master 
Update MX records using DNS Update API / Management UI
 2015-03-04 13:42:02 -05:00
Joshua Tauberer 1be0f39be0 prep for v0.07 tag 2015-02-28 17:09:12 -05:00
Joshua Tauberer d01001f2a5 some more CHANGELOG entries 2015-02-28 17:06:09 -05:00
Joshua Tauberer 7c85694d60 Merge pull request #332 from mathuin/better-mx-check 
Changed MX check to respect priorities other than 10.
 2015-02-23 07:56:24 -05:00
Joshua Tauberer 7ec662c83f status checks: use a worker pool that lives across flask requests, see #327 2015-02-18 16:42:33 +00:00
Joshua Tauberer 348d2b8701 Merge pull request #326 from dhpiggott/custom-dns-filter-secondary-nameserver 
Do not show '_secondary_nameserver' in Custom DNS table
 2015-02-17 08:31:34 -05:00
Joshua Tauberer 449a538e6b if a CNAME is set for a domain, don't create a website for that domain (just like A/AAAA records) 2015-02-17 00:48:26 +00:00
Joshua Tauberer 3c50c9a18b when serving a 'www.' domain, check if the parent domain's ssl certificate can be used besides checking PRIMARY_HOSTNAME 
Removing buy_certificate.py which is not working and I don't want to update its call signatures.
 2015-02-17 00:42:25 +00:00
Joshua Tauberer 3c10ec70a5 update comment 2015-02-17 00:08:04 +00:00
Joshua Tauberer 1a59f343c0 adding entries to the CHANGELOG 2015-02-16 23:58:17 +00:00
Joshua Tauberer fba4d4702e install opendmarc to add Authentication-Results headers for DMARC too 2015-02-16 23:17:44 +00:00
Joshua Tauberer 143bbf37f4 all mail domains, not just (top-level) zones, must have an entry in the opendkim key tables so that such outgoing mail gets signed 
If you had both x.y.com and y.com configured here, x.y.com mail would not get DKIM-signed.
 2015-02-16 18:13:51 -05:00
Joshua Tauberer fd3ad267ba if a domain has a catch-all or domain alias then we no longer force the creation of postmaster@ and so we should not be checking for its existence in the status checks 
see 85a40da83c
 2015-02-15 19:07:10 -05:00
Joshua Tauberer 330583f71d status checks: if a service isn't available publicly, check if it is available on the loopback interface to distinguish not running from not accessible 2015-02-13 09:30:25 -05:00
Joshua Tauberer d775f90f0c prevent apt from asking the user any questions 
Add additional options to really prevent apt from asking questions, which causes setup to hang because stdin/out have been redirected.

fixes #270, #291
 2015-02-13 13:41:52 +00:00
Joshua Tauberer e096144713 Outlook 2007 or later on Windows 7 and later 
fixes #308
 2015-02-13 13:29:01 +00:00
Joshua Tauberer 7ce30ba888 roundcube 1.1.0 2015-02-13 13:22:46 +00:00
Joshua Tauberer 6a3ec1d874 updating CHANGELOG 2015-02-13 13:20:55 +00:00
Joshua Tauberer 575d3a66c6 more on being smarter about waiting for the management daemon to start 
cc333b3965 worked for fresh systems, but if the system already had the daemon running the api.key file would already exist and the test would pass to early. Now removing the file first.

fixes #322
 2015-02-13 13:11:03 +00:00
Joshua Tauberer cc333b3965 be smarter about waiting for the management daemon to start before accessing it 2015-02-10 10:03:07 -05:00
Joshua Tauberer 351758b3bd typo 
typo in "roudcube"
 2015-02-10 09:27:36 -05:00
Joshua Tauberer 94053d8432 Merge pull request #317 from bizonix/master 
Disable viewing dotfiles (.htaccess, .svn, .git, etc.)
 2015-02-09 12:53:32 -05:00
Joshua Tauberer 150611123a typo/text tweak 2015-02-05 09:17:48 -05:00
Joshua Tauberer abfc17ee62 web admin: simplify the instructions for creating a separate web directory for particular sites by moving it into a modal 2015-02-05 09:12:55 -05:00
Joshua Tauberer 97be9c94b9 if the user has set a http proxy or redirect on the root path of a domain, using custom.yaml, skip the domain from the static hosting panel because it wont be serving any static files 2015-02-05 08:55:57 -05:00
Joshua Tauberer 21b00e8fbb if a custom A record is set, dont put in a default AAAA record pointing to the box because it will probably be wrong --- the user should either set an AAAA record or let the domain not resolve on IPv6 2015-02-03 21:51:19 -05:00
Joshua Tauberer 01636c2e4b Merge branch 'h8h-master' 
I squashed some commits together and modified the commit message...
 2015-02-03 23:54:17 +00:00
Joshua Tauberer f945a1bc6b Merge pull request #312 from ikarus23/master 
hide nginx version an OS information for better privacy
 2015-02-01 14:25:39 -05:00
Joshua Tauberer 82e752395b Merge pull request #310 from ikarus23/master 
do better redirection from http to https
 2015-01-31 19:58:31 -05:00
Joshua Tauberer 16422b4055 adding items to the CHANGELOG 2015-01-31 21:36:37 +00:00
Joshua Tauberer b9ca74c915 implement Mozilla (e.g. Thunderbird) autoconfiguration file 
fixes #241
 2015-01-31 21:33:18 +00:00
Joshua Tauberer 7e05d7478f run status checks asynchronously so that they finish faster, since many checks are waiting on network replies and ought not to block the whole thing 2015-01-31 20:42:43 +00:00
Joshua Tauberer 8fd98d7db3 status checks: s/env['out']/output/ 2015-01-31 20:42:43 +00:00
Joshua Tauberer 1039a08be6 /admin login now issues a user-specific key for future calls (rather than providing the system-wide API key or passing the password on each request) 2015-01-31 20:42:43 +00:00
Joshua Tauberer 023b38df50 split management daemon authorization from authentication and use 'doveadm pw' rather than 'doveadm auth test' so that it is decoupled from dovecot's login mechanism 
This was done to pave the way for two-factor authentication, but that's still a ways off.
 2015-01-31 20:41:41 +00:00
Joshua Tauberer 3187053b3a dont save the CSR generated to make self-signed certificates for non-primary domains (it has no value and might be confusing) 2015-01-31 13:27:06 +00:00
Joshua Tauberer a3e526e818 Merge pull request #307 from pierreozoux/master 
Typo
 2015-01-29 12:52:37 -05:00
Joshua Tauberer d075113c1a Merge pull request #306 from dhpiggott/fix-backup-typos 
Fix typos in backup status template
 2015-01-29 08:22:44 -05:00
Joshua Tauberer 624cc7876a Merge pull request #297 from kurthuwig/fix_typo 
Fix typo in mail-guide.html
 2015-01-21 08:52:39 -05:00
Joshua Tauberer 85a40da83c catch-all aiases and domain aliases should not require postmaster@ and admin@ aliases because they'll forward anyway 2015-01-19 23:32:36 +00:00
Joshua Tauberer 1bf8f1991f internationalized domain names (DNS, web, CSRs, normalize to Unicode in database, prohibit non-ASCII characters in user account names) 
* For non-ASCII domain names, we will keep the Unicode encoding in our users/aliases table. This is nice for the user and also simplifies things like sorting domain names (using Unicode lexicographic order is good, using ASCII lexicogrpahic order on IDNA is confusing).
* Write nsd config, nsd zone files, nginx config, and SSL CSRs with domains in IDNA-encoded ASCII.
* When checking SSL certificates, treat the CN and SANs as IDNA.
* Since Chrome has an interesting feature of converting Unicode to IDNA in <input type="email"> form fields, we'll also forcibly convert IDNA to Unicode in the domain part of email addresses before saving email addresses in the users/aliases tables so that the table is normalized to Unicode.
* Don't allow non-ASCII characters in user account email addresses. Dovecot gets confused when querying the Sqlite database (which we observed even for non-word ASCII characters too, so it may not be related to the character encoding).
 2015-01-19 23:31:55 +00:00
Joshua Tauberer d155aa8745 if all system services are running, say so in the status checks rather than being totally silent 2015-01-19 22:04:25 +00:00
Joshua Tauberer c0bfd6d15f bring CHANGELOG up to date 2015-01-19 22:04:25 +00:00
Joshua Tauberer 24cc108147 if a custom CNAME record is set, don't add a default A/AAAA record, e.g. for 'www' 
see https://discourse.mailinabox.email/t/multiple-domains-in-mail-in-a-box-with-the-domains-being-hosted-elsewhere/56/18
 2015-01-19 22:04:21 +00:00
Joshua Tauberer b02d7d990e install cron in case it isn't already installed 2015-01-11 20:00:11 +00:00
Joshua Tauberer 87f82addbc preflight memory check: units problems 
/proc/meminfo reports kibibytes. Lower the minimum memory requirement so that 768 MB (not MiB) also is allowed.

Report the detected memory in MB (not KiB), to be clearer.

Fixes #289.
 2015-01-11 14:13:35 +00:00
Joshua Tauberer 09713e8eab status checks: check that system services are running 
If bind9 isn't running, dont proceed with other checks because we can't do DNS checks. Even though we skip, add error handling so that a failed call to rndc doesn't crash and that a timeout in a DNS check doesn't crash the status checks.
 2015-01-11 14:13:35 +00:00
Joshua Tauberer 0aa3941832 release v0.06 2015-01-04 15:18:13 -05:00
Joshua Tauberer fea77e41df Owncloud doesnt't support CARDDAV_SUPPORTS_SYNC 
partialy reverts 93a722f; closes #287
 2015-01-04 16:04:32 +00:00
Joshua Tauberer 74ef9ab7c5 Merge pull request #288 from fjuan/srv_doc 
explain how to add SRV records to DNS zonefile using the API
 2015-01-04 09:19:24 -05:00
Joshua Tauberer 80e97feee2 update CHANGELOG 2015-01-02 23:47:19 +00:00
Joshua Tauberer fddab5d432 allow the dns api to set srv records 
see https://discourse.mailinabox.email/t/create-srv-record-at-the-dns-server/225
 2015-01-02 23:39:09 +00:00
Joshua Tauberer c4e4805160 ensure postfix/postgrey agree on whether to communicate with ipv4 or ipv6 
see https://discourse.mailinabox.email/t/postgrey-and-ipv6/227
 2015-01-02 23:37:16 +00:00
Joshua Tauberer c75950125d set dovecot default_process_limit and fs.inotify.max_user_instances to better defaults 
See https://discourse.mailinabox.email/t/mailserver-limits/228.
 2015-01-02 23:25:52 +00:00
Joshua Tauberer f141af4b61 status checks: dont die if openssh-server isn't installed 
see https://discourse.mailinabox.email/t/local-dns-is-not-working-was-unable-to-check-system-status/165/39
 2015-01-02 22:59:29 +00:00
Joshua Tauberer 3d8ea0e6ed mail log scanner: dont assume lines are utf8 2015-01-02 22:49:25 +00:00
Joshua Tauberer 399f9d9bdf in status checks, clear bind9 cache using rndc rather than restarting bind9 2014-12-26 13:22:14 +00:00
Joshua Tauberer 2b76fd299e admin: ensure multiple concurrent api calls dont confuse the ajax loading indicator (track number of open requets, stop fade animation when it is time to hide) 2014-12-21 22:47:11 +00:00
Joshua Tauberer 90592bb157 add a control panel for setting custom dns records so that we dont have to use the api manually 2014-12-21 11:31:24 -05:00
Joshua Tauberer 5cf38b950a bump ownCloud to 7.0.4; fixes #283 2014-12-12 01:00:35 +00:00
Joshua Tauberer 3bc5361491 Merge pull request #282 from m4rcs/master 
Fix NS status check - should sort on both ends of the comparison
 2014-12-09 11:17:30 -05:00
Joshua Tauberer d390bfb215 indicate in the admin when a multi-domain or wildcard certificate is in use 2014-12-05 14:43:52 -05:00
Joshua Tauberer ceba53f1c4 explain how to install a multi-domain or wildcard ssl cert; if one is installed, the Replace Cert button in the admin for non-primary domains should not replace the cert on the primary domain 2014-12-05 14:25:14 -05:00
Joshua Tauberer be59bcd47d for .fund domains use RSASHA256 DNSSEC keys 2014-12-05 12:03:21 -05:00
Joshua Tauberer cfe0fa912a add a 'redirects' feature in web/custom.yaml 2014-12-05 12:03:21 -05:00
Joshua Tauberer 31d6128a2b nginx: explicitly listen on both ipv4 and ipv6 (works even if ipv6 isn't present) 2014-11-30 14:41:30 +00:00
Joshua Tauberer 82cf5b72e4 simplify some output in the work-in-progress mail log scanner 2014-11-30 14:41:30 +00:00
Joshua Tauberer 8ec8c42441 Merge pull request #275 from grepwood/master 
add `apt-get install sudo`
 2014-11-25 10:39:13 -05:00
Joshua Tauberer a7710e9058 dns.resolver.query treats hostnames as relative names if they don't end in a period 
Relative hostnames have a fall-back lookup with the machine's hostname appended, which makes no sense. Add a period, e.g. "my.hostname.com" => "my.hostname.com.", to prevent that.

This caused false positive Spamhaus checks. Fixes #185.
 2014-11-21 15:16:59 +00:00
Joshua Tauberer 3133dcd5a3 release 0.05 2014-11-18 16:52:02 +00:00
Joshua Tauberer 057c1dd913 recommend IMAP/SMTP for everyone 2014-11-18 16:47:42 +00:00
Joshua Tauberer 06f2477cfd the new iOS configuration profile also is used on OS X 10.10.1, see #261 2014-11-18 16:32:37 +00:00
Joshua Tauberer 1abc8ed469 add CHANGELOG entries for recent work 2014-11-14 14:13:24 +00:00
Joshua Tauberer cdaa2c847d [merge] iOS Mobile Configuration Profile 2014-11-14 13:56:18 +00:00
Joshua Tauberer b04addda9a move the mobileconfig into the conf directory as a plain XML file and handle substitutions and copying to /var in web.sh 2014-11-14 13:52:29 +00:00