external/mailinabox
1
0
Fork 0
mirror of https://github.com/mail-in-a-box/mailinabox.git synced 2026-09-12 00:18:59 +02:00
Code Issues Releases Wiki Activity
207 Commits 6 Branches 90 Tags
4668367420d854f9113563ada535aa13c215e54b
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Joshua Tauberer 4668367420 first pass at a management tool for checking what the user must do to finish his configuration: set NS records, DS records, sign his certificates, etc. 2014-06-22 15:54:22 +00:00
Joshua Tauberer ec6c7d84c1 dont ask for a CSR country code on second runs because the CSR is already generated and any new country code won't be used anyway 2014-06-22 15:36:14 +00:00
Joshua Tauberer 8076ce4ab9 Merge pull request #74 from mkropat/mgmt-auth 
Add authentication to mailinabox-daemon; resolves #67
 2014-06-22 11:36:04 -04:00
Joshua Tauberer 064d75e261 Merge pull request #73 from mkropat/syslog-logging 
Tell Flask to log to syslog
 2014-06-21 21:22:27 -04:00
Joshua Tauberer e70bc50432 README parallel sentence structure 2014-06-22 00:34:49 +00:00
Joshua Tauberer 67d31ed998 move the SSL setup into its own bash script since it is used for much more than email now 2014-06-21 22:16:46 +00:00
Joshua Tauberer 0ab43ef4fd have webfinger output a JSON file in STORAGE_ROOT/webfinger/(acct/..) 2014-06-21 17:08:18 +00:00
Joshua Tauberer 326cc2a451 obviously put our stuff in /usr/local and not /usr 2014-06-21 12:35:00 -04:00
Joshua Tauberer d3cacd4a11 update test_dns 
Don't check NS records for now because they will only appear on zones.
If a hostname is a subdomain on a zone and not itself a zone, it will
lack NS records.

Also stop testing for ADSP, which we dropped in 126ea94ccf.
 2014-06-21 12:32:20 -04:00
Joshua Tauberer 87b0608f15 test_dns: DNSSEC signing inserts empty text string components 2014-06-21 12:32:20 -04:00
Joshua Tauberer 85169dc960 preliminary support for webfinger 
It just echos back the subject given to it.
 2014-06-20 01:55:16 +00:00
Joshua Tauberer 5faa1cae71 manage the nginx conf in the management daemon too so we can have nginx operate on all domains that we serve mail for 2014-06-20 01:55:12 +00:00
Joshua Tauberer a1a80b295e update docs a bit 2014-06-18 23:12:05 -04:00
Joshua Tauberer 94a140a27a linkify README 2014-06-18 23:04:06 -04:00
Joshua Tauberer 126ea94ccf drop support for ADSP which since last November is no longer recommended per http://datatracker.ietf.org/doc/status-change-adsp-rfc5617-to-historic/ 2014-06-18 22:56:55 -04:00
Joshua Tauberer 0f72f78eea add DNSSEC/DANE TLSA to the README 2014-06-19 02:23:07 +00:00
Joshua Tauberer 782ad04b10 use DANE when sending mail: if the recipient MX has a DANE TLSA record in DNS then Postfix will necessarily encrypt the mail in transport 2014-06-19 01:58:14 +00:00
Joshua Tauberer 95e61bc110 add DANE TLSA records to the PUBLIC_HOSTNAME's DNS 
Postfix has a tls_security_level called "dane" which uses DNS-Based Authentication of Named Entities (DANE)
to require, if specified in the DNS of the MX host, an encrpyted connection with a known certificate.

This commit adds TLSA records.
 2014-06-19 01:39:27 +00:00
Joshua Tauberer 699bccad80 missing spaces in nsd.conf (has no effect but looks proper) 2014-06-18 23:53:52 +00:00
Joshua Tauberer afb6c26c8b run bind9 on the loopback interface for ensuring we are using a DNSSEC-aware nameserver to resolve our own DNS queries (i.e. when sending mail) since we can't trust that the network configuration provided for us gives us a DNSSEC-aware DNS server 
see #71
 2014-06-18 19:45:47 -04:00
Joshua Tauberer 761fac729b nsd.conf wasn't properly using the signed zone files 2014-06-18 23:30:35 +00:00
Joshua Tauberer dd15bf4384 use a better sort order for records in DNS zone files 2014-06-17 23:34:06 +00:00
Joshua Tauberer 14396e58f8 dont create a separate zone for PUBLIC_HOSTNAME if it is a subdomain of another zone (hmm, this is a general principle that could apply to any two domains the box is serving) 2014-06-17 23:30:00 +00:00
Joshua Tauberer 33f06f29c1 let the user override some DNS records 2014-06-17 22:21:51 +00:00
Joshua Tauberer 88709506f8 add DNSSEC 
* sign zones
* in a cron job, periodically re-sign zones because they expire (not tested)
 2014-06-17 22:21:12 +00:00
Joshua Tauberer aaa735dbfe write nsd.conf zones in a predictable order so that we don't keep rewriting it 2014-06-12 22:28:37 -04:00
Joshua Tauberer e9cde52a48 two more cases of shelling out external programs in a more secure way, see cecda9cec5 2014-06-12 21:06:04 -04:00
Joshua Tauberer c925f72b0b remove obsoleted parts of setup/dns.sh 
Now that dns_update is a part of the management daemon, we no
longer are using STORAGE_ROOT/dns for anything.
 2014-06-12 20:18:55 -04:00
Joshua Tauberer e18c51293d update News Challenge status in README 2014-06-10 18:48:12 -04:00
Joshua Tauberer d28d07f78e increase the postfix message size limit from 10MB to 128MB 2014-06-10 10:21:43 +00:00
Joshua Tauberer cad868c6c9 reorganize mail.sh a little 2014-06-10 10:19:49 +00:00
Joshua Tauberer 8bd62aa3bc increase duplicity's volume size from the default of 25MB to 100MB so we create fewer files 2014-06-09 13:47:41 +00:00
Joshua Tauberer 5490142df5 re-do the backup script to use the duplicity program 
Duplicity will manage the process of creating incremental backups for us.
Although duplicity can both encrypt & copy files to a remote host, I really
don't like PGP and so I don't want to use that.

Instead, we'll back up to a local directory unencrypted, then manually
encrypt the full & incremental backup files. Synchronizing the encrypted
backup directory to a remote host is a TODO.
 2014-06-09 09:34:52 -04:00
Joshua Tauberer cecda9cec5 management: shell out external programs in a more secure way 2014-06-09 08:09:45 -04:00
Joshua Tauberer 70bd96f643 Merge pull request #70 from mkropat/ipv6-support 
Support dual-stack IPv4/IPv6 mail servers
 2014-06-08 19:03:33 -04:00
Joshua Tauberer cd1802fecc Filter privacy-sensitive headers on outgoing mail 
This re-implements part of PR #69 by @mkropat, who wrote:

By default, Postfix adds a Received header — on all mail that you send —
that lists the IP of the device you sent the mail from.  This feature is
great if you're a mail provider and you need to debug why one user is
having sending issues.  This feature is not so great if you run your own
mail server and you don't want every recipient of every email you send
to know the device and IP you sent the email from.

To limit this filtering to outgoing mail only, we apply the filters just
to the submission port.  See these guides [1] [2] for more context.

  [1] http://askubuntu.com/a/78168/11259
  [2] http://www.void.gr/kargig/blog/2013/11/24/anonymize-headers-in-postfix/
 2014-06-08 18:35:09 -04:00
Joshua Tauberer 2c4212fa36 use editconf.py to mangle /etc/postfix/master.cf 
* using it to enable the Postfix submission service
* per @mkropat's suggestion in #69, set an option to distinguish submission from regular smpd in syslog by giving submission a new name (doing this here to test that editconf is working right on master.cf)
 2014-06-08 17:31:12 -04:00
Joshua Tauberer 5b72e5419d fix shebang lines in the tests to take advantage of any activated python environment 2014-06-08 17:31:12 -04:00
Joshua Tauberer ad520b45ff adding a new script archive_conf_files.sh to dump the contents of all files modified by editconf.py so testing is easier 2014-06-08 17:31:12 -04:00
Joshua Tauberer ca34c1b1ae Merge pull request #68 from mkropat/protect-key 
Protect private key from being world-readable
 2014-06-07 20:19:40 -04:00
Joshua Tauberer 3fa8e384d4 improve hostname/IP default values 
Merges branch 'mkropat-populate-hostname-ip'
 2014-06-07 14:57:22 -04:00
Joshua Tauberer b60ca25e53 add comments to the new get_default_hostname etc. functions, and simplify the logic in the Vagrantfile and start.sh so that we always call into the same two functions 2014-06-07 14:57:03 -04:00
Joshua Tauberer add1545deb Merge pull request #65 from mkropat/mkropat/password-mask 
Mask password input on stdin in tools/mail.py
 2014-06-06 17:18:33 -04:00
Joshua Tauberer 242cadebc8 allow dashes in emails during validation, and for aliases allow a much wider range of characters, fixes #64 
* for local mail users, also disallows periods at the beginning or end of the local or domain parts
* Dovecot gets confused if the string contains any unusual characters, so local mail users are restricted to a narrow regex
* for mail aliases Postfix is not confused so use a regex based on RFC 2822
 2014-06-06 10:51:36 -04:00
Joshua Tauberer f1dac1fe13 show less output when updating DNS configuration 2014-06-06 10:51:36 -04:00
Joshua Tauberer 389c354c8f Vagrant updates 
* use a public box (the official Ubuntu 14.04 box which contra the description does have VBox Guest Additions installed)
* now that we allow SSH password logins, since Vagrant requires it, dont muck with sshd_config here
* don't put the machine on the public network because that will allow anyone to log into it with Vagrant's default username/password, duh
 2014-06-06 10:51:36 -04:00
Joshua Tauberer f9c3f33e74 move the SSH password login check out of setup because it interfers with Vagrant and into a separate script that we'll use for auditing in a later phase 2014-06-06 10:51:36 -04:00
Joshua Tauberer 6194c63f76 add management comments for checking for updated Ubuntu packages and applying updates 2014-06-05 20:57:30 +00:00
Joshua Tauberer cab7321dbb remove vestigal docker compatibility that prevented starting services during setup 2014-06-04 20:04:26 -04:00
Joshua Tauberer 295981828f Vagrantize 
* adding a Vagrantfile
* in a non-interactive setup like this, create the user's first email account for them
* let the machine auto-detect its IP address using http://icanhazip.com/
* use our own justtesting.email domain to provision a subdomain for users so they can quickly get started
 2014-06-04 19:39:58 -04:00
Joshua Tauberer 3961e1aec3 test_dns: more error handling 2014-06-04 19:31:55 -04:00
Joshua Tauberer 7fa4862f1a refactor dns_update so that the zone is first generated in a file-format agnostic way 2014-06-04 19:00:31 -04:00
Joshua Tauberer 8ed15168c0 the new dns_update totally forgot to write the OpenDKIM tables 2014-06-04 18:44:13 -04:00
Joshua Tauberer 2f0d036504 the bc package is no longer needed since redoing dns_update 2014-06-04 17:27:01 -04:00
Joshua Tauberer d6e6cfd3c9 mail test: catch typical connecting errors and display nicer output 2014-06-04 17:13:06 -04:00
Joshua Tauberer fff06f7d71 improve DNS test output 2014-06-04 17:01:49 -04:00
Joshua Tauberer 2bbb7a5e7e remove Docker stuff since it doesnt work 2014-06-04 10:57:23 -04:00
Joshua Tauberer a35fa12465 script to check the SSL certificate, with instructions for turning the self-signed certificate into a properly signed certificate 2014-06-04 11:38:20 +00:00
Joshua Tauberer ea62c2419d typo in updating DKIM, dont regenerate the DKIM private key each time setup is run 2014-06-03 21:42:33 +00:00
Joshua Tauberer 2a9349a64e show the SSL certificate's fingerprint during setup so the user can sort of pin it 2014-06-03 21:39:49 +00:00
Joshua Tauberer bb7905aefd on second and later runs of start.sh, recall the inputs the user entered the last time 2014-06-03 21:31:13 +00:00
Joshua Tauberer 24edd5ce91 the SSL CSR must be generated with a country code 2014-06-03 21:17:10 +00:00
Joshua Tauberer 89730bd643 new backup script, see #11 2014-06-03 21:16:38 +00:00
Joshua Tauberer 51dd2ed70b update nginx SSL options, fixes #61 2014-06-03 14:06:02 +00:00
Joshua Tauberer c54b0cbefc move management into a daemon service running as root 
* Created a new Python/flask-based management daemon.
* Moved the mail user management core code from tools/mail.py to the new daemon.
* tools/mail.py is a wrapper around the daemon and can be run as a non-root user.
* Adding a new initscript for the management daemon.
* Moving dns_update.sh to the management daemon, called via curl'ing the daemon's API.

This also now runs the DNS update after mail users and aliases are added/removed,
which sets up new domains' DNS as needed.
 2014-06-03 13:56:40 +00:00
Joshua Tauberer da15ae5375 rename the scripts directory to setup 2014-06-03 11:12:38 +00:00
Joshua Tauberer af03feb389 remove permit_dnswl_client because postfix has odd behavior when an IP address is not listed: it turns all bounces into deferrals (retry) 
partially reverts 6d473f81ac
 2014-05-23 09:01:03 +00:00
Joshua Tauberer 19aba091d7 test_mail: if EHLO test fails continue testing the rest, since user may be waiting on DNS propagation 2014-05-17 08:32:40 -04:00
Joshua Tauberer f91830f0e3 clean up README a bit; moving the bit Rationale into the github wiki 2014-05-15 08:57:44 -04:00
Joshua Tauberer 6d473f81ac add more postfix rules: reject_non_fqdn_sender, reject_unknown_sender_domain, reject_rhsbl_sender, and permit_dnswl_client 2014-05-15 12:10:35 +00:00
Joshua Tauberer b646771517 redirect all HTTP to HTTPS and enable HSTS, closes #18 2014-05-14 12:15:11 +00:00
Joshua Tauberer 091a58ac94 dns_update needs to run with bash when run directly, see #39 2014-05-12 23:38:55 +00:00
Joshua Tauberer c722625041 test_dns: add ADSP and DMARC tests, see #14 2014-05-10 08:03:18 -04:00
Joshua Tauberer c403895f95 test_dns: properly test the non-primary domain of a box (for email addresses on domains besides PUBLIC_HOSTNAME) 2014-05-10 08:03:13 -04:00
Joshua Tauberer bdadf3017d test_dns: handle case where a DNS record is missing (vs incorrect) 2014-05-10 08:03:07 -04:00
Joshua Tauberer d5971e383b add ADSP and DMARC records; see #14 2014-05-10 11:58:27 +00:00
Joshua Tauberer a8938e107e DKIM: For the benefit of ADSP and DMARC (not yet impl), each sending domain should be its signing domain 2014-05-10 11:58:27 +00:00
Joshua Tauberer cfcb5f5bbd merge: @PirosB3 and @pjz suggested using pjzz/phusion-baseimage as the base image for docker 
See http://phusion.github.io/baseimage-docker/ for why the stock Ubuntu
image from Docker is not good enough for a complex system.

Thanks to @pjz for updating the base image for Ubuntu 14.04 and starting
the service scripts.

see #16; merges #49
 2014-05-06 10:05:14 -04:00
Joshua Tauberer 80b367ab07 test_mail: gracefully handled when the server has no reverse DNS available 2014-05-06 10:02:29 -04:00
Joshua Tauberer 63ef8f7b04 missing wget dependency used by roundcube installation 2014-05-06 10:02:06 -04:00
Joshua Tauberer e247929386 docker: don't start services ourself 
* let the base image's system services manager handle it
* move our container start script to occur before system services are started
 2014-05-06 10:00:30 -04:00
Joshua Tauberer 1db0dd3092 system.sh: make apt-get upgrade quieter 2014-05-06 09:57:11 -04:00
Joshua Tauberer fbd7d731e8 docker: fix startup scripts for nsd and dovecot to run them in the foreground 2014-05-06 09:56:20 -04:00
Joshua Tauberer 0659a0bb16 Merge branch 'better_docker' of https://github.com/pjz/mailinabox into pjz-better_docker 
our trees had diverged, various conflicts resolved
 2014-05-02 14:54:21 -04:00
Joshua Tauberer 189dd6000e docker: re-run the start script on the container's first run because it won't know its hostname or IP address until then 2014-05-02 14:23:56 -04:00
Joshua Tauberer 3fdcbe542f don't ask the user to create an email account if the shell is non-interactive and provide a better default for the domain name 2014-05-02 14:22:59 -04:00
Joshua Tauberer 89bb5da986 dns: missing dependency on bc 2014-05-02 14:18:26 -04:00
Joshua Tauberer acec82950b docker: disable the ufw firewall because it is not supported in a docker container and produces a lot of error output (by reverting a510e08f9e and setting an environment variable) 2014-05-01 22:39:45 -04:00
Joshua Tauberer 2f6e0ded7a docker: cleanup comments and make the installation of sshd quieter 2014-05-01 22:36:14 -04:00
Joshua Tauberer f0afa7e8dc docker: add some example run commands for debugging a container or having it take over host ports 2014-05-01 22:29:00 -04:00
Joshua Tauberer 89240a4fab docker: do ADD container/docker later on so that the Dockerfile can be updated and still reuse a cached image after the major setup steps are done 2014-05-01 22:18:45 -04:00
Joshua Tauberer 16c0a9d342 docker: if container was launched with a tty start bash otherwise loop forever to keep the container going 2014-05-01 22:16:14 -04:00
Joshua Tauberer 7999eae857 Merge pull request #47 from randallsquared/master 
don't reject mail to domains that only have aliases and not users
 2014-05-01 18:21:19 -04:00
Joshua Tauberer 74ec3d9696 ssl: there is no need to use -des3 in key generation if we're just going to remove the passphrase 
thanks @konklone for discussion
 2014-05-01 16:47:24 -04:00
Joshua Tauberer 532c9aa7fd move the Dockerfile to the root to allow the working directory of the repo to be pushed inside the image (rather than inside the container getting a fresh mailinabox from github) so changes in the working copy can be tested in Docker quickly / without pushing to github 2014-05-01 16:39:12 -04:00
Joshua Tauberer 19f5f144ae installing roundcube from debian would cause update from ubuntu later, now install from Ubuntu debs 
We were installing .deb's from Debian. The next apt-get upgrade would cause roundcube to be upgraded.
Maybe that also triggered the installation of apache. Now install roundcube from Ubuntu. So long as
Ubuntu doesn't post an update to roundcube, at least it won't trigger an upgrade on the next
apt-get upgrade. This should also mean we don't need to purge the installation of apache2.

Also try using apt-mark hold to prevent roundcube from being updated, in case that will trigger
dependencies.
 2014-05-01 20:34:41 +00:00
Joshua Tauberer e413680f62 add a bash function ufw_allow which calls 'ufw allow' but hides its totally useless output 2014-05-01 19:35:18 +00:00
Joshua Tauberer 66269f910f make a bash function to use everywhere we apt-get-install (DEBIAN_FRONTEND=noninteractive apt-get -qq -y ) 
ensures the output is quiet
 2014-05-01 19:24:16 +00:00
Joshua Tauberer 80bf60715e Merge pull request #45 from randallsquared/master 
enable roundcube's password-change plugin
 2014-04-30 15:11:23 -04:00
Joshua Tauberer 52fe6922ee add warnings about using a fresh machine because I wont support installing this on an existing machine 2014-04-26 12:08:17 +00:00