external/mailinabox
1
0
Fork 0
mirror of https://github.com/mail-in-a-box/mailinabox.git synced 2026-09-13 00:28:01 +02:00
Code Issues Releases Wiki Activity
1,441 Commits 6 Branches 90 Tags
d2ccf56adb746e75541844424a403472f4988de9
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Joshua Tauberer 00c61dbcdd changelog entry for migration to Nextcloud 2017-04-02 07:53:56 -04:00
Joshua Tauberer 10bf40250b merge #1121 - migration from ownCloud to Nextcloud 
branch 'nextcloud' of https://github.com/yeah/mailinabox
 2017-04-02 07:47:31 -04:00
Joshua Tauberer 453091f1fb v0.22 released 2017-04-02 07:34:14 -04:00
Joshua Tauberer 255a65ac98 suppress rmcarddav's php version check 
Since it says "RCMCardDAV requires at least PHP 5.6.18. Older versions might work", let's hope for the best.

Also hiding its preferences panel in settings since if it doesn't work, we don't want folks using it for anything but connecting to ownCloud contacts.
 2017-03-27 08:18:05 -04:00
Joshua Tauberer 653cb7ce10 roundcube 1.2.4, persistent login plugin 2017-03-26 09:50:00 -04:00
Joshua Tauberer d7d8964afc changlog entries 2017-03-26 09:31:35 -04:00
Joshua Tauberer 2c86fa3755 merge v0.21c hot fix release 2017-02-01 11:26:32 -05:00
Joshua Tauberer 3c05fc94ff v0.21c 2017-02-01 11:01:11 -05:00
Joshua Tauberer 2e00530944 upgrade acme package 2017-02-01 11:01:11 -05:00
Joshua Tauberer 32d6728dc9 fix pip breaking due to setuptools/pip/cryptography problem 
pip<6.1 + setuptools>=34 have a problem with packages that
try to update setuptools during installation, like cryptography.
See https://github.com/pypa/pip/issues/4253. The Ubuntu 14.04
package versions are pip 1.5.4 and setuptools 3.3. When we
install cryptography under those versions, it tries to update
setuptools to version 34, which became available about 10 days
ago, and then pip gets permanently broken with errors like
"ImportError: No module named 'packaging'".

The easiest work-around on systems that aren't already broken is
to upgrade pip and setuptools individually before we install any
package that tries to update setuptools.

Also try to detect a broken system and forcibly remove setuptools
first before trying to install/upgrade pip.

fixes #1080, fixes #1081, fixes #1086
see #1083
see https://discourse.mailinabox.email/t/error-with-pip-and-python/1880
see https://discourse.mailinabox.email/t/error-installing-mib/1875
 2017-02-01 10:29:28 -05:00
Joshua Tauberer a24977a96e normalize_ip for ipv6 still not correct, was broken if box has no IPv6 address 2017-01-18 07:51:59 -05:00
Joshua Tauberer e694f57673 changelog entries 2017-01-15 11:23:59 -05:00
Joshua Tauberer cd59de6314 update roundcube to 1.2.3 2017-01-15 11:17:17 -05:00
Joshua Tauberer a081d04082 move the custom exclusive process code from utils.py into a new python package named exclusiveprocess 2017-01-15 11:02:23 -05:00
Joshua Tauberer 99d0afd650 secondary nameserver check fails if domain has custom DNS (round-robin) multiple A records 
fixes #834
 2016-12-07 07:02:52 -05:00
Joshua Tauberer cd717ec94e nightly TLS certificate provisioning should omit warnings about domains it cant provision for 2016-12-07 07:02:52 -05:00
Joshua Tauberer 0b7f477b96 merge hot-fix release v0.21b 2016-12-05 17:36:32 -05:00
Joshua Tauberer ab2367e98a v0.21b 2016-12-05 17:36:11 -05:00
Joshua Tauberer e03b071e8b missed changelog header 2016-11-30 12:50:38 -05:00
Joshua Tauberer df93d82d0f v0.21 released 2016-11-30 12:42:24 -05:00
Joshua Tauberer 96b3a29800 rsync backup broke other things 2016-11-12 09:59:06 -05:00
Joshua Tauberer abb6a1a070 changelog entries 2016-11-12 09:34:52 -05:00
Joshua Tauberer 9331dbc519 merge z-push-from-name #940 2016-10-08 14:32:57 -04:00
Joshua Tauberer 4e4fe90fc7 v0.20 2016-09-23 07:49:13 -04:00
Joshua Tauberer 3cd5a6eee7 changelog entries 2016-09-23 07:46:01 -04:00
Joshua Tauberer c26bc841a2 more for dnspython exception with IPv6 addresses 
fixes #945, corrects prev commit (#947) in case of multiple AAAA records, adds changelog
 2016-09-23 07:41:24 -04:00
Joshua Tauberer 58541c467f merge #936 - fix wonky free disk space messages - from cmsirbu/master 
fix status_checks.py free disk space reporting, fixes #932
 2016-09-16 07:31:57 -04:00
Joshua Tauberer d73d1c6900 changelog typos 2016-08-24 07:47:55 -04:00
Joshua Tauberer fc0abd5b4d confirm that fail2ban is protecting pop3s, closes #629 2016-08-22 19:18:23 -04:00
Joshua Tauberer 27b4edfc76 merge v0.19b hot fix release 2016-08-20 11:50:26 -04:00
Joshua Tauberer ba75ff7820 v0.19b 2016-08-20 11:48:08 -04:00
Joshua Tauberer a14b17794b simplify how munin-cgi-graph is called to reduce the attack surface area 
Seems like if REQUEST_METHOD is set to GET, then we can drop two redundant ways the query string is given. munin-cgi-graph itself reads the environment variables only, but its calls to Perl's CGI::param will look at the command line if REQUEST_METHOD is not used, otherwise it uses environment variables like CGI used to work.

Since this is all behind admin auth anyway, there isn't a public vulnerability. #914 was opened without comment which lead me to notice the redundancy and worry about a vulnerability, before I realized this is admin-only anyway.

The vulnerability was created by 6d6f3ea391.

See #914.

This is the v0.19b hotfix commit.
 2016-08-20 11:47:44 -04:00
Joshua Tauberer 35a360ef0b simplify how munin-cgi-graph is called to reduce the attack surface area 
Seems like if REQUEST_METHOD is set to GET, then we can drop two redundant ways the query string is given. munin-cgi-graph itself reads the environment variables only, but its calls to Perl's CGI::param will look at the command line if REQUEST_METHOD is not used, otherwise it uses environment variables like CGI used to work.

Since this is all behind admin auth anyway, there isn't a public vulnerability. #914 was opened without comment which lead me to notice the redundancy and worry about a vulnerability, before I realized this is admin-only anyway.
 2016-08-19 12:42:43 -04:00
Joshua Tauberer 86457e5bc4 merge: fail2ban broke, released v0.19a 2016-08-18 08:39:31 -04:00
Joshua Tauberer 7c9f3e0b23 v0.19a 2016-08-18 08:36:28 -04:00
Joshua Tauberer 83d8dbca3e fail2ban won't start until the roundcube log file is created 
fixes #911
 2016-08-18 08:32:14 -04:00
Joshua Tauberer 8cf2e468bd [merge #900] Adding a Code of Conduct 
Merge pull request #900 from mail-in-a-box/code_of_conduct
 2016-08-15 20:10:37 -04:00
Joshua Tauberer 440a545010 some improvements suggested by the community 2016-08-15 20:09:05 -04:00
Joshua Tauberer e9368de462 [merge #902] Upgrade ownCloud from 8.2.3 to 8.2.7 
Merge https://github.com/mar1u5/mailinabox

fixes #901
 2016-08-13 17:36:08 -04:00
Joshua Tauberer cdd0a821eb v0.19 
closes #898
 2016-08-13 17:27:10 -04:00
Joshua Tauberer d38b732b0a add a Code of Conduct 2016-08-08 08:19:42 -04:00
Joshua Tauberer 81b5af6b64 document fail2ban filters in security.md 2016-08-08 07:55:46 -04:00
Joshua Tauberer fc5cc9753b roundcube 1.2.1 2016-08-08 07:32:02 -04:00
Joshua Tauberer 1aca6fe08f some minor tweaks to the new users/aliases API documentation 2016-08-08 07:28:10 -04:00
Joshua Tauberer cf3e1cd595 add SRV records for CardDAV/CalDAV 
DavDroid's latest version's account configuration no longer just asked for a hostname. Its email address & password configuration mode did not work without a SRV record.
 2016-07-31 20:53:57 -04:00
Joshua Tauberer b044dda28f put the ufw status checks in the network section, add a punctuation mark, add changelog entry 2016-07-29 09:23:36 -04:00
Joshua Tauberer f66f39b61d Merge branch 'ufw_status_check' of https://github.com/yodax/mailinabox 2016-07-29 09:16:22 -04:00
Joshua Tauberer 6de7d59f14 changelog entries 2016-07-29 09:12:01 -04:00
Joshua Tauberer cbc4bf553d Merge pull request #880 from schlypel/master 
Added information about API endpoints
 2016-07-29 09:04:27 -04:00
Joshua Tauberer 8844a9185f Merge pull request #798 from mail-in-a-box/fail2banjails 
add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon
 2016-07-29 08:52:44 -04:00
Joshua Tauberer 82903cd09e Merge pull request #857 from biermeester/master 
Small extension to mail log management script
 2016-06-27 06:17:16 -04:00
Joshua Tauberer 5f5f00af4a for DANE, the smtp_tls_mandatory_protocols setting seems like it also needs to be set (unlike the cipher settings, this isn't documented to be in addition to the non-mandatory setting) 2016-06-12 09:11:55 -04:00
Joshua Tauberer 6b73bb5d80 outbound SMTP connections should use the same TLS settings as inbound: drop SSLv2, SSLv3, anonymous ciphers, RC4 2016-06-12 09:11:54 -04:00
Joshua Tauberer 3055f9a79c drop SSLv3, RC4 ciphers from SMTP port 25 
Per http://googleappsupdates.blogspot.ro/2016/05/disabling-support-for-sslv3-and-rc4-for.html, Google is about to do the same.

fixes #611
 2016-06-12 09:11:50 -04:00
Joshua Tauberer d5b38a27e6 run roundcube's database migration script on every update 
There hasn't been a sqlite migration yet, since Mail-in-a-Box's creation, but with Roundcube 1.2 there will be.
 2016-06-06 07:28:12 -04:00
Joshua Tauberer 6666d28c44 v0.18c 2016-06-02 15:47:45 -04:00
Joshua Tauberer 66675ff2e9 Dovecot LMTP accepted all mail regardless of whether destination was a user, broken by ae8cd4ef, fixes #852 
In the earlier commit, I added a Dovecot userdb lookup. Without a userdb lookup, Dovecot would use the password db for user lookups. With a userdb lookup we can support iterating over users.

But I forgot the WHERE clause in the query, resulting in every incoming message being accepted if the user database contained any users at all. Since the mailbox path template is the same for all users, mail was delivered correctly except that mail that should have been rejected was delivered too.
 2016-06-02 08:05:34 -04:00
Joshua Tauberer 9ee2d946b7 Merge pull request #821 from m4rcs/before-backup 
Added a pre-backup script to complement post-backup script.
 2016-05-17 19:48:14 -04:00
Joshua Tauberer 867d9c4669 v0.18b 2016-05-16 07:17:20 -04:00
Joshua Tauberer 1ad5892acd can't change roundcube's default_host setting, partially reverts 6d259a6e12 
The default_host setting is a part of the internal username key. We can't change that without causing Roundcube to create new internal user accounts.
 2016-05-16 07:14:45 -04:00
Joshua Tauberer 94b7c80792 v0.18 2016-05-15 20:41:31 -04:00
Joshua Tauberer ae8cd4efdf support 'dovecot -A' iteration of all users 2016-05-06 09:16:48 -04:00
Joshua Tauberer 6d259a6e12 use "127.0.0.1" throughout rather than mixing use of an IP address and "localhost" 
On some machines localhost is defined as something other than 127.0.0.1, and if we mix "127.0.0.1" and "localhost" then some connections won't be to to the address a service is actually running on.

This was the case with DKIM: It was running on "localhost" but Postfix was connecting to it at 127.0.0.1. (https://discourse.mailinabox.email/t/opendkim-is-not-running-port-8891/1188/12.)

I suppose "localhost" could be an alias to an IPv6 address? We don't really want local services binding on IPv6, so use "127.0.0.1" to be explicit and don't use "localhost" to be sure we get an IPv4 address.

Fixes #797
 2016-05-06 09:10:38 -04:00
Joshua Tauberer e7fffc66c7 changelog tweaks, fixes #805 2016-05-06 08:51:53 -04:00
Joshua Tauberer 6eeb107ee3 Merge #795 - Upgrade Bootstrap 3.3.5 to 3.3.6 2016-04-24 06:27:50 -04:00
Joshua Tauberer 31eefa18da Merge #793 - Hostname as Roundcube Name 2016-04-23 13:45:09 -04:00
Joshua Tauberer 20adbb51cb Merge #804 - Make clear that Let's Encrypt is reccomended! 2016-04-23 09:51:44 -04:00
Joshua Tauberer d3818d1db6 changelog entries 2016-04-13 18:42:53 -04:00
Joshua Tauberer 7a935d8385 Merge #791 - Add ownCloud 8.2.3 update to changelog 2016-04-08 08:20:06 -04:00
Joshua Tauberer 5628f8eecb Merge #773 - Set the hostname of the box during the setup 2016-04-07 09:44:39 -04:00
Joshua Tauberer 9cc5160c38 Merge #789 - Update to ownCloud v8.2.3 2016-04-07 09:32:24 -04:00
Joshua Tauberer 30c89be982 merge #771 - stop fail2ban recidive emails 
The emails were not deliverable anyway.
 2016-04-06 19:03:44 -04:00
Joshua Tauberer 853b641d1b Merge #787 - Add SRV record to the Custom DNS page 2016-04-05 07:17:12 -04:00
Joshua Tauberer 1a1d125b31 merge hotfix release tag 'v0.17c' into master 
The hotfixes were all already applied to master in original PRs. This merge merely brings over the CHANGELOG and the updated install instructions (v0.17b=>v0.17c), including to bootstrap.sh which is what triggers v0.17c being the latest release.
 2016-04-01 08:00:10 -04:00
Joshua Tauberer 86881c0107 v0.17c 2016-04-01 07:58:28 -04:00
Joshua Tauberer e65c77588e hotfix merge #776 - some owncloud paths were improperly exposed over http 2016-04-01 07:58:24 -04:00
Joshua Tauberer 3843f63416 hotfix merge #772 - yodax/generic-login-message 
Make control panel login failed messages generic - don't reveal if an email address has an account on the system.
 2016-03-31 10:46:38 -04:00
Joshua Tauberer 703e6795e8 hotfix merge #769 - update the Roundcube html5_notifier plugin from version 0.6 to 0.6.2 
fixes Roundcube getting stuck for some people, hopefully fixes #693
 2016-03-31 10:46:34 -04:00
Joshua Tauberer b3223136f4 hotfix - install roundcube from our own mirror, hosted in Josh's AWS S3 account, because sourceforge is down all the time 
fixes #750, see #701, see #370

was df92a10eba
 2016-03-31 10:35:48 -04:00
Joshua Tauberer aa1fdaddaf hotfix merge #755 - Prevent click jacking of the management interface 2016-03-31 10:34:52 -04:00
Joshua Tauberer 7fa9baf308 hotfix merge #744 - Fix for putty Line Drawing issues 2016-03-31 10:33:42 -04:00
Joshua Tauberer 36d51bbde0 merge #776 - some owncloud paths were improperly exposed over http 2016-03-31 10:20:21 -04:00
Joshua Tauberer eb8cfaab75 changelog entry for html5_notifier bump 2016-03-31 10:20:13 -04:00
Joshua Tauberer 252c35c66e Merge pull request #772 from yodax/generic-login-message 
Make control panel login failed messages generic - don't reveal if an email address has an account on the system.
 2016-03-26 09:22:02 -04:00
Joshua Tauberer 1e1c3cbd00 Merge pull request #768 from yodax/web 
Static web hosting, instructions weren't rendered
 2016-03-26 07:46:49 -04:00
Joshua Tauberer 611e9cc84d merges #769 - update the Roundcube html5_notifier plugin from version 0.6 to 0.6.2 
fixes Roundcube getting stuck for some people, hopefully fixes #693
 2016-03-26 07:43:22 -04:00
Joshua Tauberer df92a10eba install roundcube from our own mirror, hosted in Josh's AWS S3 account, because sourceforge is down all the time 
fixes #750, see #701, see #370
 2016-03-23 17:31:24 -04:00
Joshua Tauberer 74a0359cec Merge pull request #763 from Neopallium/master 
Fix creation of custom MX records.
 2016-03-23 17:22:42 -04:00
Joshua Tauberer 336b95b3d5 Merge pull request #756 from yodax/preflight_arm 
Add a preflight check for supported architecture
 2016-03-23 17:19:21 -04:00
Joshua Tauberer 56591abbc2 merge #766 - Configure bayes_file_mode in spamassassin/local.cf 2016-03-23 17:17:30 -04:00
Joshua Tauberer 313a86d0fa add changelog entry for bayes file permissions 2016-03-23 17:16:50 -04:00
Joshua Tauberer 083e3cf755 merge #757 (squashed) - add swap space to low-memory systems 2016-03-23 17:07:40 -04:00
Joshua Tauberer 3d4cabbcd5 merge #755 - Prevent click jacking of the management interface 2016-03-23 16:53:48 -04:00
Joshua Tauberer cdedaed3b0 merge #744 - Fix for putty Line Drawing issues 2016-03-23 16:51:01 -04:00
Joshua Tauberer c01f903413 edit NCURSES_NO_UTF8_ACS's comment, add changelog entry 2016-03-23 16:50:27 -04:00
Joshua Tauberer 5edefbec27 merge #735 - Allow a server to be rebooted when a reboot is required 2016-03-23 16:39:40 -04:00
Joshua Tauberer 67555679bd move the reboot button, fix grammar, refactor check for DRY, add changelog entry 2016-03-23 16:37:15 -04:00
Joshua Tauberer 546d6f0026 merge #674 - Support munin's cgi dynazoom 2016-03-23 16:10:30 -04:00
Joshua Tauberer bd86d44c8b simplify the munin_cgi wrapper / add changelog entry 2016-03-23 16:09:19 -04:00
Joshua Tauberer 65add24e2a Merge pull request #751 from yodax/wgetrc 
Add a preflight check for ~/.wgetrc
 2016-03-11 10:29:24 -05:00