external/mailinabox
1
0
Çatalla 0
şunun yansıması https://github.com/mail-in-a-box/mailinabox.git eşitlendi 2026-09-14 00:37:59 +02:00
Kod Konular Sürüm Viki Aktivite
774 İşleme 6 Dal 90 Etiketler
dec117d03beca7785274ef766f08aa47d9f1e652
İşleme Grafiği
100 İşleme
Bu Dal
Bu Dal
Tüm Dallar
Yazar SHA1 Mesaj Tarih
Joshua Tauberer dec117d03b securely update to a newer version by verifying the signed git tag prior to checkout 2015-06-26 05:37:32 -04:00
Joshua Tauberer cbb7f29f96 add 'ip-transparent: yes' to nsd.conf 
https://discourse.mailinabox.email/t/nsd-service-not-started-at-startup-dns-not-working/449
 2015-05-04 11:24:40 +00:00
Joshua Tauberer 8886c9b6bc move the server: block of nsd.conf out of the management daemon and into the setup scripts 2015-05-04 11:24:40 +00:00
Joshua Tauberer a07de38e80 remove workaround for buggy nsd installation 
Prior to nsd 4.0.1-1ubuntu0.1, we had to create the nsd user before installing the nsd package.

This was our issue #25 (see 4e6037c0e1, c7e1e29d) and I reported it upstream at https://bugs.launchpad.net/ubuntu/+source/nsd/+bug/1311886. The new package was published by Ubuntu on 2015-01-15 so this work-around is no longer needed.
 2015-05-04 11:24:40 +00:00
Joshua Tauberer 1f08997a9e need my new email_validator library during questions 2015-05-03 11:02:23 -04:00
Joshua Tauberer 1b2d07d81d update CHANGELOG 2015-05-03 14:33:22 +00:00
Joshua Tauberer fc32cf5bcc permit the first user account to be a domain control validation address because a) it will necessarily be an admin and b) the user doesn't know the rules yet 2015-05-03 14:21:36 +00:00
Joshua Tauberer ce94ef38b2 anonymize X-Pgp-Agent, Mime-Version outgoing mail headers; fixes #342 
I don't have a mail client that sets Mime-Version with a user agent string so I couldn't really test.
 2015-05-03 14:03:59 +00:00
Joshua Tauberer 1e9c587b92 rewrite the DNS API to permit setting multiple records of the same type on the same domain 
e.g. multiple TXT records

fixes #333
 2015-05-03 13:43:38 +00:00
Joshua Tauberer 9f1d633ae4 re-do the custom DNS get/set routines so it is possible to store more than one record for a qname-rtype pair, like multiple TXT records 2015-05-03 13:43:38 +00:00
Joshua Tauberer f01189631a management api: make json responses nicely formatted 
Better while debugging.
 2015-05-03 13:43:38 +00:00
Joshua Tauberer 542877ee46 use the font-awesome .fa-spinner.fa-pulse classes for the AJAX loading indicator, rather than the static glyphicon-time icon 2015-05-03 13:43:38 +00:00
Joshua Tauberer f1760b516d control panel: sometimes the ajax loading modal would show after operations were already done 
Needed to add the clearQueue flag to jQuery's stop() method
 2015-05-03 13:43:38 +00:00
Joshua Tauberer f0143fd6c9 bump version of my email_validator library 2015-04-29 21:18:14 +00:00
Joshua Tauberer febfa72d60 race condition between backups and status checks - connection refused 
At the end of the backup, wait a bit for dovecot and postfix to finish restarting.

Hopefully fixes #381.
 2015-04-29 21:06:38 +00:00
Joshua Tauberer c03e00035f prevent archiving of the user's own account because they'll lose access to the control panel 2015-04-28 07:17:21 -04:00
Joshua Tauberer 2f8866ef32 if there are no users at all the warning on the control panel login screen was incorrect 2015-04-28 07:17:21 -04:00
Joshua Tauberer f98afac6df if you make an API call with a user-specific API key (e.g. from control panel) but your account no longer exists on the system, there was an unhandled error 
see 1039a08be6
 2015-04-28 07:17:21 -04:00
Joshua Tauberer 5efd5abbe4 move the email address syntax validation for users and aliases into my new email_validator library (https://github.com/JoshData/python-email-validator) 2015-04-21 14:43:12 +00:00
Joshua Tauberer 6bb8f5d889 ownCloud 8 busted MOD_X_ACCEL_REDIRECT_ENABLED 
see https://github.com/owncloud/core/issues/14976

We will need to update when ownCloud makes this better with MOD_X_ACCEL_REDIRECT_PREFIX.

See https://discourse.mailinabox.email/t/owncloud-can-not-read-uploaded-data/428.
 2015-04-20 22:18:45 +00:00
Joshua Tauberer 35f4a49d10 my html5 stub was wrong; 8c3aed2846 2015-04-19 13:21:38 +00:00
Joshua Tauberer a31d713fcc stricter validation of the domain parts of email addresses: only letters, numbers, and hyphens, and the TLD ends with a letter 2015-04-19 13:06:11 +00:00
Joshua Tauberer 6f38f7afc3 update CHANGELOG 2015-04-16 12:02:17 +00:00
Joshua Tauberer e514ca0009 bump to Roundcube 1.1.1 2015-04-16 11:45:35 +00:00
Joshua Tauberer 8c3aed2846 update the control panel html template to my latest html5 stub 
jquery 1.11.1, bootstrap 3.3.0, better accessibility, see https://github.com/JoshData/html5-stub
 2015-04-11 15:40:19 -04:00
Joshua Tauberer 2cab9d5514 editconf.py: better error message if command line arguments are not valid 2015-04-11 15:25:11 -04:00
Joshua Tauberer c38bdbb0c5 mistake in 31eec9fa1c #300 2015-04-11 15:24:15 -04:00
Joshua Tauberer 2a1704a0dc check that the downloaded ownCloud and roundcube files match a known SHA1 hash 2015-04-11 15:21:38 -04:00
Joshua Tauberer 36168b4609 add a 'backup --verify' command to run duplicity's verify command to check that the backup files are OK 2015-04-11 18:43:46 +00:00
Joshua Tauberer bd498def76 backups now use duplicity's built-in gpg symmetric encryption 
Merge branch 'dhpiggott-gpg-encrypt-backups'
 2015-04-11 18:33:57 +00:00
Joshua Tauberer d8279c48ac new backup method tweaks 
* use the AES256 cipher, be explicit that only the first line of secret_key.txt is used, and sanity check that the passphrase is long enough
* change overship of the encrypted files to the user-data user
* simplify variable names in management/backup.py
* although I appreciate long comments I am trimming the commentary about the backup migration
* revise the control panel template to not refer to the old unencrypted files
* add CHANGELOG entry
 2015-04-11 18:32:22 +00:00
Joshua Tauberer 2d1186e55d increase spampd maximum message size from 64KB to 500KB, matching the spamc default 
see https://discourse.mailinabox.email/t/allow-spamassassin-to-scan-emails-larger-than-250kb/391
 2015-04-09 14:46:02 +00:00
Joshua Tauberer 072aeca1be prevent accidental domain control validation hijacking by limiting use of admin@ etc. addresses in users/aliases 2015-04-09 14:46:02 +00:00
Joshua Tauberer cb656f9ef4 in status checks replace '=>' with a Unicode arrow and tweak how aliases are reported 2015-04-09 14:46:02 +00:00
Joshua Tauberer 322a5779f1 store IDNs (internationalized domain names) in IDNA (ASCII) in our database, not in Unicode 
I changed my mind. In 1bf8f1991f I allowed Unicode domain names to go into the database. I thought that was nice because it's what the user *means*. But it's not how the web works. Web and DNS were working, but mail wasn't. Postfix (as shipped with Ubuntu 14.04 without support for SMTPUTF8) exists in an ASCII-only world. When it goes to the users/aliases table, it queries in ASCII (IDNA) only and had no hope of delivering mail if the domain was in full Unicode in the database. I was thinking ahead to SMTPUTF8, where we *could* put Unicode in the database (though that would prevent IDNA-encoded addressing from being deliverable) not realizing it isn't well supported yet anyway.

It's IDNA that goes on the wire in most places anyway (SMTP without SMTPUTF8 (and therefore how Postfix queries our users/aliases tables), DNS zone files, nginx config, CSR 'CN' field, X509 Common Name and Subject Alternative Names fields), so we should really be talking in terms of IDNA (i.e. ASCII).

This partially reverts commit 1bf8f1991f, where I added a lot of Unicode=>IDNA conversions when writing configuration files. Instead I'm doing Unicode=>IDNA before email addresses get into the users/aliases table. Now we assume the database uses IDNA-encoded ASCII domain names. When adding/removing aliases, addresses are converted to ASCII (w/ IDNA). User accounts must be ASCII-only anyway because of Dovecot's auth limitations, so we don't do any IDNA conversion (don't want to change the user's login info behind their back!). The aliases control panel page converts domains back to Unicode for display to be nice. The status checks converts the domains to Unicode just for the output headings.

A migration is added to convert existing aliases with Unicode domains into IDNA. Any custom DNS or web settings with Unicode may need to be changed.

Future support for SMTPUTF8 will probably need to add columns in the users/aliases table so that it lists both IDNA and Unicode forms.
 2015-04-09 14:46:02 +00:00
Joshua Tauberer e41df28bf2 if a migration fails, dont continue setup 2015-04-09 14:46:02 +00:00
Joshua Tauberer d3239b49ce Merge pull request #372 from hnk/fix-spaces_in_password 
fix(read_password): regex check for spaces, quotes
 2015-04-09 09:08:31 -04:00
Joshua Tauberer d11be61d94 Add POP3S support (merge w/ adjustments) 
* Add pop3s to the ufw firewall rules.
* Updated some comments.
* Updated CHANGELOG.

Merge branch 'master' of https://github.com/pichak/mailinabox
 2015-04-09 08:19:20 -04:00
Joshua Tauberer 5aa0bf2d14 add instructions for verifying the signed tags to the README 2015-04-01 10:38:09 -04:00
Joshua Tauberer f3ad6b4acc Version 0.08 
CHANGELOG
=========

v0.08 (April 1, 2015)
---------------------

Mail:

* The Roundcube vacation_sieve plugin by @arodier is now installed to make it easier to set vacation auto-reply messages from within Roundcube.
* Authentication-Results headers for DMARC, added in v0.07, were mistakenly added for outbound mail --- that's now removed.
* The Trash folder is now created automatically for new mail accounts, addressing a Roundcube error.

DNS:

* Custom DNS TXT records were not always working and they can now override the default SPF, DKIM, and DMARC records.

System:

* ownCloud updated to version 8.0.2.
* Brute-force SSH and IMAP login attempts are now prevented by properly configuring fail2ban.
* Status checks are run each night and any changes from night to night are emailed to the box administrator (the first user account).

Control panel:

* The new check that system services are running mistakenly checked that the Dovecot Managesieve service is publicly accessible. Although the service binds to the public network interface we don't open the port in ufw. On some machines it seems that ufw blocks the connection from the status checks (which seems correct) and on some machines (mine) it doesn't, which is why I didn't notice the problem.
* The current backup chain will now try to predict how many days until it is deleted (always at least 3 days after the next full backup).
* The list of aliases that forward to a user are removed from the Mail Users page because when there are many alises it is slow and times-out.
* Some status check errors are turned into warnings, especially those that might not apply if External DNS is used.
 2015-04-01 10:14:34 -04:00
Joshua Tauberer ec039719de prevent caching of ajax responses in the control panel 
GET requests might be cached. Definitely happens on Internet Explorer. Makes it look like the user is getting unauthorized access.

See https://discourse.mailinabox.email/t/fresh-install-can-login-to-webmail-but-not-admin/394/4.
 2015-03-31 14:52:11 +00:00
Joshua Tauberer 14b16b2f36 allow custom DNS TXT records for SPF, DKIM, and DMARC to override the ones we want to set 
fixes #323
fixes #324
 2015-03-30 01:20:03 +00:00
Joshua Tauberer cbc7e280d6 set the SPF record after custom DNS records so that the SPF record doesn't prevent all custom TXT records from coming in 2015-03-30 01:18:05 +00:00
Joshua Tauberer f4fa9c93a0 Merge pull request #366 from hnk/hnk-patch-read_password 
Change read_password() logic to catch short passwords
 2015-03-29 14:12:07 -04:00
Joshua Tauberer 3d21f2223e status checks: turn missing DNSSEC into a warning instead of an error; omit an error about missing TLSA if DNSSEC isn't in use; if DNSSEC is in use, make a missing TLSA record a warning instead of an error 2015-03-28 11:24:05 -04:00
Joshua Tauberer 710a69b812 turn some nameserver status check errors into warnings if the domain resolves correctly since the user might be using External DNS, closes #330 2015-03-28 11:23:59 -04:00
Joshua Tauberer dd6a8d9998 upgrade to ownCloud 8.0.2 
The contacts and calendar apps are now maintained outside of ownCloud core, so we now pull them in from github tags and must enable them explicitly.
 2015-03-28 11:08:57 -04:00
Joshua Tauberer 9f32e5af0a the install of roundcube vacation_sieve requires that we install git 
see a8669197dd
 2015-03-28 09:54:52 -04:00
Joshua Tauberer 298e19598b small bug in the new system status checks show-changes command 
see 4d22fb9b2a

fixes #360
 2015-03-22 14:03:12 +00:00
Joshua Tauberer 680191d7cb drop the list of aliases from the users control panel page because with more than 50 aliases it seems to be so slow it times out 
see https://discourse.mailinabox.email/t/small-bug-in-admin-panel-when-49-aliases/378
 2015-03-22 13:59:05 +00:00
Joshua Tauberer 81d6d69b85 update CHANGELOG 2015-03-22 13:58:24 +00:00
Joshua Tauberer 6df72bf4ac create the Trash folder on new user creation (fixes #359) 2015-03-22 13:33:17 +00:00
Joshua Tauberer 01f2451349 provide a better error message when creating a user account with non-ASCII characters 2015-03-22 12:33:06 +00:00
Joshua Tauberer dcd971d079 the opendmarc miter should run on incoming mail only 
I added OpenDMARC's milter in fba4d4702e. But this started
setting Authentication-Results headers on outbound mail with failures. Not sure why it
fails at that point, but it shouldn't be set at all. The failure might cause recipients
to junk the mail. See #358.

This commit removes the milter from the SMTP submission (port 587) listener.
 2015-03-21 16:14:01 +00:00
Joshua Tauberer 4d22fb9b2a run status checks each night and email the administrator with the changes from the previous day's results 2015-03-21 16:02:42 +00:00
Joshua Tauberer c18d58b13f backups: predict when the next backup will occur 2015-03-21 15:22:45 +00:00
Joshua Tauberer b539c2df70 Merge pull request #347 from Toilal/feat/start-enhancements 
If the migration file is missing but the storage directory exists, assume this is a fresh directory -- don't bother trying to migrate, and do write the migration file with the current migration ID.
 2015-03-19 11:57:24 -04:00
Joshua Tauberer a8669197dd added Roundcube plugin vacation_sieve 
Merge branch 'master' of https://github.com/zealot128-os/mailinabox

Closes #334
 2015-03-08 19:15:20 +00:00
Joshua Tauberer 2412c92772 enable fail2ban for ssh and dovecot 
Merge branch 'master' of https://github.com/h8h/mailinabox

see #353, #319
 2015-03-08 18:40:17 +00:00
Joshua Tauberer 7c0ca42145 status checks: don't check that dovecot-sieve is publicly accessible 2015-03-08 18:35:33 +00:00
Joshua Tauberer e2fa01e0cf Merge pull request #348 from benschumacher/master 
Update MX records using DNS Update API / Management UI
 2015-03-04 13:42:02 -05:00
Joshua Tauberer 1be0f39be0 prep for v0.07 tag 2015-02-28 17:09:12 -05:00
Joshua Tauberer d01001f2a5 some more CHANGELOG entries 2015-02-28 17:06:09 -05:00
Joshua Tauberer 7c85694d60 Merge pull request #332 from mathuin/better-mx-check 
Changed MX check to respect priorities other than 10.
 2015-02-23 07:56:24 -05:00
Joshua Tauberer 7ec662c83f status checks: use a worker pool that lives across flask requests, see #327 2015-02-18 16:42:33 +00:00
Joshua Tauberer 348d2b8701 Merge pull request #326 from dhpiggott/custom-dns-filter-secondary-nameserver 
Do not show '_secondary_nameserver' in Custom DNS table
 2015-02-17 08:31:34 -05:00
Joshua Tauberer 449a538e6b if a CNAME is set for a domain, don't create a website for that domain (just like A/AAAA records) 2015-02-17 00:48:26 +00:00
Joshua Tauberer 3c50c9a18b when serving a 'www.' domain, check if the parent domain's ssl certificate can be used besides checking PRIMARY_HOSTNAME 
Removing buy_certificate.py which is not working and I don't want to update its call signatures.
 2015-02-17 00:42:25 +00:00
Joshua Tauberer 3c10ec70a5 update comment 2015-02-17 00:08:04 +00:00
Joshua Tauberer 1a59f343c0 adding entries to the CHANGELOG 2015-02-16 23:58:17 +00:00
Joshua Tauberer fba4d4702e install opendmarc to add Authentication-Results headers for DMARC too 2015-02-16 23:17:44 +00:00
Joshua Tauberer 143bbf37f4 all mail domains, not just (top-level) zones, must have an entry in the opendkim key tables so that such outgoing mail gets signed 
If you had both x.y.com and y.com configured here, x.y.com mail would not get DKIM-signed.
 2015-02-16 18:13:51 -05:00
Joshua Tauberer fd3ad267ba if a domain has a catch-all or domain alias then we no longer force the creation of postmaster@ and so we should not be checking for its existence in the status checks 
see 85a40da83c
 2015-02-15 19:07:10 -05:00
Joshua Tauberer 330583f71d status checks: if a service isn't available publicly, check if it is available on the loopback interface to distinguish not running from not accessible 2015-02-13 09:30:25 -05:00
Joshua Tauberer d775f90f0c prevent apt from asking the user any questions 
Add additional options to really prevent apt from asking questions, which causes setup to hang because stdin/out have been redirected.

fixes #270, #291
 2015-02-13 13:41:52 +00:00
Joshua Tauberer e096144713 Outlook 2007 or later on Windows 7 and later 
fixes #308
 2015-02-13 13:29:01 +00:00
Joshua Tauberer 7ce30ba888 roundcube 1.1.0 2015-02-13 13:22:46 +00:00
Joshua Tauberer 6a3ec1d874 updating CHANGELOG 2015-02-13 13:20:55 +00:00
Joshua Tauberer 575d3a66c6 more on being smarter about waiting for the management daemon to start 
cc333b3965 worked for fresh systems, but if the system already had the daemon running the api.key file would already exist and the test would pass to early. Now removing the file first.

fixes #322
 2015-02-13 13:11:03 +00:00
Joshua Tauberer cc333b3965 be smarter about waiting for the management daemon to start before accessing it 2015-02-10 10:03:07 -05:00
Joshua Tauberer 351758b3bd typo 
typo in "roudcube"
 2015-02-10 09:27:36 -05:00
Joshua Tauberer 94053d8432 Merge pull request #317 from bizonix/master 
Disable viewing dotfiles (.htaccess, .svn, .git, etc.)
 2015-02-09 12:53:32 -05:00
Joshua Tauberer 150611123a typo/text tweak 2015-02-05 09:17:48 -05:00
Joshua Tauberer abfc17ee62 web admin: simplify the instructions for creating a separate web directory for particular sites by moving it into a modal 2015-02-05 09:12:55 -05:00
Joshua Tauberer 97be9c94b9 if the user has set a http proxy or redirect on the root path of a domain, using custom.yaml, skip the domain from the static hosting panel because it wont be serving any static files 2015-02-05 08:55:57 -05:00
Joshua Tauberer 21b00e8fbb if a custom A record is set, dont put in a default AAAA record pointing to the box because it will probably be wrong --- the user should either set an AAAA record or let the domain not resolve on IPv6 2015-02-03 21:51:19 -05:00
Joshua Tauberer 01636c2e4b Merge branch 'h8h-master' 
I squashed some commits together and modified the commit message...
 2015-02-03 23:54:17 +00:00
Joshua Tauberer f945a1bc6b Merge pull request #312 from ikarus23/master 
hide nginx version an OS information for better privacy
 2015-02-01 14:25:39 -05:00
Joshua Tauberer 82e752395b Merge pull request #310 from ikarus23/master 
do better redirection from http to https
 2015-01-31 19:58:31 -05:00
Joshua Tauberer 16422b4055 adding items to the CHANGELOG 2015-01-31 21:36:37 +00:00
Joshua Tauberer b9ca74c915 implement Mozilla (e.g. Thunderbird) autoconfiguration file 
fixes #241
 2015-01-31 21:33:18 +00:00
Joshua Tauberer 7e05d7478f run status checks asynchronously so that they finish faster, since many checks are waiting on network replies and ought not to block the whole thing 2015-01-31 20:42:43 +00:00
Joshua Tauberer 8fd98d7db3 status checks: s/env['out']/output/ 2015-01-31 20:42:43 +00:00
Joshua Tauberer 1039a08be6 /admin login now issues a user-specific key for future calls (rather than providing the system-wide API key or passing the password on each request) 2015-01-31 20:42:43 +00:00
Joshua Tauberer 023b38df50 split management daemon authorization from authentication and use 'doveadm pw' rather than 'doveadm auth test' so that it is decoupled from dovecot's login mechanism 
This was done to pave the way for two-factor authentication, but that's still a ways off.
 2015-01-31 20:41:41 +00:00
Joshua Tauberer 3187053b3a dont save the CSR generated to make self-signed certificates for non-primary domains (it has no value and might be confusing) 2015-01-31 13:27:06 +00:00
Joshua Tauberer a3e526e818 Merge pull request #307 from pierreozoux/master 
Typo
 2015-01-29 12:52:37 -05:00
Joshua Tauberer d075113c1a Merge pull request #306 from dhpiggott/fix-backup-typos 
Fix typos in backup status template
 2015-01-29 08:22:44 -05:00
Joshua Tauberer 624cc7876a Merge pull request #297 from kurthuwig/fix_typo 
Fix typo in mail-guide.html
 2015-01-21 08:52:39 -05:00
Joshua Tauberer 85a40da83c catch-all aiases and domain aliases should not require postmaster@ and admin@ aliases because they'll forward anyway 2015-01-19 23:32:36 +00:00