v72

Merges #2511.

CHANGELOG.md

@@ -1,6 +1,70 @@
 CHANGELOG
 =========
 
+Version 72 (June 3, 2025)
+-------------------------
+
+Upgrades
+
+* Roundcube upgraded to version 1.6.11, fixing a security vulnerability.
+
+Control Panel
+
+* A warning during daily tasks related to no TLS certificates being expired is fixed.
+
+Version 71 (January 4, 2025)
+----------------------------
+
+(Version 71a was posted on January 6, 2025 and fixes a setup regression.)
+
+Upgrades
+
+* Roundcube upgraded to version 1.6.9.
+* Z-Push upgraded to version 2.7.5.
+
+Automated Maintenance
+
+* Daily automated tasks are now run at 1am in the box's timezone and full backups are now restricted to running only on Saturdays and Sundays at that time.
+* Backups now exclude the owncloud-backup folder so that we're not backing up backups.
+* Old TLS certificates are now automatically deleted to improve control panel performance.
+
+Setup
+
+* Fixed broken setup if SSH was configured to listen on multiple ports.
+* Ubuntu MOTD advertisements are now disabled.
+* Fixed missing Roundcube dependency package if NextCloud isn't installed.
+
+Control Panel
+
+* Improved status checks for secondary nameservers.
+* Spamhaus is now queried for the box's IPv6 address also.
+* DSA and EC private keys are now accepted for TLS certificates.
+* Timeouts for loading slow control panel pages are reduced.
+
+And other minor fixes.
+
+Version 70 (August 15, 2024)
+----------------------------
+
+* Roundcube is updated to version 1.6.8 fixing security vulnerabilities.
+
+Version 69 (July 20, 2024)
+--------------------------
+
+Package updates:
+
+* Nextcloud is updated to 26.0.13.
+* Z-Push is updated to 2.7.3.
+
+Other updates:
+
+* Fixed an error generating the weekly statistics.
+* Fixed file permissions when setting up Nextcloud.
+* Added an undocumented option to proxy websockets.
+* Internal improvements to the code to make it more reliable and readable.
+
+Version 69a (July 21, 2024) and 69b (July 23, 2024) correct setup failures.
+
 Version 68 (April 1, 2024)
 --------------------------
 
@@ -25,7 +89,6 @@ Other:
 * fail2ban is updated to see "HTTP/2.0" requests to munin also.
 * Internal improvements to the code to make it more reliable and readable.
 
-
 Version 67 (December 22, 2023)
 ------------------------------
 
@@ -52,7 +115,7 @@ Version 64 (September 2, 2023)
 * Fixed backups to work with the latest duplicity package which was not backwards compatible.
 * Fixed setting B2 as a backup target with a slash in the application key.
 * Turned off OpenDMARC diagnostic reports sent in response to incoming mail.
-* Fixed some crashes when using an unrelased version of Mail-in-a-Box.
+* Fixed some crashes when using an unreleased version of Mail-in-a-Box.
 * Added z-push administration scripts.
 
 Version 63 (July 27, 2023)
@@ -188,7 +251,7 @@ Other:
 
 * Set systemd journald log retention to 10 days (from no limit) to reduce disk usage.
 * Fixed log processing for submission lines that have a sasl_sender or other extra information.
-* Fix DNS secondary nameserver refesh failure retry period.
+* Fix DNS secondary nameserver refresh failure retry period.
 
 Version 55 (October 18, 2021)
 -----------------------------
@@ -213,7 +276,7 @@ Control panel:
 Other:
 
 * Fail2ban's IPv6 support is enabled.
-* The mail log tool now doesn't crash if there are email addresess in log messages with invalid UTF-8 characters.
+* The mail log tool now doesn't crash if there are email addresses in log messages with invalid UTF-8 characters.
 * Additional nsd.conf files can be placed in /etc/nsd.conf.d.
 
 v0.54 (June 20, 2021)
@@ -246,7 +309,7 @@ Setup:
 v0.53a (May 8, 2021)
 --------------------
 
-The download URL for Z-Push has been revised becaue the old URL stopped working.
+The download URL for Z-Push has been revised because the old URL stopped working.
 
 v0.53 (April 12, 2021)
 ----------------------
@@ -465,7 +528,7 @@ Changes:
 * Added support for S3-compatible backup services besides Amazon S3.
 * Fixed the control panel login page to let LastPass save passwords.
 * Fixed an error in the user privileges API.
-* Silenced some spurrious messages.
+* Silenced some spurious messages.
 
 Software updates:
 
@@ -529,7 +592,7 @@ Setup:
 
 Control Panel:
 
-* The users page now documents that passwords should only have ASCII characters to prevent character encoding mismaches between clients and the server.
+* The users page now documents that passwords should only have ASCII characters to prevent character encoding mismatches between clients and the server.
 * The users page no longer shows user mailbox sizes because this was extremely slow for very large mailboxes.
 * The Mail-in-a-Box version is now shown in the system status checks even when the new-version check is disabled.
 * The alises page now warns that alises should not be used to forward mail off of the box. Mail filters within Roundcube are better for that.
@@ -857,7 +920,7 @@ v0.17c (April 1, 2016)
 
 This update addresses some minor security concerns and some installation issues.
 
-ownCoud:
+ownCloud:
 
 * Block web access to the configuration parameters (config.php). There is no immediate impact (see [#776](https://github.com/mail-in-a-box/mailinabox/pull/776)), although advanced users may want to take note.
 
@@ -873,7 +936,7 @@ Control panel:
 Setup:
 
 * Setup dialogs did not appear correctly when connecting to SSH using Putty on Windows.
-* We now install Roundcube from our own mirror because Sourceforge's downloads experience frequent intermittant unavailability.
+* We now install Roundcube from our own mirror because Sourceforge's downloads experience frequent intermittent unavailability.
 
 v0.17b (March 1, 2016)
 ----------------------
@@ -916,7 +979,7 @@ This update primarily adds automatic SSL (now "TLS") certificate provisioning fr
 
 Control Panel:
 
-* The SSL certificates (now referred to as "TLS ccertificates") page now supports provisioning free certificates from Let's Encrypt.
+* The SSL certificates (now referred to as "TLS certificates") page now supports provisioning free certificates from Let's Encrypt.
 * Report free memory usage.
 * Fix a crash when the git directory is not checked out to a tag.
 * When IPv6 is enabled, check that all domains (besides the system hostname) resolve over IPv6.
@@ -1009,7 +1072,7 @@ Control panel:
 System:
 
 * Tweaks to fail2ban settings.
-* Fixed a spurrious warning while installing munin.
+* Fixed a spurious warning while installing munin.
 
 v0.13b (August 30, 2015)
 ------------------------
@@ -1023,7 +1086,7 @@ Note: v0.13 (no 'a', August 19, 2015) was pulled immediately due to an ownCloud
 
 Mail:
 
-* Outbound mail headers (the Recieved: header) are tweaked to possibly improve deliverability.
+* Outbound mail headers (the Received: header) are tweaked to possibly improve deliverability.
 * Some MIME messages would hang Roundcube due to a missing package.
 * The users permitted to send as an alias can now be different from where an alias forwards to.
 
@@ -1055,7 +1118,7 @@ v0.12c was posted to work around the current Sourceforge.net outage: pyzor's rem
 v0.12b (July 4, 2015)
 ---------------------
 
-This version corrects a minor regression in v0.12 related to creating aliases targetting multiple addresses.
+This version corrects a minor regression in v0.12 related to creating aliases targeting multiple addresses.
 
 v0.12 (July 3, 2015)
 --------------------
@@ -1108,7 +1171,7 @@ Control panel:
 
 System:
 * The munin system monitoring tool is now installed and accessible at /admin/munin.
-* ownCloud updated to version 8.0.4. The ownCloud installation step now is reslient to download problems. The ownCloud configuration file is now stored in STORAGE_ROOT to fix loss of data when moving STORAGE_ROOT to a new machine.
+* ownCloud updated to version 8.0.4. The ownCloud installation step now is resilient to download problems. The ownCloud configuration file is now stored in STORAGE_ROOT to fix loss of data when moving STORAGE_ROOT to a new machine.
 * The setup scripts now run `apt-get update` prior to installing anything to ensure the apt database is in sync with the packages actually available.
 
 
@@ -1146,7 +1209,7 @@ DNS:
 * Internationalized Domain Names (IDNs) should now work in email. If you had custom DNS or custom web settings for internationalized domains, check that they are still working.
 * It is now possible to set multiple TXT and other types of records on the same domain in the control panel.
 * The custom DNS API was completely rewritten to support setting multiple records of the same type on a domain. Any existing client code using the DNS API will have to be rewritten. (Existing code will just get 404s back.)
-* On some systems the `nsd` service failed to start if network inferfaces were not ready.
+* On some systems the `nsd` service failed to start if network interfaces were not ready.
 
 System / Control Panel:
 

CODE_OF_CONDUCT.md

@@ -2,13 +2,13 @@
 
 Mail-in-a-Box is an open source community project about working, as a group, to empower ourselves and others to have control over our own digital communications. Just as we hope to increase technological diversity on the Internet through decentralization, we also believe that diverse viewpoints and voices among our community members foster innovation and creative solutions to the challenges we face.
 
-We are committed to providing a safe, welcoming, and harrassment-free space for collaboration, for everyone, without regard to age, disability, economic situation, ethnicity, gender identity and expression, language fluency, level of knowledge or experience, nationality, personal appearance, race, religion, sexual identity and orientation, or any other attribute. Community comes first. This policy supersedes all other project goals.
+We are committed to providing a safe, welcoming, and harassment-free space for collaboration, for everyone, without regard to age, disability, economic situation, ethnicity, gender identity and expression, language fluency, level of knowledge or experience, nationality, personal appearance, race, religion, sexual identity and orientation, or any other attribute. Community comes first. This policy supersedes all other project goals.
 
 The maintainers of Mail-in-a-Box share the dual responsibility of leading by example and enforcing these policies as necessary to maintain an open and welcoming environment. All community members should be excellent to each other.
 
 ## Scope
 
-This Code of Conduct applies to all places where Mail-in-a-Box community activity is ocurring, including on GitHub, in discussion forums, on Slack, on social media, and in real life. The Code of Conduct applies not only on websites/at events run by the Mail-in-a-Box community (e.g. our GitHub organization, our Slack team) but also at any other location where the Mail-in-a-Box community is present (e.g. in issues of other GitHub organizations where Mail-in-a-Box community members are discussing problems related to Mail-in-a-Box, or real-life professional conferences), or whenever a Mail-in-a-Box community member is representing Mail-in-a-Box to the public at large or acting on behalf of Mail-in-a-Box.
+This Code of Conduct applies to all places where Mail-in-a-Box community activity is occurring, including on GitHub, in discussion forums, on Slack, on social media, and in real life. The Code of Conduct applies not only on websites/at events run by the Mail-in-a-Box community (e.g. our GitHub organization, our Slack team) but also at any other location where the Mail-in-a-Box community is present (e.g. in issues of other GitHub organizations where Mail-in-a-Box community members are discussing problems related to Mail-in-a-Box, or real-life professional conferences), or whenever a Mail-in-a-Box community member is representing Mail-in-a-Box to the public at large or acting on behalf of Mail-in-a-Box.
 
 This code does not apply to activity on a server running Mail-in-a-Box software, unless your server is hosting a service for the Mail-in-a-Box community at large.
 

README.md

@@ -56,11 +56,11 @@ See the [setup guide](https://mailinabox.email/guide.html) for detailed, user-fr
 
 For experts, start with a completely fresh (really, I mean it) Ubuntu 22.04 LTS 64-bit machine. On the machine...
 
-Clone this repository and checkout the tag corresponding to the most recent release:
+Clone this repository and checkout the tag corresponding to the most recent release (which you can find in the tags or releases lists on GitHub):
 
 	$ git clone https://github.com/mail-in-a-box/mailinabox
 	$ cd mailinabox
-	$ git checkout v68
+	$ git checkout TAGNAME
 
 Begin the installation.
 

conf/dovecot-mailboxes.conf

@@ -52,7 +52,7 @@ namespace inbox {
 
   # dovevot's standard mailboxes configuration file marks two sent folders
   # with the \Sent attribute, just in case clients don't agree about which
-  # they're using. We'll keep that, plus add Junk as an alterative for Spam.
+  # they're using. We'll keep that, plus add Junk as an alternative for Spam.
   # These are not auto-created.
   mailbox "Sent Messages" {
     special_use = \Sent

conf/fail2ban/jails.conf

@@ -74,7 +74,7 @@ action   = iptables-allports[name=recidive]
 # The last line on the action will sent an email to the configured address. This mail will
 # notify the administrator that someone has been repeatedly triggering one of the other jails.
 # By default we don't configure this address and no action is required from the admin anyway.
-# So the notification is ommited. This will prevent message appearing in the mail.log that mail
+# So the notification is omitted. This will prevent message appearing in the mail.log that mail
 # can't be delivered to fail2ban@$HOSTNAME.
 
 [postfix-sasl]

conf/nginx-alldomains.conf

@@ -37,7 +37,7 @@
 		return 403;
 	}
 	location ~ /mail/.*\.php {
-		# note: ~ has precendence over a regular location block
+		# note: ~ has precedence over a regular location block
 		include fastcgi_params;
 		fastcgi_split_path_info ^/mail(/.*)()$;
 		fastcgi_index index.php;

conf/nginx-primaryonly.conf

@@ -38,7 +38,7 @@
 		}
 	}
 	location ~ ^(/cloud)((?:/ocs)?/[^/]+\.php)(/.*)?$ {
-		# note: ~ has precendence over a regular location block
+		# note: ~ has precedence over a regular location block
 		# Accept URLs like:
 		# /cloud/index.php/apps/files/
 		# /cloud/index.php/apps/files/ajax/scan.php (it's really index.php; see 6fdef379adfdeac86cc2220209bdf4eb9562268d)

management/backup.py

@@ -9,13 +9,14 @@
 
 import os, os.path, re, datetime, sys
 import dateutil.parser, dateutil.relativedelta, dateutil.tz
+from datetime import date
 import rtyaml
 from exclusiveprocess import Lock
 
 from utils import load_environment, shell, wait_for_service
 
 def backup_status(env):
-	# If backups are dissbled, return no status.
+	# If backups are disabled, return no status.
 	config = get_backup_config(env)
 	if config["target"] == "off":
 		return { }
@@ -157,6 +158,8 @@ def should_force_full(config, env):
 	# since the last full backup is greater than half the size
 	# of that full backup.
 	inc_size = 0
+	# Check if day of week is a weekend day
+	weekend = date.today().weekday()>=5
 	for bak in backup_status(env)["backups"]:
 		if not bak["full"]:
 			# Scan through the incremental backups cumulating
@@ -165,8 +168,10 @@ def should_force_full(config, env):
 		else:
 			# ...until we reach the most recent full backup.
 			# Return if we should to a full backup, which is based
-			# on the size of the increments relative to the full
-			# backup, as well as the age of the full backup.
+			# on whether it is a weekend day, the size of the
+			# increments relative to the full backup, as well as
+			# the age of the full backup.
+			if weekend:
 				if inc_size > .5*bak["size"]:
 					return True
 				if dateutil.parser.parse(bak["date"]) + datetime.timedelta(days=config["min_age_in_days"]*10+1) < datetime.datetime.now(dateutil.tz.tzlocal()):
@@ -320,6 +325,7 @@ def perform_backup(full_backup):
 			"--verbosity", "warning", "--no-print-statistics",
 			"--archive-dir", backup_cache_dir,
 			"--exclude", backup_root,
+			"--exclude", os.path.join(env["STORAGE_ROOT"], "owncloud-backup"),
 			"--volsize", "250",
 			"--gpg-options", "'--cipher-algo=AES256'",
 			"--allow-source-mismatch",
@@ -399,6 +405,7 @@ def run_duplicity_verification():
 		"--compare-data",
 		"--archive-dir", backup_cache_dir,
 		"--exclude", backup_root,
+		"--exclude", os.path.join(env["STORAGE_ROOT"], "owncloud-backup"),
 		*get_duplicity_additional_args(env),
 		get_duplicity_target_url(config),
 		env["STORAGE_ROOT"],

management/dns_update.py

@@ -15,7 +15,7 @@ import contextlib
 
 # From https://stackoverflow.com/questions/3026957/how-to-validate-a-domain-name-using-regex-php/16491074#16491074
 # This regular expression matches domain names according to RFCs, it also accepts fqdn with an leading dot,
-# underscores, as well as asteriks which are allowed in domain names but not hostnames (i.e. allowed in
+# underscores, as well as asterisks which are allowed in domain names but not hostnames (i.e. allowed in
 # DNS but not in URLs), which are common in certain record types like for DKIM.
 DOMAIN_RE = r"^(?!\-)(?:[*][.])?(?:[a-zA-Z\d\-_]{0,62}[a-zA-Z\d_]\.){1,126}(?!\d+)[a-zA-Z\d_]{1,63}(\.?)$"
 
@@ -443,7 +443,7 @@ def build_sshfp_records():
 
 	# Get our local fingerprints by running ssh-keyscan. The output looks
 	# like the known_hosts file: hostname, keytype, fingerprint. The order
-	# of the output is arbitrary, so sort it to prevent spurrious updates
+	# of the output is arbitrary, so sort it to prevent spurious updates
 	# to the zone file (that trigger bumping the serial number). However,
 	# if SSH has been configured to listen on a nonstandard port, we must
 	# specify that port to sshkeyscan.

management/mail_log.py

@@ -319,7 +319,7 @@ def scan_mail_log(env):
 
     if collector["other-services"] and VERBOSE and False:
         print_header("Other services")
-        print("The following unkown services were found in the log file.")
+        print("The following unknown services were found in the log file.")
         print(" ", *sorted(collector["other-services"]), sep='\n│ ')
 
 
@@ -679,7 +679,7 @@ def print_user_table(users, data=None, sub_data=None, activity=None, latest=None
                 data_accum[col] += d[row]
 
         try:
-            if None not in {latest, earliest}:
+            if None not in [latest, earliest]: # noqa PLR6201
                 vert_pos = len(line)
                 e = earliest[row]
                 l = latest[row]
@@ -732,7 +732,7 @@ def print_user_table(users, data=None, sub_data=None, activity=None, latest=None
         else:
             header += l.rjust(max(5, len(l) + 1, col_widths[col]))
 
-    if None not in {latest, earliest}:
+    if None not in [latest, earliest]: # noqa PLR6201
         header += " │ timespan   "
 
     lines.insert(0, header.rstrip())
@@ -757,7 +757,7 @@ def print_user_table(users, data=None, sub_data=None, activity=None, latest=None
         footer += temp.format(data_accum[row])
 
     try:
-        if None not in {latest, earliest}:
+        if None not in [latest, earliest]: # noqa PLR6201
             max_l = max(latest)
             min_e = min(earliest)
             timespan = relativedelta(max_l, min_e)

management/mailconfig.py

@@ -561,7 +561,7 @@ def kick(env, mail_result=None):
 
 	auto_aliases = { }
 
-	# Mape required aliases to the administrator alias (which should be created manually).
+	# Map required aliases to the administrator alias (which should be created manually).
 	administrator = get_system_administrator(env)
 	required_aliases = get_required_aliases(env)
 	for alias in required_aliases:

management/ssl_certificates.py

@@ -14,7 +14,7 @@ def get_ssl_certificates(env):
 	# that the certificates are good for to the best certificate for
 	# the domain.
 
-	from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
+	from cryptography.hazmat.primitives.asymmetric import dsa, rsa, ec
 	from cryptography.x509 import Certificate
 
 	# The certificates are all stored here:
@@ -59,13 +59,15 @@ def get_ssl_certificates(env):
 			# Not a valid PEM format for a PEM type we care about.
 			continue
 
-		# Is it a private key?
-		if isinstance(pem, RSAPrivateKey):
-			private_keys[pem.public_key().public_numbers()] = { "filename": fn, "key": pem }
-
 		# Is it a certificate?
 		if isinstance(pem, Certificate):
 			certificates.append({ "filename": fn, "cert": pem })
+		# It is a private key
+		elif (isinstance(pem, rsa.RSAPrivateKey)
+			or isinstance(pem, dsa.DSAPrivateKey)
+			or isinstance(pem, ec.EllipticCurvePrivateKey)):
+			private_keys[pem.public_key().public_numbers()] = { "filename": fn, "key": pem }
+
 
 	# Process the certificates.
 	domains = { }
@@ -434,7 +436,7 @@ def install_cert(domain, ssl_cert, ssl_chain, env, raw=False):
 			cert_status += " " + cert_status_details
 		return cert_status
 
-	# Copy certifiate into ssl directory.
+	# Copy certificate into ssl directory.
 	install_cert_copy_file(fn, env)
 
 	# Run post-install steps.
@@ -505,7 +507,7 @@ def check_certificate(domain, ssl_certificate, ssl_private_key, warn_if_expiring
 	# Check that the ssl_certificate & ssl_private_key files are good
 	# for the provided domain.
 
-	from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
+	from cryptography.hazmat.primitives.asymmetric import rsa, dsa, ec
 	from cryptography.x509 import Certificate
 
 	# The ssl_certificate file may contain a chain of certificates. We'll
@@ -539,7 +541,9 @@ def check_certificate(domain, ssl_certificate, ssl_private_key, warn_if_expiring
 		except ValueError as e:
 			return (f"The private key file {ssl_private_key} is not a private key file: {e!s}", None)
 
-		if not isinstance(priv_key, RSAPrivateKey):
+		if (not isinstance(priv_key, rsa.RSAPrivateKey)
+			and not isinstance(priv_key, dsa.DSAPrivateKey)
+			and not isinstance(priv_key, ec.EllipticCurvePrivateKey)):
 			return ("The private key file %s is not a private key file." % ssl_private_key, None)
 
 		if priv_key.public_key().public_numbers() != cert.public_key().public_numbers():
@@ -639,7 +643,7 @@ def load_pem(pem):
 		msg = "File is not a valid PEM-formatted file."
 		raise ValueError(msg)
 	pem_type = pem_type.group(1)
-	if pem_type in {b"RSA PRIVATE KEY", b"PRIVATE KEY"}:
+	if pem_type.endswith(b"PRIVATE KEY"):
 		return serialization.load_pem_private_key(pem, password=None, backend=default_backend())
 	if pem_type == b"CERTIFICATE":
 		return load_pem_x509_certificate(pem, default_backend())

management/status_checks.py

@@ -282,26 +282,45 @@ def run_network_checks(env, output):
 	# The user might have ended up on an IP address that was previously in use
 	# by a spammer, or the user may be deploying on a residential network. We
 	# will not be able to reliably send mail in these cases.
-	
-	# See https://www.spamhaus.org/news/article/807/using-our-public-mirrors-check-your-return-codes-now. for
-	# information on spamhaus return codes
 	rev_ip4 = ".".join(reversed(env['PUBLIC_IP'].split('.')))
 	zen = query_dns(rev_ip4+'.zen.spamhaus.org', 'A', nxdomain=None)
+	evaluate_spamhaus_lookup(env['PUBLIC_IP'], 'IPv4', rev_ip4, output, zen)
+
+	if not env['PUBLIC_IPV6']:
+		return
+
+	from ipaddress import IPv6Address
+
+	rev_ip6 = ".".join(reversed(IPv6Address(env['PUBLIC_IPV6']).exploded.split(':')))
+	zen = query_dns(rev_ip6+'.zen.spamhaus.org', 'A', nxdomain=None)
+	evaluate_spamhaus_lookup(env['PUBLIC_IPV6'], 'IPv6', rev_ip6, output, zen)
+
+
+def evaluate_spamhaus_lookup(lookupaddress, lookuptype, lookupdomain, output, zen):
+	# See https://www.spamhaus.org/news/article/807/using-our-public-mirrors-check-your-return-codes-now. for
+	# information on spamhaus return codes
 	if zen is None:
-		output.print_ok("IP address is not blacklisted by zen.spamhaus.org.")
+		output.print_ok(f"{lookuptype} address is not blacklisted by zen.spamhaus.org.")
 	elif zen == "[timeout]":
-		output.print_warning("Connection to zen.spamhaus.org timed out. Could not determine whether this box's IP address is blacklisted. Please try again later.")
+		output.print_warning(f"""Connection to zen.spamhaus.org timed out. Could not determine whether this box's
+		 	{lookuptype} address is blacklisted. Please try again later.""")
 	elif zen == "[Not Set]":
-		output.print_warning("Could not connect to zen.spamhaus.org. Could not determine whether this box's IP address is blacklisted. Please try again later.")
+		output.print_warning(f"""Could not connect to zen.spamhaus.org. Could not determine whether this box's
+			{lookuptype} address is blacklisted. Please try again later.""")
 	elif zen == "127.255.255.252":
-		output.print_warning("Incorrect spamhaus query: %s. Could not determine whether this box's IP address is blacklisted." % (rev_ip4+'.zen.spamhaus.org'))
+		output.print_warning(f"""Incorrect spamhaus query: {lookupdomain + '.zen.spamhaus.org'}. Could not determine whether
+		 	this box's {lookuptype} address is blacklisted.""")
 	elif zen == "127.255.255.254":
-		output.print_warning("Mail-in-a-Box is configured to use a public DNS server. This is not supported by spamhaus. Could not determine whether this box's IP address is blacklisted.")
+		output.print_warning(f"""Mail-in-a-Box is configured to use a public DNS server. This is not supported by
+			spamhaus. Could not determine whether this box's {lookuptype} address is blacklisted.""")
 	elif zen == "127.255.255.255":
-		output.print_warning("Too many queries have been performed on the spamhaus server. Could not determine whether this box's IP address is blacklisted.")
+		output.print_warning(f"""Too many queries have been performed on the spamhaus server. Could not determine
+		 	whether this box's {lookuptype} address is blacklisted.""")
 	else:
-		output.print_error("""The IP address of this machine {} is listed in the Spamhaus Block List (code {}),
-			which may prevent recipients from receiving your email. See http://www.spamhaus.org/query/ip/{}.""".format(env['PUBLIC_IP'], zen, env['PUBLIC_IP']))
+		output.print_error(f"""The {lookuptype} address of this machine {lookupaddress} is listed in the Spamhaus Block
+		 	List (code {zen}), which may prevent recipients from receiving your email. See
+		 	http://www.spamhaus.org/query/ip/{lookupaddress}.""")
+
 
 def run_domain_checks(rounded_time, env, output, pool, domains_to_check=None):
 	# Get the list of domains we handle mail for.
@@ -521,6 +540,8 @@ def check_dns_zone(domain, env, output, dns_zonefiles):
 	# Check that each custom secondary nameserver resolves the IP address.
 
 	if custom_secondary_ns and not probably_external_dns:
+		SOARecord = query_dns(domain, "SOA", at=env['PUBLIC_IP'])# Explicitly ask the local dns server.
+
 		for ns in custom_secondary_ns:
 			# We must first resolve the nameserver to an IP address so we can query it.
 			ns_ips = query_dns(ns, "A")
@@ -530,15 +551,36 @@ def check_dns_zone(domain, env, output, dns_zonefiles):
 			# Choose the first IP if nameserver returns multiple
 			ns_ip = ns_ips.split('; ')[0]
 
+			checkSOA = True
+
 			# Now query it to see what it says about this domain.
 			ip = query_dns(domain, "A", at=ns_ip, nxdomain=None)
 			if ip == correct_ip:
-				output.print_ok("Secondary nameserver %s resolved the domain correctly." % ns)
+				output.print_ok(f"Secondary nameserver {ns} resolved the domain correctly.")
 			elif ip is None:
-				output.print_error("Secondary nameserver %s is not configured to resolve this domain." % ns)
+				output.print_error(f"Secondary nameserver {ns} is not configured to resolve this domain.")
+				# No need to check SOA record if not configured as nameserver
+				checkSOA = False
+			elif ip == '[timeout]':
+				output.print_error(f"Secondary nameserver {ns} did not resolve this domain, result: {ip}")
+				checkSOA = False
 			else:
 				output.print_error(f"Secondary nameserver {ns} is not configured correctly. (It resolved this domain as {ip}. It should be {correct_ip}.)")
 
+			if checkSOA:
+				# Check that secondary DNS server is synchronized with our primary DNS server. Simplified by checking the SOA record which has a version number
+				SOASecondary = query_dns(domain, "SOA", at=ns_ip)
+
+				if SOARecord == SOASecondary:
+					output.print_ok(f"Secondary nameserver {ns} has consistent SOA record.")
+				elif SOARecord == '[Not Set]':
+					output.print_error(f"Secondary nameserver {ns} has no SOA record configured.")
+				elif SOARecord == '[timeout]':
+					output.print_error(f"Secondary nameserver {ns} timed out on checking SOA record.")
+				else:
+					output.print_error(f"""Secondary nameserver {ns} has inconsistent SOA record (primary: {SOARecord} versus secondary: {SOASecondary}).
+					Check that synchronization between secondary and primary DNS servers is properly set-up.""")
+
 def check_dns_zone_suggestions(domain, env, output, dns_zonefiles, domains_with_a_records):
 	# Warn if a custom DNS record is preventing this or the automatic www redirect from
 	# being served.

management/templates/index.html

@@ -73,7 +73,7 @@
           filter: invert(100%) hue-rotate(180deg);
         }
 
-        /* Override Boostrap theme here to give more contrast. The black turns to white by the filter. */
+        /* Override Bootstrap theme here to give more contrast. The black turns to white by the filter. */
         .form-control {
           color: black !important;
         }

management/templates/system-backup.html

@@ -361,7 +361,7 @@ function init_inputs(target_type) {
 }
 
 // Return a two-element array of the substring preceding and the substring following
-// the first occurence of separator in string. Return [undefined, string] if the
+// the first occurrence of separator in string. Return [undefined, string] if the
 // separator does not appear in string.
 const split1_rest = (string, separator) => {
     const index = string.indexOf(separator);

management/utils.py

@@ -189,6 +189,7 @@ def get_ssh_port():
 
 def get_ssh_config_value(parameter_name):
 	# Returns ssh configuration value for the provided parameter
+	import subprocess
 	try:
 		output = shell('check_output', ['sshd', '-T'])
 	except FileNotFoundError:

management/web_update.py

@@ -166,6 +166,7 @@ def make_domain_config(domain, templates, ssl_certificates, env):
 				pass_http_host_header = False
 				proxy_redirect_off = False
 				frame_options_header_sameorigin = False
+				web_sockets = False
 				m = re.search("#(.*)$", url)
 				if m:
 					for flag in m.group(1).split(","):
@@ -175,6 +176,8 @@ def make_domain_config(domain, templates, ssl_certificates, env):
 							proxy_redirect_off = True
 						elif flag == "frame-options-sameorigin":
 							frame_options_header_sameorigin = True
+						elif flag == "web-sockets":
+							web_sockets = True
 					url = re.sub("#(.*)$", "", url)
 
 				nginx_conf_extra += "\tlocation %s {" % path
@@ -185,6 +188,10 @@ def make_domain_config(domain, templates, ssl_certificates, env):
 					nginx_conf_extra += "\n\t\tproxy_set_header Host $http_host;"
 				if frame_options_header_sameorigin:
 					nginx_conf_extra += "\n\t\tproxy_set_header X-Frame-Options SAMEORIGIN;"
+				if web_sockets:
+					nginx_conf_extra += "\n\t\tproxy_http_version 1.1;"
+					nginx_conf_extra += "\n\t\tproxy_set_header Upgrade $http_upgrade;"
+					nginx_conf_extra += "\n\t\tproxy_set_header Connection 'Upgrade';"
 				nginx_conf_extra += "\n\t\tproxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;"
 				nginx_conf_extra += "\n\t\tproxy_set_header X-Forwarded-Host $http_host;"
 				nginx_conf_extra += "\n\t\tproxy_set_header X-Forwarded-Proto $scheme;"

setup/bootstrap.sh

@@ -23,7 +23,7 @@ if [ -z "$TAG" ]; then
 	if [ "$UBUNTU_VERSION" == "Ubuntu 22.04 LTS" ]; then
 		# This machine is running Ubuntu 22.04, which is supported by
 		# Mail-in-a-Box versions 60 and later.
-		TAG=v68
+		TAG=v72
 	elif [ "$UBUNTU_VERSION" == "Ubuntu 18.04 LTS" ]; then
 		# This machine is running Ubuntu 18.04, which is supported by
 		# Mail-in-a-Box versions 0.40 through 5x.

setup/dkim.sh

@@ -66,7 +66,7 @@ tools/editconf.py /etc/opendmarc.conf -s \
 	"FailureReports=false"
 
 # SPFIgnoreResults causes the filter to ignore any SPF results in the header
-# of the message. This is useful if you want the filter to perfrom SPF checks
+# of the message. This is useful if you want the filter to perform SPF checks
 # itself, or because you don't trust the arriving header. This added header is
 # used by spamassassin to evaluate the mail for spamminess.
 

setup/dns.sh

@@ -101,7 +101,7 @@ if [ ! -f "$STORAGE_ROOT/dns/dnssec/$algo.conf" ]; then
 	# we're capturing into the `KSK` variable.
 	#
 	# ldns-keygen uses /dev/random for generating random numbers by default.
-	# This is slow and unecessary if we ensure /dev/urandom is seeded properly,
+	# This is slow and unnecessary if we ensure /dev/urandom is seeded properly,
 	# so we use /dev/urandom. See system.sh for an explanation. See #596, #115.
 	# (This previously used -b 2048 but it's unclear if this setting makes sense
 	# for non-RSA keys, so it's removed. The RSA-based keys are not recommended

setup/firstuser.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # If there aren't any mail users yet, create one.
 if [ -z "$(management/cli.py user)" ]; then
-	# The outut of "management/cli.py user" is a list of mail users. If there
+	# The output of "management/cli.py user" is a list of mail users. If there
 	# aren't any yet, it'll be empty.
 
 	# If we didn't ask for an email address at the start, do so now.
@@ -48,7 +48,7 @@ if [ -z "$(management/cli.py user)" ]; then
 	fi
 
 	# Create the user's mail account. This will ask for a password if none was given above.
-	management/cli.py user add "$EMAIL_ADDR" "${EMAIL_PW:-}"
+	management/cli.py user add "$EMAIL_ADDR" ${EMAIL_PW:+"$EMAIL_PW"}
 
 	# Make it an admin.
 	hide_output management/cli.py user make-admin "$EMAIL_ADDR"

setup/mail-postfix.sh

@@ -37,7 +37,7 @@ source /etc/mailinabox.conf # load global vars
 # * `postfix`: The SMTP server.
 # * `postfix-pcre`: Enables header filtering.
 # * `postgrey`: A mail policy service that soft-rejects mail the first time
-#   it is received. Spammers don't usually try agian. Legitimate mail
+#   it is received. Spammers don't usually try again. Legitimate mail
 #   always will.
 # * `ca-certificates`: A trust store used to squelch postfix warnings about
 #   untrusted opportunistically-encrypted connections.
@@ -172,7 +172,7 @@ tools/editconf.py /etc/postfix/main.cf \
 
 # When connecting to remote SMTP servers, prefer TLS and use DANE if available.
 #
-# Prefering ("opportunistic") TLS means Postfix will use TLS if the remote end
+# Preferring ("opportunistic") TLS means Postfix will use TLS if the remote end
 # offers it, otherwise it will transmit the message in the clear. Postfix will
 # accept whatever SSL certificate the remote end provides. Opportunistic TLS
 # protects against passive easvesdropping (but not man-in-the-middle attacks).
@@ -188,7 +188,7 @@ tools/editconf.py /etc/postfix/main.cf \
 # itself but assumes the system's nameserver does and reports DNSSEC status. Thus this also
 # relies on our local DNS server (see system.sh) and `smtp_dns_support_level=dnssec`.
 #
-# The `smtp_tls_CAfile` is superflous, but it eliminates warnings in the logs about untrusted certs,
+# The `smtp_tls_CAfile` is superfluous, but it eliminates warnings in the logs about untrusted certs,
 # which we don't care about seeing because Postfix is doing opportunistic TLS anyway. Better to encrypt,
 # even if we don't know if it's to the right party, than to not encrypt at all. Instead we'll
 # now see notices about trusted certs. The CA file is provided by the package `ca-certificates`.
@@ -230,7 +230,7 @@ tools/editconf.py /etc/postfix/main.cf  -e lmtp_destination_recipient_limit=
 # * `reject_unlisted_recipient`: Although Postfix will reject mail to unknown recipients, it's nicer to reject such mail ahead of greylisting rather than after.
 # * `check_policy_service`: Apply greylisting using postgrey.
 #
-# Note the spamhaus rbl return codes are taken into account as adviced here: https://docs.spamhaus.com/datasets/docs/source/40-real-world-usage/PublicMirrors/MTAs/020-Postfix.html
+# Note the spamhaus rbl return codes are taken into account as advised here: https://docs.spamhaus.com/datasets/docs/source/40-real-world-usage/PublicMirrors/MTAs/020-Postfix.html
 # Notes: #NODOC
 # permit_dnswl_client can pass through mail from whitelisted IP addresses, which would be good to put before greylisting #NODOC
 # so these IPs get mail delivered quickly. But when an IP is not listed in the permit_dnswl_client list (i.e. it is not #NODOC
@@ -247,7 +247,7 @@ tools/editconf.py /etc/postfix/main.cf \
 # other MTA have their own intervals. To fix the problem of receiving
 # e-mails really latter, delay of greylisting has been set to
 # 180 seconds (default is 300 seconds). We will move the postgrey database
-# under $STORAGE_ROOT. This prevents a "warming up" that would have occured
+# under $STORAGE_ROOT. This prevents a "warming up" that would have occurred
 # previously with a migrated or reinstalled OS.  We will specify this new path
 # with the --dbdir=... option. Arguments within POSTGREY_OPTS can not have spaces,
 # including dbdir. This is due to the way the init script sources the

setup/mail-users.sh

@@ -5,7 +5,7 @@
 #
 # This script configures user authentication for Dovecot
 # and Postfix (which relies on Dovecot) and destination
-# validation by quering an Sqlite3 database of mail users.
+# validation by querying an Sqlite3 database of mail users.
 
 source setup/functions.sh # load our functions
 source /etc/mailinabox.conf # load global vars

setup/management.sh

@@ -54,7 +54,7 @@ hide_output $venv/bin/pip install --upgrade \
 # Create a backup directory and a random key for encrypting backups.
 mkdir -p "$STORAGE_ROOT/backup"
 if [ ! -f "$STORAGE_ROOT/backup/secret_key.txt" ]; then
-	umask 077; openssl rand -base64 2048 > "$STORAGE_ROOT/backup/secret_key.txt"
+	(umask 077; openssl rand -base64 2048 > "$STORAGE_ROOT/backup/secret_key.txt")
 fi
 
 
@@ -116,7 +116,7 @@ minute=$((RANDOM % 60))  # avoid overloading mailinabox.email
 cat > /etc/cron.d/mailinabox-nightly << EOF;
 # Mail-in-a-Box --- Do not edit / will be overwritten on update.
 # Run nightly tasks: backup, status checks.
-$minute 3 * * *	root	(cd $PWD && management/daily_tasks.sh)
+$minute 1 * * *	root	(cd $PWD && management/daily_tasks.sh)
 EOF
 
 # Start the management server.

setup/migrate.py

@@ -172,7 +172,7 @@ def migration_12(env):
             conn.commit()
             conn.close()
 
-            # Delete all sessions, requring users to login again to recreate carddav_*
+            # Delete all sessions, requiring users to login again to recreate carddav_*
             # databases
             conn = sqlite3.connect(os.path.join(env["STORAGE_ROOT"], "mail/roundcube/roundcube.sqlite"))
             c = conn.cursor()

setup/nextcloud.sh

@@ -21,8 +21,8 @@ echo "Installing Nextcloud (contacts/calendar)..."
 #   we automatically install intermediate versions as needed.
 # * The hash is the SHA1 hash of the ZIP package, which you can find by just running this script and
 #   copying it from the error message when it doesn't match what is below.
-nextcloud_ver=26.0.12
-nextcloud_hash=b55e9f51171c0a9b9ab3686cf5c8ad1a4292ca15
+nextcloud_ver=26.0.13
+nextcloud_hash=d5c10b650e5396d5045131c6d22c02a90572527c
 
 # Nextcloud apps
 # --------------
@@ -40,12 +40,12 @@ contacts_ver=5.5.3
 contacts_hash=799550f38e46764d90fa32ca1a6535dccd8316e5
 
 # Always ensure the versions are supported, see https://apps.nextcloud.com/apps/calendar
-calendar_ver=4.6.6
-calendar_hash=e34a71669a52d997e319d64a984dcd041389eb22
+calendar_ver=4.7.6
+calendar_hash=a995bca4effeecb2cab25f3bbeac9bfe05fee766
 
 # Always ensure the versions are supported, see https://apps.nextcloud.com/apps/user_external
-user_external_ver=3.2.0
-user_external_hash=a494073dcdecbbbc79a9c77f72524ac9994d2eec
+user_external_ver=3.3.0
+user_external_hash=280d24eb2a6cb56b4590af8847f925c28d8d853e
 
 # Developer advice (test plan)
 # ----------------------------
@@ -131,7 +131,7 @@ InstallNextcloud() {
 	# Make sure permissions are correct or the upgrade step won't run.
 	# $STORAGE_ROOT/owncloud may not yet exist, so use -f to suppress
 	# that error.
-	chown -f -R www-data:www-data "$STORAGE_ROOT/owncloud /usr/local/lib/owncloud" || /bin/true
+	chown -f -R www-data:www-data "$STORAGE_ROOT/owncloud" /usr/local/lib/owncloud || /bin/true
 
 	# If this isn't a new installation, immediately run the upgrade script.
 	# Then check for success (0=ok and 3=no upgrade needed, both are success).
@@ -274,15 +274,6 @@ if [ ! -f "$STORAGE_ROOT/owncloud/owncloud.db" ]; then
     ),
   ),
   'memcache.local' => '\OC\Memcache\APCu',
-  'mail_smtpmode' => 'sendmail',
-  'mail_smtpsecure' => '',
-  'mail_smtpauthtype' => 'LOGIN',
-  'mail_smtpauth' => false,
-  'mail_smtphost' => '',
-  'mail_smtpport' => '',
-  'mail_smtpname' => '',
-  'mail_smtppassword' => '',
-  'mail_from_address' => 'owncloud',
 );
 ?>
 EOF
@@ -338,13 +329,10 @@ include("$STORAGE_ROOT/owncloud/config.php");
 
 \$CONFIG['memcache.local'] = '\OC\Memcache\APCu';
 \$CONFIG['overwrite.cli.url'] = 'https://${PRIMARY_HOSTNAME}/cloud';
-\$CONFIG['mail_from_address'] = 'administrator'; # just the local part, matches our master administrator address
 
 \$CONFIG['logtimezone'] = '$TIMEZONE';
 \$CONFIG['logdateformat'] = 'Y-m-d H:i:s';
 
-\$CONFIG['mail_domain'] = '$PRIMARY_HOSTNAME';
-
 \$CONFIG['user_backends'] = array(
   array(
     'class' => '\OCA\UserExternal\IMAP',
@@ -354,6 +342,16 @@ include("$STORAGE_ROOT/owncloud/config.php");
   ),
 );
 
+\$CONFIG['mail_domain'] = '$PRIMARY_HOSTNAME';
+\$CONFIG['mail_from_address'] = 'administrator'; # just the local part, matches the required administrator alias on mail_domain/$PRIMARY_HOSTNAME
+\$CONFIG['mail_smtpmode'] = 'sendmail';
+\$CONFIG['mail_smtpauth'] = true; # if smtpmode is smtp
+\$CONFIG['mail_smtphost'] = '127.0.0.1'; # if smtpmode is smtp
+\$CONFIG['mail_smtpport'] = '587'; # if smtpmode is smtp
+\$CONFIG['mail_smtpsecure'] = ''; # if smtpmode is smtp, must be empty string
+\$CONFIG['mail_smtpname'] = ''; # if smtpmode is smtp, set this to a mail user
+\$CONFIG['mail_smtppassword'] = ''; # if smtpmode is smtp, set this to the user's password
+
 echo "<?php\n\\\$CONFIG = ";
 var_export(\$CONFIG);
 echo ";";

setup/questions.sh

@@ -163,7 +163,7 @@ if [ -z "${PRIVATE_IPV6:-}" ]; then
 fi
 if [[ -z "$PRIVATE_IP" && -z "$PRIVATE_IPV6" ]]; then
 	echo
-	echo "I could not determine the IP or IPv6 address of the network inteface"
+	echo "I could not determine the IP or IPv6 address of the network interface"
 	echo "for connecting to the Internet. Setup must stop."
 	echo
 	hostname -I

setup/spamassassin.sh

@@ -53,7 +53,7 @@ tools/editconf.py /etc/default/spampd \
 
 # Spamassassin normally wraps spam as an attachment inside a fresh
 # email with a report about the message. This also protects the user
-# from accidentally openening a message with embedded malware.
+# from accidentally opening a message with embedded malware.
 #
 # It's nice to see what rules caused the message to be marked as spam,
 # but it's also annoying to get to the original message when it is an

setup/ssl.sh

@@ -96,3 +96,12 @@ fi
 if [ ! -f "$STORAGE_ROOT/ssl/dh2048.pem" ]; then
 	openssl dhparam -out "$STORAGE_ROOT/ssl/dh2048.pem" 2048
 fi
+
+# Cleanup expired SSL certificates from $STORAGE_ROOT/ssl daily
+cat > /etc/cron.daily/mailinabox-ssl-cleanup << EOF;
+#!/bin/bash
+# Mail-in-a-Box
+# Cleanup expired SSL certificates
+$(pwd)/tools/ssl_cleanup
+EOF
+chmod +x /etc/cron.daily/mailinabox-ssl-cleanup

setup/system.sh

@@ -37,7 +37,7 @@ chmod g-w /etc /etc/default /usr
 # - Check if the user intents to activate swap on next boot by checking fstab entries.
 # - Check if a swapfile already exists
 # - Check if the root file system is not btrfs, might be an incompatible version with
-#   swapfiles. User should hanle it them selves.
+#   swapfiles. User should handle it them selves.
 # - Check the memory requirements
 # - Check available diskspace
 
@@ -59,7 +59,7 @@ if
 then
 	echo "Adding a swap file to the system..."
 
-	# Allocate and activate the swap file. Allocate in 1KB chuncks
+	# Allocate and activate the swap file. Allocate in 1KB chunks
 	# doing it in one go, could fail on low memory systems
 	dd if=/dev/zero of=/swapfile bs=1024 count=$((1024*1024)) status=none
 	if [ -e /swapfile ]; then
@@ -83,6 +83,15 @@ fi
 # (See https://discourse.mailinabox.email/t/journalctl-reclaim-space-on-small-mailinabox/6728/11.)
 tools/editconf.py /etc/systemd/journald.conf MaxRetentionSec=10day
 
+# ### Improve server privacy
+
+# Disable MOTD adverts to prevent revealing server information in MOTD request headers
+# See https://ma.ttias.be/what-exactly-being-sent-ubuntu-motd/
+if [ -f /etc/default/motd-news ]; then
+tools/editconf.py /etc/default/motd-news ENABLED=0
+rm -f /var/cache/motd-news
+fi
+
 # ### Add PPAs.
 
 # We install some non-standard Ubuntu packages maintained by other
@@ -218,7 +227,7 @@ fi
 # issue any warnings if no entropy is actually available. (http://www.2uo.de/myths-about-urandom/)
 # Entropy might not be readily available because this machine has no user input
 # devices (common on servers!) and either no hard disk or not enough IO has
-# ocurred yet --- although haveged tries to mitigate this. So there's a good chance
+# occurred yet --- although haveged tries to mitigate this. So there's a good chance
 # that accessing /dev/urandom will not be drawing from any hardware entropy and under
 # a perfect-storm circumstance where the other seeds are meaningless, /dev/urandom
 # may not be seeded at all.
@@ -270,14 +279,14 @@ if [ -z "${DISABLE_FIREWALL:-}" ]; then
 	# ssh might be running on an alternate port. Use sshd -T to dump sshd's #NODOC
 	# settings, find the port it is supposedly running on, and open that port #NODOC
 	# too. #NODOC
-	SSH_PORT=$(sshd -T 2>/dev/null | grep "^port " | sed "s/port //") #NODOC
+	SSH_PORT=$(sshd -T 2>/dev/null | grep "^port " | sed "s/port //" | tr '\n' ' ') #NODOC
 	if [ -n "$SSH_PORT" ]; then
-	if [ "$SSH_PORT" != "22" ]; then
-
-	echo "Opening alternate SSH port $SSH_PORT." #NODOC
-	ufw_limit "$SSH_PORT" #NODOC
-
+	    for port in $SSH_PORT; do
+	        if [ "$port" != "22" ]; then
+	            echo "Opening alternate SSH port $port." #NODOC
+                ufw_limit "$port" #NODOC
             fi
+        done
 	fi
 
 	ufw --force enable;

setup/web.sh

@@ -6,7 +6,7 @@ source setup/functions.sh # load our functions
 source /etc/mailinabox.conf # load global vars
 
 # Some Ubuntu images start off with Apache. Remove it since we
-# will use nginx. Use autoremove to remove any Apache depenencies.
+# will use nginx. Use autoremove to remove any Apache dependencies.
 if [ -f /usr/sbin/apache2 ]; then
 	echo "Removing apache..."
 	hide_output apt-get -y purge apache2 apache2-*

setup/webmail.sh

@@ -23,7 +23,7 @@ echo "Installing Roundcube (webmail)..."
 apt_install \
 	dbconfig-common \
 	php"${PHP_VER}"-cli php"${PHP_VER}"-sqlite3 php"${PHP_VER}"-intl php"${PHP_VER}"-common php"${PHP_VER}"-curl php"${PHP_VER}"-imap \
-	php"${PHP_VER}"-gd php"${PHP_VER}"-pspell php"${PHP_VER}"-mbstring libjs-jquery libjs-jquery-mousewheel libmagic1 \
+	php"${PHP_VER}"-gd php"${PHP_VER}"-pspell php"${PHP_VER}"-mbstring php"${PHP_VER}"-xml libjs-jquery libjs-jquery-mousewheel libmagic1 \
 	sqlite3
 
 # Install Roundcube from source if it is not already present or if it is out of date.
@@ -36,8 +36,8 @@ apt_install \
 #   https://github.com/mstilkerich/rcmcarddav/releases
 # The easiest way to get the package hashes is to run this script and get the hash from
 # the error message.
-VERSION=1.6.6
-HASH=7705d2736890c49e7ae3ac75e3ae00ba56187056
+VERSION=1.6.11
+HASH=d72da06b5f65142dab8b574f7676e0220541a3d4
 PERSISTENT_LOGIN_VERSION=bde7b6840c7d91de627ea14e81cf4133cbb3c07a # version 5.3
 HTML5_NOTIFIER_VERSION=68d9ca194212e15b3c7225eb6085dbcf02fd13d7 # version 0.6.4+
 CARDDAV_VERSION=4.4.3

setup/zpush.sh

@@ -17,13 +17,13 @@ source /etc/mailinabox.conf # load global vars
 
 echo "Installing Z-Push (Exchange/ActiveSync server)..."
 apt_install \
-       php"${PHP_VER}"-soap php"${PHP_VER}"-imap libawl-php php"$PHP_VER"-xml
+       php"${PHP_VER}"-soap php"${PHP_VER}"-imap libawl-php php"$PHP_VER"-xml php"${PHP_VER}"-intl
 
 phpenmod -v "$PHP_VER" imap
 
 # Copy Z-Push into place.
-VERSION=2.7.1
-TARGETHASH=f15c566b1ad50de24f3f08f505f0c3d8155c2d0d
+VERSION=2.7.5
+TARGETHASH=f0b0b06e255f3496173ab9d28a4f2d985184720e
 needs_update=0 #NODOC
 if [ ! -f /usr/local/lib/z-push/version ]; then
 	needs_update=1 #NODOC
@@ -57,8 +57,6 @@ fi
 sed -i "s^define('TIMEZONE', .*^define('TIMEZONE', '$(cat /etc/timezone)');^" /usr/local/lib/z-push/config.php
 sed -i "s/define('BACKEND_PROVIDER', .*/define('BACKEND_PROVIDER', 'BackendCombined');/" /usr/local/lib/z-push/config.php
 sed -i "s/define('USE_FULLEMAIL_FOR_LOGIN', .*/define('USE_FULLEMAIL_FOR_LOGIN', true);/" /usr/local/lib/z-push/config.php
-sed -i "s/define('LOG_MEMORY_PROFILER', .*/define('LOG_MEMORY_PROFILER', false);/" /usr/local/lib/z-push/config.php
-sed -i "s/define('BUG68532FIXED', .*/define('BUG68532FIXED', false);/" /usr/local/lib/z-push/config.php
 sed -i "s/define('LOGLEVEL', .*/define('LOGLEVEL', LOGLEVEL_ERROR);/" /usr/local/lib/z-push/config.php
 
 # Configure BACKEND
@@ -112,4 +110,6 @@ restart_service php"$PHP_VER"-fpm
 
 # Fix states after upgrade
 
+if [ $needs_update == 1 ]; then
 	hide_output php"$PHP_VER" /usr/local/lib/z-push/z-push-admin.php -a fixstates
+fi

tests/test_dns.py

@@ -66,7 +66,7 @@ def test2(tests, server, description):
 			#print(server, ":", qname, rtype, "?", response)
 			continue
 
-		# show prolem
+		# show problem
 		if first:
 			print("Incorrect DNS Response from", description)
 			print()

tools/ssl_cleanup

@@ -0,0 +1,17 @@
+#!/bin/bash
+# Cleanup SSL certificates which expired more than 7 days ago from $STORAGE_ROOT/ssl and move them to $STORAGE_ROOT/ssl.expired
+
+source /etc/mailinabox.conf
+shopt -s extglob nullglob
+
+retain_after="$(date --date="7 days ago" +%Y%m%d)"
+
+mkdir -p $STORAGE_ROOT/ssl.expired
+for file in $STORAGE_ROOT/ssl/*-+([0-9])-+([0-9a-f]).pem; do
+  pem="$(basename "$file")"
+  not_valid_after="$(cut -d- -f1 <<< "${pem: -21}")"
+
+  if [ "$not_valid_after" -lt "$retain_after" ]; then
+    mv "$file" "$STORAGE_ROOT/ssl.expired/${pem}"
+  fi
+done