X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=30c987f457ec1bfb895071300276f2614420b0cf;hb=72c18f3a6a7f1ed0ca16af654a1f804ab96e1ff9;hp=5d184932481fdbafee2d9c5e63be3584446df8dc;hpb=b28eebdf9143aa17733f233b30b96f462008f3b6;p=distro-setup diff --git a/mail-setup b/mail-setup index 5d18493..30c987f 100755 --- a/mail-setup +++ b/mail-setup @@ -4,6 +4,21 @@ # SPDX-License-Identifier: AGPL-3.0-or-later +# shellcheck disable=SC2254 # makes for a lot of unneeded quotes + + +# perusing through /el/mainlog without test messages: +# &!testignore|jtuttle| +# +#&! testignore|jtuttle|eximbackup|/usr/sbin/exim4 -bpu + +# todo: check new macro DKIM_TIMESTAMPS + +# todo: check if REMOTE_SMTP_INTERFACE or REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE can simplify my or fsfs config + +# todo: max line length macro changed in t11. look into it +# todo: check that all macros we use are still valid in t11 + # todo: setup an alert for bouncing test emails. # todo: bounces to my fsf mail can come from fsf@iankelling.org, @@ -129,7 +144,8 @@ if [[ -s /usr/local/lib/err ]]; then elif [[ -s /a/bin/errhandle/err ]]; then source /a/bin/errhandle/err else - err "no err tracing script found" + echo "no err tracing script found" + exit 1 fi source /a/bin/distro-functions/src/identify-distros source /a/bin/distro-functions/src/package-manager-abstractions @@ -285,7 +301,7 @@ reload=false if [[ -e /var/local/mail-setup-reload ]]; then reload=true fi -i() { # install file +u() { # update file. note: duplicated in brc local tmp tmpdir dest="$1" local base="${dest##*/}" local dir="${dest%/*}" @@ -293,13 +309,13 @@ i() { # install file # dest has a directory component mkdir -p "$dir" fi - ir=false # i result + ur=false # u result tmpdir=$(mktemp -d) cat >$tmpdir/"$base" tmp=$(rsync -ic $tmpdir/"$base" "$dest") if [[ $tmp ]]; then printf "%s\n" "$tmp" - ir=true + ur=true if [[ $dest == /etc/systemd/system/* ]]; then touch /var/local/mail-setup-reload reload=true @@ -321,9 +337,19 @@ soff () { done } sre() { + local enabled for service; do m systemctl restart $service - m systemctl enable $service; + # Optimization for exim, + # is-enabled: 0m0.015s + # enable: 0m0.748s + # It is related to this message: + # exim4.service is not a native service, redirecting to systemd-sysv-install. + # Executing: /lib/systemd/systemd-sysv-install enable exim4 + enabled=$(systemctl is-enabled $service 2>/dev/null ||:) + if [[ $enabled != enabled ]]; then + m systemctl enable $service + fi done } mailhost() { @@ -425,7 +451,7 @@ fi # * Mail clean cronjob -i /etc/systemd/system/mailclean.timer <<'EOF' +u /etc/systemd/system/mailclean.timer <<'EOF' [Unit] Description=Run mailclean daily @@ -436,7 +462,7 @@ OnCalendar=monthly WantedBy=timers.target EOF -i /etc/systemd/system/mailclean.service < EOF -i /etc/fail2ban/jail.d/exim.local <<'EOF' +u /etc/fail2ban/jail.d/exim.local <<'EOF' [exim] enabled = true port = 25,587 @@ -967,7 +1049,7 @@ banaction = iptables-exim # 10.173.8.1 = non-nn net ignoreip = 209.51.188.13 2001:470:142::13 209.51.188.92 2001:470:142:3::10 72.14.176.105 2600:3c00:e000:280::2 10.173.8.1 EOF -if $ir; then +if $ur; then m systemctl restart fail2ban fi @@ -1073,26 +1155,26 @@ rm -fv /etc/exim4/conf.d/retry/37_retry cat >/etc/exim4/conf.d/retry/17_retry <<'EOF' # Retry fast for my own domains -iankelling.org * F,1d,4m;F,14d,1h -amnimal.ninja * F,1d,4m;F,14d,1h -expertpathologyreview.com * F,1d,4m;F,14d,1h -je.b8.nz * F,1d,4m;F,14d,1h -zroe.org * F,1d,4m;F,14d,1h -eximbackup.b8.nz * F,1d,4m;F,14d,1h +iankelling.org * F,1d,1m;F,14d,1h +amnimal.ninja * F,1d,1m;F,14d,1h +expertpathologyreview.com * F,1d,1m;F,14d,1h +je.b8.nz * F,1d,1m;F,14d,1h +zroe.org * F,1d,1m;F,14d,1h +eximbackup.b8.nz * F,1d,1m;F,14d,1h # The spec says the target domain will be used for temporary host errors, # but i've found that isn't correct, the hostname is required # at least sometimes. -nn.b8.nz * F,1d,4m;F,14d,1h -defaultnn.b8.nz * F,1d,4m;F,14d,1h -mx.iankelling.org * F,1d,4m;F,14d,1h -bk.b8.nz * F,1d,4m;F,14d,1h -eggs.gnu.org * F,1d,4m;F,14d,1h -fencepost.gnu.org * F,1d,4m;F,14d,1h +nn.b8.nz * F,1d,1m;F,14d,1h +defaultnn.b8.nz * F,1d,1m;F,14d,1h +mx.iankelling.org * F,1d,1m;F,14d,1h +bk.b8.nz * F,1d,1m;F,14d,1h +eggs.gnu.org * F,1d,1m;F,14d,1h +fencepost.gnu.org * F,1d,1m;F,14d,1h # afaik our retry doesnt need this, but just using everything -mx.amnimal.ninja * F,1d,4m;F,14d,1h -mx.expertpathologyreview.com * F,1d,4m;F,14d,1h +mx.amnimal.ninja * F,1d,1m;F,14d,1h +mx.expertpathologyreview.com * F,1d,1m;F,14d,1h mail.fsf.org * F,1d,15m;F,14d,1h @@ -1109,11 +1191,21 @@ cat >/etc/exim4/conf.d/main/000_local2 </etc/exim4/conf.d/main/000_local <<'EOF' MAIN_TLS_ENABLE = true # require tls connections for all smarthosts -REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS = * +REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS = ! nn.b8.nz +REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS = nn.b8.nz # debian exim config added this in 2016 or so? # it's part of the smtp spec, to limit lines to 998 chars @@ -1125,8 +1217,8 @@ REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS = * # other says gmail does not reject. figure out and open a new bug. IGNORE_SMTP_LINE_LENGTH_LIMIT = true -# more verbose logs -MAIN_LOG_SELECTOR = +all +# more verbose logs. used to use +all, but made it less for more efficiency. +MAIN_LOG_SELECTOR = -skip_delivery -tls_cipher -tls_certificate_verified +all_parents +address_rewrite +arguments +deliver_time +pid +queue_time +queue_time_overall +received_recipients +received_sender +return_path_on_delivery +sender_on_delivery +smtp_confirmation +subject # Based on spec, seems like a good idea to be nice. smtp_return_error_details = true @@ -1143,13 +1235,7 @@ smtp_accept_queue_per_connection = 500 DKIM_CANON = relaxed DKIM_SELECTOR = li -# from comments in -# https://debian-administration.org/article/718/DKIM-signing_outgoing_mail_with_exim4 -# and its best for this to align https://tools.ietf.org/html/rfc7489#page-8 -# There could be some circumstance when the -# from: isnt our domain, but the envelope sender is -# and so still want to sign, but I cant think of any case. -DKIM_DOMAIN = ${lc:${domain:$rh_from:}} + # The file is based on the outgoing domain-name in the from-header. # sign if key exists DKIM_PRIVATE_KEY = ${if exists{/etc/exim4/${dkim_domain}-private.pem} {/etc/exim4/${dkim_domain}-private.pem}} @@ -1191,7 +1277,7 @@ delay_warning_condition = ${if or {\ # enable 587 in addition to the default 25, so that # i can send mail where port 25 is firewalled by isp -daemon_smtp_ports = 25 : 587 +daemon_smtp_ports = 25 : 587 : 10025 # default of 25, can get stuck when catching up on mail smtp_accept_max = 400 smtp_accept_reserve = 100 @@ -1202,9 +1288,27 @@ smtp_reserve_hosts = +iank_trusted LOCAL_DENY_EXCEPTIONS_LOCAL_ACL_FILE = /etc/exim4/conf.d/local_deny_exceptions_acl EOF +if dpkg --compare-versions "$(dpkg-query -f='${Version}\n' --show exim4)" ge 4.94; then + cat >>/etc/exim4/conf.d/main/000_local <<'EOF' +# In t11, we cant do the old anymore because this is tainted data used in a file lookup. +# /usr/share/doc/exim4/NEWS.Debian.gz suggests to use lookups to untaint data. +DKIM_DOMAIN = ${lookup {${domain:$rh_from:}}lsearch,ret=key{/etc/exim4/conf.d/my-dkim-domains}} +EOF +else + cat >>/etc/exim4/conf.d/main/000_local <<'EOF' +# From comments in +# https://debian-administration.org/article/718/DKIM-signing_outgoing_mail_with_exim4 +# and its best for this to align https://tools.ietf.org/html/rfc7489#page-8 +# There could be some circumstance when the +# from: isnt our domain, but the envelope sender is +# and so still want to sign, but I cant think of any case. +DKIM_DOMAIN = ${lc:${domain:$rh_from:}} +EOF +fi + rm -fv /etc/exim4/rcpt_local_acl # old path -i /etc/exim4/conf.d/local_deny_exceptions_acl <<'EOF' +u /etc/exim4/conf.d/local_deny_exceptions_acl <<'EOF' # This acl already exists in rcpt, this just makes it more widespread. # See the comment there for its rationale. The reason it needs to be # more widespread is that I've turned on sender verification, but cron @@ -1221,7 +1325,7 @@ EOF rm -fv /etc/exim4/data_local_acl # old path -i /etc/exim4/conf.d/data_local_acl <<'EOF' +u /etc/exim4/conf.d/data_local_acl <<'EOF' # Except for the "condition =", this was # a comment in the check_data acl. The comment about this not # being suitable has been changed in newer exim versions. The only thing @@ -1233,7 +1337,7 @@ i /etc/exim4/conf.d/data_local_acl <<'EOF' # those docs are rather old and I see a 110k spam message # pretty quickly looking through my spam folder. -warn +#warn !hosts = +iank_trusted remove_header = X-Spam_score: X-Spam_score_int : X-Spam_bar : X-Spam_report @@ -1257,7 +1361,207 @@ warn EOF -i /etc/exim4/conf.d/router/900_exim4-config_local_user <<'EOF' + +# old file +rm -fv /etc/exim4/conf.d/router/8{8,9}0_backup_copy \ + /etc/exim4/conf.d/router/865_backup_redir \ + /etc/exim4/conf.d/router/870_backup_local + +# It is important for this to exist everywhere except in MAIL_HOST +# non-nn config. Previously, just had it in the nn-config on MAIL_HOST, +# but that is a problem if we change mail host and still have something +# in the queue which was destined for this router, but hosts were +# unreachable, the routers will be reevaluated on the next retry. +u /etc/exim4/conf.d/router/170_backup_copy < {$max_received_linelength}{998} {1}{0}} -.endif + message_linelength_limit = 2097152 .ifdef REMOTE_SMTP_HOSTS_AVOID_TLS hosts_avoid_tls = REMOTE_SMTP_HOSTS_AVOID_TLS .endif @@ -1345,16 +1647,14 @@ tls_privatekey = REMOTE_SMTP_PRIVATEKEY interface = <; 10.8.0.4 ; 2600:3c00:e002:3800::4 EOF -i /etc/exim4/conf.d/transport/30_smarthost_dkim <<'EOF' +u /etc/exim4/conf.d/transport/30_smarthost_dkim <<'EOF' # ian: this is remote_smtp_smarthost plus the dkim parts from remote_smtp smarthost_dkim: debug_print = "T: remote_smtp_smarthost for $local_part@$domain" driver = smtp + message_linelength_limit = 2097152 multi_domain -.ifndef IGNORE_SMTP_LINE_LENGTH_LIMIT - message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}} -.endif hosts_try_auth = <; ${if exists{CONFDIR/passwd.client} \ {\ ${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$host_address}}\ @@ -1418,7 +1718,6 @@ EOF cat >/etc/exim4/update-exim4.conf.conf <<'EOF' # default stuff, i havent checked if its needed dc_minimaldns='false' -dc_relay_nets='' CFILEMODE='644' dc_use_split_config='true' dc_mailname_in_oh='true' @@ -1442,7 +1741,7 @@ if mailhost; then # in the log it just says "Starting Radicale". If you run # it in the foreground, it will give more info. Background # plus debug does not help. - # sudo -u radicale radicale -D -f + # sudo -u radicale radicale -D # created password file with: # htpasswd -c /p/c/machine_specific/li/filesystem/etc/caldav-htpasswd @@ -1450,8 +1749,9 @@ if mailhost; then # # setup chgrp www-data in ./conflink pi-nostart radicale + m usermod -a -G radicale iank - i /etc/systemd/system/radicale.service.d/override.conf < @@ -1956,9 +2256,11 @@ if [[ $HOSTNAME == bk ]]; then rcdir=${rcdirs[i]} rcbase=${rcdir##*/} ncdir=${ncdirs[i]} + myncdir=/root/${ncdir##*/} + mkdir -p $myncdir # copied from debians cronjob - i /etc/cron.d/$rcbase </dev/null @@ -2018,7 +2320,7 @@ EOF rctmpdir=/var/tmp/$rcbase rcdb=/m/rc/$rcbase.sqlite # config from mailinabox - i $rcdir/config/config.inc.php <tmp.php <$myncdir/tmp.php <config.php - # leave in place for debugging - #m rm -f tmp.php - m sudo -u www-data php $ncdir/occ maintenance:update:htaccess + e running php $myncdir/tmp.php + # note: we leave it around place for debugging + php $myncdir/tmp.php >config.php + cd $ncdir + m sudo -u www-data php occ maintenance:update:htaccess list=$(sudo -u www-data php $ncdir/occ --output=json_pretty app:list) # user_external not compaible with nc 23 for app in contacts calendar; do if [[ $(printf "%s\n" "$list"| jq ".enabled.$app") == null ]]; then - m sudo -u www-data php $ncdir/occ app:install $app + cd $ncdir + m sudo -u www-data php occ app:install $app fi done - i /etc/systemd/system/$ncbase.service <&2 - /sbin/exim -t <&2 + # -odf or else systemd will kill the background delivery process + # and the message will sit in the queue until the next queue run. + exim -odf -t <>/etc/exim4/update-exim4.conf.conf < {$max_received_linelength}{998} {1}{0}} -.endif - hosts_require_auth = * - hosts_try_auth = * - envelope_to_add - # manual return path because we want it to be the envelope sender - # we got not the one we are using in this smtp transport - headers_add = "Return-path: $sender_address" -.ifdef REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS - hosts_avoid_tls = REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS -.endif -.ifdef REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS - hosts_require_tls = REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS -.endif -.ifdef REMOTE_SMTP_SMARTHOST_TLS_VERIFY_CERTIFICATES - tls_verify_certificates = REMOTE_SMTP_SMARTHOST_TLS_VERIFY_CERTIFICATES -.endif -.ifdef REMOTE_SMTP_SMARTHOST_TLS_VERIFY_HOSTS - tls_verify_hosts = REMOTE_SMTP_SMARTHOST_TLS_VERIFY_HOST -.endif -.ifdef REMOTE_SMTP_HEADERS_REWRITE - headers_rewrite = REMOTE_SMTP_HEADERS_REWRITE -.endif -.ifdef REMOTE_SMTP_HELO_DATA - helo_data=REMOTE_SMTP_HELO_DATA -.endif -.ifdef TLS_DH_MIN_BITS -tls_dh_min_bits = TLS_DH_MIN_BITS -.endif -.ifdef REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE -tls_certificate = REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE -.endif -.ifdef REMOTE_SMTP_SMARTHOST_PRIVATEKEY -tls_privatekey = REMOTE_SMTP_SMARTHOST_PRIVATEKEY -.endif -.ifdef REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE - headers_remove = REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE -.endif -EOF - - # this avoids some error. i cant remember what. todo: - # test it out and document why/if its needed. - # i /etc/exim4/host_local_deny_exceptions <<'EOF' - # mail.fsf.org - # *.posteo.de - # EOF + # This allows for forwarded mail to not get most rcpt checks, especially SPF, + # which would incorrectly get denied. + u /etc/exim4/host_local_deny_exceptions <<'EOF' +mail.fsf.org +*.posteo.de +EOF # cron email from smarthost hosts will automatically be to # USER@FQDN. I redirect that to alerts@, on the smarthosts, but in # case that doesn't work, we still want to accept that mail, but not # from any host except the smarthosts. local_hostnames and this rule # is for that purpose. - i /etc/exim4/conf.d/rcpt_local_acl <<'EOF' + u /etc/exim4/conf.d/rcpt_local_acl <<'EOF' deny !authenticated = * domains = +local_hostnames message = no relay + +# for testing bounce behavior +#deny +# senders = testlist-bounces+test=zroe.org@fsf.org +# message = iank-bounce EOF - echo|i /etc/exim4/conf.d/router/880_universal_forward + echo|u /etc/exim4/conf.d/router/880_universal_forward cat >>/etc/exim4/conf.d/main/000_local <>/etc/exim4/update-exim4.conf.conf <>/etc/exim4/update-exim4.conf.conf <>/etc/exim4/update-exim4.conf.conf <>/etc/myexim4/conf.d/main/000_local-nn <<'EOF' + # config for the non-nn exim. note, it uses not default dir, but we + # generate that into the default config file + m rsync -ra --delete --delete-excluded \ + --exclude=/conf.d/router/161_backup_redir_nn \ + --exclude=/conf.d/router/186_sentarchive_nn \ + --exclude=/conf.d/main/000_local-nn /etc/exim4/ /etc/myexim4 + cat >>/etc/myexim4/conf.d/main/000_local <<'EOF' # this makes it easier to see which exim is doing what log_file_path = /var/log/exim4/my%s EOF + + cat >/etc/logrotate.d/myexim <<'EOF' /var/log/exim4/mymain /var/log/exim4/myreject { daily @@ -3042,11 +3313,42 @@ EOF bk) # config for the non-nn exim - cat >/etc/myexim4/conf.d/main/000_local-nn <<'EOF' + cat >>/etc/myexim4/conf.d/main/000_local <<'EOF' MAIN_HARDCODE_PRIMARY_HOSTNAME = mail2.iankelling.org EOF ;; $MAIL_HOST) + + + u /etc/myexim4/conf.d/router/185_sentarchive <<'EOF' +sentarchive: + driver = redirect + domains = ! +local_domains + senders = <; *@fsf.org ; *@posteo.net + condition = ${if !bool{${lookup{$local_part@$domain}lsearch{/etc/exim4/ignore-sent}{true}}}} + data = vojdedIdNejyebni@b8.nz + unseen +EOF + + + u /etc/myexim4/conf.d/router/160_backup_redir <<'EOF' +backup_redir: +driver = redirect +# i dont email myself from my own machine much, so lets ignore that. +domains = ! +local_domains +senders = <; *@fsf.org ; *@posteo.net +condition = ${if !bool{${lookup{$local_part@$domain}lsearch{/etc/exim4/ignore-sent}{true}}}} +# b is just an arbirary short string +data = b@eximbackup.b8.nz +# note, to test this, i could temporarily allow testignore. +# alerts avoids potential mail loop. +local_parts = ! root : ! testignore : ! alerts : ! daylert +unseen = true +errors_to = alerts@iankelling.org +EOF + + + # for bk, we have a exim4in.service that will do this for us. m update-exim4.conf -d /etc/myexim4 ;; @@ -3070,7 +3372,7 @@ if [[ -e /nocow ]]; then if ! grep -Fx "/nocow/exim4 /var/spool/exim4 none bind 0 0" /etc/fstab; then echo "/nocow/exim4 /var/spool/exim4 none bind 0 0" >>/etc/fstab fi - i /etc/systemd/system/exim4.service.d/override.conf <<'EOF' + u /etc/systemd/system/exim4.service.d/override.conf <<'EOF' [Unit] # without local-fs on exim, we get these kind of errors in paniclog on shutdown: # Failed to create spool file /var/spool/exim4//input//1jCLxz-0008V4-V9-D: Permission denied @@ -3124,8 +3426,20 @@ if $reload; then m systemctl daemon-reload fi -sysd-prom-fail-install epanicclean -m systemctl --now enable epanicclean +# optimization, this only needs to run once. +if [[ ! -e /sys/class/net/wghole ]]; then + # checking bhost_t is redundant, but could help us catch errors. + if $bhost_t || [[ -e /etc/wireguard/wghole.conf ]]; then + # todo: in mail-setup, we have a static list of backup hosts, not *y + m systemctl --now enable wg-quick@wghole + fi +fi + +# optimization, this only needs to be run once +if [[ ! -e /var/lib/prometheus/node-exporter/exim_paniclog.prom ]]; then + sysd-prom-fail-install epanicclean + m systemctl --now enable epanicclean +fi case $HOSTNAME in je) @@ -3136,8 +3450,11 @@ case $HOSTNAME in ;; esac -m /a/bin/ds/mail-cert-cron -1 -sre mailcert.timer +# optimization, this only needs to run once. +if [[ ! -e /etc/exim4/fullchain.pem ]]; then + m /a/bin/ds/mail-cert-cron -1 + m systemctl --now enable mailcert.timer +fi case $HOSTNAME in $MAIL_HOST|bk) @@ -3174,9 +3491,11 @@ case $HOSTNAME in $MAIL_HOST|bk|je) # start spamassassin/dovecot before exim. sre dovecot spamassassin - # need to wait a bit before restarting exim, else I - # get a paniclog entry like: spam acl condition: all spamd servers failed - sleep 3 + # Wait a bit before restarting exim, else I get a paniclog entry + # like: spam acl condition: all spamd servers failed. But I'm tired + # of waiting. I'll deal with this some other way. + # + # sleep 3 m systemctl --now enable mailclean.timer ;;& $MAIL_HOST) @@ -3235,7 +3554,7 @@ case $HOSTNAME in # note: cronjob "ian" also does some important monitoring # todo: this will sometimes cause an alert because mailtest-check will run # before we have setup network namespace and spamassassin - i /etc/cron.d/mailtest <> /etc/exim4/ignore-sent - done + # Plus addresses we generally want to ignore. + u /etc/exim4/ignore-sent </usr/local/bin/send-test-forward <<'EOF' #!/bin/bash @@ -3324,7 +3645,7 @@ EOF esac cat >>/usr/local/bin/send-test-forward <