X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=3ac3476c337be913ba03f3cee8a73bcafd51cef6;hb=HEAD;hp=e15a31ef782d5dcbb34e628c65a42fbb90ba45ab;hpb=86c0ed3d5d8b0df8b961935fe931c8f57edd0240;p=distro-setup diff --git a/mail-setup b/mail-setup index e15a31e..d19fba0 100755 --- a/mail-setup +++ b/mail-setup @@ -107,7 +107,7 @@ # todo: run mailping test after running, or otherwise # clear out terminal alert -# todo: disable postgrey +# todo: disable postgrey. (why did we have it?) # todo: in testforward-check, we should also look @@ -361,7 +361,10 @@ reload=false if [[ -e /var/local/mail-setup-reload ]]; then reload=true fi -u() { # update file. note: duplicated in brc +# update file. +# if the file changed, ur=true, else false. +# note: duplicated in brc +u() { local tmp tmpdir dest="$1" local base="${dest##*/}" local dir="${dest%/*}" @@ -415,7 +418,6 @@ sre() { mailhost() { [[ $HOSTNAME == "$MAIL_HOST" ]] } -e() { printf "%s\n" "$*"; } reifactive() { for service; do if systemctl is-active $service >/dev/null; then @@ -454,7 +456,7 @@ fi bhost_t=false case $HOSTNAME in $MAIL_HOST) : ;; - kd|frodo|x2|x3|kw|sy|bo) + kd|x2|x3|kw|sy|bo|so) bhost_t=true ;; esac @@ -474,13 +476,30 @@ Pin-Priority: 500 EOF fi +# name change in t12, and now timer instead of cron option in /etc/default +first_spamd_run=false +if ! systemctl cat spamassassin-maintenance.timer &>/dev/null; then + first_spamd_run=true +fi + + # light version of exim does not have sasl auth support. # note: for bitfolk hosts, unbound has important config with conflink. pi-nostart exim4 exim4-daemon-heavy spamassassin unbound clamav-daemon wireguard +spamd_ser=spamd +if systemctl cat spamassassin &>/dev/null; then + spamd_ser=spamassassin +elif $first_spamd_run; then + systemctl start spamassassin-maintenance +fi + +systemctl enable --now spamassassin-maintenance.timer + # note: pyzor debian readme says you need to run some initialization command # but its outdated. -pi spf-tools-perl p0f postgrey pyzor razor jq moreutils certbot fail2ban +pi spf-tools-perl p0f pyzor razor jq moreutils certbot fail2ban +pu postgrey case $HOSTNAME in je) : ;; # not included due to using wireguard: openvpn @@ -509,6 +528,77 @@ fi # our nostart pi fails to avoid enabling + +# * initial dns config & daemon setup +# +# use systemd-resolved for glibc resolutions, setup symlinks + +pi libnss-resolve + +# if this link gets replaced with a normal file we will get exim log +# errors on MAIL_HOST like so: +# +# R=fsfsmarthost defer (-36) DT=0s: host lookup for mail.fsf.org did not complete (DNS timeout?) + +if [[ ! -L /etc/nsswitch.conf ]]; then + sudo mkdir -p /etc/resolved-nsswitch + sudo mv /etc/nsswitch.conf /etc/resolved-nsswitch + sudo ln -sf /etc/resolved-nsswitch/nsswitch.conf /etc +fi + +f=/etc/basic-nsswitch/nsswitch.conf +if [[ ! -e $f ]]; then + sudo mkdir -p ${f%/*} + sudo cp /etc/nsswitch.conf $f + sudo sed -i --follow-symlinks 's/^ *hosts:.*/hosts: files dns myhostname/' $f +fi +case $HOSTNAME in + bk|je) + # je should be able to get along systemd-resolved, but ive had some odd + # very intermittent dns failures with spamassassin, it seems it might only + # be happening with systemd-resolved, so just use unbound + # to make it consistent with the other hosts. + sudo sed -i --follow-symlinks 's/^ *hosts:.*/hosts: files dns myhostname/' /etc/nsswitch.conf + soff systemd-resolved + sudo ln -sf 127.0.0.1-resolv/stub-resolv.conf /etc/resolv.conf + sgo unbound + # cautious measure to make sure resolution is working + sleep 1 + ;; + *) + # default is + # files mdns4_minimal [NOTFOUND=return] dns myhostname + # mdns4 is needed for my printer and for bbb webrtc, not sure exactly why. + # https://www.freedesktop.org/software/systemd/man/nss-resolve.html# + # seems more important than some potential use case. + # Interestingly, t9/t10 man page says use files before resolve, debian 10 says the opposite. + # removing files makes hostname -f not actually give the fully qualified domain name. + sudo sed -i --follow-symlinks 's/^ *hosts:.*/hosts: files resolve [!UNAVAIL=return] mdns4_minimal [NOTFOUND=return] myhostname/' /etc/resolved-nsswitch/nsswitch.conf + ;; +esac + +case $HOSTNAME in + bk) + sgo named + ;; +esac + + +u /etc/apparmor.d/abstractions/nameservice.d/iank <<'EOF' +/etc/resolved-nsswitch/nsswitch.conf r, +/etc/basic-nsswitch/nsswitch.conf r, +# Aug 06 23:09:11 kd audit[3995]: AVC apparmor="DENIED" operation="connect" profile="/usr/bin/freshclam" name="/run/systemd/resolve/io.systemd.Resolve" pid=3995 comm="freshclam" requested_mask="wr" denied_mask="wr" fsuid=109 ouid=101 +# I dont know if this is quite the right fix, but I saw other sockets +# in the nameservice files that were rw, so figured it was ok to add this and it worked. +/run/systemd/resolve/io.systemd.Resolve rw, +EOF + +if $ur && systemctl is-active apparmor; then + m systemctl reload apparmor +fi + + + # * Mail clean cronjob u /etc/systemd/system/mailclean.timer <<'EOF' @@ -775,25 +865,26 @@ EOF # this is just a bug fix for trisquel. f=/etc/apparmor.d/usr.sbin.unbound -line="/usr/sbin/unbound flags=(attach_disconnected) {" -if ! grep -qFx "$line" $f; then - badline="/usr/sbin/unbound {" - if ! grep -qFx "$badline" $f; then +good_string="/usr/sbin/unbound flags=(attach_disconnected) {" +if ! grep -qF "$good_string" $f; then + bad_string="/usr/sbin/unbound {" + if ! grep -qF "$bad_string" $f; then err expected line in $f not found fi - sed -i "s,^$badline$,$line," $f + sed -i "s,$bad_string$,$good_string," $f if systemctl is-active apparmor &>/dev/null; then m systemctl reload apparmor fi fi + # note: anything added to nn_progs needs corresponding rm # down below in the host switch nn_progs=(exim4) if mailhost; then # Note dovecots lmtp doesnt need to be in the same nn to accept delivery. # Its in the nn so remote clients can connect to it. - nn_progs+=(spamassassin dovecot) + nn_progs+=($spamd_ser dovecot) fi case $HOSTNAME in @@ -873,7 +964,7 @@ EOF done ;; *) - for unit in exim4 spamassassin dovecot unbound; do + for unit in exim4 $spamd_ser dovecot unbound; do f=/etc/systemd/system/$unit.service.d/nn.conf if [[ -s $f ]]; then rm -fv $f @@ -925,12 +1016,14 @@ EOF # 2020-10-19 remove old file. remove this when all hosts updated rm -fv /etc/systemd/system/spamddnsfix.{timer,service} -u /etc/default/spamassassin <<'EOF' +u /etc/default/$spamd_ser <<'EOF' # defaults plus debugging flags for an issue im having OPTIONS="--create-prefs --max-children 5 --helper-home-dir" -PIDFILE="/var/run/spamd.pid" +PIDFILE="/run/spamd.pid" # my additions NICE="--nicelevel 15" +# not used in t12+, that uses +# /usr/lib/systemd/system/spamassassin-maintenance.timer CRON=1 EOF @@ -1143,6 +1236,10 @@ banaction = iptables-exim ignoreip = 209.51.188.13 2001:470:142::13 209.51.188.92 2001:470:142:3::10 72.14.176.105 2600:3c00:e000:280::2 10.173.8.1 EOF if $ur; then + # Ensure the log file monitored by fail2ban exists, or else fail2ban can't start. + if [[ ! -e /var/log/exim4/mainlog ]]; then + install -m 640 -o Debian-exim -g adm /dev/null /var/log/exim4/mainlog + fi m systemctl restart fail2ban fi @@ -2533,8 +2630,8 @@ EOF m mkdir -p $rctmpdir /m/rc m chown -R www-data.www-data $rctmpdir /m/rc m chmod 750 $rctmpdir - # Ensure the log file monitored by fail2ban exists, or else fail2ban can't start. # todo: check for other mailinabox things + # Ensure the log file monitored by fail2ban exists, or else fail2ban can't start. m sudo -u www-data touch $rclogdir/errors.log #### begin carddav install @@ -2864,7 +2961,7 @@ debbugsconfig # ld for local debbugs -/a/exe/web-conf -t -a 127.0.1.1 -p 80 -r /var/lib/debbugs/www - apache2 ld <<'EOF' +/a/exe/web-conf -l -t -a 127.0.1.1 -p 80 -r /var/lib/debbugs/www - apache2 ld <<'EOF' # copied from debbugs upstream example Options Indexes SymLinksIfOwnerMatch MultiViews @@ -2977,10 +3074,11 @@ case $HOSTNAME in # which will overwrite any existing file u /etc/default/exim4 <<'EOF' QUEUERUNNER='combined' -# note: this is duplicated in brc2, 10m here is -q10m there. QUEUEINTERVAL='10m' COMMONOPTIONS='-C /etc/exim4/my.conf' UPEX4OPTS='-o /etc/exim4/my.conf' +# in t12 exim, this replaces all the above options +EXIMSERVICE='-bdf -q10m -C /etc/exim4/my.conf' # i use epanic-clean for alerting if there are bad paniclog entries E4BCD_WATCH_PANICLOG='no' EOF @@ -3177,6 +3275,11 @@ bounce_debbugs: domains = DEBBUGS_DOMAIN EOF + install -m=0775 -d -g Debian-exim -o iank /var/spool/exim4/gw + f=/var/spool/exim4/gw/.no-delay-eximids + if [[ ! -e $f ]]; then + install -g Debian-exim -o iank /dev/null $f + fi u /etc/exim4/conf.d/router/155_delay <<'EOF' # By default, delay sending email by 30-40 minutes in case I # change my mind. @@ -3196,14 +3299,14 @@ delay_iank: condition = ${if and { \ {< {$tod_epoch} {${eval10:$received_time + 60*30}}} \ {!def:h_i:} \ -{!bool{${lookup{$message_exim_id}lsearch{/etc/exim4/no-delay-eximids}{true}}}} \ -{!bool{${lookup{all}lsearch{/etc/exim4/no-delay-eximids}{true}}}} \ +{!bool{${lookup{$message_exim_id}lsearch{/var/spool/exim4/gw/.no-delay-eximids}{true}}}} \ +{!bool{${lookup{all}lsearch{/var/spool/exim4/gw/.no-delay-eximids}{true}}}} \ } {true}{false}} headers_remove = <; i: domains = ! +local_domains # uncomment for testing delays to jtuttle # local_parts = ! root : ! testignore : ! alerts : ! ian-pager : ! daylert - local_parts = ! root : ! testignore : ! alerts : ! jtuttle : ! ian-pager : ! daylert + local_parts = ! root : ! testignore : ! alerts : ! jtuttle : ! ian-pager : ! daylert : ! r2e ignore_target_hosts = ROUTER_DNSLOOKUP_IGNORE_TARGET_HOSTS EOF @@ -3344,6 +3447,12 @@ EOF # This name won\'t appear on From: lines of outgoing messages if rewriting is enabled. echo iankelling.org > /etc/mailname + # mail default domain. + u /etc/mailutils.conf <<'EOF' +address { + email-domain iankelling.org; +}; +EOF # mail.iankelling.org so local imap clients can connect with tls and # when they happen to not be local. @@ -3558,11 +3667,13 @@ backup_local: EOF # Bind to wghole to receive mailbackup. - wgholeip=$(sed -rn 's/^ *Address *= *([^/]+).*/\1/p' /etc/wireguard/wghole.conf) - cat >>/etc/exim4/update-exim4.conf.conf <>/etc/exim4/update-exim4.conf.conf <>/etc/cron.d/mailtest </usr/local/bin/send-test-forward <<'EOF' +#!/bin/bash +# we remove from the queue older than 4.3 minutes since we send every 5 minutes. +olds=( +$(/usr/sbin/exiqgrep -o 260 -i -r '^(testignore@(iankelling\.org|zroe\.org|expertpathologyreview\.com|amnimal\.ninja|je\.b8\.nz)|jtuttle@gnu\.org)$') +) +if (( ${#olds[@]} )); then + /usr/sbin/exim -Mrm "${olds[@]}" >/dev/null +fi +EOF + for test_from in ${test_froms[@]}; do + + test_to=${test_tos[0]} + for t in ${test_tos[@]:1}; do + if [[ $test_from == *@gnu.org && $t == *@gnu.org ]]; then + continue + fi + test_to+=", $t" + done + case $test_from in + testignore@expertpathologyreview.com) + test_to=testignore@zroe.org + ;; + esac + + cat >>/usr/local/bin/send-test-forward <>/etc/cron.d/mailtest </usr/local/bin/send-test-forward <<'EOF' -#!/bin/bash -# we remove from the queue older than 4.3 minutes since we send every 5 minutes. -olds=( -$(/usr/sbin/exiqgrep -o 260 -i -r '^(testignore@(iankelling\.org|zroe\.org|expertpathologyreview\.com|amnimal\.ninja|je\.b8\.nz)|jtuttle@gnu\.org)$') -) -if (( ${#olds[@]} )); then - /usr/sbin/exim -Mrm "${olds[@]}" >/dev/null -fi -EOF - for test_from in ${test_froms[@]}; do - - test_to=${test_tos[0]} - for t in ${test_tos[@]:1}; do - if [[ $test_from == *@gnu.org && $t == *@gnu.org ]]; then - continue - fi - test_to+=", $t" - done - case $test_from in - testignore@expertpathologyreview.com) - test_to=testignore@zroe.org - ;; - esac - - cat >>/usr/local/bin/send-test-forward <