X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=86464f1aaf3ca337bb9ef2ede0d7e94f32826550;hb=12cab163424e3a7b0815646d1d4407f9b5839bcb;hp=6efc3e311a52c19cbf2e5f80e3cb1bcc883979c6;hpb=e93a488af3a47f059a407dd797d48459d3f639ef;p=distro-setup diff --git a/mail-setup b/mail-setup index 6efc3e3..86464f1 100755 --- a/mail-setup +++ b/mail-setup @@ -3,6 +3,22 @@ # Copyright (C) 2019 Ian Kelling # SPDX-License-Identifier: AGPL-3.0-or-later +# todo: sandbox / harden exim: +# 1. stop it from running as root. how? +# https://www.exim.org/exim-html-current/doc/html/spec_html/ch-security_considerations.html +# * avoid using .forward files, remove that router +# * set deliver_drop_privilege +# * set user to run as Debian-exim in systemd +# * set port to something like 2500, and forward 25 to 2500 with iptables. same for 587. +# https://superuser.com/questions/710253/allow-non-root-process-to-bind-to-port-80-and-443/1334552#1334552 +# * consider whether other routers like postmaster need modification / removal. +# 2. restrict its filesystem access from within systemd + +# todo: harden dovecot. need to do some research. one way is for it to only listen on a wireguard vpn interface, so only clients that are on the vpn can access it. +# todo: consider hardening cups listening on 0.0.0.0 +# todo: stop/disable local apache, and rpc.mountd, and kdeconnect when not in use. +# todo: check that spamd and unbound only listen locally. + # todo: hosts should only allow external mail that is authed and # destined for backup route. it is a minor issue since traffic is # limited to the wghole network. @@ -300,8 +316,7 @@ soff () { for service; do # ignore services that dont exist if systemctl cat $service &>/dev/null; then - m systemctl stop $service; - m systemctl disable $service + m systemctl disable --now $service fi done } @@ -311,11 +326,6 @@ sre() { m systemctl enable $service; done } -sstart() { - for service; do - m systemctl enable --now $service; - done -} mailhost() { [[ $HOSTNAME == "$MAIL_HOST" ]] } @@ -367,6 +377,10 @@ esac # * Install universal packages + +# installs epanicclean +/a/bin/ds/install-my-scripts + if [[ $(debian-codename-compat) == bionic ]]; then cat >/etc/apt/preferences.d/spamassassin <<'EOF' Package: spamassassin sa-compile spamc @@ -404,21 +418,6 @@ fi # our nostart pi fails to avoid enabling -# * user forward file -case $HOSTNAME in - $MAIL_HOST) - # afaik, these will get ignored on MAIL_HOST because they are routing to my own - # machine, but rm them is safer - rm -fv $uhome/.forward /root/.forward - ;; - *) - # this can\'t be a symlink and has permission restrictions - # it might work in /etc/aliases, but this seems more proper. - e setting $uhome/.forward to $forward - install -m 644 {-o,-g}$u <(e $forward) $uhome/.forward - ;; -esac - # * Mail clean cronjob i /etc/systemd/system/mailclean.timer <<'EOF' @@ -464,6 +463,8 @@ EOF # old. #vpnser=mailvpn.service +# todo: this hangs if it cant resolv the endpoint. we +# want it to just retry in the background. vpnser=wg-quick@wgmail.service case $HOSTNAME in @@ -474,6 +475,12 @@ case $HOSTNAME in bk) bindpaths="/etc/10.173.8.1-resolv:/etc/127.0.0.1-resolv" ;;& + *) + d=/p/c/machine_specific/$HOSTNAME/filesystem/etc/wireguard/ + if [[ -d $d ]]; then + rsync -aiSAX --chown=root:root --chmod=g-s $d /etc/wireguard + fi + ;; esac i /etc/systemd/system/wg-quick@wgmail.service.d/override.conf < 'OC_User_IMAP','arguments' => array('127.0.0.1', 143, null),),); +#\$CONFIG['user_backends'] = array(array('class' => 'OC_User_IMAP','arguments' => array('127.0.0.1', 143, null),),); # based on installer check @@ -2199,7 +2242,6 @@ EOF CHECK_RCPT_VERIFY_SENDER = true # default config comment says: If you enable this, you might reject legitimate mail, # but eggs has had this a long time, so that seems unlikely. -CHECK_DATA_VERIFY_HEADER_SYNTAX = true CHECK_RCPT_SPF = true CHECK_RCPT_REVERSE_DNS = true CHECK_MAIL_HELO_ISSUED = true @@ -2329,6 +2371,7 @@ ignore_target_hosts = ${HOSTNAME}wg.b8.nz # note changes here also require change in passwd.client route_list = * eximbackup.b8.nz same_domain_copy_routing = yes +errors_to = alerts@iankelling.org no_more EOF @@ -2342,9 +2385,8 @@ backup_remote: .endif hosts_require_auth = * hosts_try_auth = * - return_path = alerts@iankelling.org envelope_to_add - # manual return path because we dont want it to be the envelope sender + # manual return path because we want it to be the envelope sender # we got not the one we are using in this smtp transport headers_add = "Return-path: $sender_address" .ifdef REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS @@ -2382,10 +2424,10 @@ EOF # this avoids some error. i cant remember what. todo: # test it out and document why/if its needed. - i /etc/exim4/host_local_deny_exceptions <<'EOF' -mail.fsf.org -*.posteo.de -EOF +# i /etc/exim4/host_local_deny_exceptions <<'EOF' +# mail.fsf.org +# *.posteo.de +# EOF # cron email from smarthost hosts will automatically be to # USER@FQDN. I redirect that to alerts@, on the smarthosts, but in @@ -2450,13 +2492,13 @@ EOF /a/exe/cedit nn /etc/hosts <<'EOF' || [[ $? == 1 ]] # note: i put nn.b8.nz into bind for good measure -10.173.8.2 nn.b8.nz mail.iankelling.org +10.173.8.2 nn.b8.nz mx.iankelling.org EOF # note: systemd-resolved will consult /etc/hosts, dnsmasq wont. this assumes # weve configured this file in dnsmasq if we are using it. /a/exe/cedit mail /etc/dnsmasq-servers.conf <<'EOF' || [[ $? == 1 ]] -server=/mail.iankelling.org/127.0.1.1 +server=/mx.iankelling.org/127.0.1.1 EOF # I used to use debconf-set-selections + dpkg-reconfigure, # which then updates this file @@ -2468,10 +2510,12 @@ EOF # The debconf questions output is additional documentation that is not # easily accessible, but super long, along with the initial default comment in this # file, so I've saved that into ./mail-notes.conf. + # + # # TODO: remove mx.iankelling.org once systems get updated mail-setup from jan 2022 cat >>/etc/exim4/update-exim4.conf.conf <>/etc/exim4/update-exim4.conf.conf <>/etc/exim4/conf.d/main/000_local-nn <<'EOF' +# spool_directory = /var/spool/myexim4 +# EOF cat >>/etc/myexim4/update-exim4.conf.conf <<'EOF' dc_eximconfig_configtype='smarthost' dc_smarthost='nn.b8.nz' @@ -2736,6 +2791,8 @@ if $reload; then m systemctl daemon-reload fi +m systemctl --now enable epanicclean.timer + case $HOSTNAME in je) /a/exe/web-conf apache2 je.b8.nz @@ -2755,14 +2812,14 @@ case $HOSTNAME in ln -sf 127.0.0.1-resolv/stub-resolv.conf /etc/resolv.conf ;;& $MAIL_HOST|bk) - sstart mailnn mailnnroute + m systemctl --now enable mailnn mailnnroute ;;& $MAIL_HOST) # we use dns to start wg if $reload; then sre unbound else - sstart unbound + m systemctl --now enable unbound fi ;;& $MAIL_HOST|bk) @@ -2771,10 +2828,15 @@ case $HOSTNAME in if $reload; then sre $vpnser else - sstart $vpnser + m systemctl --now enable $vpnser fi if ! systemctl is-active clamav-daemon >/dev/null; then - sstart clamav-daemon + m systemctl --now enable clamav-daemon + out=$(rsync -aiSAX --chown=root:root --chmod=g-s /a/bin/ds/filesystem/etc/systemd/system/epanicclean.{timer,service} /etc/systemd/system) + if [[ $out ]]; then + reload=true + fi + # note, this will cause paniclog entries because it takes like 45 # seconds for clamav to start, i use ./epanic-clean to remove # them. @@ -2786,13 +2848,13 @@ case $HOSTNAME in # need to wait a bit before restarting exim, else I # get a paniclog entry like: spam acl condition: all spamd servers failed sleep 3 - sstart mailclean.timer + m systemctl --now enable mailclean.timer ;;& $MAIL_HOST) # < 2.1 (eg: in t9), uses a different data format which required manual # migration. dont start if we are running an old version. if dpkg --compare-versions $(dpkg -s radicale | awk '$1 == "Version:" { print $2 }') ge 2.1; then - sstart radicale + m systemctl --now enable radicale fi ;;& esac @@ -2810,6 +2872,16 @@ esac sre exim4 +case $HOSTNAME in + $MAIL_HOST) + m systemctl --now enable mailbindwatchdog + ;; + *) + soff mailbindwatchdog + ;; +esac + + case $HOSTNAME in bk) sre exim4in ;; esac @@ -2844,7 +2916,7 @@ EOF test_to="testignore@expertpathologyreview.com, testignore@je.b8.nz, testignore@amnimal.ninja, jtuttle@gnu.org" cat >>/etc/cron.d/mailtest </usr/local/bin/send-test-forward <<'EOF' #!/bin/bash -exiqgrep -o 260 -i -r '^(testignore@(iankelling\.org|zroe\.org|expertpathologyreview\.com|amnimal\.ninja|je\.b8\.nz)|jtuttle@gnu\.org)$' | xargs /sbin/exim -Mrm >/dev/null +olds=( +$(/sbin/exiqgrep -o 260 -i -r '^(testignore@(iankelling\.org|zroe\.org|expertpathologyreview\.com|amnimal\.ninja|je\.b8\.nz)|jtuttle@gnu\.org)$') +) +if (( ${#olds[@]} )); then + /sbin/exim -Mrm "${olds[@]}" >/dev/null +fi EOF for test_from in ${test_froms[@]}; do cat >>/usr/local/bin/send-test-forward <