X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=9b9a97c04589f8a356c65d0b0b80260df06dc010;hb=8fc333f8c2d69d0792f3742d4f4351e7acb07d9e;hp=6a291c444748eacd3dbafd6d1e4dcf202aa37cf3;hpb=c24cd5dbf70ec9639adc5800a742eba698593f23;p=distro-setup diff --git a/mail-setup b/mail-setup index 6a291c4..9b9a97c 100755 --- a/mail-setup +++ b/mail-setup @@ -14,6 +14,9 @@ # todo: handle errors like this: # Mar 02 12:44:26 kw systemd[1]: exim4.service: Found left-over process 68210 (exim4) in control group while starting unit. Ignoring. # Mar 02 12:44:26 kw systemd[1]: This usually indicates unclean termination of a previous run, or service implementation deficiencies. +#eg: on eggs, on may 1st, ps grep for exim, 2 daemons running. 1 leftover from a month ago +#Debian-+ 1954 1 0 36231 11560 4 Apr02 ? 00:40:25 /usr/sbin/exim4 -bd -q30m +#Debian-+ 23058 1954 0 36821 10564 0 20:38 ? 00:00:00 /usr/sbin/exim4 -bd -q30m # todo: harden dovecot. need to do some research. one way is for it to only listen on a wireguard vpn interface, so only clients that are on the vpn can access it. # todo: consider hardening cups listening on 0.0.0.0 @@ -287,7 +290,8 @@ i() { # install file local base="${dest##*/}" local dir="${dest%/*}" if [[ $dir != "$base" ]]; then - mkdir -p ${dest%/*} + # dest has a directory component + mkdir -p "$dir" fi ir=false # i result tmpdir=$(mktemp -d) @@ -343,7 +347,6 @@ stopifactive() { mxhost=mx.iankelling.org mxport=587 -forward=$u@$mxhost # old setup. left as comment for example # mxhost=mail.messagingengine.com @@ -465,8 +468,48 @@ EOF # old. #vpnser=mailvpn.service -# todo: this hangs if it cant resolv the endpoint. we -# want it to just retry in the background. +# note: this hangs if it cant resolv the endpoint. we +# want it to just retry in the background. i just use a static ip instead. +# +# Note: at least on t10, on reboot, the service fails to come up according to systemd, but +# in reality it is up and working, then it tries to restart infinitely, and fails +# because it detects that the interface exists. +# +# failing output: +# +# Aug 02 21:59:27 sy wg-quick[2092]: [#] sysctl -q net.ipv4.conf.all.src_valid_mark=1 +# Aug 02 21:59:27 sy wg-quick[2248]: [#] iptables-restore -n +# Aug 02 21:59:27 sy wg-quick[2249]: Another app is currently holding the xtables lock. Perhaps you want to use the -w option? +# Aug 02 21:59:27 sy wg-quick[2259]: [#] iptables-restore -n +# Aug 02 21:59:27 sy wg-quick[2260]: Another app is currently holding the xtables lock. Perhaps you want to use the -w option? +# Aug 02 21:59:27 sy systemd[1]: wg-quick@wgmail.service: Main process exited, code=exited, status=4/NOPERMISSION + + +# successful output. +# Aug 03 14:12:47 sy wg-quick[711336]: [#] sysctl -q net.ipv4.conf.all.src_valid_mark=1 +# Aug 03 14:12:47 sy wg-quick[711384]: [#] iptables-restore -n +# Aug 03 14:12:47 sy wg-quick[711336]: [#] ping -w10 -c1 10.8.0.1 ||: +# Aug 03 14:12:47 sy wg-quick[711389]: PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data. +# Aug 03 14:12:47 sy wg-quick[711389]: 64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=73.0 ms +# Aug 03 14:12:47 sy wg-quick[711389]: --- 10.8.0.1 ping statistics --- +# Aug 03 14:12:47 sy wg-quick[711389]: 1 packets transmitted, 1 received, 0% packet loss, time 0ms +# Aug 03 14:12:47 sy wg-quick[711389]: rtt min/avg/max/mdev = 72.993/72.993/72.993/0.000 ms +# Aug 03 14:12:47 sy systemd[1]: Finished WireGuard via wg-quick(8) for wgmail. +# Aug 02 21:59:27 sy systemd[1]: wg-quick@wgmail.service: Failed with result 'exit-code'. +# Aug 02 21:59:27 sy systemd[1]: Failed to start WireGuard via wg-quick(8) for wgmail. +# Aug 02 21:59:47 sy systemd[1]: wg-quick@wgmail.service: Scheduled restart job, restart counter is at 1. +# Aug 02 21:59:47 sy systemd[1]: Stopped WireGuard via wg-quick(8) for wgmail. +# Aug 02 21:59:47 sy systemd[1]: Starting WireGuard via wg-quick(8) for wgmail... +# Aug 02 21:59:47 sy wg-quick[3424]: wg-quick: `wgmail' already exists +# Aug 02 21:59:47 sy systemd[1]: wg-quick@wgmail.service: Main process exited, code=exited, status=1/FAILURE +# Aug 02 21:59:47 sy systemd[1]: wg-quick@wgmail.service: Failed with result 'exit-code'. +# Aug 02 21:59:47 sy systemd[1]: Failed to start WireGuard via wg-quick(8) for wgmail. + + +# According to iptables -S and iptables -t nat -S, +# there are no modifications to iptables rules on a succsfull run, +# and + vpnser=wg-quick@wgmail.service case $HOSTNAME in @@ -1000,10 +1043,8 @@ awk 'BEGIN { FS = ":" } ; $6 ~ /^\/home/ && $7 !~ /\/nologin$/ { print $1 }' /et esac done -if ! grep -q "^ncsoft:" /etc/aliases; then - echo "ncsoft: graceq2323@gmail.com" |m tee -a /etc/aliases -fi +. /a/bin/bash_unpublished/priv-mail-setup m gpasswd -a iank adm #needed for reading logs @@ -1186,6 +1227,19 @@ delay_warning_condition = ${if or {\ { match{$h_auto-submitted:}{(?i)auto-generated|auto-replied} }\ { match_domain{$domain}{+local_domains} }\ } {no}{yes}} + + +# enable 587 in addition to the default 25, so that +# i can send mail where port 25 is firewalled by isp +daemon_smtp_ports = 25 : 587 +# default of 25, can get stuck when catching up on mail +smtp_accept_max = 400 +smtp_accept_reserve = 100 +smtp_reserve_hosts = +iank_trusted + +# Rules that make receiving more liberal should be on backup hosts +# so that we dont reject mail accepted by MAIL_HOST +LOCAL_DENY_EXCEPTIONS_LOCAL_ACL_FILE = /etc/exim4/conf.d/local_deny_exceptions_acl EOF rm -fv /etc/exim4/rcpt_local_acl # old path @@ -1225,8 +1279,7 @@ warn warn !hosts = +iank_trusted - # They dont send spam, but needed this because - # smarthosts connect with residential ips and thus get flagged as spam. + # Smarthosts connect with residential ips and thus get flagged as spam if we do a spam check. !authenticated = plain_server:login_server condition = ${if < {$message_size}{5000K}} spam = Debian-exim:true @@ -1236,12 +1289,6 @@ warn add_header = X-Spam_report: $spam_report add_header = X-Spam_action: $spam_action -warn - !authenticated = plain_server:login_server - condition = ${if def:malware_name} - remove_header = Subject: - add_header = Subject: [Clamav warning: $malware_name] $h_subject - log_message = heuristic malware warning: $malware_name #accept # spf = pass:fail:softfail:none:neutral:permerror:temperror @@ -1500,7 +1547,7 @@ EOF # disable power management feature, set to 240 min sync interval, # so it shouldn't be bad. - # davdroid from f-druid. + # davx^5 from f-droid # login with url and user name # url https://cal.iankelling.org/ian # username ian @@ -1607,7 +1654,7 @@ EOF cat <<'EOF' # https://ssl-config.mozilla.org ssl = required -# this is the same as the certbot list, in my cert cronjob, I check if that has changed upstream. +# this is the same as the certbot list, i check changes in /a/bin/ds/filesystem/usr/local/bin/check-lets-encrypt-ssl-settings ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl_protocols = TLSv1.2 ssl_prefer_server_ciphers = no @@ -1618,7 +1665,7 @@ protocol lmtp { mail_plugins = $mail_plugins sieve } EOF - if dpkg --compare-versions $(dpkg-query -f='${Version}\n' --show dovecot-core) ge 1:2.3; then + if dpkg --compare-versions "$(dpkg-query -f='${Version}\n' --show dovecot-core)" ge 1:2.3; then cat <config.php - m rm -f tmp.php + e running php tmp.php + php tmp.php >config.php + # leave in place for debugging + #m rm -f tmp.php m sudo -u www-data php $ncdir/occ maintenance:update:htaccess list=$(sudo -u www-data php $ncdir/occ --output=json_pretty app:list) # user_external not compaible with nc 23 @@ -2302,22 +2351,39 @@ EOF systemctl enable --now $ncbase.timer i /usr/local/bin/ncup <<'EOFOUTER' #!/bin/bash -if ! test "$BASH_VERSION"; then echo "error: shell is not bash" >&2; exit 1; fi -shopt -s inherit_errexit 2>/dev/null ||: # ignore fail in bash < 4.4 -set -eE -o pipefail -trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" exit status: $?, PIPESTATUS: ${PIPESTATUS[*]}" >&2' ERR -ncbase=$1 -if ! php /var/www/$ncbase/updater/updater.phar -n; then +source /usr/local/lib/err + +m() { printf "%s\n" "$*"; "$@"; } +err-cleanup() { echo failed nextcloud update for $ncbase >&2 - /sbin/exim -t <>/etc/exim4/conf.d/main/000_local <>/etc/cron.d/mailtest <>/usr/local/bin/send-test-forward <