X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=b0454841ad1874b53f5a9dc85890743183fb9275;hb=77917a8fbf2032a8b2634a1b3de0879ec45cf213;hp=9b30579ba5c002062e386dfe5055f6bc69169f97;hpb=f95f9128ba77e77d41389810affd475581075246;p=distro-setup diff --git a/mail-setup b/mail-setup index 9b30579..b045484 100755 --- a/mail-setup +++ b/mail-setup @@ -1,26 +1,28 @@ #!/bin/bash -set -x +# -*- eval: (outline-minor-mode); -*- +# * intro +# Copyright (C) 2019 Ian Kelling +# SPDX-License-Identifier: AGPL-3.0-or-later -# Copyright (C) 2016 Ian Kelling +if [ -z "$BASH_VERSION" ]; then echo "error: shell is not bash" >&2; exit 1; fi -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at +pre="${0##*/}:" +m() { printf "$pre %s\n" "$*"; "$@"; } +e() { printf "$pre %s\n" "$*"; } +err() { echo "[$(date +'%Y-%m-%d %H:%M:%S%z')]: $0: $*" >&2; } -# http://www.apache.org/licenses/LICENSE-2.0 +shopt -s nullglob -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# todo: make quick backups of maildir, or deliver to multiple hosts. - -set -eE -o pipefail -trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR +if [[ -s /usr/local/lib/err ]]; then + source /usr/local/lib/err +elif [[ -s /a/bin/errhandle/err ]]; then + source /a/bin/errhandle/err +else + err "no err tracing script found" + exit 1 +fi -[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@" +[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@" if [[ ! $SUDO_USER ]]; then echo "$0: error: requires running as nonroot or sudo" exit 1 @@ -30,32 +32,14 @@ u=$SUDO_USER usage() { cat < preferences -> preferences -> advanced tab -> config editor button -> security.ssl.enable_ocsp_must_staple = false # background: ovecot does not yet have ocsp stapling support # reference: https://community.letsencrypt.org/t/simple-guide-using-lets-encrypt-ssl-certs-with-dovecot/2921 +# +# for phone, k9mail, same thing but username alerts, pass in ivy-pass. +# also, l2.b8.nz for secondary alerts +# fetching mail settings: folder poll frequency 10 minutes ####### -####### begin perstent password instructions ###### +# * perstent password instructions # # exim passwords: # # for hosts which have all private files I just use the same user # # for other hosts, each one get\'s their own password. # # for generating secure pass, and storing for server too: -# # user=USUALLY_SAME_AS_HOSTNAME -# user=li # f=$(mktemp) +# I use $HOSTNAME as username # apg -m 50 -x 70 -n 1 -a 1 -M CLN >$f -# s sed -i "/^$user:/d" /p/c/filesystem/etc/exim4/passwd -# echo "$user:$(mkpasswd -m sha-512 -s <$f)" >>/p/c/filesystem/etc/exim4/passwd -# echo "mail.iankelling.org 587 $user:$(<$f)" >> /p/c/machine_specific/$user/filesystem/etc/mailpass -# # then run this script, or part of it which uses /etc/mailpass +# s sed -i "/^$HOSTNAME:/d" /p/c/filesystem/etc/exim4/passwd +# echo "$HOSTNAME:$(mkpasswd -m sha-512 -s <$f)" >>/p/c/filesystem/etc/exim4/passwd +# reference: exim4_passwd_client(5) +# echo "mail.iankelling.org:$HOSTNAME:$(<$f)" > /p/c/machine_specific/$HOSTNAME/filesystem/etc/exim4/passwd.client +# # then run this script # # dovecot password, i just need 1 as I\'m the only user # mkdir /p/c/filesystem/etc/dovecot -# echo "iank:$(doveadm pw -s ssha256)::::::" >/p/c/filesystem/etc/dovecot/users -# conflink +# echo "iank:$(doveadm pw -s ssha256)::::::" >>/p/c/filesystem/etc/dovecot/users - - -# # for ad-hoc testing of some random new host sending mail: -# user=li # client host username & hostname -# f=$(mktemp) -# apg -m 50 -x 70 -n 1 -a 1 -M CLN >$f -# s sed -i "/^$user:/d" /etc/exim4/passwd -# echo "$user:$(mkpasswd -m sha-512 -s <$f)" | s tee -a /etc/exim4/passwd -# echo "mail.iankelling.org:$user:$(<$f)" | ssh root@$user dd of=/etc/exim4/passwd.client ####### end perstent password instructions ###### -####### begin persistent dkim/dns instructions ######### +# * persistent dkim/dns instructions # # Remove 1 level of comments in this section, set the domain var # # for the domain you are setting up, then run this and copy dns settings # # into dns. @@ -121,12 +99,7 @@ fi # # lines 2+: append to hold space # echo "txt record contents:" # echo "v=DKIM1; k=rsa; p=$(sed -n '${x;s/\n//gp};2,$H' $domain.pem)" -# chmod 644 $domain.pem -# chmod 640 $domain-private.pem -# # in conflink, we chown these to group debian -# conflink -# # selector was also put into /etc/exim4/conf.d/main/000_localmacros, -# # via the mail-setup scripts +# # selector was also put into /etc/exim4/conf.d/main/000_local, # # 2017-02 dmarc policies: # # host -t txt _dmarc.gmail.com @@ -144,7 +117,6 @@ fi # # i include fastmail\'s settings, per their instructions, # # and follow their policy. In mail in a box, or similar instructions, # # I\'ve seen recommended to not use a restrictive policy. -# echo "spf dns: name is empty, value: v=spf1 a include:spf.messagingengine.com ?all" # # to check if dns has updated, you do # host -a mesmtp._domainkey.$domain @@ -155,64 +127,37 @@ fi # cat <<'EOF' # mx records, 2 records each, for * and empty domain # pri 10 mail.iankelling.org -# pri 20 in1-smtp.messagingengine.com -# pri 30 in2-smtp.messagingengine.com # EOF ####### end persistent dkim instructions ######### -# misc exim notes: -# useful exim docs: -# /usr/share/doc/exim4-base/README.Debian.gz -# /usr/share/doc/exim4-base/spec.txt.gz - -# routers, transports, and authenticators are sections, and you define -# driver instances in those sections, and the manual calls them driver -# types but there is also a more specific "type" of driver, which is specified -# with the driver = some_module setting in the driver. - -# the driver option must precede and private options (options that are -# specific to that driver), so follow example of putting it at beginning. - -# The full list of option settings for any particular driver instance, -# including all the defaulted values, can be extracted by making use of -# the -bP command line option. -# exim -bP config_file to see what config file it used -# exim -bP config to see - -# exim clear out message queue. as root: -# adapted from somewhere on stackoverflow. -# ser stop exim4; sleep 1; exim -bp | exiqgrep -i | xargs exim -Mrm; ser start exim4 - -# fastmail has changed their smtp server, but the old one still works, -# I see no reason to bother changing. -# New one is smtp.fastmail.com - -# test delivery & rewrite settings: -#exim4 -bt iank@localhost - - -postconfin() { - local MAPFILE - mapfile -t - local s - postconf -ev "${MAPFILE[@]}" -} +# * functions constants e() { printf "%s\n" "$*"; } -pi() { # package install - local s f +pi() { # package install without starting daemons + local f if dpkg -s -- "$@" &> /dev/null; then return 0; fi; while fuser /var/lib/dpkg/lock &>/dev/null; do sleep 1; done f=/var/cache/apt/pkgcache.bin; if [[ ! -r $f ]] || (( $(( $(date +%s) - $(stat -c %Y $f ) )) > 60*60*12 )); then - apt-get update + m apt-get update + fi + f=/usr/sbin/policy-rc.d + dd of=$f 2>/dev/null < /dev/null; then - debconf-set-selections </dev/null; then - while fuser /var/lib/dpkg/lock &>/dev/null; do sleep 1; done - dpkg-reconfigure -u -fnoninteractive postfix - else - pi postfix - fi - else - source /a/bin/distro-functions/src/package-manager-abstractions - pi postfix - # Settings from reading the output when installing on debian, - # then seeing which were different in a default install on arch. - # I assume the same works for fedora. - postconfin <>$f - done - postmap hash:/etc/postfix/sasl_passwd - # need restart instead of reload when changing - # inet_protocols - service postfix restart - -else # begin exim. has debian specific stuff for now - - pi openvpn - - if [[ -e /p/c/filesystem ]]; then - # allow failure of these commands when our internet is down, they are likely not needed, - # we check that a valid cert is there already. - # to put the hostname in the known hosts - if ! ssh -o StrictHostKeyChecking=no root@li.iankelling.org :; then - # This just causes failure if our cert is going to expire in the next 30 days. - # Certs I generate last 10 years. - openssl x509 -checkend $(( 60 * 60 * 24 * 30 )) -noout -in /etc/openvpn/mail.crt - else - # note, man openvpn implies we could just call mail-route on vpn startup/shutdown with - # systemd, buuut it can remake the tun device unexpectedly, i got this in the log - # after my internet was down for a bit: - # NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device. - /a/exe/vpn-mk-client-cert -b mail -n mail -s /b/ds/mail-route li.iankelling.org - fi - fi - - cat >/etc/systemd/system/offlineimapsync.timer <<'EOF' +uhome=$(eval echo ~$u) +### * user forward file + +case $HOSTNAME in + $MAIL_HOST|l2) + # afaik, these will get ignored on MAIL_HOST because they are routing to my own + # machine, but rm them is safer + rm -fv $uhome/.forward /root/.forward + ;; + *) + # this can\'t be a symlink and has permission restrictions + # it might work in /etc/aliases, but this seems more proper. + e setting $uhome/.forward to $forward + install -m 644 {-o,-g}$u <(e $forward) $uhome/.forward + ;; +esac + +# * Mail clean cronjob + +cat >/etc/systemd/system/mailclean.timer <<'EOF' [Unit] -Description=Run offlineimap-sync once every min +Description=Run mailclean daily [Timer] -OnCalendar=*:0/1 +OnCalendar=monthly [Install] WantedBy=timers.target EOF - cat >/etc/systemd/system/offlineimapsync.service </etc/systemd/system/mailclean.service </etc/systemd/system/mailclean.timer <<'EOF' +systemctl daemon-reload + + +# * spamassassin + +if [[ $HOSTNAME != "$MAIL_HOST" ]]; then + m systemctl stop spamassassin + m systemctl disable spamassassin +else + + # per readme.debian + sed -i '/^\s*CRON\s*=/d' /etc/default/spamassassin + e CRON=1 >>/etc/default/spamassassin + # just noticed this in the config file, seems like a good idea. + sed -i '/^\s*NICE\s*=/d' /etc/default/spamassassin + e 'NICE="--nicelevel 15"' >>/etc/default/spamassassin + + m systemctl enable spamassassin + m systemctl start spamassassin + m systemctl reload spamassassin + + cat >/etc/systemd/system/spamddnsfix.service <<'EOF' [Unit] -Description=Run mailclean daily +Description=spamd dns bug fix cronjob + +[Service] +Type=oneshot +ExecStart=/a/bin/distro-setup/spamd-dns-fix +EOF + # 2017-09, debian closed the bug on this saying upstream had fixed it. + # remove this when i\'m using the newer package, ie, debian 10, or maybe + # ubuntu 18.04. + cat >/etc/systemd/system/spamddnsfix.timer <<'EOF' +[Unit] +Description=run spamd bug fix script every 10 minutes [Timer] -OnCalendar=monthly +OnActiveSec=60 +# the script looks back 9 minutes into the journal, +# it takes a second to run, +# so lets run every 9 minutes and 10 seconds. +OnUnitActiveSec=550 [Install] WantedBy=timers.target EOF + m systemctl daemon-reload + m systemctl restart spamddnsfix.timer + m systemctl enable spamddnsfix.timer + +fi # [[ $HOSTNAME != "$MAIL_HOST" ]] +##### end spamassassin config + + +# * Update mail cert +if [[ -e /p/c/filesystem ]]; then + # allow failure of these commands when our internet is down, they are likely not needed, + # we check that a valid cert is there already. + # to put the hostname in the known hosts + if ! ssh -o StrictHostKeyChecking=no root@li.iankelling.org :; then + # This just causes failure if our cert is going to expire in the next 30 days. + # Certs I generate last 10 years. + openssl x509 -checkend $(( 60 * 60 * 24 * 30 )) -noout -in /etc/openvpn/mail.crt + else + # note, man openvpn implies we could just call mail-route on vpn startup/shutdown with + # systemd, buuut it can remake the tun device unexpectedly, i got this in the log + # after my internet was down for a bit: + # NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device. + m /a/exe/vpn-mk-client-cert -b mail -n mail -s /b/ds/mail-route li.iankelling.org + fi +fi + + - cat >/etc/systemd/system/mailclean.service <$f <<'EOF' +#!/bin/bash +set -eE -o pipefail +trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR + +[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@" + +f=/a/bin/bash_unpublished/source-state +if [[ -e $f ]]; then + source $f +fi +if [[ $HOSTNAME != "$MAIL_HOST" ]]; then + exit 0 +fi +local_mx=mail.iankelling.org +mkdir -p /etc/letsencrypt/live/$local_mx +chmod 700 /etc/letsencrypt/live +rsync_common="rsync -ogtL --chown=root:Debian-exim --chmod=640 root@li.iankelling.org:/etc/letsencrypt/live/$local_mx/" +# allow for temporary connection issues +${rsync_common}fullchain.pem /etc/exim4/exim.crt ||: +${rsync_common}privkey.pem /etc/exim4/exim.key ||: +if ! openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/exim4/exim.crt; then + echo "$0: error!: cert rsync failed and it will expire in less than 3 days" + exit 1 +fi +exit 0 +EOF +m chmod 755 $f + +cat >/etc/systemd/system/mailcert.service <<'EOF' [Unit] -Description=Delete and archive old mail files +Description=Mail cert rsync After=multi-user.target [Service] -User=$u Type=oneshot -ExecStart=/a/bin/log-quiet/sysd-mail-once mailclean /a/bin/distro-setup/mailclean +ExecStart=/a/bin/log-quiet/sysd-mail-once mailcert /usr/local/bin/mail-cert-cron EOF - systemctl daemon-reload +cat >/etc/systemd/system/mailcert.timer <<'EOF' +[Unit] +Description=Run mail-cert once a day - # wording of question from dpkg-reconfigure exim4-config - # 1. internet site; mail is sent and received directly using SMTP - # 2. mail sent by smarthost; received via SMTP or fetchmail - # 3. mail sent by smarthost; no local mail - # 4. local delivery only; not on a network - # 5. no configuration at this time - # - # Note, I have used option 2 in the past for receiving mail - # from lan hosts, sending external mail via another smtp server. - # - # Note, other than configtype, we could set all the options in - # both types of configs without harm, they would either be - # ignored or be disabled by other settings, but the default - # local_interfaces definitely makes things more secure. - - # most of these settings get translated into settings - # in /etc/exim4/update-exim4.conf.conf - # how /etc/exim4/update-exim4.conf.conf translates into actual exim settings is - # documented in man update-exim4.conf, which outputs to the config that - # exim actually reads. except the man page is not perfect, for example, - # it doesn't document that it sets - # DCconfig_${dc_eximconfig_configtype}" "1" - # which is a line from update-exim4.conf, which is a relatively short bash script. - # mailname setting sets /etc/mailname - - debconf-set-selections </etc/exim4/rcpt_local_acl <<'EOF' -# Only hosts we control send to mail.iankelling.org, so make sure +if [[ ! $MAIL_HOST ]]; then + err "\$MAIL_HOST not set" +fi + +m sudo gpasswd -a iank adm #needed for reading logs + + +### make local bounces go to normal maildir +# local mail that bounces goes to /Maildir or /root/Maildir +dirs=(/m/md/bounces/{cur,tmp,new}) +m mkdir -p ${dirs[@]} +m chown iank:iank /m /m/md +m ln -sfT /m/md /m/iank +m chmod 700 /m /m/md +m chown -R $u:Debian-exim /m/md/bounces +m chmod 775 ${dirs[@]} +m usermod -a -G Debian-exim $u +for d in /Maildir /root/Maildir; do + if [[ ! -L $d ]]; then + m rm -rf $d + fi + m ln -sf -T /m/md/bounces $d +done + +# Note, even the server needs permissions of this file right +# if it exists, so do this up here. +f=/p/c/filesystem/etc/exim4/passwd.client +if [[ ! -e $f ]]; then + f=/p/c/machine_specific/$HOSTNAME/filesystem/etc/exim4/passwd.client +fi +m sudo rsync -ahhi --chown=root:Debian-exim --chmod=0640 $f /etc/exim4/ + +# by default, only 10 days of logs are kept. increase that. +m sed -ri 's/^(\s*rotate\s).*/\11000/' /etc/logrotate.d/exim4-base + + +## https://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost +# i only need .forwards, so just doing that one. +cd /etc/exim4/conf.d/router +b=userforward_higher_priority +# replace the router name so it is unique +sed -r s/^\\S+:/$b:/ 600_exim4-config_userforward >175_$b + + +rm -vf /etc/exim4/conf.d/main/000_localmacros # old filename +cat >/etc/exim4/conf.d/main/000_local </etc/exim4/conf.d/rcpt_local_acl <<'EOF' +# Only hosts we control send to @mail.iankelling.org, so make sure # they are all authed. # Note, if we wanted authed senders for all domains, # we could make this condition in acl_check_mail @@ -418,7 +461,8 @@ deny !authenticated = * domains = mail.iankelling.org EOF - cat >/etc/exim4/data_local_acl <<'EOF' +rm -fv /etc/exim4/data_local_acl # old path +cat >/etc/exim4/conf.d/data_local_acl <<'EOF' # Except for the "condition =", this was # a comment in the check_data acl. The comment about this not # being suitable is mostly bs. The only thing related I found was to @@ -428,16 +472,21 @@ EOF # suggested in official docs, and 100k in the wiki example because # those docs are rather old and I see a 110k spam message # pretty quickly looking through my spam folder. - warn - condition = ${if < {$message_size}{2000K}} - spam = Debian-exim:true - add_header = X-Spam_score: $spam_score\n\ - X-Spam_score_int: $spam_score_int\n\ - X-Spam_bar: $spam_bar\n\ - X-Spam_report: $spam_report +warn + condition = ${if < {$message_size}{2000K}} + spam = Debian-exim:true + add_header = X-Spam_score: $spam_score\n\ + X-Spam_score_int: $spam_score_int\n\ + X-Spam_bar: $spam_bar\n\ + X-Spam_report: $spam_report + +#accept +# spf = pass:fail:softfail:none:neutral:permerror:temperror +# dmarc_status = reject:quarantine +# add_header = Reply-to: dmarctest@iankelling.org EOF - cat >/etc/exim4/conf.d/auth/29_exim4-config_auth <<'EOF' +cat >/etc/exim4/conf.d/auth/29_exim4-config_auth <<'EOF' # from 30_exim4-config_examples plain_server: @@ -451,7 +500,7 @@ server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}} .endif EOF - cat >/etc/exim4/conf.d/router/900_exim4-config_local_user <<'EOF' +cat >/etc/exim4/conf.d/router/900_exim4-config_local_user <<'EOF' ### router/900_exim4-config_local_user ################################# @@ -469,7 +518,7 @@ local_user: transport = LOCAL_DELIVERY cannot_route_message = Unknown user EOF - cat >/etc/exim4/conf.d/transport/30_exim4-config_dovecot_lmtp <<'EOF' +cat >/etc/exim4/conf.d/transport/30_exim4-config_dovecot_lmtp <<'EOF' dovecot_lmtp: driver = lmtp socket = /var/run/dovecot/lmtp @@ -477,7 +526,12 @@ dovecot_lmtp: batch_max = 200 EOF - cat >/etc/exim4/conf.d/router/190_exim4-config_fsfsmarthost <<'EOF' +cat >/etc/exim4/host_local_deny_exceptions <<'EOF' +mail.fsf.org +*.posteo.de +EOF + +cat >/etc/exim4/conf.d/router/190_exim4-config_fsfsmarthost <<'EOF' # smarthost for fsf mail # ian: copied from /etc/exim4/conf.d/router/200_exim4-config_primary, and added senders = and # replaced DCsmarthost with mail.fsf.org @@ -494,206 +548,201 @@ fsfsmarthost: EOF - #### begin mail cert setup ### - f=/usr/local/bin/mail-cert-cron - cat >$f <<'EOF' -set -eE -o pipefail -trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR +cat >/etc/exim4/update-exim4.conf.conf <<'EOF' +# default stuff, i havent checked if its needed +dc_minimaldns='false' +dc_relay_nets='' +CFILEMODE='644' +dc_use_split_config='true' +dc_local_interfaces='' +dc_mailname_in_oh='true' +EOF -[[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@" -f=/a/bin/bash_unpublished/source-semi-priv -if [[ -e $f ]]; then - source $f -fi -if [[ $HOSTNAME == $MAIL_HOST ]]; then - local_mx=mail.iankelling.org - rsync_common="rsync -ogtL --chown=root:Debian-exim --chmod=640 root@li.iankelling.org:/etc/letsencrypt/live/$local_mx/" - ${rsync_common}fullchain.pem /etc/exim4/exim.crt - ret=$? - ${rsync_common}privkey.pem /etc/exim4/exim.key - new_ret=$? - if [[ $ret != $new_ret ]]; then - echo "$0: error: differing rsync returns, $ret, $new_ret" - exit 1 - fi -fi -if [[ $new_ret != 0 ]]; then - if ! openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/exim4/exim.crt; then - echo "$0: error!: cert rsync failed and it will expire in less than 3 days" - exit 1 +# ** dovecot +dovecot-setup() { + # based on a little google and package search, just the dovecot + # packages we need instead of dovecot-common. + # + # dovecot-lmtpd is for exim to deliver to dovecot instead of maildir + # directly. The reason to do this is to use dovecot\'s sieve, which + # has extensions that allow it to be almost equivalent to exim\'s + # filter capabilities, some ways probably better, some worse, and + # sieve has the benefit of being supported in postfix and + # proprietary/weird environments, so there is more examples on the + # internet. I was torn about whether to do this or not, meh. + pi dovecot-core dovecot-imapd dovecot-sieve dovecot-lmtpd + + for f in /p/c{/machine_specific/$HOSTNAME,}/filesystem/etc/dovecot/users; do + e $f + if [[ -e $f ]]; then + m sudo rsync -ahhi --chown=root:dovecot --chmod=0640 $f /etc/dovecot/ + break fi -fi -exit 0 -EOF - chmod 755 $f - - cat >/etc/systemd/system/mailcert.service <<'EOF' -[Unit] -Description=Mail cert rsync -After=multi-user.target + done + for f in /p/c/subdir_files/sieve/*sieve /a/c/subdir_files/sieve/*sieve; do + m sudo -u $u /a/exe/lnf -T $f $uhome/sieve/${f##*/} + done + # If we changed 90-sieve.conf and removed the active part of the + # sieve option, we wouldn\'t need this, but I\'d rather not modify a + # default config if not needed. This won\'t work as a symlink in /a/c + # unfortunately. + if [[ -e $uhome/sieve/personal.sieve ]]; then + m sudo -u $u /a/exe/lnf -T sieve/main.sieve $uhome/.dovecot.sieve + fi -[Service] -Type=oneshot -ExecStart=/a/bin/log-quiet/sysd-mail-once mailcert /usr/local/bin/mail-cert-cron + # we set this later in local.conf + sed -ri -f - /etc/dovecot/conf.d/10-mail.conf <<'EOF' +/^\s*mail_location\s*=/d EOF - cat >/etc/systemd/system/mailcert.timer <<'EOF' -[Unit] -Description=Run mail-cert once a day + cat >/etc/dovecot/conf.d/20-lmtp.conf </etc/dovecot/local.conf </dev/null; then + m systemctl restart dnsmasq + fi + m nscd -i hosts + # I used to use debconf-set-selections + dpkg-reconfigure, + # which then updates this file + # but the process is slower than updating it directly and then I want to set other things in + # update-exim4.conf.conf, so there's no point. + # The file is documented in man update-exim4.conf, + # except the man page is not perfect, read the bash script to be sure about things. + # The debconf questions output is additional documentation that is not + # easily accessible, but super long, along with the initial default comment in this + # file, so I've saved that into ./mail-notes.conf. -# Please enter a semicolon-separated list of recipient domains for which this machine -# should consider itself the final destination. These domains are commonly called -# 'local domains'. The local hostname (kd.lan) and 'localhost' are always added -# to the list given here. + cat >>/etc/exim4/update-exim4.conf.conf < /etc/mailname # MAIN_HARDCODE_PRIMARY_HOSTNAME might mess up the # smarthost config type, not sure. all other settings # would be unused in that config type. - rm -f /etc/exim4/conf.d/main/000_localmacros # old filename - cat >/etc/exim4/conf.d/main/000_local <>/etc/exim4/conf.d/main/000_local </etc/dovecot/conf.d/20-lmtp.conf <$f <<'EOF' +#!/bin/bash +cd /etc +wget -q -N https://publicsuffix.org/list/public_suffix_list.dat EOF + m chmod 755 $f - - cat >/etc/dovecot/local.conf <<'EOF' -# so I can use a different login that my shell login for mail. this is -# worth doing solely for the reason that if this login is compromised, -# it won't also compromise my shell password. -!include conf.d/auth-passwdfile.conf.ext - -# settings derived from wiki and 10-ssl.conf -ssl = required -ssl_cert = $d/override.conf <<'EOF' [Service] Restart=always @@ -843,201 +800,230 @@ RestartSec=1 # StartLimitIntervalSec in recent systemd versions StartLimitInterval=0 EOF + if ! systemctl cat openvpn@mail.service|grep -xF StartLimitInterval=0 &>/dev/null; then + # needed for the above config to go into effect + m systemctl daemon-reexec + fi - systemctl enable offlineimapsync.timer - systemctl start offlineimapsync.timer - systemctl enable mailclean.timer - systemctl start mailclean.timer - systemctl restart $vpn_ser@mail - systemctl enable $vpn_ser@mail - systemctl enable dovecot - systemctl restart dovecot - - else # $HOSTNAME != $MAIL_HOST - systemctl disable offlineimapsync.timer &>/dev/null ||: - systemctl stop offlineimapsync.timer &>/dev/null ||: - systemctl disable mailclean.timer &>/dev/null ||: - systemctl stop mailclean.timer &>/dev/null ||: - systemctl disable $vpn_ser@mail - systemctl stop $vpn_ser@mail - systemctl disable dovecot ||: - systemctl stop dovecot ||: + + m systemctl enable mailclean.timer + m systemctl start mailclean.timer + m systemctl restart $vpn_ser@mail + m systemctl enable $vpn_ser@mail + m systemctl enable dovecot + m systemctl restart dovecot + ;; + # * not MAIL_HOST + *) # $HOSTNAME != $MAIL_HOST + # remove mail. uses 2 lines to properly remove whitespace + sed -ri -f - /etc/hosts <<'EOF' +s#^(127\.0\.1\.1 .*) +mail\.iankelling\.org$#\1# +s#^(127\.0\.1\.1 .*)mail\.iankelling\.org +(.*)#\1\2# +EOF + + echo | /a/exe/cedit mail /etc/dnsmasq-servers.conf || [[ $? == 1 ]] + if systemctl is-active dnsmasq >/dev/null; then + m systemctl restart dnsmasq # reload does not ensure new config is used + fi + m nscd -i hosts + + m systemctl disable mailclean.timer &>/dev/null ||: + m systemctl stop mailclean.timer &>/dev/null ||: + m systemctl disable $vpn_ser@mail + m systemctl stop $vpn_ser@mail # # # would only exist because I wrote it i the previous condition, # it\'s not part of exim - rm -f /etc/exim4/conf.d/main/000_localmacros - debconf-set-selections <>/etc/exim4/update-exim4.conf.conf < /etc/mailname - fi # end $HOSTNAME != $MAIL_HOST + hostname -f >/etc/mailname - # if we already have it installed, need to reconfigure, without being prompted - if dpkg -s exim4-config &>/dev/null; then - # gotta remove this, otherwise the set-selections are completely - # ignored. It woulda been nice if this was documented somewhere! - rm -f /etc/exim4/update-exim4.conf.conf - while fuser /var/lib/dpkg/lock &>/dev/null; do sleep 1; done - dpkg-reconfigure -u -fnoninteractive exim4-config - fi - # i have the spool directory be common to distro multi-boot, so - # we need the uid to be the same. 608 cuz it's kind of in the middle - # of the free system uids. - IFS=:; read _ _ uid _ < <(getent passwd Debian-exim ||:) ||:; unset IFS - IFS=:; read _ _ gid _ < <(getent group Debian-exim ||:) ||:; unset IFS - if [[ ! $uid ]]; then - # from /var/lib/dpkg/info/exim4-base.postinst, plus uid and gid options - adduser --uid 608 --system --group --quiet --home /var/spool/exim4 \ - --no-create-home --disabled-login --force-badname Debian-exim - elif [[ $uid != 608 ]]; then - systemctl stop exim4 ||: - usermod -u 608 Debian-exim - groupmod -g 608 Debian-exim - usermod -g 608 Debian-exim - find / /nocow -xdev -uid $uid -exec chown -h 608 {} + - find / /nocow -xdev -gid $gid -exec chgrp -h 608 {} + - fi + ;;& + ## we use this host to monitor MAIL_HOST + l2) + dovecot-setup + m systemctl enable dovecot + m systemctl restart dovecot + cat >>/etc/exim4/update-exim4.conf.conf <>/etc/exim4/update-exim4.conf.conf <>/etc/default/spamassassin - # just noticed this in the config file, seems like a good idea. - sed -i '/^\s*NICE\s*=/d' /etc/default/spamassassin - e 'NICE="--nicelevel 15"' >>/etc/default/spamassassin - systemctl start spamassassin - systemctl reload spamassassin +# this used to do a symlink, but, in the boot logs, /nocow would get mounted succesfully, +# about 2 seconds later, exim starts, and immediately puts into paniclog: +# honVi-0000u3-82 Failed to create directory "/var/spool/exim4/input": No such file or directory +# so, im trying a bind mount to get rid of that. +if [[ -e /nocow ]]; then + if ! grep -Fx "/nocow/exim4 /var/spool/exim4 none bind 0 0" /etc/fstab; then + echo "/nocow/exim4 /var/spool/exim4 none bind 0 0" >>/etc/fstab + fi + if ! mountpoint -q $sdir; then + m systemctl stop exim4 + if [[ -L $sdir ]]; then + m rm $sdir + fi + if [[ ! -e $dir && -d $sdir ]]; then + m mv $sdir $dir + fi + if [[ ! -d $sdir ]]; then + m mkdir $sdir + m chmod 000 $sdir # only want it to be used when its mounted + fi + m mount $sdir + fi +fi - cat >/etc/systemd/system/spamddnsfix.service <<'EOF' -[Unit] -Description=spamd dns bug fix cronjob -[Service] -Type=oneshot -ExecStart=/a/bin/distro-setup/spamd-dns-fix -EOF - # 2017-09, debian closed the bug on this saying upstream had fixed it. - # remove this when i\'m using the newer package, ie, debian 10, or maybe - # ubuntu 18.04. - cat >/etc/systemd/system/spamddnsfix.timer <<'EOF' -[Unit] -Description=run spamd bug fix script every 10 minutes -[Timer] -OnActiveSec=60 -# the script looks back 9 minutes into the journal, -# it takes a second to run, -# so lets run every 9 minutes and 10 seconds. -OnUnitActiveSec=550 +# ** exim/spool uid setup +# i have the spool directory be common to distro multi-boot, so +# we need the uid to be the same. 608 cuz it's kind of in the middle +# of the free system uids. +IFS=:; read -r _ _ uid _ < <(getent passwd Debian-exim ||:) ||:; unset IFS +IFS=:; read -r _ _ gid _ < <(getent group Debian-exim ||:) ||:; unset IFS +if [[ ! $uid ]]; then + # from /var/lib/dpkg/info/exim4-base.postinst, plus uid and gid options + m adduser --uid 608 --system --group --quiet --home /var/spool/exim4 \ + --no-create-home --disabled-login --force-badname Debian-exim +elif [[ $uid != 608 ]]; then + m systemctl stop exim4 ||: + m usermod -u 608 Debian-exim + m groupmod -g 608 Debian-exim + m usermod -g 608 Debian-exim + m find / /nocow -path ./var/tmp -prune -o -xdev -uid $uid -execdir chown -h 608 {} + + m find / /nocow -path ./var/tmp -prune -o -xdev -gid $gid -execdir chgrp -h 608 {} + +fi -[Install] -WantedBy=timers.target -EOF - systemctl daemon-reload - systemctl restart spamddnsfix.timer - systemctl enable spamddnsfix.timer - # - ##### end spamassassin config +# * reload exim +if systemctl is-active exim4 >/dev/null; then + m systemctl reload exim4 +else + m systemctl start exim4 +fi - # https://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost - # i only need .forwards, so just doing that one. - cd /etc/exim4/conf.d/router - b=userforward_higher_priority - # replace the router name so it is unique - sed -r s/^\\S+:/$b:/ 600_exim4-config_userforward >175_$b - # begin setup passwd.client - f=/etc/exim4/passwd.client - rm -f /etc/exim4/passwd.client - install -m 640 -g Debian-exim /dev/null $f - cat /etc/mailpass| while read -r domain port pass; do - # reference: exim4_passwd_client(5) - printf "%s:%s\n" "$domain" "$pass" >>$f - done - # end setup passwd.client +# * mail monitoring / testing - # by default, only 10 days of logs are kept. increase that. - sed -ri 's/^(\s*rotate\s).*/\11000/' /etc/logrotate.d/exim4-base +case $HOSTNAME in + $MAIL_HOST|l2) + # note: cronjob "ian" also does some important monitoring + cat >/etc/cron.d/mailtest <>/etc/cron.d/mailtest </usr/local/bin/send-test-forward </dev/null; then - if [[ $HOSTNAME == $MAIL_HOST ]]; then - systemctl restart radicale - systemctl enable radicale - if [[ -e /etc/logrotate.d/radicale.disabled ]]; then - mv /etc/logrotate.d/radicale{.disabled,} - fi - else - systemctl stop radicale - systemctl disable radicale - # weekly logrotate tries to restart radicale even if it's a disabled service in flidas. - if [[ -e /etc/logrotate.d/radicale ]]; then - mv /etc/logrotate.d/radicale{,.disabled} - fi - fi -fi exit 0 : -# if I wanted the from address to be renamed and sent to a different address, -# echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical -# sudo postmap hash:/etc/postfix/recipient_canonical -# sudo service postfix reload