X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=b0454841ad1874b53f5a9dc85890743183fb9275;hb=77917a8fbf2032a8b2634a1b3de0879ec45cf213;hp=b28bedf004b895d497ccb3c98c2f61f602947fab;hpb=efcfe83c7df501547696e38d822232e67b94644f;p=distro-setup diff --git a/mail-setup b/mail-setup index b28bedf..b045484 100755 --- a/mail-setup +++ b/mail-setup @@ -4,14 +4,23 @@ # Copyright (C) 2019 Ian Kelling # SPDX-License-Identifier: AGPL-3.0-or-later +if [ -z "$BASH_VERSION" ]; then echo "error: shell is not bash" >&2; exit 1; fi -set -x +pre="${0##*/}:" +m() { printf "$pre %s\n" "$*"; "$@"; } +e() { printf "$pre %s\n" "$*"; } +err() { echo "[$(date +'%Y-%m-%d %H:%M:%S%z')]: $0: $*" >&2; } -# TODO: copy dkim keys from within this file. its now done in conflink. -# TODO: fix dkim key to b chmod 640, group Debian-exim +shopt -s nullglob -set -eE -o pipefail -trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR +if [[ -s /usr/local/lib/err ]]; then + source /usr/local/lib/err +elif [[ -s /a/bin/errhandle/err ]]; then + source /a/bin/errhandle/err +else + err "no err tracing script found" + exit 1 +fi [[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@" if [[ ! $SUDO_USER ]]; then @@ -26,9 +35,6 @@ usage() { Usage: ${0##*/} Setup exim4 & dovecot & related things -The minimal assumption we have is that /etc/mailpass exists - - -h|--help Print help and exit. EOF exit $1 @@ -44,7 +50,9 @@ EOF # background: ovecot does not yet have ocsp stapling support # reference: https://community.letsencrypt.org/t/simple-guide-using-lets-encrypt-ssl-certs-with-dovecot/2921 # -# for phone, same thing but username alerts, pass in ivy-pass. +# for phone, k9mail, same thing but username alerts, pass in ivy-pass. +# also, l2.b8.nz for secondary alerts +# fetching mail settings: folder poll frequency 10 minutes ####### @@ -53,30 +61,19 @@ EOF # # for hosts which have all private files I just use the same user # # for other hosts, each one get\'s their own password. # # for generating secure pass, and storing for server too: -# # user=USUALLY_SAME_AS_HOSTNAME -# user=li # f=$(mktemp) +# I use $HOSTNAME as username # apg -m 50 -x 70 -n 1 -a 1 -M CLN >$f -# s sed -i "/^$user:/d" /p/c/filesystem/etc/exim4/passwd -# echo "$user:$(mkpasswd -m sha-512 -s <$f)" >>/p/c/filesystem/etc/exim4/passwd -# # todo: port is no longer used in mailpass, remove it. -# echo "mail.iankelling.org 587 $user:$(<$f)" >> /p/c/machine_specific/$user/filesystem/etc/mailpass -# # then run this script, or part of it which uses /etc/mailpass +# s sed -i "/^$HOSTNAME:/d" /p/c/filesystem/etc/exim4/passwd +# echo "$HOSTNAME:$(mkpasswd -m sha-512 -s <$f)" >>/p/c/filesystem/etc/exim4/passwd +# reference: exim4_passwd_client(5) +# echo "mail.iankelling.org:$HOSTNAME:$(<$f)" > /p/c/machine_specific/$HOSTNAME/filesystem/etc/exim4/passwd.client +# # then run this script # # dovecot password, i just need 1 as I\'m the only user # mkdir /p/c/filesystem/etc/dovecot # echo "iank:$(doveadm pw -s ssha256)::::::" >>/p/c/filesystem/etc/dovecot/users -# conflink - - -# # for ad-hoc testing of some random new host sending mail: -# user=li # client host username & hostname -# f=$(mktemp) -# apg -m 50 -x 70 -n 1 -a 1 -M CLN >$f -# s sed -i "/^$user:/d" /etc/exim4/passwd -# echo "$user:$(mkpasswd -m sha-512 -s <$f)" | s tee -a /etc/exim4/passwd -# echo "mail.iankelling.org:$user:$(<$f)" | ssh root@$user dd of=/etc/exim4/passwd.client ####### end perstent password instructions ###### @@ -102,12 +99,7 @@ EOF # # lines 2+: append to hold space # echo "txt record contents:" # echo "v=DKIM1; k=rsa; p=$(sed -n '${x;s/\n//gp};2,$H' $domain.pem)" -# chmod 644 $domain.pem -# chmod 640 $domain-private.pem -# # in conflink, we chown these to group debian -# conflink # # selector was also put into /etc/exim4/conf.d/main/000_local, -# # via the mail-setup scripts # # 2017-02 dmarc policies: # # host -t txt _dmarc.gmail.com @@ -141,7 +133,7 @@ EOF # * functions constants e() { printf "%s\n" "$*"; } -pi() { # package install +pi() { # package install without starting daemons local f if dpkg -s -- "$@" &> /dev/null; then return 0; @@ -149,9 +141,20 @@ pi() { # package install while fuser /var/lib/dpkg/lock &>/dev/null; do sleep 1; done f=/var/cache/apt/pkgcache.bin; if [[ ! -r $f ]] || (( $(( $(date +%s) - $(stat -c %Y $f ) )) > 60*60*12 )); then - apt-get update + m apt-get update + fi + f=/usr/sbin/policy-rc.d + dd of=$f 2>/dev/null <>/etc/default/spamassassin - systemctl enable spamassassin - systemctl start spamassassin - systemctl reload spamassassin + m systemctl enable spamassassin + m systemctl start spamassassin + m systemctl reload spamassassin cat >/etc/systemd/system/spamddnsfix.service <<'EOF' [Unit] @@ -258,9 +268,9 @@ OnUnitActiveSec=550 [Install] WantedBy=timers.target EOF - systemctl daemon-reload - systemctl restart spamddnsfix.timer - systemctl enable spamddnsfix.timer + m systemctl daemon-reload + m systemctl restart spamddnsfix.timer + m systemctl enable spamddnsfix.timer fi # [[ $HOSTNAME != "$MAIL_HOST" ]] ##### end spamassassin config @@ -280,7 +290,7 @@ if [[ -e /p/c/filesystem ]]; then # systemd, buuut it can remake the tun device unexpectedly, i got this in the log # after my internet was down for a bit: # NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device. - /a/exe/vpn-mk-client-cert -b mail -n mail -s /b/ds/mail-route li.iankelling.org + m /a/exe/vpn-mk-client-cert -b mail -n mail -s /b/ds/mail-route li.iankelling.org fi fi @@ -298,27 +308,23 @@ f=/a/bin/bash_unpublished/source-state if [[ -e $f ]]; then source $f fi -if [[ $HOSTNAME == "$MAIL_HOST" ]]; then - local_mx=mail.iankelling.org - rsync_common="rsync -ogtL --chown=root:Debian-exim --chmod=640 root@li.iankelling.org:/etc/letsencrypt/live/$local_mx/" - ${rsync_common}fullchain.pem /etc/exim4/exim.crt - ret=$? - ${rsync_common}privkey.pem /etc/exim4/exim.key - new_ret=$? - if [[ $ret != $new_ret ]]; then - echo "$0: error: differing rsync returns, $ret, $new_ret" - exit 1 - fi +if [[ $HOSTNAME != "$MAIL_HOST" ]]; then + exit 0 fi -if [[ $new_ret != 0 ]]; then - if ! openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/exim4/exim.crt; then - echo "$0: error!: cert rsync failed and it will expire in less than 3 days" - exit 1 - fi +local_mx=mail.iankelling.org +mkdir -p /etc/letsencrypt/live/$local_mx +chmod 700 /etc/letsencrypt/live +rsync_common="rsync -ogtL --chown=root:Debian-exim --chmod=640 root@li.iankelling.org:/etc/letsencrypt/live/$local_mx/" +# allow for temporary connection issues +${rsync_common}fullchain.pem /etc/exim4/exim.crt ||: +${rsync_common}privkey.pem /etc/exim4/exim.key ||: +if ! openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/exim4/exim.crt; then + echo "$0: error!: cert rsync failed and it will expire in less than 3 days" + exit 1 fi exit 0 EOF -chmod 755 $f +m chmod 755 $f cat >/etc/systemd/system/mailcert.service <<'EOF' [Unit] @@ -340,44 +346,50 @@ OnCalendar=daily [Install] WantedBy=timers.target EOF -systemctl daemon-reload -systemctl start mailcert -systemctl restart mailcert.timer -systemctl enable mailcert.timer +m systemctl daemon-reload +m systemctl start mailcert +m systemctl restart mailcert.timer +m systemctl enable mailcert.timer # * common exim4 config source /a/bin/bash_unpublished/source-state +if [[ ! $MAIL_HOST ]]; then + err "\$MAIL_HOST not set" +fi + +m sudo gpasswd -a iank adm #needed for reading logs + ### make local bounces go to normal maildir # local mail that bounces goes to /Maildir or /root/Maildir dirs=(/m/md/bounces/{cur,tmp,new}) -mkdir -p ${dirs[@]} -chown -R $u:Debian-exim /m/md/bounces -chmod 775 ${dirs[@]} -usermod -a -G Debian-exim $u +m mkdir -p ${dirs[@]} +m chown iank:iank /m /m/md +m ln -sfT /m/md /m/iank +m chmod 700 /m /m/md +m chown -R $u:Debian-exim /m/md/bounces +m chmod 775 ${dirs[@]} +m usermod -a -G Debian-exim $u for d in /Maildir /root/Maildir; do if [[ ! -L $d ]]; then - rm -rf $d + m rm -rf $d fi - ln -sf -T /m/md/bounces $d + m ln -sf -T /m/md/bounces $d done - -### begin setup passwd.client -f=/etc/exim4/passwd.client -rm -f /etc/exim4/passwd.client -install -m 640 -g Debian-exim /dev/null $f -while read -r domain _ pass; do - # reference: exim4_passwd_client(5) - printf "%s:%s\n" "$domain" "$pass" >>$f -done 175_$b -rm -f /etc/exim4/conf.d/main/000_localmacros # old filename +rm -vf /etc/exim4/conf.d/main/000_localmacros # old filename cat >/etc/exim4/conf.d/main/000_local </etc/exim4/conf.d/rcpt_local_acl <<'EOF' # Only hosts we control send to @mail.iankelling.org, so make sure # they are all authed. @@ -419,7 +461,7 @@ deny !authenticated = * domains = mail.iankelling.org EOF -rm -f /etc/exim4/data_local_acl # old path +rm -fv /etc/exim4/data_local_acl # old path cat >/etc/exim4/conf.d/data_local_acl <<'EOF' # Except for the "condition =", this was # a comment in the check_data acl. The comment about this not @@ -516,10 +558,9 @@ dc_local_interfaces='' dc_mailname_in_oh='true' EOF -# * if MAIL_HOST -if [[ $HOSTNAME == "$MAIL_HOST" ]]; then - # ** dovecot - ####### begin dovecot setup ######## + +# ** dovecot +dovecot-setup() { # based on a little google and package search, just the dovecot # packages we need instead of dovecot-common. # @@ -532,14 +573,23 @@ if [[ $HOSTNAME == "$MAIL_HOST" ]]; then # internet. I was torn about whether to do this or not, meh. pi dovecot-core dovecot-imapd dovecot-sieve dovecot-lmtpd + for f in /p/c{/machine_specific/$HOSTNAME,}/filesystem/etc/dovecot/users; do + e $f + if [[ -e $f ]]; then + m sudo rsync -ahhi --chown=root:dovecot --chmod=0640 $f /etc/dovecot/ + break + fi + done for f in /p/c/subdir_files/sieve/*sieve /a/c/subdir_files/sieve/*sieve; do - sudo -u $u /a/exe/lnf -T $f $(eval echo ~$u)/sieve/${f##*/} + m sudo -u $u /a/exe/lnf -T $f $uhome/sieve/${f##*/} done - # if we changed 90-sieve.conf and removed the active part of the + # If we changed 90-sieve.conf and removed the active part of the # sieve option, we wouldn\'t need this, but I\'d rather not modify a # default config if not needed. This won\'t work as a symlink in /a/c # unfortunately. - sudo -u $u /a/exe/lnf -T sieve/main.sieve $(eval echo ~$u)/.dovecot.sieve + if [[ -e $uhome/sieve/personal.sieve ]]; then + m sudo -u $u /a/exe/lnf -T sieve/main.sieve $uhome/.dovecot.sieve + fi # we set this later in local.conf sed -ri -f - /etc/dovecot/conf.d/10-mail.conf <<'EOF' @@ -601,7 +651,7 @@ ssl_cipher_list = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDH # ian: added this, more secure, per google etc ssl_prefer_server_ciphers = yes - +# ian: %u is used for alerts user vs iank mail_location = maildir:/m/%u:LAYOUT=fs:INBOX=/m/%u/INBOX mail_uid = $u mail_gid = $u @@ -611,40 +661,56 @@ mail_gid = $u # auth_verbose=yes #mail_debug=yes EOF - ####### end dovecot setup ######## + ####### end dovecot-setup ######## +} + + + +# * if MAIL_HOST +case $HOSTNAME in + $MAIL_HOST) + dovecot-setup - # ** exim + # ** exim - # mail.iankelling.org so local imap clients can connect with tls and - # when they happen to not be local. - sed -ri -f - /etc/hosts <<'EOF' + sudo rsync -ahhi --chown=root:Debian-exim --chmod=0640 \ + /p/c/filesystem/etc/exim4/passwd /p/c/filesystem/etc/exim4/*.pem /etc/exim4/ + + + # mail.iankelling.org so local imap clients can connect with tls and + # when they happen to not be local. + sed -ri -f - /etc/hosts <<'EOF' /^127\.0\.1\.1.* mail\.iankelling\.org\b/{p;d} /^127\.0\.1\.1 /s/ *$/ mail.iankelling.org/ EOF - /a/exe/cedit mail /etc/dnsmasq-servers.conf <<'EOF' || [[ $? == 1 ]] + + # note: systemd-resolved will consult /etc/hosts, dnsmasq wont. this assumes + # weve configured this file in dnsmasq if we are using it. + /a/exe/cedit mail /etc/dnsmasq-servers.conf <<'EOF' || [[ $? == 1 ]] server=/mail.iankelling.org/127.0.1.1 EOF - if systemctl is-active dnsmasq >/dev/null; then - systemctl reload dnsmasq - fi + if systemctl is-active dnsmasq >/dev/null; then + m systemctl restart dnsmasq + fi + m nscd -i hosts - # I used to use debconf-set-selections + dpkg-reconfigure, - # which then updates this file - # but the process is slower than updating it directly and then I want to set other things in - # update-exim4.conf.conf, so there's no point. - # The file is documented in man update-exim4.conf, - # except the man page is not perfect, read the bash script to be sure about things. + # I used to use debconf-set-selections + dpkg-reconfigure, + # which then updates this file + # but the process is slower than updating it directly and then I want to set other things in + # update-exim4.conf.conf, so there's no point. + # The file is documented in man update-exim4.conf, + # except the man page is not perfect, read the bash script to be sure about things. - # The debconf questions output is additional documentation that is not - # easily accessible, but super long, along with the initial default comment in this - # file, so I've saved that into ./mail-notes.conf. + # The debconf questions output is additional documentation that is not + # easily accessible, but super long, along with the initial default comment in this + # file, so I've saved that into ./mail-notes.conf. - cat >>/etc/exim4/update-exim4.conf.conf <>/etc/exim4/update-exim4.conf.conf < /etc/mailname + echo mail.iankelling.org > /etc/mailname - # MAIN_HARDCODE_PRIMARY_HOSTNAME might mess up the - # smarthost config type, not sure. all other settings - # would be unused in that config type. - cat >>/etc/exim4/conf.d/main/000_local <>/etc/exim4/conf.d/main/000_local <$f <<'EOF' + f=/etc/cron.daily/refresh-dmarc-tld-file + cat >$f <<'EOF' #!/bin/bash cd /etc wget -q -N https://publicsuffix.org/list/public_suffix_list.dat EOF - chmod 755 $f + m chmod 755 $f - sed -i --follow-symlinks -f - /etc/aliases <$d/override.conf <<'EOF' + # https://selivan.github.io/2017/12/30/systemd-serice-always-restart.html + d=/etc/systemd/system/openvpn@mail.service.d + m mkdir -p $d + cat >$d/override.conf <<'EOF' [Service] Restart=always # time to sleep before restarting a service @@ -757,63 +800,90 @@ RestartSec=1 # StartLimitIntervalSec in recent systemd versions StartLimitInterval=0 EOF - if ! systemctl cat openvpn@mail.service|grep -xF StartLimitInterval=0 &>/dev/null; then - # needed for the above config to go into effect - systemctl daemon-reexec - fi - + if ! systemctl cat openvpn@mail.service|grep -xF StartLimitInterval=0 &>/dev/null; then + # needed for the above config to go into effect + m systemctl daemon-reexec + fi - systemctl enable mailclean.timer - systemctl start mailclean.timer - systemctl restart $vpn_ser@mail - systemctl enable $vpn_ser@mail - systemctl enable dovecot - systemctl restart dovecot + m systemctl enable mailclean.timer + m systemctl start mailclean.timer + m systemctl restart $vpn_ser@mail + m systemctl enable $vpn_ser@mail + m systemctl enable dovecot + m systemctl restart dovecot + ;; # * not MAIL_HOST -else # $HOSTNAME != $MAIL_HOST - # remove mail. 2 lines to properly remove whitespace - sed -ri -f - /etc/hosts <<'EOF' + *) # $HOSTNAME != $MAIL_HOST + # remove mail. uses 2 lines to properly remove whitespace + sed -ri -f - /etc/hosts <<'EOF' s#^(127\.0\.1\.1 .*) +mail\.iankelling\.org$#\1# s#^(127\.0\.1\.1 .*)mail\.iankelling\.org +(.*)#\1\2# EOF - echo | /a/exe/cedit mail /etc/dnsmasq-servers.conf || [[ $? == 1 ]] - if systemctl is-active dnsmasq >/dev/null; then - systemctl reload dnsmasq - fi - - systemctl disable mailclean.timer &>/dev/null ||: - systemctl stop mailclean.timer &>/dev/null ||: - systemctl disable $vpn_ser@mail - systemctl stop $vpn_ser@mail - systemctl disable dovecot ||: - systemctl stop dovecot ||: - # - # - # would only exist because I wrote it i the previous condition, - # it\'s not part of exim - rm -f /etc/exim4/conf.d/main/000_localmacros - cat >>/etc/exim4/update-exim4.conf.conf </dev/null; then + m systemctl restart dnsmasq # reload does not ensure new config is used + fi + m nscd -i hosts + + m systemctl disable mailclean.timer &>/dev/null ||: + m systemctl stop mailclean.timer &>/dev/null ||: + m systemctl disable $vpn_ser@mail + m systemctl stop $vpn_ser@mail + # + # + # would only exist because I wrote it i the previous condition, + # it\'s not part of exim + rm -fv /etc/exim4/conf.d/main/000_localmacros + cat >>/etc/exim4/update-exim4.conf.conf < /etc/mailname + hostname -f >/etc/mailname - # This ends up at alerts mailbox on MAIL_HOST, but using a user that doesn't exist elsewhere - # is no good. - sed -i --follow-symlinks -f - /etc/aliases <>/etc/exim4/update-exim4.conf.conf <>/etc/exim4/update-exim4.conf.conf <> /etc/fstab + echo "/nocow/exim4 /var/spool/exim4 none bind 0 0" >>/etc/fstab fi if ! mountpoint -q $sdir; then - systemctl stop exim4 + m systemctl stop exim4 if [[ -L $sdir ]]; then - rm $sdir + m rm $sdir fi if [[ ! -e $dir && -d $sdir ]]; then - mv $sdir $dir + m mv $sdir $dir fi if [[ ! -d $sdir ]]; then - mkdir $sdir - chmod 000 $sdir # only want it to be used when its mounted + m mkdir $sdir + m chmod 000 $sdir # only want it to be used when its mounted fi - mount $sdir + m mount $sdir fi fi @@ -857,19 +927,19 @@ fi # i have the spool directory be common to distro multi-boot, so # we need the uid to be the same. 608 cuz it's kind of in the middle # of the free system uids. -IFS=:; read _ _ uid _ < <(getent passwd Debian-exim ||:) ||:; unset IFS -IFS=:; read _ _ gid _ < <(getent group Debian-exim ||:) ||:; unset IFS +IFS=:; read -r _ _ uid _ < <(getent passwd Debian-exim ||:) ||:; unset IFS +IFS=:; read -r _ _ gid _ < <(getent group Debian-exim ||:) ||:; unset IFS if [[ ! $uid ]]; then # from /var/lib/dpkg/info/exim4-base.postinst, plus uid and gid options - adduser --uid 608 --system --group --quiet --home /var/spool/exim4 \ - --no-create-home --disabled-login --force-badname Debian-exim + m adduser --uid 608 --system --group --quiet --home /var/spool/exim4 \ + --no-create-home --disabled-login --force-badname Debian-exim elif [[ $uid != 608 ]]; then - systemctl stop exim4 ||: - usermod -u 608 Debian-exim - groupmod -g 608 Debian-exim - usermod -g 608 Debian-exim - find / /nocow -xdev -uid $uid -exec chown -h 608 {} + - find / /nocow -xdev -gid $gid -exec chgrp -h 608 {} + + m systemctl stop exim4 ||: + m usermod -u 608 Debian-exim + m groupmod -g 608 Debian-exim + m usermod -g 608 Debian-exim + m find / /nocow -path ./var/tmp -prune -o -xdev -uid $uid -execdir chown -h 608 {} + + m find / /nocow -path ./var/tmp -prune -o -xdev -gid $gid -execdir chgrp -h 608 {} + fi @@ -878,64 +948,61 @@ fi # * reload exim if systemctl is-active exim4 >/dev/null; then - systemctl reload exim4 + m systemctl reload exim4 else - systemctl start exim4 + m systemctl start exim4 fi # * mail monitoring / testing -if [[ $HOSTNAME == "$MAIL_HOST" ]]; then - f=/usr/local/bin/send-test-forward - cat >$f <<'EOFOUTER' + +case $HOSTNAME in + $MAIL_HOST|l2) + # note: cronjob "ian" also does some important monitoring + cat >/etc/cron.d/mailtest <>/etc/cron.d/mailtest </usr/local/bin/send-test-forward </etc/cron.d/mailtest <&1 | /usr/local/bin/log-once send-test-forward -*/10 * * * * $u /usr/local/bin/mailtest-check 2>&1 | /usr/local/bin/log-once -1 mailtest-check -*/10 * * * * root chmod -R g+rw /m/md/bounces 2>&1 | /usr/local/bin/log-once -1 bounces-chmod -EOF - cp /a/bin/distro-setup/filesystem/usr/local/bin/mailtest-check /usr/local/bin -else - rm -f /etc/cron.d/mailtest -fi -# * Radicale - -# MAIL_HOST also does radicale, and easier to start and stop it here -# for when MAIL_HOST changes, so radicale gets the synced files and -# does not stop us from remounting /o. -if dpkg -s radicale &>/dev/null; then - if [[ $HOSTNAME == "$MAIL_HOST" ]]; then - systemctl restart radicale - systemctl enable radicale - if [[ -e /etc/logrotate.d/radicale.disabled ]]; then - mv /etc/logrotate.d/radicale{.disabled,} - fi - else - systemctl stop radicale - systemctl disable radicale - # weekly logrotate tries to restart radicale even if it's a disabled service in flidas. - if [[ -e /etc/logrotate.d/radicale ]]; then - mv /etc/logrotate.d/radicale{,.disabled} - fi - fi -fi - # * misc -sudo -u $u ln -sf -T /m/.mu /home/$u/.mu +m sudo -u $u ln -sf -T /m/.mu /home/$u/.mu # /etc/alias setup is debian specific, and exim postinst script sets up