X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=b97f3b929a5fd4f1f16105d9c8bcadf8c66951e5;hb=0da09a2fa9c4ce921d5af5be8494c4a96cce43de;hp=abe98d97b61762b9f92339fc7bce1734baf29b0e;hpb=9d21aed0c95e0c343f2769a724d9dbb220874185;p=distro-setup diff --git a/mail-setup b/mail-setup index abe98d9..b97f3b9 100755 --- a/mail-setup +++ b/mail-setup @@ -1,7 +1,7 @@ #!/bin/bash set -x -# Copyright (C) 2016 Ian Kelling +# Copyright (C) 2019 Ian Kelling # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -15,7 +15,8 @@ set -x # See the License for the specific language governing permissions and # limitations under the License. -# todo: make quick backups of maildir, or deliver to multiple hosts. +# TODO: copy dkim keys from within this file. its now done in conflink. +# TODO: fix dkim key to b chmod 640, group Debian-exim set -eE -o pipefail trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR @@ -149,36 +150,6 @@ EOF ####### end persistent dkim instructions ######### -# misc exim notes: -# useful exim docs: -# /usr/share/doc/exim4-base/README.Debian.gz -# /usr/share/doc/exim4-base/spec.txt.gz - -# routers, transports, and authenticators are sections, and you define -# driver instances in those sections, and the manual calls them driver -# types but there is also a more specific "type" of driver, which is specified -# with the driver = some_module setting in the driver. - -# the driver option must precede and private options (options that are -# specific to that driver), so follow example of putting it at beginning. - -# The full list of option settings for any particular driver instance, -# including all the defaulted values, can be extracted by making use of -# the -bP command line option. -# exim -bP config_file to see what config file it used -# exim -bP config to see - -# exim clear out message queue. as root: -# adapted from somewhere on stackoverflow. -# ser stop exim4; sleep 1; exim -bp | exiqgrep -i | xargs exim -Mrm; ser start exim4 - -# fastmail has changed their smtp server, but the old one still works, -# I see no reason to bother changing. -# New one is smtp.fastmail.com - -# test delivery & rewrite settings: -#exim4 -bt iank@localhost - e() { printf "%s\n" "$*"; } pi() { # package install @@ -212,7 +183,7 @@ if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then vpn_ser=openvpn fi -if [[ $HOSTNAME == $MAIL_HOST ]]; then +if [[ $HOSTNAME == "$MAIL_HOST" ]]; then # afaik, these will get ignored because they are routing to my own # machine, but rm them is safer rm -f $(eval echo ~$u)/.forward /root/.forward @@ -272,7 +243,7 @@ source /a/bin/bash_unpublished/source-state mkdir -p /etc/exim4/conf.d/{main,transport,auth,router} cat >/etc/exim4/rcpt_local_acl <<'EOF' -# Only hosts we control send to mail.iankelling.org, so make sure +# Only hosts we control send to @mail.iankelling.org, so make sure # they are all authed. # Note, if we wanted authed senders for all domains, # we could make this condition in acl_check_mail @@ -291,13 +262,18 @@ cat >/etc/exim4/data_local_acl <<'EOF' # suggested in official docs, and 100k in the wiki example because # those docs are rather old and I see a 110k spam message # pretty quickly looking through my spam folder. - warn - condition = ${if < {$message_size}{2000K}} - spam = Debian-exim:true - add_header = X-Spam_score: $spam_score\n\ - X-Spam_score_int: $spam_score_int\n\ - X-Spam_bar: $spam_bar\n\ - X-Spam_report: $spam_report +warn + condition = ${if < {$message_size}{2000K}} + spam = Debian-exim:true + add_header = X-Spam_score: $spam_score\n\ + X-Spam_score_int: $spam_score_int\n\ + X-Spam_bar: $spam_bar\n\ + X-Spam_report: $spam_report + +#accept +# spf = pass:fail:softfail:none:neutral:permerror:temperror +# dmarc_status = reject:quarantine +# add_header = Reply-to: dmarctest@iankelling.org EOF cat >/etc/exim4/conf.d/auth/29_exim4-config_auth <<'EOF' @@ -340,6 +316,11 @@ dovecot_lmtp: batch_max = 200 EOF +cat >/etc/exim4/host_local_deny_exceptions <<'EOF' +mail.fsf.org +*.posteo.de +EOF + cat >/etc/exim4/conf.d/router/190_exim4-config_fsfsmarthost <<'EOF' # smarthost for fsf mail # ian: copied from /etc/exim4/conf.d/router/200_exim4-config_primary, and added senders = and @@ -360,6 +341,7 @@ EOF #### begin mail cert setup ### f=/usr/local/bin/mail-cert-cron cat >$f <<'EOF' +#!/bin/bash set -eE -o pipefail trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR @@ -369,7 +351,7 @@ f=/a/bin/bash_unpublished/source-state if [[ -e $f ]]; then source $f fi -if [[ $HOSTNAME == $MAIL_HOST ]]; then +if [[ $HOSTNAME == "$MAIL_HOST" ]]; then local_mx=mail.iankelling.org rsync_common="rsync -ogtL --chown=root:Debian-exim --chmod=640 root@li.iankelling.org:/etc/letsencrypt/live/$local_mx/" ${rsync_common}fullchain.pem /etc/exim4/exim.crt @@ -416,6 +398,11 @@ systemctl start mailcert systemctl restart mailcert.timer systemctl enable mailcert.timer +# This symlink is only here to so I can use the +# fsf mailman ansible role and trick its cert script +# into doing nothing. +/a/exe/lnf -T /etc/exim4/exim.crt /etc/letsencrypt/live/$(hostname -f)/fullchain.pem + ##### end mailcert setup ##### # comon stuff @@ -430,12 +417,12 @@ dc_mailname_in_oh='true' EOF -if [[ $HOSTNAME == $MAIL_HOST ]]; then +if [[ $HOSTNAME == "$MAIL_HOST" ]]; then # mail.iankelling.org so local imap clients can connect with tls and # when they happen to not be local. sed -ri -f - /etc/hosts <<'EOF' -/^127\.0\.1\.1.* mail\.iankelling\.org\b/q +/^127\.0\.1\.1.* mail\.iankelling\.org\b/{p;d} /^127\.0\.1\.1 /s/ *$/ mail.iankelling.org/ EOF /a/exe/cedit mail /etc/dnsmasq-servers.conf <<'EOF' || [[ $? == 1 ]] @@ -553,8 +540,25 @@ CHECK_DATA_VERIFY_HEADER_SENDER = true CHECK_RCPT_SPF = true CHECK_RCPT_REVERSE_DNS = true CHECK_MAIL_HELO_ISSUED = true + +MAIN_LOG_SELECTOR = +all + +# testing dmarc +#dmarc_tld_file = /etc/public_suffix_list.dat EOF + f=/etc/cron.daily/refresh-dmarc-tld-file + cat >$f <<'EOF' +#!/bin/bash +cd /etc +wget -q -N https://publicsuffix.org/list/public_suffix_list.dat +EOF + chmod 755 $f + + sed -i --follow-symlinks -f - /etc/aliases </etc/dovecot/local.conf <<'EOF' + cat >/etc/dovecot/local.conf <>/etc/exim4/update-exim4.conf.conf < /etc/mailname + # We set this to alerts on MAIL_HOST, but using a user that doesn't exist elsewhere + # is no good. + sed -i --follow-symlinks -f - /etc/aliases </etc/cron.d/mailtest <<'EOF' -*/10 * * * * iank echo body_test | mail -s "primary_test $(date +%s) $(date +%Y-%m-%dT%H:%M:%S%z)" iank@posteo.de -2/10 * * * * root /usr/local/bin/mailtest-check +if [[ $HOSTNAME == "$MAIL_HOST" ]]; then + f=/usr/local/bin/send-test-forward + cat >$f <<'EOF' +#!/bin/bash +echo body_test | mail -s "primary_test $(date +%s) $(date +%Y-%m-%dT%H:%M:%S%z)" iank@posteo.de +EOF + chmod +x $f + + cat >/etc/cron.d/mailtest <&1 | /usr/local/bin/log-once send-test-forward +*/10 * * * * $u /usr/local/bin/mailtest-check 2>&1 | /usr/local/bin/log-once -1 send-test-forward +*/10 * * * * root chmod -R g+rw /m/md/bounces 2>&1 | /usr/local/bin/log-once -1 bounces-chmod EOF cp /a/bin/distro-setup/filesystem/usr/local/bin/mailtest-check /usr/local/bin else @@ -876,7 +912,7 @@ fi # for when MAIL_HOST changes, so radicale gets the synced files and # does not stop us from remounting /o. if dpkg -s radicale &>/dev/null; then - if [[ $HOSTNAME == $MAIL_HOST ]]; then + if [[ $HOSTNAME == "$MAIL_HOST" ]]; then systemctl restart radicale systemctl enable radicale if [[ -e /etc/logrotate.d/radicale.disabled ]]; then