X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=bbe0defeb3f803a1cedf759c9b1e62f6c77389a0;hb=fde3746c622eb042ce1fd051cdfea2f9a247cd53;hp=5d184932481fdbafee2d9c5e63be3584446df8dc;hpb=b28eebdf9143aa17733f233b30b96f462008f3b6;p=distro-setup diff --git a/mail-setup b/mail-setup index 5d18493..bbe0def 100755 --- a/mail-setup +++ b/mail-setup @@ -3,6 +3,12 @@ # Copyright (C) 2019 Ian Kelling # SPDX-License-Identifier: AGPL-3.0-or-later +# todo: check new macro DKIM_TIMESTAMPS + +# todo: check if REMOTE_SMTP_INTERFACE or REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE can simplify my or fsfs config + +# todo: max line length macro changed in t11. look into it +# todo: check that all macros we use are still valid in t11 # todo: setup an alert for bouncing test emails. @@ -460,7 +466,7 @@ m usermod -a -G Debian-exim clamav i /etc/systemd/system/clamav-daemon.service.d/fix.conf </etc/exim4/conf.d/main/000_local2 </etc/exim4/conf.d/transport/11_iank <<'EOF' +# This unsets the default macro defined in on t11 in +# /etc/exim4/conf.d/transport/10_exim4-config_transport-macros +# It seems like a very odd choice that this has become +# the default in t11. Normal smarthost clients use username/password +# auth. Oh well. +REMOTE_SMTP_SMARTHOST_TLS_VERIFY_HOSTS == +EOF +else + rm -f /etc/exim4/conf.d/transport/11_iank +fi + cat >/etc/exim4/conf.d/main/000_local <<'EOF' MAIN_TLS_ENABLE = true @@ -1143,13 +1226,7 @@ smtp_accept_queue_per_connection = 500 DKIM_CANON = relaxed DKIM_SELECTOR = li -# from comments in -# https://debian-administration.org/article/718/DKIM-signing_outgoing_mail_with_exim4 -# and its best for this to align https://tools.ietf.org/html/rfc7489#page-8 -# There could be some circumstance when the -# from: isnt our domain, but the envelope sender is -# and so still want to sign, but I cant think of any case. -DKIM_DOMAIN = ${lc:${domain:$rh_from:}} + # The file is based on the outgoing domain-name in the from-header. # sign if key exists DKIM_PRIVATE_KEY = ${if exists{/etc/exim4/${dkim_domain}-private.pem} {/etc/exim4/${dkim_domain}-private.pem}} @@ -1202,6 +1279,24 @@ smtp_reserve_hosts = +iank_trusted LOCAL_DENY_EXCEPTIONS_LOCAL_ACL_FILE = /etc/exim4/conf.d/local_deny_exceptions_acl EOF +if dpkg --compare-versions "$(dpkg-query -f='${Version}\n' --show exim4)" ge 4.94; then + cat >>/etc/exim4/conf.d/main/000_local <<'EOF' +# In t11, we cant do the old anymore because this is tainted data used in a file lookup. +# /usr/share/doc/exim4/NEWS.Debian.gz suggests to use lookups to untaint data. +DKIM_DOMAIN = ${lookup {${domain:$rh_from:}}lsearch,ret=key{/etc/exim4/conf.d/my-dkim-domains}} +EOF +else + cat >>/etc/exim4/conf.d/main/000_local <<'EOF' +# From comments in +# https://debian-administration.org/article/718/DKIM-signing_outgoing_mail_with_exim4 +# and its best for this to align https://tools.ietf.org/html/rfc7489#page-8 +# There could be some circumstance when the +# from: isnt our domain, but the envelope sender is +# and so still want to sign, but I cant think of any case. +DKIM_DOMAIN = ${lc:${domain:$rh_from:}} +EOF +fi + rm -fv /etc/exim4/rcpt_local_acl # old path i /etc/exim4/conf.d/local_deny_exceptions_acl <<'EOF' @@ -1257,6 +1352,207 @@ warn EOF + +# old file +rm -fv /etc/exim4/conf.d/router/880_backup_copy + + +# It is important for this to exist everywhere except in MAIL_HOST +# non-nn config. Previously, just had it in the nn-config on MAIL_HOST, +# but that is a problem if we change mail host and still have something +# in the queue which was destined for this router, but hosts were +# unreachable, the routers will be reevaluated on the next retry. +i /etc/exim4/conf.d/router/890_backup_copy < {$max_received_linelength}{998} {1}{0}} -.endif + message_linelength_limit = 2097152 .ifdef REMOTE_SMTP_HOSTS_AVOID_TLS hosts_avoid_tls = REMOTE_SMTP_HOSTS_AVOID_TLS .endif @@ -1351,10 +1645,8 @@ i /etc/exim4/conf.d/transport/30_smarthost_dkim <<'EOF' smarthost_dkim: debug_print = "T: remote_smtp_smarthost for $local_part@$domain" driver = smtp + message_linelength_limit = 2097152 multi_domain -.ifndef IGNORE_SMTP_LINE_LENGTH_LIMIT - message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}} -.endif hosts_try_auth = <; ${if exists{CONFDIR/passwd.client} \ {\ ${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$host_address}}\ @@ -1442,7 +1734,7 @@ if mailhost; then # in the log it just says "Starting Radicale". If you run # it in the foreground, it will give more info. Background # plus debug does not help. - # sudo -u radicale radicale -D -f + # sudo -u radicale radicale -D # created password file with: # htpasswd -c /p/c/machine_specific/li/filesystem/etc/caldav-htpasswd @@ -1507,7 +1799,7 @@ EOF # disable power management feature, set to 240 min sync interval, # so it shouldn't be bad. - # davdroid from f-druid. + # davx^5 from f-droid # login with url and user name # url https://cal.iankelling.org/ian # username ian @@ -1956,6 +2248,8 @@ if [[ $HOSTNAME == bk ]]; then rcdir=${rcdirs[i]} rcbase=${rcdir##*/} ncdir=${ncdirs[i]} + myncdir=/root/${ncdir##*/} + mkdir -p $myncdir # copied from debians cronjob i /etc/cron.d/$rcbase <tmp.php <$myncdir/tmp.php <config.php - # leave in place for debugging - #m rm -f tmp.php - m sudo -u www-data php $ncdir/occ maintenance:update:htaccess + e running php $myncdir/tmp.php + # note: we leave it around place for debugging + php $myncdir/tmp.php >config.php + cd $ncdir + m sudo -u www-data php occ maintenance:update:htaccess list=$(sudo -u www-data php $ncdir/occ --output=json_pretty app:list) # user_external not compaible with nc 23 for app in contacts calendar; do if [[ $(printf "%s\n" "$list"| jq ".enabled.$app") == null ]]; then - m sudo -u www-data php $ncdir/occ app:install $app + cd $ncdir + m sudo -u www-data php occ app:install $app fi done i /etc/systemd/system/$ncbase.service <&2 - /sbin/exim -t <&2 + # -odf or else systemd will kill the background delivery process + # and the message will sit in the queue until the next queue run. + exim -odf -t < {$max_received_linelength}{998} {1}{0}} -.endif - hosts_require_auth = * - hosts_try_auth = * - envelope_to_add - # manual return path because we want it to be the envelope sender - # we got not the one we are using in this smtp transport - headers_add = "Return-path: $sender_address" -.ifdef REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS - hosts_avoid_tls = REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS -.endif -.ifdef REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS - hosts_require_tls = REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS -.endif -.ifdef REMOTE_SMTP_SMARTHOST_TLS_VERIFY_CERTIFICATES - tls_verify_certificates = REMOTE_SMTP_SMARTHOST_TLS_VERIFY_CERTIFICATES -.endif -.ifdef REMOTE_SMTP_SMARTHOST_TLS_VERIFY_HOSTS - tls_verify_hosts = REMOTE_SMTP_SMARTHOST_TLS_VERIFY_HOST -.endif -.ifdef REMOTE_SMTP_HEADERS_REWRITE - headers_rewrite = REMOTE_SMTP_HEADERS_REWRITE -.endif -.ifdef REMOTE_SMTP_HELO_DATA - helo_data=REMOTE_SMTP_HELO_DATA -.endif -.ifdef TLS_DH_MIN_BITS -tls_dh_min_bits = TLS_DH_MIN_BITS -.endif -.ifdef REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE -tls_certificate = REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE -.endif -.ifdef REMOTE_SMTP_SMARTHOST_PRIVATEKEY -tls_privatekey = REMOTE_SMTP_SMARTHOST_PRIVATEKEY -.endif -.ifdef REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE - headers_remove = REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE -.endif -EOF - - # this avoids some error. i cant remember what. todo: - # test it out and document why/if its needed. - # i /etc/exim4/host_local_deny_exceptions <<'EOF' - # mail.fsf.org - # *.posteo.de - # EOF + # This allows for forwarded mail to not get most rcpt checks, especially SPF, + # which would incorrectly get denied. + i /etc/exim4/host_local_deny_exceptions <<'EOF' +mail.fsf.org +*.posteo.de +EOF # cron email from smarthost hosts will automatically be to # USER@FQDN. I redirect that to alerts@, on the smarthosts, but in @@ -2886,7 +3137,7 @@ EOF echo|i /etc/exim4/conf.d/router/188_exim4-config_smarthost echo|i /etc/exim4/conf.d/router/190_exim4-config_fsfsmarthost echo|i /etc/exim4/conf.d/rcpt_local_acl - echo|i /etc/exim4/conf.d/router/890_backup_copy + echo|i /etc/exim4/conf.d/router/865_backup_redir echo|i /etc/exim4/conf.d/main/000_local-nn echo|i /etc/exim4/conf.d/clamav_data_acl @@ -2923,7 +3174,7 @@ EOF echo | /a/exe/cedit nn /etc/hosts || [[ $? == 1 ]] echo | /a/exe/cedit mail /etc/dnsmasq-servers.conf || [[ $? == 1 ]] - + # note: condition duplicated at else if $bhost_t; then install -d /bu install -d -g Debian-exim -o Debian-exim -m 771 /bu/md @@ -2971,7 +3222,7 @@ Restart=always RestartSec=20 EOF - else + else # if $bhost_t; then cat >>/etc/exim4/update-exim4.conf.conf <>/etc/myexim4/conf.d/main/000_local-nn <<'EOF' + # config for the non-nn exim. note, it uses not default dir, but we + # generate that into the default config file + m rsync -ra --delete --delete-excluded --exclude=/conf.d/main/000_local-nn --exclude=/conf.d/router/890_backup_copy /etc/exim4/ /etc/myexim4 + cat >>/etc/myexim4/conf.d/main/000_local <<'EOF' # this makes it easier to see which exim is doing what log_file_path = /var/log/exim4/my%s EOF + + cat >/etc/logrotate.d/myexim <<'EOF' /var/log/exim4/mymain /var/log/exim4/myreject { daily @@ -3124,6 +3378,12 @@ if $reload; then m systemctl daemon-reload fi +# checking bhost_t is redundant, but could help us catch errors. +if $bhost_t || [[ -e /etc/wireguard/wghole.conf ]]; then + # todo: in mail-setup, we have a static list of backup hosts, not *y + m systemctl --now enable wg-quick@wghole +fi + sysd-prom-fail-install epanicclean m systemctl --now enable epanicclean @@ -3296,10 +3556,12 @@ EOF # Dont put these test messages into the sent folder or else it will # overwhelm it, plus i dont want to save a copy at all. - rm -f /etc/exim4/ignore-sent - for t in ${test_tos[@]}; do - echo $t >> /etc/exim4/ignore-sent - done + # Plus addresses we generally want to ignore. + i /etc/exim4/ignore-sent </usr/local/bin/send-test-forward <<'EOF' #!/bin/bash @@ -3324,7 +3586,7 @@ EOF esac cat >>/usr/local/bin/send-test-forward <