X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=c6ce2a5d5266bb190a4920ba262ed29329099869;hb=38387a0fbfcc731fbd5785d4c035c5121a4c9281;hp=08ec7aed2126611e4641cde9924e0dad789e2433;hpb=07fbcf11a78d2ee20697eb98f5b7eeaa2475f1d1;p=distro-setup diff --git a/mail-setup b/mail-setup index 08ec7ae..c6ce2a5 100755 --- a/mail-setup +++ b/mail-setup @@ -107,7 +107,7 @@ # todo: run mailping test after running, or otherwise # clear out terminal alert -# todo: disable postgrey +# todo: disable postgrey. (why did we have it?) # todo: in testforward-check, we should also look @@ -361,7 +361,10 @@ reload=false if [[ -e /var/local/mail-setup-reload ]]; then reload=true fi -u() { # update file. note: duplicated in brc +# update file. +# if the file changed, ur=true, else false. +# note: duplicated in brc +u() { local tmp tmpdir dest="$1" local base="${dest##*/}" local dir="${dest%/*}" @@ -415,7 +418,6 @@ sre() { mailhost() { [[ $HOSTNAME == "$MAIL_HOST" ]] } -e() { printf "%s\n" "$*"; } reifactive() { for service; do if systemctl is-active $service >/dev/null; then @@ -454,7 +456,7 @@ fi bhost_t=false case $HOSTNAME in $MAIL_HOST) : ;; - kd|frodo|x2|x3|kw|sy|bo) + kd|x2|x3|kw|sy|bo|so) bhost_t=true ;; esac @@ -474,13 +476,30 @@ Pin-Priority: 500 EOF fi +# name change in t12, and now timer instead of cron option in /etc/default +first_spamd_run=false +if ! systemctl cat spamassassin-maintenance.timer &>/dev/null; then + first_spamd_run=true +fi + + # light version of exim does not have sasl auth support. # note: for bitfolk hosts, unbound has important config with conflink. pi-nostart exim4 exim4-daemon-heavy spamassassin unbound clamav-daemon wireguard +spamd_ser=spamd +if systemctl cat spamassassin &>/dev/null; then + spamd_ser=spamassassin +elif $first_spamd_run; then + systemctl start spamassassin-maintenance +fi + +systemctl enable --now spamassassin-maintenance.timer + # note: pyzor debian readme says you need to run some initialization command # but its outdated. -pi spf-tools-perl p0f postgrey pyzor razor jq moreutils certbot fail2ban +pi spf-tools-perl p0f pyzor razor jq moreutils certbot fail2ban +pu postgrey case $HOSTNAME in je) : ;; # not included due to using wireguard: openvpn @@ -509,6 +528,77 @@ fi # our nostart pi fails to avoid enabling + +# * initial dns config & daemon setup +# +# use systemd-resolved for glibc resolutions, setup symlinks + +pi libnss-resolve + +# if this link gets replaced with a normal file we will get exim log +# errors on MAIL_HOST like so: +# +# R=fsfsmarthost defer (-36) DT=0s: host lookup for mail.fsf.org did not complete (DNS timeout?) + +if [[ ! -L /etc/nsswitch.conf ]]; then + sudo mkdir -p /etc/resolved-nsswitch + sudo mv /etc/nsswitch.conf /etc/resolved-nsswitch + sudo ln -sf /etc/resolved-nsswitch/nsswitch.conf /etc +fi + +f=/etc/basic-nsswitch/nsswitch.conf +if [[ ! -e $f ]]; then + sudo mkdir -p ${f%/*} + sudo cp /etc/nsswitch.conf $f + sudo sed -i --follow-symlinks 's/^ *hosts:.*/hosts: files dns myhostname/' $f +fi +case $HOSTNAME in + bk|je) + # je should be able to get along systemd-resolved, but ive had some odd + # very intermittent dns failures with spamassassin, it seems it might only + # be happening with systemd-resolved, so just use unbound + # to make it consistent with the other hosts. + sudo sed -i --follow-symlinks 's/^ *hosts:.*/hosts: files dns myhostname/' /etc/nsswitch.conf + soff systemd-resolved + sudo ln -sf 127.0.0.1-resolv/stub-resolv.conf /etc/resolv.conf + sgo unbound + # cautious measure to make sure resolution is working + sleep 1 + ;; + *) + # default is + # files mdns4_minimal [NOTFOUND=return] dns myhostname + # mdns4 is needed for my printer and for bbb webrtc, not sure exactly why. + # https://www.freedesktop.org/software/systemd/man/nss-resolve.html# + # seems more important than some potential use case. + # Interestingly, t9/t10 man page says use files before resolve, debian 10 says the opposite. + # removing files makes hostname -f not actually give the fully qualified domain name. + sudo sed -i --follow-symlinks 's/^ *hosts:.*/hosts: files resolve [!UNAVAIL=return] mdns4_minimal [NOTFOUND=return] myhostname/' /etc/resolved-nsswitch/nsswitch.conf + ;; +esac + +case $HOSTNAME in + bk) + sgo named + ;; +esac + + +u /etc/apparmor.d/abstractions/nameservice.d/iank <<'EOF' +/etc/resolved-nsswitch/nsswitch.conf r, +/etc/basic-nsswitch/nsswitch.conf r, +# Aug 06 23:09:11 kd audit[3995]: AVC apparmor="DENIED" operation="connect" profile="/usr/bin/freshclam" name="/run/systemd/resolve/io.systemd.Resolve" pid=3995 comm="freshclam" requested_mask="wr" denied_mask="wr" fsuid=109 ouid=101 +# I dont know if this is quite the right fix, but I saw other sockets +# in the nameservice files that were rw, so figured it was ok to add this and it worked. +/run/systemd/resolve/io.systemd.Resolve rw, +EOF + +if $ur && systemctl is-active apparmor; then + m systemctl reload apparmor +fi + + + # * Mail clean cronjob u /etc/systemd/system/mailclean.timer <<'EOF' @@ -775,25 +865,26 @@ EOF # this is just a bug fix for trisquel. f=/etc/apparmor.d/usr.sbin.unbound -line="/usr/sbin/unbound flags=(attach_disconnected) {" -if ! grep -qFx "$line" $f; then - badline="/usr/sbin/unbound {" - if ! grep -qFx "$badline" $f; then +good_string="/usr/sbin/unbound flags=(attach_disconnected) {" +if ! grep -qF "$good_string" $f; then + bad_string="/usr/sbin/unbound {" + if ! grep -qF "$bad_string" $f; then err expected line in $f not found fi - sed -i "s,^$badline$,$line," $f + sed -i "s,$bad_string$,$good_string," $f if systemctl is-active apparmor &>/dev/null; then m systemctl reload apparmor fi fi + # note: anything added to nn_progs needs corresponding rm # down below in the host switch nn_progs=(exim4) if mailhost; then # Note dovecots lmtp doesnt need to be in the same nn to accept delivery. # Its in the nn so remote clients can connect to it. - nn_progs+=(spamassassin dovecot) + nn_progs+=($spamd_ser dovecot) fi case $HOSTNAME in @@ -873,7 +964,7 @@ EOF done ;; *) - for unit in exim4 spamassassin dovecot unbound; do + for unit in exim4 $spamd_ser dovecot unbound; do f=/etc/systemd/system/$unit.service.d/nn.conf if [[ -s $f ]]; then rm -fv $f @@ -925,12 +1016,14 @@ EOF # 2020-10-19 remove old file. remove this when all hosts updated rm -fv /etc/systemd/system/spamddnsfix.{timer,service} -u /etc/default/spamassassin <<'EOF' +u /etc/default/$spamd_ser <<'EOF' # defaults plus debugging flags for an issue im having OPTIONS="--create-prefs --max-children 5 --helper-home-dir" -PIDFILE="/var/run/spamd.pid" +PIDFILE="/run/spamd.pid" # my additions NICE="--nicelevel 15" +# not used in t12+, that uses +# /usr/lib/systemd/system/spamassassin-maintenance.timer CRON=1 EOF @@ -1143,6 +1236,10 @@ banaction = iptables-exim ignoreip = 209.51.188.13 2001:470:142::13 209.51.188.92 2001:470:142:3::10 72.14.176.105 2600:3c00:e000:280::2 10.173.8.1 EOF if $ur; then + # Ensure the log file monitored by fail2ban exists, or else fail2ban can't start. + if [[ ! -e /var/log/exim4/mainlog ]]; then + install -m 640 -o Debian-exim -g adm /dev/null /var/log/exim4/mainlog + fi m systemctl restart fail2ban fi @@ -2061,6 +2158,23 @@ protocol lmtp { # default is just $mail_plugins mail_plugins = $mail_plugins sieve } + +# /etc/dovecot/conf.d/10-master.conf says the default is 256M. +# but I started getting oom errors in the syslog +# Mar 27 15:10:04 sy dovecot[330088]: lmtp(iank)<3839880>: Fatal: master: service(lmtp): child 3839880 returned error 83 (Out of memory (service lmtp { vsz_limit=256 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) +# exim would just queue mail until it eventually succeeded. +# Deciding what to increase it to, I found this +# https://dovecot.org/list/dovecot/2011-December/080056.html +# which suggests 3x the largest dovecot.index.cache file +# and then I found that +# md/l/testignore/dovecot.index.cache is 429M, my largest cache file, +# but that folder only has 2k messages. +# next biggest is md/l/qemu-devel/dovecot.index.cache 236M +# which lead to me a search https://doc.dovecot.org/admin_manual/known_issues/large_cache/ +# which suggests 1.5x the maximum cache file size 1G, and +# that I can safely rm the index. +default_vsz_limit = 1500M + EOF if dpkg --compare-versions "$(dpkg-query -f='${Version}\n' --show dovecot-core)" ge 1:2.3; then cat <>/etc/dovecot/local.conf <: Fatal: master: service(lmtp): child 3839880 returned error 83 (Out of memory (service lmtp { vsz_limit=256 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) -# exim would just queue mail until it eventually succeeded. -# Deciding what to increase it to, I found this -# https://dovecot.org/list/dovecot/2011-December/080056.html -# which suggests 3x the largest dovecot.index.cache file -# and then I found that -# md/l/testignore/dovecot.index.cache is 429M, my largest cache file, -# but that folder only has 2k messages. -# next biggest is md/l/qemu-devel/dovecot.index.cache 236M -# which lead to me a search https://doc.dovecot.org/admin_manual/known_issues/large_cache/ -# which suggests 1.5x the maximum cache file size 1G, and -# that I can safely rm the indix -default_vsz_limit = 1500M +# This will decrease memory use, and seems likely to decrease cpu & disk +# use since I rarely use dovecot for most folders. +mail_cache_max_size = 50M + # simple password file based login !include conf.d/auth-passwdfile.conf.ext # ian: %u is used for alerts user vs iank -mail_location = maildir:/m/%u:LAYOUT=fs:INBOX=/m/%u/INBOX -mail_uid = $u -mail_gid = $u +# https://doc.dovecot.org/configuration_manual/mail_location/Maildir/ +mail_location = maildir:/m/%u:LAYOUT=fs:INBOX=/m/%u/INBOX:INDEX=/var/dovecot-indexes/%u +# note: i don't know if these need to be set, but this seems fine. +mail_uid = iank +mail_gid = iank protocol lmtp { # For a normal setup with exim, we need something like this, which @@ -2520,8 +2630,8 @@ EOF m mkdir -p $rctmpdir /m/rc m chown -R www-data.www-data $rctmpdir /m/rc m chmod 750 $rctmpdir - # Ensure the log file monitored by fail2ban exists, or else fail2ban can't start. # todo: check for other mailinabox things + # Ensure the log file monitored by fail2ban exists, or else fail2ban can't start. m sudo -u www-data touch $rclogdir/errors.log #### begin carddav install @@ -2851,7 +2961,7 @@ debbugsconfig # ld for local debbugs -/a/exe/web-conf -t -a 127.0.1.1 -p 80 -r /var/lib/debbugs/www - apache2 ld <<'EOF' +/a/exe/web-conf -l -t -a 127.0.1.1 -p 80 -r /var/lib/debbugs/www - apache2 ld <<'EOF' # copied from debbugs upstream example Options Indexes SymLinksIfOwnerMatch MultiViews @@ -2964,10 +3074,11 @@ case $HOSTNAME in # which will overwrite any existing file u /etc/default/exim4 <<'EOF' QUEUERUNNER='combined' -# note: this is duplicated in brc2, 10m here is -q10m there. QUEUEINTERVAL='10m' COMMONOPTIONS='-C /etc/exim4/my.conf' UPEX4OPTS='-o /etc/exim4/my.conf' +# in t12 exim, this replaces all the above options +EXIMSERVICE='-bdf -q10m -C /etc/exim4/my.conf' # i use epanic-clean for alerting if there are bad paniclog entries E4BCD_WATCH_PANICLOG='no' EOF @@ -3164,6 +3275,7 @@ bounce_debbugs: domains = DEBBUGS_DOMAIN EOF + install -m=0775 -d -g Debian-exim -o iank /var/spool/exim4/gw u /etc/exim4/conf.d/router/155_delay <<'EOF' # By default, delay sending email by 30-40 minutes in case I # change my mind. @@ -3183,14 +3295,14 @@ delay_iank: condition = ${if and { \ {< {$tod_epoch} {${eval10:$received_time + 60*30}}} \ {!def:h_i:} \ -{!bool{${lookup{$message_exim_id}lsearch{/etc/exim4/no-delay-eximids}{true}}}} \ -{!bool{${lookup{all}lsearch{/etc/exim4/no-delay-eximids}{true}}}} \ +{!bool{${lookup{$message_exim_id}lsearch{/var/spool/exim4/gw/.no-delay-eximids}{true}}}} \ +{!bool{${lookup{all}lsearch{/var/spool/exim4/gw/.no-delay-eximids}{true}}}} \ } {true}{false}} headers_remove = <; i: domains = ! +local_domains # uncomment for testing delays to jtuttle # local_parts = ! root : ! testignore : ! alerts : ! ian-pager : ! daylert - local_parts = ! root : ! testignore : ! alerts : ! jtuttle : ! ian-pager : ! daylert + local_parts = ! root : ! testignore : ! alerts : ! jtuttle : ! ian-pager : ! daylert : ! r2e ignore_target_hosts = ROUTER_DNSLOOKUP_IGNORE_TARGET_HOSTS EOF @@ -3331,6 +3443,12 @@ EOF # This name won\'t appear on From: lines of outgoing messages if rewriting is enabled. echo iankelling.org > /etc/mailname + # mail default domain. + u /etc/mailutils.conf <<'EOF' +address { + email-domain iankelling.org; +}; +EOF # mail.iankelling.org so local imap clients can connect with tls and # when they happen to not be local. @@ -3545,11 +3663,13 @@ backup_local: EOF # Bind to wghole to receive mailbackup. - wgholeip=$(sed -rn 's/^ *Address *= *([^/]+).*/\1/p' /etc/wireguard/wghole.conf) - cat >>/etc/exim4/update-exim4.conf.conf <>/etc/exim4/update-exim4.conf.conf <