X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=d19fba0306f2317068ab9c8efed4a99f7801e4d5;hb=55b37c2dbe292fa1023c0c5376c2104fbe568011;hp=eb3689ebf535c4aa162ad884443aea6d2b6e0bed;hpb=f27b67a1dfa58b5f101bba607b2f91a73e65299e;p=distro-setup diff --git a/mail-setup b/mail-setup index eb3689e..d19fba0 100755 --- a/mail-setup +++ b/mail-setup @@ -361,7 +361,10 @@ reload=false if [[ -e /var/local/mail-setup-reload ]]; then reload=true fi -u() { # update file. note: duplicated in brc +# update file. +# if the file changed, ur=true, else false. +# note: duplicated in brc +u() { local tmp tmpdir dest="$1" local base="${dest##*/}" local dir="${dest%/*}" @@ -581,30 +584,17 @@ case $HOSTNAME in esac -lines=( - "/etc/resolved-nsswitch/nsswitch.conf r," - "/etc/basic-nsswitch/nsswitch.conf r," - # Aug 06 23:09:11 kd audit[3995]: AVC apparmor="DENIED" operation="connect" profile="/usr/bin/freshclam" name="/run/systemd/resolve/io.systemd.Resolve" pid=3995 comm="freshclam" requested_mask="wr" denied_mask="wr" fsuid=109 ouid=101 - # I dont know if this is quite the right fix, but I saw other sockets - # in the nameservice files that were rw, so figured it was ok to add this and it worked. - "/run/systemd/resolve/io.systemd.Resolve rw," -) -f=/etc/apparmor.d/abstractions/nameservice -apparmor_reload=false -if [[ -e $f ]]; then - for l in "${lines[@]}"; do - if ! grep -qF "$l" $f; then - sudo sed -i "/\/nsswitch.conf/a $l" $f - apparmor_reload=true - if ! grep -qF "$l" $f; then - echo "$0: failed editing $f. investigate" - exit 1 - fi - fi - done - if $apparmor_reload && systemctl is-active apparmor; then - m ser reload apparmor - fi +u /etc/apparmor.d/abstractions/nameservice.d/iank <<'EOF' +/etc/resolved-nsswitch/nsswitch.conf r, +/etc/basic-nsswitch/nsswitch.conf r, +# Aug 06 23:09:11 kd audit[3995]: AVC apparmor="DENIED" operation="connect" profile="/usr/bin/freshclam" name="/run/systemd/resolve/io.systemd.Resolve" pid=3995 comm="freshclam" requested_mask="wr" denied_mask="wr" fsuid=109 ouid=101 +# I dont know if this is quite the right fix, but I saw other sockets +# in the nameservice files that were rw, so figured it was ok to add this and it worked. +/run/systemd/resolve/io.systemd.Resolve rw, +EOF + +if $ur && systemctl is-active apparmor; then + m systemctl reload apparmor fi @@ -3084,10 +3074,11 @@ case $HOSTNAME in # which will overwrite any existing file u /etc/default/exim4 <<'EOF' QUEUERUNNER='combined' -# note: this is duplicated in brc2, 10m here is -q10m there. QUEUEINTERVAL='10m' COMMONOPTIONS='-C /etc/exim4/my.conf' UPEX4OPTS='-o /etc/exim4/my.conf' +# in t12 exim, this replaces all the above options +EXIMSERVICE='-bdf -q10m -C /etc/exim4/my.conf' # i use epanic-clean for alerting if there are bad paniclog entries E4BCD_WATCH_PANICLOG='no' EOF @@ -3285,6 +3276,10 @@ bounce_debbugs: EOF install -m=0775 -d -g Debian-exim -o iank /var/spool/exim4/gw + f=/var/spool/exim4/gw/.no-delay-eximids + if [[ ! -e $f ]]; then + install -g Debian-exim -o iank /dev/null $f + fi u /etc/exim4/conf.d/router/155_delay <<'EOF' # By default, delay sending email by 30-40 minutes in case I # change my mind. @@ -3888,6 +3883,131 @@ fi # err debbugs exist but is not uid 610: investigate # fi +# * mail monitoring / testing + +# note, to test clamav, send an email with body that only contains +# https://en.wikipedia.org/wiki/EICAR_test_file +# which set malware_name to Eicar-Signature +case $HOSTNAME in + $MAIL_HOST|bk|je) + # note: cronjob "ian" also does some important monitoring + # todo: this will sometimes cause an alert because mailtest-check will run + # before we have setup network namespace and spamassassin + u /etc/cron.d/mailtest <>/etc/cron.d/mailtest </usr/local/bin/send-test-forward <<'EOF' +#!/bin/bash +# we remove from the queue older than 4.3 minutes since we send every 5 minutes. +olds=( +$(/usr/sbin/exiqgrep -o 260 -i -r '^(testignore@(iankelling\.org|zroe\.org|expertpathologyreview\.com|amnimal\.ninja|je\.b8\.nz)|jtuttle@gnu\.org)$') +) +if (( ${#olds[@]} )); then + /usr/sbin/exim -Mrm "${olds[@]}" >/dev/null +fi +EOF + for test_from in ${test_froms[@]}; do + + test_to=${test_tos[0]} + for t in ${test_tos[@]:1}; do + if [[ $test_from == *@gnu.org && $t == *@gnu.org ]]; then + continue + fi + test_to+=", $t" + done + case $test_from in + testignore@expertpathologyreview.com) + test_to=testignore@zroe.org + ;; + esac + + cat >>/usr/local/bin/send-test-forward <>/etc/cron.d/mailtest </usr/local/bin/send-test-forward <<'EOF' -#!/bin/bash -# we remove from the queue older than 4.3 minutes since we send every 5 minutes. -olds=( -$(/usr/sbin/exiqgrep -o 260 -i -r '^(testignore@(iankelling\.org|zroe\.org|expertpathologyreview\.com|amnimal\.ninja|je\.b8\.nz)|jtuttle@gnu\.org)$') -) -if (( ${#olds[@]} )); then - /usr/sbin/exim -Mrm "${olds[@]}" >/dev/null -fi -EOF - for test_from in ${test_froms[@]}; do - - test_to=${test_tos[0]} - for t in ${test_tos[@]:1}; do - if [[ $test_from == *@gnu.org && $t == *@gnu.org ]]; then - continue - fi - test_to+=", $t" - done - case $test_from in - testignore@expertpathologyreview.com) - test_to=testignore@zroe.org - ;; - esac - - cat >>/usr/local/bin/send-test-forward <