X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=e2d02f63b14ea5be6407d453d7ecf6975c2d168e;hb=523b7ff889aaafdcd997d84b2a06744993018e89;hp=e753fbe9670ea27f7837b14be795d1ce5d7c95af;hpb=c300392f92092b3a89281df462d42710f25d0351;p=distro-setup diff --git a/mail-setup b/mail-setup index e753fbe..e2d02f6 100755 --- a/mail-setup +++ b/mail-setup @@ -3,6 +3,28 @@ # Copyright (C) 2019 Ian Kelling # SPDX-License-Identifier: AGPL-3.0-or-later +# todo: +# on bk (and fsf servers that run multiple exim4 daemons, eg eximfsf2 and eximfsf3), +# make it so that when exim is restarted due to package upgrades, +# we also restart those daemons, which can be done like so, based on looking +# at the prerm and postinst scripts of exim4-daemon-heavy. +# +# if [[ ! -e /usr/sbin/invoke-rc.d-diverted ]]; then +# mv /usr/sbin/invoke-rc.d /usr/sbin/invoke-rc.d-diverted +# dpkg --divert /usr/sbin/invoke-rc.d-diverted --no-rename /usr/sbin/invoke-rc.d +# fi +# /usr/sbin/invoke-rc.d: +# #!/bin/bash +# if [[ DPKG_MAINTSCRIPT_PACKAGE == exim4* && $1 == exim4 ]]; then +# shift +# ret=0 +# for daemon in exim4 eximfsf2 eximfsf3; do +# /usr/sbin/invoke-rc.d-diverted $daemon "$@" || ret=$? +# done +# else +# /usr/sbin/invoke-rc.d-diverted "$@" +# fi + # Things I tend to forget. on MAIL_HOST, daemon runs with /etc/exim4/my.conf, # due to /etc/default/exim4 containing: # COMMONOPTIONS='-C /etc/exim4/my.conf' @@ -13,6 +35,8 @@ # which has log path # log_file_path = /var/log/exim4/my%s # +# On non bk|MAIL_HOST, the config and log file are all standard. +# # eximbackup folder is /bu/md # it is cleaned up by mail-backup-clean, which is run by btrbk-run @@ -24,6 +48,14 @@ # #&! testignore|jtuttle|eximbackup|/usr/sbin/exim4 -bpu +# todo: this message seems to get dropped on the floor, it was due to a missing 2nd colon in +# condition = ${if def:h_fdate:} +# Figure out how to avoid this message being discarded. + +# 2023-09-12 01:41:43 [722371] 1qfw9f-0031v9-0S <= ian@iankelling.org U=iank P=local S=483 id=87cyyogd7t.fsf@iankelling.org T="iank2" from for testignore@amnimal.ninja +# 2023-09-12 01:41:43 [722373] 1qfw9f-0031v9-0S H=nn.b8.nz [10.173.8.2]: SMTP error from remote mail server after pipelined end of data: 451 Temporary local problem - please try later +# 2023-09-12 01:41:43 [722372] 1qfw9f-0031v9-0S == testignore@amnimal.ninja R=smarthost T=remote_smtp_smarthost defer (-46) H=nn.b8.nz [10.173.8.2] DT=0s: SMTP error from remote mail server after pipelined end of data: 451 Temporary local problem - please try later + # todo: check new macro DKIM_TIMESTAMPS # todo: check if REMOTE_SMTP_INTERFACE or REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE can simplify my or fsfs config @@ -208,8 +240,8 @@ fi ####### -# * perstent password instructions -# Note: for cert cron, we need to manually run first to accept known_hosts +# * perstent password instructions Note: for cert cron, we need to +# manually run first to accept known_hosts # # exim passwords: # # for hosts which have all private files I just use the same user @@ -494,6 +526,9 @@ EOF # * clamav +# old file. remove when all hosts updated, 2023-09-11 +rm -fv /etc/exim4/conf.d/clamav_data_acl + m usermod -a -G Debian-exim clamav u /etc/systemd/system/clamav-daemon.service.d/fix.conf </etc/exim4/conf.d/main/30_local < + Options Indexes SymLinksIfOwnerMatch MultiViews + DirectoryIndex index.html + Require all granted + + +ScriptAlias /cgi/ /var/lib/debbugs/www/cgi/ + + AllowOverride None + Options ExecCGI SymLinksIfOwnerMatch + Require all granted + + +RewriteEngine on +RewriteCond %{HTTP_USER_AGENT} .*apt-listbugs.* +RewriteRule .* /apt-listbugs.html [R,L] + +# RewriteLog /org/bugs.debian.org/apache-rewrite.log +# RewriteLogLevel 0 + +#RewriteRule ^/$ http://www.debian.org/Bugs/ +RewriteRule ^/(robots\.txt|release-critical|apt-listbugs\.html)$ - [L] +# The following two redirect to up-to-date pages +RewriteRule ^/[[:space:]]*#?([[:digit:]][[:digit:]][[:digit:]]+)([;&].+)?$ /cgi-bin/bugreport.cgi?bug=$1$2 [L,R,NE] +RewriteRule ^/([^/+]*)([+])([^/]*)$ "/$1%%{%}2B$3" [N] +RewriteRule ^/[Ff][Rr][Oo][Mm]:([^/]+\@.+)$ /cgi-bin/pkgreport.cgi?submitter=$1 [PT,NE] +# Commented out, 'cuz aj says it will crash master. (old master) +# RewriteRule ^/[Ss][Ee][Vv][Ee][Rr][Ii][Tt][Yy]:([^/]+\@.+)$ /cgi-bin/pkgreport.cgi?severity=$1 [L,R] +RewriteRule ^/([^/]+\@.+)$ /cgi-bin/pkgreport.cgi?maint=$1 [PT,NE] +RewriteRule ^/mbox:([[:digit:]][[:digit:]][[:digit:]]+)([;&].+)?$ /cgi-bin/bugreport.cgi?mbox=yes&bug=$1$2 [PT,NE] +RewriteRule ^/src:([^/]+)$ /cgi-bin/pkgreport.cgi?src=$1 [PT,NE] +RewriteRule ^/severity:([^/]+)$ /cgi-bin/pkgreport.cgi?severity=$1 [PT,NE] +RewriteRule ^/tag:([^/]+)$ /cgi-bin/pkgreport.cgi?tag=$1 [PT,NE] +# RewriteMap fix-chars int:noescape +RewriteCond %{REQUEST_URI} ^/(Access\.html|Developer\.html|Reporting\.html|server-request\.html|server-control\.html|server-refcard\.html).* [NC] +RewriteRule .* - [L] +# PT|passthrough to bugreport.cgi and pkgreport.cgi +RewriteRule ^/([0-9]+)$ /cgi-bin/bugreport.cgi?bug=$1 [PT,NE] +RewriteRule ^/([^/]+)$ /cgi-bin/pkgreport.cgi?pkg=$1 [PT,NE] +EOF + + # * exim host conditional config # ** exim certs @@ -2791,7 +2930,8 @@ case $HOSTNAME in # which will overwrite any existing file u /etc/default/exim4 <<'EOF' QUEUERUNNER='combined' -QUEUEINTERVAL='30m' +# note: this is duplicated in brc2, 10m here is -q10m there. +QUEUEINTERVAL='10m' COMMONOPTIONS='-C /etc/exim4/my.conf' UPEX4OPTS='-o /etc/exim4/my.conf' # i use epanic-clean for alerting if there are bad paniclog entries @@ -2912,28 +3052,6 @@ EOF dc_relay_nets='defaultnn.b8.nz' EOF - # no clamav on je, it has 1.5g memory and clamav uses most of it - u /etc/exim4/conf.d/clamav_data_acl <<'EOF' -warn -!hosts = +iank_trusted -!authenticated = plain_server:login_server -condition = ${if def:malware_name} -remove_header = Subject: -add_header = Subject: [Clamav warning: $malware_name] $h_subject -log_message = heuristic malware warning: $malware_name -EOF - - cat >>/etc/exim4/conf.d/main/000_local <> /etc/exim4/conf.d/data_local_acl <<'EOF' -deny - malware = */defer_ok - !condition = ${if match {$malware_name}{\N^Heuristic\N}} - message = This message was detected as possible malware ($malware_name). -EOF cat >/etc/exim4/conf.d/main/000_local-nn <>/etc/exim4/conf.d/main/000_local <> /etc/exim4/conf.d/data_local_acl <<'EOF' +deny + malware = */defer_ok + !condition = ${if match {$malware_name}{\N^Heuristic\N}} + message = This message was detected as possible malware ($malware_name). + +warn + !hosts = +iank_trusted + !authenticated = * + condition = ${if def:malware_name} + remove_header = Subject: + add_header = Subject: [Clamav warning: $malware_name] $h_subject + log_message = heuristic malware warning: $malware_name + +warn + # fdate = future date. # tdate = temporary date. + condition = ${if def:h_fdate} + remove_header = fdate: + add_header = tdate: + control = freeze +EOF + /a/exe/cedit nn /etc/hosts <<'EOF' || [[ $? == 1 ]] 10.173.8.2 nn.b8.nz @@ -3199,18 +3413,27 @@ EOF ;; # ** not MAIL_HOST|bk|je *) - # this one should be removed for all non mail hosts, but + echo|u /etc/exim4/conf.d/transport/30_debbugs + echo|u /etc/exim4/conf.d/router/153_debbugs + echo|u /etc/exim4/conf.d/router/155_delay + # this one should be removed for all non mail_hosts. note # bk and je never become mail_host echo|u /etc/exim4/conf.d/router/195_dnslookup_vpn echo|u /etc/exim4/conf.d/router/160_backup_redir echo|u /etc/exim4/conf.d/router/161_backup_redir_nn echo|u /etc/exim4/conf.d/router/185_sentarchive echo|u /etc/exim4/conf.d/router/186_sentarchive_nn + # Note, in general we could submit to smarthosts on non MAIL_HOST. + # however, delayed mail makes this inconvenient, because I + # occasionally want to send an email from a non-MAIL_HOST and then + # turn off that computer or travel with it so it is disconnected. + # It is also probably easier to setup emacs to delay messages, but + # that would mean we need to keep emacs running, this is much + # nicer. echo|u /etc/exim4/conf.d/router/188_exim4-config_smarthost echo|u /etc/exim4/conf.d/router/190_exim4-config_fsfsmarthost echo|u /etc/exim4/conf.d/rcpt_local_acl echo|u /etc/exim4/conf.d/main/000_local-nn - echo|u /etc/exim4/conf.d/clamav_data_acl if $bhost_t; then @@ -3472,6 +3695,25 @@ elif [[ $uid != 608 ]]; then m find / /nocow -xdev -path ./var/tmp -prune -o -gid $gid -execdir chgrp -h 608 {} + fi + +# note: example config has a debbugs user, +# but my exim runs setuid as Debian-exim so it can't switch +# to another user. Anyways, I'm not exposing this to the +# internet at this time. If I do, the thing to do would +# be to use a sudo config (or sudo alternative). This +# would be how to setup + +# IFS=:; read -r _ _ uid _ < <(getent passwd debbugs||:) ||:; unset IFS +# if [[ ! $uid ]]; then +# # /a/opt/debbugs/debian/README.mail +# adduser --uid 610 --system --group --home /o/debbugs \ +# --no-create-home --disabled-login --force-badname debbugs +# m find /o/debbugs -xdev -path ./var/tmp -prune -o -uid $uid -execdir chown -h 610 {} + +# m find /o/debbugs -xdev -path ./var/tmp -prune -o -gid $gid -execdir chgrp -h 610 {} + +# elif [[ $uid != 610 ]]; then +# err debbugs exist but is not uid 610: investigate +# fi + # * start / stop services reifactive dnsmasq nscd @@ -3530,6 +3772,8 @@ case $HOSTNAME in else m systemctl --now enable $vpnser fi + ;;& + bk) if ! systemctl is-active clamav-daemon >/dev/null; then m systemctl --now enable clamav-daemon out=$(rsync -aiSAX --chown=root:root --chmod=g-s /a/bin/ds/filesystem/etc/systemd/system/epanicclean.service /etc/systemd/system)