From: Ian Kelling Date: Sun, 19 Dec 2021 23:07:47 +0000 (-0500) Subject: change email backups to use smtp X-Git-Url: https://iankelling.org/git/?a=commitdiff_plain;h=83cb9e1b1731b6473c48189c971b55eb43888a95;p=distro-setup change email backups to use smtp --- diff --git a/brc2 b/brc2 index 51e2af5..4dc573b 100644 --- a/brc2 +++ b/brc2 @@ -213,29 +213,8 @@ tback() { sqlite3 /p/.timetrap.db "update entries set end = NULL where id = (select max(id) from entries);" } -bum() { - local cur host - host=$1 - (( $# == 1 )) || return 1 - cur="$(awk '$2 == "/bu/mnt" {print $1}' /proc/mounts)" - if [[ $cur ]]; then - if [[ $cur == "$host:/bu/md" ]]; then - return 0 - else - s fusermount -u /bu/mnt - fi - fi - s sshfs bu@$host:/bu/home/md /bu/mnt -o reconnect,ServerAliveInterval=20,ServerAliveCountMax=30 -o allow_other - ser start exim4 -} -bu() { - if mountpoint -q /bu/mnt; then - if ! s timeout -s 9 10 fusermount -u /bu/mnt; then - s fusermount -zu /bu/mnt - fi - fi -} - +# sshfs example: +# s sshfs bu@$host:/bu/home/md /bu/mnt -o reconnect,ServerAliveInterval=20,ServerAliveCountMax=30 -o allow_other eqgo() { enn -M $(exiqgrep -i) @@ -1040,35 +1019,31 @@ wghole() { local host ipsuf umask_orig host=$1 ipsuf=$2 - umask_orig=$(umask) mkdir -p /p/c/machine_specific/$host/filesystem/etc/{wireguard,network/interfaces.d} cd /p/c/machine_specific/$host/filesystem/etc/wireguard + umask_orig=$(umask) umask 0077 - if [[ ! -e hole-priv.key || ! -e hole-pub.key ]]; then - wg genkey | tee hole-priv.key | wg pubkey > hole-pub.key - fi + wg genkey | tee $host-priv.key | wg pubkey > $host-pub.key cat >wghole.conf < ../network/interfaces.d/wghole <$f <$f </dev/null ||: # ignore fail in bash < 4.4 set -eE -o pipefail trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" exit status: $?, PIPESTATUS: ${PIPESTATUS[*]}" >&2' ERR -if ! mountpoint /bu/mnt &>/dev/null; then - exit 0 -fi - cd /mnt/root/btrbk tmp=(o*) last_snap_date=${tmp[-1]#o.} time=$(( $(date -d $(sed -r 's/(.{4})(..)(.{5})(..)(.*)/\1-\2-\3:\4:\5/' <<<$last_snap_date) +%s) -1 )) # 1 second granularity, so we could have a duplicate file, oh well, not worrying about that. -find /bu/md /bu/mnt -type f \! -newermt @$time -delete +find /bu/md -type f \! -newermt @$time -delete diff --git a/mail-setup b/mail-setup index 526c51e..82d3d37 100755 --- a/mail-setup +++ b/mail-setup @@ -3,6 +3,10 @@ # Copyright (C) 2019 Ian Kelling # SPDX-License-Identifier: AGPL-3.0-or-later +# todo: backup hosts should only allow external mail that is authed and +# destined for backup route. it is a minor issue since traffic is +# limited to the wghole network. + # todo: emailing info@amnimal.ninja produces a bounce, user doesn't exist # instead of a simple rejection like it should. @@ -309,8 +313,7 @@ sre () { } sstart() { for service; do - m systemctl start $service - m systemctl enable $service; + m systemctl enable --now $service; done } mailhost() { @@ -332,7 +335,7 @@ stopifactive() { done } -mxhost=mail.iankelling.org +mxhost=mx.iankelling.org mxport=587 forward=$u@$mxhost @@ -353,6 +356,14 @@ if [[ ! $MAIL_HOST ]]; then err "\$MAIL_HOST not set" fi +bhost_t=false +case $HOSTNAME in + $MAIL_HOST) : ;; + kd|frodo|x2|x3|kw|sy) + bhost_t=true + ;; +esac + # * Install universal packages @@ -369,7 +380,7 @@ pi-nostart exim4 exim4-daemon-heavy spamassassin openvpn unbound clamav-daemon w # note: pyzor debian readme says you need to run some initialization command # but its outdated. -pi spf-tools-perl p0f postgrey pyzor razor jq moreutils +pi spf-tools-perl p0f postgrey pyzor razor jq moreutils certbot # bad packages that sometimes get automatically installed pu openresolv resolvconf @@ -393,45 +404,6 @@ fi # our nostart pi fails to avoid enabling -# * bu setup - -if ! getent passwd bu; then - useradd -c bu -Um -s /bin/bash -d /bu/home bu - usermod -a -G bu $u - # note, no reason for /bu/mnt to be owned by bu, - # but its just convenient to have it here. - for dir in /bu/mnt /bu/home/md /bu/home/md/{cur,tmp,new}; do - [[ -e $dir ]] && continue - dirs+=($dir) - done - if (( ${#dirs[@]} )); then - mkdir -p "${dirs[@]}" - chown bu:bu "${dirs[@]}" - fi - sed -ri '/Subsystem[[:space:]]+sftp/d' /etc/ssh/sshd_config - - install -d -o bu -g bu /bu/home/.ssh - install -T -o bu -g bu /root/.ssh/h.pub /bu/home/.ssh/authorized_keys - - i /etc/ssh/sshd_config.d/mail.conf <<'EOF' -# for mail chroot restriction -# https://serverfault.com/questions/660160/openssh-difference-between-internal-sftp-and-sftp-server -Subsystem sftp internal-sftp -Match user bu - ChrootDirectory /bu/home - X11Forwarding no - AllowTcpForwarding no - PermitTunnel no - AllowAgentForwarding no - ForceCommand internal-sftp -EOF - if $ir; then - systemctl reload sshd - fi -fi - - - # * user forward file case $HOSTNAME in $MAIL_HOST) @@ -657,6 +629,42 @@ BindPaths=$bindpaths Restart=always RestartSec=1 +EOF + + # sooo, there are a few ways to get traffic from the mail network + # namespace to go over the wghole. + # + #1: unify the mail vpn and wghole + # into 1 network. this seems simple and logical, but the thing is + # that if we ever have a network block we need to overcome, for + # example with a tcp 443 vpn connection, then i'd need to setup some + # hole hosts on that vpn too, which is kind of a pain. + # + # 2. We can route 10.5.3.0/24 out of the mail nn and nat it into wghole. + # + # 3. We can setup the routing to happen on li, which seemed like I + # just needed to add 10.8.0.4/24 to AllowedIPs in at least the + # wghole clients, but I think that is kind of hacky and breaks ipv4 + # routing within the mailvpn, it happened to work just because exim + # prefers ipv6 and that was also available in the mailvpn. + # + # 4. Put the hole interface into the mail network + # namespace. Apparently wireguard is smart enough to get around the + # mailvpn default routing and establish a direct connection. That is + # what I'm doing here. I only use the hole vpn for randomish things, + # it should be fine to join the mail nn for that. If that becomes a + # problem, I think I'd go with option #2. + i /etc/systemd/system/wg-quick@wghole.service.d/override.conf <<'EOF' +[Unit] +Requires=mailvpn.service +After=network.target mailnn.service mailvpn.service +JoinsNamespaceOf=mailnn.service +BindsTo=mailnn.service + +[Service] +PrivateNetwork=true +# i dont think we need any of these, but it doesnt hurt to stay consistent +BindPaths=$bindpaths EOF ;;& @@ -770,6 +778,16 @@ OnCalendar=daily WantedBy=timers.target EOF + +wghost=${HOSTNAME}wg.b8.nz +if $bhost_t && [[ ! -e /etc/exim4/certs/$wghost/privkey.pem ]]; then + certbot -n --manual-public-ip-logging-ok --eff-email --agree-tos -m letsencrypt@iankelling.org \ + certonly --manual --preferred-challenges=dns \ + --manual-auth-hook /a/bin/ds/le-dns-challenge \ + --manual-cleanup-hook /a/bin/ds/le-dns-challenge-cleanup \ + --deploy-hook /a/bin/ds/le-exim-deploy -d $wghost +fi + # * common exim4 config @@ -846,8 +864,8 @@ EOF # old name rm -fv /etc/exim4/conf.d/retry/37_retry -# Retry faster than usual for domains that I send with send-test-forward. cat >/etc/exim4/conf.d/retry/17_retry <<'EOF' +# Retry faster than usual for sending to domains that I send with send-test-forward. iankelling.org * F,2d,15m;F,14d,2h amnimal.ninja * F,2d,15m;F,14d,2h expertpathologyreview.com * F,2d,15m;F,14d,2h @@ -860,6 +878,9 @@ rm -vf /etc/exim4/conf.d/main/000_localmacros # old filename cat >/etc/exim4/conf.d/main/000_local <>/etc/exim4/update-exim4.conf.conf < {$max_received_linelength}{998} {1}{0}} +.endif + hosts_require_auth = * + hosts_try_auth = * + return_path = alerts@iankelling.org + envelope_to_add + # manual return path because we dont want it to be the envelope sender + # we got not the one we are using in this smtp transport + headers_add = "Return-path: $sender_address" +.ifdef REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS + hosts_avoid_tls = REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS +.endif +.ifdef REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS + hosts_require_tls = REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS +.endif +.ifdef REMOTE_SMTP_SMARTHOST_TLS_VERIFY_CERTIFICATES + tls_verify_certificates = REMOTE_SMTP_SMARTHOST_TLS_VERIFY_CERTIFICATES +.endif +.ifdef REMOTE_SMTP_SMARTHOST_TLS_VERIFY_HOSTS + tls_verify_hosts = REMOTE_SMTP_SMARTHOST_TLS_VERIFY_HOST +.endif +.ifdef REMOTE_SMTP_HEADERS_REWRITE + headers_rewrite = REMOTE_SMTP_HEADERS_REWRITE +.endif +.ifdef REMOTE_SMTP_HELO_DATA + helo_data=REMOTE_SMTP_HELO_DATA +.endif +.ifdef TLS_DH_MIN_BITS +tls_dh_min_bits = TLS_DH_MIN_BITS +.endif +.ifdef REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE +tls_certificate = REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE +.endif +.ifdef REMOTE_SMTP_SMARTHOST_PRIVATEKEY +tls_privatekey = REMOTE_SMTP_SMARTHOST_PRIVATEKEY +.endif +.ifdef REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE + headers_remove = REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE +.endif EOF + # this avoids some error. i cant remember what. todo: # test it out and document why/if its needed. i /etc/exim4/host_local_deny_exceptions <<'EOF' @@ -2464,6 +2533,21 @@ EOF echo|i /etc/exim4/conf.d/router/188_exim4-config_smarthost echo|i /etc/exim4/conf.d/router/190_exim4-config_fsfsmarthost echo|i /etc/exim4/conf.d/rcpt_local_acl + echo|i /etc/exim4/conf.d/router/890_backup_copy + + + if $bhost_t; then + cat >>/etc/exim4/conf.d/main/000_local <>/etc/exim4/update-exim4.conf.conf <>/etc/exim4/update-exim4.conf.conf <>/etc/exim4/update-exim4.conf.conf <>/etc/exim4/update-exim4.conf.conf <>/etc/exim4/update-exim4.conf.conf <