various improvements mostly email

[distro-setup] / mail-setup

diff --git a/mail-setup b/mail-setup
index babbbd8dc3668c428167f8d3adae9d17bc6aa0a8..9b30579ba5c002062e386dfe5055f6bc69169f97 100755 (executable)
--- a/mail-setup
+++ b/mail-setup
@@ -58,6 +58,15 @@ if ! exim && ! postfix; then
 fi
 
 
+####### instructions for icedove #####
+# Incoming mail server: mail.iankelling.org, port 143, username iank, connection security starttls, authentication method normal password
+# we could also just use 127.0.0.1 with no ssl, but todo: disable that in dovecot, so mail is secure from local programs.
+#
+# hamburger -> preferences -> preferences -> advanced tab -> config editor button -> security.ssl.enable_ocsp_must_staple = false
+# background: ovecot does not yet have ocsp stapling support
+# reference: https://community.letsencrypt.org/t/simple-guide-using-lets-encrypt-ssl-certs-with-dovecot/2921
+#######
+
 
 ####### begin perstent password instructions ######
 # # exim passwords:
@@ -70,12 +79,12 @@ fi
 # apg -m 50 -x 70 -n 1 -a 1 -M CLN >$f
 # s sed -i "/^$user:/d" /p/c/filesystem/etc/exim4/passwd
 # echo "$user:$(mkpasswd -m sha-512 -s <$f)" >>/p/c/filesystem/etc/exim4/passwd
-# echo "mail.iankelling.org $user $(<$f)" >> /p/c/machine_specific/$user/filesystem/etc/mailpass
+# echo "mail.iankelling.org 587 $user:$(<$f)" >> /p/c/machine_specific/$user/filesystem/etc/mailpass
 # # then run this script, or part of it which uses /etc/mailpass
 
 # # dovecot password, i just need 1 as I\'m the only user
 # mkdir /p/c/filesystem/etc/dovecot
-# echo "ian:$(doveadm pw -s ssha256)::::::" >/p/c/filesystem/etc/dovecot/users
+# echo "iank:$(doveadm pw -s ssha256)::::::" >/p/c/filesystem/etc/dovecot/users
 # conflink
 
 
@@ -131,7 +140,7 @@ fi
 
 # # 2017-02 spf policies:
 # # host -t txt lists.fedoraproject.org
-# # google ~all, hotmail -all, yahoo: ?all, fastmail ?all
+# # google ~all, hotmail ~all, yahoo: ?all, fastmail ?all, outlook ~all
 # # i include fastmail\'s settings, per their instructions,
 # # and follow their policy. In mail in a box, or similar instructions,
 # # I\'ve seen recommended to not use a restrictive policy.
@@ -205,7 +214,7 @@ pi() { # package install
 
 postmaster=$u
 mxhost=mail.iankelling.org
-mxport=25
+mxport=587
 forward=$u@$mxhost
 
 # old setup. left as comment for example
@@ -342,6 +351,29 @@ User=$u
 Type=oneshot
 ExecStart=/a/bin/log-quiet/sysd-mail-once offlineimap-sync /a/bin/distro-setup/offlineimap-sync
 EOF
+
+  cat >/etc/systemd/system/mailclean.timer <<'EOF'
+[Unit]
+Description=Run mailclean daily
+
+[Timer]
+OnCalendar=monthly
+
+[Install]
+WantedBy=timers.target
+EOF
+
+  cat >/etc/systemd/system/mailclean.service <<EOF
+[Unit]
+Description=Delete and archive old mail files
+After=multi-user.target
+
+[Service]
+User=$u
+Type=oneshot
+ExecStart=/a/bin/log-quiet/sysd-mail-once mailclean /a/bin/distro-setup/mailclean
+EOF
+
   systemctl daemon-reload
 
   # wording of question from dpkg-reconfigure exim4-config
@@ -644,6 +676,9 @@ EOF
     # would be unused in that config type.
     rm -f /etc/exim4/conf.d/main/000_localmacros # old filename
     cat >/etc/exim4/conf.d/main/000_local <<EOF
+# enable 587 in addition to the default 25, so that
+# i can send mail where port 25 is firewalled by isp
+daemon_smtp_ports = 25 : 587
 # i don't have ipv6 setup for my vpn tunnel yet.
 disable_ipv6 = true
 
@@ -699,6 +734,13 @@ IGNORE_SMTP_LINE_LENGTH_LIMIT = true
 # keep your dkim signature intact but add list- headers.
 DKIM_SIGN_HEADERS = mime-version:in-reply-to:references:from:date:subject:to
 
+# recommended if dns is expected to work
+CHECK_RCPT_VERIFY_SENDER = true
+# seems like a good idea
+CHECK_DATA_VERIFY_HEADER_SENDER = true
+CHECK_RCPT_SPF = true
+CHECK_RCPT_REVERSE_DNS = true
+CHECK_MAIL_HELO_ISSUED = true
 EOF
 
 
@@ -804,6 +846,8 @@ EOF
 
     systemctl enable offlineimapsync.timer
     systemctl start offlineimapsync.timer
+    systemctl enable mailclean.timer
+    systemctl start mailclean.timer
     systemctl restart $vpn_ser@mail
     systemctl enable $vpn_ser@mail
     systemctl enable dovecot
@@ -812,6 +856,8 @@ EOF
   else # $HOSTNAME != $MAIL_HOST
     systemctl disable offlineimapsync.timer &>/dev/null ||:
     systemctl stop offlineimapsync.timer &>/dev/null ||:
+    systemctl disable mailclean.timer &>/dev/null ||:
+    systemctl stop mailclean.timer &>/dev/null ||:
     systemctl disable $vpn_ser@mail
     systemctl stop $vpn_ser@mail
     systemctl disable dovecot ||:
@@ -863,7 +909,7 @@ EOF
 
 
   # light version of exim does not have sasl auth support.
-  pi exim4-daemon-heavy spamassassin
+  pi exim4-daemon-heavy spamassassin spf-tools-perl