X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=blobdiff_plain;f=mail-setup;h=93d09c739402f2c4b8c78c7b79aa22641b228f5b;hp=36b0e9d6345334396ab4010b79a06f3b85bac9a0;hb=HEAD;hpb=fc2a33b827a7adede9cba7728e381820857189d5 diff --git a/mail-setup b/mail-setup index 36b0e9d..9ada9b6 100755 --- a/mail-setup +++ b/mail-setup @@ -1,7 +1,80 @@ #!/bin/bash # * intro -# Copyright (C) 2019 Ian Kelling -# SPDX-License-Identifier: AGPL-3.0-or-later + +# Program to install and configure Ian's email related programs +# Copyright (C) 2024 Ian Kelling + +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. + +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. + +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +# SPDX-License-Identifier: GPL-3.0-or-later + +# todo: +# on bk (and fsf servers that run multiple exim4 daemons, eg eximfsf2 and eximfsf3), +# make it so that when exim is restarted due to package upgrades, +# we also restart those daemons, which can be done like so, based on looking +# at the prerm and postinst scripts of exim4-daemon-heavy. +# +# if [[ ! -e /usr/sbin/invoke-rc.d-diverted ]]; then +# mv /usr/sbin/invoke-rc.d /usr/sbin/invoke-rc.d-diverted +# dpkg --divert /usr/sbin/invoke-rc.d-diverted --no-rename /usr/sbin/invoke-rc.d +# fi +# /usr/sbin/invoke-rc.d: +# #!/bin/bash +# if [[ DPKG_MAINTSCRIPT_PACKAGE == exim4* && $1 == exim4 ]]; then +# shift +# ret=0 +# for daemon in exim4 eximfsf2 eximfsf3; do +# /usr/sbin/invoke-rc.d-diverted $daemon "$@" || ret=$? +# done +# else +# /usr/sbin/invoke-rc.d-diverted "$@" +# fi + +# Things I tend to forget. on MAIL_HOST, daemon runs with /etc/exim4/my.conf, +# due to /etc/default/exim4 containing: +# COMMONOPTIONS='-C /etc/exim4/my.conf' +# UPEX4OPTS='-o /etc/exim4/my.conf' +# +# The non-daemon config +# gets generated from this script calling update-exim4.conf -d /etc/myexim4 +# which has log path +# log_file_path = /var/log/exim4/my%s +# +# On non bk|MAIL_HOST, the config and log file are all standard. +# +# eximbackup folder is /bu/md +# it is cleaned up by mail-backup-clean, which is run by btrbk-run + +# shellcheck disable=SC2254 # makes for a lot of unneeded quotes + + +# perusing through /el/mainlog without test messages: +# &!testignore|jtuttle| +# +#&! testignore|jtuttle|eximbackup|/usr/sbin/exim4 -bpu + +# todo: this message seems to get dropped on the floor, it was due to a missing 2nd colon in +# condition = ${if def:h_fdate:} +# Figure out how to avoid this message being discarded. + +# 2023-09-12 01:41:43 [722371] 1qfw9f-0031v9-0S <= ian@iankelling.org U=iank P=local S=483 id=87cyyogd7t.fsf@iankelling.org T="iank2" from for testignore@amnimal.ninja +# 2023-09-12 01:41:43 [722373] 1qfw9f-0031v9-0S H=nn.b8.nz [10.173.8.2]: SMTP error from remote mail server after pipelined end of data: 451 Temporary local problem - please try later +# 2023-09-12 01:41:43 [722372] 1qfw9f-0031v9-0S == testignore@amnimal.ninja R=smarthost T=remote_smtp_smarthost defer (-46) H=nn.b8.nz [10.173.8.2] DT=0s: SMTP error from remote mail server after pipelined end of data: 451 Temporary local problem - please try later + +# todo: check new macro DKIM_TIMESTAMPS + +# todo: check if REMOTE_SMTP_INTERFACE or REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE can simplify my or fsfs config # todo: max line length macro changed in t11. look into it # todo: check that all macros we use are still valid in t11 @@ -126,12 +199,13 @@ if [ -z "$BASH_VERSION" ]; then echo "error: shell is not bash" >&2; exit 1; fi shopt -s nullglob -if [[ -s /usr/local/lib/err ]]; then - source /usr/local/lib/err -elif [[ -s /a/bin/errhandle/err ]]; then - source /a/bin/errhandle/err +if [[ -s /usr/local/lib/bash-bear ]]; then + source /usr/local/lib/bash-bear +elif [[ -s /a/bin/bash-bear-trap/bash-bear ]]; then + source /a/bin/bash-bear-trap/bash-bear else - err "no err tracing script found" + echo "no err tracing script found" + exit 1 fi source /a/bin/distro-functions/src/identify-distros source /a/bin/distro-functions/src/package-manager-abstractions @@ -182,8 +256,8 @@ fi ####### -# * perstent password instructions -# Note: for cert cron, we need to manually run first to accept known_hosts +# * perstent password instructions Note: for cert cron, we need to +# manually run first to accept known_hosts # # exim passwords: # # for hosts which have all private files I just use the same user @@ -277,7 +351,7 @@ fi # * functions & constants -pre="${0##*/}:" +pre="${0##*/}:${SSH_CLIENT:+ $HOSTNAME:}" m() { printf "$pre %s\n" "$*"; "$@"; } e() { printf "$pre %s\n" "$*"; } err() { printf "$pre %s\n" "$*" >&2; exit 1; } @@ -287,7 +361,7 @@ reload=false if [[ -e /var/local/mail-setup-reload ]]; then reload=true fi -i() { # install file +u() { # update file. note: duplicated in brc local tmp tmpdir dest="$1" local base="${dest##*/}" local dir="${dest%/*}" @@ -295,13 +369,13 @@ i() { # install file # dest has a directory component mkdir -p "$dir" fi - ir=false # i result + ur=false # u result tmpdir=$(mktemp -d) cat >$tmpdir/"$base" tmp=$(rsync -ic $tmpdir/"$base" "$dest") if [[ $tmp ]]; then printf "%s\n" "$tmp" - ir=true + ur=true if [[ $dest == /etc/systemd/system/* ]]; then touch /var/local/mail-setup-reload reload=true @@ -323,9 +397,19 @@ soff () { done } sre() { + local enabled for service; do m systemctl restart $service - m systemctl enable $service; + # Optimization for exim, + # is-enabled: 0m0.015s + # enable: 0m0.748s + # It is related to this message: + # exim4.service is not a native service, redirecting to systemd-sysv-install. + # Executing: /lib/systemd/systemd-sysv-install enable exim4 + enabled=$(systemctl is-enabled $service 2>/dev/null ||:) + if [[ $enabled != enabled ]]; then + m systemctl enable $service + fi done } mailhost() { @@ -370,7 +454,7 @@ fi bhost_t=false case $HOSTNAME in $MAIL_HOST) : ;; - kd|frodo|x2|x3|kw|sy|bo) + kd|x2|x3|kw|sy|bo|so) bhost_t=true ;; esac @@ -427,7 +511,7 @@ fi # * Mail clean cronjob -i /etc/systemd/system/mailclean.timer <<'EOF' +u /etc/systemd/system/mailclean.timer <<'EOF' [Unit] Description=Run mailclean daily @@ -438,7 +522,7 @@ OnCalendar=monthly WantedBy=timers.target EOF -i /etc/systemd/system/mailclean.service < EOF -i /etc/fail2ban/jail.d/exim.local <<'EOF' +u /etc/fail2ban/jail.d/exim.local <<'EOF' [exim] enabled = true port = 25,587 @@ -1025,7 +1142,11 @@ banaction = iptables-exim # 10.173.8.1 = non-nn net ignoreip = 209.51.188.13 2001:470:142::13 209.51.188.92 2001:470:142:3::10 72.14.176.105 2600:3c00:e000:280::2 10.173.8.1 EOF -if $ir; then +if $ur; then + # Ensure the log file monitored by fail2ban exists, or else fail2ban can't start. + if [[ ! -e /var/log/exim4/mainlog ]]; then + install -m 640 -o Debian-exim -g adm /dev/null /var/log/exim4/mainlog + fi m systemctl restart fail2ban fi @@ -1131,26 +1252,26 @@ rm -fv /etc/exim4/conf.d/retry/37_retry cat >/etc/exim4/conf.d/retry/17_retry <<'EOF' # Retry fast for my own domains -iankelling.org * F,1d,4m;F,14d,1h -amnimal.ninja * F,1d,4m;F,14d,1h -expertpathologyreview.com * F,1d,4m;F,14d,1h -je.b8.nz * F,1d,4m;F,14d,1h -zroe.org * F,1d,4m;F,14d,1h -eximbackup.b8.nz * F,1d,4m;F,14d,1h +iankelling.org * F,1d,1m;F,14d,1h +amnimal.ninja * F,1d,1m;F,14d,1h +expertpathologyreview.com * F,1d,1m;F,14d,1h +je.b8.nz * F,1d,1m;F,14d,1h +zroe.org * F,1d,1m;F,14d,1h +eximbackup.b8.nz * F,1d,1m;F,14d,1h # The spec says the target domain will be used for temporary host errors, # but i've found that isn't correct, the hostname is required # at least sometimes. -nn.b8.nz * F,1d,4m;F,14d,1h -defaultnn.b8.nz * F,1d,4m;F,14d,1h -mx.iankelling.org * F,1d,4m;F,14d,1h -bk.b8.nz * F,1d,4m;F,14d,1h -eggs.gnu.org * F,1d,4m;F,14d,1h -fencepost.gnu.org * F,1d,4m;F,14d,1h +nn.b8.nz * F,1d,1m;F,14d,1h +defaultnn.b8.nz * F,1d,1m;F,14d,1h +mx.iankelling.org * F,1d,1m;F,14d,1h +bk.b8.nz * F,1d,1m;F,14d,1h +eggs.gnu.org * F,1d,1m;F,14d,1h +fencepost.gnu.org * F,1d,1m;F,14d,1h # afaik our retry doesnt need this, but just using everything -mx.amnimal.ninja * F,1d,4m;F,14d,1h -mx.expertpathologyreview.com * F,1d,4m;F,14d,1h +mx.amnimal.ninja * F,1d,1m;F,14d,1h +mx.expertpathologyreview.com * F,1d,1m;F,14d,1h mail.fsf.org * F,1d,15m;F,14d,1h @@ -1172,22 +1293,16 @@ cd /etc/exim4 for f in *-private.pem; do echo ${f%-private.pem} done -} | i /etc/exim4/conf.d/my-dkim-domains +} | u /etc/exim4/conf.d/my-dkim-domains -cat >/etc/exim4/conf.d/transport/11_iank <<'EOF' -# This unsets the default macro defined in on t11 in -# /etc/exim4/conf.d/transport/10_exim4-config_transport-macros -# It seems like a very odd choice that this has become -# the default in t11. Normal smarthost clients use username/password -# auth. Oh well. -REMOTE_SMTP_SMARTHOST_TLS_VERIFY_HOSTS == -EOF +rm -f /etc/exim4/conf.d/transport/11_iank cat >/etc/exim4/conf.d/main/000_local <<'EOF' MAIN_TLS_ENABLE = true # require tls connections for all smarthosts -REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS = * +REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS = ! nn.b8.nz +REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS = nn.b8.nz # debian exim config added this in 2016 or so? # it's part of the smtp spec, to limit lines to 998 chars @@ -1199,8 +1314,8 @@ REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS = * # other says gmail does not reject. figure out and open a new bug. IGNORE_SMTP_LINE_LENGTH_LIMIT = true -# more verbose logs -MAIN_LOG_SELECTOR = +all +# more verbose logs. used to use +all, but made it less for more efficiency. +MAIN_LOG_SELECTOR = -skip_delivery -tls_cipher -tls_certificate_verified +all_parents +address_rewrite +arguments +deliver_time +pid +queue_time +queue_time_overall +received_recipients +received_sender +return_path_on_delivery +sender_on_delivery +smtp_confirmation +subject # Based on spec, seems like a good idea to be nice. smtp_return_error_details = true @@ -1217,16 +1332,6 @@ smtp_accept_queue_per_connection = 500 DKIM_CANON = relaxed DKIM_SELECTOR = li -# From comments in -# https://debian-administration.org/article/718/DKIM-signing_outgoing_mail_with_exim4 -# and its best for this to align https://tools.ietf.org/html/rfc7489#page-8 -# There could be some circumstance when the -# from: isnt our domain, but the envelope sender is -# and so still want to sign, but I cant think of any case. -#DKIM_DOMAIN = ${lc:${domain:$rh_from:}} -# In t11, we cant do the above anymore because this is tainted data used in a file lookup. -# /usr/share/doc/exim4/NEWS.Debian.gz suggests to use lookups to untaint data. -DKIM_DOMAIN = ${lookup {${domain:$rh_from:}}lsearch,ret=key{/etc/exim4/conf.d/my-dkim-domains}} # The file is based on the outgoing domain-name in the from-header. # sign if key exists @@ -1241,6 +1346,7 @@ DKIM_SIGN_HEADERS = mime-version:in-reply-to:references:from:date:subject:to domainlist local_hostnames = ! je.b8.nz : ! bk.b8.nz : *.b8.nz : b8.nz +# note: most of these are duplicated in spamassassin config hostlist iank_trusted = <; \ # veth0 10.173.8.1 ; \ @@ -1269,7 +1375,7 @@ delay_warning_condition = ${if or {\ # enable 587 in addition to the default 25, so that # i can send mail where port 25 is firewalled by isp -daemon_smtp_ports = 25 : 587 +daemon_smtp_ports = 25 : 587 : 10025 # default of 25, can get stuck when catching up on mail smtp_accept_max = 400 smtp_accept_reserve = 100 @@ -1278,11 +1384,40 @@ smtp_reserve_hosts = +iank_trusted # Rules that make receiving more liberal should be on backup hosts # so that we dont reject mail accepted by MAIL_HOST LOCAL_DENY_EXCEPTIONS_LOCAL_ACL_FILE = /etc/exim4/conf.d/local_deny_exceptions_acl + +acl_not_smtp = acl_check_not_smtp + + +DEBBUGS_DOMAIN = b.b8.nz + +EOF + +if dpkg --compare-versions "$(dpkg-query -f='${Version}\n' --show exim4)" ge 4.94; then + cat >>/etc/exim4/conf.d/main/000_local <<'EOF' +# In t11, we cant do the old anymore because this is tainted data used in a file lookup. +# /usr/share/doc/exim4/NEWS.Debian.gz suggests to use lookups to untaint data. +DKIM_DOMAIN = ${lookup {${domain:$rh_from:}}lsearch,ret=key{/etc/exim4/conf.d/my-dkim-domains}} +EOF +else + cat >>/etc/exim4/conf.d/main/000_local <<'EOF' +# From comments in +# https://debian-administration.org/article/718/DKIM-signing_outgoing_mail_with_exim4 +# and its best for this to align https://tools.ietf.org/html/rfc7489#page-8 +# There could be some circumstance when the +# from: isnt our domain, but the envelope sender is +# and so still want to sign, but I cant think of any case. +DKIM_DOMAIN = ${lc:${domain:$rh_from:}} EOF +fi + +cat >/etc/exim4/conf.d/main/30_local </etc/exim4/update-exim4.conf.conf <<'EOF' # default stuff, i havent checked if its needed dc_minimaldns='false' -dc_relay_nets='' CFILEMODE='644' dc_use_split_config='true' dc_mailname_in_oh='true' @@ -1514,16 +1882,17 @@ if mailhost; then # in the log it just says "Starting Radicale". If you run # it in the foreground, it will give more info. Background # plus debug does not help. - # sudo -u radicale radicale -D -f + # sudo -u radicale radicale -D - # created password file with: - # htpasswd -c /p/c/machine_specific/li/filesystem/etc/caldav-htpasswd + # created radicale password file with: + # htpasswd -c /p/c/machine_specific/li/filesystem/etc/caldav-htpasswd ian # chmod 640 /p/c/machine_specific/li/filesystem/etc/caldav-htpasswd # # setup chgrp www-data in ./conflink pi-nostart radicale + m usermod -a -G radicale iank - i /etc/systemd/system/radicale.service.d/override.conf <: Fatal: master: service(lmtp): child 3839880 returned error 83 (Out of memory (service lmtp { vsz_limit=256 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) +# exim would just queue mail until it eventually succeeded. +# Deciding what to increase it to, I found this +# https://dovecot.org/list/dovecot/2011-December/080056.html +# which suggests 3x the largest dovecot.index.cache file +# and then I found that +# md/l/testignore/dovecot.index.cache is 429M, my largest cache file, +# but that folder only has 2k messages. +# next biggest is md/l/qemu-devel/dovecot.index.cache 236M +# which lead to me a search https://doc.dovecot.org/admin_manual/known_issues/large_cache/ +# which suggests 1.5x the maximum cache file size 1G, and +# that I can safely rm the index. +default_vsz_limit = 1500M + EOF if dpkg --compare-versions "$(dpkg-query -f='${Version}\n' --show dovecot-core)" ge 1:2.3; then cat <>/etc/dovecot/local.conf < @@ -1976,27 +2376,28 @@ if [[ $HOSTNAME == bk ]]; then ### begin composer install # https://getcomposer.org/doc/faqs/how-to-install-composer-programmatically.md - # cd $(mktemp -d) - # sum="$(wget -q -O - https://composer.github.io/installer.sig)" - # m php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" - # if [[ $sum != $(php -r "echo hash_file('sha384', 'composer-setup.php');") ]]; then - # echo 'ERROR: Invalid composer installer checksum' >&2 - # rm -fv composer-setup.php - # exit 1 - # fi - # m php composer-setup.php --quiet - # rm -fv composer-setup.php - # m mv composer.phar /usr/local/bin - - # the above method gets composer2, carddav plugin at least doesnt work with that - # yet, it was just released 10-24-2020. - m cd /usr/local/bin - m wget -nv -N https://getcomposer.org/composer-1.phar - chmod +x composer-1.phar + cd /usr/local/bin + EXPECTED_CHECKSUM="$(php -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')" + php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" + ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")" + + if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ] + then + >&2 echo 'ERROR: Invalid installer checksum' + rm composer-setup.php + exit 1 + fi + + php composer-setup.php --quiet + rm composer-setup.php + + # based on error when running composer + mkdir -p /var/www/.composer + chown www-data:www-data /var/www/.composer + ### end composer install rcdirs=(/usr/local/lib/rcexpertpath /usr/local/lib/rcninja) - ncdirs=(/var/www/ncninja) ncdirs=(/var/www/ncexpertpath /var/www/ncninja) # point debian cronjob to our local install, preventing daily cron error @@ -2030,7 +2431,7 @@ if [[ $HOSTNAME == bk ]]; then ncdir=${ncdirs[i]} # copied from debians cronjob - i /etc/cron.d/$rcbase </dev/null @@ -2090,7 +2491,7 @@ EOF rctmpdir=/var/tmp/$rcbase rcdb=/m/rc/$rcbase.sqlite # config from mailinabox - i $rcdir/config/config.inc.php <$verf @@ -2185,7 +2586,7 @@ EOF # About categories, see https://www.davx5.com/tested-with/nextcloud # https://github.com/blind-coder/rcmcarddav/blob/master/doc/GROUPS.md - i $rcdir/plugins/carddav/config.inc.php <tmp.php <$myncdir/tmp.php <config.php - # leave in place for debugging - #m rm -f tmp.php - m sudo -u www-data php $ncdir/occ maintenance:update:htaccess + e running php $myncdir/tmp.php + # note: we leave it around place for debugging + # shellcheck disable=SC2024 # intended + sudo -u www-data php $myncdir/tmp.php >config.php + fi + cd $ncdir + m sudo -u www-data php occ maintenance:update:htaccess list=$(sudo -u www-data php $ncdir/occ --output=json_pretty app:list) # user_external not compaible with nc 23 for app in contacts calendar; do if [[ $(printf "%s\n" "$list"| jq ".enabled.$app") == null ]]; then - m sudo -u www-data php $ncdir/occ app:install $app + cd $ncdir + m sudo -u www-data php occ app:install $app fi done - i /etc/systemd/system/$ncbase.service < + Options Indexes SymLinksIfOwnerMatch MultiViews + DirectoryIndex index.html + Require all granted + + +ScriptAlias /cgi/ /var/lib/debbugs/www/cgi/ + + AllowOverride None + Options ExecCGI SymLinksIfOwnerMatch + Require all granted + + +RewriteEngine on +RewriteCond %{HTTP_USER_AGENT} .*apt-listbugs.* +RewriteRule .* /apt-listbugs.html [R,L] + +# RewriteLog /org/bugs.debian.org/apache-rewrite.log +# RewriteLogLevel 0 + +#RewriteRule ^/$ http://www.debian.org/Bugs/ +RewriteRule ^/(robots\.txt|release-critical|apt-listbugs\.html)$ - [L] +# The following two redirect to up-to-date pages +RewriteRule ^/[[:space:]]*#?([[:digit:]][[:digit:]][[:digit:]]+)([;&].+)?$ /cgi-bin/bugreport.cgi?bug=$1$2 [L,R,NE] +RewriteRule ^/([^/+]*)([+])([^/]*)$ "/$1%%{%}2B$3" [N] +RewriteRule ^/[Ff][Rr][Oo][Mm]:([^/]+\@.+)$ /cgi-bin/pkgreport.cgi?submitter=$1 [PT,NE] +# Commented out, 'cuz aj says it will crash master. (old master) +# RewriteRule ^/[Ss][Ee][Vv][Ee][Rr][Ii][Tt][Yy]:([^/]+\@.+)$ /cgi-bin/pkgreport.cgi?severity=$1 [L,R] +RewriteRule ^/([^/]+\@.+)$ /cgi-bin/pkgreport.cgi?maint=$1 [PT,NE] +RewriteRule ^/mbox:([[:digit:]][[:digit:]][[:digit:]]+)([;&].+)?$ /cgi-bin/bugreport.cgi?mbox=yes&bug=$1$2 [PT,NE] +RewriteRule ^/src:([^/]+)$ /cgi-bin/pkgreport.cgi?src=$1 [PT,NE] +RewriteRule ^/severity:([^/]+)$ /cgi-bin/pkgreport.cgi?severity=$1 [PT,NE] +RewriteRule ^/tag:([^/]+)$ /cgi-bin/pkgreport.cgi?tag=$1 [PT,NE] +# RewriteMap fix-chars int:noescape +RewriteCond %{REQUEST_URI} ^/(Access\.html|Developer\.html|Reporting\.html|server-request\.html|server-control\.html|server-refcard\.html).* [NC] +RewriteRule .* - [L] +# PT|passthrough to bugreport.cgi and pkgreport.cgi +RewriteRule ^/([0-9]+)$ /cgi-bin/bugreport.cgi?bug=$1 [PT,NE] +RewriteRule ^/([^/]+)$ /cgi-bin/pkgreport.cgi?pkg=$1 [PT,NE] +EOF + + # * exim host conditional config # ** exim certs @@ -2469,7 +2949,7 @@ deny domains = +local_domains !verify = recipient/callout=no_cache EOF - i /etc/exim4/conf.d/auth/29_exim4-config_auth <<'EOF' + u /etc/exim4/conf.d/auth/29_exim4-config_auth <<'EOF' dovecot_plain: driver = dovecot public_name = PLAIN @@ -2479,7 +2959,7 @@ EOF ;; esac if $bhost_t; then - i /etc/exim4/conf.d/auth/29_exim4-config_auth <<'EOF' + u /etc/exim4/conf.d/auth/29_exim4-config_auth <<'EOF' # from 30_exim4-config_examples plain_server: driver = plaintext @@ -2499,9 +2979,10 @@ case $HOSTNAME in # to see the default comments in /etc/default/exim4: # s update-exim4defaults --force --init # which will overwrite any existing file - i /etc/default/exim4 <<'EOF' + u /etc/default/exim4 <<'EOF' QUEUERUNNER='combined' -QUEUEINTERVAL='30m' +# note: this is duplicated in brc2, 10m here is -q10m there. +QUEUEINTERVAL='10m' COMMONOPTIONS='-C /etc/exim4/my.conf' UPEX4OPTS='-o /etc/exim4/my.conf' # i use epanic-clean for alerting if there are bad paniclog entries @@ -2518,13 +2999,13 @@ EOF # note: the daemon gives up and dies after retrying those 9 times. # I came upon this by guessing and trial and error. setcap CAP_NET_BIND_SERVICE+ei /usr/sbin/exim4 - i /etc/exim4/trusted_configs <<'EOF' + u /etc/exim4/trusted_configs <<'EOF' /etc/exim4/my.conf EOF ;; *) # default file - i /etc/default/exim4 <<'EOF' + u /etc/default/exim4 <<'EOF' QUEUERUNNER='combined' QUEUEINTERVAL='30m' EOF @@ -2545,7 +3026,7 @@ case $HOSTNAME in dirs+=($d) fi done - i /etc/systemd/system/exim4.service.d/nonroot.conf <>/etc/exim4/update-exim4.conf.conf <>/etc/exim4/conf.d/main/000_local <>/etc/exim4/update-exim4.conf.conf <> /etc/exim4/conf.d/data_local_acl <<'EOF' -deny - malware = */defer_ok - !condition = ${if match {$malware_name}{\N^Heuristic\N}} - message = This message was detected as possible malware ($malware_name). -EOF cat >/etc/exim4/conf.d/main/000_local-nn <>/etc/exim4/conf.d/main/000_local < /etc/mailname + # mail default domain. + u /etc/mailutils.conf <<'EOF' +address { + email-domain iankelling.org; +}; +EOF # mail.iankelling.org so local imap clients can connect with tls and # when they happen to not be local. @@ -2913,21 +3402,52 @@ EOF ## we use this host to monitor MAIL_HOST and host a mail server for someone bk) - echo|i /etc/exim4/conf.d/rcpt_local_acl - echo|i /etc/exim4/conf.d/router/880_universal_forward + # No clamav on je, it has 1.5g memory and clamav uses most of it. + # + # No clamav on MAIL_HOST because it is just a waste of useful cpu + # time and memory when I'm running on an x200, and it takes 30 + # seconds to shut down. + + cat >>/etc/exim4/conf.d/main/000_local <> /etc/exim4/conf.d/data_local_acl <<'EOF' +deny + malware = */defer_ok + !condition = ${if match {$malware_name}{\N^Heuristic\N}} + message = This message was detected as possible malware ($malware_name). + +warn + !hosts = +iank_trusted + !authenticated = * + condition = ${if def:malware_name} + remove_header = Subject: + add_header = Subject: [Clamav warning: $malware_name] $h_subject + log_message = heuristic malware warning: $malware_name + +warn + # fdate = future date. # tdate = temporary date. + condition = ${if def:h_fdate} + remove_header = fdate: + add_header = tdate: + control = freeze +EOF + /a/exe/cedit nn /etc/hosts <<'EOF' || [[ $? == 1 ]] 10.173.8.2 nn.b8.nz EOF - sed -r -f - /etc/init.d/exim4 <<'EOF' | i /etc/init.d/exim4in + sed -r -f - /etc/init.d/exim4 <<'EOF' |u /etc/init.d/exim4in s,/etc/default/exim4,/etc/default/exim4in,g s,/run/exim4/exim.pid,/run/exim4/eximin.pid,g s,(^[ #]*Provides:).*,\1 exim4in, s,(^[ #]*NAME=).*,\1"exim4in", EOF chmod +x /etc/init.d/exim4in - i /etc/systemd/system/exim4in.service.d/alwaysrestart.conf <<'EOF' + u /etc/systemd/system/exim4in.service.d/alwaysrestart.conf <<'EOF' [Unit] # needed to continually restart StartLimitIntervalSec=0 @@ -2938,7 +3458,7 @@ Restart=always RestartSec=20 EOF - i /etc/default/exim4in <<'EOF' + u /etc/default/exim4in <<'EOF' # defaults but no queue runner and alternate config dir QUEUERUNNER='no' COMMONOPTIONS='-oP /run/exim4/eximin.pid' @@ -2958,23 +3478,30 @@ EOF cat >>/etc/exim4/update-exim4.conf.conf <>/etc/exim4/update-exim4.conf.conf <>/etc/exim4/update-exim4.conf.conf <>/etc/exim4/update-exim4.conf.conf <>/etc/myexim4/conf.d/main/000_local <<'EOF' # this makes it easier to see which exim is doing what log_file_path = /var/log/exim4/my%s @@ -3130,11 +3663,39 @@ EOF bk) # config for the non-nn exim - cat >/etc/myexim4/conf.d/main/000_local-nn <<'EOF' + cat >>/etc/myexim4/conf.d/main/000_local <<'EOF' MAIN_HARDCODE_PRIMARY_HOSTNAME = mail2.iankelling.org EOF ;; $MAIL_HOST) + + + u /etc/myexim4/conf.d/router/185_sentarchive <<'EOF' +sentarchive: + driver = redirect + domains = ! +local_domains + senders = <; *@fsf.org ; *@posteo.net + condition = ${if and {{!bool{${lookup{$local_part@$domain}lsearch{/etc/exim4/ignore-sent}{true}}}} {!match {$h_user-agent:}{emacs}}}} + data = vojdedIdNejyebni@b8.nz + unseen +EOF + + u /etc/myexim4/conf.d/router/160_backup_redir <<'EOF' +backup_redir: + driver = redirect + # i dont email myself from my own machine much, so lets ignore that. + domains = ! +local_domains + senders = <; *@fsf.org ; *@posteo.net + condition = ${if and {{!bool{${lookup{$local_part@$domain}lsearch{/etc/exim4/ignore-sent}{true}}}} {!match {$h_user-agent:}{emacs}}}} + # b is just an arbirary short string + data = b@eximbackup.b8.nz + # note, to test this, i could temporarily allow testignore. + # alerts avoids potential mail loop. + local_parts = ! root : ! testignore : ! alerts : ! daylert + unseen = true + errors_to = alerts@iankelling.org +EOF + # for bk, we have a exim4in.service that will do this for us. m update-exim4.conf -d /etc/myexim4 ;; @@ -3158,7 +3719,7 @@ if [[ -e /nocow ]]; then if ! grep -Fx "/nocow/exim4 /var/spool/exim4 none bind 0 0" /etc/fstab; then echo "/nocow/exim4 /var/spool/exim4 none bind 0 0" >>/etc/fstab fi - i /etc/systemd/system/exim4.service.d/override.conf <<'EOF' + u /etc/systemd/system/exim4.service.d/override.conf <<'EOF' [Unit] # without local-fs on exim, we get these kind of errors in paniclog on shutdown: # Failed to create spool file /var/spool/exim4//input//1jCLxz-0008V4-V9-D: Permission denied @@ -3204,6 +3765,25 @@ elif [[ $uid != 608 ]]; then m find / /nocow -xdev -path ./var/tmp -prune -o -gid $gid -execdir chgrp -h 608 {} + fi + +# note: example config has a debbugs user, +# but my exim runs setuid as Debian-exim so it can't switch +# to another user. Anyways, I'm not exposing this to the +# internet at this time. If I do, the thing to do would +# be to use a sudo config (or sudo alternative). This +# would be how to setup + +# IFS=:; read -r _ _ uid _ < <(getent passwd debbugs||:) ||:; unset IFS +# if [[ ! $uid ]]; then +# # /a/opt/debbugs/debian/README.mail +# adduser --uid 610 --system --group --home /o/debbugs \ + # --no-create-home --disabled-login --force-badname debbugs +# m find /o/debbugs -xdev -path ./var/tmp -prune -o -uid $uid -execdir chown -h 610 {} + +# m find /o/debbugs -xdev -path ./var/tmp -prune -o -gid $gid -execdir chgrp -h 610 {} + +# elif [[ $uid != 610 ]]; then +# err debbugs exist but is not uid 610: investigate +# fi + # * start / stop services reifactive dnsmasq nscd @@ -3212,14 +3792,20 @@ if $reload; then m systemctl daemon-reload fi -# checking bhost_t is redundant, but could help us catch errors. -if $bhost_t || [[ -e /etc/wireguard/wghole.conf ]]; then - # todo: in mail-setup, we have a static list of backup hosts, not *y - m systemctl --now enable wg-quick@wghole +# optimization, this only needs to run once. +if [[ ! -e /sys/class/net/wghole ]]; then + # checking bhost_t is redundant, but could help us catch errors. + if $bhost_t || [[ -e /etc/wireguard/wghole.conf ]]; then + # todo: in mail-setup, we have a static list of backup hosts, not *y + m systemctl --now enable wg-quick@wghole + fi fi -sysd-prom-fail-install epanicclean -m systemctl --now enable epanicclean +# optimization, this only needs to be run once +if [[ ! -e /var/lib/prometheus/node-exporter/exim_paniclog.prom ]]; then + sysd-prom-fail-install epanicclean + m systemctl --now enable epanicclean +fi case $HOSTNAME in je) @@ -3230,8 +3816,13 @@ case $HOSTNAME in ;; esac -m /a/bin/ds/mail-cert-cron -1 -sre mailcert.timer +# optimization, this only needs to run once. But, if we move to a +# computer we haven't used much, we need to fetch a fresh cert. +# Existence check is just to avoid ugly error message from openssl. +if [[ ! -e /etc/exim4/fullchain.pem ]] || ! openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/exim4/fullchain.pem; then + m /a/bin/ds/mail-cert-cron -1 -i + m systemctl --now enable mailcert.timer +fi case $HOSTNAME in $MAIL_HOST|bk) @@ -3253,6 +3844,8 @@ case $HOSTNAME in else m systemctl --now enable $vpnser fi + ;;& + bk) if ! systemctl is-active clamav-daemon >/dev/null; then m systemctl --now enable clamav-daemon out=$(rsync -aiSAX --chown=root:root --chmod=g-s /a/bin/ds/filesystem/etc/systemd/system/epanicclean.service /etc/systemd/system) @@ -3268,9 +3861,11 @@ case $HOSTNAME in $MAIL_HOST|bk|je) # start spamassassin/dovecot before exim. sre dovecot spamassassin - # need to wait a bit before restarting exim, else I - # get a paniclog entry like: spam acl condition: all spamd servers failed - sleep 3 + # Wait a bit before restarting exim, else I get a paniclog entry + # like: spam acl condition: all spamd servers failed. But I'm tired + # of waiting. I'll deal with this some other way. + # + # sleep 3 m systemctl --now enable mailclean.timer ;;& $MAIL_HOST) @@ -3329,7 +3924,7 @@ case $HOSTNAME in # note: cronjob "ian" also does some important monitoring # todo: this will sometimes cause an alert because mailtest-check will run # before we have setup network namespace and spamassassin - i /etc/cron.d/mailtest <> /etc/exim4/ignore-sent - done + # Plus addresses we generally want to ignore. + u /etc/exim4/ignore-sent </usr/local/bin/send-test-forward <<'EOF' #!/bin/bash @@ -3409,6 +4006,9 @@ EOF test_to=${test_tos[0]} for t in ${test_tos[@]:1}; do + if [[ $test_from == *@gnu.org && $t == *@gnu.org ]]; then + continue + fi test_to+=", $t" done case $test_from in