X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=blobdiff_plain;f=mail-setup;h=f2623028be96c76a68bb4f869f7c9c7fe63c3353;hp=d6ba6f7f7b07ef24b90d6e2a16cfdb0b61c6c37d;hb=79b274fcd8bfa556133ab13270e84b40aebe8468;hpb=8793e42101bdb66e63e76deebe3958e9a1ef7c87 diff --git a/mail-setup b/mail-setup index d6ba6f7..f262302 100755 --- a/mail-setup +++ b/mail-setup @@ -1,52 +1,65 @@ #!/bin/bash -set -x +# -*- eval: (outline-minor-mode); -*- +# * intro +# Copyright (C) 2019 Ian Kelling +# SPDX-License-Identifier: AGPL-3.0-or-later -# Copyright (C) 2016 Ian Kelling +if [ -z "$BASH_VERSION" ]; then echo "error: shell is not bash" >&2; exit 1; fi -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at +pre="${0##*/}:" +m() { printf "$pre %s\n" "$*"; "$@"; } +e() { printf "$pre %s\n" "$*"; } +err() { echo "[$(date +'%Y-%m-%d %H:%M:%S%z')]: $0: $*" >&2; } -# http://www.apache.org/licenses/LICENSE-2.0 -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. +# TODO: copy dkim keys from within this file. its now done in conflink. +# TODO: fix dkim key to b chmod 640, group Debian-exim -set -eE -o pipefail -trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR +if [[ -s /usr/local/lib/err ]]; then + source /usr/local/lib/err +elif [[ -s /a/bin/errhandle/err ]]; then + source /a/bin/errhandle/err +else + err "no err tracing script found" + exit 1 +fi + +[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@" +if [[ ! $SUDO_USER ]]; then + echo "$0: error: requires running as nonroot or sudo" + exit 1 +fi +u=$SUDO_USER -[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@" usage() { - cat < preferences -> preferences -> advanced tab -> config editor button -> security.ssl.enable_ocsp_must_staple = false +# background: ovecot does not yet have ocsp stapling support +# reference: https://community.letsencrypt.org/t/simple-guide-using-lets-encrypt-ssl-certs-with-dovecot/2921 +# +# for phone, same thing but username alerts, pass in ivy-pass. +####### -####### begin perstent password instructions ###### +# * perstent password instructions # # exim passwords: # # for hosts which have all private files I just use the same user # # for other hosts, each one get\'s their own password. @@ -57,12 +70,13 @@ u=$SUDO_USER # apg -m 50 -x 70 -n 1 -a 1 -M CLN >$f # s sed -i "/^$user:/d" /p/c/filesystem/etc/exim4/passwd # echo "$user:$(mkpasswd -m sha-512 -s <$f)" >>/p/c/filesystem/etc/exim4/passwd -# echo "mail.iankelling.org $user $(<$f)" >> /p/c/machine_specific/$user/filesystem/etc/mailpass +# # todo: port is no longer used in mailpass, remove it. +# echo "mail.iankelling.org 587 $user:$(<$f)" >> /p/c/machine_specific/$user/filesystem/etc/mailpass # # then run this script, or part of it which uses /etc/mailpass # # dovecot password, i just need 1 as I\'m the only user # mkdir /p/c/filesystem/etc/dovecot -# echo "ian:$(doveadm pw -s ssha256)::::::" >/p/c/filesystem/etc/dovecot/users +# echo "iank:$(doveadm pw -s ssha256)::::::" >>/p/c/filesystem/etc/dovecot/users # conflink @@ -77,7 +91,7 @@ u=$SUDO_USER ####### end perstent password instructions ###### -####### begin persistent dkim/dns instructions ######### +# * persistent dkim/dns instructions # # Remove 1 level of comments in this section, set the domain var # # for the domain you are setting up, then run this and copy dns settings # # into dns. @@ -103,7 +117,7 @@ u=$SUDO_USER # chmod 640 $domain-private.pem # # in conflink, we chown these to group debian # conflink -# # selector was also put into /etc/exim4/conf.d/main/000_localmacros, +# # selector was also put into /etc/exim4/conf.d/main/000_local, # # via the mail-setup scripts # # 2017-02 dmarc policies: @@ -117,11 +131,11 @@ u=$SUDO_USER # echo "dmarc dns, name: _dmarc value: v=DMARC1; p=none; rua=mailto:mailauth-reports@$domain" # # 2017-02 spf policies: -# # google ~all, hotmail -all, yahoo: ?all, fastmail ?all +# # host -t txt lists.fedoraproject.org +# # google ~all, hotmail ~all, yahoo: ?all, fastmail ?all, outlook ~all # # i include fastmail\'s settings, per their instructions, # # and follow their policy. In mail in a box, or similar instructions, # # I\'ve seen recommended to not use a restrictive policy. -# echo "spf dns: name is empty, value: v=spf1 a include:spf.messagingengine.com ?all" # # to check if dns has updated, you do # host -a mesmtp._domainkey.$domain @@ -132,54 +146,28 @@ u=$SUDO_USER # cat <<'EOF' # mx records, 2 records each, for * and empty domain # pri 10 mail.iankelling.org -# pri 20 in1-smtp.messagingengine.com -# pri 30 in2-smtp.messagingengine.com # EOF ####### end persistent dkim instructions ######### -# misc exim notes: -# useful exim docs: -# /usr/share/doc/exim4-base/README.Debian.gz -# /usr/share/doc/exim4-base/spec.txt.gz - -# routers, transports, and authenticators are sections, and you define -# driver instances in those sections, and the manual calls them driver -# types but there is also a more specific "type" of driver, which is specified -# with the driver = some_module setting in the driver. - -# the driver option must precede and private options (options that are -# specific to that driver), so follow example of putting it at beginning. - -# The full list of option settings for any particular driver instance, -# including all the defaulted values, can be extracted by making use of -# the -bP command line option. -# exim -bP config_file to see what config file it used -# exim -bP config to see - -# exim clear out message queue. as root: -# adapted from somewhere on stackoverflow. -# ser stop exim4; sleep 1; exim -bp | exiqgrep -i | xargs exim -Mrm; ser start exim4 - -# fastmail has changed their smtp server, but the old one still works, -# I see no reason to bother changing. -# New one is smtp.fastmail.com - -# test delivery & rewrite settings: -#exim4 -bt iank@localhost - - -postconfin() { - local MAPFILE - mapfile -t - local s - postconf -ev "${MAPFILE[@]}" -} +# * functions constants e() { printf "%s\n" "$*"; } +pi() { # package install + local f + if dpkg -s -- "$@" &> /dev/null; then + return 0; + fi; + while fuser /var/lib/dpkg/lock &>/dev/null; do sleep 1; done + f=/var/cache/apt/pkgcache.bin; + if [[ ! -r $f ]] || (( $(( $(date +%s) - $(stat -c %Y $f ) )) > 60*60*12 )); then + m apt-get update + fi + DEBIAN_FRONTEND=noninteractive m apt-get -y install --purge --auto-remove "$@" +} -postmaster=$u +postmaster=alerts mxhost=mail.iankelling.org -mxport=25 +mxport=587 forward=$u@$mxhost # old setup. left as comment for example @@ -187,198 +175,164 @@ forward=$u@$mxhost # mxport=587 # forward=ian@iankelling.org -relayhost="[$mxhost]:$mxport" # postfix -smarthost="$mxhost::$mxport" # exim +smarthost="$mxhost::$mxport" + +## * Install packages +# light version of exim does not have sasl auth support. +pi exim4-daemon-heavy spamassassin spf-tools-perl openvpn dnsmasq # trisquel 8 = openvpn, debian stretch = openvpn-client vpn_ser=openvpn-client if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then - vpn_ser=openvpn + vpn_ser=openvpn fi -if [[ $HOSTNAME == $MAIL_HOST ]]; then - # afaik, these will get ignored because they are routing to my own - # machine, but rm them is safer - rm -f $(eval echo ~$postmaster)/.forward /root/.forward +uhome=$(eval echo ~$u) +### * user forward file +if [[ $HOSTNAME == "$MAIL_HOST" ]]; then + # afaik, these will get ignored because they are routing to my own + # machine, but rm them is safer + rm -fv $uhome/.forward /root/.forward else - # this can\'t be a symlink and has permission restrictions - # it might work in /etc/aliases, but this seems more proper. - install -m 644 {-o,-g}$postmaster <(e $forward) $(eval echo ~$postmaster)/.forward + # this can\'t be a symlink and has permission restrictions + # it might work in /etc/aliases, but this seems more proper. + e setting $uhome/.forward to $forward + install -m 644 {-o,-g}$u <(e $forward) $uhome/.forward fi -# offlineimap uses this too, it is much easier to use one location than to -# condition it\'s config and postfix\'s config -if [[ -f /etc/fedora-release ]]; then - /a/exe/lnf -T ca-certificates.crt /etc/ssl/ca-bundle.trust.crt -fi - -if postfix; then - # dunno why, but debian installed postfix with builddep emacs - # but I will just explicitly install it here since - # I use it for sending mail in emacs. - if command -v apt-get &> /dev/null; then - debconf-set-selections </dev/null; then - dpkg-reconfigure -u -fnoninteractive postfix - else - apt-get -y install --purge --auto-remove postfix - fi - else - source /a/bin/distro-functions/src/package-manager-abstractions - pi postfix - # Settings from reading the output when installing on debian, - # then seeing which were different in a default install on arch. - # I assume the same works for fedora. - postconfin <>$f - done - postmap hash:/etc/postfix/sasl_passwd - # need restart instead of reload when changing - # inet_protocols - service postfix restart - -else # begin exim. has debian specific stuff for now - - if ! dpkg -s openvpn &>/dev/null; then - apt-get -y install --purge --auto-remove openvpn - fi - - if [[ -e /p/c/filesystem ]]; then - # to put the hostname in the known hosts - ssh -o StrictHostKeyChecking=no root@li.iankelling.org : - /a/exe/vpn-mk-client-cert -b mail -n mail li.iankelling.org - fi +# * Mail clean cronjob - cat >/etc/systemd/system/mailroute.service </etc/systemd/system/mailclean.timer <<'EOF' [Unit] -# this unit is configured to start and stop whenever $vpn_ser@mail.service -# does -Description=Routing for email vpn -After=network.target -BindsTo=$vpn_ser@mail.service -After=$vpn_ser@mail.service - -[Service] -Type=oneshot -ExecStart=/a/bin/distro-setup/mail-route start -ExecStop=/a/bin/distro-setup/mail-route stop -RemainAfterExit=yes - -[Install] -RequiredBy=$vpn_ser@mail.service -EOF - - cat >/etc/systemd/system/offlineimapsync.timer <<'EOF' -[Unit] -Description=Run offlineimap-sync once every 5 mins +Description=Run mailclean daily [Timer] -OnCalendar=*:0/5 +OnCalendar=monthly [Install] WantedBy=timers.target EOF - cat >/etc/systemd/system/offlineimapsync.service </etc/systemd/system/mailclean.service <>/etc/default/spamassassin + # just noticed this in the config file, seems like a good idea. + sed -i '/^\s*NICE\s*=/d' /etc/default/spamassassin + e 'NICE="--nicelevel 15"' >>/etc/default/spamassassin + + m systemctl enable spamassassin + m systemctl start spamassassin + m systemctl reload spamassassin + + cat >/etc/systemd/system/spamddnsfix.service <<'EOF' +[Unit] +Description=spamd dns bug fix cronjob + +[Service] +Type=oneshot +ExecStart=/a/bin/distro-setup/spamd-dns-fix EOF + # 2017-09, debian closed the bug on this saying upstream had fixed it. + # remove this when i\'m using the newer package, ie, debian 10, or maybe + # ubuntu 18.04. + cat >/etc/systemd/system/spamddnsfix.timer <<'EOF' +[Unit] +Description=run spamd bug fix script every 10 minutes - source /a/bin/bash_unpublished/source-semi-priv - exim_main_dir=/etc/exim4/conf.d/main - mkdir -p $exim_main_dir +[Timer] +OnActiveSec=60 +# the script looks back 9 minutes into the journal, +# it takes a second to run, +# so lets run every 9 minutes and 10 seconds. +OnUnitActiveSec=550 + +[Install] +WantedBy=timers.target +EOF + m systemctl daemon-reload + m systemctl restart spamddnsfix.timer + m systemctl enable spamddnsfix.timer + +fi # [[ $HOSTNAME != "$MAIL_HOST" ]] +##### end spamassassin config + + +# * Update mail cert +if [[ -e /p/c/filesystem ]]; then + # allow failure of these commands when our internet is down, they are likely not needed, + # we check that a valid cert is there already. + # to put the hostname in the known hosts + if ! ssh -o StrictHostKeyChecking=no root@li.iankelling.org :; then + # This just causes failure if our cert is going to expire in the next 30 days. + # Certs I generate last 10 years. + openssl x509 -checkend $(( 60 * 60 * 24 * 30 )) -noout -in /etc/openvpn/mail.crt + else + # note, man openvpn implies we could just call mail-route on vpn startup/shutdown with + # systemd, buuut it can remake the tun device unexpectedly, i got this in the log + # after my internet was down for a bit: + # NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device. + m /a/exe/vpn-mk-client-cert -b mail -n mail -s /b/ds/mail-route li.iankelling.org + fi +fi - #### begin mail cert setup ### - f=/usr/local/bin/mail-cert-cron - cat >$f <<'EOF' +f=/usr/local/bin/mail-cert-cron +cat >$f <<'EOF' +#!/bin/bash set -eE -o pipefail trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR -[[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@" +[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@" -f=/a/bin/bash_unpublished/source-semi-priv +f=/a/bin/bash_unpublished/source-state if [[ -e $f ]]; then source $f fi -if [[ $HOSTNAME == $MAIL_HOST ]]; then +if [[ $HOSTNAME == "$MAIL_HOST" ]]; then local_mx=mail.iankelling.org - rsync_common="rsync -ogtL --chown=root:Debian-exim --chmod=640 root@li:/etc/letsencrypt/live/$local_mx/" + rsync_common="rsync -ogtL --chown=root:Debian-exim --chmod=640 root@li.iankelling.org:/etc/letsencrypt/live/$local_mx/" ${rsync_common}fullchain.pem /etc/exim4/exim.crt + ret=$? ${rsync_common}privkey.pem /etc/exim4/exim.key + new_ret=$? + if [[ $ret != $new_ret ]]; then + echo "$0: error: differing rsync returns, $ret, $new_ret" + exit 1 + fi fi +if [[ $new_ret != 0 ]]; then + if ! openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/exim4/exim.crt; then + echo "$0: error!: cert rsync failed and it will expire in less than 3 days" + exit 1 + fi +fi +exit 0 EOF - chmod 755 $f +m chmod 755 $f - cat >/etc/systemd/system/mailcert.service <<'EOF' +cat >/etc/systemd/system/mailcert.service <<'EOF' [Unit] Description=Mail cert rsync After=multi-user.target @@ -388,7 +342,7 @@ Type=oneshot ExecStart=/a/bin/log-quiet/sysd-mail-once mailcert /usr/local/bin/mail-cert-cron EOF - cat >/etc/systemd/system/mailcert.timer <<'EOF' +cat >/etc/systemd/system/mailcert.timer <<'EOF' [Unit] Description=Run mail-cert once a day @@ -398,168 +352,58 @@ OnCalendar=daily [Install] WantedBy=timers.target EOF - systemctl daemon-reload - systemctl start mailcert - systemctl restart mailcert.timer - systemctl enable mailcert.timer +m systemctl daemon-reload +m systemctl start mailcert +m systemctl restart mailcert.timer +m systemctl enable mailcert.timer - ##### end mailcert setup ##### - - if [[ $HOSTNAME == $MAIL_HOST ]]; then - - debconf-set-selections <>$f +done 175_$b - - -# Mail for the 'postmaster', 'root', and other system accounts needs to be redirected -# to the user account of the actual system administrator. - -# If this value is left empty, such mail will be saved in /var/mail/mail, which is not -# recommended. - -# Note that postmaster\'s mail should be read on the system to which it is directed, -# rather than being forwarded elsewhere, so (at least one of) the users listed here -# should not redirect their mail off this machine. A 'real-' prefix can be used to -# force local delivery. - -# Multiple user names need to be separated by spaces. - -# Root and postmaster mail recipient: -exim4-config exim4/dc_postmaster string $postmaster - - - -# Exim is able to store locally delivered email in different formats. The most commonly -# used ones are mbox and Maildir. mbox uses a single file for the complete mail folder -# stored in /var/mail/. With Maildir format every single message is stored in a -# separate file in ~/Maildir/. - -# Please note that most mail tools in Debian expect the local delivery method to be -# mbox in their default. - -# 1. mbox format in /var/mail/ 2. Maildir format in home directory - -# Delivery method for local mail: 2 -exim4-config exim4/dc_localdelivery select Maildir format in home directory -EOF - # MAIN_HARDCODE_PRIMARY_HOSTNAME might mess up the - # smarthost config type, not sure. all other settings - # would be unused in that config type. - cat >$exim_main_dir/000_localmacros </etc/exim4/conf.d/main/000_local </etc/exim4/conf.d/rcpt_local_acl <<'EOF' +# Only hosts we control send to @mail.iankelling.org, so make sure +# they are all authed. +# Note, if we wanted authed senders for all domains, +# we could make this condition in acl_check_mail +deny + message = ian trusted domain recepient but no auth + !authenticated = * + domains = mail.iankelling.org +EOF +rm -fv /etc/exim4/data_local_acl # old path +cat >/etc/exim4/conf.d/data_local_acl <<'EOF' +# Except for the "condition =", this was +# a comment in the check_data acl. The comment about this not +# being suitable is mostly bs. The only thing related I found was to +# add the condition =, cuz spamassassin has problems with big +# messages and spammers don't bother with big messages, +# but I've increased the size from 10k +# suggested in official docs, and 100k in the wiki example because +# those docs are rather old and I see a 110k spam message +# pretty quickly looking through my spam folder. +warn + condition = ${if < {$message_size}{2000K}} + spam = Debian-exim:true + add_header = X-Spam_score: $spam_score\n\ + X-Spam_score_int: $spam_score_int\n\ + X-Spam_bar: $spam_bar\n\ + X-Spam_report: $spam_report + +#accept +# spf = pass:fail:softfail:none:neutral:permerror:temperror +# dmarc_status = reject:quarantine +# add_header = Reply-to: dmarctest@iankelling.org + +EOF +cat >/etc/exim4/conf.d/auth/29_exim4-config_auth <<'EOF' +# from 30_exim4-config_examples + +plain_server: +driver = plaintext +public_name = PLAIN +server_condition = "${if crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}" +server_set_id = $auth2 +server_prompts = : +.ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS +server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}} +.endif +EOF + +cat >/etc/exim4/conf.d/router/900_exim4-config_local_user <<'EOF' +### router/900_exim4-config_local_user +################################# + +# This router matches local user mailboxes. If the router fails, the error +# message is "Unknown user". + +local_user: + debug_print = "R: local_user for $local_part@$domain" + driver = accept + domains = +local_domains +# ian: commented this, in conjunction with a dovecot lmtp +# change so I get mail for all users. +# check_local_user + local_parts = ! root + transport = LOCAL_DELIVERY + cannot_route_message = Unknown user +EOF +cat >/etc/exim4/conf.d/transport/30_exim4-config_dovecot_lmtp <<'EOF' +dovecot_lmtp: + driver = lmtp + socket = /var/run/dovecot/lmtp + #maximum number of deliveries per batch, default 1 + batch_max = 200 +EOF +cat >/etc/exim4/host_local_deny_exceptions <<'EOF' +mail.fsf.org +*.posteo.de EOF +cat >/etc/exim4/conf.d/router/190_exim4-config_fsfsmarthost <<'EOF' +# smarthost for fsf mail +# ian: copied from /etc/exim4/conf.d/router/200_exim4-config_primary, and added senders = and +# replaced DCsmarthost with mail.fsf.org +fsfsmarthost: + debug_print = "R: smarthost for $local_part@$domain" + driver = manualroute + domains = ! +local_domains + senders = *@fsf.org + transport = remote_smtp_smarthost + route_list = * mail.fsf.org byname + host_find_failed = ignore + same_domain_copy_routing = yes + no_more +EOF - ####### begin dovecot setup ######## - # based on a little google and package search, just the dovecot - # packages we need instead of dovecot-common. - # - # dovecot-lmtpd is for exim to deliver to dovecot instead of maildir - # directly. The reason to do this is to use dovecot\'s sieve, which - # has extensions that allow it to be almost equivalent to exim\'s - # filter capabilities, some ways probably better, some worse, and - # sieve has the benefit of being supported in postfix and - # proprietary/weird environments, so there is more examples on the - # internet. I was torn about whether to do this or not, meh. - apt-get -y install --purge --auto-remove \ - dovecot-core dovecot-imapd dovecot-sieve dovecot-lmtpd - # if we changed 90-sieve.conf and removed the active part of the - # sieve option, we wouldn\'t need this, but I\'d rather not modify a - # default config if not needed. This won\'t work as a symlink in /a/c - # unfortunately. - sudo -u $postmaster /a/exe/lnf -T sieve/main.sieve $(eval echo ~$postmaster)/.dovecot.sieve +cat >/etc/exim4/update-exim4.conf.conf <<'EOF' +# default stuff, i havent checked if its needed +dc_minimaldns='false' +dc_relay_nets='' +CFILEMODE='644' +dc_use_split_config='true' +dc_local_interfaces='' +dc_mailname_in_oh='true' +EOF - sed -ri -f - /etc/dovecot/conf.d/10-mail.conf <<'EOF' -1i mail_location = maildir:/m/md:LAYOUT=fs:INBOX=/m/md/INBOX +# * if MAIL_HOST +if [[ $HOSTNAME == "$MAIL_HOST" ]]; then + # ** dovecot + ####### begin dovecot setup ######## + # based on a little google and package search, just the dovecot + # packages we need instead of dovecot-common. + # + # dovecot-lmtpd is for exim to deliver to dovecot instead of maildir + # directly. The reason to do this is to use dovecot\'s sieve, which + # has extensions that allow it to be almost equivalent to exim\'s + # filter capabilities, some ways probably better, some worse, and + # sieve has the benefit of being supported in postfix and + # proprietary/weird environments, so there is more examples on the + # internet. I was torn about whether to do this or not, meh. + pi dovecot-core dovecot-imapd dovecot-sieve dovecot-lmtpd + + for f in /p/c/subdir_files/sieve/*sieve /a/c/subdir_files/sieve/*sieve; do + m sudo -u $u /a/exe/lnf -T $f $uhome/sieve/${f##*/} + done + # if we changed 90-sieve.conf and removed the active part of the + # sieve option, we wouldn\'t need this, but I\'d rather not modify a + # default config if not needed. This won\'t work as a symlink in /a/c + # unfortunately. + m sudo -u $u /a/exe/lnf -T sieve/main.sieve $uhome/.dovecot.sieve + + # we set this later in local.conf + sed -ri -f - /etc/dovecot/conf.d/10-mail.conf <<'EOF' /^\s*mail_location\s*=/d EOF - cat >/etc/dovecot/conf.d/20-lmtp.conf </etc/dovecot/conf.d/20-lmtp.conf </etc/dovecot/local.conf <<'EOF' + cat >/etc/dovecot/local.conf </dev/null ||: - systemctl stop offlineimapsync.timer &>/dev/null ||: - systemctl disable $vpn_ser@mail - systemctl stop $vpn_ser@mail - systemctl disable dovecot ||: - systemctl stop dovecot ||: - # - # - # would only exist because I wrote it i the previous condition, - # it\'s not part of exim - rm -f $exim_main_dir/000_localmacros - debconf-set-selections </dev/null; then - # gotta remove this, otherwise the set-selections are completely - # ignored. It woulda been nice if this was documented somewhere! - rm -f /etc/exim4/update-exim4.conf.conf - dpkg-reconfigure -u -fnoninteractive exim4-config - fi + ####### end dovecot setup ######## - # i have the spool directory be common to distro multi-boot, so - # we need the uid to be the same. 608 cuz it's kind of in the middle - # of the free system uids. - IFS=:; read _ _ uid _ < <(getent passwd Debian-exim ); unset IFS - IFS=:; read _ _ gid _ < <(getent group Debian-exim ); unset IFS - if [[ ! $uid ]]; then - # from /var/lib/dpkg/info/exim4-base.postinst, plus uid and gid options - adduser --uid 608 --gid 608 --system --group --quiet --home /var/spool/exim4 \ - --no-create-home --disabled-login --force-badname Debian-exim - elif [[ $uid != 608 ]]; then - systemctl stop exim4 ||: - usermod -u 608 Debian-exim - groupmod -g 608 Debian-exim - usermod -g 608 Debian-exim - find / /nocow -xdev -uid $uid -exec chown -h 608 {} + - find / /nocow -xdev -gid $gid -exec chgrp -h 608 {} + - fi + # ** exim - # light version of exim does not have sasl auth support. - apt-get -y install --purge --auto-remove exim4-daemon-heavy spamassassin + # mail.iankelling.org so local imap clients can connect with tls and + # when they happen to not be local. + sed -ri -f - /etc/hosts <<'EOF' +/^127\.0\.1\.1.* mail\.iankelling\.org\b/{p;d} +/^127\.0\.1\.1 /s/ *$/ mail.iankelling.org/ +EOF + /a/exe/cedit mail /etc/dnsmasq-servers.conf <<'EOF' || [[ $? == 1 ]] +server=/mail.iankelling.org/127.0.1.1 +EOF + if systemctl is-active dnsmasq >/dev/null; then + m systemctl reload dnsmasq + fi + # I used to use debconf-set-selections + dpkg-reconfigure, + # which then updates this file + # but the process is slower than updating it directly and then I want to set other things in + # update-exim4.conf.conf, so there's no point. + # The file is documented in man update-exim4.conf, + # except the man page is not perfect, read the bash script to be sure about things. + # The debconf questions output is additional documentation that is not + # easily accessible, but super long, along with the initial default comment in this + # file, so I've saved that into ./mail-notes.conf. + cat >>/etc/exim4/update-exim4.conf.conf <>/etc/default/spamassassin - # just noticed this in the config file, seems like a good idea. - sed -i '/^\s*NICE\s*=/d' /etc/default/spamassassin - e 'NICE="--nicelevel 15"' >>/etc/default/spamassassin - systemctl start spamassassin - systemctl reload spamassassin +dc_eximconfig_configtype='internet' - cat >/etc/systemd/system/spamddnsfix.service <<'EOF' -[Unit] -Description=spamd dns bug fix cronjob +# man page: is used to build the local_domains list, together with “localhost” +# iank.bid is for testing +# mail.iankelling.org is for machines i own +dc_other_hostnames='*.iankelling.org;iankelling.org;*iank.bid;iank.bid;*zroe.org;zroe.org;*.b8.nz;b8.nz' -[Service] -Type=oneshot -ExecStart=/a/bin/distro-setup/spamd-dns-fix +# from man page: +# Is a list of domains for which we accept mail from anywhere on the Internet but which are not delivered locally, e.g. +# because this machine serves as secondary MX for these domains. Sets MAIN_RELAY_TO_DOMAINS. +# todo: we should not accept from anywhere, only the mx for fsf. +dc_relay_domains='*.fsf.org;fsf.org' EOF - # 2017-09, debian closed the bug on this saying upstream had fixed it. - # remove this when i\'m using the newer package, ie, debian 10, or maybe - # ubuntu 18.04. - cat >/etc/systemd/system/spamddnsfix.timer <<'EOF' -[Unit] -Description=run spamd bug fix script every 10 minutes -[Timer] -OnActiveSec=60 -# the script looks back 9 minutes into the journal, -# it takes a second to run, -# so lets run every 9 minutes and 10 seconds. -OnUnitActiveSec=550 -[Install] -WantedBy=timers.target -EOF - systemctl daemon-reload - systemctl restart spamddnsfix.timer - systemctl enable spamddnsfix.timer - # - ##### end spamassassin config + # the debconf output about mailname is as follows: + # The 'mail name' is the domain name used to 'qualify' mail addresses without a domain + # name. + # This name will also be used by other programs. It should be the single, fully + # qualified domain name (FQDN). + # Thus, if a mail address on the local host is foo@example.org, the correct value for + # this option would be example.org. + # This name won\'t appear on From: lines of outgoing messages if rewriting is enabled. + echo mail.iankelling.org > /etc/mailname + # MAIN_HARDCODE_PRIMARY_HOSTNAME might mess up the + # smarthost config type, not sure. all other settings + # would be unused in that config type. + cat >>/etc/exim4/conf.d/main/000_local </etc/exim4/rcpt_local_acl <<'EOF' -# Only hosts we control send to mail.iankelling.org, so make sure -# they are all authed. -# Note, if we wanted authed senders for all domains, -# we could make this condition in acl_check_mail -deny - message = ian trusted domain recepient but no auth - !authenticated = * - domains = mail.iankelling.org +# The file is based on the outgoing domain-name in the from-header. +DKIM_DOMAIN = \${lc:\${domain:\$h_from:}} +# sign if key exists +DKIM_PRIVATE_KEY= \${if exists{/etc/exim4/\${dkim_domain}-private.pem} {/etc/exim4/\${dkim_domain}-private.pem}} + + +# failing message on mail-tester.com: +# We check if there is a server (A Record) behind your hostname kd. +# You may want to publish a DNS record (A type) for the hostname kd or use a different hostname in your mail software +# https://serverfault.com/questions/46545/how-do-i-change-exim4s-primary-hostname-on-a-debian-box +# and this one seemed appropriate from grepping config. +# I originally set this to li.iankelling.org, but then ended up with errors when li tried to send +# mail to kd, so this should basically be a name that no host has as their +# canonical hostname since the actual host sits behind a nat and changes. +# Seems logical for this to be the same as mailname. +MAIN_HARDCODE_PRIMARY_HOSTNAME = mail.iankelling.org + +LOCAL_DELIVERY = dovecot_lmtp + +# options exim has to avoid having to alter the default config files +CHECK_RCPT_LOCAL_ACL_FILE = /etc/exim4/conf.d/rcpt_local_acl +CHECK_DATA_LOCAL_ACL_FILE = /etc/exim4/conf.d/data_local_acl + +# most of the ones that gmail seems to use. +# Exim has horrible default of signing unincluded +# list- headers since they got mentioned in an +# rfc, but this messes up mailing lists, like gnu/debian which want to +# keep your dkim signature intact but add list- headers. +DKIM_SIGN_HEADERS = mime-version:in-reply-to:references:from:date:subject:to + +# recommended if dns is expected to work +CHECK_RCPT_VERIFY_SENDER = true +# seems like a good idea +CHECK_DATA_VERIFY_HEADER_SENDER = true +CHECK_RCPT_SPF = true +CHECK_RCPT_REVERSE_DNS = true +CHECK_MAIL_HELO_ISSUED = true + +# testing dmarc +#dmarc_tld_file = /etc/public_suffix_list.dat EOF - cat >/etc/exim4/data_local_acl <<'EOF' -# Except for the "condition =", this was -# a comment in the check_data acl. The comment about this not -# being suitable is mostly bs. The only thing related I found was to -# add the condition =, cuz spamassassin has problems with big -# messages and spammers don't bother with big messages, -# but I've increased the size from 10k -# suggested in official docs, and 100k in the wiki example because -# those docs are rather old and I see a 110k spam message -# pretty quickly looking through my spam folder. - warn - condition = ${if < {$message_size}{2000K}} - spam = Debian-exim:true - add_header = X-Spam_score: $spam_score\n\ - X-Spam_score_int: $spam_score_int\n\ - X-Spam_bar: $spam_bar\n\ - X-Spam_report: $spam_report + f=/etc/cron.daily/refresh-dmarc-tld-file + cat >$f <<'EOF' +#!/bin/bash +cd /etc +wget -q -N https://publicsuffix.org/list/public_suffix_list.dat EOF - cat >/etc/exim4/conf.d/auth/29_exim4-config_auth <<'EOF' -# from 30_exim4-config_examples + m chmod 755 $f -plain_server: -driver = plaintext -public_name = PLAIN -server_condition = "${if crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}" -server_set_id = $auth2 -server_prompts = : -.ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS -server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}} -.endif + sed -i --follow-symlinks -f - /etc/aliases </etc/exim4/conf.d/router/900_exim4-config_local_user <<'EOF' -### router/900_exim4-config_local_user -################################# -# This router matches local user mailboxes. If the router fails, the error -# message is "Unknown user". + # https://selivan.github.io/2017/12/30/systemd-serice-always-restart.html + d=/etc/systemd/system/openvpn@mail.service.d + m mkdir -p $d + cat >$d/override.conf <<'EOF' +[Service] +Restart=always +# time to sleep before restarting a service +RestartSec=1 -local_user: - debug_print = "R: local_user for $local_part@$domain" - driver = accept - domains = +local_domains -# ian: commented this, in conjunction with a dovecot lmtp -# change so I get mail for all users. -# check_local_user - local_parts = ! root - transport = LOCAL_DELIVERY - cannot_route_message = Unknown user +[Unit] +# StartLimitIntervalSec in recent systemd versions +StartLimitInterval=0 EOF - cat >/etc/exim4/conf.d/transport/30_exim4-config_dovecot_lmtp <<'EOF' -dovecot_lmtp: - driver = lmtp - socket = /var/run/dovecot/lmtp - #maximum number of deliveries per batch, default 1 - batch_max = 200 + if ! systemctl cat openvpn@mail.service|grep -xF StartLimitInterval=0 &>/dev/null; then + # needed for the above config to go into effect + m systemctl daemon-reexec + fi + + + m systemctl enable mailclean.timer + m systemctl start mailclean.timer + m systemctl restart $vpn_ser@mail + m systemctl enable $vpn_ser@mail + m systemctl enable dovecot + m systemctl restart dovecot + + # * not MAIL_HOST +else # $HOSTNAME != $MAIL_HOST + # remove mail. 2 lines to properly remove whitespace + sed -ri -f - /etc/hosts <<'EOF' +s#^(127\.0\.1\.1 .*) +mail\.iankelling\.org$#\1# +s#^(127\.0\.1\.1 .*)mail\.iankelling\.org +(.*)#\1\2# EOF + echo | /a/exe/cedit mail /etc/dnsmasq-servers.conf || [[ $? == 1 ]] + if systemctl is-active dnsmasq >/dev/null; then + m systemctl reload dnsmasq + fi + + m systemctl disable mailclean.timer &>/dev/null ||: + m systemctl stop mailclean.timer &>/dev/null ||: + m systemctl disable $vpn_ser@mail + m systemctl stop $vpn_ser@mail + m systemctl disable dovecot ||: + m systemctl stop dovecot ||: + # + # + # would only exist because I wrote it i the previous condition, + # it\'s not part of exim + rm -fv /etc/exim4/conf.d/main/000_localmacros + cat >>/etc/exim4/update-exim4.conf.conf <>$f - done - # end setup passwd.client - - # https://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost - # i only need .forwards, so just doing that one. - cd /etc/exim4/conf.d/router - b=userforward_higher_priority - # replace the router name so it is unique - sed -r s/^\\S+:/$b:/ 600_exim4-config_userforward >175_$b - systemctl restart exim4 - -fi #### end if exim4 - -# /etc/alias setup is debian specific, and -# exim config sets up an /etc/alias from root to the postmaster, which i -# config to ian, as long as there exists an entry for root, or there was -# no preexisting aliases file. based on the postinst file. postfix -# won\'t set up a root to $postmaster alias if it\'s already installed. -# Since postfix is not the greatest, just set it ourselves. -if [[ $postmaster != root ]]; then - sed -i --follow-symlinks -f - /etc/aliases </etc/mailname + + # This ends up at alerts mailbox on MAIL_HOST, but using a user that doesn't exist elsewhere + # is no good. + sed -i --follow-symlinks -f - /etc/aliases <>/etc/fstab + fi + if ! mountpoint -q $sdir; then + m systemctl stop exim4 + if [[ -L $sdir ]]; then + m rm $sdir + fi if [[ ! -e $dir && -d $sdir ]]; then - mv $sdir $dir + m mv $sdir $dir fi - /a/exe/lnf -T $dir $sdir + if [[ ! -d $sdir ]]; then + m mkdir $sdir + m chmod 000 $sdir # only want it to be used when its mounted + fi + m mount $sdir + fi +fi + + + +# ** exim/spool uid setup +# i have the spool directory be common to distro multi-boot, so +# we need the uid to be the same. 608 cuz it's kind of in the middle +# of the free system uids. +IFS=:; read _ _ uid _ < <(getent passwd Debian-exim ||:) ||:; unset IFS +IFS=:; read _ _ gid _ < <(getent group Debian-exim ||:) ||:; unset IFS +if [[ ! $uid ]]; then + # from /var/lib/dpkg/info/exim4-base.postinst, plus uid and gid options + m adduser --uid 608 --system --group --quiet --home /var/spool/exim4 \ + --no-create-home --disabled-login --force-badname Debian-exim +elif [[ $uid != 608 ]]; then + m systemctl stop exim4 ||: + m usermod -u 608 Debian-exim + m groupmod -g 608 Debian-exim + m usermod -g 608 Debian-exim + m find / /nocow -xdev -uid $uid -exec chown -h 608 {} + + m find / /nocow -xdev -gid $gid -exec chgrp -h 608 {} + fi -systemctl restart $type -systemctl enable $type + + + +# * reload exim + +if systemctl is-active exim4 >/dev/null; then + m systemctl reload exim4 +else + m systemctl start exim4 +fi + + +# * mail monitoring / testing +if [[ $HOSTNAME == "$MAIL_HOST" ]]; then + f=/usr/local/bin/send-test-forward + cat >$f <<'EOFOUTER' +#!/bin/bash +/usr/sbin/exim -t </etc/cron.d/mailtest <&1 | /usr/local/bin/log-once send-test-forward +*/10 * * * * $u /usr/local/bin/mailtest-check 2>&1 | /usr/local/bin/log-once -1 mailtest-check +*/10 * * * * root chmod -R g+rw /m/md/bounces 2>&1 | /usr/local/bin/log-once -1 bounces-chmod +EOF + m cp /a/bin/distro-setup/filesystem/usr/local/bin/mailtest-check /usr/local/bin +else + rm -fv /etc/cron.d/mailtest +fi + + +# * Radicale # MAIL_HOST also does radicale, and easier to start and stop it here # for when MAIL_HOST changes, so radicale gets the synced files and # does not stop us from remounting /o. if dpkg -s radicale &>/dev/null; then - if [[ $HOSTNAME == $MAIL_HOST ]]; then - systemctl restart radicale - systemctl enable radicale - if [[ -e /etc/logrotate.d/radicale.disabled ]]; then - mv /etc/logrotate.d/radicale{.disabled,} - fi - else - systemctl stop radicale - systemctl disable radicale - # weekly logrotate tries to restart radicale even if it's a disabled service in flidas. - if [[ -e /etc/logrotate.d/radicale ]]; then - mv /etc/logrotate.d/radicale{,.disabled} - fi + if [[ $HOSTNAME == "$MAIL_HOST" ]]; then + m systemctl restart radicale + m systemctl enable radicale + if [[ -e /etc/logrotate.d/radicale.disabled ]]; then + m mv /etc/logrotate.d/radicale{.disabled,} + fi + else + m systemctl stop radicale + m systemctl disable radicale + # weekly logrotate tries to restart radicale even if it's a disabled service in flidas. + if [[ -e /etc/logrotate.d/radicale ]]; then + m mv /etc/logrotate.d/radicale{,.disabled} fi + fi fi -exit 0 -# if I wanted the from address to be renamed and sent to a different address, -# echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical -# sudo postmap hash:/etc/postfix/recipient_canonical -# sudo service postfix reload +# * misc +m sudo -u $u ln -sf -T /m/.mu /home/$u/.mu + + +# /etc/alias setup is debian specific, and exim postinst script sets up +# an /etc/alias from root to the postmaster, based on the question +# exim4-config exim4/dc_postmaster, as long as there exists an entry for +# root, or there was no preexisting aliases file. postfix won\'t set up +# a root to $postmaster alias if it\'s already installed. Easiest to +# just set it ourselves. + +# debconf question for postmaster: +# Mail for the 'postmaster', 'root', and other system accounts needs to be redirected +# to the user account of the actual system administrator. +# If this value is left empty, such mail will be saved in /var/mail/mail, which is not +# recommended. +# Note that postmaster\'s mail should be read on the system to which it is directed, +# rather than being forwarded elsewhere, so (at least one of) the users listed here +# should not redirect their mail off this machine. A 'real-' prefix can be used to +# force local delivery. +# Multiple user names need to be separated by spaces. +# Root and postmaster mail recipient: + + +exit 0 +: