X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=blobdiff_plain;f=mail-setup;h=fdb4c219d4eb2b9154c500c93fe6d751fe962113;hp=33ad75a0b3af2719e63ecd3328f77070c0227605;hb=f7a2fe0e56e14b55818245a2e3a2eb68f1cd23de;hpb=1ad20724a44a0ee3adc2f4a1d002850fbad7a372 diff --git a/mail-setup b/mail-setup index 33ad75a..fdb4c21 100755 --- a/mail-setup +++ b/mail-setup @@ -1,4 +1,6 @@ #!/bin/bash +set -x + # Copyright (C) 2016 Ian Kelling # Licensed under the Apache License, Version 2.0 (the "License"); @@ -25,6 +27,13 @@ Setup exim4 / postfix / dovecot The minimal assumption we have is that /etc/mailpass exists + +I\'ve had problems with postfix on debian: +on stretch, a startup ordering issue caused all mail to fail. +postfix changed defaults to only use ipv6 dns, causing all my mail to fail. +I haven\'t gotten around to getting a non-debian exim +setup. + -h|--help Print help and exit. EOF exit $1 @@ -38,6 +47,10 @@ if ! exim && ! postfix; then usage 1 fi +if [[ ! $SUDO_USER ]]; then + echo "$0: error: requires running as nonroot or sudo" +fi +u=$SUDO_USER ####### begin perstent password instructions ###### @@ -51,7 +64,7 @@ fi # apg -m 50 -x 70 -n 1 -a 1 -M CLN >$f # s sed -i "/^$user:/d" /p/c/filesystem/etc/exim4/passwd # echo "$user:$(mkpasswd -m sha-512 -s <$f)" >>/p/c/filesystem/etc/exim4/passwd -# echo "mail.iankelling.org:$user:$(<$f)" >> /p/c/machine_specific/$user/filesystem/etc/mailpass +# echo "mail.iankelling.org $user $(<$f)" >> /p/c/machine_specific/$user/filesystem/etc/mailpass # # then run this script, or part of it which uses /etc/mailpass # # dovecot password, i just need 1 as I\'m the only user @@ -101,12 +114,17 @@ fi # # via the mail-setup scripts # # 2017-02 dmarc policies: +# # host -t txt _dmarc.gmail.com # # yahoo: p=reject, hotmail: p=none, gmail: p=none, fastmail none for legacy reasons -# # gmail will be changing to p=reject, which is expected to cause problems +# # there were articles claiming gmail would be changing +# # to p=reject, in early 2017, which didn\'t happen. I see no sources on them. It\'s +# # expected to cause problems # # with a few old mailing lists, copying theirs for now. +# # echo "dmarc dns, name: _dmarc value: v=DMARC1; p=none; rua=mailto:mailauth-reports@$domain" # # 2017-02 spf policies: +# # host -t txt lists.fedoraproject.org # # google ~all, hotmail -all, yahoo: ?all, fastmail ?all # # i include fastmail\'s settings, per their instructions, # # and follow their policy. In mail in a box, or similar instructions, @@ -144,6 +162,8 @@ fi # The full list of option settings for any particular driver instance, # including all the defaulted values, can be extracted by making use of # the -bP command line option. +# exim -bP config_file to see what config file it used +# exim -bP config to see # exim clear out message queue. as root: # adapted from somewhere on stackoverflow. @@ -154,7 +174,7 @@ fi # New one is smtp.fastmail.com # test delivery & rewrite settings: -#exim4 -bt ian@localhost +#exim4 -bt iank@localhost postconfin() { @@ -165,10 +185,10 @@ postconfin() { } e() { printf "%s\n" "$*"; } -postmaster=ian +postmaster=$u mxhost=mail.iankelling.org mxport=25 -forward=ian@$mxhost +forward=$u@$mxhost # old setup. left as comment for example # mxhost=mail.messagingengine.com @@ -178,7 +198,11 @@ forward=ian@$mxhost relayhost="[$mxhost]:$mxport" # postfix smarthost="$mxhost::$mxport" # exim - +# trisquel 8 = openvpn, debian stretch = openvpn-client +vpn_ser=openvpn-client +if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then + vpn_ser=openvpn +fi if [[ $HOSTNAME == $MAIL_HOST ]]; then # afaik, these will get ignored because they are routing to my own @@ -239,7 +263,7 @@ smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt inet_protocols = ipv4 EOF # msg_size_limit: I ran into a log file not sending cuz of size. double from 10 to 20 meg limit - # inet_protocols: without this, I've had postfix try an ipv6 lookup then gives + # inet_protocols: without this, I\'ve had postfix try an ipv6 lookup then gives # up and fail forever. snippet from syslog: type=AAAA: Host not found, try again @@ -259,18 +283,24 @@ EOF else # begin exim. has debian specific stuff for now + if ! dpkg -s openvpn &>/dev/null; then + apt-get -y install --purge --auto-remove openvpn + fi + if [[ -e /p/c/filesystem ]]; then - /a/exe/vpn-mk-client-cert -n mail li + # to put the hostname in the known hosts + ssh -o StrictHostKeyChecking=no root@li.iankelling.org : + /a/exe/vpn-mk-client-cert -b mail -n mail li.iankelling.org fi - cat >/etc/systemd/system/mailroute.service <<'EOF' + cat >/etc/systemd/system/mailroute.service </etc/systemd/system/offlineimapsync.timer <<'EOF' @@ -293,13 +323,13 @@ OnCalendar=*:0/5 WantedBy=timers.target EOF - cat >/etc/systemd/system/offlineimapsync.service <<'EOF' + cat >/etc/systemd/system/offlineimapsync.service <$f <<'EOF' +set -eE -o pipefail +trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR + +[[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@" + +f=/a/bin/bash_unpublished/source-semi-priv +if [[ -e $f ]]; then + source $f +fi +if [[ $HOSTNAME == $MAIL_HOST ]]; then + local_mx=mail.iankelling.org + rsync_common="rsync -ogtL --chown=root:Debian-exim --chmod=640 root@li:/etc/letsencrypt/live/$local_mx/" + ${rsync_common}fullchain.pem /etc/exim4/exim.crt + ${rsync_common}privkey.pem /etc/exim4/exim.key +fi +EOF + chmod 755 $f + + cat >/etc/systemd/system/mailcert.service <<'EOF' +[Unit] +Description=Mail cert rsync +After=multi-user.target + +[Service] +Type=oneshot +ExecStart=/a/bin/log-quiet/sysd-mail-once mailcert /usr/local/bin/mail-cert-cron +EOF + + cat >/etc/systemd/system/mailcert.timer <<'EOF' +[Unit] +Description=Run mail-cert once a day + +[Timer] +OnCalendar=daily + +[Install] +WantedBy=timers.target +EOF + systemctl daemon-reload + systemctl start mailcert + systemctl restart mailcert.timer + systemctl enable mailcert.timer + + ##### end mailcert setup ##### + + + if [[ $HOSTNAME == $MAIL_HOST ]]; then debconf-set-selections <$exim_main_dir/000_localmacros <<'EOF' + cat >$exim_main_dir/000_localmacros </dev/null ||: - systemctl stop offlineimapsync.timer &>/dev/null ||: - systemctl disable openvpn-client@mail - systemctl stop openvpn-client@mail - # - # - # would only exist because I wrote it i the previous condition, - # it\'s not part of exim - rm -f $exim_main_dir/000_localmacros - debconf-set-selections </dev/null; then - # gotta remove this, otherwise the set-selections are completely - # ignored. It woulda been nice if this was documented somewhere! - rm -f /etc/exim4/update-exim4.conf.conf - dpkg-reconfigure -u -fnoninteractive exim4-config - fi - # light version of exim does not have sasl auth support. - apt-get -y install --purge --auto-remove exim4-daemon-heavy spamassassin - - - - - ##### begin spamassassin config - systemctl enable spamassassin - # per readme.debian - sed -i '/^\s*CRON\s*=/d' /etc/default/spamassassin - e CRON=1 >>/etc/default/spamassassin - # just noticed this in the config file, seems like a good idea. - sed -i '/^\s*NICE\s*=/d' /etc/default/spamassassin - e 'NICE="--nicelevel 15"' >>/etc/default/spamassassin - systemctl start spamassassin - systemctl reload spamassassin - - cat >/etc/systemd/system/spamddnsfix.service <<'EOF' -[Unit] -Description=spamd dns bug fix cronjob - -[Service] -Type=oneshot -ExecStart=/a/bin/distro-setup/spamd-dns-fix -EOF - cat >/etc/systemd/system/spamddnsfix.timer <<'EOF' -[Unit] -Description=run spamd bug fix script every 10 minutes - -[Timer] -OnActiveSec=60 -# the script looks back 9 minutes into the journal, -# it takes a second to run, -# so lets run every 9 minutes and 10 seconds. -OnUnitActiveSec=550 - -[Install] -WantedBy=timers.target -EOF - systemctl daemon-reload - systemctl restart spamddnsfix.timer - systemctl enable spamddnsfix.timer - # - ##### end spamassassin config - - - f=/usr/local/bin/mail-cert-cron - cat >$f <<'EOF' -set -eE -o pipefail -trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR - -[[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@" - -f=/a/bin/bash_unpublished/source-semi-priv -if [[ -e $f ]]; then - source $f -fi -if [[ $HOSTNAME == $MAIL_HOST ]]; then - local_mx=mail.iankelling.org - rsync_common="rsync -ogtL --chown=root:Debian-exim --chmod=640 root@li:/etc/letsencrypt/live/$local_mx/" - ${rsync_common}fullchain.pem /etc/exim4/exim.crt - ${rsync_common}privkey.pem /etc/exim4/exim.key -fi -EOF - chmod 755 $f - cat >/etc/systemd/system/mailcert.service <<'EOF' -[Unit] -Description=Mail cert rsync -After=multi-user.target - -[Service] -Type=oneshot -ExecStart=/a/bin/log-quiet/sysd-mail-once mailcert /usr/local/bin/mail-cert-cron -EOF +# debian exim config added this in 2016 or so? +# it's part of the smtp spec, to limit lines to 998 chars +# but a fair amount of legit mail does not adhere to it. I don't think +# this should be default, like it says in +# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=828801 +# todo: the bug for introducing this was about headers, but +# the fix maybe is for all lines? one says gmail rejects, the +# other says gmail does not reject. figure out and open a new bug. +IGNORE_SMTP_LINE_LENGTH_LIMIT = true + +# most of the ones that gmail seems to use. +# Exim has horrible default of signing unincluded +# list- headers since they got mentioned in an +# rfc, but this messes up mailing lists, like gnu/debian which want to +# keep your dkim signature intact but add list- headers. +DKIM_SIGN_HEADERS = mime-version:in-reply-to:references:from:date:subject:to - cat >/etc/systemd/system/mailcert.timer <<'EOF' -[Unit] -Description=Run mail-cert once a day - -[Timer] -OnCalendar=daily - -[Install] -WantedBy=timers.target EOF - systemctl daemon-reload - systemctl start mailcert - systemctl restart mailcert.timer - systemctl enable mailcert.timer - ####### begin dovecot setup ######## - if [[ $HOSTNAME == $MAIL_HOST ]]; then + ####### begin dovecot setup ######## # based on a little google and package search, just the dovecot # packages we need instead of dovecot-common. # @@ -622,19 +612,19 @@ EOF # sieve option, we wouldn\'t need this, but I\'d rather not modify a # default config if not needed. This won\'t work as a symlink in /a/c # unfortunately. - sudo -u $postmaster /a/exe/lnf -T sieve/main.sieve ~$postmaster/.dovecot.sieve + sudo -u $postmaster /a/exe/lnf -T sieve/main.sieve $(eval echo ~$postmaster)/.dovecot.sieve sed -ri -f - /etc/dovecot/conf.d/10-mail.conf <<'EOF' 1i mail_location = maildir:/m/md:LAYOUT=fs:INBOX=/m/md/INBOX /^\s*mail_location\s*=/d EOF - cat >/etc/dovecot/conf.d/20-lmtp.conf <<'EOF' + cat >/etc/dovecot/conf.d/20-lmtp.conf </dev/null ||: + systemctl stop offlineimapsync.timer &>/dev/null ||: + systemctl disable $vpn_ser@mail + systemctl stop $vpn_ser@mail + systemctl disable dovecot ||: + systemctl stop dovecot ||: + # + # + # would only exist because I wrote it i the previous condition, + # it\'s not part of exim + rm -f $exim_main_dir/000_localmacros + debconf-set-selections </dev/null; then + # gotta remove this, otherwise the set-selections are completely + # ignored. It woulda been nice if this was documented somewhere! + rm -f /etc/exim4/update-exim4.conf.conf + dpkg-reconfigure -u -fnoninteractive exim4-config + fi + + # i have the spool directory be common to distro multi-boot, so + # we need the uid to be the same. 608 cuz it's kind of in the middle + # of the free system uids. + IFS=:; read _ _ uid _ < <(getent passwd Debian-exim ); unset IFS + IFS=:; read _ _ gid _ < <(getent group Debian-exim ); unset IFS + if [[ ! $uid ]]; then + # from /var/lib/dpkg/info/exim4-base.postinst, plus uid and gid options + adduser --uid 608 --gid 608 --system --group --quiet --home /var/spool/exim4 \ + --no-create-home --disabled-login --force-badname Debian-exim + elif [[ $uid != 608 ]]; then + systemctl stop exim4 ||: + usermod -u 608 Debian-exim + groupmod -g 608 Debian-exim + usermod -g 608 Debian-exim + find / /nocow -xdev -uid $uid -exec chown -h 608 {} + + find / /nocow -xdev -gid $gid -exec chgrp -h 608 {} + + fi + + # light version of exim does not have sasl auth support. + apt-get -y install --purge --auto-remove exim4-daemon-heavy spamassassin + + + + + ##### begin spamassassin config + systemctl enable spamassassin + # per readme.debian + sed -i '/^\s*CRON\s*=/d' /etc/default/spamassassin + e CRON=1 >>/etc/default/spamassassin + # just noticed this in the config file, seems like a good idea. + sed -i '/^\s*NICE\s*=/d' /etc/default/spamassassin + e 'NICE="--nicelevel 15"' >>/etc/default/spamassassin + systemctl start spamassassin + systemctl reload spamassassin + + cat >/etc/systemd/system/spamddnsfix.service <<'EOF' +[Unit] +Description=spamd dns bug fix cronjob + +[Service] +Type=oneshot +ExecStart=/a/bin/distro-setup/spamd-dns-fix +EOF + # 2017-09, debian closed the bug on this saying upstream had fixed it. + # remove this when i\'m using the newer package, ie, debian 10, or maybe + # ubuntu 18.04. + cat >/etc/systemd/system/spamddnsfix.timer <<'EOF' +[Unit] +Description=run spamd bug fix script every 10 minutes + +[Timer] +OnActiveSec=60 +# the script looks back 9 minutes into the journal, +# it takes a second to run, +# so lets run every 9 minutes and 10 seconds. +OnUnitActiveSec=550 + +[Install] +WantedBy=timers.target +EOF + systemctl daemon-reload + systemctl restart spamddnsfix.timer + systemctl enable spamddnsfix.timer + # + ##### end spamassassin config + + @@ -763,6 +858,28 @@ dovecot_lmtp: batch_max = 200 EOF + cat >/etc/exim4/conf.d/router/190_exim4-config_fsfsmarthost <<'EOF' +# smarthost for fsf mail +# ian: copied from /etc/exim4/conf.d/router/200_exim4-config_primary, and added senders = and +# replaced DCsmarthost with mail.fsf.org +fsfsmarthost: + debug_print = "R: smarthost for $local_part@$domain" + driver = manualroute + domains = ! +local_domains + senders = *@fsf.org + transport = remote_smtp_smarthost + route_list = * mail.fsf.org byname + host_find_failed = ignore + same_domain_copy_routing = yes + no_more +EOF + + # https://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost + # i only need .forwards, so just doing that one. + cd /etc/exim4/conf.d/router + b=userforward_higher_priority + # replace the router name so it is unique + sed -r s/^\\S+:/$b:/ 600_exim4-config_userforward >175_$b # begin setup passwd.client f=/etc/exim4/passwd.client @@ -774,21 +891,15 @@ EOF done # end setup passwd.client - # https://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost - # i only need .forwards, so just doing that one. - cd /etc/exim4/conf.d/router - b=userforward_higher_priority - # replace the router name so it is unique - sed -r s/^\\S+:/$b:/ 600_exim4-config_userforward >175_$b systemctl restart exim4 -fi # end if exim4 +fi #### end if exim4 # /etc/alias setup is debian specific, and # exim config sets up an /etc/alias from root to the postmaster, which i # config to ian, as long as there exists an entry for root, or there was # no preexisting aliases file. based on the postinst file. postfix -# won't set up a root to $postmaster alias if it's already installed. +# won\'t set up a root to $postmaster alias if it\'s already installed. # Since postfix is not the greatest, just set it ourselves. if [[ $postmaster != root ]]; then sed -i --follow-symlinks -f - /etc/aliases </dev/null; then + if [[ $HOSTNAME == $MAIL_HOST ]]; then + systemctl restart radicale + systemctl enable radicale + if [[ -e /etc/logrotate.d/radicale.disabled ]]; then + mv /etc/logrotate.d/radicale{.disabled,} + fi + else + systemctl stop radicale + systemctl disable radicale + # weekly logrotate tries to restart radicale even if it's a disabled service in flidas. + if [[ -e /etc/logrotate.d/radicale ]]; then + mv /etc/logrotate.d/radicale{,.disabled} + fi + fi +fi +exit 0 # if I wanted the from address to be renamed and sent to a different address, # echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical