X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=blobdiff_plain;f=mail-setup;h=fdb4c219d4eb2b9154c500c93fe6d751fe962113;hp=3bd6b21725ea4b1f05d91059be088f24889b4361;hb=f7a2fe0e56e14b55818245a2e3a2eb68f1cd23de;hpb=a59404493d3f4a432c6083e2657d6622a79b90ed diff --git a/mail-setup b/mail-setup index 3bd6b21..fdb4c21 100755 --- a/mail-setup +++ b/mail-setup @@ -1,4 +1,6 @@ #!/bin/bash +set -x + # Copyright (C) 2016 Ian Kelling # Licensed under the Apache License, Version 2.0 (the "License"); @@ -16,10 +18,45 @@ set -eE -o pipefail trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR +[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@" + +usage() { + cat <&2' ERR # apg -m 50 -x 70 -n 1 -a 1 -M CLN >$f # s sed -i "/^$user:/d" /p/c/filesystem/etc/exim4/passwd # echo "$user:$(mkpasswd -m sha-512 -s <$f)" >>/p/c/filesystem/etc/exim4/passwd -# echo "mail.iankelling.org:$user:$(<$f)" >> /p/c/machine_specific/$user/filesystem/etc/mailpass +# echo "mail.iankelling.org $user $(<$f)" >> /p/c/machine_specific/$user/filesystem/etc/mailpass # # then run this script, or part of it which uses /etc/mailpass -# # dovecot password, i just need 1 as I'm the only user +# # dovecot password, i just need 1 as I\'m the only user # mkdir /p/c/filesystem/etc/dovecot # echo "ian:$(doveadm pw -s ssha256)::::::" >/p/c/filesystem/etc/dovecot/users # conflink @@ -62,7 +99,7 @@ trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR # # I dun do that, so just use a static one: li # echo "txt record name: li._domainkey.$domain" # # Debadmin page does not have v=, fastmail does, and this -# # says it's recommended in 3.6.1, default is DKIM1 anyways. +# # says it\'s recommended in 3.6.1, default is DKIM1 anyways. # # https://www.ietf.org/rfc/rfc6376.txt # # Join and print all but first and last line. # # last line: swap hold & pattern, remove newlines, print. @@ -77,16 +114,21 @@ trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR # # via the mail-setup scripts # # 2017-02 dmarc policies: +# # host -t txt _dmarc.gmail.com # # yahoo: p=reject, hotmail: p=none, gmail: p=none, fastmail none for legacy reasons -# # gmail will be changing to p=reject, which is expected to cause problems +# # there were articles claiming gmail would be changing +# # to p=reject, in early 2017, which didn\'t happen. I see no sources on them. It\'s +# # expected to cause problems # # with a few old mailing lists, copying theirs for now. +# # echo "dmarc dns, name: _dmarc value: v=DMARC1; p=none; rua=mailto:mailauth-reports@$domain" # # 2017-02 spf policies: +# # host -t txt lists.fedoraproject.org # # google ~all, hotmail -all, yahoo: ?all, fastmail ?all -# # i include fastmail's settings, per their instructions, +# # i include fastmail\'s settings, per their instructions, # # and follow their policy. In mail in a box, or similar instructions, -# # I've seen recommended to not use a restrictive policy. +# # I\'ve seen recommended to not use a restrictive policy. # echo "spf dns: name is empty, value: v=spf1 a include:spf.messagingengine.com ?all" # # to check if dns has updated, you do @@ -120,6 +162,8 @@ trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR # The full list of option settings for any particular driver instance, # including all the defaulted values, can be extracted by making use of # the -bP command line option. +# exim -bP config_file to see what config file it used +# exim -bP config to see # exim clear out message queue. as root: # adapted from somewhere on stackoverflow. @@ -130,67 +174,70 @@ trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR # New one is smtp.fastmail.com # test delivery & rewrite settings: -#exim4 -bt ian@localhost - - -type=$1 -postfix() { [[ $type == postfix ]]; } -exim() { [[ $type == exim4 ]]; } -if ! exim && ! postfix; then - echo "$1: error: expected exim4 or postfix as first arg" - exit 1 +#exim4 -bt iank@localhost + + +postconfin() { + local MAPFILE + mapfile -t + local s + postconf -ev "${MAPFILE[@]}" +} +e() { printf "%s\n" "$*"; } + +postmaster=$u +mxhost=mail.iankelling.org +mxport=25 +forward=$u@$mxhost + +# old setup. left as comment for example +# mxhost=mail.messagingengine.com +# mxport=587 +# forward=ian@iankelling.org + +relayhost="[$mxhost]:$mxport" # postfix +smarthost="$mxhost::$mxport" # exim + +# trisquel 8 = openvpn, debian stretch = openvpn-client +vpn_ser=openvpn-client +if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then + vpn_ser=openvpn fi - -local_mx=mail.iankelling.org - -host=$local_mx -relayhost="[$host]:25" # postfix -smarthost="$host::25" # exim - - -# this was for when I used the exim config type -# "mail sent by smarthost; received via SMTP or fetchmail" -# if [[ $HOSTNAME == $MAIL_HOST ]]; then -# host=mail.messagingengine.com -# relayhost="[$host]:587" # postfix -# smarthost="$host::587" # exim -# fi - -forward=ian@$local_mx - - -# background: This also works instead of ~/.forward -# s sed -i --follow-symlinks '/^root/d' /etc/aliases ||: -#echo "root: $HOSTNAME@$SOME_DOMAIN" | s tee -a /etc/aliases -# this can't be a symlink and has permission restrictions -# it might work in /etc/aliases, but this seems more proper. -e $forward > ~/.forward -e $forward | s tee /root/.forward -# exim log complains about 664 permissions. -s chmod 644 ~/.forward /root/.forward - +if [[ $HOSTNAME == $MAIL_HOST ]]; then + # afaik, these will get ignored because they are routing to my own + # machine, but rm them is safer + rm -f $(eval echo ~$postmaster)/.forward /root/.forward +else + # this can\'t be a symlink and has permission restrictions + # it might work in /etc/aliases, but this seems more proper. + install -m 644 {-o,-g}$postmaster <(e $forward) $(eval echo ~$postmaster)/.forward +fi # offlineimap uses this too, it is much easier to use one location than to -# condition it's config and postfix's config -case $distro in - fedora) s lnf -T ca-certificates.crt /etc/ssl/ca-bundle.trust.crt ;; - *) : -esac +# condition it\'s config and postfix\'s config +if [[ -f /etc/fedora-release ]]; then + /a/exe/lnf -T ca-certificates.crt /etc/ssl/ca-bundle.trust.crt +fi if postfix; then # dunno why, but debian installed postfix with builddep emacs # but I will just explicitly install it here since # I use it for sending mail in emacs. - if isdeb; then - s debconf-set-selections < /dev/null; then + debconf-set-selections </dev/null; then + dpkg-reconfigure -u -fnoninteractive postfix + else + apt-get -y install --purge --auto-remove postfix + fi else + source /a/bin/distro-functions/src/package-manager-abstractions pi postfix # Settings from reading the output when installing on debian, # then seeing which were different in a default install on arch. @@ -202,10 +249,10 @@ relayhost = $relayhost inet_interfaces = loopback-only EOF - s systemctl enable postfix - s systemctl start postfix + systemctl enable postfix + systemctl start postfix fi - # i'm assuming mail just won't work on systems without the sasl_passwd. + # i\'m assuming mail just won\'t work on systems without the sasl_passwd. postconfin <<'EOF' smtp_sasl_auth_enable = yes smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd @@ -216,26 +263,78 @@ smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt inet_protocols = ipv4 EOF # msg_size_limit: I ran into a log file not sending cuz of size. double from 10 to 20 meg limit - # inet_protocols: without this, postfix tries an ipv6 lookup then gives - # up and fails. snippet from syslog: type=AAAA: Host not found, try again + # inet_protocols: without this, I\'ve had postfix try an ipv6 lookup then gives + # up and fail forever. snippet from syslog: type=AAAA: Host not found, try again f=/etc/postfix/sasl_passwd - s rm -f $f - s touch $f - s chmod 600 $f - s cat /etc/mailpass| while read -r domain port pass; do + install -m 600 /dev/null $f + cat /etc/mailpass| while read -r domain port pass; do # format: domain port user:pass # mailpass is just a name i made up, since postfix and # exim both use a slightly crazy format to translate to # each other, it\'s easier to use my own format. - printf "[%s]:%s %s" "$domain" "$port" "${pass/@/#}" | s tee -a $f >/dev/null + printf "[%s]:%s %s" "$domain" "$port" "${pass/@/#}" >>$f done - s postmap hash:/etc/postfix/sasl_passwd - s service postfix reload + postmap hash:/etc/postfix/sasl_passwd + # need restart instead of reload when changing + # inet_protocols + service postfix restart + +else # begin exim. has debian specific stuff for now + + if ! dpkg -s openvpn &>/dev/null; then + apt-get -y install --purge --auto-remove openvpn + fi + + if [[ -e /p/c/filesystem ]]; then + # to put the hostname in the known hosts + ssh -o StrictHostKeyChecking=no root@li.iankelling.org : + /a/exe/vpn-mk-client-cert -b mail -n mail li.iankelling.org + fi -else # exim. has debian specific stuff for now + cat >/etc/systemd/system/mailroute.service </etc/systemd/system/offlineimapsync.timer <<'EOF' +[Unit] +Description=Run offlineimap-sync once every 5 mins + +[Timer] +OnCalendar=*:0/5 + +[Install] +WantedBy=timers.target +EOF + + cat >/etc/systemd/system/offlineimapsync.service <$f <<'EOF' +set -eE -o pipefail +trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR + +[[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@" + +f=/a/bin/bash_unpublished/source-semi-priv +if [[ -e $f ]]; then + source $f +fi +if [[ $HOSTNAME == $MAIL_HOST ]]; then + local_mx=mail.iankelling.org + rsync_common="rsync -ogtL --chown=root:Debian-exim --chmod=640 root@li:/etc/letsencrypt/live/$local_mx/" + ${rsync_common}fullchain.pem /etc/exim4/exim.crt + ${rsync_common}privkey.pem /etc/exim4/exim.key +fi +EOF + chmod 755 $f + + cat >/etc/systemd/system/mailcert.service <<'EOF' +[Unit] +Description=Mail cert rsync +After=multi-user.target + +[Service] +Type=oneshot +ExecStart=/a/bin/log-quiet/sysd-mail-once mailcert /usr/local/bin/mail-cert-cron +EOF + + cat >/etc/systemd/system/mailcert.timer <<'EOF' +[Unit] +Description=Run mail-cert once a day + +[Timer] +OnCalendar=daily + +[Install] +WantedBy=timers.target +EOF + systemctl daemon-reload + systemctl start mailcert + systemctl restart mailcert.timer + systemctl enable mailcert.timer + + ##### end mailcert setup ##### + + + if [[ $HOSTNAME == $MAIL_HOST ]]; then - # afaik, these will get ignored, routing to my own machine, but rm - # them to make me feel better. - s rm -f ~/.forward /root/.forward - s debconf-set-selections </dev/null <<'EOF' + cat >$exim_main_dir/000_localmacros </etc/dovecot/conf.d/20-lmtp.conf </etc/dovecot/local.conf <<'EOF' +# so I can use a different login that my shell login for mail. this is +# worth doing solely for the reason that if this login is compromised, +# it won't also compromise my shell password. +!include conf.d/auth-passwdfile.conf.ext + +# settings derived from wiki and 10-ssl.conf +ssl = required +ssl_cert = /dev/null ||: - s systemctl stop offlineimapsync.timer &>/dev/null ||: + systemctl disable offlineimapsync.timer &>/dev/null ||: + systemctl stop offlineimapsync.timer &>/dev/null ||: + systemctl disable $vpn_ser@mail + systemctl stop $vpn_ser@mail + systemctl disable dovecot ||: + systemctl stop dovecot ||: # # # would only exist because I wrote it i the previous condition, - # it's not part of exim - s rm -f $exim_main_dir/000_localmacros - s debconf-set-selections </dev/null; then - s dpkg-reconfigure -u -pcritical exim4-config + if dpkg -s exim4-config &>/dev/null; then + # gotta remove this, otherwise the set-selections are completely + # ignored. It woulda been nice if this was documented somewhere! + rm -f /etc/exim4/update-exim4.conf.conf + dpkg-reconfigure -u -fnoninteractive exim4-config + fi + + # i have the spool directory be common to distro multi-boot, so + # we need the uid to be the same. 608 cuz it's kind of in the middle + # of the free system uids. + IFS=:; read _ _ uid _ < <(getent passwd Debian-exim ); unset IFS + IFS=:; read _ _ gid _ < <(getent group Debian-exim ); unset IFS + if [[ ! $uid ]]; then + # from /var/lib/dpkg/info/exim4-base.postinst, plus uid and gid options + adduser --uid 608 --gid 608 --system --group --quiet --home /var/spool/exim4 \ + --no-create-home --disabled-login --force-badname Debian-exim + elif [[ $uid != 608 ]]; then + systemctl stop exim4 ||: + usermod -u 608 Debian-exim + groupmod -g 608 Debian-exim + usermod -g 608 Debian-exim + find / /nocow -xdev -uid $uid -exec chown -h 608 {} + + find / /nocow -xdev -gid $gid -exec chgrp -h 608 {} + fi - # light version does not have sasl auth support. - pi exim4-daemon-heavy spamassassin + + # light version of exim does not have sasl auth support. + apt-get -y install --purge --auto-remove exim4-daemon-heavy spamassassin + + + ##### begin spamassassin config - ser enable spamassassin + systemctl enable spamassassin # per readme.debian - s sed -i '/^\s*CRON\s*=/d' /etc/default/spamassassin - s tee -a /etc/default/spamassassin <<>/etc/default/spamassassin # just noticed this in the config file, seems like a good idea. - s sed -i '/^\s*NICE\s*=/d' /etc/default/spamassassin - s tee -a /etc/default/spamassassin <<<'NICE="--nicelevel 15"' - ser reload spamassassin + sed -i '/^\s*NICE\s*=/d' /etc/default/spamassassin + e 'NICE="--nicelevel 15"' >>/etc/default/spamassassin + systemctl start spamassassin + systemctl reload spamassassin - s dd of=/etc/systemd/system/spamddnsfix.service <<'EOF' + cat >/etc/systemd/system/spamddnsfix.service <<'EOF' [Unit] Description=spamd dns bug fix cronjob @@ -477,127 +762,194 @@ Description=spamd dns bug fix cronjob Type=oneshot ExecStart=/a/bin/distro-setup/spamd-dns-fix EOF - s dd of=/etc/systemd/system/spamddnsfix.timer <<'EOF' + # 2017-09, debian closed the bug on this saying upstream had fixed it. + # remove this when i\'m using the newer package, ie, debian 10, or maybe + # ubuntu 18.04. + cat >/etc/systemd/system/spamddnsfix.timer <<'EOF' [Unit] Description=run spamd bug fix script every 10 minutes [Timer] +OnActiveSec=60 # the script looks back 9 minutes into the journal, # it takes a second to run, # so lets run every 9 minutes and 10 seconds. -OnUnitInactiveSec=550 +OnUnitActiveSec=550 [Install] WantedBy=timers.target EOF - ser daemon-reload - sgo spamddnsfix.timer + systemctl daemon-reload + systemctl restart spamddnsfix.timer + systemctl enable spamddnsfix.timer # ##### end spamassassin config - gitslink # needed to install the execstart files below - s dd of=/etc/systemd/system/mailcert.service <<'EOF' -[Unit] -Description=Mail cert rsync -After=multi-user.target -[Service] -Type=oneshot -ExecStart=/usr/local/bin/sysd-mail-once mailcert /usr/local/bin/mail-cert-cron -EOF - s dd of=/etc/systemd/system/mailcert.timer <<'EOF' -[Unit] -Description=Run mail-cert once a day -[Timer] -OnCalendar=daily -[Install] -WantedBy=timers.target + cat >/etc/exim4/rcpt_local_acl <<'EOF' +# Only hosts we control send to mail.iankelling.org, so make sure +# they are all authed. +# Note, if we wanted authed senders for all domains, +# we could make this condition in acl_check_mail +deny + message = ian trusted domain recepient but no auth + !authenticated = * + domains = mail.iankelling.org +EOF + cat >/etc/exim4/data_local_acl <<'EOF' +# Except for the "condition =", this was +# a comment in the check_data acl. The comment about this not +# being suitable is mostly bs. The only thing related I found was to +# add the condition =, cuz spamassassin has problems with big +# messages and spammers don't bother with big messages, +# but I've increased the size from 10k +# suggested in official docs, and 100k in the wiki example because +# those docs are rather old and I see a 110k spam message +# pretty quickly looking through my spam folder. + warn + condition = ${if < {$message_size}{2000K}} + spam = Debian-exim:true + add_header = X-Spam_score: $spam_score\n\ + X-Spam_score_int: $spam_score_int\n\ + X-Spam_bar: $spam_bar\n\ + X-Spam_report: $spam_report + +EOF + cat >/etc/exim4/conf.d/auth/29_exim4-config_auth <<'EOF' +# from 30_exim4-config_examples + +plain_server: +driver = plaintext +public_name = PLAIN +server_condition = "${if crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}" +server_set_id = $auth2 +server_prompts = : +.ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS +server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}} +.endif EOF - ser daemon-reload - ser start mailcert - sgo mailcert.timer + cat >/etc/exim4/conf.d/router/900_exim4-config_local_user <<'EOF' +### router/900_exim4-config_local_user +################################# + +# This router matches local user mailboxes. If the router fails, the error +# message is "Unknown user". + +local_user: + debug_print = "R: local_user for $local_part@$domain" + driver = accept + domains = +local_domains +# ian: commented this, in conjunction with a dovecot lmtp +# change so I get mail for all users. +# check_local_user + local_parts = ! root + transport = LOCAL_DELIVERY + cannot_route_message = Unknown user +EOF + cat >/etc/exim4/conf.d/transport/30_exim4-config_dovecot_lmtp <<'EOF' +dovecot_lmtp: + driver = lmtp + socket = /var/run/dovecot/lmtp + #maximum number of deliveries per batch, default 1 + batch_max = 200 +EOF - # based on a little google and package search, just the dovecot - # packages we need instead of dovecot-common. - # - # dovecot-lmtpd is for exim to deliver to dovecot instead of maildir - # directly. The reason to do this is to use dovecot's sieve, which - # has extensions that allow it to be almost equivalent to exim's - # filter capabilities, some ways probably better, some worse, and - # sieve has the benefit of being supported in postfix and - # proprietary/weird environments, so there is more examples on the - # internet. I was torn about whether to do this or not, meh. - pi dovecot-core dovecot-imapd dovecot-sieve dovecot-lmtpd - - # if we changed 90-sieve.conf and removed the active part of the - # sieve option, we wouldn't need this, but I'd rather not modify a - # default config if not needed. This won't work as a symlink in /a/c - # unfortunately. - lnf -T sieve/main.sieve ~/.dovecot.sieve - - # we have a few config files which installing exim/dovecot overwrites, - # and might as well have this before reading /etc/mailpass, - # which this sets up too. - conflink + cat >/etc/exim4/conf.d/router/190_exim4-config_fsfsmarthost <<'EOF' +# smarthost for fsf mail +# ian: copied from /etc/exim4/conf.d/router/200_exim4-config_primary, and added senders = and +# replaced DCsmarthost with mail.fsf.org +fsfsmarthost: + debug_print = "R: smarthost for $local_part@$domain" + driver = manualroute + domains = ! +local_domains + senders = *@fsf.org + transport = remote_smtp_smarthost + route_list = * mail.fsf.org byname + host_find_failed = ignore + same_domain_copy_routing = yes + no_more +EOF + + # https://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost + # i only need .forwards, so just doing that one. + cd /etc/exim4/conf.d/router + b=userforward_higher_priority + # replace the router name so it is unique + sed -r s/^\\S+:/$b:/ 600_exim4-config_userforward >175_$b # begin setup passwd.client f=/etc/exim4/passwd.client - s rm -f $f - s touch $f - s chmod 640 $f - s chown root:Debian-exim $f - # note: this will go away - s cat /etc/mailpass| while read -r domain port pass; do + rm -f /etc/exim4/passwd.client + install -m 640 -g Debian-exim /dev/null $f + cat /etc/mailpass| while read -r domain port pass; do # reference: exim4_passwd_client(5) - printf "%s:%s\n" "$domain" "$pass" | s tee -a $f >/dev/null + printf "%s:%s\n" "$domain" "$pass" >>$f done # end setup passwd.client - # https://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost - # i only need .forwards, so just doing that one. - cd /etc/exim4/conf.d/router - a=userforward - b=${a}_higher_priority - tmp=$(mktemp) - of=175_$b - # sed to make the router name unique - sed -r s/^\\S+:/$b:/ 600_exim4-config_$a | s dd of=$tmp 2>/dev/null - if ! diff -q $tmp $of &>/dev/null; then - s dd if=$tmp of=$of >/dev/null - fi + systemctl restart exim4 +fi #### end if exim4 - ser restart exim4 +# /etc/alias setup is debian specific, and +# exim config sets up an /etc/alias from root to the postmaster, which i +# config to ian, as long as there exists an entry for root, or there was +# no preexisting aliases file. based on the postinst file. postfix +# won\'t set up a root to $postmaster alias if it\'s already installed. +# Since postfix is not the greatest, just set it ourselves. +if [[ $postmaster != root ]]; then + sed -i --follow-symlinks -f - /etc/aliases </dev/null; then + if [[ $HOSTNAME == $MAIL_HOST ]]; then + systemctl restart radicale + systemctl enable radicale + if [[ -e /etc/logrotate.d/radicale.disabled ]]; then + mv /etc/logrotate.d/radicale{.disabled,} + fi + else + systemctl stop radicale + systemctl disable radicale + # weekly logrotate tries to restart radicale even if it's a disabled service in flidas. + if [[ -e /etc/logrotate.d/radicale ]]; then + mv /etc/logrotate.d/radicale{,.disabled} fi - s lnf -T $dir $sdir fi +fi +exit 0 - sgo $type - - - # if I wanted the from address to be renamed and sent to a different address, - # echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical - # sudo postmap hash:/etc/postfix/recipient_canonical - # sudo service postfix reload +# if I wanted the from address to be renamed and sent to a different address, +# echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical +# sudo postmap hash:/etc/postfix/recipient_canonical +# sudo service postfix reload