diff --git a/.travis.yml b/.travis.yml index b6bf81c5..9bccf6d4 100644 --- a/.travis.yml +++ b/.travis.yml @@ -8,7 +8,7 @@ services: install: - travis_retry travis_wait make build-no-cache script: -- make generate-accounts run fixtures tests +- make generate-accounts run generate-accounts-after-run fixtures tests after_script: - make clean notifications: diff --git a/Dockerfile b/Dockerfile index b3d4e5c2..7e819097 100644 --- a/Dockerfile +++ b/Dockerfile @@ -193,7 +193,7 @@ RUN curl -s https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem > /et COPY ./target/bin /usr/local/bin # Start-mailserver script -COPY ./target/start-mailserver.sh ./target/fail2ban-wrapper.sh ./target/postfix-wrapper.sh ./target/docker-configomat/configomat.sh /usr/local/bin/ +COPY ./target/check_for_changes.sh ./target/start-mailserver.sh ./target/fail2ban-wrapper.sh ./target/postfix-wrapper.sh ./target/docker-configomat/configomat.sh /usr/local/bin/ RUN chmod +x /usr/local/bin/* # Configure supervisor diff --git a/Makefile b/Makefile index 496e18d1..cb2150d2 100644 --- a/Makefile +++ b/Makefile @@ -31,6 +31,7 @@ run: -e VIRUSMAILS_DELETE_DELAY=7 \ -e SASL_PASSWD="external-domain.com username:password" \ -e ENABLE_MANAGESIEVE=1 \ + --cap-add=SYS_PTRACE \ -e PERMIT_DOCKER=host \ -e DMS_DEBUG=0 \ -h mail.my-domain.com -t $(NAME) @@ -160,13 +161,17 @@ run: -h mail.my-domain.com -t $(NAME) sleep 20 - +generate-accounts-after-run: + docker run --rm -e MAIL_USER=added@localhost.localdomain -e MAIL_PASS=mypassword -t $(NAME) /bin/sh -c 'echo "$$MAIL_USER|$$(doveadm pw -s SHA512-CRYPT -u $$MAIL_USER -p $$MAIL_PASS)"' >> test/config/postfix-accounts.cf + sleep 10 + fixtures: cp config/postfix-accounts.cf config/postfix-accounts.cf.bak # Setup sieve & create filtering folder (INBOX/spam) docker cp "`pwd`/test/config/sieve/dovecot.sieve" mail:/var/mail/localhost.localdomain/user1/.dovecot.sieve docker exec mail /bin/sh -c "maildirmake.dovecot /var/mail/localhost.localdomain/user1/.INBOX.spam" docker exec mail /bin/sh -c "chown 5000:5000 -R /var/mail/localhost.localdomain/user1/.INBOX.spam" + sleep 20 # Sending test mails docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/amavis-spam.txt" docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/amavis-virus.txt" @@ -175,6 +180,7 @@ fixtures: docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-alias-recipient-delimiter.txt" docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user1.txt" docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user2.txt" + docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-added.txt" docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user-and-cc-local-alias.txt" docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-regexp-alias-external.txt" docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-regexp-alias-local.txt" @@ -188,7 +194,7 @@ fixtures: docker exec mail_override_hostname /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user1.txt" # Wait for mails to be analyzed - sleep 60 + sleep 75 tests: # Start tests diff --git a/README.md b/README.md index 478be3c1..0d0b1809 100644 --- a/README.md +++ b/README.md @@ -71,6 +71,7 @@ services: - DMS_DEBUG=0 cap_add: - NET_ADMIN + - SYS_PTRACE volumes: maildata: @@ -125,6 +126,7 @@ services: - POSTMASTER_ADDRESS=postmaster@localhost.localdomain cap_add: - NET_ADMIN + - SYS_PTRACE volumes: maildata: diff --git a/docker-compose.elk.yml.dist b/docker-compose.elk.yml.dist index 1578f26a..3adb8905 100644 --- a/docker-compose.elk.yml.dist +++ b/docker-compose.elk.yml.dist @@ -21,6 +21,7 @@ services: - ENABLE_ELK_FORWARDER=1 cap_add: - NET_ADMIN + - SYS_PTRACE restart: always elk: build: elk diff --git a/docker-compose.yml.dist b/docker-compose.yml.dist index 2605977c..26131f87 100644 --- a/docker-compose.yml.dist +++ b/docker-compose.yml.dist @@ -23,6 +23,7 @@ services: - DMS_DEBUG=0 cap_add: - NET_ADMIN + - SYS_PTRACE restart: always volumes: diff --git a/target/check_for_changes.sh b/target/check_for_changes.sh new file mode 100755 index 00000000..215ef76d --- /dev/null +++ b/target/check_for_changes.sh @@ -0,0 +1,123 @@ +#! /bin/bash + +# Prevent a start too early +sleep 5 + +# change directory +cd /tmp/docker-mailserver + +# Update / generate after start +echo 'Makeing new chksum' +sha512sum --tag postfix-accounts.cf --tag postfix-virtual.cf > chksum + +# Run forever +while true; do + +# Check postfix-virtual.cf exist else break +if [ ! -f postfix-virtual.cf ]; then + echo 'postfix-virtual.cf is missing! exit!' + break; +fi + +# Check postfix-accounts.cf exist else break +if [ ! -f postfix-accounts.cf ]; then + echo 'postfix-accounts.cf is missing! exit!' + break; +fi + + +# Get chksum and check it. +chksum=$(sha512sum -c chksum) +resu_acc=${chksum:21:2} +resu_vir=${chksum:44:2} + +if ! [ $resu_acc = "OK" ] || ! [ $resu_vir = "OK" ]; then + echo "CHANGE DETECT" + #regen postfix accounts. + echo -n > /etc/postfix/vmailbox + echo -n > /etc/dovecot/userdb + if [ -f /tmp/docker-mailserver/postfix-accounts.cf -a "$ENABLE_LDAP" != 1 ]; then + sed -i 's/\r//g' /tmp/docker-mailserver/postfix-accounts.cf + echo "# WARNING: this file is auto-generated. Modify config/postfix-accounts.cf to edit user list." > /etc/postfix/vmailbox + # Checking that /tmp/docker-mailserver/postfix-accounts.cf ends with a newline + sed -i -e '$a\' /tmp/docker-mailserver/postfix-accounts.cf + chown dovecot:dovecot /etc/dovecot/userdb + chmod 640 /etc/dovecot/userdb + sed -i -e '/\!include auth-ldap\.conf\.ext/s/^/#/' /etc/dovecot/conf.d/10-auth.conf + sed -i -e '/\!include auth-passwdfile\.inc/s/^#//' /etc/dovecot/conf.d/10-auth.conf + # Creating users + # 'pass' is encrypted + # comments and empty lines are ignored + grep -v "^\s*$\|^\s*\#" /tmp/docker-mailserver/postfix-accounts.cf | while IFS=$'|' read login pass + do + # Setting variables for better readability + user=$(echo ${login} | cut -d @ -f1) + domain=$(echo ${login} | cut -d @ -f2) + # Let's go! + echo "${login} ${domain}/${user}/" >> /etc/postfix/vmailbox + # User database for dovecot has the following format: + # user:password:uid:gid:(gecos):home:(shell):extra_fields + # Example : + # ${login}:${pass}:5000:5000::/var/mail/${domain}/${user}::userdb_mail=maildir:/var/mail/${domain}/${user} + echo "${login}:${pass}:5000:5000::/var/mail/${domain}/${user}::" >> /etc/dovecot/userdb + mkdir -p /var/mail/${domain} + if [ ! -d "/var/mail/${domain}/${user}" ]; then + maildirmake.dovecot "/var/mail/${domain}/${user}" + maildirmake.dovecot "/var/mail/${domain}/${user}/.Sent" + maildirmake.dovecot "/var/mail/${domain}/${user}/.Trash" + maildirmake.dovecot "/var/mail/${domain}/${user}/.Drafts" + echo -e "INBOX\nSent\nTrash\nDrafts" >> "/var/mail/${domain}/${user}/subscriptions" + touch "/var/mail/${domain}/${user}/.Sent/maildirfolder" + fi + # Copy user provided sieve file, if present + test -e /tmp/docker-mailserver/${login}.dovecot.sieve && cp /tmp/docker-mailserver/${login}.dovecot.sieve /var/mail/${domain}/${user}/.dovecot.sieve + echo ${domain} >> /tmp/vhost.tmp + done + fi + # regen postfix aliases + echo -n > /etc/postfix/virtual + echo -n > /etc/postfix/regexp + if [ -f /tmp/docker-mailserver/postfix-virtual.cf ]; then + # Copying virtual file + cp -f /tmp/docker-mailserver/postfix-virtual.cf /etc/postfix/virtual + while read from to + do + # Setting variables for better readability + uname=$(echo ${from} | cut -d @ -f1) + domain=$(echo ${from} | cut -d @ -f2) + # if they are equal it means the line looks like: "user1 other@domain.tld" + test "$uname" != "$domain" && echo ${domain} >> /tmp/vhost.tmp + done < /tmp/docker-mailserver/postfix-virtual.cf + fi + if [ -f /tmp/docker-mailserver/postfix-regexp.cf ]; then + # Copying regexp alias file + cp -f /tmp/docker-mailserver/postfix-regexp.cf /etc/postfix/regexp + sed -i -e '/^virtual_alias_maps/{ + s/ regexp:.*// + s/$/ regexp:\/etc\/postfix\/regexp/ + }' /etc/postfix/main.cf + fi + # Set vhost + if [ -f /tmp/vhost.tmp ]; then + cat /tmp/vhost.tmp | sort | uniq > /etc/postfix/vhost && rm /tmp/vhost.tmp + fi + + # Set right new if needed + if [ `find /var/mail -maxdepth 3 -a \( \! -user 5000 -o \! -group 5000 \) | grep -c .` != 0 ]; then + chown -R 5000:5000 /var/mail + fi + + # Restart of the postfix + supervisorctl restart postfix + + # Prevent restart of dovecot when smtp_only=1 + if [ ! -f $SMTP_ONLY = 1 ]; then + supervisorctl restart dovecot + fi + + echo 'Update chksum' + sha512sum --tag postfix-accounts.cf --tag postfix-virtual.cf > chksum +fi + +sleep 1 +done diff --git a/target/start-mailserver.sh b/target/start-mailserver.sh index 87f42b6f..f4c9698e 100644 --- a/target/start-mailserver.sh +++ b/target/start-mailserver.sh @@ -183,7 +183,10 @@ function register_functions() { if [ "$ENABLE_CLAMAV" = 1 ]; then _register_start_daemon "_start_daemons_clamav" fi - + # Change detector + if [ "$ENABLE_LDAP" = 0 ]; then + _register_start_daemon "_start_changedetector" + fi _register_start_daemon "_start_daemons_amavis" ################### << daemon funcs @@ -1243,7 +1246,14 @@ function _start_daemons_amavis() { ########################################################################## +########################################################################## +# Start check for update postfix-accounts and postfix-virtual +########################################################################## +function _start_changedetector() { + notify 'task' 'Starting changedetector' 'n' + supervisorctl start changedetector +} # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! diff --git a/target/supervisor/conf.d/supervisor-app.conf b/target/supervisor/conf.d/supervisor-app.conf index 92441afc..c768ba4b 100644 --- a/target/supervisor/conf.d/supervisor-app.conf +++ b/target/supervisor/conf.d/supervisor-app.conf @@ -114,3 +114,10 @@ stdout_logfile=/var/log/supervisor/%(program_name)s.log stderr_logfile=/var/log/supervisor/%(program_name)s.log command=/usr/local/bin/postfix-wrapper.sh +[program:changedetector] +startsecs=0 +autostart=false +autorestart=true +stdout_logfile=/var/log/supervisor/%(program_name)s.log +stderr_logfile=/var/log/supervisor/%(program_name)s.log +command=/usr/local/bin/check_for_changes.sh diff --git a/test/auth/added-imap-auth.txt b/test/auth/added-imap-auth.txt new file mode 100644 index 00000000..83267a1f --- /dev/null +++ b/test/auth/added-imap-auth.txt @@ -0,0 +1,4 @@ +a1 LOGIN added@localhost.localdomain mypassword +a3 EXAMINE INBOX +a4 FETCH 1 BODY[] +a5 LOGOUT diff --git a/test/auth/added-pop3-auth.txt b/test/auth/added-pop3-auth.txt new file mode 100644 index 00000000..dcc93631 --- /dev/null +++ b/test/auth/added-pop3-auth.txt @@ -0,0 +1,4 @@ +USER added@localhost.localdomain +PASS mypassword +LIST +quit diff --git a/test/auth/added-smtp-auth-login-wrong.txt b/test/auth/added-smtp-auth-login-wrong.txt new file mode 100644 index 00000000..a75856f1 --- /dev/null +++ b/test/auth/added-smtp-auth-login-wrong.txt @@ -0,0 +1,4 @@ +EHLO mail +AUTH LOGIN YWRkZWRAbG9jYWxob3N0LmxvY2FsZG9tYWlu +Bn3JKisq4HQ2RO== +QUIT diff --git a/test/auth/added-smtp-auth-login.txt b/test/auth/added-smtp-auth-login.txt new file mode 100644 index 00000000..5276b7f4 --- /dev/null +++ b/test/auth/added-smtp-auth-login.txt @@ -0,0 +1,4 @@ +EHLO mail +AUTH LOGIN YWRkZWRAbG9jYWxob3N0LmxvY2FsZG9tYWlu +bXlwYXNzd29yZA== +QUIT diff --git a/test/auth/added-smtp-auth-plain-wrong.txt b/test/auth/added-smtp-auth-plain-wrong.txt new file mode 100644 index 00000000..6ce5a383 --- /dev/null +++ b/test/auth/added-smtp-auth-plain-wrong.txt @@ -0,0 +1,3 @@ +EHLO mail +AUTH PLAIN YWRkZWRAbG9jYWxob3N0LmxvY2FsZG9tYWluAGFkZGVkQGxvY2FsaG9zdC5sb2NhbGRvbWFpbgBCQURQQVNTV09SRA== +QUIT diff --git a/test/auth/added-smtp-auth-plain.txt b/test/auth/added-smtp-auth-plain.txt new file mode 100644 index 00000000..ed48d77d --- /dev/null +++ b/test/auth/added-smtp-auth-plain.txt @@ -0,0 +1,3 @@ +EHLO mail +AUTH PLAIN YWRkZWRAbG9jYWxob3N0LmxvY2FsZG9tYWluAGFkZGVkQGxvY2FsaG9zdC5sb2NhbGRvbWFpbgBteXBhc3N3b3Jk +QUIT diff --git a/test/email-templates/existing-added.txt b/test/email-templates/existing-added.txt new file mode 100644 index 00000000..aa97fb2f --- /dev/null +++ b/test/email-templates/existing-added.txt @@ -0,0 +1,12 @@ +HELO mail.external.tld +MAIL FROM: user@external.tld +RCPT TO: added@localhost.localdomain +DATA +From: Docker Mail Server +To: Existing Local User +Date: Sat, 22 May 2010 07:43:25 -0400 +Subject: Test Message +This is a test mail. + +. +QUIT diff --git a/test/tests.bats b/test/tests.bats index b729fbf9..3754c378 100644 --- a/test/tests.bats +++ b/test/tests.bats @@ -197,6 +197,11 @@ load 'test_helper/bats-assert/load' assert_success } +@test "checking imap: added user authentication works" { + run docker exec mail /bin/sh -c "nc -w 1 0.0.0.0 143 < /tmp/docker-mailserver-test/auth/added-imap-auth.txt" + assert_success +} + # # pop # @@ -211,6 +216,11 @@ load 'test_helper/bats-assert/load' assert_success } +@test "checking pop: added user authentication works" { + run docker exec mail_pop3 /bin/sh -c "nc -w 1 0.0.0.0 110 < /tmp/docker-mailserver-test/auth/added-pop3-auth.txt" + assert_success +} + # # sasl # @@ -264,10 +274,30 @@ load 'test_helper/bats-assert/load' assert_success } +@test "checking smtp: added user authentication works with good password (plain)" { + run docker exec mail /bin/sh -c "nc -w 5 0.0.0.0 25 < /tmp/docker-mailserver-test/auth/added-smtp-auth-plain.txt | grep 'Authentication successful'" + assert_success +} + +@test "checking smtp: added user authentication fails with wrong password (plain)" { + run docker exec mail /bin/sh -c "nc -w 20 0.0.0.0 25 < /tmp/docker-mailserver-test/auth/added-smtp-auth-plain-wrong.txt | grep 'authentication failed'" + assert_success +} + +@test "checking smtp: added user authentication works with good password (login)" { + run docker exec mail /bin/sh -c "nc -w 5 0.0.0.0 25 < /tmp/docker-mailserver-test/auth/added-smtp-auth-login.txt | grep 'Authentication successful'" + assert_success +} + +@test "checking smtp: added user authentication fails with wrong password (login)" { + run docker exec mail /bin/sh -c "nc -w 20 0.0.0.0 25 < /tmp/docker-mailserver-test/auth/added-smtp-auth-login-wrong.txt | grep 'authentication failed'" + assert_success +} + @test "checking smtp: delivers mail to existing account" { run docker exec mail /bin/sh -c "grep 'postfix/lmtp' /var/log/mail/mail.log | grep 'status=sent' | grep ' Saved)' | wc -l" assert_success - assert_output 9 + assert_output 10 } @test "checking smtp: delivers mail to existing alias" { @@ -349,6 +379,7 @@ load 'test_helper/bats-assert/load' assert_success [ "${lines[0]}" = "user1@localhost.localdomain" ] [ "${lines[1]}" = "user2@otherdomain.tld" ] + [ "${lines[2]}" = "added@localhost.localdomain" ] } @test "checking accounts: user mail folders for user1" { @@ -363,6 +394,12 @@ load 'test_helper/bats-assert/load' assert_output 7 } +@test "checking accounts: user mail folders for added user" { + run docker exec mail /bin/bash -c "ls -A /var/mail/localhost.localdomain/added | grep -E '.Drafts|.Sent|.Trash|cur|new|subscriptions|tmp' | wc -l" + assert_success + assert_output 7 +} + @test "checking accounts: comments are not parsed" { run docker exec mail /bin/bash -c "ls /var/mail | grep 'comment'" assert_failure @@ -1315,7 +1352,7 @@ load 'test_helper/bats-assert/load' } @test "checking restart of process: amavisd-new" { - run docker exec mail /bin/bash -c "pkill amavi && sleep 10 && ps aux --forest | grep -v grep | grep '/usr/sbin/amavisd-new (master)'" + run docker exec mail /bin/bash -c "pkill amavi && sleep 12 && ps aux --forest | grep -v grep | grep '/usr/sbin/amavisd-new (master)'" assert_success }