diff --git a/Dockerfile b/Dockerfile index 1a0a4a91..0c021ea0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM ubuntu:14.04 +FROM ubuntu:16.04 MAINTAINER Thomas VIAL ENV DEBIAN_FRONTEND noninteractive @@ -6,12 +6,16 @@ ENV VIRUSMAILS_DELETE_DELAY=7 ENV ONE_DIR=0 # Packages +RUN apt-get update -q --fix-missing && \ + apt-get -y upgrade && \ + apt-get -y install postfix RUN apt-get update -q --fix-missing && \ apt-get -y upgrade && \ apt-get -y install --no-install-recommends \ amavisd-new \ arj \ bzip2 \ + ca-certificates \ clamav \ clamav-daemon \ curl \ @@ -29,14 +33,15 @@ RUN apt-get update -q --fix-missing && \ gamin \ gzip \ iptables \ + locales \ libmail-spf-perl \ libnet-dns-perl \ libsasl2-modules \ + netcat-openbsd \ opendkim \ opendkim-tools \ opendmarc \ p7zip \ - postfix \ postfix-ldap \ postfix-policyd-spf-python \ pyzor \ @@ -47,8 +52,6 @@ RUN apt-get update -q --fix-missing && \ postgrey \ unzip \ && \ - curl -sk http://neuro.debian.net/lists/trusty.de-m.libre > /etc/apt/sources.list.d/neurodebian.sources.list && \ - apt-key adv --recv-keys --keyserver hkp://pgp.mit.edu:80 0xA5D32F012649A5A9 && \ curl https://packages.elasticsearch.org/GPG-KEY-elasticsearch | apt-key add - && \ echo "deb http://packages.elastic.co/beats/apt stable main" | tee -a /etc/apt/sources.list.d/beats.list && \ apt-get update -q --fix-missing && apt-get -y upgrade fail2ban filebeat && \ @@ -69,6 +72,7 @@ RUN sed -i -e 's/^.*postmaster_address.*/postmaster_address = '${POSTMASTER_ADDR RUN sed -i 's/#imap_idle_notify_interval = 2 mins/imap_idle_notify_interval = 29 mins/' /etc/dovecot/conf.d/20-imap.conf COPY target/dovecot/auth-passwdfile.inc /etc/dovecot/conf.d/ COPY target/dovecot/??-*.conf /etc/dovecot/conf.d/ +RUN cd /usr/share/dovecot && ./mkcert.sh # Configures LDAP COPY target/dovecot/dovecot-ldap.conf.ext /etc/dovecot diff --git a/Makefile b/Makefile index f96fb710..286fe70b 100644 --- a/Makefile +++ b/Makefile @@ -56,7 +56,7 @@ run: -v "`pwd`/test":/tmp/docker-mailserver-test \ -e PERMIT_DOCKER=network \ -e OVERRIDE_HOSTNAME=mail.my-domain.com \ - -h unknown.domain.tld \ + -h mail.my-domain.com \ -t $(NAME) sleep 15 docker run -d --name mail_fail2ban \ diff --git a/target/fail2ban/jail.conf b/target/fail2ban/jail.conf index 6da04a58..ec08e5c8 100644 --- a/target/fail2ban/jail.conf +++ b/target/fail2ban/jail.conf @@ -224,7 +224,6 @@ action = %(action_)s port = ssh logpath = %(sshd_log)s -backend = %(sshd_backend)s [sshd-ddos] @@ -233,14 +232,12 @@ backend = %(sshd_backend)s # in the body. port = ssh logpath = %(sshd_log)s -backend = %(sshd_backend)s [dropbear] port = ssh logpath = %(dropbear_log)s -backend = %(dropbear_backend)s [selinux-ssh] @@ -419,7 +416,6 @@ port = http,https port = http,https logpath = %(syslog_daemon)s -backend = %(syslog_backend)s [guacamole] @@ -436,14 +432,12 @@ logpath = /var/log/monit port = 10000 logpath = %(syslog_authpriv)s -backend = %(syslog_backend)s [froxlor-auth] port = http,https logpath = %(syslog_authpriv)s -backend = %(syslog_backend)s # @@ -472,28 +466,24 @@ logpath = /var/log/3proxy.log port = ftp,ftp-data,ftps,ftps-data logpath = %(proftpd_log)s -backend = %(proftpd_backend)s [pure-ftpd] port = ftp,ftp-data,ftps,ftps-data logpath = %(pureftpd_log)s -backend = %(pureftpd_backend)s [gssftpd] port = ftp,ftp-data,ftps,ftps-data logpath = %(syslog_daemon)s -backend = %(syslog_backend)s [wuftpd] port = ftp,ftp-data,ftps,ftps-data logpath = %(wuftpd_log)s -backend = %(wuftpd_backend)s [vsftpd] @@ -520,14 +510,12 @@ logpath = /root/path/to/assp/logs/maillog.txt port = smtp,465,submission logpath = %(syslog_mail)s -backend = %(syslog_backend)s [postfix] port = smtp,465,submission logpath = /var/log/mail/mail.log -backend = %(postfix_backend)s enabled = true @@ -535,7 +523,6 @@ enabled = true port = smtp,465,submission logpath = %(postfix_log)s -backend = %(postfix_backend)s maxretry = 1 @@ -543,14 +530,12 @@ maxretry = 1 port = submission,465,smtp logpath = %(syslog_mail)s -backend = %(syslog_backend)s [sendmail-reject] port = smtp,465,submission logpath = %(syslog_mail)s -backend = %(syslog_backend)s [qmail-rbl] @@ -566,7 +551,6 @@ logpath = /service/qmail/log/main/current port = pop3,pop3s,imap,imaps,submission,465,sieve logpath = /var/log/mail/mail.log -backend = %(dovecot_backend)s enabled = true @@ -574,7 +558,6 @@ enabled = true port = smtp,465,submission logpath = %(dovecot_log)s -backend = %(dovecot_backend)s [solid-pop3d] @@ -610,7 +593,6 @@ logpath = /opt/kerio/mailserver/store/logs/security.log port = smtp,465,submission,imap3,imaps,pop3,pop3s logpath = %(syslog_mail)s -backend = %(syslog_backend)s [postfix-sasl] @@ -620,7 +602,6 @@ port = smtp,465,submission,imap3,imaps,pop3,pop3s # running postfix since it would provide the same log lines at the # "warn" level but overall at the smaller filesize. logpath = /var/log/mail/mail.log -backend = %(postfix_backend)s enabled = true @@ -628,7 +609,6 @@ enabled = true port = imap3,imaps,pop3,pop3s logpath = %(syslog_mail)s -backend = %(syslog_backend)s [squirrelmail] @@ -641,14 +621,12 @@ logpath = /var/lib/squirrelmail/prefs/squirrelmail_access_log port = imap3,imaps logpath = %(syslog_mail)s -backend = %(syslog_backend)s [uwimap-auth] port = imap3,imaps logpath = %(syslog_mail)s -backend = %(syslog_backend)s # @@ -730,7 +708,6 @@ maxretry = 10 port = 3306 logpath = %(mysql_log)s -backend = %(mysql_backend)s # Jail for more extended banning of persistent abusers @@ -755,14 +732,12 @@ findtime = 86400 ; 1 day # pam-generic filter can be customized to monitor specific subset of 'tty's banaction = %(banaction_allports)s logpath = %(syslog_authpriv)s -backend = %(syslog_backend)s [xinetd-fail] banaction = iptables-multiport-log logpath = %(syslog_daemon)s -backend = %(syslog_backend)s maxretry = 2 @@ -792,7 +767,6 @@ action = %(banaction)s[name=%(__name__)s-tcp, port="%(tcpport)s", protocol="tcp [nagios] logpath = %(syslog_daemon)s ; nrpe.cfg may define a different log_facility -backend = %(syslog_backend)s maxretry = 1 diff --git a/test/tests.bats b/test/tests.bats index 18240d92..27dbc56f 100644 --- a/test/tests.bats +++ b/test/tests.bats @@ -15,7 +15,7 @@ load 'test_helper/bats-assert/load' } @test "checking configuration: hostname/domainname override: check container hostname is applied correctly" { - run docker exec mail_override_hostname /bin/bash -c "hostname | grep unknown.domain.tld" + run docker exec mail_override_hostname /bin/bash -c "hostname | grep mail.my-domain.com" assert_success } @@ -57,7 +57,7 @@ load 'test_helper/bats-assert/load' # @test "checking process: postfix" { - run docker exec mail /bin/bash -c "ps aux --forest | grep -v grep | grep '/usr/lib/postfix/master'" + run docker exec mail /bin/bash -c "ps aux --forest | grep -v grep | grep '/usr/lib/postfix/sbin/master'" assert_success } @@ -82,12 +82,12 @@ load 'test_helper/bats-assert/load' } @test "checking process: fail2ban (disabled in default configuration)" { - run docker exec mail /bin/bash -c "ps aux --forest | grep -v grep | grep '/usr/bin/python /usr/bin/fail2ban-server'" + run docker exec mail /bin/bash -c "ps aux --forest | grep -v grep | grep '/usr/bin/python3 /usr/bin/fail2ban-server'" assert_failure } @test "checking process: fail2ban (fail2ban server enabled)" { - run docker exec mail_fail2ban /bin/bash -c "ps aux --forest | grep -v grep | grep '/usr/bin/python /usr/bin/fail2ban-server'" + run docker exec mail_fail2ban /bin/bash -c "ps aux --forest | grep -v grep | grep '/usr/bin/python3 /usr/bin/fail2ban-server'" assert_success } @@ -121,7 +121,7 @@ load 'test_helper/bats-assert/load' # @test "checking process: postgrey (disabled in default configuration)" { - run docker exec mail /bin/bash -c "ps aux --forest | grep -v grep | grep '/usr/sbin/postgrey'" + run docker exec mail /bin/bash -c "ps aux --forest | grep -v grep | grep 'postgrey'" assert_failure } @@ -141,7 +141,7 @@ load 'test_helper/bats-assert/load' } @test "checking process: postgrey (postgrey server enabled)" { - run docker exec mail_with_postgrey /bin/bash -c "ps aux --forest | grep -v grep | grep '/usr/sbin/postgrey'" + run docker exec mail_with_postgrey /bin/bash -c "ps aux --forest | grep -v grep | grep 'postgrey'" assert_success }