* Introduced Postscreen
cheaper, earlier and simpler blocking of zombies/spambots.
From http://postfix.cs.utah.edu/POSTSCREEN_README.html :
As a first layer, postscreen(8) blocks connections from zombies and other spambots that are responsible for about 90% of all spam. It is implemented as a single process to make this defense as cheap as possible.
Things we need to consider:
- Do we need a whitelist/backlist file? (http://postfix.cs.utah.edu/postconf.5.html#postscreen_access_list)
- Via introducing an optional config/postfix-access.cidr
- The only permanent whitelisting I could imagine are monitoring services(which might (still?) behave weird/hastely) or blacklisting backup servers(since no traffic should be coming from them anyway)
- Do we need deep inspections? They are desireable, but these tests are expensive: a good client must disconnect after it passes the test, before it can talk to a real Postfix SMTP server. Considered tests are:
- postscreen_bare_newline_enable (http://postfix.cs.utah.edu/postconf.5.html#postscreen_bare_newline_action)
- postscreen_non_smtp_command_enable (http://postfix.cs.utah.edu/postconf.5.html#postscreen_non_smtp_command_action)
- postscreen_pipelining_enable (http://postfix.cs.utah.edu/postconf.5.html#postscreen_pipelining_action)
- Do we need to make the blacklisting via dnsblocking configurable? It's currently set and weighted as follows, where a score of 3 results in blocking, a score of -1 results in whitelisting:
(*: adds the specified weight to the SMTP client's DNSBL score. Specify a negative number for whitelisting.)
(http://postfix.cs.utah.edu/postconf.5.html#postscreen_dnsbl_sites)
- zen.spamhaus.org*3
- bl.mailspike.net
- b.barracudacentral.org*2
- bl.spameatingmonkey.net
- bl.spamcop.net
- dnsbl.sorbs.net
- psbl.surriel.com
- list.dnswl.org=127.0.[0..255].0*-2
- list.dnswl.org=127.0.[0..255].1*-3
- list.dnswl.org=127.0.[0..255].[2..3]*-4
- What to do when blacklisting? I currently set it to drop. We could
- ignore: Ignore the failure of this test. Allow other tests to complete. Repeat this test the next time the client connects. This option is useful for testing and collecting statistics without blocking mail.
- enforce: Allow other tests to complete. Reject attempts to deliver mail with a 550 SMTP reply, and log the helo/sender/recipient information. Repeat this test the next time the client connects.
- drop: Drop the connection immediately with a 521 SMTP reply. Repeat this test the next time the client connects.
In the end I think we could drop postgrey support. Postscreen replaces postgrey in its entirety, while being more selective and not delaying mail. Especially if we consider using the deep inspection options of postscreen.
Hope that wasn't too much to read! ;)
* main.cf got misformatted..
Don't know how, should be ok now.
* fixed malformatted main.cf & repaired master.cf
* reenabled rbl stuff.. It's cached, therefore doesn't hurt
* fixed tests
* added tests, repaired tests, added info, introduced new Variable POSTSCREEN_ACTION, fixes
* Allow setup of LDAP STARTTLS for Dovecot and Postfix
* Added tests for TLS config override
* Add missing Postfix TLS options
* Added missing new line at the end of the file
* Added STARTTLS tests for Postfix config
* Switch to stretch-slim as base image.
- first step correct the testdata, as newer packages are more strict
about the mail-structure.
* Switch to stretch-slim: correcting the test-environment and the build
- add missing build-step to make
- clean the userdb aswell
- use timeout of netcat, as postgrey would not close the connection
- there is 2 extra mail-logs -> assert_output 5
- cosmetic: use "" instead of ''
* Switch to stretch-slim:
new image:
- smaller size
- 0 CVEs compared to 11 CVEs in ubuntu 16.04 Image
better backport situation
- postfix 3.1.6 vs 3.1.0
- fail2ban 0.9.6 vs 0.9.3
...
changes needed because of stretch-slim:
- add missing gnupg and iproute2 package
- remove non-free rar, unrar-free should do
- rsyslog does not add syslog user and has different conf-structure
- pyzor command discover was deprecated and is missing in the new
stretch package
- dovecot does not know SSLv2 anymore. removed because of warnings in
log
- iptables does not know imap3, IMAP working group chose imap2 in favor
of imap3
* Switch to debian stretch slim:
SSLv2 seems to be a not known protocol anymore - good!
* switch to debian stretch slim:
make this test more stable. there might be more than only one mail.log
(mail.info, mail.warn, ...)
* switch to debian stretc slim:
new openssl 1.1.0 needs stronger ciphers, removed some weekers ones.
Please, look through the new list of cipher! this needs to be done in
another commit for all other SSL/TLS-Endpoints aswell.
* Switch to debian stretch slim:
let our server pre-empt the cipher list.
Did a read through, wwwDOTpostfixDOTorg/FORWARD_SECRECY_READMEDOThtml
and
wwwDOTpostfixDOTorg/TLS_READMEDOThtml
* Switch to debian stretch slim: lets give this openssl-based test a new and independent but identical container. many other test on the main 'mail' container might interfere here.
* Switch to debian stretch slim: remove unused lines
* fix for issue #747 (NOT TESTED YET)
Need to test this. Dont merge it yet.
* Small Cleanup and bug fixes Not done Yet!
Not done yet. Dont merge. See comment in issue #747
* Add --ignore-missing. Now is fixed.
This command can be used for generating DKIM key for a domain,
which is not included in any configuration files. For example,
when using SQL database for transport maps.
* installed supervisor. Still need to set tasks to run in foreground.
* setting programs to run in foreground
* seems to work now
* cleanup
* final fixes
* tests
* show startup output on stdout
* set Dovecot config files before starting it
* make all processes log to console
* Use the supervisor as the main process. The start-mailserver is started
from the supervisord and then this process triggers others.
Defined some default variable in the Dockerfile. In order for
supervisored to build the command lines the ENV variable need to be set.
Therefore the defaults are defined.
Some processes are not single processes like postfix and fail2ban and
they have a wrapper. The wrapper takes care of proper shutdown and checking
if the process is running or not. Supervisored will restart the wrapping
script if the process is gone.
Increased some delays between tests because sometimes they where to short
for all containers to be running.
* Remove obsolete comments, reset timeout value to old one, added new lines
* Add more time for analyzing the emails.
Sometimes it fails the tests and gives a wrong state about
the test. During testing 40 seconds was the safe value.
* Fix Dovecot Ldap Problems
* Fix typo within DEFAULT_VARS Definitions
* Fix wrong ldap hosts value within the bats test
* Fix override_config for strings containing &
* Fix erroneous removal of an conditional within the postfix override function
* Renamed Test 129, to be clear that this belongs to ldap
* Fix mail_with_ldap setting dn pass explicit
* Add 3 env variables for ldap: LDAP_QUERY_FILTER_{USER,GROUP,ALIAS}
* Update README.md
* Environment variable for spam subject tag
* Add SA_SPAM_SUBJECT to readme
* Add integration tests for spam subject tag
* Fix overwrite environment variable in config file
* First pass at adding support for pipe and filter in Sieve, excluding unit tests.
* Reduce insight into copied scripts
* Added test
* Adjustments related to switch to 16.04
* Fixed wrong mail headers when using OVERRIDE_HOSTNAME by setting the the hostname explicitly
* Added tests and fixed hostname in dovecot conf
* Added missing tests
* Improved function naming and task notification message
* Added `bats-assert` for more detailed error, very useful locally and on Travis
* Moved `bats` to git submodule
Example:
```
not ok 52 checking opendkim: generator creates keys, tables and TrustedHosts
# (from function `assert_output' in file test/test_helper/bats-assert/src/assert.bash, line 239,
# in test file test/tests.bats, line 368)
# `assert_output 2' failed
#
# -- output differs --
# expected : 2
# actual : 4
# --
#
```
* Add #394: Postfix Virtual Transport
This makes it possible to specify a lmtp config file, by providing
POSTFIX_DAGENT.
Update - Readme with informations about #394
* Add Variable ENABLE_POSTFIX_VIRTUAL_TRANSPORT (task)
* Add Variable POSTFIX_DAGENT (section)
Added Unit tests for virtual transport
* Fix syntax error in test/tests.bats
* Fix Unit Test
* Removed DISABLE_AMAVIS
* Renamed DISABLE_* to ENABLE_* with 0 as default value. (this must be explicit)
* Added missing tests for ENABLE_*
* Improved readme and docker-compose example
Should fix#256 and #386
* Adding the PERMIT_DOCKER option
See README.md for more informations
* Adding some test for PERMIT_DOCKER option
* Fix test cases
* Opendkim and Openmarc configuration
Fix docker network range
Adding opendkim and openmarc configuration
* Adding some options for tests
* Update log message
* Update tests
* Allow disabling amavis service
Setting the `DISABLE_AMAVIS=1` env var will skip the starting of the
amavis process.
* Enable option to not run spamassassin
Setting the `DISABLE_SPAMASSASSIN=1` env var will start this container
without spamassain.
* Allow starting of the container without clamav
Setting the `DISABLE_CLAMAV=1` env var will start this container without
starting clamav.
The dovecot-sieve plugin is installed and configured to apply sieve
as soon as a .dovecot.sieve file is encountered in the virtual user's
home directory (that is /var/mail/${domain}/${username}/.dovecot.sieve).
Transport has been changed in the postfix configuration to use
Dovecot LDA (see http://wiki.dovecot.org/LDA/Postfix) to actually
enable sieve filtering.
Tests have been added.
Courier and Cyrus Sasl have been removed and substituted with Dovecot which now
handle authentication for Postfix, Imap and Pop3, with support for SSL.
This allow the use of several encryption schemes for the password as well as a
single user db.
OpenDKIM keys can now be provided at the startup and will be used instead of
generating new ones (so that you don't have to change your DNS configuration).
This version builds correctly on Docker but no integration tests have been
reworked to accommodate Dovecot instead of Courier and Cyrus Sasl. As such
at present no automatic tests can be executed.
Modified the Makefile so that the containers startup with a short delay
between each other.
Corrected a small bug in start-mailserver.sh that prevented the correct
configuration of the jails.
