Commit graph

1920 commits

Author SHA1 Message Date
akmet 68aaeba59f added error messages to letsencrypt on startup (#898) 2018-03-15 08:01:44 +01:00
17Halbe 570237232c Delmailuser (Closes: #878)
* delmailuser:
  + added multiple address deletion
  + added alias deletion
  + added maildir deletion (upon confirmation)
  + introduced optional "assume yes" argument
* updated addalias,delalias,delmailuser,updatemailuser and added modified tests
* added config check and repair to start-mailserver for old postfix-virtual.cf files
2018-03-14 20:00:38 +01:00
Johan Smits 50a76ba91e
Update docker-configomat (Resolves: #680) 2018-03-13 08:10:16 +01:00
Johan Smits 0d5ec7e463
Add templates for Github for creating new issues and contributing 2018-03-11 11:01:32 +01:00
James ef79e9a65d Generate SRS secret on first run and store it (#891) 2018-03-10 13:41:20 +01:00
Benedict Endemann e6c32a03e5 Add /var/lib/dovecot to mailstate persistence (Closes: #887)
Added `/var/lib/dovecot/` to the list of folders that get persisted in `mailstate`. So the creation of `ssl-parameters.dat` has not to be done every restart again. This may only take some dozen seconds, but can be very long on systems with high load.
2018-03-09 19:46:49 +01:00
James 2e8bb4ae34 Allow configuring SRS secrets using the environment (#885) 2018-03-08 22:51:10 +01:00
Cédric Laubacher d691b8df6f Fix typo in README (#883) 2018-03-07 22:14:52 +01:00
akmet 34cb3a14cc Removed unneeded check for Let's encrypt cert.pem (Closes: #843) 2018-03-07 20:21:46 +01:00
17Halbe a73692cc9f Added reject_authenticated_sender_login_mismatch (#872)
* added reject_authenticated_sender_login_mismatch handling including tests
* removed obsolete reject_sender_login_mismatch
* introduced SPOOF_PROTECTION env variable, tests, documentation and missing documentation for TLS_LEVEL
* added missing email template
2018-03-07 19:33:43 +01:00
Thomas A. Kilian 4036588c65 Setting quiet mode on invoke-rc.d (Closes: #792)
This prevents a daily error message
2018-03-07 19:31:10 +01:00
17Halbe 3ef1447e12 Updated Setup docker mailserver using the script setup.sh (markdown) 2018-03-06 14:00:37 +01:00
lokipo a9cb14a1c3 Updated Update and cleanup (markdown) 2018-03-06 11:06:03 +01:00
lokipo 1ed7b7d4f9 Updated Update and cleanup (markdown) 2018-03-06 11:05:44 +01:00
Marek Walczak 253c8faef6 Dkim key size - Addon (#871)
* added Tests
2018-03-03 09:20:23 +01:00
Marek Walczak d74fa95afa DKIM Key Size introduced in #868 2018-03-03 07:39:24 +01:00
Alexander Elbracht d9502ab6e7 Implement undef option for SA_SPAM_SUBJECT (#767)
* Implement undef option for SA_SPAM_SUBJECT in amavis config
* Add test for undef spam subject
2018-03-02 22:38:57 +01:00
Marek Walczak c505177486 Dkim key size (#868)
Allow to change the keysize for the dkim key
2018-03-02 22:17:18 +01:00
17Halbe b644ced730 Updated Setup docker mailserver using the script setup.sh (markdown) 2018-03-01 09:32:21 +01:00
Andreas Gerstmayr 2687469f38 update postmaster_address in dovecot config according to POSTMASTER_ADDRESS env var (#866)
* update postmaster_address in dovecot config according to POSTMASTER_ADDRESS env var
* tests: add another test for postmaster_address with default settings
2018-02-27 20:44:45 +01:00
Marek Walczak c36e878d76 Nist tls (#831)
* remove two ciphers according to https://www.htbridge.com/ssl/ (NIST, HIPAA)
* added a switch via an environment variable to choose between modern and intermediate ciphers
2018-02-22 08:36:12 +01:00
Achim Christ eb20722b80 Add environment variable to allow for customizing postsrsd's SRS_EXCLUDE_DOMAINS setting (#849, #842) 2018-02-18 20:53:13 +01:00
17Halbe 5e09074d58 postscreen implementation altered (#846)
* new setup.sh function, new tests, new script and some minor updates to main.cf
* fix for missing files
* removed obsolete test-files
* restart postfix if neccessary.
* see pr  #845
* fixed typo
* fixed branchmixup
* changed postfix reload command & changed to operate on container instead of image
* reload postfix only on adding new restriction
* main.cf is only changed when user is added.
 - Postfix reload changed
 - working on container instead of image now in setup.sh
 - added cleanup after tests
* moved cleanup to makefile
2018-02-18 13:29:43 +01:00
Johan Smits 803dab12c6
Update readme and changelog about the ports and usage (#848) 2018-02-18 13:12:39 +01:00
17Halbe 795cbf103d fixed greedy postgrey sed command (#845) 2018-02-18 10:37:31 +01:00
17Halbe b08c9b42ed moved fail2ban function from setup.sh to own file (#837)
* moved fail2ban function out of setup.sh
2018-02-13 08:31:12 +01:00
Cédric Laubacher 19cb22a1a5 Generate new DH param weekly instead of daily (#836) 2018-02-12 22:04:02 +01:00
17Halbe ac9be357ce Diffie-Hellman 2048 Bit Parameters should be changed regularly. (#834)
Since it is assumed that the NSA uses Rainbowtables to break default-DHE-Parameters, one is encouraged to change the Parameters periodically.
2018-02-11 18:37:04 +01:00
17Halbe 21b7cf72c9 added config-path option to setup.sh script (Closes: #698)
* added config-path option to setup.sh script
2018-02-11 18:26:46 +01:00
17Halbe 260486b305 Updated Configure SPF (markdown) 2018-02-09 22:16:48 +01:00
17Halbe e5b15a3330 Updated Setup docker mailserver using the script setup.sh (markdown) 2018-02-08 08:32:56 +01:00
17Halbe 7fc0bf145f Updated Configure Fail2ban (markdown) 2018-02-08 08:28:41 +01:00
17Halbe 5394a505b9 Restrict access (Closes #452, #816)
new setup.sh function, new tests, new script
2018-02-07 21:33:07 +01:00
Darren McGrandle 3afbf12a46 Updated Overwrite Default Postfix Configuration (markdown) 2018-02-07 12:01:12 -08:00
17Halbe 115ad555be Introduce .env for docker-compose examples (Closes #815)
Introduce .env for docker-compose examples
2018-02-07 19:37:26 +01:00
H4R0 f6404156f9 Changed Junk folder to be created and subscribed by default (#806) 2018-02-06 20:21:37 +01:00
Johan Smits a643caf793 Add restart message 2018-02-06 19:57:16 +01:00
TechnicLab f68befdbee Added reject_sender_login_mismatch (Closes: #811) 2018-02-06 19:35:32 +01:00
Jurek Barth e1e4542390 Fix: Add SRS to fix SPF issues on redirect #611 (#814)
* add srs support

* change autorestart behavior

* this may work now

* make postsrsd’s own wrapper file

* fix dockerfile formatting

* fixing tests
2018-02-06 08:11:57 +01:00
17Halbe 3b7fc5930c Introducing Postscreen (#799)
* Introduced Postscreen

cheaper, earlier and simpler blocking of zombies/spambots.
From http://postfix.cs.utah.edu/POSTSCREEN_README.html :
As a first layer, postscreen(8) blocks connections from zombies and other spambots that are responsible for about 90% of all spam. It is implemented as a single process to make this defense as cheap as possible.

Things we need to consider:

 - Do we need a whitelist/backlist file? (http://postfix.cs.utah.edu/postconf.5.html#postscreen_access_list)
   - Via introducing an optional config/postfix-access.cidr
   - The only permanent whitelisting I could imagine are monitoring services(which might (still?) behave weird/hastely) or blacklisting backup servers(since no traffic should be coming from them anyway)
 - Do we need deep inspections? They are desireable, but these tests are expensive: a good client must disconnect after it passes the test, before it can talk to a real Postfix SMTP server. Considered tests are:
   - postscreen_bare_newline_enable (http://postfix.cs.utah.edu/postconf.5.html#postscreen_bare_newline_action)
   - postscreen_non_smtp_command_enable (http://postfix.cs.utah.edu/postconf.5.html#postscreen_non_smtp_command_action)
   - postscreen_pipelining_enable (http://postfix.cs.utah.edu/postconf.5.html#postscreen_pipelining_action)
- Do we need to make the blacklisting via dnsblocking configurable? It's currently set and weighted as follows, where a score of 3 results in blocking, a score of -1 results in whitelisting:
   (*: adds the specified weight to the SMTP client's DNSBL score. Specify a negative number for whitelisting.)
   (http://postfix.cs.utah.edu/postconf.5.html#postscreen_dnsbl_sites)
   - zen.spamhaus.org*3
   - bl.mailspike.net
   - b.barracudacentral.org*2
   - bl.spameatingmonkey.net
   - bl.spamcop.net
   - dnsbl.sorbs.net
   - psbl.surriel.com
   - list.dnswl.org=127.0.[0..255].0*-2
   - list.dnswl.org=127.0.[0..255].1*-3
   - list.dnswl.org=127.0.[0..255].[2..3]*-4
- What to do when blacklisting? I currently set it to drop. We could
   - ignore: Ignore the failure of this test. Allow other tests to complete. Repeat this test the next time the client connects. This option is useful for testing and collecting statistics without blocking mail.
   - enforce: Allow other tests to complete. Reject attempts to deliver mail with a 550 SMTP reply, and log the helo/sender/recipient information. Repeat this test the next time the client connects.
   - drop: Drop the connection immediately with a 521 SMTP reply. Repeat this test the next time the client connects.

In the end I think we could drop postgrey support. Postscreen replaces postgrey in its entirety, while being more selective and not delaying mail. Especially if we consider using the deep inspection options of postscreen.

Hope that wasn't too much to read! ;)

* main.cf got misformatted..
Don't know how, should be ok now.

* fixed malformatted main.cf & repaired master.cf

* reenabled rbl stuff.. It's cached, therefore doesn't hurt

* fixed tests

* added tests, repaired tests, added info, introduced new Variable POSTSCREEN_ACTION, fixes
2018-02-04 21:31:08 +01:00
Marek Walczak b4b19e76b7 Stretch backport (#813)
* install dovecot from backports

* dovecot 2.2.33 has a slightly different TLS-configuration than 2.2.27

* want to have both images a the same time

* make use of the /etc/dovecot/ssl as mkcert.sh (2.2.33) is using that folder for certs.
2018-02-04 21:27:47 +01:00
17Halbe c1e490d6b5 Added fail2ban description 2018-02-01 09:36:13 +01:00
17Halbe c2f4220016 fail2ban handling integrated in setup.sh (#797)
* fail2ban handling integrated in setup.sh

- calling \"./setup debug fail2ban\" lists all iptable chains whith blocked IPs (like: Banned in dovecot: 91.200.12.164
										       Banned in postfix-sasl: 91.200.12.164)
- calling \"./setup debug fail2ban unban xxx.xxx.xxx.xxx [yyy.yyy.yyy.yyy ...]\" unbans/removes those IPs from all jails.
- calling \"./setup debug fail2ban unban\" (without an IP) gives an descriptive error: (You need to specify an IP address. Run "./setup.sh debug fail2ban" to get a list of banned IP addresses.)

* disable_vrfy_command: (#798)

Prevents Spammers from collecting existing mail-addresses by probing the mailserver for them.

* Added support for Dovecot and Postfix LDAP TLS (#800)

* Allow setup of LDAP STARTTLS for Dovecot and Postfix

* Added tests for TLS config override

* Add missing Postfix TLS options

* Added missing new line at the end of the file

* Added STARTTLS tests for Postfix config

* tests added
and made the script output look more shiny.

* setup.sh enhancements
2018-01-31 22:25:29 +01:00
17Halbe b14249faf2 Updated Setup docker mailserver using the script setup.sh (markdown) 2018-01-30 18:05:00 +01:00
Hugues Granger b0532e3d88 AWS_SES_PORT was implemented, but wiki not updated 2018-01-26 18:32:53 +01:00
Mathieu Brunot d270fcdd40 Added support for Dovecot and Postfix LDAP TLS (#800)
* Allow setup of LDAP STARTTLS for Dovecot and Postfix

* Added tests for TLS config override

* Add missing Postfix TLS options

* Added missing new line at the end of the file

* Added STARTTLS tests for Postfix config
2018-01-25 22:38:41 +01:00
17Halbe eea4ec1dbc disable_vrfy_command: (#798)
Prevents Spammers from collecting existing mail-addresses by probing the mailserver for them.
2018-01-25 08:32:00 +01:00
Johan Smits 84c0d23a80 Remove no mail option. 2018-01-09 08:39:54 +01:00
Sylvain Benner 0748734b19 Add requirements to README (#789) 2018-01-09 08:31:15 +01:00
Steve Johnson 55b0a5bfb8 Updated Debugging (markdown) 2018-01-01 21:07:54 -07:00