1
0
mirror of https://github.com/tomav/docker-mailserver.git synced 2024-06-30 21:21:31 +02:00
Commit Graph

181 Commits

Author SHA1 Message Date
17Halbe
2167108ec0 introducing ENABLE_SRS env variable (Closes: #906, #852)
* making postsrsd optional
* added tests, added documentation
2018-03-18 20:15:06 +01:00
akmet
a420b15370 Adding daily mail review from Issue 839 (#881)
* Added dependencies, binary, startup configuration
* Added env variable to dist files/readme
* send summary after each logrotate, added env variable for mail/logrotate interval
* remove mail.log from rsyslogs logrotate
* rotate mail.log when no email is set
* Added documentation for POSTFIX_LOGROTATE_INTERVAL
* Removed interval option, since its not being tested for.
* changed test to force logrotate to rotate fixed logrotate config
* readded setup_environment, made logrotate_setup being called everytime
* changed documentation for new variable names - again
* Did Documentation, added a default recipient, added test for default config.
* layout fix
* changed variable names apposite the documentation
2018-03-18 19:52:28 +01:00
akmet
68aaeba59f added error messages to letsencrypt on startup (#898) 2018-03-15 08:01:44 +01:00
17Halbe
570237232c Delmailuser (Closes: #878)
* delmailuser:
  + added multiple address deletion
  + added alias deletion
  + added maildir deletion (upon confirmation)
  + introduced optional "assume yes" argument
* updated addalias,delalias,delmailuser,updatemailuser and added modified tests
* added config check and repair to start-mailserver for old postfix-virtual.cf files
2018-03-14 20:00:38 +01:00
Johan Smits
50a76ba91e
Update docker-configomat (Resolves: #680) 2018-03-13 08:10:16 +01:00
James
ef79e9a65d Generate SRS secret on first run and store it (#891) 2018-03-10 13:41:20 +01:00
Benedict Endemann
e6c32a03e5 Add /var/lib/dovecot to mailstate persistence (Closes: #887)
Added `/var/lib/dovecot/` to the list of folders that get persisted in `mailstate`. So the creation of `ssl-parameters.dat` has not to be done every restart again. This may only take some dozen seconds, but can be very long on systems with high load.
2018-03-09 19:46:49 +01:00
James
2e8bb4ae34 Allow configuring SRS secrets using the environment (#885) 2018-03-08 22:51:10 +01:00
akmet
34cb3a14cc Removed unneeded check for Let's encrypt cert.pem (Closes: #843) 2018-03-07 20:21:46 +01:00
17Halbe
a73692cc9f Added reject_authenticated_sender_login_mismatch (#872)
* added reject_authenticated_sender_login_mismatch handling including tests
* removed obsolete reject_sender_login_mismatch
* introduced SPOOF_PROTECTION env variable, tests, documentation and missing documentation for TLS_LEVEL
* added missing email template
2018-03-07 19:33:43 +01:00
Alexander Elbracht
d9502ab6e7 Implement undef option for SA_SPAM_SUBJECT (#767)
* Implement undef option for SA_SPAM_SUBJECT in amavis config
* Add test for undef spam subject
2018-03-02 22:38:57 +01:00
Marek Walczak
c505177486 Dkim key size (#868)
Allow to change the keysize for the dkim key
2018-03-02 22:17:18 +01:00
Andreas Gerstmayr
2687469f38 update postmaster_address in dovecot config according to POSTMASTER_ADDRESS env var (#866)
* update postmaster_address in dovecot config according to POSTMASTER_ADDRESS env var
* tests: add another test for postmaster_address with default settings
2018-02-27 20:44:45 +01:00
Marek Walczak
c36e878d76 Nist tls (#831)
* remove two ciphers according to https://www.htbridge.com/ssl/ (NIST, HIPAA)
* added a switch via an environment variable to choose between modern and intermediate ciphers
2018-02-22 08:36:12 +01:00
Achim Christ
eb20722b80 Add environment variable to allow for customizing postsrsd's SRS_EXCLUDE_DOMAINS setting (#849, #842) 2018-02-18 20:53:13 +01:00
17Halbe
5e09074d58 postscreen implementation altered (#846)
* new setup.sh function, new tests, new script and some minor updates to main.cf
* fix for missing files
* removed obsolete test-files
* restart postfix if neccessary.
* see pr  #845
* fixed typo
* fixed branchmixup
* changed postfix reload command & changed to operate on container instead of image
* reload postfix only on adding new restriction
* main.cf is only changed when user is added.
 - Postfix reload changed
 - working on container instead of image now in setup.sh
 - added cleanup after tests
* moved cleanup to makefile
2018-02-18 13:29:43 +01:00
17Halbe
795cbf103d fixed greedy postgrey sed command (#845) 2018-02-18 10:37:31 +01:00
17Halbe
b08c9b42ed moved fail2ban function from setup.sh to own file (#837)
* moved fail2ban function out of setup.sh
2018-02-13 08:31:12 +01:00
17Halbe
5394a505b9 Restrict access (Closes #452, #816)
new setup.sh function, new tests, new script
2018-02-07 21:33:07 +01:00
H4R0
f6404156f9 Changed Junk folder to be created and subscribed by default (#806) 2018-02-06 20:21:37 +01:00
TechnicLab
f68befdbee Added reject_sender_login_mismatch (Closes: #811) 2018-02-06 19:35:32 +01:00
Jurek Barth
e1e4542390 Fix: Add SRS to fix SPF issues on redirect #611 (#814)
* add srs support

* change autorestart behavior

* this may work now

* make postsrsd’s own wrapper file

* fix dockerfile formatting

* fixing tests
2018-02-06 08:11:57 +01:00
17Halbe
3b7fc5930c Introducing Postscreen (#799)
* Introduced Postscreen

cheaper, earlier and simpler blocking of zombies/spambots.
From http://postfix.cs.utah.edu/POSTSCREEN_README.html :
As a first layer, postscreen(8) blocks connections from zombies and other spambots that are responsible for about 90% of all spam. It is implemented as a single process to make this defense as cheap as possible.

Things we need to consider:

 - Do we need a whitelist/backlist file? (http://postfix.cs.utah.edu/postconf.5.html#postscreen_access_list)
   - Via introducing an optional config/postfix-access.cidr
   - The only permanent whitelisting I could imagine are monitoring services(which might (still?) behave weird/hastely) or blacklisting backup servers(since no traffic should be coming from them anyway)
 - Do we need deep inspections? They are desireable, but these tests are expensive: a good client must disconnect after it passes the test, before it can talk to a real Postfix SMTP server. Considered tests are:
   - postscreen_bare_newline_enable (http://postfix.cs.utah.edu/postconf.5.html#postscreen_bare_newline_action)
   - postscreen_non_smtp_command_enable (http://postfix.cs.utah.edu/postconf.5.html#postscreen_non_smtp_command_action)
   - postscreen_pipelining_enable (http://postfix.cs.utah.edu/postconf.5.html#postscreen_pipelining_action)
- Do we need to make the blacklisting via dnsblocking configurable? It's currently set and weighted as follows, where a score of 3 results in blocking, a score of -1 results in whitelisting:
   (*: adds the specified weight to the SMTP client's DNSBL score. Specify a negative number for whitelisting.)
   (http://postfix.cs.utah.edu/postconf.5.html#postscreen_dnsbl_sites)
   - zen.spamhaus.org*3
   - bl.mailspike.net
   - b.barracudacentral.org*2
   - bl.spameatingmonkey.net
   - bl.spamcop.net
   - dnsbl.sorbs.net
   - psbl.surriel.com
   - list.dnswl.org=127.0.[0..255].0*-2
   - list.dnswl.org=127.0.[0..255].1*-3
   - list.dnswl.org=127.0.[0..255].[2..3]*-4
- What to do when blacklisting? I currently set it to drop. We could
   - ignore: Ignore the failure of this test. Allow other tests to complete. Repeat this test the next time the client connects. This option is useful for testing and collecting statistics without blocking mail.
   - enforce: Allow other tests to complete. Reject attempts to deliver mail with a 550 SMTP reply, and log the helo/sender/recipient information. Repeat this test the next time the client connects.
   - drop: Drop the connection immediately with a 521 SMTP reply. Repeat this test the next time the client connects.

In the end I think we could drop postgrey support. Postscreen replaces postgrey in its entirety, while being more selective and not delaying mail. Especially if we consider using the deep inspection options of postscreen.

Hope that wasn't too much to read! ;)

* main.cf got misformatted..
Don't know how, should be ok now.

* fixed malformatted main.cf & repaired master.cf

* reenabled rbl stuff.. It's cached, therefore doesn't hurt

* fixed tests

* added tests, repaired tests, added info, introduced new Variable POSTSCREEN_ACTION, fixes
2018-02-04 21:31:08 +01:00
Marek Walczak
b4b19e76b7 Stretch backport (#813)
* install dovecot from backports

* dovecot 2.2.33 has a slightly different TLS-configuration than 2.2.27

* want to have both images a the same time

* make use of the /etc/dovecot/ssl as mkcert.sh (2.2.33) is using that folder for certs.
2018-02-04 21:27:47 +01:00
Mathieu Brunot
d270fcdd40 Added support for Dovecot and Postfix LDAP TLS (#800)
* Allow setup of LDAP STARTTLS for Dovecot and Postfix

* Added tests for TLS config override

* Add missing Postfix TLS options

* Added missing new line at the end of the file

* Added STARTTLS tests for Postfix config
2018-01-25 22:38:41 +01:00
17Halbe
eea4ec1dbc disable_vrfy_command: (#798)
Prevents Spammers from collecting existing mail-addresses by probing the mailserver for them.
2018-01-25 08:32:00 +01:00
Marek Walczak
49b3867c1b debian stretch slim (#784)
* Switch to stretch-slim as base image.
 - first step correct the testdata, as newer packages are more strict
about the mail-structure.

* Switch to stretch-slim: correcting the test-environment and the build
 - add missing build-step to make
 - clean the userdb aswell
 - use timeout of netcat, as postgrey would not close the connection
 - there is 2 extra mail-logs -> assert_output 5
 - cosmetic: use "" instead of ''

* Switch to stretch-slim:
new image:
 - smaller size
 - 0 CVEs compared to 11 CVEs in ubuntu 16.04 Image
better backport situation
 - postfix 3.1.6 vs 3.1.0
 - fail2ban 0.9.6 vs 0.9.3
 ...
changes needed because of stretch-slim:
- add missing gnupg and iproute2 package
- remove non-free rar, unrar-free should do
- rsyslog does not add syslog user and has different conf-structure
- pyzor command discover was deprecated and is missing in the new
stretch package

- dovecot does not know SSLv2 anymore. removed because of warnings in
log

- iptables does not know imap3, IMAP working group chose imap2 in favor
of imap3

* Switch to debian stretch slim:
SSLv2 seems to be a not known protocol anymore - good!

* switch to debian stretch slim:
make this test more stable. there might be more than only one mail.log
(mail.info, mail.warn, ...)

* switch to debian stretc slim:
 new openssl 1.1.0 needs stronger ciphers, removed some weekers ones.
Please, look through the new list of cipher! this needs to be done in
another commit for all other SSL/TLS-Endpoints aswell.

* Switch to debian stretch slim:
let our server pre-empt the cipher list.
Did a read through, wwwDOTpostfixDOTorg/FORWARD_SECRECY_READMEDOThtml
and
wwwDOTpostfixDOTorg/TLS_READMEDOThtml

* Switch to debian stretch slim: lets give this openssl-based test a new and independent but identical container.  many other test on the main 'mail' container might interfere here.

* Switch to debian stretch slim: remove unused lines
2017-12-31 12:33:48 +01:00
Toru Hisai
b0526d0afe fix arguments for [ command (#783) 2017-12-31 10:49:15 +01:00
Alessio Nava
c26d02a910 Changed omitted headers for DKIM with mailtrain (#774)
Added List-ID and List-Unsubscribe omitted headers for DKIM verification.
2017-12-18 21:55:50 +01:00
Damian Moore
01a41e9d93 Use PCRE for alias regular expressions instead of the basic type (#751) 2017-12-07 19:44:45 +01:00
Marek Walczak
d62ea049e6 Add ability to override fail2ban.conf with fail2ban.local values. (#769)
* Add ability to override fail2ban.conf with fail2ban.local values.
2017-12-07 19:27:31 +01:00
kamuri
835939d856 Issue 747 (#748)
* fix for issue #747 (NOT TESTED YET)

Need to test this. Dont merge it yet.

* Small Cleanup and bug fixes Not done Yet!

Not done yet. Dont merge. See comment in issue #747

* Add --ignore-missing. Now is fixed.
2017-10-18 07:43:30 +02:00
kamuri
420e7741a1 Check for account changes and reload (Closes: #552)
Restart the daemons when changes are made to 'postfix-account.cf' and/or 'postfix-virtual.cf'
2017-10-10 08:15:18 +02:00
Johan Smits
c7311f280f Fix spamassassin directory typo (Closes: #739) 2017-10-08 14:47:45 +02:00
Darren McGrandle
5961b31e91 Enable user definable fetchmail poll times (#731)
* Enable user definable fetchmail poll times
* create new ENV variable FETCHMAIL_POLL in target/start-mailserver.sh
* change --daemon setting in supervisor-app.conf to use ENV var
* Put FETCHMAIL_POLL env variable in Dockerfile to handle case where
  user does not specify it in their docker-compose.yml
2017-10-04 22:10:18 +02:00
Johan Smits
a2efdab5dd Merge pull request #719 from johansmitsnl/supervisor-sock (closes: #707)
fix(): Supervisor socket issue with overlay (closes: #707)
2017-09-17 08:58:46 +02:00
Jean-Sebastien Legare
c4cf848826 [opendmarc] Skip dmarc checks for email sent over authenticated sockets
opendmarc checks fail for mail sent over (SMTP AUTH) submission
   ports. Adding this directive skips checks for those emails, and
   clears the logs of related errors.

   See https://github.com/tomav/docker-mailserver/issues/703
2017-09-11 17:02:47 -07:00
Johan Smits
ba62096550 fix(): Supervisor socket issue with overlay 2017-09-10 15:38:21 +02:00
Johan Smits
20a6eda79b Add newline to the end of the file 2017-09-10 09:52:22 +02:00
Hannu Shemeikka
984537526a New command: generate-dkim-domain
This command can be used for generating DKIM key for a domain,
which is not included in any configuration files. For example,
when using SQL database for transport maps.
2017-09-09 23:35:26 +03:00
Johan Smits
97e296162f Merge pull request #710 from johansmitsnl/improve-security-dhparams
Generate a new dhparams file if one_dir is set. (Resolves: #530)
2017-09-08 18:51:47 +02:00
Johan Smits
4cb8f4d4ae Improve the privacy of the client by removing sensitive details 2017-09-07 19:29:50 +02:00
Johan Smits
0fe86e796b Listen also on the ssl port 465 for clients (#709) 2017-09-07 18:08:25 +02:00
Johan Smits
91d34bc54e Generate a new dhparams file if one_dir is set. (Resolves: #530)
This improves security because each installation has it own generated
dhparams file. See ticket #530 for more details.
2017-09-06 23:41:23 +02:00
Johan Smits
1c75cabcfd Clean any leftover pid file from a stop (#700)
* Clean any leftover pid file from a stop

* More time needed for travis. It can be busy and fail tests.
2017-08-24 18:07:20 +02:00
Johan Smits
04904e77c4 Also search on the domain name for the virtual domain name in the ldap (Solves: #638) (#642)
Added test to check email delivery for a other domain then the primary
of the mailserver.
2017-08-19 10:32:00 +02:00
Johan Smits
9e7959fafe Issue 631 run services with supervisor (#676)
* installed supervisor. Still need to set tasks to run in foreground.

* setting programs to run in foreground

* seems to work now

* cleanup

* final fixes

* tests

* show startup output on stdout

* set Dovecot config files before starting it

* make all processes log to console

* Use the supervisor as the main process. The start-mailserver is started
from the supervisord and then this process triggers others.

Defined some default variable in the Dockerfile. In order for
supervisored to build the command lines the ENV variable need to be set.
Therefore the defaults are defined.

Some processes are not single processes like postfix and fail2ban and
they have a wrapper. The wrapper takes care of proper shutdown and checking
if the process is running or not. Supervisored will restart the wrapping
script if the process is gone.

Increased some delays between tests because sometimes they where to short
for all containers to be running.

* Remove obsolete comments, reset timeout value to old one, added new lines

* Add more time for analyzing the emails.

Sometimes it fails the tests and gives a wrong state about
the test. During testing 40 seconds was the safe value.
2017-08-07 17:39:40 +02:00
Daniel Panteleit
60afbe1d16 Disable logrotate and cron job for updating clamav if clamav is disabled (fixes #660) (#667) 2017-07-23 21:31:41 +02:00
Thomas VIAL
88e3d88de1 Fixed Postgrey re-startup by reoving pid file, suggested by @Sharsie (#658)
Fixes #649
2017-07-20 10:59:41 +02:00
alinmear
dbf65789f2 Integrate docker-configomat for configuration parts of start-mailserver.sh #648 (#650)
* Add submodule docker-configomat

* Add configomat.sh to Dockerfile

* Replaced override_config with configomat.sh
2017-07-10 00:11:00 +02:00