freedombone-base-email 78KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Email functions
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2014-2017 Bob Mottram <bob@freedombone.net>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. # the default email address
  31. MY_EMAIL_ADDRESS=$MY_USERNAME@$DEFAULT_DOMAIN_NAME
  32. # If you want to run a public mailing list specify its name here.
  33. # There should be no spaces in the name
  34. PUBLIC_MAILING_LIST=
  35. # Optional different domain name for the public mailing list
  36. PUBLIC_MAILING_LIST_DOMAIN_NAME=
  37. # Directory where the public mailing list data is stored
  38. PUBLIC_MAILING_LIST_DIRECTORY="/var/spool/mlmmj"
  39. # If you want to run an encrypted mailing list specify its name here.
  40. # There should be no spaces in the name
  41. PRIVATE_MAILING_LIST=
  42. GPG_KEYSERVER="hkp://keys.gnupg.net"
  43. # whether to encrypt all incoming email with your public key
  44. GPG_ENCRYPT_STORED_EMAIL="yes"
  45. # optionally you can provide your exported GPG key pair here
  46. # Note that the private key file will be deleted after use
  47. # If these are unspecified then a new GPG key will be created
  48. MY_GPG_PUBLIC_KEY=
  49. MY_GPG_PRIVATE_KEY=
  50. # optionally specify your public key ID
  51. MY_GPG_PUBLIC_KEY_ID=
  52. EXIM_ONION_REPO="https://github.com/petterreinholdtsen/exim4-smtorp"
  53. # automatic archiving of email
  54. CLEANUP_MAILDIR_REPO="https://github.com/bashrc/cleanup-maildir"
  55. CLEANUP_MAILDIR_COMMIT='33241d2e3861f901ba17f5c77ada007e1ec06a86'
  56. # email encryption at rest
  57. GPGIT_REPO="https://gitlab.com/mikecardwell/gpgit"
  58. GPGIT_COMMIT='583dc76119f19420f8a33f606744faa7c8922738'
  59. # refresh gpg keys every few hours
  60. REFRESH_GPG_KEYS_HOURS=2
  61. function email_create_template {
  62. if [ ! -d /etc/skel/log ]; then
  63. mkdir -m 700 /etc/skel/log
  64. fi
  65. if [ ! -d /etc/skel/Maildir ]; then
  66. mkdir -m 700 /etc/skel/.mutt
  67. mkdir -m 700 /etc/skel/Maildir
  68. mkdir -m 700 /etc/skel/Maildir/new
  69. mkdir -m 700 /etc/skel/Maildir/cur
  70. mkdir -m 700 /etc/skel/Maildir/Sent
  71. mkdir -m 700 /etc/skel/Maildir/Sent/tmp
  72. mkdir -m 700 /etc/skel/Maildir/Sent/cur
  73. mkdir -m 700 /etc/skel/Maildir/Sent/new
  74. mkdir -m 700 /etc/skel/Maildir/.learn-spam
  75. mkdir -m 700 /etc/skel/Maildir/.learn-spam/cur
  76. mkdir -m 700 /etc/skel/Maildir/.learn-spam/new
  77. mkdir -m 700 /etc/skel/Maildir/.learn-spam/tmp
  78. mkdir -m 700 /etc/skel/Maildir/.learn-ham
  79. mkdir -m 700 /etc/skel/Maildir/.learn-ham/cur
  80. mkdir -m 700 /etc/skel/Maildir/.learn-ham/new
  81. mkdir -m 700 /etc/skel/Maildir/.learn-ham/tmp
  82. ln -s /etc/skel/Maildir/.learn-spam /etc/skel/Maildir/spam
  83. ln -s /etc/skel/Maildir/.learn-ham /etc/skel/Maildir/ham
  84. fi
  85. if [ ! -d /home/$MY_USERNAME/Maildir ]; then
  86. mkdir -m 700 /home/$MY_USERNAME/.mutt
  87. mkdir -m 700 /home/$MY_USERNAME/Maildir
  88. mkdir -m 700 /home/$MY_USERNAME/Maildir/cur
  89. mkdir -m 700 /home/$MY_USERNAME/Maildir/tmp
  90. mkdir -m 700 /home/$MY_USERNAME/Maildir/new
  91. mkdir -m 700 /home/$MY_USERNAME/Maildir/Sent
  92. mkdir -m 700 /home/$MY_USERNAME/Maildir/Sent/cur
  93. mkdir -m 700 /home/$MY_USERNAME/Maildir/Sent/tmp
  94. mkdir -m 700 /home/$MY_USERNAME/Maildir/Sent/new
  95. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-spam
  96. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-spam/cur
  97. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-spam/new
  98. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-spam/tmp
  99. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-ham
  100. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-ham/cur
  101. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-ham/new
  102. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-ham/tmp
  103. ln -s /home/$MY_USERNAME/Maildir/.learn-spam /home/$MY_USERNAME/Maildir/spam
  104. ln -s /home/$MY_USERNAME/Maildir/.learn-ham /home/$MY_USERNAME/Maildir/ham
  105. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/Maildir
  106. fi
  107. }
  108. function email_install_tls {
  109. # make a tls certificate for email
  110. if [ ! -f /etc/ssl/certs/exim.dhparam ]; then
  111. ${PROJECT_NAME}-addcert -h exim --dhkey $DH_KEYLENGTH
  112. check_certificates exim
  113. fi
  114. cp /etc/ssl/private/exim.key /etc/exim4
  115. cp /etc/ssl/certs/exim.crt /etc/exim4
  116. cp /etc/ssl/certs/exim.dhparam /etc/exim4
  117. chown root:Debian-exim /etc/exim4/exim.key /etc/exim4/exim.crt /etc/exim4/exim.dhparam
  118. chmod 640 /etc/exim4/exim.key /etc/exim4/exim.crt /etc/exim4/exim.dhparam
  119. sed -i '/login_saslauthd_server/,/.endif/ s/# *//' /etc/exim4/exim4.conf.template
  120. if ! grep -q "MAIN_TLS_ENABLE = true" /etc/exim4/exim4.conf.template; then
  121. sed -i "/.ifdef MAIN_HARDCODE_PRIMARY_HOSTNAME/i\MAIN_HARDCODE_PRIMARY_HOSTNAME =\nMAIN_TLS_ENABLE = true" /etc/exim4/exim4.conf.template
  122. else
  123. sed -i "s|MAIN_HARDCODE_PRIMARY_HOSTNAME =.*|MAIN_HARDCODE_PRIMARY_HOSTNAME =|g" /etc/exim4/exim4.conf.template
  124. fi
  125. sed -i "s|SMTPLISTENEROPTIONS=''|SMTPLISTENEROPTIONS='-oX 465:25:587 -oP /var/run/exim4/exim.pid'|g" /etc/default/exim4
  126. if ! grep -q "tls_on_connect_ports=465" /etc/exim4/exim4.conf.template; then
  127. sed -i '/SSL configuration for exim/i\tls_on_connect_ports=465' /etc/exim4/exim4.conf.template
  128. fi
  129. if ! grep -q "# don't send system passwords" /etc/exim4/exim4.conf.template; then
  130. sed -i "s|don't send system passwords.*|# don't send system passwords unencrypted|g" /etc/exim4/exim4.conf.template
  131. fi
  132. }
  133. function configure_email_onion {
  134. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  135. return
  136. fi
  137. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  138. return
  139. fi
  140. if ! grep -q "hidden_service_email" /etc/tor/torrc; then
  141. echo 'HiddenServiceDir /var/lib/tor/hidden_service_email/' >> /etc/tor/torrc
  142. echo 'HiddenServicePort 25 127.0.0.1:25' >> /etc/tor/torrc
  143. echo 'HiddenServicePort 587 127.0.0.1:587' >> /etc/tor/torrc
  144. echo 'HiddenServicePort 465 127.0.0.1:465' >> /etc/tor/torrc
  145. fi
  146. function_check onion_update
  147. onion_update
  148. function_check wait_for_onion_service
  149. wait_for_onion_service email
  150. if [ ! -f /var/lib/tor/hidden_service_email/hostname ]; then
  151. echo $"email onion site hostname not found"
  152. systemctl restart tor
  153. exit 782352
  154. fi
  155. onion_address=$(cat /var/lib/tor/hidden_service_email/hostname)
  156. set_completion_param "email onion domain" "${onion_address}"
  157. add_email_hostname "$onion_address"
  158. mark_completed $FUNCNAME
  159. }
  160. function check_email_address_exists {
  161. read_config_param ONION_ONLY
  162. read_config_param MY_USERNAME
  163. read_config_param DEFAULT_DOMAIN_NAME
  164. read_config_param MY_EMAIL_ADDRESS
  165. read_config_param DH_KEYLENGTH
  166. if [ ! $MY_USERNAME ]; then
  167. echo $'No username for email installation'
  168. exit 73672
  169. fi
  170. if [ ! $DEFAULT_DOMAIN_NAME ]; then
  171. echo $'No default domain name for email installation'
  172. exit 57634
  173. fi
  174. my_email="$MY_EMAIL_ADDRESS"
  175. if [ ${#my_email} -lt 3 ]; then
  176. MY_EMAIL_ADDRESS=${MY_USERNAME}@${DEFAULT_DOMAIN_NAME}
  177. write_config_param "MY_EMAIL_ADDRESS" "$MY_EMAIL_ADDRESS"
  178. fi
  179. }
  180. function backup_email {
  181. echo ''
  182. }
  183. function configure_firewall_for_email {
  184. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  185. # docker does its own firewalling
  186. return
  187. fi
  188. if [[ $ONION_ONLY != "no" ]]; then
  189. return
  190. fi
  191. firewall_add Email 25 tcp
  192. firewall_add Email 587 tcp
  193. firewall_add Email 465 tcp
  194. firewall_add Imap 993 tcp
  195. }
  196. function encrypt_incoming_email {
  197. # encrypts incoming mail using your GPG public key
  198. # so even if an attacker gains access to the data at rest they still need
  199. # to know your GPG key password to be able to read anything
  200. if [ ! -d /etc/exim4 ]; then
  201. return
  202. fi
  203. # update to the next commit
  204. function_check set_repo_commit
  205. set_repo_commit $INSTALL_DIR/gpgit "gpgit commit" "$GPGIT_COMMIT" $GPGIT_REPO
  206. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  207. return
  208. fi
  209. if [[ $GPG_ENCRYPT_STORED_EMAIL != "yes" ]]; then
  210. return
  211. fi
  212. if [ ! -f /usr/bin/gpgit.pl ]; then
  213. apt-get -yq install git libmail-gnupg-perl
  214. cd $INSTALL_DIR
  215. function_check git_clone
  216. git_clone $GPGIT_REPO $INSTALL_DIR/gpgit
  217. cd $INSTALL_DIR/gpgit
  218. git checkout $GPGIT_COMMIT -b $GPGIT_COMMIT
  219. set_completion_param "gpgit commit" "$GPGIT_COMMIT"
  220. cp gpgit.pl /usr/bin
  221. fi
  222. # add a procmail rule
  223. if ! grep -q "/usr/bin/gpgit.pl" /home/$MY_USERNAME/.procmailrc; then
  224. echo '' >> /home/$MY_USERNAME/.procmailrc
  225. echo ':0 f' >> /home/$MY_USERNAME/.procmailrc
  226. echo "| /usr/bin/gpgit.pl --encrypt-mode prefer-inline --inline-flatten $MY_EMAIL_ADDRESS" >> /home/$MY_USERNAME/.procmailrc
  227. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.procmailrc
  228. echo '' >> /etc/skel/.procmailrc
  229. echo ':0 f' >> /etc/skel/.procmailrc
  230. echo -n '| /usr/bin/gpgit.pl --encrypt-mode prefer-inline --inline-flatten $USER@' >> /etc/skel/.procmailrc
  231. echo "$DEFAULT_DOMAIN_NAME" >> /etc/skel/.procmailrc
  232. fi
  233. mark_completed $FUNCNAME
  234. }
  235. function encrypt_outgoing_email {
  236. # encrypts outgoing mail using your GPG public key
  237. # so even if an attacker gains access to the data at rest they still need
  238. # to know your GPG key password to be able to read sent mail
  239. if [ ! -d /etc/exim4 ]; then
  240. return
  241. fi
  242. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  243. return
  244. fi
  245. if [[ $GPG_ENCRYPT_STORED_EMAIL != "yes" ]]; then
  246. return
  247. fi
  248. if [ ! -d /home/$MY_USERNAME/.gnupg ]; then
  249. return
  250. fi
  251. if [ ! -f /home/$MY_USERNAME/.muttrc ]; then
  252. return
  253. fi
  254. # obtain your public key ID
  255. if [ ! $MY_GPG_PUBLIC_KEY_ID ]; then
  256. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  257. if [ ! "$MY_GPG_PUBLIC_KEY_ID" ]; then
  258. return
  259. fi
  260. if [ ${#MY_GPG_PUBLIC_KEY_ID} -lt 4 ]; then
  261. return
  262. fi
  263. fi
  264. if ! grep -q "pgp_encrypt_only_command" /home/$MY_USERNAME/.muttrc; then
  265. echo '' >> /home/$MY_USERNAME/.muttrc
  266. echo $'# Encrypt items in the Sent folder' >> /home/$MY_USERNAME/.muttrc
  267. echo "set pgp_encrypt_only_command=\"/usr/lib/mutt/pgpewrap gpg --batch --quiet --no-verbose --output - --encrypt --textmode --armor --trust-model always --encrypt-to $MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"" >> /home/$MY_USERNAME/.muttrc
  268. else
  269. sed -i "s|set pgp_encrypt_only_command.*|set pgp_encrypt_only_command=\"/usr/lib/mutt/pgpewrap gpg --batch --quiet --no-verbose --output - --encrypt --textmode --armor --trust-model always --encrypt-to $MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"|g" /home/$MY_USERNAME/.muttrc
  270. fi
  271. if ! grep -q "pgp_encrypt_sign_command" /home/$MY_USERNAME/.muttrc; then
  272. echo "set pgp_encrypt_sign_command=\"/usr/lib/mutt/pgpewrap gpg %?p?--passphrase-fd 0? --batch --quiet --no-verbose --textmode --output - --encrypt --sign %?a?-u %a? --armor --trust-model always --encrypt-to $MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"" >> /home/$MY_USERNAME/.muttrc
  273. else
  274. sed -i "s|set pgp_encrypt_sign_command.*|set pgp_encrypt_sign_command=\"/usr/lib/mutt/pgpewrap gpg %?p?--passphrase-fd 0? --batch --quiet --no-verbose --textmode --output - --encrypt --sign %?a?-u %a? --armor --trust-model always --encrypt-to $MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"|g" /home/$MY_USERNAME/.muttrc
  275. fi
  276. mark_completed $FUNCNAME
  277. }
  278. function encrypt_all_email {
  279. if [ ! -d /etc/exim4 ]; then
  280. return
  281. fi
  282. if [[ $GPG_ENCRYPT_STORED_EMAIL != "yes" ]]; then
  283. return
  284. fi
  285. if [ -f /usr/local/bin/${PROJECT_NAME}-encrypt-mail ]; then
  286. if [ ! -f /usr/bin/encmaildir ]; then
  287. cp /usr/local/bin/${PROJECT_NAME}-encrypt-mail /usr/bin/encmaildir
  288. else
  289. HASH1=$(sha256sum /usr/local/bin/${PROJECT_NAME}-encrypt-mail | awk -F ' ' '{print $1}')
  290. HASH2=$(sha256sum /usr/bin/encmaildir | awk -F ' ' '{print $1}')
  291. if [[ "$HASH1" != "$HASH2" ]]; then
  292. cp /usr/local/bin/${PROJECT_NAME}-encrypt-mail /usr/bin/encmaildir
  293. fi
  294. fi
  295. else
  296. if [ ! -f /usr/bin/encmaildir ]; then
  297. cp /usr/bin/${PROJECT_NAME}-encrypt-mail /usr/bin/encmaildir
  298. else
  299. HASH1=$(sha256sum /usr/bin/${PROJECT_NAME}-encrypt-mail | awk -F ' ' '{print $1}')
  300. HASH2=$(sha256sum /usr/bin/encmaildir | awk -F ' ' '{print $1}')
  301. if [[ "$HASH1" != "$HASH2" ]]; then
  302. cp /usr/bin/${PROJECT_NAME}-encrypt-mail /usr/bin/encmaildir
  303. fi
  304. fi
  305. fi
  306. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  307. return
  308. fi
  309. if [ ! /home/$MY_USERNAME/README ]; then
  310. touch /home/$MY_USERNAME/README
  311. fi
  312. if ! grep -q $"If you have imported legacy email which is not encrypted" /home/$MY_USERNAME/README; then
  313. echo '' >> /home/$MY_USERNAME/README
  314. echo '' >> /home/$MY_USERNAME/README
  315. echo $'# Encrypting legacy email' >> /home/$MY_USERNAME/README
  316. echo $'If you have imported legacy email which is not encrypted' >> /home/$MY_USERNAME/README
  317. echo $'then it can be encrypted with the command:' >> /home/$MY_USERNAME/README
  318. echo '' >> /home/$MY_USERNAME/README
  319. echo ' encmaildir' >> /home/$MY_USERNAME/README
  320. echo '' >> /home/$MY_USERNAME/README
  321. echo $'But be warned that depending upon how much email you have' >> /home/$MY_USERNAME/README
  322. echo $'this could take a seriously LONG time on the Beaglebone' >> /home/$MY_USERNAME/README
  323. echo $'and may be better done on a faster machine.' >> /home/$MY_USERNAME/README
  324. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/README
  325. chmod 600 /home/$MY_USERNAME/README
  326. fi
  327. mark_completed $FUNCNAME
  328. }
  329. function email_client {
  330. if [ ! -d /etc/exim4 ]; then
  331. return
  332. fi
  333. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  334. return
  335. fi
  336. apt-get -yq install lynx abook urlview mutt
  337. if [ ! -f /etc/Muttrc ]; then
  338. echo $"ERROR: Mutt does not appear to have installed. $CHECK_MESSAGE"
  339. exit 49
  340. fi
  341. if [ ! -d /home/$MY_USERNAME/.mutt ]; then
  342. mkdir /home/$MY_USERNAME/.mutt
  343. fi
  344. echo "text/html; lynx -dump -width=78 -nolist %s | sed ‘s/^ //’; copiousoutput; needsterminal; nametemplate=%s.html" > /home/$MY_USERNAME/.mutt/mailcap
  345. cp /home/$MY_USERNAME/.mutt/mailcap /etc/skel/.mutt
  346. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.mutt
  347. chown -R root:root /etc/skel/.mutt
  348. echo 'set mbox_type=Maildir' >> /etc/Muttrc
  349. echo 'set folder="~/Maildir"' >> /etc/Muttrc
  350. echo 'set mask="!^\\.[^.]"' >> /etc/Muttrc
  351. echo 'set mbox="~/Maildir"' >> /etc/Muttrc
  352. echo 'set record="+Sent"' >> /etc/Muttrc
  353. echo 'set postponed="+Drafts"' >> /etc/Muttrc
  354. echo 'set trash="+Trash"' >> /etc/Muttrc
  355. echo 'set spoolfile="~/Maildir"' >> /etc/Muttrc
  356. echo 'auto_view text/x-vcard text/html text/enriched' >> /etc/Muttrc
  357. echo 'set header_cache="+.cache"' >> /etc/Muttrc
  358. echo 'set markers=no' >> /etc/Muttrc
  359. echo '' >> /etc/Muttrc
  360. echo '# ctrl-u to view long URLs' >> /etc/Muttrc
  361. echo 'macro pager \cu <pipe-entry>"urlview"<enter> "Follow links with urlview"' >> /etc/Muttrc
  362. echo '' >> /etc/Muttrc
  363. echo 'macro index S "<tag-prefix><decode-save>=.learn-spam<enter>" "move to learn-spam"' >> /etc/Muttrc
  364. echo 'macro pager S "<decode-save>=.learn-spam<enter>" "move to learn-spam"' >> /etc/Muttrc
  365. echo 'macro index H "<tag-prefix><decode-copy>=.learn-ham<enter>" "copy to learn-ham"' >> /etc/Muttrc
  366. echo 'macro pager H "<decode-copy>=.learn-ham<enter>" "copy to learn-ham"' >> /etc/Muttrc
  367. echo '' >> /etc/Muttrc
  368. echo '# set up the sidebar' >> /etc/Muttrc
  369. echo 'set sidebar_width=22' >> /etc/Muttrc
  370. echo 'set sidebar_visible=yes' >> /etc/Muttrc
  371. echo '' >> /etc/Muttrc
  372. echo 'set rfc2047_parameters' >> /etc/Muttrc
  373. echo '' >> /etc/Muttrc
  374. echo '# Show inbox and sent items' >> /etc/Muttrc
  375. echo 'mailboxes = =admin =Sent =maybe-spam =spam' >> /etc/Muttrc
  376. echo '' >> /etc/Muttrc
  377. echo '# Alter these colours as needed for maximum bling' >> /etc/Muttrc
  378. echo 'color sidebar_new yellow default' >> /etc/Muttrc
  379. echo 'color normal white default' >> /etc/Muttrc
  380. echo 'color hdrdefault brightcyan default' >> /etc/Muttrc
  381. echo 'color signature green default' >> /etc/Muttrc
  382. echo 'color attachment brightyellow default' >> /etc/Muttrc
  383. echo 'color quoted green default' >> /etc/Muttrc
  384. echo 'color quoted1 white default' >> /etc/Muttrc
  385. echo 'color tilde blue default' >> /etc/Muttrc
  386. echo '' >> /etc/Muttrc
  387. echo '# ctrl-n, ctrl-p to select next, prev folder' >> /etc/Muttrc
  388. echo '# ctrl-o to open selected folder' >> /etc/Muttrc
  389. echo 'bind index \Cp sidebar-prev' >> /etc/Muttrc
  390. echo 'bind index \Cn sidebar-next' >> /etc/Muttrc
  391. echo 'bind index \Co sidebar-open' >> /etc/Muttrc
  392. echo 'bind pager \Cp sidebar-prev' >> /etc/Muttrc
  393. echo 'bind pager \Cn sidebar-next' >> /etc/Muttrc
  394. echo 'bind pager \Co sidebar-open' >> /etc/Muttrc
  395. echo '' >> /etc/Muttrc
  396. echo '# ctrl-b toggles sidebar visibility' >> /etc/Muttrc
  397. echo "macro index,pager \Cb '<enter-command>toggle sidebar_visible<enter><redraw-screen>' 'toggle sidebar'" >> /etc/Muttrc
  398. echo '' >> /etc/Muttrc
  399. echo '# esc-m Mark new messages as read' >> /etc/Muttrc
  400. echo 'macro index <esc>m "T~N<enter>;WNT~O<enter>;WO\CT~T<enter>" "mark all messages read"' >> /etc/Muttrc
  401. echo '' >> /etc/Muttrc
  402. echo '# Collapsing threads' >> /etc/Muttrc
  403. echo 'macro index [ "<collapse-thread>" "collapse/uncollapse thread"' >> /etc/Muttrc
  404. echo 'macro index ] "<collapse-all>" "collapse/uncollapse all threads"' >> /etc/Muttrc
  405. echo '' >> /etc/Muttrc
  406. echo '# threads containing new messages' >> /etc/Muttrc
  407. echo 'uncolor index "~(~N)"' >> /etc/Muttrc
  408. echo 'color index brightblue default "~(~N)"' >> /etc/Muttrc
  409. echo '' >> /etc/Muttrc
  410. echo '# new messages themselves' >> /etc/Muttrc
  411. echo 'uncolor index "~N"' >> /etc/Muttrc
  412. echo 'color index brightyellow default "~N"' >> /etc/Muttrc
  413. echo '' >> /etc/Muttrc
  414. echo '# GPG/PGP integration' >> /etc/Muttrc
  415. echo '# this set the number of seconds to keep in memory the passphrase used to encrypt/sign' >> /etc/Muttrc
  416. echo 'set pgp_timeout=1800' >> /etc/Muttrc
  417. echo '' >> /etc/Muttrc
  418. echo '# automatically sign and encrypt with PGP/MIME' >> /etc/Muttrc
  419. echo 'set pgp_autosign # autosign all outgoing mails' >> /etc/Muttrc
  420. echo 'set pgp_autoencrypt # Try to encrypt automatically' >> /etc/Muttrc
  421. echo 'set pgp_replyencrypt # autocrypt replies to crypted' >> /etc/Muttrc
  422. echo 'set pgp_replysign # autosign replies to signed' >> /etc/Muttrc
  423. echo 'set pgp_auto_decode=yes # decode attachments' >> /etc/Muttrc
  424. echo 'set fcc_clear=no # Keep encrypted copy of sent encrypted mail' >> /etc/Muttrc
  425. echo 'unset smime_is_default' >> /etc/Muttrc
  426. echo '' >> /etc/Muttrc
  427. echo 'set alias_file=~/.mutt-alias' >> /etc/Muttrc
  428. echo 'source ~/.mutt-alias' >> /etc/Muttrc
  429. echo 'set query_command= "abook --mutt-query \"%s\""' >> /etc/Muttrc
  430. echo 'macro index,pager A "<pipe-message>abook --add-email-quiet<return>" "add the sender address to abook"' >> /etc/Muttrc
  431. echo '' >> /etc/Muttrc
  432. echo '# Optional relay of SMTP via ISP' >> /etc/Muttrc
  433. echo '#set smtp_url="smtps://username:password@isp_mail_domain:465/"' >> /etc/Muttrc
  434. # For viewing long URLs
  435. echo 'REGEXP (((http|https|ftp|gopher)|mailto)[.:][^ >"\t]*|www\.[-a-z0-9.]+)[^ .,;\t>">\):]' > /home/$MY_USERNAME/.urlview
  436. echo 'COMMAND lynx -dump -width=78 -nolist %s' >> /home/$MY_USERNAME/.urlview
  437. cp -f /etc/Muttrc /home/$MY_USERNAME/.muttrc
  438. cp -f /etc/Muttrc /etc/skel/.muttrc
  439. cp -f /home/$MY_USERNAME/.urlview /etc/skel/.urlview
  440. touch /home/$MY_USERNAME/.mutt-alias
  441. cp /home/$MY_USERNAME/.mutt-alias /etc/skel/.mutt-alias
  442. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.muttrc
  443. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.mutt-alias
  444. # default user on generic images
  445. if [ -d /home/${GENERIC_IMAGE_USERNAME} ]; then
  446. cp -f /etc/Muttrc /home/${GENERIC_IMAGE_USERNAME}/.muttrc
  447. chown ${GENERIC_IMAGE_USERNAME}:${GENERIC_IMAGE_USERNAME} /home/${GENERIC_IMAGE_USERNAME}/.muttrc
  448. touch /home/${GENERIC_IMAGE_USERNAME}/.mutt-alias
  449. chown ${GENERIC_IMAGE_USERNAME}:${GENERIC_IMAGE_USERNAME} /home/${GENERIC_IMAGE_USERNAME}/.mutt-alias
  450. fi
  451. mark_completed $FUNCNAME
  452. }
  453. function email_archiving {
  454. if [ ! -d /etc/exim4 ]; then
  455. return
  456. fi
  457. # ensure that the mail archive script is up to date
  458. if [ -f /usr/local/bin/${PROJECT_NAME}-archive-mail ]; then
  459. if [ ! -f /etc/cron.daily/archivemail ]; then
  460. cp /usr/local/bin/${PROJECT_NAME}-archive-mail /etc/cron.daily/archivemail
  461. chmod +x /etc/cron.daily/archivemail
  462. else
  463. HASH1=$(sha256sum /usr/local/bin/${PROJECT_NAME}-archive-mail | awk -F ' ' '{print $1}')
  464. HASH2=$(sha256sum /etc/cron.daily/archivemail | awk -F ' ' '{print $1}')
  465. if [[ "$HASH1" != "$HASH2" ]]; then
  466. cp /usr/local/bin/${PROJECT_NAME}-archive-mail /etc/cron.daily/archivemail
  467. chmod +x /etc/cron.daily/archivemail
  468. fi
  469. fi
  470. else
  471. if [ -f /usr/bin/${PROJECT_NAME}-archive-mail ]; then
  472. if [ ! -f /etc/cron.daily/archivemail ]; then
  473. cp /usr/bin/${PROJECT_NAME}-archive-mail /etc/cron.daily/archivemail
  474. chmod +x /etc/cron.daily/archivemail
  475. else
  476. HASH1=$(sha256sum /usr/local/bin/${PROJECT_NAME}-archive-mail | awk -F ' ' '{print $1}')
  477. HASH2=$(sha256sum /etc/cron.daily/archivemail | awk -F ' ' '{print $1}')
  478. if [[ "$HASH1" != "$HASH2" ]]; then
  479. cp /usr/local/bin/${PROJECT_NAME}-archive-mail /etc/cron.daily/archivemail
  480. chmod +x /etc/cron.daily/archivemail
  481. fi
  482. fi
  483. else
  484. echo "/usr/bin/${PROJECT_NAME}-archive-mail was not found. ${PROJECT_NAME} might not have fully installed."
  485. exit 62379
  486. fi
  487. fi
  488. # update to the next commit
  489. function_check set_repo_commit
  490. set_repo_commit $INSTALL_DIR/cleanup-maildir "cleanup-maildir commit" "$CLEANUP_MAILDIR_COMMIT" $CLEANUP_MAILDIR_REPO
  491. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  492. return
  493. fi
  494. if [ ! -d $INSTALL_DIR ]; then
  495. mkdir $INSTALL_DIR
  496. fi
  497. cd $INSTALL_DIR
  498. function_check git_clone
  499. git_clone $CLEANUP_MAILDIR_REPO $INSTALL_DIR/cleanup-maildir
  500. cd $INSTALL_DIR/cleanup-maildir
  501. git checkout $CLEANUP_MAILDIR_COMMIT -b $CLEANUP_MAILDIR_COMMIT
  502. set_completion_param "cleanup-maildir commit" "$CLEANUP_MAILDIR_COMMIT"
  503. if [ ! -f /usr/bin/cleanup-maildir ]; then
  504. cp $INSTALL_DIR/cleanup-maildir/cleanup-maildir /usr/bin
  505. else
  506. HASH1=$(sha256sum $INSTALL_DIR/cleanup-maildir/cleanup-maildir | awk -F ' ' '{print $1}')
  507. HASH2=$(sha256sum /usr/bin/cleanup-maildir | awk -F ' ' '{print $1}')
  508. if [[ "$HASH1" != "$HASH2" ]]; then
  509. cp $INSTALL_DIR/cleanup-maildir/cleanup-maildir /usr/bin
  510. fi
  511. fi
  512. mark_completed $FUNCNAME
  513. }
  514. # Ensure that the from field is correct when sending email from Mutt
  515. function email_from_address {
  516. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  517. return
  518. fi
  519. if [ ! -f /home/$MY_USERNAME/.muttrc ]; then
  520. return
  521. fi
  522. if grep -q "set from=" /home/$MY_USERNAME/.muttrc; then
  523. sed -i "s|set from=.*|set from='$MY_NAME <$MY_EMAIL_ADDRESS>'|g" /home/$MY_USERNAME/.muttrc
  524. else
  525. echo "set from='$MY_NAME <$MY_EMAIL_ADDRESS>'" >> /home/$MY_USERNAME/.muttrc
  526. fi
  527. mark_completed $FUNCNAME
  528. }
  529. function create_public_mailing_list {
  530. if [ ! -d /etc/exim4 ]; then
  531. return
  532. fi
  533. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  534. return
  535. fi
  536. if [ ! $PUBLIC_MAILING_LIST ]; then
  537. return
  538. fi
  539. # does the mailing list have a separate domain name?
  540. if [ ! $PUBLIC_MAILING_LIST_DOMAIN_NAME ]; then
  541. PUBLIC_MAILING_LIST_DOMAIN_NAME=$DEFAULT_DOMAIN_NAME
  542. fi
  543. PUBLIC_MAILING_LIST_USER="mlmmj"
  544. apt-get -yq install mlmmj
  545. adduser --system $PUBLIC_MAILING_LIST_USER
  546. addgroup $PUBLIC_MAILING_LIST_USER
  547. adduser $PUBLIC_MAILING_LIST_USER $PUBLIC_MAILING_LIST_USER
  548. echo ''
  549. echo $"Creating the $PUBLIC_MAILING_LIST mailing list"
  550. echo ''
  551. # create the list
  552. mlmmj-make-ml -a -L "$PUBLIC_MAILING_LIST" -c $PUBLIC_MAILING_LIST_USER
  553. echo 'SYSTEM_ALIASES_PIPE_TRANSPORT = address_pipe' > /etc/exim4/conf.d/main/000_localmacros
  554. echo "SYSTEM_ALIASES_USER = $PUBLIC_MAILING_LIST_USER" >> /etc/exim4/conf.d/main/000_localmacros
  555. echo "SYSTEM_ALIASES_GROUP = $PUBLIC_MAILING_LIST_USER" >> /etc/exim4/conf.d/main/000_localmacros
  556. # router
  557. echo 'mlmmj_router:' > /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  558. echo ' debug_print = "R: mlmmj_router for $local_part@$domain"' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  559. echo ' driver = accept' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  560. echo ' domains = +mlmmj_domains' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  561. echo ' #require_files = MLMMJ_HOME/${lc::$local_part}' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  562. echo ' # Use this instead, if you dont want to give Exim rx rights to mlmmj spool.' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  563. echo ' # Exim will then spawn a new process running under the UID of "mlmmj".' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  564. echo ' require_files = mlmmj:MLMMJ_HOME/${lc::$local_part}' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  565. echo ' local_part_suffix = +*' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  566. echo ' local_part_suffix_optional' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  567. echo ' headers_remove = Delivered-To' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  568. echo ' headers_add = Delivered-To: $local_part$local_part_suffix@$domain' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  569. echo ' transport = mlmmj_transport' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  570. # transport
  571. echo 'mlmmj_transport:' > /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  572. echo ' debug_print = "T: mlmmj_transport for $local_part@$domain"' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  573. echo ' driver = pipe' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  574. echo ' return_path_add' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  575. echo ' user = mlmmj' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  576. echo ' group = mlmmj' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  577. echo ' home_directory = MLMMJ_HOME' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  578. echo ' current_directory = MLMMJ_HOME' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  579. echo ' command = /usr/bin/mlmmj-receive -F -L MLMMJ_HOME/${lc:$local_part}' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  580. if ! grep -q "MLMMJ_HOME=/var/spool/mlmmj" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs; then
  581. sed -i '/MAIN CONFIGURATION SETTINGS/a\MLMMJ_HOME=/var/spool/mlmmj' /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs
  582. fi
  583. if ! grep -q "domainlist mlmmj_domains =" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs; then
  584. sed -i "/MLMMJ_HOME/a\domainlist mlmmj_domains = $PUBLIC_MAILING_LIST_DOMAIN_NAME" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs
  585. fi
  586. if ! grep -q "delay_warning_condition =" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs; then
  587. sed -i '/domainlist mlmmj_domains =/a\delay_warning_condition = ${if match_domain{$domain}{+mlmmj_domains}{no}{yes}}' /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs
  588. fi
  589. if ! grep -q ": +mlmmj_domains" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs; then
  590. sed -i 's/domainlist relay_to_domains = MAIN_RELAY_TO_DOMAINS/domainlist relay_to_domains = MAIN_RELAY_TO_DOMAINS : +mlmmj_domains/g' /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs
  591. fi
  592. if ! grep -q "! +mlmmj_domains" /etc/exim4/conf.d/router/200_exim4-config_primary; then
  593. sed -i 's/domains = ! +local_domains/domains = ! +mlmmj_domains : ! +local_domains/g' /etc/exim4/conf.d/router/200_exim4-config_primary
  594. fi
  595. update-exim4.conf.template -r
  596. update-exim4.conf
  597. systemctl restart exim4
  598. if ! grep -q $"$PUBLIC_MAILING_LIST mailing list" /home/$MY_USERNAME/README; then
  599. echo '' >> /home/$MY_USERNAME/README
  600. echo '' >> /home/$MY_USERNAME/README
  601. echo $"$PUBLIC_MAILING_LIST mailing list" >> /home/$MY_USERNAME/README
  602. echo '=================================' >> /home/$MY_USERNAME/README
  603. echo $"To subscribe to the $PUBLIC_MAILING_LIST mailing list send a" >> /home/$MY_USERNAME/README
  604. echo $"cleartext email to $PUBLIC_MAILING_LIST+subscribe@$DEFAULT_DOMAIN_NAME" >> /home/$MY_USERNAME/README
  605. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/README
  606. chmod 600 /home/$MY_USERNAME/README
  607. fi
  608. ${PROJECT_NAME}-addlist -u $MY_USERNAME -l "$PUBLIC_MAILING_LIST" -s "$PUBLIC_MAILING_LIST"
  609. mark_completed $FUNCNAME
  610. }
  611. function create_private_mailing_list {
  612. if [ ! -d /etc/exim4 ]; then
  613. return
  614. fi
  615. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  616. return
  617. fi
  618. if [ ! $PRIVATE_MAILING_LIST ]; then
  619. return
  620. fi
  621. if [[ $PRIVATE_MAILING_LIST == $MY_USERNAME ]]; then
  622. echo $'The name of the private mailing list should not be the same as your username'
  623. exit 10
  624. fi
  625. if [ ! $MY_GPG_PUBLIC_KEY ]; then
  626. echo $'To create a private mailing list you need to specify a file'
  627. echo $'containing your exported GPG key within MY_GPG_PUBLIC_KEY at'
  628. echo $'the top of the script'
  629. exit 11
  630. fi
  631. apt-get -yq install ruby ruby-dev ruby-gpgme libgpgme11-dev libmagic-dev
  632. gem install schleuder
  633. schleuder-fix-gem-dependencies
  634. schleuder-init-setup --gem
  635. # NOTE: this is version number sensitive and so might need changing
  636. ln -s /var/lib/gems/2.1.0/gems/schleuder-2.2.4 /var/lib/schleuder
  637. sed -i 's/#smtp_port: 25/smtp_port: 465/g' /etc/schleuder/schleuder.conf
  638. sed -i 's/#superadminaddr: root@localhost/superadminaddr: root@localhost' /etc/schleuder/schleuder.conf
  639. schleuder-newlist $PRIVATE_MAILING_LIST@$DEFAULT_DOMAIN_NAME -realname "$PRIVATE_MAILING_LIST" -adminaddress $MY_EMAIL_ADDRESS -initmember $MY_EMAIL_ADDRESS -initmemberkey $MY_GPG_PUBLIC_KEY -nointeractive
  640. ${PROJECT_NAME}-addemail -u $MY_USERNAME -e $PRIVATE_MAILING_LIST@$DEFAULT_DOMAIN_NAME -l $PRIVATE_MAILING_LIST
  641. echo 'schleuder:' > /etc/exim4/conf.d/router/550_exim4-config_schleuder
  642. echo ' debug_print = "R: schleuder for $local_part@$domain"' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  643. echo ' driver = accept' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  644. echo ' local_part_suffix_optional' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  645. echo ' local_part_suffix = +* : -bounce : -sendkey' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  646. echo ' domains = +local_domains' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  647. echo ' user = schleuder' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  648. echo ' group = schleuder' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  649. echo ' require_files = schleuder:+/var/lib/schleuder/$domain/${local_part}' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  650. echo ' transport = schleuder_transport' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  651. echo 'schleuder_transport:' > /etc/exim4/conf.d/transport/30_exim4-config_schleuder
  652. echo ' debug_print = "T: schleuder_transport for $local_part@$domain"' >> /etc/exim4/conf.d/transport/30_exim4-config_schleuder
  653. echo ' driver = pipe' >> /etc/exim4/conf.d/transport/30_exim4-config_schleuder
  654. echo ' home_directory = "/var/lib/schleuder/$domain/$local_part"' >> /etc/exim4/conf.d/transport/30_exim4-config_schleuder
  655. echo ' command = "/usr/bin/schleuder $local_part@$domain"' >> /etc/exim4/conf.d/transport/30_exim4-config_schleuder
  656. chown -R schleuder:schleuder /var/lib/schleuder
  657. update-exim4.conf.template -r
  658. update-exim4.conf
  659. systemctl restart exim4
  660. chmod 600 /etc/shadow
  661. chmod 600 /etc/gshadow
  662. useradd -d /var/schleuderlists -s /bin/false schleuder
  663. adduser Debian-exim schleuder
  664. usermod -a -G mail schleuder
  665. chmod 0000 /etc/shadow
  666. chmod 0000 /etc/gshadow
  667. #exim -d -bt $PRIVATE_MAILING_LIST@$DEFAULT_DOMAIN_NAME
  668. mark_completed $FUNCNAME
  669. }
  670. function split_gpg_key_into_fragments {
  671. # split the gpg key into fragments if social key management is enabled
  672. if [[ $ENABLE_SOCIAL_KEY_MANAGEMENT == "yes" ]]; then
  673. if [ $IMAGE_PASSWORD_FILE ]; then
  674. if [ -f $IMAGE_PASSWORD_FILE ]; then
  675. ${PROJECT_NAME}-splitkey -u $MY_USERNAME -e $MY_EMAIL_ADDRESS --fullname "$MY_NAME" --passwordfile $IMAGE_PASSWORD_FILE
  676. return
  677. fi
  678. fi
  679. echo 'Splitting GPG key. You may need to enter your passphrase.'
  680. ${PROJECT_NAME}-splitkey -u $MY_USERNAME -e $MY_EMAIL_ADDRESS --fullname "$MY_NAME"
  681. if [ ! -d /home/$MY_USERNAME/.gnupg_fragments ]; then
  682. echo 'Yhe GPG key could not be split'
  683. exit 86548
  684. fi
  685. fi
  686. }
  687. function import_email {
  688. if [ ! -d /etc/exim4 ]; then
  689. return
  690. fi
  691. EMAIL_COMPLETE_MSG=$"
  692. *** ${PROJECT_NAME} mailbox installation is complete ***
  693. Now on your internet router forward ports
  694. 25, 587, 465, 993 and 2222 to the ${PROJECT_NAME}
  695. "
  696. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  697. if [[ $SYSTEM_TYPE == "mail"* ]]; then
  698. function_check backup_to_friends_servers
  699. backup_to_friends_servers
  700. function_check install_tripwire
  701. install_tripwire
  702. function_check split_gpg_key_into_fragments
  703. split_gpg_key_into_fragments
  704. clear
  705. echo ''
  706. echo "$EMAIL_COMPLETE_MSG"
  707. if [ -d $USB_MOUNT ]; then
  708. umount $USB_MOUNT
  709. rm -rf $USB_MOUNT
  710. echo $' You can now remove the USB drive'
  711. fi
  712. exit 0
  713. fi
  714. return
  715. fi
  716. mark_completed $FUNCNAME
  717. if [[ $SYSTEM_TYPE == "mail"* ]]; then
  718. function_check backup_to_friends_servers
  719. backup_to_friends_servers
  720. function_check install_tripwire
  721. install_tripwire
  722. function_check split_gpg_key_into_fragments
  723. split_gpg_key_into_fragments
  724. # unmount any attached usb drive
  725. clear
  726. echo ''
  727. echo "$EMAIL_COMPLETE_MSG"
  728. echo ''
  729. if [ -d $USB_MOUNT ]; then
  730. umount $USB_MOUNT
  731. rm -rf $USB_MOUNT
  732. echo $' You can now remove the USB drive'
  733. fi
  734. exit 0
  735. fi
  736. }
  737. function remove_email {
  738. echo ''
  739. }
  740. function install_email_with_tor {
  741. apt-get -yq remove postfix
  742. apt-get -yq install exim4 sasl2-bin swaks libnet-ssleay-perl procmail xinetd
  743. if [ ! -d /etc/exim4 ]; then
  744. echo $"ERROR: Exim does not appear to have installed. $CHECK_MESSAGE"
  745. exit 48
  746. fi
  747. onion_service_name='email'
  748. if [ ! -d /var/lib/tor ]; then
  749. echo $"No Tor installation found. ${onion_service_name} onion site cannot be configured."
  750. exit 877367
  751. fi
  752. if ! grep -q "hidden_service_${onion_service_name}" /etc/tor/torrc; then
  753. echo "HiddenServiceDir /var/lib/tor/hidden_service_${onion_service_name}/" >> /etc/tor/torrc
  754. echo 'HiddenServicePort 25 127.0.0.1:25' >> /etc/tor/torrc
  755. echo 'HiddenServicePort 587 127.0.0.1:587' >> /etc/tor/torrc
  756. echo 'HiddenServicePort 465 127.0.0.1:465' >> /etc/tor/torrc
  757. echo 'HiddenServicePort 993 127.0.0.1:993' >> /etc/tor/torrc
  758. echo $"Added onion site for ${onion_service_name}"
  759. fi
  760. onion_update
  761. function_check wait_for_onion_service
  762. wait_for_onion_service ${onion_service_name}
  763. if [ ! -f /var/lib/tor/hidden_service_${onion_service_name}/hostname ]; then
  764. echo $"${onion_service_name} onion site hostname not found"
  765. exit 76362
  766. fi
  767. EMAIL_ONION_HOSTNAME=$(cat /var/lib/tor/hidden_service_${onion_service_name}/hostname)
  768. if [[ $ONION_ONLY != "no" ]]; then
  769. function_check set_hostname
  770. set_hostname ${EMAIL_ONION_HOSTNAME}
  771. MY_EMAIL_ADDRESS=${MY_USERNAME}@${DEFAULT_DOMAIN_NAME}
  772. fi
  773. set_completion_param "email onion domain" "${EMAIL_ONION_HOSTNAME}"
  774. # see https://github.com/petterreinholdtsen/exim4-smtorp
  775. echo '# tor stuff first' > /etc/exim4/conf.d/router/100_exim4-smtorp
  776. echo '#' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  777. echo '# if were submitting mail *from* a .tor/.onion address,' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  778. echo '# make sure any header lines that may give us away is' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  779. echo '# stripped out, and add a new, cryptic Message-ID.' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  780. echo '# In address_data we store the name we should HELO as.' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  781. echo 'tor_to_any:' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  782. echo ' debug_print = "R: manualroute from .onion to $local_part@$domain"' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  783. echo ' driver = manualroute' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  784. echo ' domains = ! +local_domains' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  785. echo ' condition = ${if match {$sender_address_domain}{\N.*\.(onion|tor)$\N}}' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  786. echo ' address_data = $sender_address_domain' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  787. echo ' transport = remote_smtp_onion' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  788. echo ' self = send' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  789. echo ' route_list = * localhost' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  790. echo ' headers_remove = Received:Message-ID:X-Mailer:User-Agent' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  791. echo ' headers_add = Message-ID: <${lc:${sha1:$message_id}}@$sender_address_domain>' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  792. echo '' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  793. echo '# this catches the case where were submitting mail' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  794. echo '# from a regular email address where we dont need to' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  795. echo '# rewrite any headers' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  796. echo 'any_to_tor:' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  797. echo ' debug_print = "R: manualroute for $local_part@$domain"' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  798. echo ' driver = manualroute' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  799. echo ' domains = ! +local_domains' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  800. echo ' transport = remote_smtp_onion' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  801. echo ' self = send' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  802. echo ' route_list = *.onion localhost ; *.tor localhost' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  803. echo ' address_data = $smtp_active_hostname' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  804. echo 'remote_smtp_onion:' > /etc/exim4/conf.d/transport/100_exim4-smtorp
  805. echo ' debug_print = "T: remote_smtp_onion for $local_part@$original_domain"' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  806. echo ' driver = smtp' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  807. echo '' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  808. echo ' # set helo_data to where we want to connect to,' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  809. echo ' # for the proxy program tor-smtp' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  810. echo ' helo_data = "$address_data $original_domain"' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  811. echo '' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  812. echo ' # wherever we configured our script at' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  813. echo ' port = 12668' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  814. echo '' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  815. echo ' # cannot use TLS otherwise it will EHLO again!!' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  816. echo ' hosts_avoid_tls = *' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  817. if [ ! -d $INSTALL_DIR ]; then
  818. mkdir -p $INSTALL_DIR
  819. fi
  820. cd $INSTALL_DIR
  821. function_check git_clone
  822. git_clone $EXIM_ONION_REPO $INSTALL_DIR/exim4-smtorp
  823. cd $INSTALL_DIR/exim4-smtorp/tor-smtp
  824. make
  825. if [ ! -f $INSTALL_DIR/exim4-smtorp/tor-smtp/tor-smtp ]; then
  826. echo $'Unable to make tor smtp transport'
  827. exit 52629
  828. fi
  829. if [ ! -d /usr/lib/exim4-smtorp ]; then
  830. mkdir /usr/lib/exim4-smtorp
  831. fi
  832. cp $INSTALL_DIR/exim4-smtorp/tor-smtp/tor-smtp /usr/lib/exim4-smtorp/tor-smtp
  833. if [ ! -f /usr/lib/exim4-smtorp/tor-smtp ]; then
  834. echo $'Unable to copy tor-smtp'
  835. exit 83503
  836. fi
  837. cp $INSTALL_DIR/exim4-smtorp/xinetd /etc/xinetd.d/tor-smtp
  838. if [ ! -f /etc/xinetd.d/tor-smtp ]; then
  839. echo $'Unable to copy to xinetd.d'
  840. exit 835954
  841. fi
  842. systemctl restart xinetd
  843. # configure for Maildir format
  844. sed -i 's/MAIL_DIR/#MAIL_DIR/g' /etc/login.defs
  845. sed -i 's|#MAIL_FILE.*|MAIL_FILE Maildir/|g' /etc/login.defs
  846. if ! grep -q "export MAIL" /etc/profile; then
  847. echo 'export MAIL=~/Maildir' >> /etc/profile
  848. fi
  849. sed -i 's|pam_mail.so standard|pam_mail.so dir=~/Maildir standard|g' /etc/pam.d/login
  850. sed -i 's|pam_mail.so standard noenv|pam_mail.so dir=~/Maildir standard|g' /etc/pam.d/sshd
  851. sed -i 's|pam_mail.so nopen|pam_mail.so dir=~/Maildir nopen|g' /etc/pam.d/su
  852. echo "dc_eximconfig_configtype='internet'" > /etc/exim4/update-exim4.conf.conf
  853. if [[ $ONION_ONLY == "no" ]]; then
  854. # both ICANN and onion domains
  855. echo "dc_other_hostnames='${DEFAULT_DOMAIN_NAME};mail.${DEFAULT_DOMAIN_NAME};${EMAIL_ONION_HOSTNAME}'" >> /etc/exim4/update-exim4.conf.conf
  856. else
  857. echo "dc_other_hostnames='${EMAIL_ONION_HOSTNAME}'" >> /etc/exim4/update-exim4.conf.conf
  858. fi
  859. echo "dc_local_interfaces=''" >> /etc/exim4/update-exim4.conf.conf
  860. echo "dc_readhost=''" >> /etc/exim4/update-exim4.conf.conf
  861. echo "dc_relay_domains=''" >> /etc/exim4/update-exim4.conf.conf
  862. echo "dc_minimaldns='false'" >> /etc/exim4/update-exim4.conf.conf
  863. IPv4_address=$(get_ipv4_address)
  864. IPv4_address_base=$(echo "$IPv4_address" | awk -F '.' '{print $1"."$2"."$3}')
  865. RELAY_NETS="${IPv4_address_base}.0/24"
  866. if [ $LOCAL_NETWORK_STATIC_IP_ADDRESS ]; then
  867. RELAY_NETS=$(echo $LOCAL_NETWORK_STATIC_IP_ADDRESS | awk -F '.' '{print $1 "." $2 "." $3 ".0/24"}')
  868. fi
  869. echo "dc_relay_nets='$RELAY_NETS'" >> /etc/exim4/update-exim4.conf.conf
  870. echo "dc_smarthost=''" >> /etc/exim4/update-exim4.conf.conf
  871. echo "CFILEMODE='644'" >> /etc/exim4/update-exim4.conf.conf
  872. echo "dc_use_split_config='false'" >> /etc/exim4/update-exim4.conf.conf
  873. echo "dc_hide_mailname=''" >> /etc/exim4/update-exim4.conf.conf
  874. echo "dc_mailname_in_oh='true'" >> /etc/exim4/update-exim4.conf.conf
  875. echo "dc_localdelivery='maildir_home'" >> /etc/exim4/update-exim4.conf.conf
  876. echo "dc_main_log_selector=-all" >> /etc/exim4/update-exim4.conf.conf
  877. update-exim4.conf
  878. sed -i "s/START=no/START=yes/g" /etc/default/saslauthd
  879. systemctl start saslauthd
  880. email_install_tls
  881. adduser $MY_USERNAME sasl
  882. addgroup Debian-exim sasl
  883. systemctl restart exim4
  884. email_create_template
  885. if [ -f /usr/sbin/exim ]; then
  886. chmod u+s /usr/sbin/exim
  887. fi
  888. if [ -f /usr/sbin/exim4 ]; then
  889. chmod u+s /usr/sbin/exim4
  890. fi
  891. function_check configure_firewall_for_email
  892. configure_firewall_for_email
  893. dpkg-reconfigure --frontend noninteractive exim4-config
  894. }
  895. function install_email_basic {
  896. apt-get -yq remove postfix
  897. apt-get -yq install exim4 sasl2-bin swaks libnet-ssleay-perl procmail
  898. if [ ! -d /etc/exim4 ]; then
  899. echo $"ERROR: Exim does not appear to have installed. $CHECK_MESSAGE"
  900. exit 48
  901. fi
  902. # configure for Maildir format
  903. sed -i 's/MAIL_DIR/#MAIL_DIR/g' /etc/login.defs
  904. sed -i 's|#MAIL_FILE.*|MAIL_FILE Maildir/|g' /etc/login.defs
  905. if ! grep -q "export MAIL" /etc/profile; then
  906. echo 'export MAIL=~/Maildir' >> /etc/profile
  907. fi
  908. sed -i 's|pam_mail.so standard|pam_mail.so dir=~/Maildir standard|g' /etc/pam.d/login
  909. sed -i 's|pam_mail.so standard noenv|pam_mail.so dir=~/Maildir standard|g' /etc/pam.d/sshd
  910. sed -i 's|pam_mail.so nopen|pam_mail.so dir=~/Maildir nopen|g' /etc/pam.d/su
  911. echo "dc_eximconfig_configtype='internet'" > /etc/exim4/update-exim4.conf.conf
  912. echo "dc_other_hostnames='${DEFAULT_DOMAIN_NAME};mail.${DEFAULT_DOMAIN_NAME}'" >> /etc/exim4/update-exim4.conf.conf
  913. echo "dc_local_interfaces=''" >> /etc/exim4/update-exim4.conf.conf
  914. echo "dc_readhost=''" >> /etc/exim4/update-exim4.conf.conf
  915. echo "dc_relay_domains=''" >> /etc/exim4/update-exim4.conf.conf
  916. echo "dc_minimaldns='false'" >> /etc/exim4/update-exim4.conf.conf
  917. IPv4_address=$(get_ipv4_address)
  918. IPv4_address_base=$(echo "$IPv4_address" | awk -F '.' '{print $1"."$2"."$3}')
  919. RELAY_NETS="${IPv4_address_base}.0/24"
  920. if [ $LOCAL_NETWORK_STATIC_IP_ADDRESS ]; then
  921. RELAY_NETS=$(echo $LOCAL_NETWORK_STATIC_IP_ADDRESS | awk -F '.' '{print $1 "." $2 "." $3 ".0/24"}')
  922. fi
  923. echo "dc_relay_nets='$RELAY_NETS'" >> /etc/exim4/update-exim4.conf.conf
  924. echo "dc_smarthost=''" >> /etc/exim4/update-exim4.conf.conf
  925. echo "CFILEMODE='644'" >> /etc/exim4/update-exim4.conf.conf
  926. echo "dc_use_split_config='false'" >> /etc/exim4/update-exim4.conf.conf
  927. echo "dc_hide_mailname=''" >> /etc/exim4/update-exim4.conf.conf
  928. echo "dc_mailname_in_oh='true'" >> /etc/exim4/update-exim4.conf.conf
  929. echo "dc_localdelivery='maildir_home'" >> /etc/exim4/update-exim4.conf.conf
  930. echo "dc_main_log_selector=-all" >> /etc/exim4/update-exim4.conf.conf
  931. update-exim4.conf
  932. sed -i "s/START=no/START=yes/g" /etc/default/saslauthd
  933. systemctl start saslauthd
  934. email_install_tls
  935. adduser $MY_USERNAME sasl
  936. addgroup Debian-exim sasl
  937. systemctl restart exim4
  938. email_create_template
  939. if [ -f /usr/sbin/exim ]; then
  940. chmod u+s /usr/sbin/exim
  941. fi
  942. if [ -f /usr/sbin/exim4 ]; then
  943. chmod u+s /usr/sbin/exim4
  944. fi
  945. function_check configure_firewall_for_email
  946. configure_firewall_for_email
  947. dpkg-reconfigure --frontend noninteractive exim4-config
  948. systemctl restart exim4
  949. }
  950. function email_change_relay {
  951. curr_ip_address="$1"
  952. email_relay_base=$(echo "$curr_ip_address" | awk -F '.' '{print $1"."$2"."$3}')
  953. RELAY_NETS="${email_relay_base}.0/24"
  954. sed -i "s|dc_relay_nets=.*|dc_relay_nets='$RELAY_NETS'|g" /etc/exim4/update-exim4.conf.conf
  955. dpkg-reconfigure --frontend noninteractive exim4-config
  956. }
  957. function create_procmail {
  958. if [ ! -d /etc/exim4 ]; then
  959. return
  960. fi
  961. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  962. return
  963. fi
  964. if [ ! -f /home/$MY_USERNAME/.procmailrc ]; then
  965. echo 'MAILDIR=$HOME/Maildir' > /home/$MY_USERNAME/.procmailrc
  966. echo 'DEFAULT=$MAILDIR/' >> /home/$MY_USERNAME/.procmailrc
  967. echo 'LOGFILE=$HOME/log/procmail.log' >> /home/$MY_USERNAME/.procmailrc
  968. echo 'LOGABSTRACT=all' >> /home/$MY_USERNAME/.procmailrc
  969. echo '' >> /home/$MY_USERNAME/.procmailrc
  970. echo '# Test for an empty or missing subject line' >> /home/$MY_USERNAME/.procmailrc
  971. echo 'SUBJ_=$(formail -xSubject: \' >> /home/$MY_USERNAME/.procmailrc
  972. echo " | expand | sed -e 's/^[ ]*//g' -e 's/[ ]*\$//g')" >> /home/$MY_USERNAME/.procmailrc
  973. echo ':0' >> /home/$MY_USERNAME/.procmailrc
  974. echo ' * SUBJ_ ?? ^^^^' >> /home/$MY_USERNAME/.procmailrc
  975. echo '/dev/null' >> /home/$MY_USERNAME/.procmailrc
  976. echo '' >> /home/$MY_USERNAME/.procmailrc
  977. echo $"# Tripwire reports which have no violations don't need to be logged" >> /home/$MY_USERNAME/.procmailrc
  978. echo ':0 BD:' >> /home/$MY_USERNAME/.procmailrc
  979. TRIPWIRE_VIOLATIONS_STR=$'Total violations found: 0'
  980. echo " * .*$TRIPWIRE_VIOLATIONS_STR" >> /home/$MY_USERNAME/.procmailrc
  981. echo '/dev/null' >> /home/$MY_USERNAME/.procmailrc
  982. echo '' >> /home/$MY_USERNAME/.procmailrc
  983. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.procmailrc
  984. fi
  985. mkdir -p /home/$MY_USERNAME/Maildir/admin/new
  986. mkdir -p /home/$MY_USERNAME/Maildir/admin/cur
  987. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/Maildir/admin
  988. if [ ! -f /etc/skel/.procmailrc ]; then
  989. cp /home/$MY_USERNAME/.procmailrc /etc/skel/.procmailrc
  990. chown root:root /etc/skel/.procmailrc
  991. fi
  992. if [ -f /usr/bin/procmail ]; then
  993. chmod 6755 /usr/bin/procmail
  994. fi
  995. mark_completed $FUNCNAME
  996. }
  997. function handle_admin_emails {
  998. # keep emails for root in a separate folder
  999. if [ -d /home/$MY_USERNAME/Maildir/admin ]; then
  1000. return
  1001. fi
  1002. ${PROJECT_NAME}-addemail -u $MY_USERNAME -e "root@$DEFAULT_DOMAIN_NAME" -g admin --public no
  1003. }
  1004. function spam_filtering {
  1005. if [ ! -d /etc/exim4 ]; then
  1006. return
  1007. fi
  1008. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  1009. return
  1010. fi
  1011. apt-get -yq install exim4-daemon-heavy
  1012. apt-get -yq install spamassassin
  1013. if [ ! -f /etc/default/spamassassin ]; then
  1014. echo 'Spamassassin was not installed'
  1015. exit 72570
  1016. fi
  1017. sa-update -v
  1018. sed -i 's/ENABLED=0/ENABLED=1/g' /etc/default/spamassassin
  1019. sed -i 's/# spamd_address = 127.0.0.1 783/spamd_address = 127.0.0.1 783/g' /etc/exim4/exim4.conf.template
  1020. # This configuration is based on https://wiki.debian.org/DebianSpamAssassin
  1021. sed -i 's/local_parts = postmaster/local_parts = postmaster:abuse/g' /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt
  1022. sed -i '/domains = +local_domains : +relay_to_domains/a\ set acl_m0 = rfcnames' /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt
  1023. sed -i 's/accept/accept condition = ${if eq{$acl_m0}{rfcnames} {1}{0}}/g' /etc/exim4/conf.d/acl/40_exim4-config_check_data
  1024. echo 'warn message = X-Spam-Score: $spam_score ($spam_bar)' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  1025. echo ' spam = nobody:true' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  1026. echo 'warn message = X-Spam-Flag: YES' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  1027. echo ' spam = nobody' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  1028. echo 'warn message = X-Spam-Report: $spam_report' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  1029. echo ' spam = nobody' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  1030. echo '# reject spam at high scores (> 12)' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  1031. echo 'deny message = This message scored $spam_score spam points.' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  1032. echo ' spam = nobody:true' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  1033. echo ' condition = ${if >{$spam_score_int}{120}{1}{0}}' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  1034. # procmail configuration
  1035. echo '# get spamassassin to check emails' >> /home/$MY_USERNAME/.procmailrc
  1036. echo ':0fw: .spamassassin.lock' >> /home/$MY_USERNAME/.procmailrc
  1037. echo ' * < 256000' >> /home/$MY_USERNAME/.procmailrc
  1038. echo '| spamc' >> /home/$MY_USERNAME/.procmailrc
  1039. echo '# strong spam are discarded' >> /home/$MY_USERNAME/.procmailrc
  1040. echo ':0' >> /home/$MY_USERNAME/.procmailrc
  1041. echo ' * ^X-Spam-Level: \*\*\*\*\*\*' >> /home/$MY_USERNAME/.procmailrc
  1042. echo '/dev/null' >> /home/$MY_USERNAME/.procmailrc
  1043. echo '# weak spam are kept just in case - clear this out every now and then' >> /home/$MY_USERNAME/.procmailrc
  1044. echo ':0' >> /home/$MY_USERNAME/.procmailrc
  1045. echo ' * ^X-Spam-Level: \*\*\*\*\*' >> /home/$MY_USERNAME/.procmailrc
  1046. echo 'maybe-spam/' >> /home/$MY_USERNAME/.procmailrc
  1047. echo '# otherwise, marginal spam goes here for revision' >> /home/$MY_USERNAME/.procmailrc
  1048. echo ':0' >> /home/$MY_USERNAME/.procmailrc
  1049. echo ' * ^X-Spam-Level: \*\*' >> /home/$MY_USERNAME/.procmailrc
  1050. echo 'spam/' >> /home/$MY_USERNAME/.procmailrc
  1051. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.procmailrc
  1052. echo '# get spamassassin to check emails' >> /etc/skel/.procmailrc
  1053. echo ':0fw: .spamassassin.lock' >> /etc/skel/.procmailrc
  1054. echo ' * < 256000' >> /etc/skel/.procmailrc
  1055. echo '| spamc' >> /etc/skel/.procmailrc
  1056. echo '# strong spam are discarded' >> /etc/skel/.procmailrc
  1057. echo ':0' >> /etc/skel/.procmailrc
  1058. echo ' * ^X-Spam-Level: \*\*\*\*\*\*' >> /etc/skel/.procmailrc
  1059. echo '/dev/null' >> /etc/skel/.procmailrc
  1060. echo '# weak spam are kept just in case - clear this out every now and then' >> /etc/skel/.procmailrc
  1061. echo ':0' >> /etc/skel/.procmailrc
  1062. echo ' * ^X-Spam-Level: \*\*\*\*\*' >> /etc/skel/.procmailrc
  1063. echo 'maybe-spam/' >> /etc/skel/.procmailrc
  1064. echo '# otherwise, marginal spam goes here for revision' >> /etc/skel/.procmailrc
  1065. echo ':0' >> /etc/skel/.procmailrc
  1066. echo ' * ^X-Spam-Level: \*\*' >> /etc/skel/.procmailrc
  1067. echo 'spam/' >> /etc/skel/.procmailrc
  1068. # filtering scripts
  1069. echo '#!/bin/bash' > /usr/bin/filterspam
  1070. echo 'for d in /home/*/ ; do' >> /usr/bin/filterspam
  1071. echo ' USERNAME=$(echo "$d" | awk -F '"'"'/'"'"' '"'"'{print $3}'"'"')' >> /usr/bin/filterspam
  1072. echo ' if [[ $USERNAME != "git" && $USERNAME != "go" && $USERNAME != "gogs" && $USERNAME != "sync" && $USERNAME != "tahoelafs" ]]; then' >> /usr/bin/filterspam
  1073. echo ' MAILDIR=/home/$USERNAME/Maildir/.learn-spam' >> /usr/bin/filterspam
  1074. echo ' if [ ! -d "$MAILDIR" ]; then' >> /usr/bin/filterspam
  1075. echo ' exit' >> /usr/bin/filterspam
  1076. echo ' fi' >> /usr/bin/filterspam
  1077. echo ' for f in `ls $MAILDIR/cur`' >> /usr/bin/filterspam
  1078. echo ' do' >> /usr/bin/filterspam
  1079. echo ' spamc -L spam < "$MAILDIR/cur/$f" > /dev/null' >> /usr/bin/filterspam
  1080. echo ' rm "$MAILDIR/cur/$f"' >> /usr/bin/filterspam
  1081. echo ' done' >> /usr/bin/filterspam
  1082. echo ' for f in `ls $MAILDIR/new`' >> /usr/bin/filterspam
  1083. echo ' do' >> /usr/bin/filterspam
  1084. echo ' spamc -L spam < "$MAILDIR/new/$f" > /dev/null' >> /usr/bin/filterspam
  1085. echo ' rm "$MAILDIR/new/$f"' >> /usr/bin/filterspam
  1086. echo ' done' >> /usr/bin/filterspam
  1087. echo ' fi' >> /usr/bin/filterspam
  1088. echo 'done' >> /usr/bin/filterspam
  1089. echo 'exit 0' >> /usr/bin/filterspam
  1090. echo '#!/bin/bash' > /usr/bin/filterham
  1091. echo 'for d in /home/*/ ; do' >> /usr/bin/filterham
  1092. echo ' USERNAME=$(echo "$d" | awk -F '"'"'/'"'"' '"'"'{print $3}'"'"')' >> /usr/bin/filterham
  1093. echo ' if [[ $USERNAME != "git" && $USERNAME != "go" && $USERNAME != "gogs" && $USERNAME != "sync" && $USERNAME != "tahoelafs" ]]; then' >> /usr/bin/filterham
  1094. echo ' MAILDIR=/home/$USERNAME/Maildir/.learn-ham' >> /usr/bin/filterham
  1095. echo ' if [ ! -d "$MAILDIR" ]; then' >> /usr/bin/filterham
  1096. echo ' exit' >> /usr/bin/filterham
  1097. echo ' fi' >> /usr/bin/filterham
  1098. echo ' for f in `ls $MAILDIR/cur`' >> /usr/bin/filterham
  1099. echo ' do' >> /usr/bin/filterham
  1100. echo ' spamc -L ham < "$MAILDIR/cur/$f" > /dev/null' >> /usr/bin/filterham
  1101. echo ' rm "$MAILDIR/cur/$f"' >> /usr/bin/filterham
  1102. echo ' done' >> /usr/bin/filterham
  1103. echo ' for f in `ls $MAILDIR/new`' >> /usr/bin/filterham
  1104. echo ' do' >> /usr/bin/filterham
  1105. echo ' spamc -L ham < "$MAILDIR/new/$f" > /dev/null' >> /usr/bin/filterham
  1106. echo ' rm "$MAILDIR/new/$f"' >> /usr/bin/filterham
  1107. echo ' done' >> /usr/bin/filterham
  1108. echo ' fi' >> /usr/bin/filterham
  1109. echo 'done' >> /usr/bin/filterham
  1110. echo 'exit 0' >> /usr/bin/filterham
  1111. function_check cron_add_mins
  1112. cron_add_mins 3 '/usr/bin/timeout 120 /usr/bin/filterspam'
  1113. cron_add_mins 3 '/usr/bin/timeout 120 /usr/bin/filterham'
  1114. chmod 655 /usr/bin/filterspam /usr/bin/filterham
  1115. sed -i 's/# use_bayes 1/use_bayes 1/g' /etc/mail/spamassassin/local.cf
  1116. sed -i 's/# bayes_auto_learn 1/bayes_auto_learn 1/g' /etc/mail/spamassassin/local.cf
  1117. # user preferences
  1118. if [ ! -d /home/$MY_USERNAME/.spamassassin ]; then
  1119. mkdir /home/$MY_USERNAME/.spamassassin
  1120. echo $'# How many points before a mail is considered spam.' > /home/$MY_USERNAME/.spamassassin/user_prefs
  1121. echo '# required_score 5' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1122. echo '' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1123. echo $'# Whitelist and blacklist addresses are now file-glob-style patterns, so' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1124. echo $'# "friend@somewhere.com", "*@isp.com", or "*.domain.net" will all work.' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1125. echo '# whitelist_from someone@somewhere.com' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1126. echo '' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1127. echo $'# Add your own customised scores for some tests below. The default scores are' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1128. echo $'# read from the installed spamassassin rules files, but you can override them' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1129. echo $'# here. To see the list of tests and their default scores, go to' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1130. echo '# http://spamassassin.apache.org/tests.html .' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1131. echo '#' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1132. echo '# score SYMBOLIC_TEST_NAME n.nn' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1133. echo '' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1134. echo $'# Speakers of Asian languages, like Chinese, Japanese and Korean, will almost' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1135. echo $'# definitely want to uncomment the following lines. They will switch off some' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1136. echo $'# rules that detect 8-bit characters, which commonly trigger on mails using CJK' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1137. echo $'# character sets, or that assume a western-style charset is in use. ' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1138. echo '# ' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1139. echo '# score HTML_COMMENT_8BITS 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1140. echo '# score UPPERCASE_25_50 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1141. echo '# score UPPERCASE_50_75 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1142. echo '# score UPPERCASE_75_100 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1143. echo '# score OBSCURED_EMAIL 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1144. echo '' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1145. echo $'# Speakers of any language that uses non-English, accented characters may wish' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1146. echo $'# to uncomment the following lines. They turn off rules that fire on' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1147. echo $'# misformatted messages generated by common mail apps in contravention of the' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1148. echo $'# email RFCs.' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1149. echo '' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1150. echo '# score SUBJ_ILLEGAL_CHARS 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1151. fi
  1152. # this must be accessible by root
  1153. chown -R $MY_USERNAME:root /home/$MY_USERNAME/.spamassassin
  1154. # script to keep spamassassin running
  1155. # There is a systemd script from the debian package, but it doesn't restart on failure
  1156. # and also doesn't ensure start after networking is up. If that is eventually fixed
  1157. # then this script and the cron job which runs it can be removed.
  1158. script_name=/usr/bin/run-spamassassin
  1159. echo '#!/bin/bash' > $script_name
  1160. echo 'current_state=$(systemctl status spamassassin)' >> $script_name
  1161. echo 'if [[ "$current_state" != *"(running)"* ]]; then' >> $script_name
  1162. echo ' systemctl restart spamassassin' >> $script_name
  1163. echo 'fi' >> $script_name
  1164. echo 'exit 0' >> $script_name
  1165. chmod +x $script_name
  1166. systemctl start spamassassin
  1167. systemctl restart exim4
  1168. systemctl restart cron
  1169. function_check cron_add_mins
  1170. cron_add_mins 10 "$script_name 2> /dev/null"
  1171. mark_completed $FUNCNAME
  1172. }
  1173. function configure_imap {
  1174. if [ ! -d /etc/exim4 ]; then
  1175. return
  1176. fi
  1177. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  1178. return
  1179. fi
  1180. apt-get -yq install dovecot-imapd
  1181. if [ ! -d /etc/dovecot ]; then
  1182. echo $"ERROR: Dovecot does not appear to have installed. $CHECK_MESSAGE"
  1183. exit 48
  1184. fi
  1185. if [[ "$(cert_exists dovecot)" == "0" ]]; then
  1186. ${PROJECT_NAME}-addcert -h dovecot --dhkey $DH_KEYLENGTH
  1187. check_certificates dovecot
  1188. fi
  1189. chmod 600 /etc/shadow
  1190. chmod 600 /etc/gshadow
  1191. groupadd default
  1192. usermod -g default dovecot
  1193. chmod 0000 /etc/shadow
  1194. chmod 0000 /etc/gshadow
  1195. chown root:default /etc/ssl/certs/dovecot.*
  1196. chown root:default /etc/ssl/private/dovecot.*
  1197. chown root:default /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.*
  1198. chown root:default /etc/ssl/private/${DEFAULT_DOMAIN_NAME}.*
  1199. if [ ! -f /etc/dovecot/conf.d/10-ssl.conf ]; then
  1200. echo $'Unable to find /etc/dovecot/conf.d/10-ssl.conf'
  1201. exit 83629
  1202. fi
  1203. sed -i 's|#ssl =.*|ssl = no|g' /etc/dovecot/conf.d/10-ssl.conf
  1204. sed -i 's|ssl =.*|ssl = no|g' /etc/dovecot/conf.d/10-ssl.conf
  1205. sed -i "s|#ssl_cert =.*|ssl_cert = </etc/ssl/certs/dovecot.crt|g" /etc/dovecot/conf.d/10-ssl.conf
  1206. sed -i "s|ssl_cert =.*|ssl_cert = </etc/ssl/certs/dovecot.crt|g" /etc/dovecot/conf.d/10-ssl.conf
  1207. sed -i "s|#ssl_key =.*|ssl_key = </etc/ssl/private/dovecot.key|g" /etc/dovecot/conf.d/10-ssl.conf
  1208. sed -i "s|ssl_key =.*|ssl_key = </etc/ssl/private/dovecot.key|g" /etc/dovecot/conf.d/10-ssl.conf
  1209. sed -i "s|#ssl_dh_parameters_length.*|ssl_dh_parameters_length = ${DH_KEYLENGTH}|g" /etc/dovecot/conf.d/10-ssl.conf
  1210. sed -i 's/#ssl_prefer_server_ciphers.*/ssl_prefer_server_ciphers = yes/g' /etc/dovecot/conf.d/10-ssl.conf
  1211. sed -i "s|#ssl_protocols =.*|ssl_protocols = '$SSL_PROTOCOLS'|g" /etc/dovecot/conf.d/10-ssl.conf
  1212. sed -i "s|ssl_protocols =.*|ssl_protocols = '$SSL_PROTOCOLS'|g" /etc/dovecot/conf.d/10-ssl.conf
  1213. echo "ssl_cipher_list = '$SSL_CIPHERS'" >> /etc/dovecot/conf.d/10-ssl.conf
  1214. if [ ! -f /etc/dovecot/conf.d/10-master.conf ]; then
  1215. echo $'Unable to find /etc/dovecot/conf.d/10-master.conf'
  1216. exit 49259
  1217. fi
  1218. sed -i 's/#process_limit =.*/process_limit = 100/g' /etc/dovecot/conf.d/10-master.conf
  1219. if [ ! -f /etc/dovecot/conf.d/10-logging.conf ]; then
  1220. echo $'Unable to find /etc/dovecot/conf.d/10-logging.conf'
  1221. exit 48936
  1222. fi
  1223. sed -i 's/#auth_verbose.*/auth_verbose = yes/g' /etc/dovecot/conf.d/10-logging.conf
  1224. if [ ! -f /etc/dovecot/dovecot.conf ]; then
  1225. echo $'Unable to find /etc/dovecot/dovecot.conf'
  1226. exit 43890
  1227. fi
  1228. sed -i 's/#listen =.*/listen = */g' /etc/dovecot/dovecot.conf
  1229. if [ ! -f /etc/dovecot/conf.d/10-auth.conf ]; then
  1230. echo $'Unable to find /etc/dovecot/conf.d/10-auth.conf'
  1231. exit 843256
  1232. fi
  1233. sed -i 's/#disable_plaintext_auth =.*/disable_plaintext_auth = no/g' /etc/dovecot/conf.d/10-auth.conf
  1234. sed -i 's/auth_mechanisms =.*/auth_mechanisms = plain login/g' /etc/dovecot/conf.d/10-auth.conf
  1235. if [ ! -f /etc/dovecot/conf.d/10-mail.conf ]; then
  1236. echo $'Unable to find /etc/dovecot/conf.d/10-mail.conf'
  1237. exit 42036
  1238. fi
  1239. sed -i 's|mail_location =.*|mail_location = maildir:~/Maildir:LAYOUT=fs|g' /etc/dovecot/conf.d/10-mail.conf
  1240. # This long notify interval makes the system more suited for use with
  1241. # battery powered mobile devices
  1242. sed -i 's|#imap_idle_notify_interval =.*|imap_idle_notify_interval = 29|g' /etc/dovecot/conf.d/20-imap.conf
  1243. if [ -f /var/lib/dovecot/ssl-parameters.dat ]; then
  1244. rm /var/lib/dovecot/ssl-parameters.dat
  1245. fi
  1246. if [ -f /etc/systemd/system/sockets.target.wants/dovecot.socket ]; then
  1247. rm /etc/systemd/system/sockets.target.wants/dovecot.socket
  1248. fi
  1249. # Separate logging, otherwise syslog is used
  1250. if ! grep -q "# logging" /etc/dovecot/dovecot.conf; then
  1251. echo '' >> /etc/dovecot/dovecot.conf
  1252. echo '# logging' >> /etc/dovecot/dovecot.conf
  1253. echo 'log_path = /var/log/dovecot.log' >> /etc/dovecot/dovecot.conf
  1254. echo 'info_log_path = /var/log/dovecot-info.log' >> /etc/dovecot/dovecot.conf
  1255. echo 'debug_log_path = /var/log/dovecot-debug.log' >> /etc/dovecot/dovecot.conf
  1256. fi
  1257. systemctl restart dovecot
  1258. mark_completed $FUNCNAME
  1259. }
  1260. function configure_imap_client_certs {
  1261. if [ ! -d /etc/exim4 ]; then
  1262. return
  1263. fi
  1264. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  1265. return
  1266. fi
  1267. # http://strange.systems/certificate-based-auth-with-dovecot-sendmail/
  1268. sed -i 's|#default_process_limit =.*|default_process_limit = 100|g' /etc/dovecot/conf.d/10-master.conf
  1269. sed -i 's/disable_plaintext_auth =.*/disable_plaintext_auth = yes/g' /etc/dovecot/conf.d/10-auth.conf
  1270. sed -i 's|#auth_ssl_require_client_cert =.*|auth_ssl_require_client_cert = yes|g' /etc/dovecot/conf.d/10-auth.conf
  1271. sed -i 's|#auth_ssl_username_from_cert =.*|auth_ssl_username_from_cert = yes|g' /etc/dovecot/conf.d/10-auth.conf
  1272. sed -i "s|#ssl_ca =.*|ssl_ca = /etc/ssl/certs/ca-$DEFAULT_DOMAIN_NAME.crt|g" /etc/dovecot/conf.d/10-ssl.conf
  1273. sed -i 's|#ssl_cert_username_field =.*|ssl_cert_username_field = commonName|g' /etc/dovecot/conf.d/10-ssl.conf
  1274. sed -i 's|#ssl_verify_client_cert =.*|ssl_verify_client_cert = yes|g' /etc/dovecot/conf.d/10-ssl.conf
  1275. if ! grep -q "passdb {" /etc/dovecot/conf.d/10-auth.conf; then
  1276. echo '' >> /etc/dovecot/conf.d/10-auth.conf
  1277. echo 'passdb {' >> /etc/dovecot/conf.d/10-auth.conf
  1278. echo ' driver = passwd-file' >> /etc/dovecot/conf.d/10-auth.conf
  1279. echo ' args = /etc/dovecot/passwd-file' >> /etc/dovecot/conf.d/10-auth.conf
  1280. echo ' deny = no' >> /etc/dovecot/conf.d/10-auth.conf
  1281. echo ' master = no' >> /etc/dovecot/conf.d/10-auth.conf
  1282. echo ' pass = no' >> /etc/dovecot/conf.d/10-auth.conf
  1283. echo '}' >> /etc/dovecot/conf.d/10-auth.conf
  1284. fi
  1285. if [[ $ONION_ONLY == "no" ]]; then
  1286. # make a CA cert
  1287. if [ ! -f /etc/ssl/private/ca-$DEFAULT_DOMAIN_NAME.key ]; then
  1288. if [[ $LETSENCRYPT_ENABLED != "yes" ]]; then
  1289. ${PROJECT_NAME}-addcert -h $DEFAULT_DOMAIN_NAME --ca "" --dhkey $DH_KEYLENGTH
  1290. else
  1291. ${PROJECT_NAME}-addcert -e $DEFAULT_DOMAIN_NAME -s $LETSENCRYPT_SERVER --ca "" --dhkey $DH_KEYLENGTH --email $MY_EMAIL_ADDRESS
  1292. fi
  1293. fi
  1294. fi
  1295. # CA configuration
  1296. echo '[ ca ]' > /etc/ssl/dovecot-ca.cnf
  1297. echo "default_ca = dovecot-ca" >> /etc/ssl/dovecot-ca.cnf
  1298. echo '' >> /etc/ssl/dovecot-ca.cnf
  1299. echo '[ crl_ext ]' >> /etc/ssl/dovecot-ca.cnf
  1300. echo 'authorityKeyIdentifier=keyid:always' >> /etc/ssl/dovecot-ca.cnf
  1301. echo '' >> /etc/ssl/dovecot-ca.cnf
  1302. echo '[ dovecot-ca ]' >> /etc/ssl/dovecot-ca.cnf
  1303. echo 'new_certs_dir = .' >> /etc/ssl/dovecot-ca.cnf
  1304. echo 'unique_subject = no' >> /etc/ssl/dovecot-ca.cnf
  1305. echo "certificate = /etc/ssl/certs/ca-$DEFAULT_DOMAIN_NAME.crt" >> /etc/ssl/dovecot-ca.cnf
  1306. echo 'database = ssldb' >> /etc/ssl/dovecot-ca.cnf
  1307. echo "private_key = /etc/ssl/private/ca-$DEFAULT_DOMAIN_NAME.key" >> /etc/ssl/dovecot-ca.cnf
  1308. echo 'serial = sslserial' >> /etc/ssl/dovecot-ca.cnf
  1309. echo 'default_days = 3650' >> /etc/ssl/dovecot-ca.cnf
  1310. echo 'default_md = sha256' >> /etc/ssl/dovecot-ca.cnf
  1311. echo 'default_bits = 2048' >> /etc/ssl/dovecot-ca.cnf
  1312. echo 'policy = dovecot-ca_policy' >> /etc/ssl/dovecot-ca.cnf
  1313. echo 'x509_extensions = dovecot-ca_extensions' >> /etc/ssl/dovecot-ca.cnf
  1314. echo '' >> /etc/ssl/dovecot-ca.cnf
  1315. echo '[ dovecot-ca_policy ]' >> /etc/ssl/dovecot-ca.cnf
  1316. echo 'commonName = supplied' >> /etc/ssl/dovecot-ca.cnf
  1317. echo 'stateOrProvinceName = supplied' >> /etc/ssl/dovecot-ca.cnf
  1318. echo 'countryName = supplied' >> /etc/ssl/dovecot-ca.cnf
  1319. echo 'emailAddress = optional' >> /etc/ssl/dovecot-ca.cnf
  1320. echo 'organizationName = supplied' >> /etc/ssl/dovecot-ca.cnf
  1321. echo 'organizationalUnitName = optional' >> /etc/ssl/dovecot-ca.cnf
  1322. echo '' >> /etc/ssl/dovecot-ca.cnf
  1323. echo '[ dovecot-ca_extensions ]' >> /etc/ssl/dovecot-ca.cnf
  1324. echo 'basicConstraints = CA:false' >> /etc/ssl/dovecot-ca.cnf
  1325. echo 'subjectKeyIdentifier = hash' >> /etc/ssl/dovecot-ca.cnf
  1326. echo 'authorityKeyIdentifier = keyid:always' >> /etc/ssl/dovecot-ca.cnf
  1327. echo 'keyUsage = digitalSignature,keyEncipherment' >> /etc/ssl/dovecot-ca.cnf
  1328. echo 'extendedKeyUsage = clientAuth' >> /etc/ssl/dovecot-ca.cnf
  1329. if [ -f /etc/ssl/ssldb ]; then
  1330. rm /etc/ssl/ssldb
  1331. fi
  1332. if [ -f /etc/ssl/sslserial ]; then
  1333. rm /etc/ssl/sslserial
  1334. fi
  1335. touch /etc/ssl/ssldb
  1336. echo 0001 > /etc/ssl/sslserial
  1337. #${PROJECT_NAME}-clientcert -u $MY_USERNAME
  1338. systemctl restart dovecot
  1339. mark_completed $FUNCNAME
  1340. }
  1341. function create_gpg_subkey {
  1342. # Note: currently not used
  1343. if [ ! -d /etc/exim4 ]; then
  1344. return
  1345. fi
  1346. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  1347. return
  1348. fi
  1349. apt-get -yq install gnupg
  1350. GPG_KEY_USAGE=$1
  1351. if [[ $GPG_KEY_USAGE != "sign" && $GPG_KEY_USAGE != "auth" && $GPG_KEY_USAGE != "encrypt" ]]; then
  1352. echo $"Unknown subkey usage: $GPG_KEY_USAGE"
  1353. echo $'Available types: sign|auth|encrypt'
  1354. exit 14783
  1355. fi
  1356. KEYGRIP=$(gpg --fingerprint --fingerprint $MY_EMAIL_ADDRESS | grep fingerprint | tail -1 | cut -d= -f2 | sed -e 's/ //g')
  1357. # Generate a GPG subkey
  1358. echo 'Key-Type: eddsa' > /home/$MY_USERNAME/gpg-genkey.conf
  1359. echo 'Key-Curve: Ed25519' >> /home/$MY_USERNAME/gpg-genkey.conf
  1360. echo "Key-Grip: $KEYGRIP" >> /home/$MY_USERNAME/gpg-genkey.conf
  1361. echo 'Subkey-Type: eddsa' >> /home/$MY_USERNAME/gpg-genkey.conf
  1362. echo "subkey-Usage: $GPG_KEY_USAGE" > /home/$MY_USERNAME/gpg-genkey.conf
  1363. echo "Name-Real: $MY_NAME" >> /home/$MY_USERNAME/gpg-genkey.conf
  1364. echo "Name-Email: $MY_EMAIL_ADDRESS" >> /home/$MY_USERNAME/gpg-genkey.conf
  1365. echo "Name-Comment: $GPG_KEY_USAGE" >> /home/$MY_USERNAME/gpg-genkey.conf
  1366. echo 'Expire-Date: 0' >> /home/$MY_USERNAME/gpg-genkey.conf
  1367. echo "Passphrase: $PROJECT_NAME" >> /home/$MY_USERNAME/gpg-genkey.conf
  1368. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/gpg-genkey.conf
  1369. su -m root -c "gpg --homedir /home/$MY_USERNAME/.gnupg --batch --full-gen-key /home/$MY_USERNAME/gpg-genkey.conf" - $MY_USERNAME
  1370. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.gnupg
  1371. shred -zu /home/$MY_USERNAME/gpg-genkey.conf
  1372. MY_GPG_SUBKEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1373. mark_completed $FUNCNAME
  1374. }
  1375. function gpg_key_exists {
  1376. key_owner_username=$1
  1377. key_search_text=$2
  1378. if [[ $key_owner_username != "root" ]]; then
  1379. KEY_EXISTS=$(su -c "gpg --list-keys \"${key_search_text}\"" - $key_owner_username)
  1380. else
  1381. KEY_EXISTS=$(gpg --list-keys "${key_search_text}")
  1382. fi
  1383. if [ ! "$KEY_EXISTS" ]; then
  1384. echo "no"
  1385. return
  1386. fi
  1387. if [ "$KEY_EXISTS" == *"error"* ]; then
  1388. echo "no"
  1389. return
  1390. fi
  1391. echo "yes"
  1392. }
  1393. function configure_gpg {
  1394. if [ ! -d /etc/exim4 ]; then
  1395. return
  1396. fi
  1397. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  1398. return
  1399. fi
  1400. apt-get -yq install gnupg
  1401. check_email_address_exists
  1402. gpg_dir=/home/$MY_USERNAME/.gnupg
  1403. # if gpg keys directory was previously imported from usb
  1404. if [ -d $gpg_dir ]; then
  1405. echo $'GPG directory exists'
  1406. else
  1407. echo $"GPG directory $gpg_dir was not found"
  1408. fi
  1409. if [ -d $gpg_dir ]; then
  1410. echo $'GPG keys were imported'
  1411. sed -i "s|keyserver hkp://keys.gnupg.net|keyserver $GPG_KEYSERVER|g" $gpg_dir/gpg.conf
  1412. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1413. if [ ${#MY_GPG_PUBLIC_KEY_ID} -lt 4 ]; then
  1414. echo $'GPG public key ID could not be obtained'
  1415. fi
  1416. chown -R $MY_USERNAME:$MY_USERNAME $gpg_dir
  1417. chmod 700 $gpg_dir
  1418. chmod 600 $gpg_dir/*
  1419. mark_completed $FUNCNAME
  1420. return
  1421. fi
  1422. if [ ! -d $gpg_dir ]; then
  1423. mkdir $gpg_dir
  1424. echo "keyserver $GPG_KEYSERVER" >> $gpg_dir/gpg.conf
  1425. echo 'keyserver-options auto-key-retrieve' >> $gpg_dir/gpg.conf
  1426. fi
  1427. sed -i "s|keyserver hkp://keys.gnupg.net|keyserver $GPG_KEYSERVER|g" $gpg_dir/gpg.conf
  1428. if ! grep -q "# default preferences" $gpg_dir/gpg.conf; then
  1429. echo '' >> $gpg_dir/gpg.conf
  1430. echo '# default preferences' >> $gpg_dir/gpg.conf
  1431. echo 'personal-digest-preferences SHA256' >> $gpg_dir/gpg.conf
  1432. echo 'cert-digest-algo SHA256' >> $gpg_dir/gpg.conf
  1433. echo 'default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed' >> $gpg_dir/gpg.conf
  1434. fi
  1435. chown -R $MY_USERNAME:$MY_USERNAME $gpg_dir
  1436. chmod 700 $gpg_dir
  1437. chmod 600 $gpg_dir/*
  1438. if [[ $MY_GPG_PUBLIC_KEY && $MY_GPG_PRIVATE_KEY ]]; then
  1439. echo $'Importing GPG keys from file'
  1440. echo $"Public key: $MY_GPG_PUBLIC_KEY"
  1441. echo $"Private key: $MY_GPG_PRIVATE_KEY"
  1442. # use your existing GPG keys which were exported
  1443. if [ ! -f $MY_GPG_PUBLIC_KEY ]; then
  1444. echo $"GPG public key file $MY_GPG_PUBLIC_KEY was not found"
  1445. exit 2483
  1446. fi
  1447. if [ ! -f $MY_GPG_PRIVATE_KEY ]; then
  1448. echo $"GPG private key file $MY_GPG_PRIVATE_KEY was not found"
  1449. exit 5383
  1450. fi
  1451. gpg_import_public_key $MY_USERNAME $MY_GPG_PUBLIC_KEY
  1452. gpg_import_private_key $MY_USERNAME $MY_GPG_PRIVATE_KEY
  1453. KEY_EXISTS=$(gpg_key_exists "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1454. if [[ $KEY_EXISTS == "no" ]]; then
  1455. echo $"The GPG key for $MY_EMAIL_ADDRESS could not be imported"
  1456. exit 13821
  1457. fi
  1458. # for security ensure that the private key file doesn't linger around
  1459. shred -zu $MY_GPG_PRIVATE_KEY
  1460. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1461. if [ ${#MY_GPG_PUBLIC_KEY_ID} -lt 4 ]; then
  1462. echo $'GPG public key ID could not be obtained'
  1463. fi
  1464. else
  1465. # Generate a GPG key
  1466. if [ -f $IMAGE_PASSWORD_FILE ]; then
  1467. gpg_create_key $MY_USERNAME $(printf `cat $IMAGE_PASSWORD_FILE`)
  1468. else
  1469. gpg_create_key $MY_USERNAME $PROJECT_NAME
  1470. fi
  1471. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1472. MY_GPG_PUBLIC_KEY=/tmp/public_key.gpg
  1473. gpg_export_public_key $MY_USERNAME $MY_GPG_PUBLIC_KEY_ID $MY_GPG_PUBLIC_KEY
  1474. fi
  1475. if [ ! -d /root/.gnupg ]; then
  1476. cp -r /home/$MY_USERNAME/.gnupg /root/
  1477. chmod 700 /root/.gnupg
  1478. chmod 600 /root/.gnupg/*
  1479. fi
  1480. gpg_agent_setup root
  1481. gpg_agent_setup $MY_USERNAME
  1482. mark_completed $FUNCNAME
  1483. }
  1484. function refresh_gpg_keys {
  1485. REFRESH_GPG_KEYS_SCRIPT=/tmp/update-gpg-keys
  1486. echo '#!/bin/bash' > $REFRESH_GPG_KEYS_SCRIPT
  1487. echo "if [ -f /usr/local/bin/${PROJECT_NAME}-sec ]; then" >> $REFRESH_GPG_KEYS_SCRIPT
  1488. echo " /usr/bin/timeout 600 /usr/local/bin/${PROJECT_NAME}-sec --refresh yes" >> $REFRESH_GPG_KEYS_SCRIPT
  1489. echo 'else' >> $REFRESH_GPG_KEYS_SCRIPT
  1490. echo " /usr/bin/timeout 600 /usr/bin/${PROJECT_NAME}-sec --refresh yes" >> $REFRESH_GPG_KEYS_SCRIPT
  1491. echo 'fi' >> $REFRESH_GPG_KEYS_SCRIPT
  1492. echo 'exit 0' >> $REFRESH_GPG_KEYS_SCRIPT
  1493. chmod +x $REFRESH_GPG_KEYS_SCRIPT
  1494. if [ ! -f /usr/bin/update-gpg-keys ]; then
  1495. cp $REFRESH_GPG_KEYS_SCRIPT /usr/bin/update-gpg-keys
  1496. else
  1497. HASH1=$(sha256sum $REFRESH_GPG_KEYS_SCRIPT | awk -F ' ' '{print $1}')
  1498. HASH2=$(sha256sum /usr/bin/update-gpg-keys | awk -F ' ' '{print $1}')
  1499. if [[ "$HASH1" != "$HASH2" ]]; then
  1500. cp $REFRESH_GPG_KEYS_SCRIPT /usr/bin/update-gpg-keys
  1501. fi
  1502. rm $REFRESH_GPG_KEYS_SCRIPT
  1503. fi
  1504. REFRESH_GPG_KEYS_SCRIPT=/usr/bin/update-gpg-keys
  1505. if grep -q "${PROJECT_NAME}-sec" /etc/crontab; then
  1506. sed -i "/${PROJECT_NAME}-sec /d" /etc/crontab
  1507. fi
  1508. if ! grep -q "$REFRESH_GPG_KEYS_SCRIPT" /etc/crontab; then
  1509. GPG_REFRESH_TIME=$(( RANDOM % 60 ))
  1510. echo "$GPG_REFRESH_TIME */$REFRESH_GPG_KEYS_HOURS * * * root cronic $REFRESH_GPG_KEYS_SCRIPT" >> /etc/crontab
  1511. systemctl restart cron
  1512. else
  1513. if ! grep "root cronic $REFRESH_GPG_KEYS_SCRIPT" /etc/crontab; then
  1514. sed -i "s|root $REFRESH_GPG_KEYS_SCRIPT.*|root cronic $REFRESH_GPG_KEYS_SCRIPT|g" /etc/crontab
  1515. fi
  1516. fi
  1517. }
  1518. function install_email {
  1519. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  1520. return
  1521. fi
  1522. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  1523. return
  1524. fi
  1525. check_email_address_exists
  1526. install_email_basic
  1527. configure_email_onion
  1528. #install_email_with_tor
  1529. mark_completed $FUNCNAME
  1530. }
  1531. # NOTE: deliberately no exit 0