freedombone-app-email 69KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Email functions
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2014-2016 Bob Mottram <bob@robotics.uk.to>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. # the default email address
  31. MY_EMAIL_ADDRESS=$MY_USERNAME@$DEFAULT_DOMAIN_NAME
  32. # If you want to run a public mailing list specify its name here.
  33. # There should be no spaces in the name
  34. PUBLIC_MAILING_LIST=
  35. # Optional different domain name for the public mailing list
  36. PUBLIC_MAILING_LIST_DOMAIN_NAME=
  37. # Directory where the public mailing list data is stored
  38. PUBLIC_MAILING_LIST_DIRECTORY="/var/spool/mlmmj"
  39. # If you want to run an encrypted mailing list specify its name here.
  40. # There should be no spaces in the name
  41. PRIVATE_MAILING_LIST=
  42. GPG_KEYSERVER="hkp://keys.gnupg.net"
  43. # whether to encrypt all incoming email with your public key
  44. GPG_ENCRYPT_STORED_EMAIL="yes"
  45. # gets set to yes if gpg keys are imported from usb
  46. GPG_KEYS_IMPORTED="no"
  47. # optionally you can provide your exported GPG key pair here
  48. # Note that the private key file will be deleted after use
  49. # If these are unspecified then a new GPG key will be created
  50. MY_GPG_PUBLIC_KEY=
  51. MY_GPG_PRIVATE_KEY=
  52. # optionally specify your public key ID
  53. MY_GPG_PUBLIC_KEY_ID=
  54. # If you have existing mail within a Maildir
  55. # you can specify the directory here and the files
  56. # will be imported
  57. IMPORT_MAILDIR=
  58. EXIM_ONION_REPO="https://github.com/petterreinholdtsen/exim4-smtorp"
  59. # automatic archiving of email
  60. CLEANUP_MAILDIR_REPO="https://github.com/bashrc/cleanup-maildir"
  61. CLEANUP_MAILDIR_COMMIT='33241d2e3861f901ba17f5c77ada007e1ec06a86'
  62. # email encryption at rest
  63. GPGIT_REPO="https://github.com/mikecardwell/gpgit"
  64. GPGIT_COMMIT='583dc76119f19420f8a33f606744faa7c8922738'
  65. # refresh gpg keys every few hours
  66. REFRESH_GPG_KEYS_HOURS=2
  67. function encrypt_incoming_email {
  68. # encrypts incoming mail using your GPG public key
  69. # so even if an attacker gains access to the data at rest they still need
  70. # to know your GPG key password to be able to read anything
  71. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  72. return
  73. fi
  74. # update to the next commit
  75. function_check set_repo_commit
  76. set_repo_commit $INSTALL_DIR/gpgit "gpgit commit" "$GPGIT_COMMIT" $GPGIT_REPO
  77. if grep -Fxq "encrypt_incoming_email" $COMPLETION_FILE; then
  78. return
  79. fi
  80. if [[ $GPG_ENCRYPT_STORED_EMAIL != "yes" ]]; then
  81. return
  82. fi
  83. if [ ! -f /usr/bin/gpgit.pl ]; then
  84. apt-get -y install git libmail-gnupg-perl
  85. cd $INSTALL_DIR
  86. function_check git_clone
  87. git_clone $GPGIT_REPO $INSTALL_DIR/gpgit
  88. cd $INSTALL_DIR/gpgit
  89. git checkout $GPGIT_COMMIT -b $GPGIT_COMMIT
  90. if ! grep -q "gpgit commit" $COMPLETION_FILE; then
  91. echo "gpgit commit:$GPGIT_COMMIT" >> $COMPLETION_FILE
  92. else
  93. sed -i "s/gpgit commit.*/gpgit commit:$GPGIT_COMMIT/g" $COMPLETION_FILE
  94. fi
  95. cp gpgit.pl /usr/bin
  96. fi
  97. # add a procmail rule
  98. if ! grep -q "/usr/bin/gpgit.pl" /home/$MY_USERNAME/.procmailrc; then
  99. echo '' >> /home/$MY_USERNAME/.procmailrc
  100. echo ':0 f' >> /home/$MY_USERNAME/.procmailrc
  101. echo "| /usr/bin/gpgit.pl --encrypt-mode prefer-inline --inline-flatten $MY_EMAIL_ADDRESS" >> /home/$MY_USERNAME/.procmailrc
  102. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.procmailrc
  103. echo '' >> /etc/skel/.procmailrc
  104. echo ':0 f' >> /etc/skel/.procmailrc
  105. echo -n '| /usr/bin/gpgit.pl --encrypt-mode prefer-inline --inline-flatten $USER@' >> /etc/skel/.procmailrc
  106. echo "$DEFAULT_DOMAIN_NAME" >> /etc/skel/.procmailrc
  107. fi
  108. echo 'encrypt_incoming_email' >> $COMPLETION_FILE
  109. }
  110. function encrypt_outgoing_email {
  111. # encrypts outgoing mail using your GPG public key
  112. # so even if an attacker gains access to the data at rest they still need
  113. # to know your GPG key password to be able to read sent mail
  114. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  115. return
  116. fi
  117. if grep -Fxq "encrypt_outgoing_email" $COMPLETION_FILE; then
  118. return
  119. fi
  120. if [[ $GPG_ENCRYPT_STORED_EMAIL != "yes" ]]; then
  121. return
  122. fi
  123. if [ ! -d /home/$MY_USERNAME/.gnupg ]; then
  124. return
  125. fi
  126. if [ ! -f /home/$MY_USERNAME/.muttrc ]; then
  127. return
  128. fi
  129. # obtain your public key ID
  130. if [ ! $MY_GPG_PUBLIC_KEY_ID ]; then
  131. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  132. if [ ! "$MY_GPG_PUBLIC_KEY_ID" ]; then
  133. return
  134. fi
  135. if [ ${#MY_GPG_PUBLIC_KEY_ID} -lt 4 ]; then
  136. return
  137. fi
  138. fi
  139. if ! grep -q "pgp_encrypt_only_command" /home/$MY_USERNAME/.muttrc; then
  140. echo '' >> /home/$MY_USERNAME/.muttrc
  141. echo $'# Encrypt items in the Sent folder' >> /home/$MY_USERNAME/.muttrc
  142. echo "set pgp_encrypt_only_command=\"/usr/lib/mutt/pgpewrap gpg --batch --quiet --no-verbose --output - --encrypt --textmode --armor --always-trust --encrypt-to 0x$MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"" >> /home/$MY_USERNAME/.muttrc
  143. else
  144. sed -i "s|set pgp_encrypt_only_command.*|set pgp_encrypt_only_command=\"/usr/lib/mutt/pgpewrap gpg --batch --quiet --no-verbose --output - --encrypt --textmode --armor --always-trust --encrypt-to 0x$MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"|g" /home/$MY_USERNAME/.muttrc
  145. fi
  146. if ! grep -q "pgp_encrypt_sign_command" /home/$MY_USERNAME/.muttrc; then
  147. echo "set pgp_encrypt_sign_command=\"/usr/lib/mutt/pgpewrap gpg %?p?--passphrase-fd 0? --batch --quiet --no-verbose --textmode --output - --encrypt --sign %?a?-u %a? --armor --always-trust --encrypt-to 0x$MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"" >> /home/$MY_USERNAME/.muttrc
  148. else
  149. sed -i "s|set pgp_encrypt_sign_command.*|set pgp_encrypt_sign_command=\"/usr/lib/mutt/pgpewrap gpg %?p?--passphrase-fd 0? --batch --quiet --no-verbose --textmode --output - --encrypt --sign %?a?-u %a? --armor --always-trust --encrypt-to 0x$MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"|g" /home/$MY_USERNAME/.muttrc
  150. fi
  151. echo 'encrypt_outgoing_email' >> $COMPLETION_FILE
  152. }
  153. function encrypt_all_email {
  154. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  155. return
  156. fi
  157. if [[ $GPG_ENCRYPT_STORED_EMAIL != "yes" ]]; then
  158. return
  159. fi
  160. if [ -f /usr/local/bin/${PROJECT_NAME}-encrypt-mail ]; then
  161. cp /usr/local/bin/${PROJECT_NAME}-encrypt-mail /usr/bin/encmaildir
  162. else
  163. cp /usr/bin/${PROJECT_NAME}-encrypt-mail /usr/bin/encmaildir
  164. fi
  165. chmod +x /usr/bin/encmaildir
  166. if grep -Fxq "encrypt_all_email" $COMPLETION_FILE; then
  167. return
  168. fi
  169. if [ ! /home/$MY_USERNAME/README ]; then
  170. touch /home/$MY_USERNAME/README
  171. fi
  172. if ! grep -q $"If you have imported legacy email which is not encrypted" /home/$MY_USERNAME/README; then
  173. echo '' >> /home/$MY_USERNAME/README
  174. echo '' >> /home/$MY_USERNAME/README
  175. echo $'Encrypting legacy email' >> /home/$MY_USERNAME/README
  176. echo '=======================' >> /home/$MY_USERNAME/README
  177. echo $'If you have imported legacy email which is not encrypted' >> /home/$MY_USERNAME/README
  178. echo $'then it can be encrypted with the command:' >> /home/$MY_USERNAME/README
  179. echo '' >> /home/$MY_USERNAME/README
  180. echo ' encmaildir' >> /home/$MY_USERNAME/README
  181. echo '' >> /home/$MY_USERNAME/README
  182. echo $'But be warned that depending upon how much email you have' >> /home/$MY_USERNAME/README
  183. echo $'this could take a seriously LONG time on the Beaglebone' >> /home/$MY_USERNAME/README
  184. echo $'and may be better done on a faster machine.' >> /home/$MY_USERNAME/README
  185. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/README
  186. chmod 600 /home/$MY_USERNAME/README
  187. fi
  188. echo 'encrypt_all_email' >> $COMPLETION_FILE
  189. }
  190. function email_client {
  191. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  192. return
  193. fi
  194. if grep -Fxq "email_client" $COMPLETION_FILE; then
  195. return
  196. fi
  197. apt-get -y install mutt-patched lynx abook
  198. if [ ! -f /etc/Muttrc ]; then
  199. echo $"ERROR: Mutt does not appear to have installed. $CHECK_MESSAGE"
  200. exit 49
  201. fi
  202. if [ ! -d /home/$MY_USERNAME/.mutt ]; then
  203. mkdir /home/$MY_USERNAME/.mutt
  204. fi
  205. echo "text/html; lynx -dump -width=78 -nolist %s | sed ‘s/^ //’; copiousoutput; needsterminal; nametemplate=%s.html" > /home/$MY_USERNAME/.mutt/mailcap
  206. cp /home/$MY_USERNAME/.mutt/mailcap /etc/skel/.mutt
  207. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.mutt
  208. chown -R root:root /etc/skel/.mutt
  209. echo 'set mbox_type=Maildir' >> /etc/Muttrc
  210. echo 'set folder="~/Maildir"' >> /etc/Muttrc
  211. echo 'set mask="!^\\.[^.]"' >> /etc/Muttrc
  212. echo 'set mbox="~/Maildir"' >> /etc/Muttrc
  213. echo 'set record="+Sent"' >> /etc/Muttrc
  214. echo 'set postponed="+Drafts"' >> /etc/Muttrc
  215. echo 'set trash="+Trash"' >> /etc/Muttrc
  216. echo 'set spoolfile="~/Maildir"' >> /etc/Muttrc
  217. echo 'auto_view text/x-vcard text/html text/enriched' >> /etc/Muttrc
  218. echo 'set editor="emacs -q --load ~/.emacs-mutt"' >> /etc/Muttrc
  219. echo 'set header_cache="+.cache"' >> /etc/Muttrc
  220. echo '' >> /etc/Muttrc
  221. echo 'macro index S "<tag-prefix><decode-save>=.learn-spam<enter>" "move to learn-spam"' >> /etc/Muttrc
  222. echo 'macro pager S "<decode-save>=.learn-spam<enter>" "move to learn-spam"' >> /etc/Muttrc
  223. echo 'macro index H "<tag-prefix><decode-copy>=.learn-ham<enter>" "copy to learn-ham"' >> /etc/Muttrc
  224. echo 'macro pager H "<decode-copy>=.learn-ham<enter>" "copy to learn-ham"' >> /etc/Muttrc
  225. echo '' >> /etc/Muttrc
  226. echo '# set up the sidebar' >> /etc/Muttrc
  227. echo 'set sidebar_width=22' >> /etc/Muttrc
  228. echo 'set sidebar_visible=yes' >> /etc/Muttrc
  229. echo "set sidebar_delim='|'" >> /etc/Muttrc
  230. echo 'set sidebar_sort=yes' >> /etc/Muttrc
  231. echo '' >> /etc/Muttrc
  232. echo 'set rfc2047_parameters' >> /etc/Muttrc
  233. echo '' >> /etc/Muttrc
  234. echo '# Show inbox and sent items' >> /etc/Muttrc
  235. echo 'mailboxes = =Sent =maybe-spam =spam' >> /etc/Muttrc
  236. echo '' >> /etc/Muttrc
  237. echo '# Alter these colours as needed for maximum bling' >> /etc/Muttrc
  238. echo 'color sidebar_new yellow default' >> /etc/Muttrc
  239. echo 'color normal white default' >> /etc/Muttrc
  240. echo 'color hdrdefault brightcyan default' >> /etc/Muttrc
  241. echo 'color signature green default' >> /etc/Muttrc
  242. echo 'color attachment brightyellow default' >> /etc/Muttrc
  243. echo 'color quoted green default' >> /etc/Muttrc
  244. echo 'color quoted1 white default' >> /etc/Muttrc
  245. echo 'color tilde blue default' >> /etc/Muttrc
  246. echo '' >> /etc/Muttrc
  247. echo '# ctrl-n, ctrl-p to select next, prev folder' >> /etc/Muttrc
  248. echo '# ctrl-o to open selected folder' >> /etc/Muttrc
  249. echo 'bind index \Cp sidebar-prev' >> /etc/Muttrc
  250. echo 'bind index \Cn sidebar-next' >> /etc/Muttrc
  251. echo 'bind index \Co sidebar-open' >> /etc/Muttrc
  252. echo 'bind pager \Cp sidebar-prev' >> /etc/Muttrc
  253. echo 'bind pager \Cn sidebar-next' >> /etc/Muttrc
  254. echo 'bind pager \Co sidebar-open' >> /etc/Muttrc
  255. echo '' >> /etc/Muttrc
  256. echo '# ctrl-b toggles sidebar visibility' >> /etc/Muttrc
  257. echo "macro index,pager \Cb '<enter-command>toggle sidebar_visible<enter><redraw-screen>' 'toggle sidebar'" >> /etc/Muttrc
  258. echo '' >> /etc/Muttrc
  259. echo '# esc-m Mark new messages as read' >> /etc/Muttrc
  260. echo 'macro index <esc>m "T~N<enter>;WNT~O<enter>;WO\CT~T<enter>" "mark all messages read"' >> /etc/Muttrc
  261. echo '' >> /etc/Muttrc
  262. echo '# Collapsing threads' >> /etc/Muttrc
  263. echo 'macro index [ "<collapse-thread>" "collapse/uncollapse thread"' >> /etc/Muttrc
  264. echo 'macro index ] "<collapse-all>" "collapse/uncollapse all threads"' >> /etc/Muttrc
  265. echo '' >> /etc/Muttrc
  266. echo '# threads containing new messages' >> /etc/Muttrc
  267. echo 'uncolor index "~(~N)"' >> /etc/Muttrc
  268. echo 'color index brightblue default "~(~N)"' >> /etc/Muttrc
  269. echo '' >> /etc/Muttrc
  270. echo '# new messages themselves' >> /etc/Muttrc
  271. echo 'uncolor index "~N"' >> /etc/Muttrc
  272. echo 'color index brightyellow default "~N"' >> /etc/Muttrc
  273. echo '' >> /etc/Muttrc
  274. echo '# GPG/PGP integration' >> /etc/Muttrc
  275. echo '# this set the number of seconds to keep in memory the passphrase used to encrypt/sign' >> /etc/Muttrc
  276. echo 'set pgp_timeout=1800' >> /etc/Muttrc
  277. echo '' >> /etc/Muttrc
  278. echo '# automatically sign and encrypt with PGP/MIME' >> /etc/Muttrc
  279. echo 'set pgp_autosign # autosign all outgoing mails' >> /etc/Muttrc
  280. echo 'set pgp_autoencrypt # Try to encrypt automatically' >> /etc/Muttrc
  281. echo 'set pgp_replyencrypt # autocrypt replies to crypted' >> /etc/Muttrc
  282. echo 'set pgp_replysign # autosign replies to signed' >> /etc/Muttrc
  283. echo 'set pgp_auto_decode=yes # decode attachments' >> /etc/Muttrc
  284. echo 'set fcc_clear=no # Keep encrypted copy of sent encrypted mail' >> /etc/Muttrc
  285. echo 'unset smime_is_default' >> /etc/Muttrc
  286. echo '' >> /etc/Muttrc
  287. echo 'set alias_file=~/.mutt-alias' >> /etc/Muttrc
  288. echo 'source ~/.mutt-alias' >> /etc/Muttrc
  289. echo 'set query_command= "abook --mutt-query \"%s\""' >> /etc/Muttrc
  290. echo 'macro index,pager A "<pipe-message>abook --add-email-quiet<return>" "add the sender address to abook"' >> /etc/Muttrc
  291. echo '' >> /etc/Muttrc
  292. echo '# Optional relay of SMTP via ISP' >> /etc/Muttrc
  293. echo '#set smtp_url="smtps://username:password@isp_mail_domain:465/"' >> /etc/Muttrc
  294. # create an Emacs configuration specifically for use with Mutt, which
  295. # has word wrap and spell checking on by default
  296. echo "(add-hook 'before-save-hook 'delete-trailing-whitespace)" > /home/$MY_USERNAME/.emacs-mutt
  297. echo '(setq org-support-shift-select t)' >> /home/$MY_USERNAME/.emacs-mutt
  298. echo '(setq standard-indent 4)' >> /home/$MY_USERNAME/.emacs-mutt
  299. echo '(setq-default tab-width 4)' >> /home/$MY_USERNAME/.emacs-mutt
  300. echo '(setq c-basic-offset 4)' >> /home/$MY_USERNAME/.emacs-mutt
  301. echo '(mouse-wheel-mode t)' >> /home/$MY_USERNAME/.emacs-mutt
  302. echo '(setq make-backup-files t)' >> /home/$MY_USERNAME/.emacs-mutt
  303. echo '(setq version-control t)' >> /home/$MY_USERNAME/.emacs-mutt
  304. echo '(setq backup-directory-alist (quote ((".*" . "~/.emacs_backups/"))))' >> /home/$MY_USERNAME/.emacs-mutt
  305. echo "(setq default-major-mode 'text-mode)" >> /home/$MY_USERNAME/.emacs-mutt
  306. echo "(dolist (hook '(text-mode-hook))" >> /home/$MY_USERNAME/.emacs-mutt
  307. echo ' (add-hook hook (lambda () (flyspell-mode 1))))' >> /home/$MY_USERNAME/.emacs-mutt
  308. echo '(setq-default fill-column 72)' >> /home/$MY_USERNAME/.emacs-mutt
  309. echo '(setq auto-fill-mode 0)' >> /home/$MY_USERNAME/.emacs-mutt
  310. echo "(add-hook 'text-mode-hook 'turn-on-auto-fill)" >> /home/$MY_USERNAME/.emacs-mutt
  311. echo "(setq-default auto-fill-function 'do-auto-fill)" >> /home/$MY_USERNAME/.emacs-mutt
  312. # add the emacs mutt configuration to the user profile skeleton
  313. if [ ! -f /etc/skel/.emacs-mutt ]; then
  314. cp /home/$MY_USERNAME/.emacs-mutt /etc/skel/.emacs-mutt
  315. chown root:root /etc/skel/.emacs-mutt
  316. fi
  317. cp -f /etc/Muttrc /home/$MY_USERNAME/.muttrc
  318. cp -f /etc/Muttrc /etc/skel/.muttrc
  319. touch /home/$MY_USERNAME/.mutt-alias
  320. cp /home/$MY_USERNAME/.mutt-alias /etc/skel/.mutt-alias
  321. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.emacs-mutt
  322. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.muttrc
  323. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.mutt-alias
  324. # default user on generic images
  325. if [ -d /home/${GENERIC_IMAGE_USERNAME} ]; then
  326. cp -f /etc/Muttrc /home/${GENERIC_IMAGE_USERNAME}/.muttrc
  327. chown ${GENERIC_IMAGE_USERNAME}:${GENERIC_IMAGE_USERNAME} /home/${GENERIC_IMAGE_USERNAME}/.muttrc
  328. touch /home/${GENERIC_IMAGE_USERNAME}/.mutt-alias
  329. chown ${GENERIC_IMAGE_USERNAME}:${GENERIC_IMAGE_USERNAME} /home/${GENERIC_IMAGE_USERNAME}/.mutt-alias
  330. cp /etc/skel/.emacs-mutt /home/${GENERIC_IMAGE_USERNAME}/.emacs-mutt
  331. chown ${GENERIC_IMAGE_USERNAME}:${GENERIC_IMAGE_USERNAME} /home/${GENERIC_IMAGE_USERNAME}/.emacs-mutt
  332. fi
  333. echo 'email_client' >> $COMPLETION_FILE
  334. }
  335. function email_archiving {
  336. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  337. return
  338. fi
  339. # ensure that the mail archive script is up to date
  340. if [ -f /usr/local/bin/${PROJECT_NAME}-archive-mail ]; then
  341. cp /usr/local/bin/${PROJECT_NAME}-archive-mail /etc/cron.daily/archivemail
  342. else
  343. if [ -f /usr/bin/${PROJECT_NAME}-archive-mail ]; then
  344. cp /usr/bin/${PROJECT_NAME}-archive-mail /etc/cron.daily/archivemail
  345. else
  346. echo "/usr/bin/${PROJECT_NAME}-archive-mail was not found. ${PROJECT_NAME} might not have fully installed."
  347. exit 62379
  348. fi
  349. fi
  350. chmod +x /etc/cron.daily/archivemail
  351. # update to the next commit
  352. function_check set_repo_commit
  353. set_repo_commit $INSTALL_DIR/cleanup-maildir "cleanup-maildir commit" "$CLEANUP_MAILDIR_COMMIT" $CLEANUP_MAILDIR_REPO
  354. if grep -Fxq "email_archiving" $COMPLETION_FILE; then
  355. return
  356. fi
  357. if [ ! -d $INSTALL_DIR ]; then
  358. mkdir $INSTALL_DIR
  359. fi
  360. cd $INSTALL_DIR
  361. function_check git_clone
  362. git_clone $CLEANUP_MAILDIR_REPO $INSTALL_DIR/cleanup-maildir
  363. cd $INSTALL_DIR/cleanup-maildir
  364. git checkout $CLEANUP_MAILDIR_COMMIT -b $CLEANUP_MAILDIR_COMMIT
  365. if ! grep -q "cleanup-maildir commit" $COMPLETION_FILE; then
  366. echo "cleanup-maildir commit:$CLEANUP_MAILDIR_COMMIT" >> $COMPLETION_FILE
  367. else
  368. sed -i "s/cleanup-maildir commit.*/cleanup-maildir commit:$CLEANUP_MAILDIR_COMMIT/g" $COMPLETION_FILE
  369. fi
  370. cp $INSTALL_DIR/cleanup-maildir/cleanup-maildir /usr/bin
  371. echo 'email_archiving' >> $COMPLETION_FILE
  372. }
  373. # Ensure that the from field is correct when sending email from Mutt
  374. function email_from_address {
  375. if grep -Fxq "email_from_address" $COMPLETION_FILE; then
  376. return
  377. fi
  378. if [ ! -f /home/$MY_USERNAME/.muttrc ]; then
  379. return
  380. fi
  381. if grep -q "set from=" /home/$MY_USERNAME/.muttrc; then
  382. sed -i "s|set from=.*|set from='$MY_NAME <$MY_EMAIL_ADDRESS>'|g" /home/$MY_USERNAME/.muttrc
  383. else
  384. echo "set from='$MY_NAME <$MY_EMAIL_ADDRESS>'" >> /home/$MY_USERNAME/.muttrc
  385. fi
  386. echo 'email_from_address' >> $COMPLETION_FILE
  387. }
  388. function create_public_mailing_list {
  389. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  390. return
  391. fi
  392. if grep -Fxq "create_public_mailing_list" $COMPLETION_FILE; then
  393. return
  394. fi
  395. if [ ! $PUBLIC_MAILING_LIST ]; then
  396. return
  397. fi
  398. # does the mailing list have a separate domain name?
  399. if [ ! $PUBLIC_MAILING_LIST_DOMAIN_NAME ]; then
  400. PUBLIC_MAILING_LIST_DOMAIN_NAME=$DEFAULT_DOMAIN_NAME
  401. fi
  402. PUBLIC_MAILING_LIST_USER="mlmmj"
  403. apt-get -y install mlmmj
  404. adduser --system $PUBLIC_MAILING_LIST_USER
  405. addgroup $PUBLIC_MAILING_LIST_USER
  406. adduser $PUBLIC_MAILING_LIST_USER $PUBLIC_MAILING_LIST_USER
  407. echo ''
  408. echo $"Creating the $PUBLIC_MAILING_LIST mailing list"
  409. echo ''
  410. # create the list
  411. mlmmj-make-ml -a -L "$PUBLIC_MAILING_LIST" -c $PUBLIC_MAILING_LIST_USER
  412. echo 'SYSTEM_ALIASES_PIPE_TRANSPORT = address_pipe' > /etc/exim4/conf.d/main/000_localmacros
  413. echo "SYSTEM_ALIASES_USER = $PUBLIC_MAILING_LIST_USER" >> /etc/exim4/conf.d/main/000_localmacros
  414. echo "SYSTEM_ALIASES_GROUP = $PUBLIC_MAILING_LIST_USER" >> /etc/exim4/conf.d/main/000_localmacros
  415. # router
  416. echo 'mlmmj_router:' > /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  417. echo ' debug_print = "R: mlmmj_router for $local_part@$domain"' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  418. echo ' driver = accept' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  419. echo ' domains = +mlmmj_domains' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  420. echo ' #require_files = MLMMJ_HOME/${lc::$local_part}' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  421. echo ' # Use this instead, if you dont want to give Exim rx rights to mlmmj spool.' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  422. echo ' # Exim will then spawn a new process running under the UID of "mlmmj".' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  423. echo ' require_files = mlmmj:MLMMJ_HOME/${lc::$local_part}' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  424. echo ' local_part_suffix = +*' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  425. echo ' local_part_suffix_optional' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  426. echo ' headers_remove = Delivered-To' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  427. echo ' headers_add = Delivered-To: $local_part$local_part_suffix@$domain' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  428. echo ' transport = mlmmj_transport' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  429. # transport
  430. echo 'mlmmj_transport:' > /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  431. echo ' debug_print = "T: mlmmj_transport for $local_part@$domain"' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  432. echo ' driver = pipe' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  433. echo ' return_path_add' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  434. echo ' user = mlmmj' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  435. echo ' group = mlmmj' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  436. echo ' home_directory = MLMMJ_HOME' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  437. echo ' current_directory = MLMMJ_HOME' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  438. echo ' command = /usr/bin/mlmmj-receive -F -L MLMMJ_HOME/${lc:$local_part}' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  439. if ! grep -q "MLMMJ_HOME=/var/spool/mlmmj" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs; then
  440. sed -i '/MAIN CONFIGURATION SETTINGS/a\MLMMJ_HOME=/var/spool/mlmmj' /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs
  441. fi
  442. if ! grep -q "domainlist mlmmj_domains =" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs; then
  443. sed -i "/MLMMJ_HOME/a\domainlist mlmmj_domains = $PUBLIC_MAILING_LIST_DOMAIN_NAME" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs
  444. fi
  445. if ! grep -q "delay_warning_condition =" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs; then
  446. sed -i '/domainlist mlmmj_domains =/a\delay_warning_condition = ${if match_domain{$domain}{+mlmmj_domains}{no}{yes}}' /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs
  447. fi
  448. if ! grep -q ": +mlmmj_domains" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs; then
  449. sed -i 's/domainlist relay_to_domains = MAIN_RELAY_TO_DOMAINS/domainlist relay_to_domains = MAIN_RELAY_TO_DOMAINS : +mlmmj_domains/g' /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs
  450. fi
  451. if ! grep -q "! +mlmmj_domains" /etc/exim4/conf.d/router/200_exim4-config_primary; then
  452. sed -i 's/domains = ! +local_domains/domains = ! +mlmmj_domains : ! +local_domains/g' /etc/exim4/conf.d/router/200_exim4-config_primary
  453. fi
  454. update-exim4.conf.template -r
  455. update-exim4.conf
  456. systemctl restart exim4
  457. if ! grep -q $"$PUBLIC_MAILING_LIST mailing list" /home/$MY_USERNAME/README; then
  458. echo '' >> /home/$MY_USERNAME/README
  459. echo '' >> /home/$MY_USERNAME/README
  460. echo $"$PUBLIC_MAILING_LIST mailing list" >> /home/$MY_USERNAME/README
  461. echo '=================================' >> /home/$MY_USERNAME/README
  462. echo $"To subscribe to the $PUBLIC_MAILING_LIST mailing list send a" >> /home/$MY_USERNAME/README
  463. echo $"cleartext email to $PUBLIC_MAILING_LIST+subscribe@$DEFAULT_DOMAIN_NAME" >> /home/$MY_USERNAME/README
  464. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/README
  465. chmod 600 /home/$MY_USERNAME/README
  466. fi
  467. ${PROJECT_NAME}-addlist -u $MY_USERNAME -l "$PUBLIC_MAILING_LIST" -s "$PUBLIC_MAILING_LIST"
  468. echo 'create_public_mailing_list' >> $COMPLETION_FILE
  469. }
  470. function create_private_mailing_list {
  471. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  472. return
  473. fi
  474. # This installation doesn't work, results in ruby errors
  475. # There is currently no schleuder package for Debian jessie
  476. if grep -Fxq "create_private_mailing_list" $COMPLETION_FILE; then
  477. return
  478. fi
  479. if [ ! $PRIVATE_MAILING_LIST ]; then
  480. return
  481. fi
  482. if [[ $PRIVATE_MAILING_LIST == $MY_USERNAME ]]; then
  483. echo $'The name of the private mailing list should not be the same as your username'
  484. exit 10
  485. fi
  486. if [ ! $MY_GPG_PUBLIC_KEY ]; then
  487. echo $'To create a private mailing list you need to specify a file'
  488. echo $'containing your exported GPG key within MY_GPG_PUBLIC_KEY at'
  489. echo $'the top of the script'
  490. exit 11
  491. fi
  492. apt-get -y install ruby ruby-dev ruby-gpgme libgpgme11-dev libmagic-dev
  493. gem install schleuder
  494. schleuder-fix-gem-dependencies
  495. schleuder-init-setup --gem
  496. # NOTE: this is version number sensitive and so might need changing
  497. ln -s /var/lib/gems/2.1.0/gems/schleuder-2.2.4 /var/lib/schleuder
  498. sed -i 's/#smtp_port: 25/smtp_port: 465/g' /etc/schleuder/schleuder.conf
  499. sed -i 's/#superadminaddr: root@localhost/superadminaddr: root@localhost' /etc/schleuder/schleuder.conf
  500. schleuder-newlist $PRIVATE_MAILING_LIST@$DEFAULT_DOMAIN_NAME -realname "$PRIVATE_MAILING_LIST" -adminaddress $MY_EMAIL_ADDRESS -initmember $MY_EMAIL_ADDRESS -initmemberkey $MY_GPG_PUBLIC_KEY -nointeractive
  501. ${PROJECT_NAME}-addemail -u $MY_USERNAME -e $PRIVATE_MAILING_LIST@$DEFAULT_DOMAIN_NAME -l $PRIVATE_MAILING_LIST
  502. echo 'schleuder:' > /etc/exim4/conf.d/router/550_exim4-config_schleuder
  503. echo ' debug_print = "R: schleuder for $local_part@$domain"' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  504. echo ' driver = accept' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  505. echo ' local_part_suffix_optional' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  506. echo ' local_part_suffix = +* : -bounce : -sendkey' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  507. echo ' domains = +local_domains' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  508. echo ' user = schleuder' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  509. echo ' group = schleuder' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  510. echo ' require_files = schleuder:+/var/lib/schleuder/$domain/${local_part}' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  511. echo ' transport = schleuder_transport' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  512. echo 'schleuder_transport:' > /etc/exim4/conf.d/transport/30_exim4-config_schleuder
  513. echo ' debug_print = "T: schleuder_transport for $local_part@$domain"' >> /etc/exim4/conf.d/transport/30_exim4-config_schleuder
  514. echo ' driver = pipe' >> /etc/exim4/conf.d/transport/30_exim4-config_schleuder
  515. echo ' home_directory = "/var/lib/schleuder/$domain/$local_part"' >> /etc/exim4/conf.d/transport/30_exim4-config_schleuder
  516. echo ' command = "/usr/bin/schleuder $local_part@$domain"' >> /etc/exim4/conf.d/transport/30_exim4-config_schleuder
  517. chown -R schleuder:schleuder /var/lib/schleuder
  518. update-exim4.conf.template -r
  519. update-exim4.conf
  520. systemctl restart exim4
  521. useradd -d /var/schleuderlists -s /bin/false schleuder
  522. adduser Debian-exim schleuder
  523. usermod -a -G mail schleuder
  524. #exim -d -bt $PRIVATE_MAILING_LIST@$DEFAULT_DOMAIN_NAME
  525. echo 'create_private_mailing_list' >> $COMPLETION_FILE
  526. }
  527. function split_gpg_key_into_fragments {
  528. # split the gpg key into fragments if social key management is enabled
  529. if [[ $ENABLE_SOCIAL_KEY_MANAGEMENT == "yes" ]]; then
  530. echo 'Splitting GPG key. You may need to enter your passphrase.'
  531. ${PROJECT_NAME}-splitkey -u $MY_USERNAME -e $MY_EMAIL_ADDRESS --fullname "$MY_NAME"
  532. if [ ! -d /home/$MY_USERNAME/.gnupg_fragments ]; then
  533. echo 'Yhe GPG key could not be split'
  534. exit 86548
  535. fi
  536. fi
  537. }
  538. function import_email {
  539. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  540. return
  541. fi
  542. EMAIL_COMPLETE_MSG=$"
  543. *** ${PROJECT_NAME} mailbox installation is complete ***
  544. Now on your internet router forward ports
  545. 25, 587, 465, 993 and 2222 to the ${PROJECT_NAME}
  546. "
  547. if grep -Fxq "import_email" $COMPLETION_FILE; then
  548. if [[ $SYSTEM_TYPE == "$VARIANT_MAILBOX" ]]; then
  549. function_check backup_to_friends_servers
  550. backup_to_friends_servers
  551. function_check intrusion_detection
  552. intrusion_detection
  553. function_check split_gpg_key_into_fragments
  554. split_gpg_key_into_fragments
  555. clear
  556. echo ''
  557. echo "$EMAIL_COMPLETE_MSG"
  558. if [ -d $USB_MOUNT ]; then
  559. umount $USB_MOUNT
  560. rm -rf $USB_MOUNT
  561. echo $' You can now remove the USB drive'
  562. fi
  563. exit 0
  564. fi
  565. return
  566. fi
  567. if [ $IMPORT_MAILDIR ]; then
  568. if [ -d $IMPORT_MAILDIR ]; then
  569. echo $'Transfering email files'
  570. cp -r $IMPORT_MAILDIR /home/$MY_USERNAME
  571. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/Maildir
  572. else
  573. echo $"Email import directory $IMPORT_MAILDIR not found"
  574. exit 9
  575. fi
  576. fi
  577. echo 'import_email' >> $COMPLETION_FILE
  578. if [[ $SYSTEM_TYPE == "$VARIANT_MAILBOX" ]]; then
  579. function_check backup_to_friends_servers
  580. backup_to_friends_servers
  581. function_check intrusion_detection
  582. intrusion_detection
  583. function_check split_gpg_key_into_fragments
  584. split_gpg_key_into_fragments
  585. # unmount any attached usb drive
  586. clear
  587. echo ''
  588. echo "$EMAIL_COMPLETE_MSG"
  589. echo ''
  590. if [ -d $USB_MOUNT ]; then
  591. umount $USB_MOUNT
  592. rm -rf $USB_MOUNT
  593. echo $' You can now remove the USB drive'
  594. fi
  595. exit 0
  596. fi
  597. }
  598. function configure_email {
  599. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  600. return
  601. fi
  602. if grep -Fxq "configure_email" $COMPLETION_FILE; then
  603. return
  604. fi
  605. apt-get -y remove postfix
  606. apt-get -y install exim4 sasl2-bin swaks libnet-ssleay-perl procmail xinetd
  607. if [ ! -d /etc/exim4 ]; then
  608. echo $"ERROR: Exim does not appear to have installed. $CHECK_MESSAGE"
  609. exit 48
  610. fi
  611. onion_service_name='email'
  612. if [ ! -d /var/lib/tor ]; then
  613. echo $"No Tor installation found. ${onion_service_name} onion site cannot be configured."
  614. exit 877367
  615. fi
  616. if ! grep -q "hidden_service_${onion_service_name}" /etc/tor/torrc; then
  617. echo "HiddenServiceDir /var/lib/tor/hidden_service_${onion_service_name}/" >> /etc/tor/torrc
  618. echo 'HiddenServicePort 25 127.0.0.1:25' >> /etc/tor/torrc
  619. echo 'HiddenServicePort 587 127.0.0.1:587' >> /etc/tor/torrc
  620. echo 'HiddenServicePort 465 127.0.0.1:465' >> /etc/tor/torrc
  621. echo 'HiddenServicePort 993 127.0.0.1:993' >> /etc/tor/torrc
  622. echo $"Added onion site for ${onion_service_name}"
  623. fi
  624. systemctl restart tor
  625. function_check wait_for_onion_service
  626. wait_for_onion_service ${onion_service_name}
  627. if [ ! -f /var/lib/tor/hidden_service_${onion_service_name}/hostname ]; then
  628. echo $"${onion_service_name} onion site hostname not found"
  629. exit 76362
  630. fi
  631. EMAIL_ONION_HOSTNAME=$(cat /var/lib/tor/hidden_service_${onion_service_name}/hostname)
  632. if [[ $ONION_ONLY != "no" ]]; then
  633. function_check set_hostname
  634. set_hostname ${EMAIL_ONION_HOSTNAME}
  635. MY_EMAIL_ADDRESS=${MY_USERNAME}@${DEFAULT_DOMAIN_NAME}
  636. fi
  637. if ! grep -q "Email onion domain" $COMPLETION_FILE; then
  638. echo "Email onion domain:${EMAIL_ONION_HOSTNAME}" >> $COMPLETION_FILE
  639. else
  640. sed -i "s|Email onion domain.*|Email onion domain:${EMAIL_ONION_HOSTNAME}|g" $COMPLETION_FILE
  641. fi
  642. # see https://github.com/petterreinholdtsen/exim4-smtorp
  643. echo '# tor stuff first' > /etc/exim4/conf.d/router/100_exim4-smtorp
  644. echo '#' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  645. echo '# if were submitting mail *from* a .tor/.onion address,' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  646. echo '# make sure any header lines that may give us away is' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  647. echo '# stripped out, and add a new, cryptic Message-ID.' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  648. echo '# In address_data we store the name we should HELO as.' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  649. echo 'tor_to_any:' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  650. echo ' debug_print = "R: manualroute from .onion to $local_part@$domain"' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  651. echo ' driver = manualroute' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  652. echo ' domains = ! +local_domains' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  653. echo ' condition = ${if match {$sender_address_domain}{\N.*\.(onion|tor)$\N}}' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  654. echo ' address_data = $sender_address_domain' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  655. echo ' transport = remote_smtp_onion' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  656. echo ' self = send' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  657. echo ' route_list = * localhost' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  658. echo ' headers_remove = Received:Message-ID:X-Mailer:User-Agent' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  659. echo ' headers_add = Message-ID: <${lc:${sha1:$message_id}}@$sender_address_domain>' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  660. echo '' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  661. echo '# this catches the case where were submitting mail' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  662. echo '# from a regular email address where we dont need to' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  663. echo '# rewrite any headers' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  664. echo 'any_to_tor:' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  665. echo ' debug_print = "R: manualroute for $local_part@$domain"' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  666. echo ' driver = manualroute' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  667. echo ' domains = ! +local_domains' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  668. echo ' transport = remote_smtp_onion' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  669. echo ' self = send' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  670. echo ' route_list = *.onion localhost ; *.tor localhost' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  671. echo ' address_data = $smtp_active_hostname' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  672. echo 'remote_smtp_onion:' > /etc/exim4/conf.d/transport/100_exim4-smtorp
  673. echo ' debug_print = "T: remote_smtp_onion for $local_part@$original_domain"' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  674. echo ' driver = smtp' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  675. echo '' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  676. echo ' # set helo_data to where we want to connect to,' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  677. echo ' # for the proxy program tor-smtp' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  678. echo ' helo_data = "$address_data $original_domain"' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  679. echo '' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  680. echo ' # wherever we configured our script at' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  681. echo ' port = 12668' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  682. echo '' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  683. echo ' # cannot use TLS otherwise it will EHLO again!!' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  684. echo ' hosts_avoid_tls = *' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  685. if [ ! -d $INSTALL_DIR ]; then
  686. mkdir -p $INSTALL_DIR
  687. fi
  688. cd $INSTALL_DIR
  689. function_check git_clone
  690. git_clone $EXIM_ONION_REPO $INSTALL_DIR/exim4-smtorp
  691. cd $INSTALL_DIR/exim4-smtorp/tor-smtp
  692. make
  693. if [ ! -f $INSTALL_DIR/exim4-smtorp/tor-smtp/tor-smtp ]; then
  694. echo $'Unable to make tor smtp transport'
  695. exit 52629
  696. fi
  697. if [ ! -d /usr/lib/exim4-smtorp ]; then
  698. mkdir /usr/lib/exim4-smtorp
  699. fi
  700. cp $INSTALL_DIR/exim4-smtorp/tor-smtp/tor-smtp /usr/lib/exim4-smtorp/tor-smtp
  701. if [ ! -f /usr/lib/exim4-smtorp/tor-smtp ]; then
  702. echo $'Unable to copy tor-smtp'
  703. exit 83503
  704. fi
  705. cp $INSTALL_DIR/exim4-smtorp/xinetd /etc/xinetd.d/tor-smtp
  706. if [ ! -f /etc/xinetd.d/tor-smtp ]; then
  707. echo $'Unable to copy to xinetd.d'
  708. exit 835954
  709. fi
  710. systemctl restart xinetd
  711. # configure for Maildir format
  712. sed -i 's/MAIL_DIR/#MAIL_DIR/g' /etc/login.defs
  713. sed -i 's|#MAIL_FILE.*|MAIL_FILE Maildir/|g' /etc/login.defs
  714. if ! grep -q "export MAIL" /etc/profile; then
  715. echo 'export MAIL=~/Maildir' >> /etc/profile
  716. fi
  717. sed -i 's|pam_mail.so standard|pam_mail.so dir=~/Maildir standard|g' /etc/pam.d/login
  718. sed -i 's|pam_mail.so standard noenv|pam_mail.so dir=~/Maildir standard|g' /etc/pam.d/sshd
  719. sed -i 's|pam_mail.so nopen|pam_mail.so dir=~/Maildir nopen|g' /etc/pam.d/su
  720. echo 'dc_eximconfig_configtype="internet"' > /etc/exim4/update-exim4.conf.conf
  721. if [[ $ONION_ONLY == "no" ]]; then
  722. # both ICANN and onion domains
  723. echo "dc_other_hostnames='${DEFAULT_DOMAIN_NAME};${EMAIL_ONION_HOSTNAME}'" >> /etc/exim4/update-exim4.conf.conf
  724. else
  725. echo "dc_other_hostnames='${EMAIL_ONION_HOSTNAME}'" >> /etc/exim4/update-exim4.conf.conf
  726. fi
  727. echo "dc_local_interfaces=''" >> /etc/exim4/update-exim4.conf.conf
  728. echo "dc_readhost=''" >> /etc/exim4/update-exim4.conf.conf
  729. echo "dc_relay_domains=''" >> /etc/exim4/update-exim4.conf.conf
  730. echo "dc_minimaldns='false'" >> /etc/exim4/update-exim4.conf.conf
  731. RELAY_NETS='192.168.1.0/24'
  732. if [ $LOCAL_NETWORK_STATIC_IP_ADDRESS ]; then
  733. RELAY_NETS=$(echo $LOCAL_NETWORK_STATIC_IP_ADDRESS | awk -F '.' '{print $1 "." $2 "." $3 ".0/24"}')
  734. fi
  735. echo "dc_relay_nets='$RELAY_NETS'" >> /etc/exim4/update-exim4.conf.conf
  736. echo "dc_smarthost=''" >> /etc/exim4/update-exim4.conf.conf
  737. echo "CFILEMODE='644'" >> /etc/exim4/update-exim4.conf.conf
  738. echo "dc_use_split_config='false'" >> /etc/exim4/update-exim4.conf.conf
  739. echo "dc_hide_mailname=''" >> /etc/exim4/update-exim4.conf.conf
  740. echo "dc_mailname_in_oh='true'" >> /etc/exim4/update-exim4.conf.conf
  741. echo "dc_localdelivery='maildir_home'" >> /etc/exim4/update-exim4.conf.conf
  742. update-exim4.conf
  743. sed -i "s/START=no/START=yes/g" /etc/default/saslauthd
  744. systemctl start saslauthd
  745. # make a tls certificate for email
  746. if [ ! -f /etc/ssl/certs/exim.dhparam ]; then
  747. ${PROJECT_NAME}-addcert -h exim --dhkey $DH_KEYLENGTH
  748. check_certificates exim
  749. fi
  750. cp /etc/ssl/private/exim.key /etc/exim4
  751. cp /etc/ssl/certs/exim.crt /etc/exim4
  752. cp /etc/ssl/certs/exim.dhparam /etc/exim4
  753. chown root:Debian-exim /etc/exim4/exim.key /etc/exim4/exim.crt /etc/exim4/exim.dhparam
  754. chmod 640 /etc/exim4/exim.key /etc/exim4/exim.crt /etc/exim4/exim.dhparam
  755. sed -i '/login_saslauthd_server/,/.endif/ s/# *//' /etc/exim4/exim4.conf.template
  756. sed -i "/.ifdef MAIN_HARDCODE_PRIMARY_HOSTNAME/i\MAIN_HARDCODE_PRIMARY_HOSTNAME = $DEFAULT_DOMAIN_NAME\nMAIN_TLS_ENABLE = true" /etc/exim4/exim4.conf.template
  757. sed -i "s|SMTPLISTENEROPTIONS=''|SMTPLISTENEROPTIONS='-oX 465:25:587 -oP /var/run/exim4/exim.pid'|g" /etc/default/exim4
  758. if ! grep -q "tls_on_connect_ports=465" /etc/exim4/exim4.conf.template; then
  759. sed -i '/SSL configuration for exim/i\tls_on_connect_ports=465' /etc/exim4/exim4.conf.template
  760. fi
  761. adduser $MY_USERNAME sasl
  762. addgroup Debian-exim sasl
  763. systemctl restart exim4
  764. if [ ! -d /etc/skel/Maildir ]; then
  765. mkdir -m 700 /etc/skel/.mutt
  766. mkdir -m 700 /etc/skel/Maildir
  767. mkdir -m 700 /etc/skel/Maildir/new
  768. mkdir -m 700 /etc/skel/Maildir/cur
  769. mkdir -m 700 /etc/skel/Maildir/Sent
  770. mkdir -m 700 /etc/skel/Maildir/Sent/tmp
  771. mkdir -m 700 /etc/skel/Maildir/Sent/cur
  772. mkdir -m 700 /etc/skel/Maildir/Sent/new
  773. mkdir -m 700 /etc/skel/Maildir/.learn-spam
  774. mkdir -m 700 /etc/skel/Maildir/.learn-spam/cur
  775. mkdir -m 700 /etc/skel/Maildir/.learn-spam/new
  776. mkdir -m 700 /etc/skel/Maildir/.learn-spam/tmp
  777. mkdir -m 700 /etc/skel/Maildir/.learn-ham
  778. mkdir -m 700 /etc/skel/Maildir/.learn-ham/cur
  779. mkdir -m 700 /etc/skel/Maildir/.learn-ham/new
  780. mkdir -m 700 /etc/skel/Maildir/.learn-ham/tmp
  781. ln -s /etc/skel/Maildir/.learn-spam /etc/skel/Maildir/spam
  782. ln -s /etc/skel/Maildir/.learn-ham /etc/skel/Maildir/ham
  783. fi
  784. if [ ! -d /home/$MY_USERNAME/Maildir ]; then
  785. mkdir -m 700 /home/$MY_USERNAME/.mutt
  786. mkdir -m 700 /home/$MY_USERNAME/Maildir
  787. mkdir -m 700 /home/$MY_USERNAME/Maildir/cur
  788. mkdir -m 700 /home/$MY_USERNAME/Maildir/tmp
  789. mkdir -m 700 /home/$MY_USERNAME/Maildir/new
  790. mkdir -m 700 /home/$MY_USERNAME/Maildir/Sent
  791. mkdir -m 700 /home/$MY_USERNAME/Maildir/Sent/cur
  792. mkdir -m 700 /home/$MY_USERNAME/Maildir/Sent/tmp
  793. mkdir -m 700 /home/$MY_USERNAME/Maildir/Sent/new
  794. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-spam
  795. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-spam/cur
  796. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-spam/new
  797. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-spam/tmp
  798. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-ham
  799. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-ham/cur
  800. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-ham/new
  801. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-ham/tmp
  802. ln -s /home/$MY_USERNAME/Maildir/.learn-spam /home/$MY_USERNAME/Maildir/spam
  803. ln -s /home/$MY_USERNAME/Maildir/.learn-ham /home/$MY_USERNAME/Maildir/ham
  804. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/Maildir
  805. fi
  806. function_check configure_firewall_for_email
  807. configure_firewall_for_email
  808. echo 'configure_email' >> $COMPLETION_FILE
  809. }
  810. function create_procmail {
  811. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  812. return
  813. fi
  814. if grep -Fxq "create_procmail" $COMPLETION_FILE; then
  815. return
  816. fi
  817. if [ ! -f /home/$MY_USERNAME/.procmailrc ]; then
  818. echo 'MAILDIR=$HOME/Maildir' > /home/$MY_USERNAME/.procmailrc
  819. echo 'DEFAULT=$MAILDIR/' >> /home/$MY_USERNAME/.procmailrc
  820. echo 'LOGFILE=$HOME/log/procmail.log' >> /home/$MY_USERNAME/.procmailrc
  821. echo 'LOGABSTRACT=all' >> /home/$MY_USERNAME/.procmailrc
  822. echo '' >> /home/$MY_USERNAME/.procmailrc
  823. echo $"# Tripwire reports which have no violations don't need to be logged" >> /home/$MY_USERNAME/.procmailrc
  824. echo ':0 BD:' >> /home/$MY_USERNAME/.procmailrc
  825. TRIPWIRE_VIOLATIONS_STR=$'Total violations found: 0'
  826. echo " * .*$TRIPWIRE_VIOLATIONS_STR" >> /home/$MY_USERNAME/.procmailrc
  827. echo '/dev/null' >> /home/$MY_USERNAME/.procmailrc
  828. echo '' >> /home/$MY_USERNAME/.procmailrc
  829. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.procmailrc
  830. fi
  831. mkdir -p /home/$MY_USERNAME/Maildir/admin/new
  832. mkdir -p /home/$MY_USERNAME/Maildir/admin/cur
  833. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/Maildir/admin
  834. if [ ! -f /etc/skel/.procmailrc ]; then
  835. cp /home/$MY_USERNAME/.procmailrc /etc/skel/.procmailrc
  836. chown root:root /etc/skel/.procmailrc
  837. fi
  838. echo 'create_procmail' >> $COMPLETION_FILE
  839. }
  840. function handle_admin_emails {
  841. # keep emails for root in a separate folder
  842. if [ -d /home/$MY_USERNAME/Maildir/admin ]; then
  843. return
  844. fi
  845. freedombone-addemail -u $MY_USERNAME -e "root@$DEFAULT_DOMAIN_NAME" -g admin --public no
  846. }
  847. function spam_filtering {
  848. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  849. return
  850. fi
  851. if grep -Fxq "spam_filtering" $COMPLETION_FILE; then
  852. return
  853. fi
  854. apt-get -y install exim4-daemon-heavy
  855. apt-get -y install spamassassin
  856. if [ ! -f /etc/default/spamassassin ]; then
  857. echo 'Spamassassin was not installed'
  858. exit 72570
  859. fi
  860. sa-update -v
  861. sed -i 's/ENABLED=0/ENABLED=1/g' /etc/default/spamassassin
  862. sed -i 's/# spamd_address = 127.0.0.1 783/spamd_address = 127.0.0.1 783/g' /etc/exim4/exim4.conf.template
  863. # This configuration is based on https://wiki.debian.org/DebianSpamAssassin
  864. sed -i 's/local_parts = postmaster/local_parts = postmaster:abuse/g' /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt
  865. sed -i '/domains = +local_domains : +relay_to_domains/a\ set acl_m0 = rfcnames' /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt
  866. sed -i 's/accept/accept condition = ${if eq{$acl_m0}{rfcnames} {1}{0}}/g' /etc/exim4/conf.d/acl/40_exim4-config_check_data
  867. echo 'warn message = X-Spam-Score: $spam_score ($spam_bar)' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  868. echo ' spam = nobody:true' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  869. echo 'warn message = X-Spam-Flag: YES' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  870. echo ' spam = nobody' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  871. echo 'warn message = X-Spam-Report: $spam_report' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  872. echo ' spam = nobody' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  873. echo '# reject spam at high scores (> 12)' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  874. echo 'deny message = This message scored $spam_score spam points.' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  875. echo ' spam = nobody:true' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  876. echo ' condition = ${if >{$spam_score_int}{120}{1}{0}}' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  877. # procmail configuration
  878. echo '# get spamassassin to check emails' >> /home/$MY_USERNAME/.procmailrc
  879. echo ':0fw: .spamassassin.lock' >> /home/$MY_USERNAME/.procmailrc
  880. echo ' * < 256000' >> /home/$MY_USERNAME/.procmailrc
  881. echo '| spamc' >> /home/$MY_USERNAME/.procmailrc
  882. echo '# strong spam are discarded' >> /home/$MY_USERNAME/.procmailrc
  883. echo ':0' >> /home/$MY_USERNAME/.procmailrc
  884. echo ' * ^X-Spam-Level: \*\*\*\*\*\*' >> /home/$MY_USERNAME/.procmailrc
  885. echo '/dev/null' >> /home/$MY_USERNAME/.procmailrc
  886. echo '# weak spam are kept just in case - clear this out every now and then' >> /home/$MY_USERNAME/.procmailrc
  887. echo ':0' >> /home/$MY_USERNAME/.procmailrc
  888. echo ' * ^X-Spam-Level: \*\*\*\*\*' >> /home/$MY_USERNAME/.procmailrc
  889. echo 'maybe-spam/' >> /home/$MY_USERNAME/.procmailrc
  890. echo '# otherwise, marginal spam goes here for revision' >> /home/$MY_USERNAME/.procmailrc
  891. echo ':0' >> /home/$MY_USERNAME/.procmailrc
  892. echo ' * ^X-Spam-Level: \*\*' >> /home/$MY_USERNAME/.procmailrc
  893. echo 'spam/' >> /home/$MY_USERNAME/.procmailrc
  894. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.procmailrc
  895. echo '# get spamassassin to check emails' >> /etc/skel/.procmailrc
  896. echo ':0fw: .spamassassin.lock' >> /etc/skel/.procmailrc
  897. echo ' * < 256000' >> /etc/skel/.procmailrc
  898. echo '| spamc' >> /etc/skel/.procmailrc
  899. echo '# strong spam are discarded' >> /etc/skel/.procmailrc
  900. echo ':0' >> /etc/skel/.procmailrc
  901. echo ' * ^X-Spam-Level: \*\*\*\*\*\*' >> /etc/skel/.procmailrc
  902. echo '/dev/null' >> /etc/skel/.procmailrc
  903. echo '# weak spam are kept just in case - clear this out every now and then' >> /etc/skel/.procmailrc
  904. echo ':0' >> /etc/skel/.procmailrc
  905. echo ' * ^X-Spam-Level: \*\*\*\*\*' >> /etc/skel/.procmailrc
  906. echo 'maybe-spam/' >> /etc/skel/.procmailrc
  907. echo '# otherwise, marginal spam goes here for revision' >> /etc/skel/.procmailrc
  908. echo ':0' >> /etc/skel/.procmailrc
  909. echo ' * ^X-Spam-Level: \*\*' >> /etc/skel/.procmailrc
  910. echo 'spam/' >> /etc/skel/.procmailrc
  911. # filtering scripts
  912. echo '#!/bin/bash' > /usr/bin/filterspam
  913. echo 'for d in /home/*/ ; do' >> /usr/bin/filterspam
  914. echo ' USERNAME=$(echo "$d" | awk -F '"'"'/'"'"' '"'"'{print $3}'"'"')' >> /usr/bin/filterspam
  915. echo ' if [[ $USERNAME != "git" && $USERNAME != "mirrors" && $USERNAME != "sync" ]]; then' >> /usr/bin/filterspam
  916. echo ' MAILDIR=/home/$USERNAME/Maildir/.learn-spam' >> /usr/bin/filterspam
  917. echo ' if [ ! -d "$MAILDIR" ]; then' >> /usr/bin/filterspam
  918. echo ' exit' >> /usr/bin/filterspam
  919. echo ' fi' >> /usr/bin/filterspam
  920. echo ' for f in `ls $MAILDIR/cur`' >> /usr/bin/filterspam
  921. echo ' do' >> /usr/bin/filterspam
  922. echo ' spamc -L spam < "$MAILDIR/cur/$f" > /dev/null' >> /usr/bin/filterspam
  923. echo ' rm "$MAILDIR/cur/$f"' >> /usr/bin/filterspam
  924. echo ' done' >> /usr/bin/filterspam
  925. echo ' for f in `ls $MAILDIR/new`' >> /usr/bin/filterspam
  926. echo ' do' >> /usr/bin/filterspam
  927. echo ' spamc -L spam < "$MAILDIR/new/$f" > /dev/null' >> /usr/bin/filterspam
  928. echo ' rm "$MAILDIR/new/$f"' >> /usr/bin/filterspam
  929. echo ' done' >> /usr/bin/filterspam
  930. echo ' fi' >> /usr/bin/filterspam
  931. echo 'done' >> /usr/bin/filterspam
  932. echo 'exit 0' >> /usr/bin/filterspam
  933. echo '#!/bin/bash' > /usr/bin/filterham
  934. echo 'for d in /home/*/ ; do' >> /usr/bin/filterham
  935. echo ' USERNAME=$(echo "$d" | awk -F '"'"'/'"'"' '"'"'{print $3}'"'"')' >> /usr/bin/filterham
  936. echo ' if [[ $USERNAME != "git" && $USERNAME != "mirrors" && $USERNAME != "sync" ]]; then' >> /usr/bin/filterham
  937. echo ' MAILDIR=/home/$USERNAME/Maildir/.learn-ham' >> /usr/bin/filterham
  938. echo ' if [ ! -d "$MAILDIR" ]; then' >> /usr/bin/filterham
  939. echo ' exit' >> /usr/bin/filterham
  940. echo ' fi' >> /usr/bin/filterham
  941. echo ' for f in `ls $MAILDIR/cur`' >> /usr/bin/filterham
  942. echo ' do' >> /usr/bin/filterham
  943. echo ' spamc -L ham < "$MAILDIR/cur/$f" > /dev/null' >> /usr/bin/filterham
  944. echo ' rm "$MAILDIR/cur/$f"' >> /usr/bin/filterham
  945. echo ' done' >> /usr/bin/filterham
  946. echo ' for f in `ls $MAILDIR/new`' >> /usr/bin/filterham
  947. echo ' do' >> /usr/bin/filterham
  948. echo ' spamc -L ham < "$MAILDIR/new/$f" > /dev/null' >> /usr/bin/filterham
  949. echo ' rm "$MAILDIR/new/$f"' >> /usr/bin/filterham
  950. echo ' done' >> /usr/bin/filterham
  951. echo ' fi' >> /usr/bin/filterham
  952. echo 'done' >> /usr/bin/filterham
  953. echo 'exit 0' >> /usr/bin/filterham
  954. function_check cron_add_mins
  955. cron_add_mins 3 '/usr/bin/timeout 120 /usr/bin/filterspam'
  956. cron_add_mins 3 '/usr/bin/timeout 120 /usr/bin/filterham'
  957. chmod 655 /usr/bin/filterspam /usr/bin/filterham
  958. sed -i 's/# use_bayes 1/use_bayes 1/g' /etc/mail/spamassassin/local.cf
  959. sed -i 's/# bayes_auto_learn 1/bayes_auto_learn 1/g' /etc/mail/spamassassin/local.cf
  960. # user preferences
  961. if [ ! -d /home/$MY_USERNAME/.spamassassin ]; then
  962. mkdir /home/$MY_USERNAME/.spamassassin
  963. echo $'# How many points before a mail is considered spam.' > /home/$MY_USERNAME/.spamassassin/user_prefs
  964. echo '# required_score 5' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  965. echo '' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  966. echo $'# Whitelist and blacklist addresses are now file-glob-style patterns, so' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  967. echo $'# "friend@somewhere.com", "*@isp.com", or "*.domain.net" will all work.' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  968. echo '# whitelist_from someone@somewhere.com' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  969. echo '' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  970. echo $'# Add your own customised scores for some tests below. The default scores are' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  971. echo $'# read from the installed spamassassin rules files, but you can override them' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  972. echo $'# here. To see the list of tests and their default scores, go to' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  973. echo '# http://spamassassin.apache.org/tests.html .' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  974. echo '#' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  975. echo '# score SYMBOLIC_TEST_NAME n.nn' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  976. echo '' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  977. echo $'# Speakers of Asian languages, like Chinese, Japanese and Korean, will almost' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  978. echo $'# definitely want to uncomment the following lines. They will switch off some' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  979. echo $'# rules that detect 8-bit characters, which commonly trigger on mails using CJK' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  980. echo $'# character sets, or that assume a western-style charset is in use. ' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  981. echo '# ' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  982. echo '# score HTML_COMMENT_8BITS 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  983. echo '# score UPPERCASE_25_50 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  984. echo '# score UPPERCASE_50_75 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  985. echo '# score UPPERCASE_75_100 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  986. echo '# score OBSCURED_EMAIL 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  987. echo '' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  988. echo $'# Speakers of any language that uses non-English, accented characters may wish' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  989. echo $'# to uncomment the following lines. They turn off rules that fire on' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  990. echo $'# misformatted messages generated by common mail apps in contravention of the' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  991. echo $'# email RFCs.' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  992. echo '' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  993. echo '# score SUBJ_ILLEGAL_CHARS 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  994. fi
  995. # this must be accessible by root
  996. chown -R $MY_USERNAME:root /home/$MY_USERNAME/.spamassassin
  997. systemctl restart spamassassin
  998. systemctl restart exim4
  999. systemctl restart cron
  1000. echo 'spam_filtering' >> $COMPLETION_FILE
  1001. }
  1002. function configure_imap {
  1003. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  1004. return
  1005. fi
  1006. if grep -Fxq "configure_imap" $COMPLETION_FILE; then
  1007. return
  1008. fi
  1009. dpkg -P dovecot-imapd
  1010. dpkg -P dovecot-core
  1011. apt-get -y install dovecot-imapd
  1012. if [ ! -d /etc/dovecot ]; then
  1013. echo $"ERROR: Dovecot does not appear to have installed. $CHECK_MESSAGE"
  1014. exit 48
  1015. fi
  1016. if [ ! -f /etc/ssl/certs/dovecot.dhparam ]; then
  1017. ${PROJECT_NAME}-addcert -h dovecot --dhkey $DH_KEYLENGTH
  1018. check_certificates dovecot
  1019. fi
  1020. chown root:dovecot /etc/ssl/certs/dovecot.*
  1021. chown root:dovecot /etc/ssl/private/dovecot.*
  1022. if [ ! -f /etc/dovecot/conf.d/10-ssl.conf ]; then
  1023. echo $'Unable to find /etc/dovecot/conf.d/10-ssl.conf'
  1024. exit 83629
  1025. fi
  1026. sed -i 's|#ssl =.*|ssl = required|g' /etc/dovecot/conf.d/10-ssl.conf
  1027. sed -i 's|ssl = no|ssl = required|g' /etc/dovecot/conf.d/10-ssl.conf
  1028. sed -i 's|ssl = yes|ssl = required|g' /etc/dovecot/conf.d/10-ssl.conf
  1029. sed -i 's|#ssl_cert =.*|ssl_cert = </etc/ssl/certs/dovecot.crt|g' /etc/dovecot/conf.d/10-ssl.conf
  1030. sed -i 's|ssl_cert =.*|ssl_cert = </etc/ssl/certs/dovecot.crt|g' /etc/dovecot/conf.d/10-ssl.conf
  1031. sed -i 's|#ssl_key =.*|ssl_key = </etc/ssl/private/dovecot.key|g' /etc/dovecot/conf.d/10-ssl.conf
  1032. sed -i 's|ssl_key =.*|ssl_key = </etc/ssl/private/dovecot.key|g' /etc/dovecot/conf.d/10-ssl.conf
  1033. sed -i 's|#ssl_dh_parameters_length.*|ssl_dh_parameters_length = 2048|g' /etc/dovecot/conf.d/10-ssl.conf
  1034. sed -i 's/#ssl_prefer_server_ciphers.*/ssl_prefer_server_ciphers = yes/g' /etc/dovecot/conf.d/10-ssl.conf
  1035. sed -i "s|#ssl_protocols =.*|ssl_protocols = '$SSL_PROTOCOLS'|g" /etc/dovecot/conf.d/10-ssl.conf
  1036. sed -i "s|ssl_protocols =.*|ssl_protocols = '$SSL_PROTOCOLS'|g" /etc/dovecot/conf.d/10-ssl.conf
  1037. echo "ssl_cipher_list = '$SSL_CIPHERS'" >> /etc/dovecot/conf.d/10-ssl.conf
  1038. if [ ! -f /etc/dovecot/conf.d/10-master.conf ]; then
  1039. echo $'Unable to find /etc/dovecot/conf.d/10-master.conf'
  1040. exit 49259
  1041. fi
  1042. sed -i 's/#process_limit =.*/process_limit = 100/g' /etc/dovecot/conf.d/10-master.conf
  1043. sed -i 's/#default_client_limit.*/default_client_limit = 100/g' /etc/dovecot/conf.d/10-master.conf
  1044. sed -i 's|#default_process_limit =.*|default_process_limit = 100|g' /etc/dovecot/conf.d/10-master.conf
  1045. if [ ! -f /etc/dovecot/conf.d/10-logging.conf ]; then
  1046. echo $'Unable to find /etc/dovecot/conf.d/10-logging.conf'
  1047. exit 48936
  1048. fi
  1049. sed -i 's/#auth_verbose.*/auth_verbose = yes/g' /etc/dovecot/conf.d/10-logging.conf
  1050. if [ ! -f /etc/dovecot/dovecot.conf ]; then
  1051. echo $'Unable to find /etc/dovecot/dovecot.conf'
  1052. exit 43890
  1053. fi
  1054. sed -i 's/#listen =.*/listen = */g' /etc/dovecot/dovecot.conf
  1055. if [ ! -f /etc/dovecot/conf.d/10-auth.conf ]; then
  1056. echo $'Unable to find /etc/dovecot/conf.d/10-auth.conf'
  1057. exit 843256
  1058. fi
  1059. sed -i 's/#disable_plaintext_auth =.*/disable_plaintext_auth = no/g' /etc/dovecot/conf.d/10-auth.conf
  1060. sed -i 's/auth_mechanisms =.*/auth_mechanisms = plain login/g' /etc/dovecot/conf.d/10-auth.conf
  1061. if [ ! -f /etc/dovecot/conf.d/10-mail.conf ]; then
  1062. echo $'Unable to find /etc/dovecot/conf.d/10-mail.conf'
  1063. exit 42036
  1064. fi
  1065. sed -i 's|mail_location =.*|mail_location = maildir:~/Maildir:LAYOUT=fs|g' /etc/dovecot/conf.d/10-mail.conf
  1066. # This long notify interval makes the system more suited for use with
  1067. # battery powered mobile devices
  1068. sed -i 's|#imap_idle_notify_interval =.*|imap_idle_notify_interval = 29|g' /etc/dovecot/conf.d/20-imap.conf
  1069. if [ -f /var/lib/dovecot/ssl-parameters.dat ]; then
  1070. rm /var/lib/dovecot/ssl-parameters.dat
  1071. fi
  1072. systemctl restart dovecot
  1073. echo 'configure_imap' >> $COMPLETION_FILE
  1074. }
  1075. function configure_imap_client_certs {
  1076. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  1077. return
  1078. fi
  1079. if grep -Fxq "configure_imap_client_certs" $COMPLETION_FILE; then
  1080. return
  1081. fi
  1082. # http://strange.systems/certificate-based-auth-with-dovecot-sendmail/
  1083. sed -i 's|#default_process_limit =.*|default_process_limit = 100|g' /etc/dovecot/conf.d/10-master.conf
  1084. sed -i 's/disable_plaintext_auth =.*/disable_plaintext_auth = yes/g' /etc/dovecot/conf.d/10-auth.conf
  1085. sed -i 's|#auth_ssl_require_client_cert =.*|auth_ssl_require_client_cert = yes|g' /etc/dovecot/conf.d/10-auth.conf
  1086. sed -i 's|#auth_ssl_username_from_cert =.*|auth_ssl_username_from_cert = yes|g' /etc/dovecot/conf.d/10-auth.conf
  1087. sed -i "s|#ssl_ca =.*|ssl_ca = /etc/ssl/certs/ca-$DEFAULT_DOMAIN_NAME.crt|g" /etc/dovecot/conf.d/10-ssl.conf
  1088. sed -i 's|#ssl_cert_username_field =.*|ssl_cert_username_field = commonName|g' /etc/dovecot/conf.d/10-ssl.conf
  1089. sed -i 's|#ssl_verify_client_cert =.*|ssl_verify_client_cert = yes|g' /etc/dovecot/conf.d/10-ssl.conf
  1090. if ! grep -q "passdb {" /etc/dovecot/conf.d/10-auth.conf; then
  1091. echo '' >> /etc/dovecot/conf.d/10-auth.conf
  1092. echo 'passdb {' >> /etc/dovecot/conf.d/10-auth.conf
  1093. echo ' driver = passwd-file' >> /etc/dovecot/conf.d/10-auth.conf
  1094. echo ' args = /etc/dovecot/passwd-file' >> /etc/dovecot/conf.d/10-auth.conf
  1095. echo ' deny = no' >> /etc/dovecot/conf.d/10-auth.conf
  1096. echo ' master = no' >> /etc/dovecot/conf.d/10-auth.conf
  1097. echo ' pass = no' >> /etc/dovecot/conf.d/10-auth.conf
  1098. echo '}' >> /etc/dovecot/conf.d/10-auth.conf
  1099. fi
  1100. if [[ $ONION_ONLY == "no" ]]; then
  1101. # make a CA cert
  1102. if [ ! -f /etc/ssl/private/ca-$DEFAULT_DOMAIN_NAME.key ]; then
  1103. if [[ $LETSENCRYPT_ENABLED != "yes" ]]; then
  1104. ${PROJECT_NAME}-addcert -h $DEFAULT_DOMAIN_NAME --ca "" --dhkey $DH_KEYLENGTH
  1105. else
  1106. ${PROJECT_NAME}-addcert -e $DEFAULT_DOMAIN_NAME -s $LETSENCRYPT_SERVER --ca "" --dhkey $DH_KEYLENGTH --email $MY_EMAIL_ADDRESS
  1107. fi
  1108. fi
  1109. fi
  1110. # CA configuration
  1111. echo '[ ca ]' > /etc/ssl/dovecot-ca.cnf
  1112. echo "default_ca = dovecot-ca" >> /etc/ssl/dovecot-ca.cnf
  1113. echo '' >> /etc/ssl/dovecot-ca.cnf
  1114. echo '[ crl_ext ]' >> /etc/ssl/dovecot-ca.cnf
  1115. echo 'authorityKeyIdentifier=keyid:always' >> /etc/ssl/dovecot-ca.cnf
  1116. echo '' >> /etc/ssl/dovecot-ca.cnf
  1117. echo '[ dovecot-ca ]' >> /etc/ssl/dovecot-ca.cnf
  1118. echo 'new_certs_dir = .' >> /etc/ssl/dovecot-ca.cnf
  1119. echo 'unique_subject = no' >> /etc/ssl/dovecot-ca.cnf
  1120. echo "certificate = /etc/ssl/certs/ca-$DEFAULT_DOMAIN_NAME.crt" >> /etc/ssl/dovecot-ca.cnf
  1121. echo 'database = ssldb' >> /etc/ssl/dovecot-ca.cnf
  1122. echo "private_key = /etc/ssl/private/ca-$DEFAULT_DOMAIN_NAME.key" >> /etc/ssl/dovecot-ca.cnf
  1123. echo 'serial = sslserial' >> /etc/ssl/dovecot-ca.cnf
  1124. echo 'default_days = 3650' >> /etc/ssl/dovecot-ca.cnf
  1125. echo 'default_md = sha256' >> /etc/ssl/dovecot-ca.cnf
  1126. echo 'default_bits = 4096' >> /etc/ssl/dovecot-ca.cnf
  1127. echo 'policy = dovecot-ca_policy' >> /etc/ssl/dovecot-ca.cnf
  1128. echo 'x509_extensions = dovecot-ca_extensions' >> /etc/ssl/dovecot-ca.cnf
  1129. echo '' >> /etc/ssl/dovecot-ca.cnf
  1130. echo '[ dovecot-ca_policy ]' >> /etc/ssl/dovecot-ca.cnf
  1131. echo 'commonName = supplied' >> /etc/ssl/dovecot-ca.cnf
  1132. echo 'stateOrProvinceName = supplied' >> /etc/ssl/dovecot-ca.cnf
  1133. echo 'countryName = supplied' >> /etc/ssl/dovecot-ca.cnf
  1134. echo 'emailAddress = optional' >> /etc/ssl/dovecot-ca.cnf
  1135. echo 'organizationName = supplied' >> /etc/ssl/dovecot-ca.cnf
  1136. echo 'organizationalUnitName = optional' >> /etc/ssl/dovecot-ca.cnf
  1137. echo '' >> /etc/ssl/dovecot-ca.cnf
  1138. echo '[ dovecot-ca_extensions ]' >> /etc/ssl/dovecot-ca.cnf
  1139. echo 'basicConstraints = CA:false' >> /etc/ssl/dovecot-ca.cnf
  1140. echo 'subjectKeyIdentifier = hash' >> /etc/ssl/dovecot-ca.cnf
  1141. echo 'authorityKeyIdentifier = keyid:always' >> /etc/ssl/dovecot-ca.cnf
  1142. echo 'keyUsage = digitalSignature,keyEncipherment' >> /etc/ssl/dovecot-ca.cnf
  1143. echo 'extendedKeyUsage = clientAuth' >> /etc/ssl/dovecot-ca.cnf
  1144. if [ -f /etc/ssl/ssldb ]; then
  1145. rm /etc/ssl/ssldb
  1146. fi
  1147. if [ -f /etc/ssl/sslserial ]; then
  1148. rm /etc/ssl/sslserial
  1149. fi
  1150. touch /etc/ssl/ssldb
  1151. echo 0001 > /etc/ssl/sslserial
  1152. #${PROJECT_NAME}-clientcert -u $MY_USERNAME
  1153. systemctl restart dovecot
  1154. echo 'configure_imap_client_certs' >> $COMPLETION_FILE
  1155. }
  1156. function create_gpg_subkey {
  1157. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  1158. return
  1159. fi
  1160. if grep -Fxq "create_gpg_subkey" $COMPLETION_FILE; then
  1161. return
  1162. fi
  1163. apt-get -y install gnupg
  1164. GPG_KEY_USAGE=$1
  1165. if [[ $GPG_KEY_USAGE != "sign" && $GPG_KEY_USAGE != "auth" && $GPG_KEY_USAGE != "encrypt" ]]; then
  1166. echo $"Unknown subkey usage: $GPG_KEY_USAGE"
  1167. echo $'Available types: sign|auth|encrypt'
  1168. exit 14783
  1169. fi
  1170. KEYGRIP=$(gpg --fingerprint --fingerprint $MY_EMAIL_ADDRESS | grep fingerprint | tail -1 | cut -d= -f2 | sed -e 's/ //g')
  1171. # Generate a GPG subkey
  1172. # Here a 2048bit length is used to be compatible with yubikey
  1173. echo 'Key-Type: 1' > /home/$MY_USERNAME/gpg-genkey.conf
  1174. echo "Key-Grip: $KEYGRIP" > /home/$MY_USERNAME/gpg-genkey.conf
  1175. echo 'Subkey-Type: 1' >> /home/$MY_USERNAME/gpg-genkey.conf
  1176. echo 'Subkey-Length: 2048' >> /home/$MY_USERNAME/gpg-genkey.conf
  1177. echo "subkey-Usage: $GPG_KEY_USAGE" > /home/$MY_USERNAME/gpg-genkey.conf
  1178. echo "Name-Real: $MY_NAME" >> /home/$MY_USERNAME/gpg-genkey.conf
  1179. echo "Name-Email: $MY_EMAIL_ADDRESS" >> /home/$MY_USERNAME/gpg-genkey.conf
  1180. echo "Name-Comment: $GPG_KEY_USAGE" >> /home/$MY_USERNAME/gpg-genkey.conf
  1181. echo 'Expire-Date: 0' >> /home/$MY_USERNAME/gpg-genkey.conf
  1182. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/gpg-genkey.conf
  1183. su -c "gpg --batch --gen-key /home/$MY_USERNAME/gpg-genkey.conf" - $MY_USERNAME
  1184. shred -zu /home/$MY_USERNAME/gpg-genkey.conf
  1185. MY_GPG_SUBKEY_ID=$(su -c "gpg --list-keys $MY_EMAIL_ADDRESS | grep 'pub '" - $MY_USERNAME | awk -F ' ' '{print $2}' | awk -F '/' '{print $2}')
  1186. echo 'create_gpg_subkey' >> $COMPLETION_FILE
  1187. }
  1188. function gpg_key_exists {
  1189. key_owner_username=$1
  1190. key_search_text=$2
  1191. if [[ $key_owner_username != "root" ]]; then
  1192. KEY_EXISTS=$(su -c "gpg --list-keys \"${key_search_text}\"" - $key_owner_username)
  1193. else
  1194. KEY_EXISTS=$(gpg --list-keys "${key_search_text}")
  1195. fi
  1196. if [ ! "$KEY_EXISTS" ]; then
  1197. echo "no"
  1198. return
  1199. fi
  1200. if [ "$KEY_EXISTS" == *"error"* ]; then
  1201. echo "no"
  1202. return
  1203. fi
  1204. echo "yes"
  1205. }
  1206. function gpg_pubkey_from_email {
  1207. key_owner_username=$1
  1208. key_email_address=$2
  1209. key_id=
  1210. if [[ $key_owner_username != "root" ]]; then
  1211. key_id=$(su -c "gpg --list-keys $key_email_address | grep 'pub '" - $key_owner_username | awk -F ' ' '{print $2}' | awk -F '/' '{print $2}')
  1212. else
  1213. key_id=$(gpg --list-keys $key_email_address | grep 'pub ' | awk -F ' ' '{print $2}' | awk -F '/' '{print $2}')
  1214. fi
  1215. echo $key_id
  1216. }
  1217. function configure_gpg {
  1218. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  1219. return
  1220. fi
  1221. if grep -Fxq "configure_gpg" $COMPLETION_FILE; then
  1222. return
  1223. fi
  1224. apt-get -y install gnupg
  1225. gpg_dir=/home/$MY_USERNAME/.gnupg
  1226. # if gpg keys directory was previously imported from usb
  1227. if [[ $GPG_KEYS_IMPORTED == "yes" && -d $gpg_dir ]]; then
  1228. echo $'GPG keys were imported'
  1229. sed -i "s|keyserver hkp://keys.gnupg.net|keyserver $GPG_KEYSERVER|g" $gpg_dir/gpg.conf
  1230. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1231. if [ ${#MY_GPG_PUBLIC_KEY_ID} -lt 4 ]; then
  1232. echo $'GPG public key ID could not be obtained'
  1233. fi
  1234. chown -R $MY_USERNAME:$MY_USERNAME $gpg_dir
  1235. chmod 700 $gpg_dir
  1236. chmod 600 $gpg_dir/*
  1237. echo 'configure_gpg' >> $COMPLETION_FILE
  1238. return
  1239. fi
  1240. if [ ! -d $gpg_dir ]; then
  1241. mkdir $gpg_dir
  1242. echo "keyserver $GPG_KEYSERVER" >> $gpg_dir/gpg.conf
  1243. echo 'keyserver-options auto-key-retrieve' >> $gpg_dir/gpg.conf
  1244. fi
  1245. sed -i "s|keyserver hkp://keys.gnupg.net|keyserver $GPG_KEYSERVER|g" $gpg_dir/gpg.conf
  1246. if ! grep -q "# default preferences" $gpg_dir/gpg.conf; then
  1247. echo '' >> $gpg_dir/gpg.conf
  1248. echo '# default preferences' >> $gpg_dir/gpg.conf
  1249. echo 'personal-digest-preferences SHA256' >> $gpg_dir/gpg.conf
  1250. echo 'cert-digest-algo SHA256' >> $gpg_dir/gpg.conf
  1251. echo 'default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed' >> $gpg_dir/gpg.conf
  1252. fi
  1253. chown -R $MY_USERNAME:$MY_USERNAME $gpg_dir
  1254. chmod 700 $gpg_dir
  1255. chmod 600 $gpg_dir/*
  1256. if [[ $MY_GPG_PUBLIC_KEY && $MY_GPG_PRIVATE_KEY ]]; then
  1257. echo $'Importing GPG keys from file'
  1258. echo $"Public key: $MY_GPG_PUBLIC_KEY"
  1259. echo $"Private key: $MY_GPG_PRIVATE_KEY"
  1260. # use your existing GPG keys which were exported
  1261. if [ ! -f $MY_GPG_PUBLIC_KEY ]; then
  1262. echo $"GPG public key file $MY_GPG_PUBLIC_KEY was not found"
  1263. exit 2483
  1264. fi
  1265. if [ ! -f $MY_GPG_PRIVATE_KEY ]; then
  1266. echo $"GPG private key file $MY_GPG_PRIVATE_KEY was not found"
  1267. exit 5383
  1268. fi
  1269. su -c "gpg --import $MY_GPG_PUBLIC_KEY" - $MY_USERNAME
  1270. su -c "gpg --allow-secret-key-import --import $MY_GPG_PRIVATE_KEY" - $MY_USERNAME
  1271. KEY_EXISTS=$(gpg_key_exists "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1272. if [[ $KEY_EXISTS == "no" ]]; then
  1273. echo $"The GPG key for $MY_EMAIL_ADDRESS could not be imported"
  1274. exit 13821
  1275. fi
  1276. # for security ensure that the private key file doesn't linger around
  1277. shred -zu $MY_GPG_PRIVATE_KEY
  1278. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1279. if [ ${#MY_GPG_PUBLIC_KEY_ID} -lt 4 ]; then
  1280. echo $'GPG public key ID could not be obtained'
  1281. fi
  1282. else
  1283. # Generate a GPG key
  1284. echo 'Key-Type: 1' > /home/$MY_USERNAME/gpg-genkey.conf
  1285. echo 'Key-Length: 4096' >> /home/$MY_USERNAME/gpg-genkey.conf
  1286. echo 'Subkey-Type: 1' >> /home/$MY_USERNAME/gpg-genkey.conf
  1287. echo 'Subkey-Length: 4096' >> /home/$MY_USERNAME/gpg-genkey.conf
  1288. echo "Name-Real: $MY_NAME" >> /home/$MY_USERNAME/gpg-genkey.conf
  1289. echo "Name-Email: $MY_EMAIL_ADDRESS" >> /home/$MY_USERNAME/gpg-genkey.conf
  1290. echo 'Expire-Date: 0' >> /home/$MY_USERNAME/gpg-genkey.conf
  1291. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/gpg-genkey.conf
  1292. echo $'Generating a new GPG key'
  1293. su -c "gpg --batch --gen-key /home/$MY_USERNAME/gpg-genkey.conf" - $MY_USERNAME
  1294. KEY_EXISTS=$(gpg_key_exists "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1295. if [[ $KEY_EXISTS == "no" ]]; then
  1296. echo $"A GPG key for $MY_EMAIL_ADDRESS could not be created"
  1297. exit 6362
  1298. fi
  1299. shred -zu /home/$MY_USERNAME/gpg-genkey.conf
  1300. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1301. if [ ${#MY_GPG_PUBLIC_KEY_ID} -lt 4 ]; then
  1302. echo $'GPG public key ID could not be obtained'
  1303. fi
  1304. MY_GPG_PUBLIC_KEY=/tmp/public_key.gpg
  1305. su -c "gpg --output $MY_GPG_PUBLIC_KEY --armor --export $MY_GPG_PUBLIC_KEY_ID" - $MY_USERNAME
  1306. if grep -q "configure_email" $COMPLETION_FILE; then
  1307. if ! grep -q $"Change your GPG password" /home/$MY_USERNAME/README; then
  1308. echo '' >> /home/$MY_USERNAME/README
  1309. echo '' >> /home/$MY_USERNAME/README
  1310. echo $'Change your GPG password' >> /home/$MY_USERNAME/README
  1311. echo '========================' >> /home/$MY_USERNAME/README
  1312. echo $"It's very important to add a password to your GPG key so that" >> /home/$MY_USERNAME/README
  1313. echo $"if anyone does get access to your email they still won't be able" >> /home/$MY_USERNAME/README
  1314. echo $'to read them without knowning the GPG password.' >> /home/$MY_USERNAME/README
  1315. echo $'You can change the it with:' >> /home/$MY_USERNAME/README
  1316. echo '' >> /home/$MY_USERNAME/README
  1317. echo " gpg --edit-key $MY_GPG_PUBLIC_KEY_ID" >> /home/$MY_USERNAME/README
  1318. echo ' passwd' >> /home/$MY_USERNAME/README
  1319. echo ' save' >> /home/$MY_USERNAME/README
  1320. echo ' quit' >> /home/$MY_USERNAME/README
  1321. fi
  1322. if ! grep -q $"Publish your GPG public key" /home/$MY_USERNAME/README; then
  1323. echo '' >> /home/$MY_USERNAME/README
  1324. echo '' >> /home/$MY_USERNAME/README
  1325. echo $'Publish your GPG public key' >> /home/$MY_USERNAME/README
  1326. echo '===========================' >> /home/$MY_USERNAME/README
  1327. echo $'So that others can send emails to you securely you should' >> /home/$MY_USERNAME/README
  1328. echo $'publish your GPG public key with the command:' >> /home/$MY_USERNAME/README
  1329. echo '' >> /home/$MY_USERNAME/README
  1330. echo " gpg --send-keys $MY_GPG_PUBLIC_KEY_ID" >> /home/$MY_USERNAME/README
  1331. fi
  1332. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/README
  1333. chmod 600 /home/$MY_USERNAME/README
  1334. fi
  1335. fi
  1336. echo 'configure_gpg' >> $COMPLETION_FILE
  1337. }
  1338. function refresh_gpg_keys {
  1339. REFRESH_GPG_KEYS_SCRIPT=/usr/bin/update-gpg-keys
  1340. echo '#!/bin/bash' > $REFRESH_GPG_KEYS_SCRIPT
  1341. echo "if [ -f /usr/local/bin/${PROJECT_NAME}-sec ]; then" >> $REFRESH_GPG_KEYS_SCRIPT
  1342. echo " /usr/bin/timeout 600 /usr/local/bin/${PROJECT_NAME}-sec --refresh yes" >> $REFRESH_GPG_KEYS_SCRIPT
  1343. echo 'else' >> $REFRESH_GPG_KEYS_SCRIPT
  1344. echo " /usr/bin/timeout 600 /usr/bin/${PROJECT_NAME}-sec --refresh yes" >> $REFRESH_GPG_KEYS_SCRIPT
  1345. echo 'fi' >> $REFRESH_GPG_KEYS_SCRIPT
  1346. chmod +x $REFRESH_GPG_KEYS_SCRIPT
  1347. if grep -q "${PROJECT_NAME}-sec" /etc/crontab; then
  1348. sed -i "/${PROJECT_NAME}-sec /d" /etc/crontab
  1349. fi
  1350. if ! grep -q "$REFRESH_GPG_KEYS_SCRIPT" /etc/crontab; then
  1351. GPG_REFRESH_TIME=$(( RANDOM % 60 ))
  1352. echo "$GPG_REFRESH_TIME */$REFRESH_GPG_KEYS_HOURS * * * root cronic $REFRESH_GPG_KEYS_SCRIPT" >> /etc/crontab
  1353. systemctl restart cron
  1354. else
  1355. sed -i "s|root $REFRESH_GPG_KEYS_SCRIPT.*|root cronic $REFRESH_GPG_KEYS_SCRIPT|g" /etc/crontab
  1356. fi
  1357. }
  1358. # NOTE: deliberately no exit 0