freedombone-base-email 65KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Email functions
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2014-2018 Bob Mottram <bob@freedombone.net>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. # the default email address
  31. MY_EMAIL_ADDRESS=$MY_USERNAME@$DEFAULT_DOMAIN_NAME
  32. # When sending mail to riseup.net route to this onion address
  33. RISEUP_EMAIL_ONION='wy6zk3pmcwiyhiao.onion'
  34. # If you want to run a public mailing list specify its name here.
  35. # There should be no spaces in the name
  36. PUBLIC_MAILING_LIST=
  37. # Optional different domain name for the public mailing list
  38. PUBLIC_MAILING_LIST_DOMAIN_NAME=
  39. # Directory where the public mailing list data is stored
  40. PUBLIC_MAILING_LIST_DIRECTORY="/var/spool/mlmmj"
  41. # If you want to run an encrypted mailing list specify its name here.
  42. # There should be no spaces in the name
  43. PRIVATE_MAILING_LIST=
  44. GPG_KEYSERVER="hkp://keys.gnupg.net"
  45. # whether to encrypt all incoming email with your public key
  46. GPG_ENCRYPT_STORED_EMAIL="yes"
  47. # optionally you can provide your exported GPG key pair here
  48. # Note that the private key file will be deleted after use
  49. # If these are unspecified then a new GPG key will be created
  50. MY_GPG_PUBLIC_KEY=
  51. MY_GPG_PRIVATE_KEY=
  52. # optionally specify your public key ID
  53. MY_GPG_PUBLIC_KEY_ID=
  54. # automatic archiving of email
  55. CLEANUP_MAILDIR_REPO="https://github.com/bashrc/cleanup-maildir"
  56. CLEANUP_MAILDIR_COMMIT='33241d2e3861f901ba17f5c77ada007e1ec06a86'
  57. # email encryption at rest
  58. GPGIT_REPO="https://gitlab.com/mikecardwell/gpgit"
  59. GPGIT_COMMIT='583dc76119f19420f8a33f606744faa7c8922738'
  60. # refresh gpg keys every few hours
  61. REFRESH_GPG_KEYS_HOURS=2
  62. exim_version='4.89'
  63. function rebuild_exim_with_socks {
  64. exim_socks_installed=$(get_completion_param "exim_socks")
  65. if [[ "$exim_socks_installed" == 'true' ]]; then
  66. return
  67. fi
  68. # shellcheck disable=SC2154
  69. if [ ! -d "$INSTALL_DIR/exim4" ]; then
  70. mkdir -p "$INSTALL_DIR/exim4"
  71. fi
  72. cd "$INSTALL_DIR/exim4" || exit 3468356
  73. rm -rf "$INSTALL_DIR/exim4/"*
  74. apt-get -qy install build-essential fakeroot devscripts
  75. apt-get source exim4-daemon-heavy
  76. apt-get -qy build-dep exim4-daemon-heavy
  77. cd "${INSTALL_DIR}/exim4/exim4-${exim_version}" || exit 356835685
  78. { echo 'Description: Socks proxying';
  79. echo ' Support for socks proxying of outgoing mail';
  80. echo ' This is to support onion email addresses, which require support for SOCKS5';
  81. echo ' .';
  82. echo " exim4 (${exim_version}-2+deb9u3) stretch-security; urgency=high";
  83. echo ' .';
  84. echo ' * Non-maintainer upload by the Security Team.';
  85. echo ' * Fix base64d() buffer size (CVE-2018-6789) (Closes: #890000)';
  86. echo 'Author: Salvatore Bonaccorso <carnil@debian.org>';
  87. echo 'Bug-Debian: https://bugs.debian.org/890000';
  88. echo '';
  89. echo '---';
  90. echo 'The information above should follow the Patch Tagging Guidelines, please';
  91. echo 'checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here';
  92. echo 'are templates for supplementary fields that you might want to add:';
  93. echo '';
  94. echo 'Origin: <vendor|upstream|other>, <url of original patch>';
  95. echo 'Bug: <url in upstream bugtracker>';
  96. echo 'Bug-Debian: https://bugs.debian.org/<bugnumber>';
  97. echo 'Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber>';
  98. echo 'Forwarded: <no|not-needed|url proving that it has been forwarded>';
  99. echo 'Reviewed-By: <name and email of someone who approved the patch>';
  100. echo "Last-Update: $(date +%Y-%m-%d)";
  101. echo '';
  102. echo '--- /dev/null';
  103. echo "+++ exim4-${exim_version}/Local/Makefile";
  104. echo '@@ -0,0 +1,32 @@';
  105. echo '+BIN_DIRECTORY=/usr/exim/bin';
  106. echo '+CONFIGURE_FILE=/usr/exim/configure';
  107. echo '+EXIM_USER=';
  108. echo '+SPOOL_DIRECTORY=/var/spool/exim';
  109. echo '+ROUTER_ACCEPT=yes';
  110. echo '+ROUTER_DNSLOOKUP=yes';
  111. echo '+ROUTER_IPLITERAL=yes';
  112. echo '+ROUTER_MANUALROUTE=yes';
  113. echo '+ROUTER_QUERYPROGRAM=yes';
  114. echo '+ROUTER_REDIRECT=yes';
  115. echo '+TRANSPORT_APPENDFILE=yes';
  116. echo '+TRANSPORT_AUTOREPLY=yes';
  117. echo '+TRANSPORT_PIPE=yes';
  118. echo '+TRANSPORT_SMTP=yes';
  119. echo '+LOOKUP_DBM=yes';
  120. echo '+LOOKUP_LSEARCH=yes';
  121. echo '+LOOKUP_DNSDB=yes';
  122. echo '+PCRE_CONFIG=yes';
  123. echo '+EXIM_MONITOR=eximon.bin';
  124. echo '+FIXED_NEVER_USERS=root';
  125. echo '+HEADERS_CHARSET="ISO-8859-1"';
  126. echo '+DLOPEN_LOCAL_SCAN=yes';
  127. echo '+LDFLAGS += -rdynamic';
  128. echo '+CFLAGS += -fvisibility=hidden';
  129. echo '+SYSLOG_LOG_PID=yes';
  130. echo '+EXICYCLOG_MAX=10';
  131. echo '+COMPRESS_COMMAND=/usr/bin/gzip';
  132. echo '+COMPRESS_SUFFIX=gz';
  133. echo '+ZCAT_COMMAND=/usr/bin/zcat';
  134. echo '+SUPPORT_SOCKS=yes';
  135. echo '+SYSTEM_ALIASES_FILE=/etc/aliases';
  136. echo '+EXIM_TMPDIR="/tmp"'; } > debian/patches/SOCKS
  137. debuild -us -uc
  138. cd "$INSTALL_DIR/exim4" || exit 3468356
  139. mv exim4_${exim_version}-*.deb exim4_${exim_version}_all.deb
  140. if [ ! -f exim4_${exim_version}_all.deb ]; then
  141. ls -l "$INSTALL_DIR/exim4/exim4_"*.deb
  142. echo "exim4_${exim_version}_all.deb not found"
  143. exit 63857368
  144. fi
  145. apt-mark -q unhold exim4
  146. dpkg -i exim4_${exim_version}_all.deb
  147. apt-mark -q hold exim4
  148. apt-get -yq remove --purge at
  149. systemctl restart exim4
  150. if [[ $(systemctl is-active exim4) != 'active' ]]; then
  151. apt-mark -q unhold exim4
  152. apt-get -yq install exim4 --reinstall
  153. systemctl restart exim4
  154. fi
  155. rm -rf "$INSTALL_DIR/exim4"
  156. set_completion_param "exim_socks" "true"
  157. }
  158. function email_create_template {
  159. if [ ! -d /etc/skel/log ]; then
  160. mkdir -m 700 /etc/skel/log
  161. fi
  162. if [ ! -d /etc/skel/Maildir ]; then
  163. mkdir -m 700 /etc/skel/.mutt
  164. mkdir -m 700 /etc/skel/Maildir
  165. mkdir -m 700 /etc/skel/Maildir/new
  166. mkdir -m 700 /etc/skel/Maildir/cur
  167. mkdir -m 700 /etc/skel/Maildir/Sent
  168. mkdir -m 700 /etc/skel/Maildir/Sent/tmp
  169. mkdir -m 700 /etc/skel/Maildir/Sent/cur
  170. mkdir -m 700 /etc/skel/Maildir/Sent/new
  171. mkdir -m 700 /etc/skel/Maildir/.learn-spam
  172. mkdir -m 700 /etc/skel/Maildir/.learn-spam/cur
  173. mkdir -m 700 /etc/skel/Maildir/.learn-spam/new
  174. mkdir -m 700 /etc/skel/Maildir/.learn-spam/tmp
  175. mkdir -m 700 /etc/skel/Maildir/.learn-ham
  176. mkdir -m 700 /etc/skel/Maildir/.learn-ham/cur
  177. mkdir -m 700 /etc/skel/Maildir/.learn-ham/new
  178. mkdir -m 700 /etc/skel/Maildir/.learn-ham/tmp
  179. ln -s /etc/skel/Maildir/.learn-spam /etc/skel/Maildir/spam
  180. ln -s /etc/skel/Maildir/.learn-ham /etc/skel/Maildir/ham
  181. fi
  182. if [ ! -d "/home/$MY_USERNAME/Maildir" ]; then
  183. mkdir -m 700 "/home/$MY_USERNAME/.mutt"
  184. mkdir -m 700 "/home/$MY_USERNAME/Maildir"
  185. mkdir -m 700 "/home/$MY_USERNAME/Maildir/cur"
  186. mkdir -m 700 "/home/$MY_USERNAME/Maildir/tmp"
  187. mkdir -m 700 "/home/$MY_USERNAME/Maildir/new"
  188. mkdir -m 700 "/home/$MY_USERNAME/Maildir/Sent"
  189. mkdir -m 700 "/home/$MY_USERNAME/Maildir/Sent/cur"
  190. mkdir -m 700 "/home/$MY_USERNAME/Maildir/Sent/tmp"
  191. mkdir -m 700 "/home/$MY_USERNAME/Maildir/Sent/new"
  192. mkdir -m 700 "/home/$MY_USERNAME/Maildir/.learn-spam"
  193. mkdir -m 700 "/home/$MY_USERNAME/Maildir/.learn-spam/cur"
  194. mkdir -m 700 "/home/$MY_USERNAME/Maildir/.learn-spam/new"
  195. mkdir -m 700 "/home/$MY_USERNAME/Maildir/.learn-spam/tmp"
  196. mkdir -m 700 "/home/$MY_USERNAME/Maildir/.learn-ham"
  197. mkdir -m 700 "/home/$MY_USERNAME/Maildir/.learn-ham/cur"
  198. mkdir -m 700 "/home/$MY_USERNAME/Maildir/.learn-ham/new"
  199. mkdir -m 700 "/home/$MY_USERNAME/Maildir/.learn-ham/tmp"
  200. ln -s "/home/$MY_USERNAME/Maildir/.learn-spam" "/home/$MY_USERNAME/Maildir/spam"
  201. ln -s "/home/$MY_USERNAME/Maildir/.learn-ham" "/home/$MY_USERNAME/Maildir/ham"
  202. chown -R "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/Maildir"
  203. fi
  204. }
  205. function create_email_onion_address {
  206. if ! grep -q "hidden_service_email" /etc/tor/torrc; then
  207. { echo 'HiddenServiceDir /var/lib/tor/hidden_service_email/';
  208. echo 'HiddenServiceVersion 3';
  209. echo 'HiddenServicePort 25 127.0.0.1:25';
  210. echo 'HiddenServicePort 587 127.0.0.1:587';
  211. echo 'HiddenServicePort 465 127.0.0.1:465'; } >> /etc/tor/torrc
  212. function_check onion_update
  213. onion_update
  214. function_check wait_for_onion_service
  215. wait_for_onion_service email
  216. if [ ! -f /var/lib/tor/hidden_service_email/hostname ]; then
  217. echo $"email onion site hostname not found"
  218. systemctl restart tor
  219. exit 782352
  220. fi
  221. onion_address=$(cat /var/lib/tor/hidden_service_email/hostname)
  222. set_completion_param "email onion domain" "${onion_address}"
  223. add_email_hostname "$onion_address"
  224. else
  225. onion_address=$(cat /var/lib/tor/hidden_service_email/hostname)
  226. fi
  227. }
  228. function configure_email_onion {
  229. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  230. return
  231. fi
  232. if [[ "$SYSTEM_TYPE" == "mesh"* ]]; then
  233. return
  234. fi
  235. create_email_onion_address
  236. #apt-get -yq install tinycdb perl
  237. # MX record should be:
  238. # _onion-mx._tcp
  239. # 20:$onion_address
  240. # 3600 IN SRV 0 5 25 $onion_address
  241. # Test with: exim -d -bt username@$onion_address
  242. #echo "$DEFAULT_DOMAIN_NAME $onion_address" > /etc/exim4/onionrelay.txt
  243. #cdb -m -c -t ~/onionrelay.tmp /etc/exim4/onionrelay.cdb /etc/exim4/onionrelay.txt
  244. { echo "perl_startup = do '/etc/exim4/perl-routines.pl'";
  245. echo "perl_at_start"; } > /etc/exim4/conf.d/main/00_exim4-config_perl
  246. { echo "use Net::DNS::Resolver;";
  247. echo "sub onionLookup {";
  248. echo " my \$hostname = shift;";
  249. echo " my \$res = Net::DNS::Resolver->new(nameservers => [qw(127.0.0.1)],);";
  250. echo " \$res->port(5300);";
  251. echo " my \$query = \$res->search(\$hostname);";
  252. echo " foreach my \$rr (\$query->answer) {";
  253. echo " next unless \$rr->type eq \"A\";";
  254. echo " return \$rr->address;";
  255. echo " }";
  256. echo " return 'no_such_host';";
  257. echo "}"; } > /etc/exim4/perl-routines.pl
  258. #{ echo "ONION_RELAYDB=/etc/exim4/onionrelay.cdb";
  259. # echo "domainlist onion_relays = cdb;ONION_RELAYDB"; } > /etc/exim4/conf.d/main/48_exim4-config_onion_relays
  260. { echo "riseup:";
  261. echo " driver = manualroute";
  262. echo " domains = riseup.net";
  263. echo " transport = onion_relay";
  264. echo " route_data = \${perl{onionLookup}{$RISEUP_EMAIL_ONION}}"
  265. echo " no_more"; } > /etc/exim4/conf.d/router/049_exim4-config-riseup
  266. { echo "onionrelays:";
  267. echo " driver = manualroute";
  268. echo " domains = *.onion";
  269. echo " transport = onion_relay";
  270. #echo " route_data = \${lookup dnsdb{a=\$domain}}";
  271. echo " route_data = \${perl{onionLookup}{\$domain}}"
  272. echo " no_more"; } > /etc/exim4/conf.d/router/050_exim4-config-onionrelays
  273. { echo "onion_relay:";
  274. echo " driver = smtp";
  275. echo " socks_proxy = 127.0.0.1 port=9050"; } > /etc/exim4/conf.d/transport/050_exim4-config_onion_relay
  276. if ! grep -q "AutomapHostsOnResolve" /etc/tor/torrc; then
  277. echo 'AutomapHostsOnResolve 1' >> /etc/tor/torrc
  278. else
  279. sed -i 's|#AutomapHostsOnResolve.*|AutomapHostsOnResolve 1|g' /etc/tor/torrc
  280. sed -i 's|AutomapHostsOnResolve.*|AutomapHostsOnResolve 1|g' /etc/tor/torrc
  281. fi
  282. if ! grep -q "DNSPort " /etc/tor/torrc; then
  283. echo 'DNSPort 5300' >> /etc/tor/torrc
  284. else
  285. sed -i 's|#DNSPort .*|DNSPort 5300|g' /etc/tor/torrc
  286. sed -i 's|DNSPort .*|DNSPort 5300|g' /etc/tor/torrc
  287. fi
  288. if ! grep -q "DNSListenAddress" /etc/tor/torrc; then
  289. echo 'DNSListenAddress 127.0.0.1' >> /etc/tor/torrc
  290. else
  291. sed -i 's|#DNSListenAddress.*|DNSListenAddress 127.0.0.1|g' /etc/tor/torrc
  292. sed -i 's|DNSListenAddress.*|DNSListenAddress 127.0.0.1|g' /etc/tor/torrc
  293. fi
  294. update-exim4.conf.template -r
  295. update-exim4.conf
  296. dpkg-reconfigure --frontend noninteractive exim4-config
  297. systemctl restart tor
  298. systemctl restart exim4
  299. mark_completed "${FUNCNAME[0]}"
  300. }
  301. function check_email_address_exists {
  302. read_config_param ONION_ONLY
  303. read_config_param MY_USERNAME
  304. read_config_param DEFAULT_DOMAIN_NAME
  305. read_config_param MY_EMAIL_ADDRESS
  306. read_config_param DH_KEYLENGTH
  307. if [ ! "$MY_USERNAME" ]; then
  308. echo $'No username for email installation'
  309. exit 73672
  310. fi
  311. if [ ! "$DEFAULT_DOMAIN_NAME" ]; then
  312. echo $'No default domain name for email installation'
  313. exit 57634
  314. fi
  315. my_email="$MY_EMAIL_ADDRESS"
  316. if [ ${#my_email} -lt 3 ]; then
  317. MY_EMAIL_ADDRESS="${MY_USERNAME}@${DEFAULT_DOMAIN_NAME}"
  318. write_config_param "MY_EMAIL_ADDRESS" "$MY_EMAIL_ADDRESS"
  319. fi
  320. if [[ $ONION_ONLY != 'no' ]]; then
  321. my_email=$onion_address
  322. MY_EMAIL_ADDRESS=$onion_address
  323. write_config_param "MY_EMAIL_ADDRESS" "$MY_EMAIL_ADDRESS"
  324. fi
  325. }
  326. function backup_email {
  327. echo ''
  328. }
  329. function configure_firewall_for_email {
  330. if [[ "$INSTALLED_WITHIN_DOCKER" == "yes" ]]; then
  331. # docker does its own firewalling
  332. return
  333. fi
  334. if [[ "$ONION_ONLY" != "no" ]]; then
  335. return
  336. fi
  337. firewall_add Email 25 tcp
  338. firewall_add Email 587 tcp
  339. firewall_add Email 465 tcp
  340. firewall_add Imap 993 tcp
  341. }
  342. function encrypt_incoming_email {
  343. # encrypts incoming mail using your GPG public key
  344. # so even if an attacker gains access to the data at rest they still need
  345. # to know your GPG key password to be able to read anything
  346. if [ ! -d /etc/exim4 ]; then
  347. return
  348. fi
  349. # update to the next commit
  350. function_check set_repo_commit
  351. set_repo_commit "$INSTALL_DIR/gpgit" "gpgit commit" "$GPGIT_COMMIT" "$GPGIT_REPO"
  352. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  353. return
  354. fi
  355. if [[ "$GPG_ENCRYPT_STORED_EMAIL" != "yes" ]]; then
  356. return
  357. fi
  358. if [ ! -f /usr/bin/gpgit.pl ]; then
  359. apt-get -yq install git libmail-gnupg-perl
  360. cd "$INSTALL_DIR" || exit 246824624
  361. function_check git_clone
  362. git_clone "$GPGIT_REPO" "$INSTALL_DIR/gpgit"
  363. cd "$INSTALL_DIR/gpgit" || exit 7246725474
  364. git checkout "$GPGIT_COMMIT" -b "$GPGIT_COMMIT"
  365. set_completion_param "gpgit commit" "$GPGIT_COMMIT"
  366. cp gpgit.pl /usr/bin
  367. fi
  368. # add a procmail rule
  369. if ! grep -q "/usr/bin/gpgit.pl" "/home/$MY_USERNAME/.procmailrc"; then
  370. { echo '';
  371. echo ':0 f';
  372. echo "| /usr/bin/gpgit.pl --encrypt-mode prefer-inline --inline-flatten $MY_EMAIL_ADDRESS"; } >> "/home/$MY_USERNAME/.procmailrc"
  373. chown "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/.procmailrc"
  374. { echo '';
  375. echo ':0 f';
  376. echo -n "| /usr/bin/gpgit.pl --encrypt-mode prefer-inline --inline-flatten \$USER@";
  377. echo "$DEFAULT_DOMAIN_NAME"; } >> /etc/skel/.procmailrc
  378. fi
  379. mark_completed "${FUNCNAME[0]}"
  380. }
  381. function encrypt_outgoing_email {
  382. # encrypts outgoing mail using your GPG public key
  383. # so even if an attacker gains access to the data at rest they still need
  384. # to know your GPG key password to be able to read sent mail
  385. if [ ! -d /etc/exim4 ]; then
  386. return
  387. fi
  388. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  389. return
  390. fi
  391. if [[ "$GPG_ENCRYPT_STORED_EMAIL" != "yes" ]]; then
  392. return
  393. fi
  394. if [ ! -d "/home/$MY_USERNAME/.gnupg" ]; then
  395. return
  396. fi
  397. if [ ! -f "/home/$MY_USERNAME/.muttrc" ]; then
  398. return
  399. fi
  400. # obtain your public key ID
  401. if [ ! "$MY_GPG_PUBLIC_KEY_ID" ]; then
  402. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  403. if [ ! "$MY_GPG_PUBLIC_KEY_ID" ]; then
  404. return
  405. fi
  406. if [ ${#MY_GPG_PUBLIC_KEY_ID} -lt 4 ]; then
  407. return
  408. fi
  409. fi
  410. if ! grep -q "pgp_encrypt_only_command" "/home/$MY_USERNAME/.muttrc"; then
  411. { echo '';
  412. echo $'# Encrypt items in the Sent folder';
  413. echo "set pgp_encrypt_only_command=\"/usr/lib/mutt/pgpewrap gpg --batch --quiet --no-verbose --output - --encrypt --textmode --armor --trust-model always --encrypt-to $MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\""; } >> "/home/$MY_USERNAME/.muttrc"
  414. else
  415. sed -i "s|set pgp_encrypt_only_command.*|set pgp_encrypt_only_command=\"/usr/lib/mutt/pgpewrap gpg --batch --quiet --no-verbose --output - --encrypt --textmode --armor --trust-model always --encrypt-to $MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"|g" "/home/$MY_USERNAME/.muttrc"
  416. fi
  417. if ! grep -q "pgp_encrypt_sign_command" "/home/$MY_USERNAME/.muttrc"; then
  418. echo "set pgp_encrypt_sign_command=\"/usr/lib/mutt/pgpewrap gpg %?p?--passphrase-fd 0? --batch --quiet --no-verbose --textmode --output - --encrypt --sign %?a?-u %a? --armor --trust-model always --encrypt-to $MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"" >> "/home/$MY_USERNAME/.muttrc"
  419. else
  420. sed -i "s|set pgp_encrypt_sign_command.*|set pgp_encrypt_sign_command=\"/usr/lib/mutt/pgpewrap gpg %?p?--passphrase-fd 0? --batch --quiet --no-verbose --textmode --output - --encrypt --sign %?a?-u %a? --armor --trust-model always --encrypt-to $MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"|g" "/home/$MY_USERNAME/.muttrc"
  421. fi
  422. mark_completed "${FUNCNAME[0]}"
  423. }
  424. function encrypt_all_email {
  425. if [ ! -d /etc/exim4 ]; then
  426. return
  427. fi
  428. if [[ "$GPG_ENCRYPT_STORED_EMAIL" != "yes" ]]; then
  429. return
  430. fi
  431. if [ -f "/usr/local/bin/${PROJECT_NAME}-encrypt-mail" ]; then
  432. if [ ! -f /usr/bin/encmaildir ]; then
  433. cp "/usr/local/bin/${PROJECT_NAME}-encrypt-mail" /usr/bin/encmaildir
  434. else
  435. HASH1=$(sha256sum "/usr/local/bin/${PROJECT_NAME}-encrypt-mail" | awk -F ' ' '{print $1}')
  436. HASH2=$(sha256sum /usr/bin/encmaildir | awk -F ' ' '{print $1}')
  437. if [[ "$HASH1" != "$HASH2" ]]; then
  438. cp "/usr/local/bin/${PROJECT_NAME}-encrypt-mail" /usr/bin/encmaildir
  439. fi
  440. fi
  441. else
  442. if [ ! -f /usr/bin/encmaildir ]; then
  443. cp "/usr/bin/${PROJECT_NAME}-encrypt-mail" /usr/bin/encmaildir
  444. else
  445. HASH1=$(sha256sum "/usr/bin/${PROJECT_NAME}-encrypt-mail" | awk -F ' ' '{print $1}')
  446. HASH2=$(sha256sum /usr/bin/encmaildir | awk -F ' ' '{print $1}')
  447. if [[ "$HASH1" != "$HASH2" ]]; then
  448. cp "/usr/bin/${PROJECT_NAME}-encrypt-mail" /usr/bin/encmaildir
  449. fi
  450. fi
  451. fi
  452. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  453. return
  454. fi
  455. if [ ! -f "/home/$MY_USERNAME/README" ]; then
  456. touch "/home/$MY_USERNAME/README"
  457. fi
  458. if ! grep -q $"If you have imported legacy email which is not encrypted" "/home/$MY_USERNAME/README"; then
  459. { echo '';
  460. echo '';
  461. echo $'# Encrypting legacy email';
  462. echo $'If you have imported legacy email which is not encrypted';
  463. echo $'then it can be encrypted with the command:';
  464. echo '';
  465. echo ' encmaildir';
  466. echo '';
  467. echo $'But be warned that depending upon how much email you have';
  468. echo $'this could take a seriously LONG time on the Beaglebone';
  469. echo $'and may be better done on a faster machine.'; } >> "/home/$MY_USERNAME/README"
  470. chown "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/README"
  471. chmod 600 "/home/$MY_USERNAME/README"
  472. fi
  473. mark_completed "${FUNCNAME[0]}"
  474. }
  475. function email_client {
  476. if [ ! -d /etc/exim4 ]; then
  477. return
  478. fi
  479. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  480. return
  481. fi
  482. apt-get -yq install lynx abook urlview mutt
  483. if [ ! -f /etc/Muttrc ]; then
  484. echo $"ERROR: Mutt does not appear to have installed. $CHECK_MESSAGE"
  485. exit 49
  486. fi
  487. if [ ! -d "/home/$MY_USERNAME/.mutt" ]; then
  488. mkdir "/home/$MY_USERNAME/.mutt"
  489. fi
  490. echo "text/html; lynx -dump -width=78 -nolist %s | sed ‘s/^ //’; copiousoutput; needsterminal; nametemplate=%s.html" > "/home/$MY_USERNAME/.mutt/mailcap"
  491. cp "/home/$MY_USERNAME/.mutt/mailcap" /etc/skel/.mutt
  492. chown -R "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/.mutt"
  493. chown -R root:root /etc/skel/.mutt
  494. { echo 'set mbox_type=Maildir';
  495. echo 'set folder="~/Maildir"';
  496. echo 'set mask="!^\\.[^.]"';
  497. echo 'set mbox="~/Maildir"';
  498. echo 'set record="+Sent"';
  499. echo 'set postponed="+Drafts"';
  500. echo 'set trash="+Trash"';
  501. echo 'set spoolfile="~/Maildir"';
  502. echo 'auto_view text/x-vcard text/html text/enriched';
  503. echo 'set header_cache="+.cache"';
  504. echo 'set markers=no';
  505. echo '';
  506. echo '# ctrl-u to view long URLs';
  507. echo 'macro pager \cu <pipe-entry>"urlview"<enter> "Follow links with urlview"';
  508. echo '';
  509. echo 'macro index S "<tag-prefix><decode-save>=.learn-spam<enter>" "move to learn-spam"';
  510. echo 'macro pager S "<decode-save>=.learn-spam<enter>" "move to learn-spam"';
  511. echo 'macro index H "<tag-prefix><decode-copy>=.learn-ham<enter>" "copy to learn-ham"';
  512. echo 'macro pager H "<decode-copy>=.learn-ham<enter>" "copy to learn-ham"';
  513. echo '';
  514. echo '# set up the sidebar';
  515. echo 'set sidebar_width=22';
  516. echo 'set sidebar_visible=yes';
  517. echo '';
  518. echo 'set rfc2047_parameters';
  519. echo '';
  520. echo '# Show inbox and sent items';
  521. echo 'mailboxes = =admin =Sent =maybe-spam =spam';
  522. echo '';
  523. echo '# Alter these colours as needed for maximum bling';
  524. echo 'color sidebar_new yellow default';
  525. echo 'color normal white default';
  526. echo 'color hdrdefault brightcyan default';
  527. echo 'color signature green default';
  528. echo 'color attachment brightyellow default';
  529. echo 'color quoted green default';
  530. echo 'color quoted1 white default';
  531. echo 'color tilde blue default';
  532. echo '';
  533. echo '# ctrl-n, ctrl-p to select next, prev folder';
  534. echo '# ctrl-o to open selected folder';
  535. echo 'bind index \Cp sidebar-prev';
  536. echo 'bind index \Cn sidebar-next';
  537. echo 'bind index \Co sidebar-open';
  538. echo 'bind pager \Cp sidebar-prev';
  539. echo 'bind pager \Cn sidebar-next';
  540. echo 'bind pager \Co sidebar-open';
  541. echo '';
  542. echo '# ctrl-b toggles sidebar visibility';
  543. echo "macro index,pager \\Cb '<enter-command>toggle sidebar_visible<enter><redraw-screen>' 'toggle sidebar'";
  544. echo '';
  545. echo '# esc-m Mark new messages as read';
  546. echo 'macro index <esc>m "T~N<enter>;WNT~O<enter>;WO\CT~T<enter>" "mark all messages read"';
  547. echo '';
  548. echo '# Collapsing threads';
  549. echo 'macro index [ "<collapse-thread>" "collapse/uncollapse thread"';
  550. echo 'macro index ] "<collapse-all>" "collapse/uncollapse all threads"';
  551. echo '';
  552. echo '# threads containing new messages';
  553. echo 'uncolor index "~(~N)"';
  554. echo 'color index brightblue default "~(~N)"';
  555. echo '';
  556. echo '# new messages themselves';
  557. echo 'uncolor index "~N"';
  558. echo 'color index brightyellow default "~N"';
  559. echo '';
  560. echo '# GPG/PGP integration';
  561. echo '# this set the number of seconds to keep in memory the passphrase used to encrypt/sign';
  562. echo 'set pgp_timeout=1800';
  563. echo '';
  564. echo '# automatically sign and encrypt with PGP/MIME';
  565. echo 'set pgp_autosign # autosign all outgoing mails';
  566. echo 'set pgp_autoencrypt # Try to encrypt automatically';
  567. echo 'set pgp_replyencrypt # autocrypt replies to crypted';
  568. echo 'set pgp_replysign # autosign replies to signed';
  569. echo 'set pgp_auto_decode=yes # decode attachments';
  570. echo 'set fcc_clear=no # Keep encrypted copy of sent encrypted mail';
  571. echo 'unset smime_is_default';
  572. echo '';
  573. echo 'set alias_file=~/.mutt-alias';
  574. echo 'source ~/.mutt-alias';
  575. echo 'set query_command= "abook --mutt-query \"%s\""';
  576. echo 'macro index,pager A "<pipe-message>abook --add-email-quiet<return>" "add the sender address to abook"';
  577. echo '';
  578. echo '# Optional relay of SMTP via ISP';
  579. echo '#set smtp_url="smtps://username:password@isp_mail_domain:465/"'; } > /etc/Muttrc
  580. # For viewing long URLs
  581. echo 'REGEXP (((http|https|ftp|gopher)|mailto)[.:][^ >"\t]*|www\.[-a-z0-9.]+)[^ .,;\t>">\):]' > "/home/$MY_USERNAME/.urlview"
  582. echo 'COMMAND lynx -dump -width=78 -nolist %s' >> "/home/$MY_USERNAME/.urlview"
  583. cp -f /etc/Muttrc "/home/$MY_USERNAME/.muttrc"
  584. cp -f /etc/Muttrc /etc/skel/.muttrc
  585. cp -f "/home/$MY_USERNAME/.urlview" /etc/skel/.urlview
  586. touch "/home/$MY_USERNAME/.mutt-alias"
  587. cp "/home/$MY_USERNAME/.mutt-alias" /etc/skel/.mutt-alias
  588. chown "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/.muttrc"
  589. chown "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/.mutt-alias"
  590. # default user on generic images
  591. if [ -d "/home/${GENERIC_IMAGE_USERNAME}" ]; then
  592. cp -f /etc/Muttrc "/home/${GENERIC_IMAGE_USERNAME}/.muttrc"
  593. chown "${GENERIC_IMAGE_USERNAME}":"${GENERIC_IMAGE_USERNAME}" "/home/${GENERIC_IMAGE_USERNAME}/.muttrc"
  594. touch "/home/${GENERIC_IMAGE_USERNAME}/.mutt-alias"
  595. chown "${GENERIC_IMAGE_USERNAME}":"${GENERIC_IMAGE_USERNAME}" "/home/${GENERIC_IMAGE_USERNAME}/.mutt-alias"
  596. fi
  597. mark_completed "${FUNCNAME[0]}"
  598. }
  599. function email_archiving {
  600. if [ ! -d /etc/exim4 ]; then
  601. return
  602. fi
  603. # ensure that the mail archive script is up to date
  604. if [ -f "/usr/local/bin/${PROJECT_NAME}-archive-mail" ]; then
  605. if [ ! -f /etc/cron.daily/archivemail ]; then
  606. cp "/usr/local/bin/${PROJECT_NAME}-archive-mail" /etc/cron.daily/archivemail
  607. chmod +x /etc/cron.daily/archivemail
  608. else
  609. HASH1=$(sha256sum "/usr/local/bin/${PROJECT_NAME}-archive-mail" | awk -F ' ' '{print $1}')
  610. HASH2=$(sha256sum /etc/cron.daily/archivemail | awk -F ' ' '{print $1}')
  611. if [[ "$HASH1" != "$HASH2" ]]; then
  612. cp "/usr/local/bin/${PROJECT_NAME}-archive-mail" /etc/cron.daily/archivemail
  613. chmod +x /etc/cron.daily/archivemail
  614. fi
  615. fi
  616. else
  617. if [ -f "/usr/bin/${PROJECT_NAME}-archive-mail" ]; then
  618. if [ ! -f /etc/cron.daily/archivemail ]; then
  619. cp "/usr/bin/${PROJECT_NAME}-archive-mail" /etc/cron.daily/archivemail
  620. chmod +x /etc/cron.daily/archivemail
  621. else
  622. HASH1=$(sha256sum "/usr/local/bin/${PROJECT_NAME}-archive-mail" | awk -F ' ' '{print $1}')
  623. HASH2=$(sha256sum /etc/cron.daily/archivemail | awk -F ' ' '{print $1}')
  624. if [[ "$HASH1" != "$HASH2" ]]; then
  625. cp "/usr/local/bin/${PROJECT_NAME}-archive-mail" /etc/cron.daily/archivemail
  626. chmod +x /etc/cron.daily/archivemail
  627. fi
  628. fi
  629. else
  630. echo "/usr/bin/${PROJECT_NAME}-archive-mail was not found. ${PROJECT_NAME} might not have fully installed."
  631. exit 62379
  632. fi
  633. fi
  634. # update to the next commit
  635. function_check set_repo_commit
  636. set_repo_commit "$INSTALL_DIR/cleanup-maildir" "cleanup-maildir commit" "$CLEANUP_MAILDIR_COMMIT" "$CLEANUP_MAILDIR_REPO"
  637. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  638. return
  639. fi
  640. if [ ! -d "$INSTALL_DIR" ]; then
  641. mkdir "$INSTALL_DIR"
  642. fi
  643. cd "$INSTALL_DIR" || exit 246824245242
  644. function_check git_clone
  645. git_clone "$CLEANUP_MAILDIR_REPO" "$INSTALL_DIR/cleanup-maildir"
  646. cd "$INSTALL_DIR/cleanup-maildir" || exit 6887242572
  647. git checkout $CLEANUP_MAILDIR_COMMIT -b $CLEANUP_MAILDIR_COMMIT
  648. set_completion_param "cleanup-maildir commit" "$CLEANUP_MAILDIR_COMMIT"
  649. if [ ! -f /usr/bin/cleanup-maildir ]; then
  650. cp "$INSTALL_DIR/cleanup-maildir/cleanup-maildir" /usr/bin
  651. else
  652. HASH1=$(sha256sum "$INSTALL_DIR/cleanup-maildir/cleanup-maildir" | awk -F ' ' '{print $1}')
  653. HASH2=$(sha256sum /usr/bin/cleanup-maildir | awk -F ' ' '{print $1}')
  654. if [[ "$HASH1" != "$HASH2" ]]; then
  655. cp "$INSTALL_DIR/cleanup-maildir/cleanup-maildir" /usr/bin
  656. fi
  657. fi
  658. mark_completed "${FUNCNAME[0]}"
  659. }
  660. # Ensure that the from field is correct when sending email from Mutt
  661. function email_from_address {
  662. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  663. return
  664. fi
  665. if [ ! -f "/home/$MY_USERNAME/.muttrc" ]; then
  666. return
  667. fi
  668. if grep -q "set from=" "/home/$MY_USERNAME/.muttrc"; then
  669. sed -i "s|set from=.*|set from='$MY_NAME <$MY_EMAIL_ADDRESS>'|g" "/home/$MY_USERNAME/.muttrc"
  670. else
  671. echo "set from='$MY_NAME <$MY_EMAIL_ADDRESS>'" >> "/home/$MY_USERNAME/.muttrc"
  672. fi
  673. mark_completed "${FUNCNAME[0]}"
  674. }
  675. function create_public_mailing_list {
  676. if [ ! -d /etc/exim4 ]; then
  677. return
  678. fi
  679. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  680. return
  681. fi
  682. if [ ! "$PUBLIC_MAILING_LIST" ]; then
  683. return
  684. fi
  685. # does the mailing list have a separate domain name?
  686. if [ ! "$PUBLIC_MAILING_LIST_DOMAIN_NAME" ]; then
  687. PUBLIC_MAILING_LIST_DOMAIN_NAME="$DEFAULT_DOMAIN_NAME"
  688. fi
  689. PUBLIC_MAILING_LIST_USER="mlmmj"
  690. apt-get -yq install mlmmj
  691. adduser --system "$PUBLIC_MAILING_LIST_USER"
  692. addgroup "$PUBLIC_MAILING_LIST_USER"
  693. adduser "$PUBLIC_MAILING_LIST_USER" "$PUBLIC_MAILING_LIST_USER"
  694. echo ''
  695. echo $"Creating the $PUBLIC_MAILING_LIST mailing list"
  696. echo ''
  697. # create the list
  698. mlmmj-make-ml -a -L "$PUBLIC_MAILING_LIST" -c "$PUBLIC_MAILING_LIST_USER"
  699. { echo 'SYSTEM_ALIASES_PIPE_TRANSPORT = address_pipe';
  700. echo "SYSTEM_ALIASES_USER = $PUBLIC_MAILING_LIST_USER";
  701. echo "SYSTEM_ALIASES_GROUP = $PUBLIC_MAILING_LIST_USER"; } > /etc/exim4/conf.d/main/000_localmacros
  702. # router
  703. { echo 'mlmmj_router:';
  704. echo " debug_print = \"R: mlmmj_router for \$local_part@\$domain\"";
  705. echo ' driver = accept';
  706. echo ' domains = +mlmmj_domains';
  707. echo " #require_files = MLMMJ_HOME/\${lc::\$local_part}";
  708. echo ' # Use this instead, if you dont want to give Exim rx rights to mlmmj spool.';
  709. echo ' # Exim will then spawn a new process running under the UID of "mlmmj".';
  710. echo " require_files = mlmmj:MLMMJ_HOME/\${lc::\$local_part}";
  711. echo ' local_part_suffix = +*';
  712. echo ' local_part_suffix_optional';
  713. echo ' headers_remove = Delivered-To';
  714. echo " headers_add = Delivered-To: \$local_part\$local_part_suffix@\$domain";
  715. echo ' transport = mlmmj_transport'; } > /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  716. # transport
  717. { echo 'mlmmj_transport:';
  718. echo " debug_print = \"T: mlmmj_transport for \$local_part@\$domain\"";
  719. echo ' driver = pipe';
  720. echo ' return_path_add';
  721. echo ' user = mlmmj';
  722. echo ' group = mlmmj';
  723. echo ' home_directory = MLMMJ_HOME';
  724. echo ' current_directory = MLMMJ_HOME';
  725. echo " command = /usr/bin/mlmmj-receive -F -L MLMMJ_HOME/\${lc:\$local_part}"; } > /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  726. if ! grep -q "MLMMJ_HOME=/var/spool/mlmmj" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs; then
  727. sed -i '/MAIN CONFIGURATION SETTINGS/a\MLMMJ_HOME=/var/spool/mlmmj' /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs
  728. fi
  729. if ! grep -q "domainlist mlmmj_domains =" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs; then
  730. sed -i "/MLMMJ_HOME/a\\domainlist mlmmj_domains = $PUBLIC_MAILING_LIST_DOMAIN_NAME" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs
  731. fi
  732. if ! grep -q "delay_warning_condition =" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs; then
  733. sed -i "/domainlist mlmmj_domains =/a\\delay_warning_condition = \${if match_domain{\$domain}{+mlmmj_domains}{no}{yes}}" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs
  734. fi
  735. if ! grep -q ": +mlmmj_domains" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs; then
  736. sed -i 's/domainlist relay_to_domains = MAIN_RELAY_TO_DOMAINS/domainlist relay_to_domains = MAIN_RELAY_TO_DOMAINS : +mlmmj_domains/g' /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs
  737. fi
  738. if ! grep -q "! +mlmmj_domains" /etc/exim4/conf.d/router/200_exim4-config_primary; then
  739. sed -i 's/domains = ! +local_domains/domains = ! +mlmmj_domains : ! +local_domains/g' /etc/exim4/conf.d/router/200_exim4-config_primary
  740. fi
  741. update-exim4.conf.template -r
  742. update-exim4.conf
  743. systemctl restart exim4
  744. if ! grep -q $"$PUBLIC_MAILING_LIST mailing list" "/home/$MY_USERNAME/README"; then
  745. { echo '';
  746. echo '';
  747. echo $"$PUBLIC_MAILING_LIST mailing list";
  748. echo '=================================';
  749. echo $"To subscribe to the $PUBLIC_MAILING_LIST mailing list send a";
  750. echo $"cleartext email to $PUBLIC_MAILING_LIST+subscribe@$DEFAULT_DOMAIN_NAME"; } >> "/home/$MY_USERNAME/README"
  751. chown "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/README"
  752. chmod 600 "/home/$MY_USERNAME/README"
  753. fi
  754. "${PROJECT_NAME}-addlist" -u "$MY_USERNAME" -l "$PUBLIC_MAILING_LIST" -s "$PUBLIC_MAILING_LIST"
  755. mark_completed "${FUNCNAME[0]}"
  756. }
  757. function split_gpg_key_into_fragments {
  758. # split the gpg key into fragments if social key management is enabled
  759. if [[ "$ENABLE_SOCIAL_KEY_MANAGEMENT" == "yes" ]]; then
  760. if [ "$IMAGE_PASSWORD_FILE" ]; then
  761. if [ -f "$IMAGE_PASSWORD_FILE" ]; then
  762. "${PROJECT_NAME}-splitkey" -u "$MY_USERNAME" -e "$MY_EMAIL_ADDRESS" --fullname "$MY_NAME" --passwordfile "$IMAGE_PASSWORD_FILE"
  763. return
  764. fi
  765. fi
  766. echo 'Splitting GPG key. You may need to enter your passphrase.'
  767. "${PROJECT_NAME}-splitkey" -u "$MY_USERNAME" -e "$MY_EMAIL_ADDRESS" --fullname "$MY_NAME"
  768. if [ ! -d "/home/$MY_USERNAME/.gnupg_fragments" ]; then
  769. echo 'Yhe GPG key could not be split'
  770. exit 86548
  771. fi
  772. fi
  773. }
  774. function import_email {
  775. if [ ! -d /etc/exim4 ]; then
  776. return
  777. fi
  778. EMAIL_COMPLETE_MSG=$"
  779. *** ${PROJECT_NAME} mailbox installation is complete ***
  780. Now on your internet router forward ports
  781. 25, 587, 465, 993 and 2222 to the ${PROJECT_NAME}
  782. "
  783. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  784. if [[ "$SYSTEM_TYPE" == "mail"* ]]; then
  785. function_check backup_to_friends_servers
  786. backup_to_friends_servers
  787. function_check install_tripwire
  788. install_tripwire
  789. function_check split_gpg_key_into_fragments
  790. split_gpg_key_into_fragments
  791. clear
  792. echo ''
  793. echo "$EMAIL_COMPLETE_MSG"
  794. if [ -d "$USB_MOUNT" ]; then
  795. umount "$USB_MOUNT"
  796. rm -rf "$USB_MOUNT"
  797. echo $' You can now remove the USB drive'
  798. fi
  799. exit 0
  800. fi
  801. return
  802. fi
  803. mark_completed "${FUNCNAME[0]}"
  804. if [[ "$SYSTEM_TYPE" == "mail"* ]]; then
  805. function_check backup_to_friends_servers
  806. backup_to_friends_servers
  807. function_check install_tripwire
  808. install_tripwire
  809. function_check split_gpg_key_into_fragments
  810. split_gpg_key_into_fragments
  811. # unmount any attached usb drive
  812. clear
  813. echo ''
  814. echo "$EMAIL_COMPLETE_MSG"
  815. echo ''
  816. if [ -d "$USB_MOUNT" ]; then
  817. umount "$USB_MOUNT"
  818. rm -rf "$USB_MOUNT"
  819. echo $' You can now remove the USB drive'
  820. fi
  821. exit 0
  822. fi
  823. }
  824. function remove_email {
  825. echo ''
  826. }
  827. function install_email_basic {
  828. apt-get -yq remove postfix
  829. apt-get -yq install exim4 sasl2-bin swaks libnet-ssleay-perl procmail
  830. if [ ! -d /etc/exim4 ]; then
  831. echo $"ERROR: Exim does not appear to have installed. $CHECK_MESSAGE"
  832. exit 48
  833. fi
  834. # configure for Maildir format
  835. sed -i 's/MAIL_DIR/#MAIL_DIR/g' /etc/login.defs
  836. sed -i 's|#MAIL_FILE.*|MAIL_FILE Maildir/|g' /etc/login.defs
  837. if ! grep -q "export MAIL" /etc/profile; then
  838. echo 'export MAIL=~/Maildir' >> /etc/profile
  839. fi
  840. sed -i 's|pam_mail.so standard|pam_mail.so dir=~/Maildir standard|g' /etc/pam.d/login
  841. sed -i 's|pam_mail.so standard noenv|pam_mail.so dir=~/Maildir standard|g' /etc/pam.d/sshd
  842. sed -i 's|pam_mail.so nopen|pam_mail.so dir=~/Maildir nopen|g' /etc/pam.d/su
  843. echo "dc_eximconfig_configtype='internet'" > /etc/exim4/update-exim4.conf.conf
  844. if [[ $ONION_ONLY == 'no' ]]; then
  845. echo "dc_other_hostnames='${DEFAULT_DOMAIN_NAME};mail.${DEFAULT_DOMAIN_NAME}'" >> /etc/exim4/update-exim4.conf.conf
  846. else
  847. echo "dc_other_hostnames='${onion_address}'" >> /etc/exim4/update-exim4.conf.conf
  848. fi
  849. { echo "dc_local_interfaces=''";
  850. echo "dc_readhost=''";
  851. echo "dc_relay_domains=''";
  852. echo "dc_minimaldns='false'"; } >> /etc/exim4/update-exim4.conf.conf
  853. IPv4_address=$(get_ipv4_address)
  854. IPv4_address_base=$(echo "$IPv4_address" | awk -F '.' '{print $1"."$2"."$3}')
  855. RELAY_NETS="${IPv4_address_base}.0/24"
  856. if [ "$LOCAL_NETWORK_STATIC_IP_ADDRESS" ]; then
  857. RELAY_NETS=$(awk "$LOCAL_NETWORK_STATIC_IP_ADDRESS" -F '.' '{print $1 "." $2 "." $3 ".0/24"}')
  858. fi
  859. { echo "dc_relay_nets='$RELAY_NETS'";
  860. echo "dc_smarthost=''";
  861. echo "CFILEMODE='644'";
  862. echo "dc_use_split_config='false'";
  863. echo "dc_hide_mailname=''";
  864. echo "dc_mailname_in_oh='true'";
  865. echo "dc_localdelivery='maildir_home'";
  866. echo "dc_main_log_selector=-all"; } >> /etc/exim4/update-exim4.conf.conf
  867. echo "chunking_advertise_hosts =" > /etc/exim4/conf.d/main/04_exim4-config_chunking
  868. update-exim4.conf
  869. sed -i "s/START=no/START=yes/g" /etc/default/saslauthd
  870. systemctl start saslauthd
  871. email_install_tls
  872. adduser "$MY_USERNAME" sasl
  873. addgroup Debian-exim sasl
  874. systemctl restart exim4
  875. email_create_template
  876. if [ -f /usr/sbin/exim ]; then
  877. chmod u+s /usr/sbin/exim
  878. fi
  879. if [ -f /usr/sbin/exim4 ]; then
  880. chmod u+s /usr/sbin/exim4
  881. fi
  882. function_check configure_firewall_for_email
  883. configure_firewall_for_email
  884. dpkg-reconfigure --frontend noninteractive exim4-config
  885. systemctl restart exim4
  886. }
  887. function email_change_relay {
  888. curr_ip_address="$1"
  889. email_relay_base=$(echo "$curr_ip_address" | awk -F '.' '{print $1"."$2"."$3}')
  890. RELAY_NETS="${email_relay_base}.0/24"
  891. sed -i "s|dc_relay_nets=.*|dc_relay_nets='$RELAY_NETS'|g" /etc/exim4/update-exim4.conf.conf
  892. dpkg-reconfigure --frontend noninteractive exim4-config
  893. }
  894. function create_procmail {
  895. if [ ! -d /etc/exim4 ]; then
  896. return
  897. fi
  898. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  899. return
  900. fi
  901. if [ ! -f "/home/$MY_USERNAME/.procmailrc" ]; then
  902. { echo "MAILDIR=\$HOME/Maildir";
  903. echo "DEFAULT=\$MAILDIR/";
  904. echo "LOGFILE=\$HOME/log/procmail.log";
  905. echo 'LOGABSTRACT=all';
  906. echo '';
  907. echo '# Test for an empty or missing subject line';
  908. echo "SUBJ_=\$(formail -xSubject: \\";
  909. echo " | expand | sed -e 's/^[ ]*//g' -e 's/[ ]*\$//g')";
  910. echo ':0';
  911. echo ' * SUBJ_ ?? ^^^^';
  912. echo '/dev/null';
  913. echo '';
  914. echo $"# Tripwire reports which have no violations don't need to be logged";
  915. echo ':0 BD:'; } > "/home/$MY_USERNAME/.procmailrc"
  916. TRIPWIRE_VIOLATIONS_STR=$'Total violations found: 0'
  917. { echo " * .*$TRIPWIRE_VIOLATIONS_STR";
  918. echo '/dev/null';
  919. echo ''; } >> "/home/$MY_USERNAME/.procmailrc"
  920. chown "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/.procmailrc"
  921. fi
  922. mkdir -p "/home/$MY_USERNAME/Maildir/admin/new"
  923. mkdir -p "/home/$MY_USERNAME/Maildir/admin/cur"
  924. chown -R "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/Maildir/admin"
  925. if [ ! -f /etc/skel/.procmailrc ]; then
  926. cp "/home/$MY_USERNAME/.procmailrc" /etc/skel/.procmailrc
  927. chown root:root /etc/skel/.procmailrc
  928. fi
  929. if [ -f /usr/bin/procmail ]; then
  930. chmod 6755 /usr/bin/procmail
  931. fi
  932. mark_completed "${FUNCNAME[0]}"
  933. }
  934. function handle_admin_emails {
  935. # keep emails for root in a separate folder
  936. if [ -d "/home/$MY_USERNAME/Maildir/admin" ]; then
  937. return
  938. fi
  939. "${PROJECT_NAME}-addemail" -u "$MY_USERNAME" -e "root@$DEFAULT_DOMAIN_NAME" -g admin --public no
  940. }
  941. function spam_filtering {
  942. if [ ! -d /etc/exim4 ]; then
  943. return
  944. fi
  945. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  946. return
  947. fi
  948. apt-get -yq install exim4-daemon-heavy
  949. apt-get -yq install spamassassin
  950. if [ ! -f /etc/default/spamassassin ]; then
  951. echo 'Spamassassin was not installed'
  952. exit 72570
  953. fi
  954. sa-update -v
  955. sed -i 's/ENABLED=0/ENABLED=1/g' /etc/default/spamassassin
  956. sed -i 's/# spamd_address = 127.0.0.1 783/spamd_address = 127.0.0.1 783/g' /etc/exim4/exim4.conf.template
  957. # This configuration is based on https://wiki.debian.org/DebianSpamAssassin
  958. sed -i 's/local_parts = postmaster/local_parts = postmaster:abuse/g' /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt
  959. sed -i '/domains = +local_domains : +relay_to_domains/a\ set acl_m0 = rfcnames' /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt
  960. sed -i "s/accept/accept condition = \${if eq{\$acl_m0}{rfcnames} {1}{0}}/g" /etc/exim4/conf.d/acl/40_exim4-config_check_data
  961. { echo "warn message = X-Spam-Score: \$spam_score (\$spam_bar)";
  962. echo ' spam = nobody:true';
  963. echo 'warn message = X-Spam-Flag: YES';
  964. echo ' spam = nobody';
  965. echo "warn message = X-Spam-Report: \$spam_report";
  966. echo ' spam = nobody';
  967. echo '# reject spam at high scores (> 12)';
  968. echo "deny message = This message scored \$spam_score spam points.";
  969. echo ' spam = nobody:true';
  970. echo " condition = \${if >{\$spam_score_int}{120}{1}{0}}"; } >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  971. # procmail configuration
  972. { echo '# get spamassassin to check emails';
  973. echo ':0fw: .spamassassin.lock';
  974. echo ' * < 256000';
  975. echo '| spamc';
  976. echo '# strong spam are discarded';
  977. echo ':0';
  978. echo ' * ^X-Spam-Level: \*\*\*\*\*\*';
  979. echo '/dev/null';
  980. echo '# weak spam are kept just in case - clear this out every now and then';
  981. echo ':0';
  982. echo ' * ^X-Spam-Level: \*\*\*\*\*';
  983. echo 'maybe-spam/';
  984. echo '# otherwise, marginal spam goes here for revision';
  985. echo ':0';
  986. echo ' * ^X-Spam-Level: \*\*';
  987. echo 'spam/'; } >> "/home/$MY_USERNAME/.procmailrc"
  988. chown "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/.procmailrc"
  989. { echo '# get spamassassin to check emails';
  990. echo ':0fw: .spamassassin.lock';
  991. echo ' * < 256000';
  992. echo '| spamc';
  993. echo '# strong spam are discarded';
  994. echo ':0';
  995. echo ' * ^X-Spam-Level: \*\*\*\*\*\*';
  996. echo '/dev/null';
  997. echo '# weak spam are kept just in case - clear this out every now and then';
  998. echo ':0';
  999. echo ' * ^X-Spam-Level: \*\*\*\*\*';
  1000. echo 'maybe-spam/';
  1001. echo '# otherwise, marginal spam goes here for revision';
  1002. echo ':0';
  1003. echo ' * ^X-Spam-Level: \*\*';
  1004. echo 'spam/'; } >> /etc/skel/.procmailrc
  1005. # filtering scripts
  1006. { echo '#!/bin/bash';
  1007. echo 'for d in /home/*/ ; do';
  1008. echo " USERNAME=\$(echo \"\$d\" | awk -F '/' '{print \$3}')";
  1009. echo " if [[ \$USERNAME != \"git\" && $USERNAME != \"go\" && \$USERNAME != \"gogs\" && \$USERNAME != \"sync\" && \$USERNAME != \"tahoelafs\" ]]; then";
  1010. echo " MAILDIR=/home/\$USERNAME/Maildir/.learn-spam";
  1011. echo " if [ ! -d \"\$MAILDIR\" ]; then";
  1012. echo ' exit';
  1013. echo ' fi';
  1014. echo " for f in \$(ls \$MAILDIR/cur)";
  1015. echo ' do';
  1016. echo " spamc -L spam < \"\$MAILDIR/cur/\$f\" > /dev/null";
  1017. echo " rm \"\$MAILDIR/cur/\$f\"";
  1018. echo ' done';
  1019. echo " for f in \$(ls \$MAILDIR/new)";
  1020. echo ' do';
  1021. echo " spamc -L spam < \"\$MAILDIR/new/\$f\" > /dev/null";
  1022. echo " rm \"\$MAILDIR/new/\$f\"";
  1023. echo ' done';
  1024. echo ' fi';
  1025. echo 'done';
  1026. echo 'exit 0'; } > /usr/bin/filterspam
  1027. { echo '#!/bin/bash';
  1028. echo 'for d in /home/*/ ; do';
  1029. echo " USERNAME=\$(echo \"\$d\" | awk -F '/' '{print \$3}')";
  1030. echo " if [[ \$USERNAME != \"git\" && \$USERNAME != \"go\" && \$USERNAME != \"gogs\" && \$USERNAME != \"sync\" && \$USERNAME != \"tahoelafs\" ]]; then";
  1031. echo " MAILDIR=/home/\$USERNAME/Maildir/.learn-ham";
  1032. echo " if [ ! -d \"\$MAILDIR\" ]; then";
  1033. echo ' exit';
  1034. echo ' fi';
  1035. echo " for f in \$(ls \$MAILDIR/cur)";
  1036. echo ' do';
  1037. echo " spamc -L ham < \"\$MAILDIR/cur/\$f\" > /dev/null";
  1038. echo " rm \"\$MAILDIR/cur/\$f\"";
  1039. echo ' done';
  1040. echo " for f in \$(ls \$MAILDIR/new)";
  1041. echo ' do';
  1042. echo " spamc -L ham < \"\$MAILDIR/new/\$f\" > /dev/null";
  1043. echo " rm \"\$MAILDIR/new/\$f\"";
  1044. echo ' done';
  1045. echo ' fi';
  1046. echo 'done';
  1047. echo 'exit 0'; } > /usr/bin/filterham
  1048. function_check cron_add_mins
  1049. cron_add_mins 3 '/usr/bin/timeout 120 /usr/bin/filterspam'
  1050. cron_add_mins 3 '/usr/bin/timeout 120 /usr/bin/filterham'
  1051. chmod 655 /usr/bin/filterspam /usr/bin/filterham
  1052. sed -i 's/# use_bayes 1/use_bayes 1/g' /etc/mail/spamassassin/local.cf
  1053. sed -i 's/# bayes_auto_learn 1/bayes_auto_learn 1/g' /etc/mail/spamassassin/local.cf
  1054. # user preferences
  1055. if [ ! -d "/home/$MY_USERNAME/.spamassassin" ]; then
  1056. mkdir "/home/$MY_USERNAME/.spamassassin"
  1057. { echo $'# How many points before a mail is considered spam.';
  1058. echo '# required_score 5';
  1059. echo '';
  1060. echo $'# Whitelist and blacklist addresses are now file-glob-style patterns, so';
  1061. echo $'# "friend@somewhere.com", "*@isp.com", or "*.domain.net" will all work.';
  1062. echo '# whitelist_from someone@somewhere.com';
  1063. echo '';
  1064. echo $'# Add your own customised scores for some tests below. The default scores are';
  1065. echo $'# read from the installed spamassassin rules files, but you can override them';
  1066. echo $'# here. To see the list of tests and their default scores, go to';
  1067. echo '# http://spamassassin.apache.org/tests.html .';
  1068. echo '#';
  1069. echo '# score SYMBOLIC_TEST_NAME n.nn';
  1070. echo '';
  1071. echo $'# Speakers of Asian languages, like Chinese, Japanese and Korean, will almost';
  1072. echo $'# definitely want to uncomment the following lines. They will switch off some';
  1073. echo $'# rules that detect 8-bit characters, which commonly trigger on mails using CJK';
  1074. echo $'# character sets, or that assume a western-style charset is in use. ';
  1075. echo '# ';
  1076. echo '# score HTML_COMMENT_8BITS 0';
  1077. echo '# score UPPERCASE_25_50 0';
  1078. echo '# score UPPERCASE_50_75 0';
  1079. echo '# score UPPERCASE_75_100 0';
  1080. echo '# score OBSCURED_EMAIL 0';
  1081. echo '';
  1082. echo $'# Speakers of any language that uses non-English, accented characters may wish';
  1083. echo $'# to uncomment the following lines. They turn off rules that fire on';
  1084. echo $'# misformatted messages generated by common mail apps in contravention of the';
  1085. echo $'# email RFCs.';
  1086. echo '';
  1087. echo '# score SUBJ_ILLEGAL_CHARS 0'; } > "/home/$MY_USERNAME/.spamassassin/user_prefs"
  1088. fi
  1089. # this must be accessible by root
  1090. chown -R "$MY_USERNAME":root "/home/$MY_USERNAME/.spamassassin"
  1091. # script to keep spamassassin running
  1092. # There is a systemd script from the debian package, but it doesn't restart on failure
  1093. # and also doesn't ensure start after networking is up. If that is eventually fixed
  1094. # then this script and the cron job which runs it can be removed.
  1095. script_name=/usr/bin/run-spamassassin
  1096. { echo '#!/bin/bash';
  1097. echo "current_state=\$(systemctl status spamassassin)";
  1098. echo "if [[ \"\$current_state\" != *\"(running)\"* ]]; then";
  1099. echo ' systemctl restart spamassassin';
  1100. echo 'fi';
  1101. echo 'exit 0'; } > $script_name
  1102. chmod +x $script_name
  1103. systemctl start spamassassin
  1104. systemctl restart exim4
  1105. systemctl restart cron
  1106. function_check cron_add_mins
  1107. cron_add_mins 10 "$script_name 2> /dev/null"
  1108. mark_completed "${FUNCNAME[0]}"
  1109. }
  1110. function configure_imap {
  1111. if [ ! -d /etc/exim4 ]; then
  1112. return
  1113. fi
  1114. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  1115. return
  1116. fi
  1117. apt-get -yq install dovecot-imapd
  1118. if [ ! -d /etc/dovecot ]; then
  1119. echo $"ERROR: Dovecot does not appear to have installed. $CHECK_MESSAGE"
  1120. exit 48
  1121. fi
  1122. if [[ "$(cert_exists dovecot)" == "0" ]]; then
  1123. "${PROJECT_NAME}-addcert" -h dovecot --dhkey "$DH_KEYLENGTH"
  1124. CHECK_HOSTNAME=dovecot
  1125. check_certificates dovecot
  1126. fi
  1127. chmod 600 /etc/shadow
  1128. chmod 600 /etc/gshadow
  1129. groupadd default
  1130. usermod -g default dovecot
  1131. chmod 0000 /etc/shadow
  1132. chmod 0000 /etc/gshadow
  1133. chown root:default /etc/ssl/certs/dovecot.*
  1134. chown root:default /etc/ssl/private/dovecot.*
  1135. chown root:default "/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.*"
  1136. chown root:default "/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.*"
  1137. if [ ! -f /etc/dovecot/conf.d/10-ssl.conf ]; then
  1138. echo $'Unable to find /etc/dovecot/conf.d/10-ssl.conf'
  1139. exit 83629
  1140. fi
  1141. sed -i 's|#ssl =.*|ssl = no|g' /etc/dovecot/conf.d/10-ssl.conf
  1142. sed -i 's|ssl =.*|ssl = no|g' /etc/dovecot/conf.d/10-ssl.conf
  1143. sed -i "s|#ssl_cert =.*|ssl_cert = </etc/ssl/certs/dovecot.crt|g" /etc/dovecot/conf.d/10-ssl.conf
  1144. sed -i "s|ssl_cert =.*|ssl_cert = </etc/ssl/certs/dovecot.crt|g" /etc/dovecot/conf.d/10-ssl.conf
  1145. sed -i "s|#ssl_key =.*|ssl_key = </etc/ssl/private/dovecot.key|g" /etc/dovecot/conf.d/10-ssl.conf
  1146. sed -i "s|ssl_key =.*|ssl_key = </etc/ssl/private/dovecot.key|g" /etc/dovecot/conf.d/10-ssl.conf
  1147. sed -i "s|#ssl_dh_parameters_length.*|ssl_dh_parameters_length = ${DH_KEYLENGTH}|g" /etc/dovecot/conf.d/10-ssl.conf
  1148. sed -i 's/#ssl_prefer_server_ciphers.*/ssl_prefer_server_ciphers = yes/g' /etc/dovecot/conf.d/10-ssl.conf
  1149. sed -i "s|#ssl_protocols =.*|ssl_protocols = '$SSL_PROTOCOLS'|g" /etc/dovecot/conf.d/10-ssl.conf
  1150. sed -i "s|ssl_protocols =.*|ssl_protocols = '$SSL_PROTOCOLS'|g" /etc/dovecot/conf.d/10-ssl.conf
  1151. echo "ssl_cipher_list = '$SSL_CIPHERS'" >> /etc/dovecot/conf.d/10-ssl.conf
  1152. if [ ! -f /etc/dovecot/conf.d/10-master.conf ]; then
  1153. echo $'Unable to find /etc/dovecot/conf.d/10-master.conf'
  1154. exit 49259
  1155. fi
  1156. sed -i 's/#process_limit =.*/process_limit = 100/g' /etc/dovecot/conf.d/10-master.conf
  1157. if [ ! -f /etc/dovecot/conf.d/10-logging.conf ]; then
  1158. echo $'Unable to find /etc/dovecot/conf.d/10-logging.conf'
  1159. exit 48936
  1160. fi
  1161. sed -i 's/#auth_verbose.*/auth_verbose = yes/g' /etc/dovecot/conf.d/10-logging.conf
  1162. if [ ! -f /etc/dovecot/dovecot.conf ]; then
  1163. echo $'Unable to find /etc/dovecot/dovecot.conf'
  1164. exit 43890
  1165. fi
  1166. sed -i 's/#listen =.*/listen = */g' /etc/dovecot/dovecot.conf
  1167. if [ ! -f /etc/dovecot/conf.d/10-auth.conf ]; then
  1168. echo $'Unable to find /etc/dovecot/conf.d/10-auth.conf'
  1169. exit 843256
  1170. fi
  1171. sed -i 's/#disable_plaintext_auth =.*/disable_plaintext_auth = no/g' /etc/dovecot/conf.d/10-auth.conf
  1172. sed -i 's/auth_mechanisms =.*/auth_mechanisms = plain login/g' /etc/dovecot/conf.d/10-auth.conf
  1173. if [ ! -f /etc/dovecot/conf.d/10-mail.conf ]; then
  1174. echo $'Unable to find /etc/dovecot/conf.d/10-mail.conf'
  1175. exit 42036
  1176. fi
  1177. sed -i 's|mail_location =.*|mail_location = maildir:~/Maildir:LAYOUT=fs|g' /etc/dovecot/conf.d/10-mail.conf
  1178. # This long notify interval makes the system more suited for use with
  1179. # battery powered mobile devices
  1180. sed -i 's|#imap_idle_notify_interval =.*|imap_idle_notify_interval = 29|g' /etc/dovecot/conf.d/20-imap.conf
  1181. if [ -f /var/lib/dovecot/ssl-parameters.dat ]; then
  1182. rm /var/lib/dovecot/ssl-parameters.dat
  1183. fi
  1184. if [ -f /etc/systemd/system/sockets.target.wants/dovecot.socket ]; then
  1185. rm /etc/systemd/system/sockets.target.wants/dovecot.socket
  1186. fi
  1187. # Separate logging, otherwise syslog is used
  1188. if ! grep -q "# logging" /etc/dovecot/dovecot.conf; then
  1189. { echo '';
  1190. echo '# logging';
  1191. echo 'log_path = /var/log/dovecot.log';
  1192. echo 'info_log_path = /var/log/dovecot-info.log';
  1193. echo 'debug_log_path = /var/log/dovecot-debug.log'; } >> /etc/dovecot/dovecot.conf
  1194. fi
  1195. systemctl restart dovecot
  1196. mark_completed "${FUNCNAME[0]}"
  1197. }
  1198. function configure_imap_client_certs {
  1199. if [ ! -d /etc/exim4 ]; then
  1200. return
  1201. fi
  1202. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  1203. return
  1204. fi
  1205. # http://strange.systems/certificate-based-auth-with-dovecot-sendmail/
  1206. sed -i 's|#default_process_limit =.*|default_process_limit = 100|g' /etc/dovecot/conf.d/10-master.conf
  1207. sed -i 's/disable_plaintext_auth =.*/disable_plaintext_auth = yes/g' /etc/dovecot/conf.d/10-auth.conf
  1208. sed -i 's|#auth_ssl_require_client_cert =.*|auth_ssl_require_client_cert = yes|g' /etc/dovecot/conf.d/10-auth.conf
  1209. sed -i 's|#auth_ssl_username_from_cert =.*|auth_ssl_username_from_cert = yes|g' /etc/dovecot/conf.d/10-auth.conf
  1210. sed -i "s|#ssl_ca =.*|ssl_ca = /etc/ssl/certs/ca-$DEFAULT_DOMAIN_NAME.crt|g" /etc/dovecot/conf.d/10-ssl.conf
  1211. sed -i 's|#ssl_cert_username_field =.*|ssl_cert_username_field = commonName|g' /etc/dovecot/conf.d/10-ssl.conf
  1212. sed -i 's|#ssl_verify_client_cert =.*|ssl_verify_client_cert = yes|g' /etc/dovecot/conf.d/10-ssl.conf
  1213. if ! grep -q "passdb {" /etc/dovecot/conf.d/10-auth.conf; then
  1214. { echo '';
  1215. echo 'passdb {';
  1216. echo ' driver = passwd-file';
  1217. echo ' args = /etc/dovecot/passwd-file';
  1218. echo ' deny = no';
  1219. echo ' master = no';
  1220. echo ' pass = no';
  1221. echo '}'; } >> /etc/dovecot/conf.d/10-auth.conf
  1222. fi
  1223. if [[ "$ONION_ONLY" == "no" ]]; then
  1224. # make a CA cert
  1225. if [ ! -f "/etc/ssl/private/ca-$DEFAULT_DOMAIN_NAME.key" ]; then
  1226. if [[ "$LETSENCRYPT_ENABLED" != "yes" ]]; then
  1227. "${PROJECT_NAME}-addcert" -h "$DEFAULT_DOMAIN_NAME" --ca "" --dhkey "$DH_KEYLENGTH"
  1228. else
  1229. "${PROJECT_NAME}-addcert" -e "$DEFAULT_DOMAIN_NAME" -s "$LETSENCRYPT_SERVER" --ca "" --dhkey "$DH_KEYLENGTH" --email "$MY_EMAIL_ADDRESS"
  1230. fi
  1231. fi
  1232. fi
  1233. # CA configuration
  1234. { echo '[ ca ]';
  1235. echo "default_ca = dovecot-ca";
  1236. echo '';
  1237. echo '[ crl_ext ]';
  1238. echo 'authorityKeyIdentifier=keyid:always';
  1239. echo '';
  1240. echo '[ dovecot-ca ]';
  1241. echo 'new_certs_dir = .';
  1242. echo 'unique_subject = no';
  1243. echo "certificate = /etc/ssl/certs/ca-$DEFAULT_DOMAIN_NAME.crt";
  1244. echo 'database = ssldb';
  1245. echo "private_key = /etc/ssl/private/ca-$DEFAULT_DOMAIN_NAME.key";
  1246. echo 'serial = sslserial';
  1247. echo 'default_days = 3650';
  1248. echo 'default_md = sha256';
  1249. echo 'default_bits = 2048';
  1250. echo 'policy = dovecot-ca_policy';
  1251. echo 'x509_extensions = dovecot-ca_extensions';
  1252. echo '';
  1253. echo '[ dovecot-ca_policy ]';
  1254. echo 'commonName = supplied';
  1255. echo 'stateOrProvinceName = supplied';
  1256. echo 'countryName = supplied';
  1257. echo 'emailAddress = optional';
  1258. echo 'organizationName = supplied';
  1259. echo 'organizationalUnitName = optional';
  1260. echo '';
  1261. echo '[ dovecot-ca_extensions ]';
  1262. echo 'basicConstraints = CA:false';
  1263. echo 'subjectKeyIdentifier = hash';
  1264. echo 'authorityKeyIdentifier = keyid:always';
  1265. echo 'keyUsage = digitalSignature,keyEncipherment';
  1266. echo 'extendedKeyUsage = clientAuth'; } > /etc/ssl/dovecot-ca.cnf
  1267. if [ -f /etc/ssl/ssldb ]; then
  1268. rm /etc/ssl/ssldb
  1269. fi
  1270. if [ -f /etc/ssl/sslserial ]; then
  1271. rm /etc/ssl/sslserial
  1272. fi
  1273. touch /etc/ssl/ssldb
  1274. echo 0001 > /etc/ssl/sslserial
  1275. #${PROJECT_NAME}-clientcert -u $MY_USERNAME
  1276. systemctl restart dovecot
  1277. mark_completed "${FUNCNAME[0]}"
  1278. }
  1279. function create_gpg_subkey {
  1280. # Note: currently not used
  1281. if [ ! -d /etc/exim4 ]; then
  1282. return
  1283. fi
  1284. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  1285. return
  1286. fi
  1287. apt-get -yq install gnupg
  1288. GPG_KEY_USAGE=$1
  1289. if [[ "$GPG_KEY_USAGE" != "sign" && "$GPG_KEY_USAGE" != "auth" && "$GPG_KEY_USAGE" != "encrypt" ]]; then
  1290. echo $"Unknown subkey usage: $GPG_KEY_USAGE"
  1291. echo $'Available types: sign|auth|encrypt'
  1292. exit 14783
  1293. fi
  1294. KEYGRIP=$(gpg --fingerprint --fingerprint "$MY_EMAIL_ADDRESS" | grep fingerprint | tail -1 | cut -d= -f2 | sed -e 's/ //g')
  1295. # Generate a GPG subkey
  1296. { echo 'Key-Type: eddsa';
  1297. echo 'Key-Curve: Ed25519';
  1298. echo "Key-Grip: $KEYGRIP";
  1299. echo 'Subkey-Type: eddsa';
  1300. echo "subkey-Usage: $GPG_KEY_USAGE";
  1301. echo "Name-Real: $MY_NAME";
  1302. echo "Name-Email: $MY_EMAIL_ADDRESS";
  1303. echo "Name-Comment: $GPG_KEY_USAGE";
  1304. echo 'Expire-Date: 0';
  1305. echo "Passphrase: $PROJECT_NAME"; } > "/home/$MY_USERNAME/gpg-genkey.conf"
  1306. chown "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/gpg-genkey.conf"
  1307. su -m root -c "gpg --homedir /home/$MY_USERNAME/.gnupg --batch --full-gen-key /home/$MY_USERNAME/gpg-genkey.conf" - "$MY_USERNAME"
  1308. chown -R "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/.gnupg"
  1309. shred -zu "/home/$MY_USERNAME/gpg-genkey.conf"
  1310. # shellcheck disable=SC2034
  1311. MY_GPG_SUBKEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1312. mark_completed "${FUNCNAME[0]}"
  1313. }
  1314. function gpg_key_exists {
  1315. key_owner_username="$1"
  1316. key_search_text="$2"
  1317. if [[ $key_owner_username != "root" ]]; then
  1318. KEY_EXISTS=$(su -c "gpg --list-keys \"${key_search_text}\"" - "$key_owner_username")
  1319. else
  1320. KEY_EXISTS=$(gpg --list-keys "${key_search_text}")
  1321. fi
  1322. if [ ! "$KEY_EXISTS" ]; then
  1323. echo "no"
  1324. return
  1325. fi
  1326. if [[ "$KEY_EXISTS" == *"error"* ]]; then
  1327. echo "no"
  1328. return
  1329. fi
  1330. echo "yes"
  1331. }
  1332. function configure_gpg {
  1333. if [ ! -d /etc/exim4 ]; then
  1334. return
  1335. fi
  1336. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  1337. return
  1338. fi
  1339. apt-get -yq install gnupg dirmngr
  1340. printf '%%Assuan%%\nsocket=/dev/shm/S.dirmngr\n' > ~/.gnupg/S.dirmngr
  1341. check_email_address_exists
  1342. gpg_dir="/home/$MY_USERNAME/.gnupg"
  1343. # if gpg keys directory was previously imported from usb
  1344. if [ -d "$gpg_dir" ]; then
  1345. echo $'GPG directory exists'
  1346. else
  1347. echo $"GPG directory $gpg_dir was not found"
  1348. fi
  1349. if [ -d "$gpg_dir" ]; then
  1350. echo $'GPG keys were imported'
  1351. sed -i "s|keyserver hkp://keys.gnupg.net|keyserver $GPG_KEYSERVER|g" "$gpg_dir/gpg.conf"
  1352. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1353. if [ ${#MY_GPG_PUBLIC_KEY_ID} -lt 4 ]; then
  1354. echo $'GPG public key ID could not be obtained'
  1355. else
  1356. if [[ "$MY_GPG_PUBLIC_KEY_ID" == *'error'* ]]; then
  1357. echo $"Can't locate gpg key"
  1358. else
  1359. chown -R "$MY_USERNAME":"$MY_USERNAME" "$gpg_dir"
  1360. chmod 700 "$gpg_dir"
  1361. chmod 600 "$gpg_dir/"*
  1362. printf '%%Assuan%%\nsocket=/dev/shm/S.dirmngr\n' > "/home/$MY_USERNAME/.gnupg/S.dirmngr"
  1363. if [ -d "/home/$MY_USERNAME/.gnupg/crls.d" ]; then
  1364. chmod +x "/home/$MY_USERNAME/.gnupg/crls.d"
  1365. fi
  1366. mark_completed "${FUNCNAME[0]}"
  1367. return
  1368. fi
  1369. fi
  1370. fi
  1371. if [ ! -d "$gpg_dir" ]; then
  1372. mkdir "$gpg_dir"
  1373. echo "keyserver $GPG_KEYSERVER" >> "$gpg_dir/gpg.conf"
  1374. echo 'keyserver-options auto-key-retrieve' >> "$gpg_dir/gpg.conf"
  1375. fi
  1376. sed -i "s|keyserver hkp://keys.gnupg.net|keyserver $GPG_KEYSERVER|g" "$gpg_dir/gpg.conf"
  1377. gpg_agent_setup root
  1378. gpg_agent_setup "$MY_USERNAME"
  1379. if ! grep -q "# default preferences" "$gpg_dir/gpg.conf"; then
  1380. { echo '';
  1381. echo '# default preferences';
  1382. echo 'personal-digest-preferences SHA256';
  1383. echo 'cert-digest-algo SHA256';
  1384. echo 'default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed'; } >> "$gpg_dir/gpg.conf"
  1385. fi
  1386. chown -R "$MY_USERNAME":"$MY_USERNAME" "$gpg_dir"
  1387. chmod 700 "$gpg_dir"
  1388. chmod 600 "$gpg_dir/"*
  1389. printf '%%Assuan%%\nsocket=/dev/shm/S.dirmngr\n' > "$gpg_dir/S.dirmngr"
  1390. if [ -d "$gpg_dir/crls.d" ]; then
  1391. chmod +x "$gpg_dir/crls.d"
  1392. fi
  1393. if [[ "$MY_GPG_PUBLIC_KEY" && "$MY_GPG_PRIVATE_KEY" ]]; then
  1394. echo $'Importing GPG keys from file'
  1395. echo $"Public key: $MY_GPG_PUBLIC_KEY"
  1396. echo $"Private key: $MY_GPG_PRIVATE_KEY"
  1397. # use your existing GPG keys which were exported
  1398. if [ ! -f $MY_GPG_PUBLIC_KEY ]; then
  1399. echo $"GPG public key file $MY_GPG_PUBLIC_KEY was not found"
  1400. exit 2483
  1401. fi
  1402. if [ ! -f $MY_GPG_PRIVATE_KEY ]; then
  1403. echo $"GPG private key file $MY_GPG_PRIVATE_KEY was not found"
  1404. exit 5383
  1405. fi
  1406. gpg_import_public_key "$MY_USERNAME" "$MY_GPG_PUBLIC_KEY"
  1407. gpg_import_private_key "$MY_USERNAME" "$MY_GPG_PRIVATE_KEY"
  1408. KEY_EXISTS=$(gpg_key_exists "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1409. if [[ $KEY_EXISTS == "no" ]]; then
  1410. echo $"The GPG key for $MY_EMAIL_ADDRESS could not be imported"
  1411. exit 13821
  1412. fi
  1413. # for security ensure that the private key file doesn't linger around
  1414. shred -zu $MY_GPG_PRIVATE_KEY
  1415. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1416. if [ ${#MY_GPG_PUBLIC_KEY_ID} -lt 4 ]; then
  1417. echo $'GPG public key ID could not be obtained'
  1418. fi
  1419. else
  1420. # Generate a GPG key
  1421. if [ -f "$IMAGE_PASSWORD_FILE" ]; then
  1422. gpg_create_key "$MY_USERNAME" "$(printf "%s" "$(cat "$IMAGE_PASSWORD_FILE")")"
  1423. else
  1424. gpg_create_key "$MY_USERNAME" "$PROJECT_NAME"
  1425. fi
  1426. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1427. MY_GPG_PUBLIC_KEY=/tmp/public_key.gpg
  1428. gpg_export_public_key "$MY_USERNAME" "$MY_GPG_PUBLIC_KEY_ID" "$MY_GPG_PUBLIC_KEY"
  1429. fi
  1430. if [ ! -d /root/.gnupg ]; then
  1431. cp -r "/home/$MY_USERNAME/.gnupg" /root/
  1432. chmod 700 /root/.gnupg
  1433. chmod 600 /root/.gnupg/*
  1434. printf '%%Assuan%%\nsocket=/dev/shm/S.dirmngr\n' > /root/.gnupg/S.dirmngr
  1435. if [ -d /root/.gnupg/crls.d ]; then
  1436. chmod +x /root/.gnupg/crls.d
  1437. fi
  1438. fi
  1439. mark_completed "${FUNCNAME[0]}"
  1440. }
  1441. function refresh_gpg_keys {
  1442. REFRESH_GPG_KEYS_SCRIPT=/tmp/update-gpg-keys
  1443. { echo '#!/bin/bash';
  1444. echo "if [ -f /usr/local/bin/${PROJECT_NAME}-sec ]; then";
  1445. echo " /usr/bin/timeout 600 /usr/local/bin/${PROJECT_NAME}-sec --refresh yes";
  1446. echo 'else';
  1447. echo " /usr/bin/timeout 600 /usr/bin/${PROJECT_NAME}-sec --refresh yes";
  1448. echo 'fi';
  1449. echo 'exit 0'; } > "$REFRESH_GPG_KEYS_SCRIPT"
  1450. chmod +x "$REFRESH_GPG_KEYS_SCRIPT"
  1451. if [ ! -f /usr/bin/update-gpg-keys ]; then
  1452. cp "$REFRESH_GPG_KEYS_SCRIPT" /usr/bin/update-gpg-keys
  1453. else
  1454. HASH1=$(sha256sum "$REFRESH_GPG_KEYS_SCRIPT" | awk -F ' ' '{print $1}')
  1455. HASH2=$(sha256sum /usr/bin/update-gpg-keys | awk -F ' ' '{print $1}')
  1456. if [[ "$HASH1" != "$HASH2" ]]; then
  1457. cp $REFRESH_GPG_KEYS_SCRIPT /usr/bin/update-gpg-keys
  1458. fi
  1459. rm $REFRESH_GPG_KEYS_SCRIPT
  1460. fi
  1461. REFRESH_GPG_KEYS_SCRIPT=/usr/bin/update-gpg-keys
  1462. if grep -q "${PROJECT_NAME}-sec" /etc/crontab; then
  1463. sed -i "/${PROJECT_NAME}-sec /d" /etc/crontab
  1464. fi
  1465. if ! grep -q "$REFRESH_GPG_KEYS_SCRIPT" /etc/crontab; then
  1466. GPG_REFRESH_TIME=$(( RANDOM % 60 ))
  1467. echo "$GPG_REFRESH_TIME */$REFRESH_GPG_KEYS_HOURS * * * root cronic $REFRESH_GPG_KEYS_SCRIPT" >> /etc/crontab
  1468. systemctl restart cron
  1469. else
  1470. if ! grep "root cronic $REFRESH_GPG_KEYS_SCRIPT" /etc/crontab; then
  1471. sed -i "s|root $REFRESH_GPG_KEYS_SCRIPT.*|root cronic $REFRESH_GPG_KEYS_SCRIPT|g" /etc/crontab
  1472. fi
  1473. fi
  1474. }
  1475. function install_email {
  1476. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  1477. return
  1478. fi
  1479. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  1480. return
  1481. fi
  1482. create_email_onion_address
  1483. check_email_address_exists
  1484. install_email_basic
  1485. configure_email_onion
  1486. mark_completed "${FUNCNAME[0]}"
  1487. }
  1488. # NOTE: deliberately no exit 0