freedombone-base-email 76KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Email functions
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2014-2016 Bob Mottram <bob@robotics.uk.to>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. # the default email address
  31. MY_EMAIL_ADDRESS=$MY_USERNAME@$DEFAULT_DOMAIN_NAME
  32. # If you want to run a public mailing list specify its name here.
  33. # There should be no spaces in the name
  34. PUBLIC_MAILING_LIST=
  35. # Optional different domain name for the public mailing list
  36. PUBLIC_MAILING_LIST_DOMAIN_NAME=
  37. # Directory where the public mailing list data is stored
  38. PUBLIC_MAILING_LIST_DIRECTORY="/var/spool/mlmmj"
  39. # If you want to run an encrypted mailing list specify its name here.
  40. # There should be no spaces in the name
  41. PRIVATE_MAILING_LIST=
  42. GPG_KEYSERVER="hkp://keys.gnupg.net"
  43. # whether to encrypt all incoming email with your public key
  44. GPG_ENCRYPT_STORED_EMAIL="yes"
  45. # gets set to yes if gpg keys are imported from usb
  46. GPG_KEYS_IMPORTED="no"
  47. # optionally you can provide your exported GPG key pair here
  48. # Note that the private key file will be deleted after use
  49. # If these are unspecified then a new GPG key will be created
  50. MY_GPG_PUBLIC_KEY=
  51. MY_GPG_PRIVATE_KEY=
  52. # optionally specify your public key ID
  53. MY_GPG_PUBLIC_KEY_ID=
  54. # If you have existing mail within a Maildir
  55. # you can specify the directory here and the files
  56. # will be imported
  57. IMPORT_MAILDIR=
  58. EXIM_ONION_REPO="https://github.com/petterreinholdtsen/exim4-smtorp"
  59. # automatic archiving of email
  60. CLEANUP_MAILDIR_REPO="https://github.com/bashrc/cleanup-maildir"
  61. CLEANUP_MAILDIR_COMMIT='33241d2e3861f901ba17f5c77ada007e1ec06a86'
  62. # email encryption at rest
  63. GPGIT_REPO="https://github.com/mikecardwell/gpgit"
  64. GPGIT_COMMIT='583dc76119f19420f8a33f606744faa7c8922738'
  65. # refresh gpg keys every few hours
  66. REFRESH_GPG_KEYS_HOURS=2
  67. function backup_email {
  68. echo ''
  69. }
  70. function configure_firewall_for_email {
  71. if [[ $SYSTEM_TYPE == "$VARIANT_WRITER" || $SYSTEM_TYPE == "$VARIANT_CLOUD" || $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_SOCIAL" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_DEVELOPER" || $SYSTEM_TYPE == "$VARIANT_MESH" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" ]]; then
  72. return
  73. fi
  74. if grep -Fxq "configure_firewall_for_email" $COMPLETION_FILE; then
  75. return
  76. fi
  77. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  78. # docker does its own firewalling
  79. return
  80. fi
  81. if [[ $ONION_ONLY != "no" ]]; then
  82. return
  83. fi
  84. iptables -A INPUT -p tcp --dport 25 -j ACCEPT
  85. iptables -A INPUT -p tcp --dport 587 -j ACCEPT
  86. iptables -A INPUT -p tcp --dport 465 -j ACCEPT
  87. iptables -A INPUT -p tcp --dport 993 -j ACCEPT
  88. function_check save_firewall_settings
  89. save_firewall_settings
  90. OPEN_PORTS+=('Email 25')
  91. OPEN_PORTS+=('Email 587')
  92. OPEN_PORTS+=('Email 465')
  93. OPEN_PORTS+=('Email 993')
  94. echo 'configure_firewall_for_email' >> $COMPLETION_FILE
  95. }
  96. function encrypt_incoming_email {
  97. # encrypts incoming mail using your GPG public key
  98. # so even if an attacker gains access to the data at rest they still need
  99. # to know your GPG key password to be able to read anything
  100. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  101. return
  102. fi
  103. # update to the next commit
  104. function_check set_repo_commit
  105. set_repo_commit $INSTALL_DIR/gpgit "gpgit commit" "$GPGIT_COMMIT" $GPGIT_REPO
  106. if grep -Fxq "encrypt_incoming_email" $COMPLETION_FILE; then
  107. return
  108. fi
  109. if [[ $GPG_ENCRYPT_STORED_EMAIL != "yes" ]]; then
  110. return
  111. fi
  112. if [ ! -f /usr/bin/gpgit.pl ]; then
  113. apt-get -y install git libmail-gnupg-perl
  114. cd $INSTALL_DIR
  115. function_check git_clone
  116. git_clone $GPGIT_REPO $INSTALL_DIR/gpgit
  117. cd $INSTALL_DIR/gpgit
  118. git checkout $GPGIT_COMMIT -b $GPGIT_COMMIT
  119. if ! grep -q "gpgit commit" $COMPLETION_FILE; then
  120. echo "gpgit commit:$GPGIT_COMMIT" >> $COMPLETION_FILE
  121. else
  122. sed -i "s/gpgit commit.*/gpgit commit:$GPGIT_COMMIT/g" $COMPLETION_FILE
  123. fi
  124. cp gpgit.pl /usr/bin
  125. fi
  126. # add a procmail rule
  127. if ! grep -q "/usr/bin/gpgit.pl" /home/$MY_USERNAME/.procmailrc; then
  128. echo '' >> /home/$MY_USERNAME/.procmailrc
  129. echo ':0 f' >> /home/$MY_USERNAME/.procmailrc
  130. echo "| /usr/bin/gpgit.pl --encrypt-mode prefer-inline --inline-flatten $MY_EMAIL_ADDRESS" >> /home/$MY_USERNAME/.procmailrc
  131. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.procmailrc
  132. echo '' >> /etc/skel/.procmailrc
  133. echo ':0 f' >> /etc/skel/.procmailrc
  134. echo -n '| /usr/bin/gpgit.pl --encrypt-mode prefer-inline --inline-flatten $USER@' >> /etc/skel/.procmailrc
  135. echo "$DEFAULT_DOMAIN_NAME" >> /etc/skel/.procmailrc
  136. fi
  137. echo 'encrypt_incoming_email' >> $COMPLETION_FILE
  138. }
  139. function encrypt_outgoing_email {
  140. # encrypts outgoing mail using your GPG public key
  141. # so even if an attacker gains access to the data at rest they still need
  142. # to know your GPG key password to be able to read sent mail
  143. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  144. return
  145. fi
  146. if grep -Fxq "encrypt_outgoing_email" $COMPLETION_FILE; then
  147. return
  148. fi
  149. if [[ $GPG_ENCRYPT_STORED_EMAIL != "yes" ]]; then
  150. return
  151. fi
  152. if [ ! -d /home/$MY_USERNAME/.gnupg ]; then
  153. return
  154. fi
  155. if [ ! -f /home/$MY_USERNAME/.muttrc ]; then
  156. return
  157. fi
  158. # obtain your public key ID
  159. if [ ! $MY_GPG_PUBLIC_KEY_ID ]; then
  160. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  161. if [ ! "$MY_GPG_PUBLIC_KEY_ID" ]; then
  162. return
  163. fi
  164. if [ ${#MY_GPG_PUBLIC_KEY_ID} -lt 4 ]; then
  165. return
  166. fi
  167. fi
  168. if ! grep -q "pgp_encrypt_only_command" /home/$MY_USERNAME/.muttrc; then
  169. echo '' >> /home/$MY_USERNAME/.muttrc
  170. echo $'# Encrypt items in the Sent folder' >> /home/$MY_USERNAME/.muttrc
  171. echo "set pgp_encrypt_only_command=\"/usr/lib/mutt/pgpewrap gpg --batch --quiet --no-verbose --output - --encrypt --textmode --armor --always-trust --encrypt-to 0x$MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"" >> /home/$MY_USERNAME/.muttrc
  172. else
  173. sed -i "s|set pgp_encrypt_only_command.*|set pgp_encrypt_only_command=\"/usr/lib/mutt/pgpewrap gpg --batch --quiet --no-verbose --output - --encrypt --textmode --armor --always-trust --encrypt-to 0x$MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"|g" /home/$MY_USERNAME/.muttrc
  174. fi
  175. if ! grep -q "pgp_encrypt_sign_command" /home/$MY_USERNAME/.muttrc; then
  176. echo "set pgp_encrypt_sign_command=\"/usr/lib/mutt/pgpewrap gpg %?p?--passphrase-fd 0? --batch --quiet --no-verbose --textmode --output - --encrypt --sign %?a?-u %a? --armor --always-trust --encrypt-to 0x$MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"" >> /home/$MY_USERNAME/.muttrc
  177. else
  178. sed -i "s|set pgp_encrypt_sign_command.*|set pgp_encrypt_sign_command=\"/usr/lib/mutt/pgpewrap gpg %?p?--passphrase-fd 0? --batch --quiet --no-verbose --textmode --output - --encrypt --sign %?a?-u %a? --armor --always-trust --encrypt-to 0x$MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"|g" /home/$MY_USERNAME/.muttrc
  179. fi
  180. echo 'encrypt_outgoing_email' >> $COMPLETION_FILE
  181. }
  182. function encrypt_all_email {
  183. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  184. return
  185. fi
  186. if [[ $GPG_ENCRYPT_STORED_EMAIL != "yes" ]]; then
  187. return
  188. fi
  189. if [ -f /usr/local/bin/${PROJECT_NAME}-encrypt-mail ]; then
  190. cp /usr/local/bin/${PROJECT_NAME}-encrypt-mail /usr/bin/encmaildir
  191. else
  192. cp /usr/bin/${PROJECT_NAME}-encrypt-mail /usr/bin/encmaildir
  193. fi
  194. chmod +x /usr/bin/encmaildir
  195. if grep -Fxq "encrypt_all_email" $COMPLETION_FILE; then
  196. return
  197. fi
  198. if [ ! /home/$MY_USERNAME/README ]; then
  199. touch /home/$MY_USERNAME/README
  200. fi
  201. if ! grep -q $"If you have imported legacy email which is not encrypted" /home/$MY_USERNAME/README; then
  202. echo '' >> /home/$MY_USERNAME/README
  203. echo '' >> /home/$MY_USERNAME/README
  204. echo $'Encrypting legacy email' >> /home/$MY_USERNAME/README
  205. echo '=======================' >> /home/$MY_USERNAME/README
  206. echo $'If you have imported legacy email which is not encrypted' >> /home/$MY_USERNAME/README
  207. echo $'then it can be encrypted with the command:' >> /home/$MY_USERNAME/README
  208. echo '' >> /home/$MY_USERNAME/README
  209. echo ' encmaildir' >> /home/$MY_USERNAME/README
  210. echo '' >> /home/$MY_USERNAME/README
  211. echo $'But be warned that depending upon how much email you have' >> /home/$MY_USERNAME/README
  212. echo $'this could take a seriously LONG time on the Beaglebone' >> /home/$MY_USERNAME/README
  213. echo $'and may be better done on a faster machine.' >> /home/$MY_USERNAME/README
  214. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/README
  215. chmod 600 /home/$MY_USERNAME/README
  216. fi
  217. echo 'encrypt_all_email' >> $COMPLETION_FILE
  218. }
  219. function email_client {
  220. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  221. return
  222. fi
  223. if grep -Fxq "email_client" $COMPLETION_FILE; then
  224. return
  225. fi
  226. apt-get -y install mutt-patched lynx abook
  227. if [ ! -f /etc/Muttrc ]; then
  228. echo $"ERROR: Mutt does not appear to have installed. $CHECK_MESSAGE"
  229. exit 49
  230. fi
  231. if [ ! -d /home/$MY_USERNAME/.mutt ]; then
  232. mkdir /home/$MY_USERNAME/.mutt
  233. fi
  234. echo "text/html; lynx -dump -width=78 -nolist %s | sed ‘s/^ //’; copiousoutput; needsterminal; nametemplate=%s.html" > /home/$MY_USERNAME/.mutt/mailcap
  235. cp /home/$MY_USERNAME/.mutt/mailcap /etc/skel/.mutt
  236. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.mutt
  237. chown -R root:root /etc/skel/.mutt
  238. echo 'set mbox_type=Maildir' >> /etc/Muttrc
  239. echo 'set folder="~/Maildir"' >> /etc/Muttrc
  240. echo 'set mask="!^\\.[^.]"' >> /etc/Muttrc
  241. echo 'set mbox="~/Maildir"' >> /etc/Muttrc
  242. echo 'set record="+Sent"' >> /etc/Muttrc
  243. echo 'set postponed="+Drafts"' >> /etc/Muttrc
  244. echo 'set trash="+Trash"' >> /etc/Muttrc
  245. echo 'set spoolfile="~/Maildir"' >> /etc/Muttrc
  246. echo 'auto_view text/x-vcard text/html text/enriched' >> /etc/Muttrc
  247. echo 'set editor="emacs -q --load ~/.emacs-mutt"' >> /etc/Muttrc
  248. echo 'set header_cache="+.cache"' >> /etc/Muttrc
  249. echo '' >> /etc/Muttrc
  250. echo 'macro index S "<tag-prefix><decode-save>=.learn-spam<enter>" "move to learn-spam"' >> /etc/Muttrc
  251. echo 'macro pager S "<decode-save>=.learn-spam<enter>" "move to learn-spam"' >> /etc/Muttrc
  252. echo 'macro index H "<tag-prefix><decode-copy>=.learn-ham<enter>" "copy to learn-ham"' >> /etc/Muttrc
  253. echo 'macro pager H "<decode-copy>=.learn-ham<enter>" "copy to learn-ham"' >> /etc/Muttrc
  254. echo '' >> /etc/Muttrc
  255. echo '# set up the sidebar' >> /etc/Muttrc
  256. echo 'set sidebar_width=22' >> /etc/Muttrc
  257. echo 'set sidebar_visible=yes' >> /etc/Muttrc
  258. echo "set sidebar_delim='|'" >> /etc/Muttrc
  259. echo 'set sidebar_sort=yes' >> /etc/Muttrc
  260. echo '' >> /etc/Muttrc
  261. echo 'set rfc2047_parameters' >> /etc/Muttrc
  262. echo '' >> /etc/Muttrc
  263. echo '# Show inbox and sent items' >> /etc/Muttrc
  264. echo 'mailboxes = =Sent =maybe-spam =spam' >> /etc/Muttrc
  265. echo '' >> /etc/Muttrc
  266. echo '# Alter these colours as needed for maximum bling' >> /etc/Muttrc
  267. echo 'color sidebar_new yellow default' >> /etc/Muttrc
  268. echo 'color normal white default' >> /etc/Muttrc
  269. echo 'color hdrdefault brightcyan default' >> /etc/Muttrc
  270. echo 'color signature green default' >> /etc/Muttrc
  271. echo 'color attachment brightyellow default' >> /etc/Muttrc
  272. echo 'color quoted green default' >> /etc/Muttrc
  273. echo 'color quoted1 white default' >> /etc/Muttrc
  274. echo 'color tilde blue default' >> /etc/Muttrc
  275. echo '' >> /etc/Muttrc
  276. echo '# ctrl-n, ctrl-p to select next, prev folder' >> /etc/Muttrc
  277. echo '# ctrl-o to open selected folder' >> /etc/Muttrc
  278. echo 'bind index \Cp sidebar-prev' >> /etc/Muttrc
  279. echo 'bind index \Cn sidebar-next' >> /etc/Muttrc
  280. echo 'bind index \Co sidebar-open' >> /etc/Muttrc
  281. echo 'bind pager \Cp sidebar-prev' >> /etc/Muttrc
  282. echo 'bind pager \Cn sidebar-next' >> /etc/Muttrc
  283. echo 'bind pager \Co sidebar-open' >> /etc/Muttrc
  284. echo '' >> /etc/Muttrc
  285. echo '# ctrl-b toggles sidebar visibility' >> /etc/Muttrc
  286. echo "macro index,pager \Cb '<enter-command>toggle sidebar_visible<enter><redraw-screen>' 'toggle sidebar'" >> /etc/Muttrc
  287. echo '' >> /etc/Muttrc
  288. echo '# esc-m Mark new messages as read' >> /etc/Muttrc
  289. echo 'macro index <esc>m "T~N<enter>;WNT~O<enter>;WO\CT~T<enter>" "mark all messages read"' >> /etc/Muttrc
  290. echo '' >> /etc/Muttrc
  291. echo '# Collapsing threads' >> /etc/Muttrc
  292. echo 'macro index [ "<collapse-thread>" "collapse/uncollapse thread"' >> /etc/Muttrc
  293. echo 'macro index ] "<collapse-all>" "collapse/uncollapse all threads"' >> /etc/Muttrc
  294. echo '' >> /etc/Muttrc
  295. echo '# threads containing new messages' >> /etc/Muttrc
  296. echo 'uncolor index "~(~N)"' >> /etc/Muttrc
  297. echo 'color index brightblue default "~(~N)"' >> /etc/Muttrc
  298. echo '' >> /etc/Muttrc
  299. echo '# new messages themselves' >> /etc/Muttrc
  300. echo 'uncolor index "~N"' >> /etc/Muttrc
  301. echo 'color index brightyellow default "~N"' >> /etc/Muttrc
  302. echo '' >> /etc/Muttrc
  303. echo '# GPG/PGP integration' >> /etc/Muttrc
  304. echo '# this set the number of seconds to keep in memory the passphrase used to encrypt/sign' >> /etc/Muttrc
  305. echo 'set pgp_timeout=1800' >> /etc/Muttrc
  306. echo '' >> /etc/Muttrc
  307. echo '# automatically sign and encrypt with PGP/MIME' >> /etc/Muttrc
  308. echo 'set pgp_autosign # autosign all outgoing mails' >> /etc/Muttrc
  309. echo 'set pgp_autoencrypt # Try to encrypt automatically' >> /etc/Muttrc
  310. echo 'set pgp_replyencrypt # autocrypt replies to crypted' >> /etc/Muttrc
  311. echo 'set pgp_replysign # autosign replies to signed' >> /etc/Muttrc
  312. echo 'set pgp_auto_decode=yes # decode attachments' >> /etc/Muttrc
  313. echo 'set fcc_clear=no # Keep encrypted copy of sent encrypted mail' >> /etc/Muttrc
  314. echo 'unset smime_is_default' >> /etc/Muttrc
  315. echo '' >> /etc/Muttrc
  316. echo 'set alias_file=~/.mutt-alias' >> /etc/Muttrc
  317. echo 'source ~/.mutt-alias' >> /etc/Muttrc
  318. echo 'set query_command= "abook --mutt-query \"%s\""' >> /etc/Muttrc
  319. echo 'macro index,pager A "<pipe-message>abook --add-email-quiet<return>" "add the sender address to abook"' >> /etc/Muttrc
  320. echo '' >> /etc/Muttrc
  321. echo '# Optional relay of SMTP via ISP' >> /etc/Muttrc
  322. echo '#set smtp_url="smtps://username:password@isp_mail_domain:465/"' >> /etc/Muttrc
  323. # create an Emacs configuration specifically for use with Mutt, which
  324. # has word wrap and spell checking on by default
  325. echo "(add-hook 'before-save-hook 'delete-trailing-whitespace)" > /home/$MY_USERNAME/.emacs-mutt
  326. echo '(setq org-support-shift-select t)' >> /home/$MY_USERNAME/.emacs-mutt
  327. echo '(setq standard-indent 4)' >> /home/$MY_USERNAME/.emacs-mutt
  328. echo '(setq-default tab-width 4)' >> /home/$MY_USERNAME/.emacs-mutt
  329. echo '(setq c-basic-offset 4)' >> /home/$MY_USERNAME/.emacs-mutt
  330. echo '(mouse-wheel-mode t)' >> /home/$MY_USERNAME/.emacs-mutt
  331. echo '(setq make-backup-files t)' >> /home/$MY_USERNAME/.emacs-mutt
  332. echo '(setq version-control t)' >> /home/$MY_USERNAME/.emacs-mutt
  333. echo '(setq backup-directory-alist (quote ((".*" . "~/.emacs_backups/"))))' >> /home/$MY_USERNAME/.emacs-mutt
  334. echo "(setq default-major-mode 'text-mode)" >> /home/$MY_USERNAME/.emacs-mutt
  335. echo "(dolist (hook '(text-mode-hook))" >> /home/$MY_USERNAME/.emacs-mutt
  336. echo ' (add-hook hook (lambda () (flyspell-mode 1))))' >> /home/$MY_USERNAME/.emacs-mutt
  337. echo '(setq-default fill-column 72)' >> /home/$MY_USERNAME/.emacs-mutt
  338. echo '(setq auto-fill-mode 0)' >> /home/$MY_USERNAME/.emacs-mutt
  339. echo "(add-hook 'text-mode-hook 'turn-on-auto-fill)" >> /home/$MY_USERNAME/.emacs-mutt
  340. echo "(setq-default auto-fill-function 'do-auto-fill)" >> /home/$MY_USERNAME/.emacs-mutt
  341. # add the emacs mutt configuration to the user profile skeleton
  342. if [ ! -f /etc/skel/.emacs-mutt ]; then
  343. cp /home/$MY_USERNAME/.emacs-mutt /etc/skel/.emacs-mutt
  344. chown root:root /etc/skel/.emacs-mutt
  345. fi
  346. cp -f /etc/Muttrc /home/$MY_USERNAME/.muttrc
  347. cp -f /etc/Muttrc /etc/skel/.muttrc
  348. touch /home/$MY_USERNAME/.mutt-alias
  349. cp /home/$MY_USERNAME/.mutt-alias /etc/skel/.mutt-alias
  350. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.emacs-mutt
  351. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.muttrc
  352. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.mutt-alias
  353. # default user on generic images
  354. if [ -d /home/${GENERIC_IMAGE_USERNAME} ]; then
  355. cp -f /etc/Muttrc /home/${GENERIC_IMAGE_USERNAME}/.muttrc
  356. chown ${GENERIC_IMAGE_USERNAME}:${GENERIC_IMAGE_USERNAME} /home/${GENERIC_IMAGE_USERNAME}/.muttrc
  357. touch /home/${GENERIC_IMAGE_USERNAME}/.mutt-alias
  358. chown ${GENERIC_IMAGE_USERNAME}:${GENERIC_IMAGE_USERNAME} /home/${GENERIC_IMAGE_USERNAME}/.mutt-alias
  359. cp /etc/skel/.emacs-mutt /home/${GENERIC_IMAGE_USERNAME}/.emacs-mutt
  360. chown ${GENERIC_IMAGE_USERNAME}:${GENERIC_IMAGE_USERNAME} /home/${GENERIC_IMAGE_USERNAME}/.emacs-mutt
  361. fi
  362. echo 'email_client' >> $COMPLETION_FILE
  363. }
  364. function email_archiving {
  365. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  366. return
  367. fi
  368. # ensure that the mail archive script is up to date
  369. if [ -f /usr/local/bin/${PROJECT_NAME}-archive-mail ]; then
  370. cp /usr/local/bin/${PROJECT_NAME}-archive-mail /etc/cron.daily/archivemail
  371. else
  372. if [ -f /usr/bin/${PROJECT_NAME}-archive-mail ]; then
  373. cp /usr/bin/${PROJECT_NAME}-archive-mail /etc/cron.daily/archivemail
  374. else
  375. echo "/usr/bin/${PROJECT_NAME}-archive-mail was not found. ${PROJECT_NAME} might not have fully installed."
  376. exit 62379
  377. fi
  378. fi
  379. chmod +x /etc/cron.daily/archivemail
  380. # update to the next commit
  381. function_check set_repo_commit
  382. set_repo_commit $INSTALL_DIR/cleanup-maildir "cleanup-maildir commit" "$CLEANUP_MAILDIR_COMMIT" $CLEANUP_MAILDIR_REPO
  383. if grep -Fxq "email_archiving" $COMPLETION_FILE; then
  384. return
  385. fi
  386. if [ ! -d $INSTALL_DIR ]; then
  387. mkdir $INSTALL_DIR
  388. fi
  389. cd $INSTALL_DIR
  390. function_check git_clone
  391. git_clone $CLEANUP_MAILDIR_REPO $INSTALL_DIR/cleanup-maildir
  392. cd $INSTALL_DIR/cleanup-maildir
  393. git checkout $CLEANUP_MAILDIR_COMMIT -b $CLEANUP_MAILDIR_COMMIT
  394. if ! grep -q "cleanup-maildir commit" $COMPLETION_FILE; then
  395. echo "cleanup-maildir commit:$CLEANUP_MAILDIR_COMMIT" >> $COMPLETION_FILE
  396. else
  397. sed -i "s/cleanup-maildir commit.*/cleanup-maildir commit:$CLEANUP_MAILDIR_COMMIT/g" $COMPLETION_FILE
  398. fi
  399. cp $INSTALL_DIR/cleanup-maildir/cleanup-maildir /usr/bin
  400. echo 'email_archiving' >> $COMPLETION_FILE
  401. }
  402. # Ensure that the from field is correct when sending email from Mutt
  403. function email_from_address {
  404. if grep -Fxq "email_from_address" $COMPLETION_FILE; then
  405. return
  406. fi
  407. if [ ! -f /home/$MY_USERNAME/.muttrc ]; then
  408. return
  409. fi
  410. if grep -q "set from=" /home/$MY_USERNAME/.muttrc; then
  411. sed -i "s|set from=.*|set from='$MY_NAME <$MY_EMAIL_ADDRESS>'|g" /home/$MY_USERNAME/.muttrc
  412. else
  413. echo "set from='$MY_NAME <$MY_EMAIL_ADDRESS>'" >> /home/$MY_USERNAME/.muttrc
  414. fi
  415. echo 'email_from_address' >> $COMPLETION_FILE
  416. }
  417. function create_public_mailing_list {
  418. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  419. return
  420. fi
  421. if grep -Fxq "create_public_mailing_list" $COMPLETION_FILE; then
  422. return
  423. fi
  424. if [ ! $PUBLIC_MAILING_LIST ]; then
  425. return
  426. fi
  427. # does the mailing list have a separate domain name?
  428. if [ ! $PUBLIC_MAILING_LIST_DOMAIN_NAME ]; then
  429. PUBLIC_MAILING_LIST_DOMAIN_NAME=$DEFAULT_DOMAIN_NAME
  430. fi
  431. PUBLIC_MAILING_LIST_USER="mlmmj"
  432. apt-get -y install mlmmj
  433. adduser --system $PUBLIC_MAILING_LIST_USER
  434. addgroup $PUBLIC_MAILING_LIST_USER
  435. adduser $PUBLIC_MAILING_LIST_USER $PUBLIC_MAILING_LIST_USER
  436. echo ''
  437. echo $"Creating the $PUBLIC_MAILING_LIST mailing list"
  438. echo ''
  439. # create the list
  440. mlmmj-make-ml -a -L "$PUBLIC_MAILING_LIST" -c $PUBLIC_MAILING_LIST_USER
  441. echo 'SYSTEM_ALIASES_PIPE_TRANSPORT = address_pipe' > /etc/exim4/conf.d/main/000_localmacros
  442. echo "SYSTEM_ALIASES_USER = $PUBLIC_MAILING_LIST_USER" >> /etc/exim4/conf.d/main/000_localmacros
  443. echo "SYSTEM_ALIASES_GROUP = $PUBLIC_MAILING_LIST_USER" >> /etc/exim4/conf.d/main/000_localmacros
  444. # router
  445. echo 'mlmmj_router:' > /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  446. echo ' debug_print = "R: mlmmj_router for $local_part@$domain"' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  447. echo ' driver = accept' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  448. echo ' domains = +mlmmj_domains' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  449. echo ' #require_files = MLMMJ_HOME/${lc::$local_part}' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  450. echo ' # Use this instead, if you dont want to give Exim rx rights to mlmmj spool.' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  451. echo ' # Exim will then spawn a new process running under the UID of "mlmmj".' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  452. echo ' require_files = mlmmj:MLMMJ_HOME/${lc::$local_part}' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  453. echo ' local_part_suffix = +*' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  454. echo ' local_part_suffix_optional' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  455. echo ' headers_remove = Delivered-To' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  456. echo ' headers_add = Delivered-To: $local_part$local_part_suffix@$domain' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  457. echo ' transport = mlmmj_transport' >> /etc/exim4/conf.d/router/750_exim4-config_mlmmj
  458. # transport
  459. echo 'mlmmj_transport:' > /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  460. echo ' debug_print = "T: mlmmj_transport for $local_part@$domain"' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  461. echo ' driver = pipe' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  462. echo ' return_path_add' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  463. echo ' user = mlmmj' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  464. echo ' group = mlmmj' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  465. echo ' home_directory = MLMMJ_HOME' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  466. echo ' current_directory = MLMMJ_HOME' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  467. echo ' command = /usr/bin/mlmmj-receive -F -L MLMMJ_HOME/${lc:$local_part}' >> /etc/exim4/conf.d/transport/40_exim4-config_mlmmj
  468. if ! grep -q "MLMMJ_HOME=/var/spool/mlmmj" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs; then
  469. sed -i '/MAIN CONFIGURATION SETTINGS/a\MLMMJ_HOME=/var/spool/mlmmj' /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs
  470. fi
  471. if ! grep -q "domainlist mlmmj_domains =" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs; then
  472. sed -i "/MLMMJ_HOME/a\domainlist mlmmj_domains = $PUBLIC_MAILING_LIST_DOMAIN_NAME" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs
  473. fi
  474. if ! grep -q "delay_warning_condition =" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs; then
  475. sed -i '/domainlist mlmmj_domains =/a\delay_warning_condition = ${if match_domain{$domain}{+mlmmj_domains}{no}{yes}}' /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs
  476. fi
  477. if ! grep -q ": +mlmmj_domains" /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs; then
  478. sed -i 's/domainlist relay_to_domains = MAIN_RELAY_TO_DOMAINS/domainlist relay_to_domains = MAIN_RELAY_TO_DOMAINS : +mlmmj_domains/g' /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs
  479. fi
  480. if ! grep -q "! +mlmmj_domains" /etc/exim4/conf.d/router/200_exim4-config_primary; then
  481. sed -i 's/domains = ! +local_domains/domains = ! +mlmmj_domains : ! +local_domains/g' /etc/exim4/conf.d/router/200_exim4-config_primary
  482. fi
  483. update-exim4.conf.template -r
  484. update-exim4.conf
  485. systemctl restart exim4
  486. if ! grep -q $"$PUBLIC_MAILING_LIST mailing list" /home/$MY_USERNAME/README; then
  487. echo '' >> /home/$MY_USERNAME/README
  488. echo '' >> /home/$MY_USERNAME/README
  489. echo $"$PUBLIC_MAILING_LIST mailing list" >> /home/$MY_USERNAME/README
  490. echo '=================================' >> /home/$MY_USERNAME/README
  491. echo $"To subscribe to the $PUBLIC_MAILING_LIST mailing list send a" >> /home/$MY_USERNAME/README
  492. echo $"cleartext email to $PUBLIC_MAILING_LIST+subscribe@$DEFAULT_DOMAIN_NAME" >> /home/$MY_USERNAME/README
  493. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/README
  494. chmod 600 /home/$MY_USERNAME/README
  495. fi
  496. ${PROJECT_NAME}-addlist -u $MY_USERNAME -l "$PUBLIC_MAILING_LIST" -s "$PUBLIC_MAILING_LIST"
  497. echo 'create_public_mailing_list' >> $COMPLETION_FILE
  498. }
  499. function create_private_mailing_list {
  500. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  501. return
  502. fi
  503. # This installation doesn't work, results in ruby errors
  504. # There is currently no schleuder package for Debian jessie
  505. if grep -Fxq "create_private_mailing_list" $COMPLETION_FILE; then
  506. return
  507. fi
  508. if [ ! $PRIVATE_MAILING_LIST ]; then
  509. return
  510. fi
  511. if [[ $PRIVATE_MAILING_LIST == $MY_USERNAME ]]; then
  512. echo $'The name of the private mailing list should not be the same as your username'
  513. exit 10
  514. fi
  515. if [ ! $MY_GPG_PUBLIC_KEY ]; then
  516. echo $'To create a private mailing list you need to specify a file'
  517. echo $'containing your exported GPG key within MY_GPG_PUBLIC_KEY at'
  518. echo $'the top of the script'
  519. exit 11
  520. fi
  521. apt-get -y install ruby ruby-dev ruby-gpgme libgpgme11-dev libmagic-dev
  522. gem install schleuder
  523. schleuder-fix-gem-dependencies
  524. schleuder-init-setup --gem
  525. # NOTE: this is version number sensitive and so might need changing
  526. ln -s /var/lib/gems/2.1.0/gems/schleuder-2.2.4 /var/lib/schleuder
  527. sed -i 's/#smtp_port: 25/smtp_port: 465/g' /etc/schleuder/schleuder.conf
  528. sed -i 's/#superadminaddr: root@localhost/superadminaddr: root@localhost' /etc/schleuder/schleuder.conf
  529. schleuder-newlist $PRIVATE_MAILING_LIST@$DEFAULT_DOMAIN_NAME -realname "$PRIVATE_MAILING_LIST" -adminaddress $MY_EMAIL_ADDRESS -initmember $MY_EMAIL_ADDRESS -initmemberkey $MY_GPG_PUBLIC_KEY -nointeractive
  530. ${PROJECT_NAME}-addemail -u $MY_USERNAME -e $PRIVATE_MAILING_LIST@$DEFAULT_DOMAIN_NAME -l $PRIVATE_MAILING_LIST
  531. echo 'schleuder:' > /etc/exim4/conf.d/router/550_exim4-config_schleuder
  532. echo ' debug_print = "R: schleuder for $local_part@$domain"' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  533. echo ' driver = accept' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  534. echo ' local_part_suffix_optional' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  535. echo ' local_part_suffix = +* : -bounce : -sendkey' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  536. echo ' domains = +local_domains' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  537. echo ' user = schleuder' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  538. echo ' group = schleuder' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  539. echo ' require_files = schleuder:+/var/lib/schleuder/$domain/${local_part}' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  540. echo ' transport = schleuder_transport' >> /etc/exim4/conf.d/router/550_exim4-config_schleuder
  541. echo 'schleuder_transport:' > /etc/exim4/conf.d/transport/30_exim4-config_schleuder
  542. echo ' debug_print = "T: schleuder_transport for $local_part@$domain"' >> /etc/exim4/conf.d/transport/30_exim4-config_schleuder
  543. echo ' driver = pipe' >> /etc/exim4/conf.d/transport/30_exim4-config_schleuder
  544. echo ' home_directory = "/var/lib/schleuder/$domain/$local_part"' >> /etc/exim4/conf.d/transport/30_exim4-config_schleuder
  545. echo ' command = "/usr/bin/schleuder $local_part@$domain"' >> /etc/exim4/conf.d/transport/30_exim4-config_schleuder
  546. chown -R schleuder:schleuder /var/lib/schleuder
  547. update-exim4.conf.template -r
  548. update-exim4.conf
  549. systemctl restart exim4
  550. useradd -d /var/schleuderlists -s /bin/false schleuder
  551. adduser Debian-exim schleuder
  552. usermod -a -G mail schleuder
  553. #exim -d -bt $PRIVATE_MAILING_LIST@$DEFAULT_DOMAIN_NAME
  554. echo 'create_private_mailing_list' >> $COMPLETION_FILE
  555. }
  556. function split_gpg_key_into_fragments {
  557. # split the gpg key into fragments if social key management is enabled
  558. if [[ $ENABLE_SOCIAL_KEY_MANAGEMENT == "yes" ]]; then
  559. echo 'Splitting GPG key. You may need to enter your passphrase.'
  560. ${PROJECT_NAME}-splitkey -u $MY_USERNAME -e $MY_EMAIL_ADDRESS --fullname "$MY_NAME"
  561. if [ ! -d /home/$MY_USERNAME/.gnupg_fragments ]; then
  562. echo 'Yhe GPG key could not be split'
  563. exit 86548
  564. fi
  565. fi
  566. }
  567. function import_email {
  568. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  569. return
  570. fi
  571. EMAIL_COMPLETE_MSG=$"
  572. *** ${PROJECT_NAME} mailbox installation is complete ***
  573. Now on your internet router forward ports
  574. 25, 587, 465, 993 and 2222 to the ${PROJECT_NAME}
  575. "
  576. if grep -Fxq "import_email" $COMPLETION_FILE; then
  577. if [[ $SYSTEM_TYPE == "$VARIANT_MAILBOX" ]]; then
  578. function_check backup_to_friends_servers
  579. backup_to_friends_servers
  580. function_check install_tripwire
  581. install_tripwire
  582. function_check split_gpg_key_into_fragments
  583. split_gpg_key_into_fragments
  584. clear
  585. echo ''
  586. echo "$EMAIL_COMPLETE_MSG"
  587. if [ -d $USB_MOUNT ]; then
  588. umount $USB_MOUNT
  589. rm -rf $USB_MOUNT
  590. echo $' You can now remove the USB drive'
  591. fi
  592. exit 0
  593. fi
  594. return
  595. fi
  596. if [ $IMPORT_MAILDIR ]; then
  597. if [ -d $IMPORT_MAILDIR ]; then
  598. echo $'Transfering email files'
  599. cp -r $IMPORT_MAILDIR /home/$MY_USERNAME
  600. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/Maildir
  601. else
  602. echo $"Email import directory $IMPORT_MAILDIR not found"
  603. exit 9
  604. fi
  605. fi
  606. echo 'import_email' >> $COMPLETION_FILE
  607. if [[ $SYSTEM_TYPE == "$VARIANT_MAILBOX" ]]; then
  608. function_check backup_to_friends_servers
  609. backup_to_friends_servers
  610. function_check install_tripwire
  611. install_tripwire
  612. function_check split_gpg_key_into_fragments
  613. split_gpg_key_into_fragments
  614. # unmount any attached usb drive
  615. clear
  616. echo ''
  617. echo "$EMAIL_COMPLETE_MSG"
  618. echo ''
  619. if [ -d $USB_MOUNT ]; then
  620. umount $USB_MOUNT
  621. rm -rf $USB_MOUNT
  622. echo $' You can now remove the USB drive'
  623. fi
  624. exit 0
  625. fi
  626. }
  627. function remove_email {
  628. echo ''
  629. }
  630. function install_email {
  631. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  632. return
  633. fi
  634. if grep -Fxq "install_email" $COMPLETION_FILE; then
  635. return
  636. fi
  637. apt-get -y remove postfix
  638. apt-get -y install exim4 sasl2-bin swaks libnet-ssleay-perl procmail xinetd
  639. if [ ! -d /etc/exim4 ]; then
  640. echo $"ERROR: Exim does not appear to have installed. $CHECK_MESSAGE"
  641. exit 48
  642. fi
  643. onion_service_name='email'
  644. if [ ! -d /var/lib/tor ]; then
  645. echo $"No Tor installation found. ${onion_service_name} onion site cannot be configured."
  646. exit 877367
  647. fi
  648. if ! grep -q "hidden_service_${onion_service_name}" /etc/tor/torrc; then
  649. echo "HiddenServiceDir /var/lib/tor/hidden_service_${onion_service_name}/" >> /etc/tor/torrc
  650. echo 'HiddenServicePort 25 127.0.0.1:25' >> /etc/tor/torrc
  651. echo 'HiddenServicePort 587 127.0.0.1:587' >> /etc/tor/torrc
  652. echo 'HiddenServicePort 465 127.0.0.1:465' >> /etc/tor/torrc
  653. echo 'HiddenServicePort 993 127.0.0.1:993' >> /etc/tor/torrc
  654. echo $"Added onion site for ${onion_service_name}"
  655. fi
  656. systemctl restart tor
  657. function_check wait_for_onion_service
  658. wait_for_onion_service ${onion_service_name}
  659. if [ ! -f /var/lib/tor/hidden_service_${onion_service_name}/hostname ]; then
  660. echo $"${onion_service_name} onion site hostname not found"
  661. exit 76362
  662. fi
  663. EMAIL_ONION_HOSTNAME=$(cat /var/lib/tor/hidden_service_${onion_service_name}/hostname)
  664. if [[ $ONION_ONLY != "no" ]]; then
  665. function_check set_hostname
  666. set_hostname ${EMAIL_ONION_HOSTNAME}
  667. MY_EMAIL_ADDRESS=${MY_USERNAME}@${DEFAULT_DOMAIN_NAME}
  668. fi
  669. if ! grep -q "Email onion domain" $COMPLETION_FILE; then
  670. echo "Email onion domain:${EMAIL_ONION_HOSTNAME}" >> $COMPLETION_FILE
  671. else
  672. sed -i "s|Email onion domain.*|Email onion domain:${EMAIL_ONION_HOSTNAME}|g" $COMPLETION_FILE
  673. fi
  674. # see https://github.com/petterreinholdtsen/exim4-smtorp
  675. echo '# tor stuff first' > /etc/exim4/conf.d/router/100_exim4-smtorp
  676. echo '#' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  677. echo '# if were submitting mail *from* a .tor/.onion address,' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  678. echo '# make sure any header lines that may give us away is' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  679. echo '# stripped out, and add a new, cryptic Message-ID.' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  680. echo '# In address_data we store the name we should HELO as.' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  681. echo 'tor_to_any:' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  682. echo ' debug_print = "R: manualroute from .onion to $local_part@$domain"' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  683. echo ' driver = manualroute' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  684. echo ' domains = ! +local_domains' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  685. echo ' condition = ${if match {$sender_address_domain}{\N.*\.(onion|tor)$\N}}' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  686. echo ' address_data = $sender_address_domain' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  687. echo ' transport = remote_smtp_onion' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  688. echo ' self = send' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  689. echo ' route_list = * localhost' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  690. echo ' headers_remove = Received:Message-ID:X-Mailer:User-Agent' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  691. echo ' headers_add = Message-ID: <${lc:${sha1:$message_id}}@$sender_address_domain>' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  692. echo '' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  693. echo '# this catches the case where were submitting mail' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  694. echo '# from a regular email address where we dont need to' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  695. echo '# rewrite any headers' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  696. echo 'any_to_tor:' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  697. echo ' debug_print = "R: manualroute for $local_part@$domain"' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  698. echo ' driver = manualroute' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  699. echo ' domains = ! +local_domains' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  700. echo ' transport = remote_smtp_onion' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  701. echo ' self = send' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  702. echo ' route_list = *.onion localhost ; *.tor localhost' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  703. echo ' address_data = $smtp_active_hostname' >> /etc/exim4/conf.d/router/100_exim4-smtorp
  704. echo 'remote_smtp_onion:' > /etc/exim4/conf.d/transport/100_exim4-smtorp
  705. echo ' debug_print = "T: remote_smtp_onion for $local_part@$original_domain"' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  706. echo ' driver = smtp' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  707. echo '' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  708. echo ' # set helo_data to where we want to connect to,' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  709. echo ' # for the proxy program tor-smtp' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  710. echo ' helo_data = "$address_data $original_domain"' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  711. echo '' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  712. echo ' # wherever we configured our script at' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  713. echo ' port = 12668' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  714. echo '' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  715. echo ' # cannot use TLS otherwise it will EHLO again!!' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  716. echo ' hosts_avoid_tls = *' >> /etc/exim4/conf.d/transport/100_exim4-smtorp
  717. if [ ! -d $INSTALL_DIR ]; then
  718. mkdir -p $INSTALL_DIR
  719. fi
  720. cd $INSTALL_DIR
  721. function_check git_clone
  722. git_clone $EXIM_ONION_REPO $INSTALL_DIR/exim4-smtorp
  723. cd $INSTALL_DIR/exim4-smtorp/tor-smtp
  724. make
  725. if [ ! -f $INSTALL_DIR/exim4-smtorp/tor-smtp/tor-smtp ]; then
  726. echo $'Unable to make tor smtp transport'
  727. exit 52629
  728. fi
  729. if [ ! -d /usr/lib/exim4-smtorp ]; then
  730. mkdir /usr/lib/exim4-smtorp
  731. fi
  732. cp $INSTALL_DIR/exim4-smtorp/tor-smtp/tor-smtp /usr/lib/exim4-smtorp/tor-smtp
  733. if [ ! -f /usr/lib/exim4-smtorp/tor-smtp ]; then
  734. echo $'Unable to copy tor-smtp'
  735. exit 83503
  736. fi
  737. cp $INSTALL_DIR/exim4-smtorp/xinetd /etc/xinetd.d/tor-smtp
  738. if [ ! -f /etc/xinetd.d/tor-smtp ]; then
  739. echo $'Unable to copy to xinetd.d'
  740. exit 835954
  741. fi
  742. systemctl restart xinetd
  743. # configure for Maildir format
  744. sed -i 's/MAIL_DIR/#MAIL_DIR/g' /etc/login.defs
  745. sed -i 's|#MAIL_FILE.*|MAIL_FILE Maildir/|g' /etc/login.defs
  746. if ! grep -q "export MAIL" /etc/profile; then
  747. echo 'export MAIL=~/Maildir' >> /etc/profile
  748. fi
  749. sed -i 's|pam_mail.so standard|pam_mail.so dir=~/Maildir standard|g' /etc/pam.d/login
  750. sed -i 's|pam_mail.so standard noenv|pam_mail.so dir=~/Maildir standard|g' /etc/pam.d/sshd
  751. sed -i 's|pam_mail.so nopen|pam_mail.so dir=~/Maildir nopen|g' /etc/pam.d/su
  752. echo 'dc_eximconfig_configtype="internet"' > /etc/exim4/update-exim4.conf.conf
  753. if [[ $ONION_ONLY == "no" ]]; then
  754. # both ICANN and onion domains
  755. echo "dc_other_hostnames='${DEFAULT_DOMAIN_NAME};${EMAIL_ONION_HOSTNAME}'" >> /etc/exim4/update-exim4.conf.conf
  756. else
  757. echo "dc_other_hostnames='${EMAIL_ONION_HOSTNAME}'" >> /etc/exim4/update-exim4.conf.conf
  758. fi
  759. echo "dc_local_interfaces=''" >> /etc/exim4/update-exim4.conf.conf
  760. echo "dc_readhost=''" >> /etc/exim4/update-exim4.conf.conf
  761. echo "dc_relay_domains=''" >> /etc/exim4/update-exim4.conf.conf
  762. echo "dc_minimaldns='false'" >> /etc/exim4/update-exim4.conf.conf
  763. RELAY_NETS='192.168.1.0/24'
  764. if [ $LOCAL_NETWORK_STATIC_IP_ADDRESS ]; then
  765. RELAY_NETS=$(echo $LOCAL_NETWORK_STATIC_IP_ADDRESS | awk -F '.' '{print $1 "." $2 "." $3 ".0/24"}')
  766. fi
  767. echo "dc_relay_nets='$RELAY_NETS'" >> /etc/exim4/update-exim4.conf.conf
  768. echo "dc_smarthost=''" >> /etc/exim4/update-exim4.conf.conf
  769. echo "CFILEMODE='644'" >> /etc/exim4/update-exim4.conf.conf
  770. echo "dc_use_split_config='false'" >> /etc/exim4/update-exim4.conf.conf
  771. echo "dc_hide_mailname=''" >> /etc/exim4/update-exim4.conf.conf
  772. echo "dc_mailname_in_oh='true'" >> /etc/exim4/update-exim4.conf.conf
  773. echo "dc_localdelivery='maildir_home'" >> /etc/exim4/update-exim4.conf.conf
  774. update-exim4.conf
  775. sed -i "s/START=no/START=yes/g" /etc/default/saslauthd
  776. systemctl start saslauthd
  777. # make a tls certificate for email
  778. if [ ! -f /etc/ssl/certs/exim.dhparam ]; then
  779. ${PROJECT_NAME}-addcert -h exim --dhkey $DH_KEYLENGTH
  780. check_certificates exim
  781. fi
  782. cp /etc/ssl/private/exim.key /etc/exim4
  783. cp /etc/ssl/certs/exim.crt /etc/exim4
  784. cp /etc/ssl/certs/exim.dhparam /etc/exim4
  785. chown root:Debian-exim /etc/exim4/exim.key /etc/exim4/exim.crt /etc/exim4/exim.dhparam
  786. chmod 640 /etc/exim4/exim.key /etc/exim4/exim.crt /etc/exim4/exim.dhparam
  787. sed -i '/login_saslauthd_server/,/.endif/ s/# *//' /etc/exim4/exim4.conf.template
  788. sed -i "/.ifdef MAIN_HARDCODE_PRIMARY_HOSTNAME/i\MAIN_HARDCODE_PRIMARY_HOSTNAME = $DEFAULT_DOMAIN_NAME\nMAIN_TLS_ENABLE = true" /etc/exim4/exim4.conf.template
  789. sed -i "s|SMTPLISTENEROPTIONS=''|SMTPLISTENEROPTIONS='-oX 465:25:587 -oP /var/run/exim4/exim.pid'|g" /etc/default/exim4
  790. if ! grep -q "tls_on_connect_ports=465" /etc/exim4/exim4.conf.template; then
  791. sed -i '/SSL configuration for exim/i\tls_on_connect_ports=465' /etc/exim4/exim4.conf.template
  792. fi
  793. adduser $MY_USERNAME sasl
  794. addgroup Debian-exim sasl
  795. systemctl restart exim4
  796. if [ ! -d /etc/skel/Maildir ]; then
  797. mkdir -m 700 /etc/skel/.mutt
  798. mkdir -m 700 /etc/skel/Maildir
  799. mkdir -m 700 /etc/skel/Maildir/new
  800. mkdir -m 700 /etc/skel/Maildir/cur
  801. mkdir -m 700 /etc/skel/Maildir/Sent
  802. mkdir -m 700 /etc/skel/Maildir/Sent/tmp
  803. mkdir -m 700 /etc/skel/Maildir/Sent/cur
  804. mkdir -m 700 /etc/skel/Maildir/Sent/new
  805. mkdir -m 700 /etc/skel/Maildir/.learn-spam
  806. mkdir -m 700 /etc/skel/Maildir/.learn-spam/cur
  807. mkdir -m 700 /etc/skel/Maildir/.learn-spam/new
  808. mkdir -m 700 /etc/skel/Maildir/.learn-spam/tmp
  809. mkdir -m 700 /etc/skel/Maildir/.learn-ham
  810. mkdir -m 700 /etc/skel/Maildir/.learn-ham/cur
  811. mkdir -m 700 /etc/skel/Maildir/.learn-ham/new
  812. mkdir -m 700 /etc/skel/Maildir/.learn-ham/tmp
  813. ln -s /etc/skel/Maildir/.learn-spam /etc/skel/Maildir/spam
  814. ln -s /etc/skel/Maildir/.learn-ham /etc/skel/Maildir/ham
  815. fi
  816. if [ ! -d /home/$MY_USERNAME/Maildir ]; then
  817. mkdir -m 700 /home/$MY_USERNAME/.mutt
  818. mkdir -m 700 /home/$MY_USERNAME/Maildir
  819. mkdir -m 700 /home/$MY_USERNAME/Maildir/cur
  820. mkdir -m 700 /home/$MY_USERNAME/Maildir/tmp
  821. mkdir -m 700 /home/$MY_USERNAME/Maildir/new
  822. mkdir -m 700 /home/$MY_USERNAME/Maildir/Sent
  823. mkdir -m 700 /home/$MY_USERNAME/Maildir/Sent/cur
  824. mkdir -m 700 /home/$MY_USERNAME/Maildir/Sent/tmp
  825. mkdir -m 700 /home/$MY_USERNAME/Maildir/Sent/new
  826. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-spam
  827. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-spam/cur
  828. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-spam/new
  829. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-spam/tmp
  830. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-ham
  831. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-ham/cur
  832. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-ham/new
  833. mkdir -m 700 /home/$MY_USERNAME/Maildir/.learn-ham/tmp
  834. ln -s /home/$MY_USERNAME/Maildir/.learn-spam /home/$MY_USERNAME/Maildir/spam
  835. ln -s /home/$MY_USERNAME/Maildir/.learn-ham /home/$MY_USERNAME/Maildir/ham
  836. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/Maildir
  837. fi
  838. function_check configure_firewall_for_email
  839. configure_firewall_for_email
  840. echo 'install_email' >> $COMPLETION_FILE
  841. }
  842. function create_procmail {
  843. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  844. return
  845. fi
  846. if grep -Fxq "create_procmail" $COMPLETION_FILE; then
  847. return
  848. fi
  849. if [ ! -f /home/$MY_USERNAME/.procmailrc ]; then
  850. echo 'MAILDIR=$HOME/Maildir' > /home/$MY_USERNAME/.procmailrc
  851. echo 'DEFAULT=$MAILDIR/' >> /home/$MY_USERNAME/.procmailrc
  852. echo 'LOGFILE=$HOME/log/procmail.log' >> /home/$MY_USERNAME/.procmailrc
  853. echo 'LOGABSTRACT=all' >> /home/$MY_USERNAME/.procmailrc
  854. echo '' >> /home/$MY_USERNAME/.procmailrc
  855. echo $"# Tripwire reports which have no violations don't need to be logged" >> /home/$MY_USERNAME/.procmailrc
  856. echo ':0 BD:' >> /home/$MY_USERNAME/.procmailrc
  857. TRIPWIRE_VIOLATIONS_STR=$'Total violations found: 0'
  858. echo " * .*$TRIPWIRE_VIOLATIONS_STR" >> /home/$MY_USERNAME/.procmailrc
  859. echo '/dev/null' >> /home/$MY_USERNAME/.procmailrc
  860. echo '' >> /home/$MY_USERNAME/.procmailrc
  861. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.procmailrc
  862. fi
  863. mkdir -p /home/$MY_USERNAME/Maildir/admin/new
  864. mkdir -p /home/$MY_USERNAME/Maildir/admin/cur
  865. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/Maildir/admin
  866. if [ ! -f /etc/skel/.procmailrc ]; then
  867. cp /home/$MY_USERNAME/.procmailrc /etc/skel/.procmailrc
  868. chown root:root /etc/skel/.procmailrc
  869. fi
  870. echo 'create_procmail' >> $COMPLETION_FILE
  871. }
  872. function handle_admin_emails {
  873. # keep emails for root in a separate folder
  874. if [ -d /home/$MY_USERNAME/Maildir/admin ]; then
  875. return
  876. fi
  877. ${PROJECT_NAME}-addemail -u $MY_USERNAME -e "root@$DEFAULT_DOMAIN_NAME" -g admin --public no
  878. }
  879. function spam_filtering {
  880. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  881. return
  882. fi
  883. if grep -Fxq "spam_filtering" $COMPLETION_FILE; then
  884. return
  885. fi
  886. apt-get -y install exim4-daemon-heavy
  887. apt-get -y install spamassassin
  888. if [ ! -f /etc/default/spamassassin ]; then
  889. echo 'Spamassassin was not installed'
  890. exit 72570
  891. fi
  892. sa-update -v
  893. sed -i 's/ENABLED=0/ENABLED=1/g' /etc/default/spamassassin
  894. sed -i 's/# spamd_address = 127.0.0.1 783/spamd_address = 127.0.0.1 783/g' /etc/exim4/exim4.conf.template
  895. # This configuration is based on https://wiki.debian.org/DebianSpamAssassin
  896. sed -i 's/local_parts = postmaster/local_parts = postmaster:abuse/g' /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt
  897. sed -i '/domains = +local_domains : +relay_to_domains/a\ set acl_m0 = rfcnames' /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt
  898. sed -i 's/accept/accept condition = ${if eq{$acl_m0}{rfcnames} {1}{0}}/g' /etc/exim4/conf.d/acl/40_exim4-config_check_data
  899. echo 'warn message = X-Spam-Score: $spam_score ($spam_bar)' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  900. echo ' spam = nobody:true' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  901. echo 'warn message = X-Spam-Flag: YES' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  902. echo ' spam = nobody' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  903. echo 'warn message = X-Spam-Report: $spam_report' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  904. echo ' spam = nobody' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  905. echo '# reject spam at high scores (> 12)' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  906. echo 'deny message = This message scored $spam_score spam points.' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  907. echo ' spam = nobody:true' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  908. echo ' condition = ${if >{$spam_score_int}{120}{1}{0}}' >> /etc/exim4/conf.d/acl/40_exim4-config_check_data
  909. # procmail configuration
  910. echo '# get spamassassin to check emails' >> /home/$MY_USERNAME/.procmailrc
  911. echo ':0fw: .spamassassin.lock' >> /home/$MY_USERNAME/.procmailrc
  912. echo ' * < 256000' >> /home/$MY_USERNAME/.procmailrc
  913. echo '| spamc' >> /home/$MY_USERNAME/.procmailrc
  914. echo '# strong spam are discarded' >> /home/$MY_USERNAME/.procmailrc
  915. echo ':0' >> /home/$MY_USERNAME/.procmailrc
  916. echo ' * ^X-Spam-Level: \*\*\*\*\*\*' >> /home/$MY_USERNAME/.procmailrc
  917. echo '/dev/null' >> /home/$MY_USERNAME/.procmailrc
  918. echo '# weak spam are kept just in case - clear this out every now and then' >> /home/$MY_USERNAME/.procmailrc
  919. echo ':0' >> /home/$MY_USERNAME/.procmailrc
  920. echo ' * ^X-Spam-Level: \*\*\*\*\*' >> /home/$MY_USERNAME/.procmailrc
  921. echo 'maybe-spam/' >> /home/$MY_USERNAME/.procmailrc
  922. echo '# otherwise, marginal spam goes here for revision' >> /home/$MY_USERNAME/.procmailrc
  923. echo ':0' >> /home/$MY_USERNAME/.procmailrc
  924. echo ' * ^X-Spam-Level: \*\*' >> /home/$MY_USERNAME/.procmailrc
  925. echo 'spam/' >> /home/$MY_USERNAME/.procmailrc
  926. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.procmailrc
  927. echo '# get spamassassin to check emails' >> /etc/skel/.procmailrc
  928. echo ':0fw: .spamassassin.lock' >> /etc/skel/.procmailrc
  929. echo ' * < 256000' >> /etc/skel/.procmailrc
  930. echo '| spamc' >> /etc/skel/.procmailrc
  931. echo '# strong spam are discarded' >> /etc/skel/.procmailrc
  932. echo ':0' >> /etc/skel/.procmailrc
  933. echo ' * ^X-Spam-Level: \*\*\*\*\*\*' >> /etc/skel/.procmailrc
  934. echo '/dev/null' >> /etc/skel/.procmailrc
  935. echo '# weak spam are kept just in case - clear this out every now and then' >> /etc/skel/.procmailrc
  936. echo ':0' >> /etc/skel/.procmailrc
  937. echo ' * ^X-Spam-Level: \*\*\*\*\*' >> /etc/skel/.procmailrc
  938. echo 'maybe-spam/' >> /etc/skel/.procmailrc
  939. echo '# otherwise, marginal spam goes here for revision' >> /etc/skel/.procmailrc
  940. echo ':0' >> /etc/skel/.procmailrc
  941. echo ' * ^X-Spam-Level: \*\*' >> /etc/skel/.procmailrc
  942. echo 'spam/' >> /etc/skel/.procmailrc
  943. # filtering scripts
  944. echo '#!/bin/bash' > /usr/bin/filterspam
  945. echo 'for d in /home/*/ ; do' >> /usr/bin/filterspam
  946. echo ' USERNAME=$(echo "$d" | awk -F '"'"'/'"'"' '"'"'{print $3}'"'"')' >> /usr/bin/filterspam
  947. echo ' if [[ $USERNAME != "git" && $USERNAME != "mirrors" && $USERNAME != "sync" && $USERNAME != "tahoelafs" ]]; then' >> /usr/bin/filterspam
  948. echo ' MAILDIR=/home/$USERNAME/Maildir/.learn-spam' >> /usr/bin/filterspam
  949. echo ' if [ ! -d "$MAILDIR" ]; then' >> /usr/bin/filterspam
  950. echo ' exit' >> /usr/bin/filterspam
  951. echo ' fi' >> /usr/bin/filterspam
  952. echo ' for f in `ls $MAILDIR/cur`' >> /usr/bin/filterspam
  953. echo ' do' >> /usr/bin/filterspam
  954. echo ' spamc -L spam < "$MAILDIR/cur/$f" > /dev/null' >> /usr/bin/filterspam
  955. echo ' rm "$MAILDIR/cur/$f"' >> /usr/bin/filterspam
  956. echo ' done' >> /usr/bin/filterspam
  957. echo ' for f in `ls $MAILDIR/new`' >> /usr/bin/filterspam
  958. echo ' do' >> /usr/bin/filterspam
  959. echo ' spamc -L spam < "$MAILDIR/new/$f" > /dev/null' >> /usr/bin/filterspam
  960. echo ' rm "$MAILDIR/new/$f"' >> /usr/bin/filterspam
  961. echo ' done' >> /usr/bin/filterspam
  962. echo ' fi' >> /usr/bin/filterspam
  963. echo 'done' >> /usr/bin/filterspam
  964. echo 'exit 0' >> /usr/bin/filterspam
  965. echo '#!/bin/bash' > /usr/bin/filterham
  966. echo 'for d in /home/*/ ; do' >> /usr/bin/filterham
  967. echo ' USERNAME=$(echo "$d" | awk -F '"'"'/'"'"' '"'"'{print $3}'"'"')' >> /usr/bin/filterham
  968. echo ' if [[ $USERNAME != "git" && $USERNAME != "mirrors" && $USERNAME != "sync" && $USERNAME != "tahoelafs" ]]; then' >> /usr/bin/filterham
  969. echo ' MAILDIR=/home/$USERNAME/Maildir/.learn-ham' >> /usr/bin/filterham
  970. echo ' if [ ! -d "$MAILDIR" ]; then' >> /usr/bin/filterham
  971. echo ' exit' >> /usr/bin/filterham
  972. echo ' fi' >> /usr/bin/filterham
  973. echo ' for f in `ls $MAILDIR/cur`' >> /usr/bin/filterham
  974. echo ' do' >> /usr/bin/filterham
  975. echo ' spamc -L ham < "$MAILDIR/cur/$f" > /dev/null' >> /usr/bin/filterham
  976. echo ' rm "$MAILDIR/cur/$f"' >> /usr/bin/filterham
  977. echo ' done' >> /usr/bin/filterham
  978. echo ' for f in `ls $MAILDIR/new`' >> /usr/bin/filterham
  979. echo ' do' >> /usr/bin/filterham
  980. echo ' spamc -L ham < "$MAILDIR/new/$f" > /dev/null' >> /usr/bin/filterham
  981. echo ' rm "$MAILDIR/new/$f"' >> /usr/bin/filterham
  982. echo ' done' >> /usr/bin/filterham
  983. echo ' fi' >> /usr/bin/filterham
  984. echo 'done' >> /usr/bin/filterham
  985. echo 'exit 0' >> /usr/bin/filterham
  986. function_check cron_add_mins
  987. cron_add_mins 3 '/usr/bin/timeout 120 /usr/bin/filterspam'
  988. cron_add_mins 3 '/usr/bin/timeout 120 /usr/bin/filterham'
  989. chmod 655 /usr/bin/filterspam /usr/bin/filterham
  990. sed -i 's/# use_bayes 1/use_bayes 1/g' /etc/mail/spamassassin/local.cf
  991. sed -i 's/# bayes_auto_learn 1/bayes_auto_learn 1/g' /etc/mail/spamassassin/local.cf
  992. # user preferences
  993. if [ ! -d /home/$MY_USERNAME/.spamassassin ]; then
  994. mkdir /home/$MY_USERNAME/.spamassassin
  995. echo $'# How many points before a mail is considered spam.' > /home/$MY_USERNAME/.spamassassin/user_prefs
  996. echo '# required_score 5' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  997. echo '' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  998. echo $'# Whitelist and blacklist addresses are now file-glob-style patterns, so' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  999. echo $'# "friend@somewhere.com", "*@isp.com", or "*.domain.net" will all work.' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1000. echo '# whitelist_from someone@somewhere.com' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1001. echo '' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1002. echo $'# Add your own customised scores for some tests below. The default scores are' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1003. echo $'# read from the installed spamassassin rules files, but you can override them' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1004. echo $'# here. To see the list of tests and their default scores, go to' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1005. echo '# http://spamassassin.apache.org/tests.html .' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1006. echo '#' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1007. echo '# score SYMBOLIC_TEST_NAME n.nn' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1008. echo '' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1009. echo $'# Speakers of Asian languages, like Chinese, Japanese and Korean, will almost' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1010. echo $'# definitely want to uncomment the following lines. They will switch off some' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1011. echo $'# rules that detect 8-bit characters, which commonly trigger on mails using CJK' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1012. echo $'# character sets, or that assume a western-style charset is in use. ' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1013. echo '# ' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1014. echo '# score HTML_COMMENT_8BITS 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1015. echo '# score UPPERCASE_25_50 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1016. echo '# score UPPERCASE_50_75 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1017. echo '# score UPPERCASE_75_100 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1018. echo '# score OBSCURED_EMAIL 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1019. echo '' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1020. echo $'# Speakers of any language that uses non-English, accented characters may wish' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1021. echo $'# to uncomment the following lines. They turn off rules that fire on' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1022. echo $'# misformatted messages generated by common mail apps in contravention of the' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1023. echo $'# email RFCs.' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1024. echo '' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1025. echo '# score SUBJ_ILLEGAL_CHARS 0' >> /home/$MY_USERNAME/.spamassassin/user_prefs
  1026. fi
  1027. # this must be accessible by root
  1028. chown -R $MY_USERNAME:root /home/$MY_USERNAME/.spamassassin
  1029. systemctl restart spamassassin
  1030. systemctl restart exim4
  1031. systemctl restart cron
  1032. echo 'spam_filtering' >> $COMPLETION_FILE
  1033. }
  1034. function configure_imap {
  1035. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  1036. return
  1037. fi
  1038. if grep -Fxq "configure_imap" $COMPLETION_FILE; then
  1039. return
  1040. fi
  1041. dpkg -P dovecot-imapd
  1042. dpkg -P dovecot-core
  1043. apt-get -y install dovecot-imapd
  1044. if [ ! -d /etc/dovecot ]; then
  1045. echo $"ERROR: Dovecot does not appear to have installed. $CHECK_MESSAGE"
  1046. exit 48
  1047. fi
  1048. if [ ! -f /etc/ssl/certs/dovecot.dhparam ]; then
  1049. ${PROJECT_NAME}-addcert -h dovecot --dhkey $DH_KEYLENGTH
  1050. check_certificates dovecot
  1051. fi
  1052. chown root:dovecot /etc/ssl/certs/dovecot.*
  1053. chown root:dovecot /etc/ssl/private/dovecot.*
  1054. if [ ! -f /etc/dovecot/conf.d/10-ssl.conf ]; then
  1055. echo $'Unable to find /etc/dovecot/conf.d/10-ssl.conf'
  1056. exit 83629
  1057. fi
  1058. sed -i 's|#ssl =.*|ssl = required|g' /etc/dovecot/conf.d/10-ssl.conf
  1059. sed -i 's|ssl = no|ssl = required|g' /etc/dovecot/conf.d/10-ssl.conf
  1060. sed -i 's|ssl = yes|ssl = required|g' /etc/dovecot/conf.d/10-ssl.conf
  1061. sed -i 's|#ssl_cert =.*|ssl_cert = </etc/ssl/certs/dovecot.crt|g' /etc/dovecot/conf.d/10-ssl.conf
  1062. sed -i 's|ssl_cert =.*|ssl_cert = </etc/ssl/certs/dovecot.crt|g' /etc/dovecot/conf.d/10-ssl.conf
  1063. sed -i 's|#ssl_key =.*|ssl_key = </etc/ssl/private/dovecot.key|g' /etc/dovecot/conf.d/10-ssl.conf
  1064. sed -i 's|ssl_key =.*|ssl_key = </etc/ssl/private/dovecot.key|g' /etc/dovecot/conf.d/10-ssl.conf
  1065. sed -i 's|#ssl_dh_parameters_length.*|ssl_dh_parameters_length = 2048|g' /etc/dovecot/conf.d/10-ssl.conf
  1066. sed -i 's/#ssl_prefer_server_ciphers.*/ssl_prefer_server_ciphers = yes/g' /etc/dovecot/conf.d/10-ssl.conf
  1067. sed -i "s|#ssl_protocols =.*|ssl_protocols = '$SSL_PROTOCOLS'|g" /etc/dovecot/conf.d/10-ssl.conf
  1068. sed -i "s|ssl_protocols =.*|ssl_protocols = '$SSL_PROTOCOLS'|g" /etc/dovecot/conf.d/10-ssl.conf
  1069. echo "ssl_cipher_list = '$SSL_CIPHERS'" >> /etc/dovecot/conf.d/10-ssl.conf
  1070. if [ ! -f /etc/dovecot/conf.d/10-master.conf ]; then
  1071. echo $'Unable to find /etc/dovecot/conf.d/10-master.conf'
  1072. exit 49259
  1073. fi
  1074. sed -i 's/#process_limit =.*/process_limit = 100/g' /etc/dovecot/conf.d/10-master.conf
  1075. sed -i 's/#default_client_limit.*/default_client_limit = 100/g' /etc/dovecot/conf.d/10-master.conf
  1076. sed -i 's|#default_process_limit =.*|default_process_limit = 100|g' /etc/dovecot/conf.d/10-master.conf
  1077. if [ ! -f /etc/dovecot/conf.d/10-logging.conf ]; then
  1078. echo $'Unable to find /etc/dovecot/conf.d/10-logging.conf'
  1079. exit 48936
  1080. fi
  1081. sed -i 's/#auth_verbose.*/auth_verbose = yes/g' /etc/dovecot/conf.d/10-logging.conf
  1082. if [ ! -f /etc/dovecot/dovecot.conf ]; then
  1083. echo $'Unable to find /etc/dovecot/dovecot.conf'
  1084. exit 43890
  1085. fi
  1086. sed -i 's/#listen =.*/listen = */g' /etc/dovecot/dovecot.conf
  1087. if [ ! -f /etc/dovecot/conf.d/10-auth.conf ]; then
  1088. echo $'Unable to find /etc/dovecot/conf.d/10-auth.conf'
  1089. exit 843256
  1090. fi
  1091. sed -i 's/#disable_plaintext_auth =.*/disable_plaintext_auth = no/g' /etc/dovecot/conf.d/10-auth.conf
  1092. sed -i 's/auth_mechanisms =.*/auth_mechanisms = plain login/g' /etc/dovecot/conf.d/10-auth.conf
  1093. if [ ! -f /etc/dovecot/conf.d/10-mail.conf ]; then
  1094. echo $'Unable to find /etc/dovecot/conf.d/10-mail.conf'
  1095. exit 42036
  1096. fi
  1097. sed -i 's|mail_location =.*|mail_location = maildir:~/Maildir:LAYOUT=fs|g' /etc/dovecot/conf.d/10-mail.conf
  1098. # This long notify interval makes the system more suited for use with
  1099. # battery powered mobile devices
  1100. sed -i 's|#imap_idle_notify_interval =.*|imap_idle_notify_interval = 29|g' /etc/dovecot/conf.d/20-imap.conf
  1101. if [ -f /var/lib/dovecot/ssl-parameters.dat ]; then
  1102. rm /var/lib/dovecot/ssl-parameters.dat
  1103. fi
  1104. systemctl restart dovecot
  1105. echo 'configure_imap' >> $COMPLETION_FILE
  1106. }
  1107. function configure_imap_client_certs {
  1108. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  1109. return
  1110. fi
  1111. if grep -Fxq "configure_imap_client_certs" $COMPLETION_FILE; then
  1112. return
  1113. fi
  1114. # http://strange.systems/certificate-based-auth-with-dovecot-sendmail/
  1115. sed -i 's|#default_process_limit =.*|default_process_limit = 100|g' /etc/dovecot/conf.d/10-master.conf
  1116. sed -i 's/disable_plaintext_auth =.*/disable_plaintext_auth = yes/g' /etc/dovecot/conf.d/10-auth.conf
  1117. sed -i 's|#auth_ssl_require_client_cert =.*|auth_ssl_require_client_cert = yes|g' /etc/dovecot/conf.d/10-auth.conf
  1118. sed -i 's|#auth_ssl_username_from_cert =.*|auth_ssl_username_from_cert = yes|g' /etc/dovecot/conf.d/10-auth.conf
  1119. sed -i "s|#ssl_ca =.*|ssl_ca = /etc/ssl/certs/ca-$DEFAULT_DOMAIN_NAME.crt|g" /etc/dovecot/conf.d/10-ssl.conf
  1120. sed -i 's|#ssl_cert_username_field =.*|ssl_cert_username_field = commonName|g' /etc/dovecot/conf.d/10-ssl.conf
  1121. sed -i 's|#ssl_verify_client_cert =.*|ssl_verify_client_cert = yes|g' /etc/dovecot/conf.d/10-ssl.conf
  1122. if ! grep -q "passdb {" /etc/dovecot/conf.d/10-auth.conf; then
  1123. echo '' >> /etc/dovecot/conf.d/10-auth.conf
  1124. echo 'passdb {' >> /etc/dovecot/conf.d/10-auth.conf
  1125. echo ' driver = passwd-file' >> /etc/dovecot/conf.d/10-auth.conf
  1126. echo ' args = /etc/dovecot/passwd-file' >> /etc/dovecot/conf.d/10-auth.conf
  1127. echo ' deny = no' >> /etc/dovecot/conf.d/10-auth.conf
  1128. echo ' master = no' >> /etc/dovecot/conf.d/10-auth.conf
  1129. echo ' pass = no' >> /etc/dovecot/conf.d/10-auth.conf
  1130. echo '}' >> /etc/dovecot/conf.d/10-auth.conf
  1131. fi
  1132. if [[ $ONION_ONLY == "no" ]]; then
  1133. # make a CA cert
  1134. if [ ! -f /etc/ssl/private/ca-$DEFAULT_DOMAIN_NAME.key ]; then
  1135. if [[ $LETSENCRYPT_ENABLED != "yes" ]]; then
  1136. ${PROJECT_NAME}-addcert -h $DEFAULT_DOMAIN_NAME --ca "" --dhkey $DH_KEYLENGTH
  1137. else
  1138. ${PROJECT_NAME}-addcert -e $DEFAULT_DOMAIN_NAME -s $LETSENCRYPT_SERVER --ca "" --dhkey $DH_KEYLENGTH --email $MY_EMAIL_ADDRESS
  1139. fi
  1140. fi
  1141. fi
  1142. # CA configuration
  1143. echo '[ ca ]' > /etc/ssl/dovecot-ca.cnf
  1144. echo "default_ca = dovecot-ca" >> /etc/ssl/dovecot-ca.cnf
  1145. echo '' >> /etc/ssl/dovecot-ca.cnf
  1146. echo '[ crl_ext ]' >> /etc/ssl/dovecot-ca.cnf
  1147. echo 'authorityKeyIdentifier=keyid:always' >> /etc/ssl/dovecot-ca.cnf
  1148. echo '' >> /etc/ssl/dovecot-ca.cnf
  1149. echo '[ dovecot-ca ]' >> /etc/ssl/dovecot-ca.cnf
  1150. echo 'new_certs_dir = .' >> /etc/ssl/dovecot-ca.cnf
  1151. echo 'unique_subject = no' >> /etc/ssl/dovecot-ca.cnf
  1152. echo "certificate = /etc/ssl/certs/ca-$DEFAULT_DOMAIN_NAME.crt" >> /etc/ssl/dovecot-ca.cnf
  1153. echo 'database = ssldb' >> /etc/ssl/dovecot-ca.cnf
  1154. echo "private_key = /etc/ssl/private/ca-$DEFAULT_DOMAIN_NAME.key" >> /etc/ssl/dovecot-ca.cnf
  1155. echo 'serial = sslserial' >> /etc/ssl/dovecot-ca.cnf
  1156. echo 'default_days = 3650' >> /etc/ssl/dovecot-ca.cnf
  1157. echo 'default_md = sha256' >> /etc/ssl/dovecot-ca.cnf
  1158. echo 'default_bits = 4096' >> /etc/ssl/dovecot-ca.cnf
  1159. echo 'policy = dovecot-ca_policy' >> /etc/ssl/dovecot-ca.cnf
  1160. echo 'x509_extensions = dovecot-ca_extensions' >> /etc/ssl/dovecot-ca.cnf
  1161. echo '' >> /etc/ssl/dovecot-ca.cnf
  1162. echo '[ dovecot-ca_policy ]' >> /etc/ssl/dovecot-ca.cnf
  1163. echo 'commonName = supplied' >> /etc/ssl/dovecot-ca.cnf
  1164. echo 'stateOrProvinceName = supplied' >> /etc/ssl/dovecot-ca.cnf
  1165. echo 'countryName = supplied' >> /etc/ssl/dovecot-ca.cnf
  1166. echo 'emailAddress = optional' >> /etc/ssl/dovecot-ca.cnf
  1167. echo 'organizationName = supplied' >> /etc/ssl/dovecot-ca.cnf
  1168. echo 'organizationalUnitName = optional' >> /etc/ssl/dovecot-ca.cnf
  1169. echo '' >> /etc/ssl/dovecot-ca.cnf
  1170. echo '[ dovecot-ca_extensions ]' >> /etc/ssl/dovecot-ca.cnf
  1171. echo 'basicConstraints = CA:false' >> /etc/ssl/dovecot-ca.cnf
  1172. echo 'subjectKeyIdentifier = hash' >> /etc/ssl/dovecot-ca.cnf
  1173. echo 'authorityKeyIdentifier = keyid:always' >> /etc/ssl/dovecot-ca.cnf
  1174. echo 'keyUsage = digitalSignature,keyEncipherment' >> /etc/ssl/dovecot-ca.cnf
  1175. echo 'extendedKeyUsage = clientAuth' >> /etc/ssl/dovecot-ca.cnf
  1176. if [ -f /etc/ssl/ssldb ]; then
  1177. rm /etc/ssl/ssldb
  1178. fi
  1179. if [ -f /etc/ssl/sslserial ]; then
  1180. rm /etc/ssl/sslserial
  1181. fi
  1182. touch /etc/ssl/ssldb
  1183. echo 0001 > /etc/ssl/sslserial
  1184. #${PROJECT_NAME}-clientcert -u $MY_USERNAME
  1185. systemctl restart dovecot
  1186. echo 'configure_imap_client_certs' >> $COMPLETION_FILE
  1187. }
  1188. function create_gpg_subkey {
  1189. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  1190. return
  1191. fi
  1192. if grep -Fxq "create_gpg_subkey" $COMPLETION_FILE; then
  1193. return
  1194. fi
  1195. apt-get -y install gnupg
  1196. GPG_KEY_USAGE=$1
  1197. if [[ $GPG_KEY_USAGE != "sign" && $GPG_KEY_USAGE != "auth" && $GPG_KEY_USAGE != "encrypt" ]]; then
  1198. echo $"Unknown subkey usage: $GPG_KEY_USAGE"
  1199. echo $'Available types: sign|auth|encrypt'
  1200. exit 14783
  1201. fi
  1202. KEYGRIP=$(gpg --fingerprint --fingerprint $MY_EMAIL_ADDRESS | grep fingerprint | tail -1 | cut -d= -f2 | sed -e 's/ //g')
  1203. # Generate a GPG subkey
  1204. # Here a 2048bit length is used to be compatible with yubikey
  1205. echo 'Key-Type: 1' > /home/$MY_USERNAME/gpg-genkey.conf
  1206. echo "Key-Grip: $KEYGRIP" > /home/$MY_USERNAME/gpg-genkey.conf
  1207. echo 'Subkey-Type: 1' >> /home/$MY_USERNAME/gpg-genkey.conf
  1208. echo 'Subkey-Length: 2048' >> /home/$MY_USERNAME/gpg-genkey.conf
  1209. echo "subkey-Usage: $GPG_KEY_USAGE" > /home/$MY_USERNAME/gpg-genkey.conf
  1210. echo "Name-Real: $MY_NAME" >> /home/$MY_USERNAME/gpg-genkey.conf
  1211. echo "Name-Email: $MY_EMAIL_ADDRESS" >> /home/$MY_USERNAME/gpg-genkey.conf
  1212. echo "Name-Comment: $GPG_KEY_USAGE" >> /home/$MY_USERNAME/gpg-genkey.conf
  1213. echo 'Expire-Date: 0' >> /home/$MY_USERNAME/gpg-genkey.conf
  1214. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/gpg-genkey.conf
  1215. su -c "gpg --batch --gen-key /home/$MY_USERNAME/gpg-genkey.conf" - $MY_USERNAME
  1216. shred -zu /home/$MY_USERNAME/gpg-genkey.conf
  1217. MY_GPG_SUBKEY_ID=$(su -c "gpg --list-keys $MY_EMAIL_ADDRESS | grep 'pub '" - $MY_USERNAME | awk -F ' ' '{print $2}' | awk -F '/' '{print $2}')
  1218. echo 'create_gpg_subkey' >> $COMPLETION_FILE
  1219. }
  1220. function gpg_key_exists {
  1221. key_owner_username=$1
  1222. key_search_text=$2
  1223. if [[ $key_owner_username != "root" ]]; then
  1224. KEY_EXISTS=$(su -c "gpg --list-keys \"${key_search_text}\"" - $key_owner_username)
  1225. else
  1226. KEY_EXISTS=$(gpg --list-keys "${key_search_text}")
  1227. fi
  1228. if [ ! "$KEY_EXISTS" ]; then
  1229. echo "no"
  1230. return
  1231. fi
  1232. if [ "$KEY_EXISTS" == *"error"* ]; then
  1233. echo "no"
  1234. return
  1235. fi
  1236. echo "yes"
  1237. }
  1238. function gpg_pubkey_from_email {
  1239. key_owner_username=$1
  1240. key_email_address=$2
  1241. key_id=
  1242. if [[ $key_owner_username != "root" ]]; then
  1243. key_id=$(su -c "gpg --list-keys $key_email_address | grep 'pub '" - $key_owner_username | awk -F ' ' '{print $2}' | awk -F '/' '{print $2}')
  1244. else
  1245. key_id=$(gpg --list-keys $key_email_address | grep 'pub ' | awk -F ' ' '{print $2}' | awk -F '/' '{print $2}')
  1246. fi
  1247. echo $key_id
  1248. }
  1249. function configure_gpg {
  1250. if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" || $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  1251. return
  1252. fi
  1253. if grep -Fxq "configure_gpg" $COMPLETION_FILE; then
  1254. return
  1255. fi
  1256. apt-get -y install gnupg
  1257. gpg_dir=/home/$MY_USERNAME/.gnupg
  1258. # if gpg keys directory was previously imported from usb
  1259. if [[ $GPG_KEYS_IMPORTED == "yes" && -d $gpg_dir ]]; then
  1260. echo $'GPG keys were imported'
  1261. sed -i "s|keyserver hkp://keys.gnupg.net|keyserver $GPG_KEYSERVER|g" $gpg_dir/gpg.conf
  1262. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1263. if [ ${#MY_GPG_PUBLIC_KEY_ID} -lt 4 ]; then
  1264. echo $'GPG public key ID could not be obtained'
  1265. fi
  1266. chown -R $MY_USERNAME:$MY_USERNAME $gpg_dir
  1267. chmod 700 $gpg_dir
  1268. chmod 600 $gpg_dir/*
  1269. echo 'configure_gpg' >> $COMPLETION_FILE
  1270. return
  1271. fi
  1272. if [ ! -d $gpg_dir ]; then
  1273. mkdir $gpg_dir
  1274. echo "keyserver $GPG_KEYSERVER" >> $gpg_dir/gpg.conf
  1275. echo 'keyserver-options auto-key-retrieve' >> $gpg_dir/gpg.conf
  1276. fi
  1277. sed -i "s|keyserver hkp://keys.gnupg.net|keyserver $GPG_KEYSERVER|g" $gpg_dir/gpg.conf
  1278. if ! grep -q "# default preferences" $gpg_dir/gpg.conf; then
  1279. echo '' >> $gpg_dir/gpg.conf
  1280. echo '# default preferences' >> $gpg_dir/gpg.conf
  1281. echo 'personal-digest-preferences SHA256' >> $gpg_dir/gpg.conf
  1282. echo 'cert-digest-algo SHA256' >> $gpg_dir/gpg.conf
  1283. echo 'default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed' >> $gpg_dir/gpg.conf
  1284. fi
  1285. chown -R $MY_USERNAME:$MY_USERNAME $gpg_dir
  1286. chmod 700 $gpg_dir
  1287. chmod 600 $gpg_dir/*
  1288. if [[ $MY_GPG_PUBLIC_KEY && $MY_GPG_PRIVATE_KEY ]]; then
  1289. echo $'Importing GPG keys from file'
  1290. echo $"Public key: $MY_GPG_PUBLIC_KEY"
  1291. echo $"Private key: $MY_GPG_PRIVATE_KEY"
  1292. # use your existing GPG keys which were exported
  1293. if [ ! -f $MY_GPG_PUBLIC_KEY ]; then
  1294. echo $"GPG public key file $MY_GPG_PUBLIC_KEY was not found"
  1295. exit 2483
  1296. fi
  1297. if [ ! -f $MY_GPG_PRIVATE_KEY ]; then
  1298. echo $"GPG private key file $MY_GPG_PRIVATE_KEY was not found"
  1299. exit 5383
  1300. fi
  1301. su -c "gpg --import $MY_GPG_PUBLIC_KEY" - $MY_USERNAME
  1302. su -c "gpg --allow-secret-key-import --import $MY_GPG_PRIVATE_KEY" - $MY_USERNAME
  1303. KEY_EXISTS=$(gpg_key_exists "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1304. if [[ $KEY_EXISTS == "no" ]]; then
  1305. echo $"The GPG key for $MY_EMAIL_ADDRESS could not be imported"
  1306. exit 13821
  1307. fi
  1308. # for security ensure that the private key file doesn't linger around
  1309. shred -zu $MY_GPG_PRIVATE_KEY
  1310. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1311. if [ ${#MY_GPG_PUBLIC_KEY_ID} -lt 4 ]; then
  1312. echo $'GPG public key ID could not be obtained'
  1313. fi
  1314. else
  1315. # Generate a GPG key
  1316. echo 'Key-Type: 1' > /home/$MY_USERNAME/gpg-genkey.conf
  1317. echo 'Key-Length: 4096' >> /home/$MY_USERNAME/gpg-genkey.conf
  1318. echo 'Subkey-Type: 1' >> /home/$MY_USERNAME/gpg-genkey.conf
  1319. echo 'Subkey-Length: 4096' >> /home/$MY_USERNAME/gpg-genkey.conf
  1320. echo "Name-Real: $MY_NAME" >> /home/$MY_USERNAME/gpg-genkey.conf
  1321. echo "Name-Email: $MY_EMAIL_ADDRESS" >> /home/$MY_USERNAME/gpg-genkey.conf
  1322. echo 'Expire-Date: 0' >> /home/$MY_USERNAME/gpg-genkey.conf
  1323. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/gpg-genkey.conf
  1324. echo $'Generating a new GPG key'
  1325. su -c "gpg --batch --gen-key /home/$MY_USERNAME/gpg-genkey.conf" - $MY_USERNAME
  1326. KEY_EXISTS=$(gpg_key_exists "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1327. if [[ $KEY_EXISTS == "no" ]]; then
  1328. echo $"A GPG key for $MY_EMAIL_ADDRESS could not be created"
  1329. exit 6362
  1330. fi
  1331. shred -zu /home/$MY_USERNAME/gpg-genkey.conf
  1332. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$MY_USERNAME" "$MY_EMAIL_ADDRESS")
  1333. if [ ${#MY_GPG_PUBLIC_KEY_ID} -lt 4 ]; then
  1334. echo $'GPG public key ID could not be obtained'
  1335. fi
  1336. MY_GPG_PUBLIC_KEY=/tmp/public_key.gpg
  1337. su -c "gpg --output $MY_GPG_PUBLIC_KEY --armor --export $MY_GPG_PUBLIC_KEY_ID" - $MY_USERNAME
  1338. if grep -q "install_email" $COMPLETION_FILE; then
  1339. if ! grep -q $"Change your GPG password" /home/$MY_USERNAME/README; then
  1340. echo '' >> /home/$MY_USERNAME/README
  1341. echo '' >> /home/$MY_USERNAME/README
  1342. echo $'Change your GPG password' >> /home/$MY_USERNAME/README
  1343. echo '========================' >> /home/$MY_USERNAME/README
  1344. echo $"It's very important to add a password to your GPG key so that" >> /home/$MY_USERNAME/README
  1345. echo $"if anyone does get access to your email they still won't be able" >> /home/$MY_USERNAME/README
  1346. echo $'to read them without knowning the GPG password.' >> /home/$MY_USERNAME/README
  1347. echo $'You can change the it with:' >> /home/$MY_USERNAME/README
  1348. echo '' >> /home/$MY_USERNAME/README
  1349. echo " gpg --edit-key $MY_GPG_PUBLIC_KEY_ID" >> /home/$MY_USERNAME/README
  1350. echo ' passwd' >> /home/$MY_USERNAME/README
  1351. echo ' save' >> /home/$MY_USERNAME/README
  1352. echo ' quit' >> /home/$MY_USERNAME/README
  1353. fi
  1354. if ! grep -q $"Publish your GPG public key" /home/$MY_USERNAME/README; then
  1355. echo '' >> /home/$MY_USERNAME/README
  1356. echo '' >> /home/$MY_USERNAME/README
  1357. echo $'Publish your GPG public key' >> /home/$MY_USERNAME/README
  1358. echo '===========================' >> /home/$MY_USERNAME/README
  1359. echo $'So that others can send emails to you securely you should' >> /home/$MY_USERNAME/README
  1360. echo $'publish your GPG public key with the command:' >> /home/$MY_USERNAME/README
  1361. echo '' >> /home/$MY_USERNAME/README
  1362. echo " gpg --send-keys $MY_GPG_PUBLIC_KEY_ID" >> /home/$MY_USERNAME/README
  1363. fi
  1364. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/README
  1365. chmod 600 /home/$MY_USERNAME/README
  1366. fi
  1367. fi
  1368. echo 'configure_gpg' >> $COMPLETION_FILE
  1369. }
  1370. function refresh_gpg_keys {
  1371. REFRESH_GPG_KEYS_SCRIPT=/usr/bin/update-gpg-keys
  1372. echo '#!/bin/bash' > $REFRESH_GPG_KEYS_SCRIPT
  1373. echo "if [ -f /usr/local/bin/${PROJECT_NAME}-sec ]; then" >> $REFRESH_GPG_KEYS_SCRIPT
  1374. echo " /usr/bin/timeout 600 /usr/local/bin/${PROJECT_NAME}-sec --refresh yes" >> $REFRESH_GPG_KEYS_SCRIPT
  1375. echo 'else' >> $REFRESH_GPG_KEYS_SCRIPT
  1376. echo " /usr/bin/timeout 600 /usr/bin/${PROJECT_NAME}-sec --refresh yes" >> $REFRESH_GPG_KEYS_SCRIPT
  1377. echo 'fi' >> $REFRESH_GPG_KEYS_SCRIPT
  1378. chmod +x $REFRESH_GPG_KEYS_SCRIPT
  1379. if grep -q "${PROJECT_NAME}-sec" /etc/crontab; then
  1380. sed -i "/${PROJECT_NAME}-sec /d" /etc/crontab
  1381. fi
  1382. if ! grep -q "$REFRESH_GPG_KEYS_SCRIPT" /etc/crontab; then
  1383. GPG_REFRESH_TIME=$(( RANDOM % 60 ))
  1384. echo "$GPG_REFRESH_TIME */$REFRESH_GPG_KEYS_HOURS * * * root cronic $REFRESH_GPG_KEYS_SCRIPT" >> /etc/crontab
  1385. systemctl restart cron
  1386. else
  1387. sed -i "s|root $REFRESH_GPG_KEYS_SCRIPT.*|root cronic $REFRESH_GPG_KEYS_SCRIPT|g" /etc/crontab
  1388. fi
  1389. }
  1390. # NOTE: deliberately no exit 0