From 51ebb6a3ca46a94384fd949cc1dae483095ab76a Mon Sep 17 00:00:00 2001
From: Christian Heller <c.heller@plomlompom.de>
Date: Fri, 23 Nov 2018 13:35:35 +0100
Subject: [PATCH] WIP.

---
 .../server/etc/dovecot/conf.d/99-master.conf  |  10 ++
 .../server/etc/dovecot/conf.d/99-ssl.conf     |   1 +
 .../server/etc/iptables/rules.v4              |   4 +-
 .../server/etc/postfix/main.cf                |  49 +++++++
 .../server/etc/postfix/master.cf              | 124 ++++++++++++++++++
 .../server/etc/ssh/sshd_config                |   6 +-
 all_new_2018/setup_mail.sh                    |  10 ++
 7 files changed, 200 insertions(+), 4 deletions(-)
 create mode 100644 all_new_2018/linkable_etc_files/server/etc/dovecot/conf.d/99-master.conf
 create mode 100644 all_new_2018/linkable_etc_files/server/etc/dovecot/conf.d/99-ssl.conf
 create mode 100644 all_new_2018/linkable_etc_files/server/etc/postfix/main.cf
 create mode 100644 all_new_2018/linkable_etc_files/server/etc/postfix/master.cf
 create mode 100755 all_new_2018/setup_mail.sh

diff --git a/all_new_2018/linkable_etc_files/server/etc/dovecot/conf.d/99-master.conf b/all_new_2018/linkable_etc_files/server/etc/dovecot/conf.d/99-master.conf
new file mode 100644
index 0000000..0871740
--- /dev/null
+++ b/all_new_2018/linkable_etc_files/server/etc/dovecot/conf.d/99-master.conf
@@ -0,0 +1,10 @@
+service auth {
+  unix_listener auth-userdb {
+  }
+
+  unix_listener /var/spool/postfix/private/auth {
+	mode = 0660
+	user = postfix
+	group = postfix
+  }
+}
diff --git a/all_new_2018/linkable_etc_files/server/etc/dovecot/conf.d/99-ssl.conf b/all_new_2018/linkable_etc_files/server/etc/dovecot/conf.d/99-ssl.conf
new file mode 100644
index 0000000..7fa2f5f
--- /dev/null
+++ b/all_new_2018/linkable_etc_files/server/etc/dovecot/conf.d/99-ssl.conf
@@ -0,0 +1 @@
+ssl = required
diff --git a/all_new_2018/linkable_etc_files/server/etc/iptables/rules.v4 b/all_new_2018/linkable_etc_files/server/etc/iptables/rules.v4
index 01dca75..faf35c1 100644
--- a/all_new_2018/linkable_etc_files/server/etc/iptables/rules.v4
+++ b/all_new_2018/linkable_etc_files/server/etc/iptables/rules.v4
@@ -6,7 +6,9 @@
 -A INPUT -p icmp -j ACCEPT
 -A INPUT -p tcp --dport 22 -j ACCEPT
 -A INPUT -p tcp --dport 443 -j ACCEPT
--A INPUT -p tcp --dport 80 -j ACCEPT
+-A INPUT -p tcp --dport 25 -j ACCEPT
+-A INPUT -p tcp --dport 465 -j ACCEPT
+-A INPUT -p tcp --dport 993 -j ACCEPT
 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 COMMIT
 # iptables-restore seems to ignore COMMIT if no newline follows it
\ No newline at end of file
diff --git a/all_new_2018/linkable_etc_files/server/etc/postfix/main.cf b/all_new_2018/linkable_etc_files/server/etc/postfix/main.cf
new file mode 100644
index 0000000..b97738b
--- /dev/null
+++ b/all_new_2018/linkable_etc_files/server/etc/postfix/main.cf
@@ -0,0 +1,49 @@
+# See /usr/share/postfix/main.cf.dist for a commented, more complete version
+
+
+# Debian specific:  Specifying a file name will cause the first
+# line of that file to be used as the name.  The Debian default
+# is /etc/mailname.
+#myorigin = /etc/mailname
+
+smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
+biff = no
+
+# appending .domain is the MUA's job.
+append_dot_mydomain = no
+
+# Uncomment the next line to generate "delayed mail" warnings
+#delay_warning_time = 4h
+
+readme_directory = no
+
+# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on
+# fresh installs.
+compatibility_level = 2
+
+# TLS parameters (excluding smtpd_tls_(cert|key)_file for own adaption below)
+smtpd_use_tls=yes
+smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
+smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
+
+# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
+# information on enabling SSL in the smtp client.
+
+smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
+myhostname = moil.plomlompom.com
+alias_maps = hash:/etc/aliases
+alias_database = hash:/etc/aliases
+myorigin = /etc/mailname
+mydestination = $myhostname, moil.plomlompom.com, localhost.plomlompom.com, localhost
+relayhost = 
+mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
+mailbox_size_limit = 0
+recipient_delimiter = +
+inet_interfaces = all
+inet_protocols = all
+
+# plomlompom-specific adaptions to allow TLS and SASL via LetsEncrypt/Dovecot.
+smtpd_tls_cert_file=/etc/letsencrypt/live/${myhostname}/fullchain.pem
+smtpd_tls_key_file=/etc/letsencrypt/live/${myhostname}/privkey.pem
+smtpd_sasl_type = dovecot
+smtpd_sasl_path = private/auth
diff --git a/all_new_2018/linkable_etc_files/server/etc/postfix/master.cf b/all_new_2018/linkable_etc_files/server/etc/postfix/master.cf
new file mode 100644
index 0000000..bce1262
--- /dev/null
+++ b/all_new_2018/linkable_etc_files/server/etc/postfix/master.cf
@@ -0,0 +1,124 @@
+#
+# Postfix master process configuration file.  For details on the format
+# of the file, see the master(5) manual page (command: "man 5 master" or
+# on-line: http://www.postfix.org/master.5.html).
+#
+# Do not forget to execute "postfix reload" after editing this file.
+#
+# ==========================================================================
+# service type  private unpriv  chroot  wakeup  maxproc command + args
+#               (yes)   (yes)   (no)    (never) (100)
+# ==========================================================================
+smtp      inet  n       -       y       -       -       smtpd
+#smtp      inet  n       -       y       -       1       postscreen
+#smtpd     pass  -       -       y       -       -       smtpd
+#dnsblog   unix  -       -       y       -       0       dnsblog
+#tlsproxy  unix  -       -       y       -       0       tlsproxy
+#submission inet n       -       y       -       -       smtpd
+#  -o syslog_name=postfix/submission
+#  -o smtpd_tls_security_level=encrypt
+#  -o smtpd_sasl_auth_enable=yes
+#  -o smtpd_reject_unlisted_recipient=no
+#  -o smtpd_client_restrictions=$mua_client_restrictions
+#  -o smtpd_helo_restrictions=$mua_helo_restrictions
+#  -o smtpd_sender_restrictions=$mua_sender_restrictions
+#  -o smtpd_recipient_restrictions=
+#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
+#  -o milter_macro_daemon_name=ORIGINATING
+smtps     inet  n       -       y       -       -       smtpd
+  -o syslog_name=postfix/smtps
+  -o smtpd_tls_wrappermode=yes
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_reject_unlisted_recipient=no
+#  -o smtpd_client_restrictions=$mua_client_restrictions
+#  -o smtpd_helo_restrictions=$mua_helo_restrictions
+#  -o smtpd_sender_restrictions=$mua_sender_restrictions
+#  -o smtpd_recipient_restrictions=
+#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
+#  -o milter_macro_daemon_name=ORIGINATING
+#628       inet  n       -       y       -       -       qmqpd
+pickup    unix  n       -       y       60      1       pickup
+cleanup   unix  n       -       y       -       0       cleanup
+qmgr      unix  n       -       n       300     1       qmgr
+#qmgr     unix  n       -       n       300     1       oqmgr
+tlsmgr    unix  -       -       y       1000?   1       tlsmgr
+rewrite   unix  -       -       y       -       -       trivial-rewrite
+bounce    unix  -       -       y       -       0       bounce
+defer     unix  -       -       y       -       0       bounce
+trace     unix  -       -       y       -       0       bounce
+verify    unix  -       -       y       -       1       verify
+flush     unix  n       -       y       1000?   0       flush
+proxymap  unix  -       -       n       -       -       proxymap
+proxywrite unix -       -       n       -       1       proxymap
+smtp      unix  -       -       y       -       -       smtp
+relay     unix  -       -       y       -       -       smtp
+#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
+showq     unix  n       -       y       -       -       showq
+error     unix  -       -       y       -       -       error
+retry     unix  -       -       y       -       -       error
+discard   unix  -       -       y       -       -       discard
+local     unix  -       n       n       -       -       local
+virtual   unix  -       n       n       -       -       virtual
+lmtp      unix  -       -       y       -       -       lmtp
+anvil     unix  -       -       y       -       1       anvil
+scache    unix  -       -       y       -       1       scache
+#
+# ====================================================================
+# Interfaces to non-Postfix software. Be sure to examine the manual
+# pages of the non-Postfix software to find out what options it wants.
+#
+# Many of the following services use the Postfix pipe(8) delivery
+# agent.  See the pipe(8) man page for information about ${recipient}
+# and other message envelope options.
+# ====================================================================
+#
+# maildrop. See the Postfix MAILDROP_README file for details.
+# Also specify in main.cf: maildrop_destination_recipient_limit=1
+#
+maildrop  unix  -       n       n       -       -       pipe
+  flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
+#
+# ====================================================================
+#
+# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
+#
+# Specify in cyrus.conf:
+#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
+#
+# Specify in main.cf one or more of the following:
+#  mailbox_transport = lmtp:inet:localhost
+#  virtual_transport = lmtp:inet:localhost
+#
+# ====================================================================
+#
+# Cyrus 2.1.5 (Amos Gouaux)
+# Also specify in main.cf: cyrus_destination_recipient_limit=1
+#
+#cyrus     unix  -       n       n       -       -       pipe
+#  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
+#
+# ====================================================================
+# Old example of delivery via Cyrus.
+#
+#old-cyrus unix  -       n       n       -       -       pipe
+#  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
+#
+# ====================================================================
+#
+# See the Postfix UUCP_README file for configuration details.
+#
+uucp      unix  -       n       n       -       -       pipe
+  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
+#
+# Other external delivery methods.
+#
+ifmail    unix  -       n       n       -       -       pipe
+  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
+bsmtp     unix  -       n       n       -       -       pipe
+  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
+scalemail-backend unix	-	n	n	-	2	pipe
+  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
+mailman   unix  -       n       n       -       -       pipe
+  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
+  ${nexthop} ${user}
+
diff --git a/all_new_2018/linkable_etc_files/server/etc/ssh/sshd_config b/all_new_2018/linkable_etc_files/server/etc/ssh/sshd_config
index b72e311..c3d8c6a 100644
--- a/all_new_2018/linkable_etc_files/server/etc/ssh/sshd_config
+++ b/all_new_2018/linkable_etc_files/server/etc/ssh/sshd_config
@@ -11,7 +11,7 @@
 # default value.
 
 Port 22
-Port 443 # used for networks where 22 is banned
+Port 443  # plomlompom: used for networks where 22 is banned
 #AddressFamily any
 #ListenAddress 0.0.0.0
 #ListenAddress ::
@@ -30,7 +30,7 @@ Port 443 # used for networks where 22 is banned
 # Authentication:
 
 #LoginGraceTime 2m
-PermitRootLogin no
+PermitRootLogin no  # plomlompom's security rule
 #StrictModes yes
 #MaxAuthTries 6
 #MaxSessions 10
@@ -124,4 +124,4 @@ Subsystem sftp	/usr/lib/openssh/sftp-server
 #	ForceCommand cvs server
 
 ClientAliveInterval 120
-PasswordAuthentication no
+PasswordAuthentication no  # plomlompom's security rule
diff --git a/all_new_2018/setup_mail.sh b/all_new_2018/setup_mail.sh
new file mode 100755
index 0000000..29ea604
--- /dev/null
+++ b/all_new_2018/setup_mail.sh
@@ -0,0 +1,10 @@
+#/bin/sh
+set -e
+
+echo "postfix postfix/main_mailer_type string 'Internet Site'" | debconf-set-selections
+echo "postfix postfix/mailname string $(hostname -f)" | debconf-set-selections
+apt install postfix
+mkdir -p /etc/dovecot/conf.d/
+echo "ssl_cert = </etc/letsencrypt/live/$(hostname -f)/fullchain.pem" > /etc/dovecot/conf.d/99-ssl-certs.conf
+echo "ssl_key = </etc/letsencrypt/live/$(hostname -f)/privkey.pem" >> /etc/dovecot/conf.d/99-ssl-certs.conf
+apt install dovecot-imapd
-- 
2.30.2