Improve documentation.

diff --git a/buster/etc_files/mail/etc/aliases b/buster/etc_files/mail/etc/aliases
index 59c52b45999d1645612a07dc6b3d9209238c665e..5c52e6fc574259a6b9e616b86896769fa9887661 100644 (file)
--- a/buster/etc_files/mail/etc/aliases
+++ b/buster/etc_files/mail/etc/aliases
@@ -1,4 +1,5 @@
 # /etc/aliases
 # /etc/aliases

+# maps whom what is sent to

 
 # As per RFC 2142.
 mailer-daemon: plom
 
 # As per RFC 2142.
 mailer-daemon: plom

diff --git a/buster/other_files/append_postfix_main.cf b/buster/other_files/append_postfix_main.cf
index 5ef08248e4595c5c3198dcfbb6abd1c104eef18c..3a38080274f0f649cf0c8c602b5fde32fc722298 100644 (file)
--- a/buster/other_files/append_postfix_main.cf
+++ b/buster/other_files/append_postfix_main.cf
@@ -13,7 +13,8 @@ smtpd_milters = inet:localhost:8892
 # allows us to do stuff like dovecot-side sieve filtering.
 mailbox_transport = lmtp:inet:127.0.0.1:2424
 
 # allows us to do stuff like dovecot-side sieve filtering.
 mailbox_transport = lmtp:inet:127.0.0.1:2424
 

-# use dovecot SASL for SMTP access
+# to authenticate on SMTP, we need a SASL mechanism; we talk to dovecot
+# for this, since it provides one

 smtpd_sasl_type = dovecot
 smtpd_sasl_path = private/auth
 smtpd_sasl_auth_enable = yes
 smtpd_sasl_type = dovecot
 smtpd_sasl_path = private/auth
 smtpd_sasl_auth_enable = yes

diff --git a/buster/setup_scripts/setup_mail.sh b/buster/setup_scripts/setup_mail.sh
index 81200178b3460dd3beaabcf1eb0667bb971d08be..b58492107b892b21ade837272dd5632d0d2ae8d6 100755 (executable)
--- a/buster/setup_scripts/setup_mail.sh
+++ b/buster/setup_scripts/setup_mail.sh
@@ -1,6 +1,7 @@
 #!/bin/sh
 set -e
 
 #!/bin/sh
 set -e
 

+# Check we have the necessary arguments.

 if [ "$#" -lt 1 ]; then
     echo 'Need mail for letsencrypt (and optionally old server IP).'
     false
 if [ "$#" -lt 1 ]; then
     echo 'Need mail for letsencrypt (and optionally old server IP).'
     false


@@ -14,8 +15,11 @@ echo "postfix postfix/mailname string $(hostname -f)" | debconf-set-selections
 ./install_for_target.sh mail
 ./copy_dirtree.sh "${config_tree_prefix}/etc_files" "" mail
 nft -f /etc/nftables.conf
 ./install_for_target.sh mail
 ./copy_dirtree.sh "${config_tree_prefix}/etc_files" "" mail
 nft -f /etc/nftables.conf

+
+# Rebuild aliases DB from /etc/aliases

 newaliases
 
 newaliases
 

+# Update config files without overwriting defaults.

 cat "${config_tree_prefix}/other_files/append_postfix_main.cf" >> /etc/postfix/main.cf
 cat "${config_tree_prefix}/other_files/append_postfix_master.cf" >> /etc/postfix/master.cf
 cat "${config_tree_prefix}/other_files/append_opendkim.conf" >> /etc/opendkim.conf
 cat "${config_tree_prefix}/other_files/append_postfix_main.cf" >> /etc/postfix/main.cf
 cat "${config_tree_prefix}/other_files/append_postfix_master.cf" >> /etc/postfix/master.cf
 cat "${config_tree_prefix}/other_files/append_opendkim.conf" >> /etc/opendkim.conf


@@ -29,22 +33,31 @@ certbot certonly --standalone --agree-tos --no-eff-email -m "${mail}" -d "$(host
 
 # OpenDKIM setup.
 selector=$(hostname)$(date +%Y%m%d)
 
 # OpenDKIM setup.
 selector=$(hostname)$(date +%Y%m%d)

-#opendkim-genkey -D /etc/dkimkeys -s "${selector}"

 opendkim-genkey -d "$(hostname -f)" -D /etc/dkimkeys -s "${selector}"
 sed -i "s/REPLACE_hostname_ECALPER/$(hostname -f)/g" /etc/opendkim.conf
 sed -i "s/REPLACE_selector_ECALPER/${selector}/g" /etc/opendkim.conf
 
 # Dovecot sieve filtering via LMTP.  Without this, mail only gets
 opendkim-genkey -d "$(hostname -f)" -D /etc/dkimkeys -s "${selector}"
 sed -i "s/REPLACE_hostname_ECALPER/$(hostname -f)/g" /etc/opendkim.conf
 sed -i "s/REPLACE_selector_ECALPER/${selector}/g" /etc/opendkim.conf
 
 # Dovecot sieve filtering via LMTP.  Without this, mail only gets

-# delivered to /var/mail/….
+# delivered to /var/mail/…, with it /var/mail/… remains the fallback
+# inbox, but all else is sieve-filtered to ~/mail/.

 cp "${config_tree_prefix}/other_files/dovecot.sieve" /home/plom/.dovecot.sieve
 chown plom:plom /home/plom/.dovecot.sieve
 
 cp "${config_tree_prefix}/other_files/dovecot.sieve" /home/plom/.dovecot.sieve
 chown plom:plom /home/plom/.dovecot.sieve
 

+# In addition to our postfix server receiving mails, we funnel mails from a
+# POP3 account into dovecot via fetchmail. It might make sense to adapt the
+# ~/.dovecot.sieve to move mails targeted to the fetched mail account to their
+# own mbox.

 cp "${config_tree_prefix}/other_files/fetchmailrc" /home/plom/.fetchmailrc
 chown plom:plom /home/plom/.fetchmailrc
 chmod 0700 /home/plom/.fetchmailrc
 cp "${config_tree_prefix}/other_files/fetchmailrc" /home/plom/.fetchmailrc
 chown plom:plom /home/plom/.fetchmailrc
 chmod 0700 /home/plom/.fetchmailrc

+
+# Pingmail setup.

 cp "${config_tree_prefix}/other_files/pingmailrc" /home/plom/.pingmailrc
 chown plom:plom /home/plom/.pingmailrc
 su -lc "cd && git clone https://plomlompom.com/repos/clone/pingmail" plom
 cp "${config_tree_prefix}/other_files/pingmailrc" /home/plom/.pingmailrc
 chown plom:plom /home/plom/.pingmailrc
 su -lc "cd && git clone https://plomlompom.com/repos/clone/pingmail" plom

+
+# Pingmail and fetchmail have some systemd timers waiting. To let systemd
+# know about them, do this.

 systemctl daemon-reload
 systemctl enable --now fetchmail_old_account.timer
 systemctl enable --now pingmail.timer
 systemctl daemon-reload
 systemctl enable --now fetchmail_old_account.timer
 systemctl enable --now pingmail.timer


@@ -53,7 +66,6 @@ systemctl enable --now pingmail.timer
 echo "ssl_cert = </etc/letsencrypt/live/$(hostname -f)/fullchain.pem" > /etc/dovecot/conf.d/99-ssl-certs.conf
 echo "ssl_key = </etc/letsencrypt/live/$(hostname -f)/privkey.pem" >> /etc/dovecot/conf.d/99-ssl-certs.conf
 password=$(pwgen -s 100 1)
 echo "ssl_cert = </etc/letsencrypt/live/$(hostname -f)/fullchain.pem" > /etc/dovecot/conf.d/99-ssl-certs.conf
 echo "ssl_key = </etc/letsencrypt/live/$(hostname -f)/privkey.pem" >> /etc/dovecot/conf.d/99-ssl-certs.conf
 password=$(pwgen -s 100 1)

-#echo 'mail_privileged_group = mail' >> /etc/dovecot/conf.d/99-mail.conf

 echo "plom:${password}" | chpasswd
 
 # Get old mail data, shutdown old postfix server.
 echo "plom:${password}" | chpasswd
 
 # Get old mail data, shutdown old postfix server.


@@ -76,10 +88,12 @@ if [ "${old_server}" != "" ]; then
   su -lc "scp plom@${old_server}:/var/mail/plom /var/mail/plom" plom
 fi
 
   su -lc "scp plom@${old_server}:/var/mail/plom /var/mail/plom" plom
 fi
 

+# Start everything anew to ensure new configurations.

 service opendkim restart
 service postfix restart
 service dovecot restart
 
 service opendkim restart
 service postfix restart
 service dovecot restart
 

+# Final advice to user.

 echo "To put into DNS:"
 cat "/etc/dkimkeys/${selector}.txt"
 echo "If subdomain, append .subdomain to _domainkeys!"
 echo "To put into DNS:"
 cat "/etc/dkimkeys/${selector}.txt"
 echo "If subdomain, append .subdomain to _domainkeys!"


@@ -89,33 +103,12 @@ echo "Also ensure reverse DNS lookup for our IP points to $(hostname -f)"
 echo "Also ensure MX record of priority 10 for @ or subdomain pointing to $(hostname -f)"
 echo "IMAPS password for user plom is: ${password}"
 
 echo "Also ensure MX record of priority 10 for @ or subdomain pointing to $(hostname -f)"
 echo "IMAPS password for user plom is: ${password}"
 

+# TODO:
+# - mailutils.conf from old config for pingmail?
+

 # todo just for proper mail /sending/:
 # todo just for proper mail /sending/:

-# * figure out /etc/mailname ("used by the Mail Transfer Agent (i.e. mail server) to know its own hostname", "will contain the portion after the username and @ (at) sign for email addresses of users on the machine", "Postfix sets myorigin=/etc/mailname. Myorigin is appended (with an @) to any bare name in any address field. During (re)configure, if /etc/mailname exists, it is used as the default value for myorigin in debconf dialogs. Changing it from the default results in postinst rewriting /etc/mailname to the new value.") – figure out if it is actually used?
-# * figure out /etc/postfix/main.cf
-# - myorigin ("specifies the domain that appears in mail that is posted on this machine. The default is to use the local machine name, $myhostname, which defaults to the name of the machine. Unless you are running a really small site, you probably want to change that into $mydomain, which defaults to the parent domain of the machine name")
-# - myhostname ("The internet hostname of this mail system. The default is to use the fully-qualified domain name (FQDN) from gethostname(), or to use the non-FQDN result from gethostname() and append ".$mydomain". $myhostname is used as a default value for many other configuration parameters.")
-# - mydomain ("The internet domain name of this mail system. The default is to use $myhostname minus the first component, or "localdomain" (Postfix 2.3 and later). $mydomain is used as a default value for many other configuration parameters.")
-# - relay_domains ("What destination domains (and subdomains thereof) this system will relay mail to")
-# - mydestination ("The list of domains that are delivered via the $local_transport mail delivery transport.")
-# * figure out /etc/postfix/master.cf (configures what postfix daemons run in what way?)

 # * how to check IP safety
 # https://talosintelligence.com/reputation_center/lookup?search=$IP
 # http://www.anti-abuse.org/multi-rbl-check-results/?host=
 # https://www.dnsbl.info/dnsbl-database-check.php
 # note that none of these catch the IPs that gmx etc. reject
 # * how to check IP safety
 # https://talosintelligence.com/reputation_center/lookup?search=$IP
 # http://www.anti-abuse.org/multi-rbl-check-results/?host=
 # https://www.dnsbl.info/dnsbl-database-check.php
 # note that none of these catch the IPs that gmx etc. reject

-
-# other stuff:
-# * figure out /etc/aliases (maps whom what is sent to – just re-use old core.plomlompom.com one? – also, run newaliases to generate /etc/aliases.db)
-# * more /etc/postfix/main.cf
-# - smtpd_recipient_restrictions
-# - smtpd_helo_restrictions
-# - smtpd_client_restrictions
-#
-# for using SMTP server remotely:
-# - SASL mechanism, may use dovecot for that (smtpd_sasl_type, smtpd_sasl_path)
-#   - see https://wiki2.dovecot.org/HowTo/PostfixAndDovecotSASL
-# - SASL is not a protocol but an abstraction layer to some auth mechanism
-# - SSL works on transport layer
-# - wild guess: TLS/SSL is used to authenticate /the server/ to the client, while SASL is used to identify /the client/ to the server
-#   - then it should be possible to do SASL without TLS/STARTTLS first? (experiment)
-#   - the telnet test should offer AUTH then without doing STARTTLS first