Add mail server setup scripting.

diff --git a/buster/apt-mark/mail b/buster/apt-mark/mail
new file mode 100644 (file)
index 0000000..0956960
--- /dev/null
+++ b/buster/apt-mark/mail
@@ -0,0 +1,15 @@
+# smtp server
+postfix
+# opendkim
+opendkim
+opendkim-tools
+# for pingmail
+mailutils
+# ssl
+certbot
+# IMAPS
+pwgen
+dovecot-imapd
+# sieve filtering
+dovecot-lmtpd
+dovecot-sieve

diff --git a/buster/etc_files/mail/etc/dovecot/conf.d/99-lmtp-sieve-filtering.conf b/buster/etc_files/mail/etc/dovecot/conf.d/99-lmtp-sieve-filtering.conf
new file mode 100644 (file)
index 0000000..eaf927b
--- /dev/null
+++ b/buster/etc_files/mail/etc/dovecot/conf.d/99-lmtp-sieve-filtering.conf
@@ -0,0 +1,18 @@
+# This is only necessary when we use dovecot's LMTP mechanism to receive
+# mail from postfix.
+auth_username_format = %Ln
+
+# Add sieve filtering.
+protocol lmtp {
+  mail_plugins = $mail_plugins sieve
+}
+
+# We don't strictly need to provide a LMTP server to fetch mail from
+# postfix, but we do if we want to do sophisticated stuff like sieve
+# filtering on the way.
+service lmtp {
+  inet_listener lmtp {
+    address = 127.0.0.1
+    port = 2424
+  }
+}

diff --git a/buster/etc_files/mail/etc/dovecot/conf.d/99-smtp-sasl.conf b/buster/etc_files/mail/etc/dovecot/conf.d/99-smtp-sasl.conf
new file mode 100644 (file)
index 0000000..d076d63
--- /dev/null
+++ b/buster/etc_files/mail/etc/dovecot/conf.d/99-smtp-sasl.conf
@@ -0,0 +1,10 @@
+service auth {
+  unix_listener auth-userdb {
+  }
+
+  unix_listener /var/spool/postfix/private/auth {
+        mode = 0660
+        user = postfix
+        group = postfix
+  }
+}

diff --git a/buster/etc_files/mail/etc/nftables.conf b/buster/etc_files/mail/etc/nftables.conf
new file mode 100755 (executable)
index 0000000..747d214
--- /dev/null
+++ b/buster/etc_files/mail/etc/nftables.conf
@@ -0,0 +1,24 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet filter {
+       chain input {
+               type filter hook input priority 0; policy drop;
+               iif lo accept comment "accept localhost traffic"
+               ct state invalid drop comment "drop invalid connections"
+               ct state established, related accept comment "accept traffic originated from us"
+               tcp dport 22 accept comment "accept SSH on default port"
+               tcp dport 25 accept comment "accept SMTP (allowing for STARTTLS); necessary for mail server to mail server banter, i.e. for receiving mails"
+               tcp dport 80 accept comment "accept HTTP; necessary for Certbot HTTP challenge"
+               tcp dport 465 accept comment "accept SMTPS; for mail user agent to mail server, i.e. for sending mails"
+               tcp dport 993 accept comment "accept IMAPS; for reading/downloading mails"
+               ip protocol icmp icmp type echo-request accept comment "accept ICMP for pinging"
+       }
+       chain forward {
+               type filter hook forward priority 0; policy drop;
+       }
+       chain output {
+               type filter hook output priority 0; policy accept;
+       }
+}

diff --git a/buster/other_files/dovecot.sieve b/buster/other_files/dovecot.sieve
new file mode 100644 (file)
index 0000000..5346309
--- /dev/null
+++ b/buster/other_files/dovecot.sieve
@@ -0,0 +1,8 @@
+require ["fileinto"];
+require ["mailbox"];
+if address :is "from" "foo@bar.com" {
+  fileinto :create "foo";
+}
+if address :is :domain "to" "example.com" {
+  fileinto :create "example.com";
+}

diff --git a/buster/setup_scripts/setup_mail.sh b/buster/setup_scripts/setup_mail.sh
new file mode 100755 (executable)
index 0000000..9406bee
--- /dev/null
+++ b/buster/setup_scripts/setup_mail.sh
@@ -0,0 +1,114 @@
+#!/bin/sh
+set -e
+
+if [ "$#" -ne 1 ]; then
+    echo 'Need mail for letsencrypt.'
+    false
+fi
+mail="$1"
+
+config_tree_prefix="${HOME}/config/buster"
+echo "postfix postfix/main_mailer_type string 'Internet Site'" | debconf-set-selections
+echo "postfix postfix/mailname string $(hostname -f)" | debconf-set-selections
+./install_for_target.sh mail
+./copy_dirtree.sh "${config_tree_prefix}/etc_files" "" mail
+nft -f /etc/nftables.conf
+
+# Set up letsencrypt certificate.
+# TODO: Is it auto-renewed?
+# TODO: Find out if/why this works despite firewall?
+certbot certonly --standalone --agree-tos --no-eff-email -m "${mail}" -d "$(hostname -f)"
+
+# generate opendkim selector
+selector=$(hostname)$(date +%Y%m%d)
+#opendkim-genkey -D /etc/dkimkeys -s "${selector}"
+opendkim-genkey -d "$(hostname -f)" -D /etc/dkimkeys -s "${selector}"
+
+# customize /etc/opendkim.conf
+echo '' >> /etc/opendkim.conf
+echo '# plomlompom customizations' >> /etc/opendkim.conf
+echo "Domain $(hostname -f)" >> /etc/opendkim.conf
+echo "KeyFile /etc/dkimkeys/${selector}.private" >> /etc/opendkim.conf
+echo "Selector ${selector}" >> /etc/opendkim.conf
+echo 'Socket inet:8892@localhost' >> /etc/opendkim.conf
+
+# customize /etc/postfix/main.cf
+echo '' >> /etc/postfix/main.cf
+echo '# opendkim milter' >> /etc/postfix/main.cf
+echo 'non_smtpd_milters = inet:localhost:8892' >> /etc/postfix/main.cf
+echo '' >> /etc/postfix/main.cf
+echo '# TLS certs'
+echo 'smtpd_tls_cert_file=/etc/letsencrypt/live/${myhostname}/fullchain.pem' >> /etc/postfix/main.cf
+echo 'smtpd_tls_key_file=/etc/letsencrypt/live/${myhostname}/privkey.pem' >> /etc/postfix/main.cf
+
+# TODO: consider <https://wiki.debian.org/opendkim#Postfix_integration>
+
+# Dovecot sieve filtering via LMTP
+echo '' >> /etc/postfix/main.cf
+echo '# transport mail to dovecot; not strictly needed, as even without this' >> /etc/postfix/main.cf
+echo '# postfix will throw mail to /var/mail/USER to be found by dovecot for' >> /etc/postfix/main.cf
+echo "# serving via IMAP etc.; but using dovecot's LMTP server for delivery" >> /etc/postfix/main.cf
+echo '# allows us to do stuff like dovecot-side sieve filtering.' >> /etc/postfix/main.cf
+echo 'mailbox_transport = lmtp:inet:127.0.0.1:2424' >> /etc/postfix/main.cf
+cp "${config_tree_prefix}/other_files/dovecot.sieve" /home/plom/.dovecot.sieve
+chown plom:plom /home/plom/.dovecot.sieve
+
+# To allow IMAPS access
+echo "ssl_cert = </etc/letsencrypt/live/$(hostname -f)/fullchain.pem" > /etc/dovecot/conf.d/99-ssl-certs.conf
+echo "ssl_key = </etc/letsencrypt/live/$(hostname -f)/privkey.pem" >> /etc/dovecot/conf.d/99-ssl-certs.conf
+password=$(pwgen -s 100 1)
+#echo 'mail_privileged_group = mail' >> /etc/dovecot/conf.d/99-mail.conf
+echo "plom:${password}" | chpasswd
+
+# To use Dovecot SASL for SMTP access.
+echo '' >> /etc/postfix/main.cf
+echo '# use dovecot SASL for SMTP access' >> /etc/postfix/main.cf
+echo 'smtpd_sasl_type = dovecot' >> /etc/postfix/main.cf
+echo 'smtpd_sasl_path = private/auth' >> /etc/postfix/main.cf
+echo 'smtpd_sasl_auth_enable = yes' >> /etc/postfix/main.cf
+
+service opendkim restart
+service postfix restart
+service dovecot restart
+
+echo "To put into DNS:"
+cat "/etc/dkimkeys/${selector}.txt"
+echo "If subdomain, append .subdomain to _domainkeys!"
+echo "Also ensure DMARC record of 'v=DMARC1; p=none; rua=mailto:plom+dmarc@plomlompom.com;' as TXT entry at _dmarc or, if subdomain, _dmarc.subdomain"
+echo "Also ensure SPF record of 'v=spf1 mx -all' at @ or subdomain"
+echo "Also ensure reverse DNS lookup for our IP points to $(hostname -f)"
+echo "Also ensure MX record of priority 10 for @ or subdomain pointing to $(hostname -f)"
+echo "IMAPS password for user plom is: ${password}"
+
+# todo just for proper mail /sending/:
+# * figure out /etc/mailname ("used by the Mail Transfer Agent (i.e. mail server) to know its own hostname", "will contain the portion after the username and @ (at) sign for email addresses of users on the machine", "Postfix sets myorigin=/etc/mailname. Myorigin is appended (with an @) to any bare name in any address field. During (re)configure, if /etc/mailname exists, it is used as the default value for myorigin in debconf dialogs. Changing it from the default results in postinst rewriting /etc/mailname to the new value.") – figure out if it is actually used?
+# * figure out /etc/postfix/main.cf
+# - myorigin ("specifies the domain that appears in mail that is posted on this machine. The default is to use the local machine name, $myhostname, which defaults to the name of the machine. Unless you are running a really small site, you probably want to change that into $mydomain, which defaults to the parent domain of the machine name")
+# - myhostname ("The internet hostname of this mail system. The default is to use the fully-qualified domain name (FQDN) from gethostname(), or to use the non-FQDN result from gethostname() and append ".$mydomain". $myhostname is used as a default value for many other configuration parameters.")
+# - mydomain ("The internet domain name of this mail system. The default is to use $myhostname minus the first component, or "localdomain" (Postfix 2.3 and later). $mydomain is used as a default value for many other configuration parameters.")
+# - relay_domains ("What destination domains (and subdomains thereof) this system will relay mail to")
+# - mydestination ("The list of domains that are delivered via the $local_transport mail delivery transport.")
+# * figure out /etc/postfix/master.cf (configures what postfix daemons run in what way?)
+# * how to check IP safety
+# https://talosintelligence.com/reputation_center/lookup?search=$IP
+# http://www.anti-abuse.org/multi-rbl-check-results/?host=
+# https://www.dnsbl.info/dnsbl-database-check.php
+# note that none of these catch the IPs that gmx etc. reject
+
+# other stuff:
+# * figure out /etc/aliases (maps whom what is sent to – just re-use old core.plomlompom.com one? – also, run newaliases to generate /etc/aliases.db)
+# * more /etc/postfix/main.cf
+# - smtpd_recipient_restrictions
+# - smtpd_helo_restrictions
+# - smtpd_client_restrictions
+#
+# for using SMTP server remotely:
+# - SASL mechanism, may use dovecot for that (smtpd_sasl_type, smtpd_sasl_path)
+#   - see https://wiki2.dovecot.org/HowTo/PostfixAndDovecotSASL
+# - SASL is not a protocol but an abstraction layer to some auth mechanism
+# - SSL works on transport layer
+# - wild guess: TLS/SSL is used to authenticate /the server/ to the client, while SASL is used to identify /the client/ to the server
+#   - then it should be possible to do SASL without TLS/STARTTLS first? (experiment)
+#   - the telnet test should offer AUTH then without doing STARTTLS first
+#
+# for receiving mails: make sure firewall opens SMTP port 25, and for STARTTLS to work need certificate installed (set in postfix/main.cf) – some providers only deliver via STARTTLS, i.e. GMail – this all only delivers mails to /var/mail/…, dovecot should do more then