take control of your email at https://mailinabox.email/
9 | 10 | 11 | -------------------------------------------------------------------------------- /conf/zpush/autodiscover_config.php: -------------------------------------------------------------------------------- 1 | 27 | -------------------------------------------------------------------------------- /conf/zpush/backend_caldav.php: -------------------------------------------------------------------------------- 1 | 17 | -------------------------------------------------------------------------------- /conf/zpush/backend_carddav.php: -------------------------------------------------------------------------------- 1 | 32 | -------------------------------------------------------------------------------- /conf/zpush/backend_combined.php: -------------------------------------------------------------------------------- 1 | array( 13 | 'i' => array( 14 | 'name' => 'BackendIMAP', 15 | ), 16 | 'c' => array( 17 | 'name' => 'BackendCalDAV', 18 | ), 19 | 'd' => array( 20 | 'name' => 'BackendCardDAV', 21 | ), 22 | ), 23 | 'delimiter' => '/', 24 | 'folderbackend' => array( 25 | SYNC_FOLDER_TYPE_INBOX => 'i', 26 | SYNC_FOLDER_TYPE_DRAFTS => 'i', 27 | SYNC_FOLDER_TYPE_WASTEBASKET => 'i', 28 | SYNC_FOLDER_TYPE_SENTMAIL => 'i', 29 | SYNC_FOLDER_TYPE_OUTBOX => 'i', 30 | SYNC_FOLDER_TYPE_TASK => 'c', 31 | SYNC_FOLDER_TYPE_APPOINTMENT => 'c', 32 | SYNC_FOLDER_TYPE_CONTACT => 'd', 33 | SYNC_FOLDER_TYPE_NOTE => 'c', 34 | SYNC_FOLDER_TYPE_JOURNAL => 'c', 35 | SYNC_FOLDER_TYPE_OTHER => 'i', 36 | SYNC_FOLDER_TYPE_USER_MAIL => 'i', 37 | SYNC_FOLDER_TYPE_USER_APPOINTMENT => 'c', 38 | SYNC_FOLDER_TYPE_USER_CONTACT => 'd', 39 | SYNC_FOLDER_TYPE_USER_TASK => 'c', 40 | SYNC_FOLDER_TYPE_USER_JOURNAL => 'c', 41 | SYNC_FOLDER_TYPE_USER_NOTE => 'c', 42 | SYNC_FOLDER_TYPE_UNKNOWN => 'i', 43 | ), 44 | 'rootcreatefolderbackend' => 'i', 45 | ); 46 | } 47 | } 48 | 49 | ?> 50 | -------------------------------------------------------------------------------- /conf/zpush/backend_imap.php: -------------------------------------------------------------------------------- 1 | true))); 33 | define('IMAP_FROM_SQL_QUERY', "SELECT name, email FROM identities i INNER JOIN users u ON i.user_id = u.user_id WHERE u.username = '#username' AND i.standard = 1 AND i.del = 0 AND i.name <> ''"); 34 | define('IMAP_FROM_SQL_FIELDS', serialize(array('name', 'email'))); 35 | define('IMAP_FROM_SQL_FROM', '#name <#email>'); 36 | define('IMAP_FROM_SQL_FULLNAME', '#name'); 37 | 38 | // not used 39 | define('IMAP_FROM_LDAP_SERVER', ''); 40 | define('IMAP_FROM_LDAP_SERVER_PORT', '389'); 41 | define('IMAP_FROM_LDAP_USER', 'cn=zpush,ou=servers,dc=zpush,dc=org'); 42 | define('IMAP_FROM_LDAP_PASSWORD', 'password'); 43 | define('IMAP_FROM_LDAP_BASE', 'dc=zpush,dc=org'); 44 | define('IMAP_FROM_LDAP_QUERY', '(mail=#username@#domain)'); 45 | define('IMAP_FROM_LDAP_FIELDS', serialize(array('givenname', 'sn', 'mail'))); 46 | define('IMAP_FROM_LDAP_FROM', '#givenname #sn <#mail>'); 47 | define('IMAP_FROM_LDAP_FULLNAME', '#givenname #sn'); 48 | 49 | define('IMAP_SMTP_METHOD', 'sendmail'); 50 | 51 | global $imap_smtp_params; 52 | $imap_smtp_params = array('host' => 'ssl://127.0.0.1', 'port' => 465, 'auth' => true, 'username' => 'imap_username', 'password' => 'imap_password'); 53 | 54 | define('MAIL_MIMEPART_CRLF', "\r\n"); 55 | define('IMAP_MEETING_USE_CALDAV', true); 56 | 57 | ?> 58 | -------------------------------------------------------------------------------- /management/auth.py: -------------------------------------------------------------------------------- 1 | import base64, hmac, json, secrets 2 | from datetime import timedelta 3 | 4 | from expiringdict import ExpiringDict 5 | 6 | import utils 7 | from mailconfig import get_mail_password, get_mail_user_privileges 8 | from mfa import get_hash_mfa_state, validate_auth_mfa 9 | 10 | DEFAULT_KEY_PATH = '/var/lib/mailinabox/api.key' 11 | DEFAULT_AUTH_REALM = 'Mail-in-a-Box Management Server' 12 | 13 | class AuthService: 14 | def __init__(self): 15 | self.auth_realm = DEFAULT_AUTH_REALM 16 | self.key_path = DEFAULT_KEY_PATH 17 | self.max_session_duration = timedelta(days=2) 18 | 19 | self.init_system_api_key() 20 | self.sessions = ExpiringDict(max_len=64, max_age_seconds=self.max_session_duration.total_seconds()) 21 | 22 | def init_system_api_key(self): 23 | """Write an API key to a local file so local processes can use the API""" 24 | 25 | with open(self.key_path, encoding='utf-8') as file: 26 | self.key = file.read() 27 | 28 | def authenticate(self, request, env, login_only=False, logout=False): 29 | """Test if the HTTP Authorization header's username matches the system key, a session key, 30 | or if the username/password passed in the header matches a local user. 31 | Returns a tuple of the user's email address and list of user privileges (e.g. 32 | ('my@email', []) or ('my@email', ['admin']); raises a ValueError on login failure. 33 | If the user used the system API key, the user's email is returned as None since 34 | this key is not associated with a user.""" 35 | 36 | def parse_http_authorization_basic(header): 37 | def decode(s): 38 | return base64.b64decode(s.encode('ascii')).decode('ascii') 39 | if " " not in header: 40 | return None, None 41 | scheme, credentials = header.split(maxsplit=1) 42 | if scheme != 'Basic': 43 | return None, None 44 | credentials = decode(credentials) 45 | if ":" not in credentials: 46 | return None, None 47 | username, password = credentials.split(':', maxsplit=1) 48 | return username, password 49 | 50 | username, password = parse_http_authorization_basic(request.headers.get('Authorization', '')) 51 | if username in {None, ""}: 52 | msg = "Authorization header invalid." 53 | raise ValueError(msg) 54 | 55 | if username.strip() == "" and password.strip() == "": 56 | msg = "No email address, password, session key, or API key provided." 57 | raise ValueError(msg) 58 | 59 | # If user passed the system API key, grant administrative privs. This key 60 | # is not associated with a user. 61 | if username == self.key and not login_only: 62 | return (None, ["admin"]) 63 | 64 | # If the password corresponds with a session token for the user, grant access for that user. 65 | if self.get_session(username, password, "login", env) and not login_only: 66 | sessionid = password 67 | session = self.sessions[sessionid] 68 | if logout: 69 | # Clear the session. 70 | del self.sessions[sessionid] 71 | else: 72 | # Re-up the session so that it does not expire. 73 | self.sessions[sessionid] = session 74 | 75 | # If no password was given, but a username was given, we're missing some information. 76 | elif password.strip() == "": 77 | msg = "Enter a password." 78 | raise ValueError(msg) 79 | 80 | else: 81 | # The user is trying to log in with a username and a password 82 | # (and possibly a MFA token). On failure, an exception is raised. 83 | self.check_user_auth(username, password, request, env) 84 | 85 | # Get privileges for authorization. This call should never fail because by this 86 | # point we know the email address is a valid user --- unless the user has been 87 | # deleted after the session was granted. On error the call will return a tuple 88 | # of an error message and an HTTP status code. 89 | privs = get_mail_user_privileges(username, env) 90 | if isinstance(privs, tuple): raise ValueError(privs[0]) 91 | 92 | # Return the authorization information. 93 | return (username, privs) 94 | 95 | def check_user_auth(self, email, pw, request, env): 96 | # Validate a user's login email address and password. If MFA is enabled, 97 | # check the MFA token in the X-Auth-Token header. 98 | # 99 | # On login failure, raises a ValueError with a login error message. On 100 | # success, nothing is returned. 101 | 102 | # Authenticate. 103 | try: 104 | # Get the hashed password of the user. Raise a ValueError if the 105 | # email address does not correspond to a user. But wrap it in the 106 | # same exception as if a password fails so we don't easily reveal 107 | # if an email address is valid. 108 | pw_hash = get_mail_password(email, env) 109 | 110 | # Use 'doveadm pw' to check credentials. doveadm will return 111 | # a non-zero exit status if the credentials are no good, 112 | # and check_call will raise an exception in that case. 113 | utils.shell('check_call', [ 114 | "/usr/bin/doveadm", "pw", 115 | "-p", pw, 116 | "-t", pw_hash, 117 | ]) 118 | except: 119 | # Login failed. 120 | msg = "Incorrect email address or password." 121 | raise ValueError(msg) 122 | 123 | # If MFA is enabled, check that MFA passes. 124 | status, hints = validate_auth_mfa(email, request, env) 125 | if not status: 126 | # Login valid. Hints may have more info. 127 | raise ValueError(",".join(hints)) 128 | 129 | def create_user_password_state_token(self, email, env): 130 | # Create a token that changes if the user's password or MFA options change 131 | # so that sessions become invalid if any of that information changes. 132 | msg = get_mail_password(email, env).encode("utf8") 133 | 134 | # Add to the message the current MFA state, which is a list of MFA information. 135 | # Turn it into a string stably. 136 | msg += b" " + json.dumps(get_hash_mfa_state(email, env), sort_keys=True).encode("utf8") 137 | 138 | # Make a HMAC using the system API key as a hash key. 139 | hash_key = self.key.encode('ascii') 140 | return hmac.new(hash_key, msg, digestmod="sha256").hexdigest() 141 | 142 | def create_session_key(self, username, env, type=None): 143 | # Create a new session. 144 | token = secrets.token_hex(32) 145 | self.sessions[token] = { 146 | "email": username, 147 | "password_token": self.create_user_password_state_token(username, env), 148 | "type": type, 149 | } 150 | return token 151 | 152 | def get_session(self, user_email, session_key, session_type, env): 153 | if session_key not in self.sessions: return None 154 | session = self.sessions[session_key] 155 | if session_type == "login" and session["email"] != user_email: return None 156 | if session["type"] != session_type: return None 157 | if session["password_token"] != self.create_user_password_state_token(session["email"], env): return None 158 | return session 159 | -------------------------------------------------------------------------------- /management/cli.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # 3 | # This is a command-line script for calling management APIs 4 | # on the Mail-in-a-Box control panel backend. The script 5 | # reads /var/lib/mailinabox/api.key for the backend's 6 | # root API key. This file is readable only by root, so this 7 | # tool can only be used as root. 8 | 9 | import sys, getpass, urllib.request, urllib.error, json, csv 10 | import contextlib 11 | 12 | def mgmt(cmd, data=None, is_json=False): 13 | # The base URL for the management daemon. (Listens on IPv4 only.) 14 | mgmt_uri = 'http://127.0.0.1:10222' 15 | 16 | setup_key_auth(mgmt_uri) 17 | 18 | req = urllib.request.Request(mgmt_uri + cmd, urllib.parse.urlencode(data).encode("utf8") if data else None) 19 | try: 20 | response = urllib.request.urlopen(req) 21 | except urllib.error.HTTPError as e: 22 | if e.code == 401: 23 | with contextlib.suppress(Exception): 24 | print(e.read().decode("utf8")) 25 | print("The management daemon refused access. The API key file may be out of sync. Try 'service mailinabox restart'.", file=sys.stderr) 26 | elif hasattr(e, 'read'): 27 | print(e.read().decode('utf8'), file=sys.stderr) 28 | else: 29 | print(e, file=sys.stderr) 30 | sys.exit(1) 31 | resp = response.read().decode('utf8') 32 | if is_json: resp = json.loads(resp) 33 | return resp 34 | 35 | def read_password(): 36 | while True: 37 | first = getpass.getpass('password: ') 38 | if len(first) < 8: 39 | print("Passwords must be at least eight characters.") 40 | continue 41 | second = getpass.getpass(' (again): ') 42 | if first != second: 43 | print("Passwords not the same. Try again.") 44 | continue 45 | break 46 | return first 47 | 48 | def setup_key_auth(mgmt_uri): 49 | with open('/var/lib/mailinabox/api.key', encoding='utf-8') as f: 50 | key = f.read().strip() 51 | 52 | auth_handler = urllib.request.HTTPBasicAuthHandler() 53 | auth_handler.add_password( 54 | realm='Mail-in-a-Box Management Server', 55 | uri=mgmt_uri, 56 | user=key, 57 | passwd='') 58 | opener = urllib.request.build_opener(auth_handler) 59 | urllib.request.install_opener(opener) 60 | 61 | if len(sys.argv) < 2: 62 | print("""Usage: 63 | {cli} user (lists users) 64 | {cli} user add user@domain.com [password] 65 | {cli} user password user@domain.com [password] 66 | {cli} user remove user@domain.com 67 | {cli} user make-admin user@domain.com 68 | {cli} user quota user@domain [new-quota] (get or set user quota) 69 | {cli} user remove-admin user@domain.com 70 | {cli} user admins (lists admins) 71 | {cli} user mfa show user@domain.com (shows MFA devices for user, if any) 72 | {cli} user mfa disable user@domain.com [id] (disables MFA for user) 73 | {cli} alias (lists aliases) 74 | {cli} alias add incoming.name@domain.com sent.to@other.domain.com 75 | {cli} alias add incoming.name@domain.com 'sent.to@other.domain.com, multiple.people@other.domain.com' 76 | {cli} alias remove incoming.name@domain.com 77 | 78 | Removing a mail user does not delete their mail folders on disk. It only prevents IMAP/SMTP login. 79 | """.format( 80 | cli="management/cli.py" 81 | )) 82 | 83 | elif sys.argv[1] == "user" and len(sys.argv) == 2: 84 | # Dump a list of users, one per line. Mark admins with an asterisk. 85 | users = mgmt("/mail/users?format=json", is_json=True) 86 | for domain in users: 87 | for user in domain["users"]: 88 | if user['status'] == 'inactive': continue 89 | print(user['email'], end='') 90 | if "admin" in user['privileges']: 91 | print("*", end='') 92 | print() 93 | 94 | elif sys.argv[1] == "user" and sys.argv[2] in {"add", "password"}: 95 | if len(sys.argv) < 5: 96 | email = input('email: ') if len(sys.argv) < 4 else sys.argv[3] 97 | pw = read_password() 98 | else: 99 | email, pw = sys.argv[3:5] 100 | 101 | if sys.argv[2] == "add": 102 | print(mgmt("/mail/users/add", { "email": email, "password": pw })) 103 | elif sys.argv[2] == "password": 104 | print(mgmt("/mail/users/password", { "email": email, "password": pw })) 105 | 106 | elif sys.argv[1] == "user" and sys.argv[2] == "remove" and len(sys.argv) == 4: 107 | print(mgmt("/mail/users/remove", { "email": sys.argv[3] })) 108 | 109 | elif sys.argv[1] == "user" and sys.argv[2] in {"make-admin", "remove-admin"} and len(sys.argv) == 4: 110 | action = 'add' if sys.argv[2] == 'make-admin' else 'remove' 111 | print(mgmt("/mail/users/privileges/" + action, { "email": sys.argv[3], "privilege": "admin" })) 112 | 113 | elif sys.argv[1] == "user" and sys.argv[2] == "admins": 114 | # Dump a list of admin users. 115 | users = mgmt("/mail/users?format=json", is_json=True) 116 | for domain in users: 117 | for user in domain["users"]: 118 | if "admin" in user['privileges']: 119 | print(user['email']) 120 | 121 | elif sys.argv[1] == "user" and sys.argv[2] == "quota" and len(sys.argv) == 4: 122 | # Get a user's quota 123 | print(mgmt("/mail/users/quota?text=1&email=%s" % sys.argv[3])) 124 | 125 | elif sys.argv[1] == "user" and sys.argv[2] == "quota" and len(sys.argv) == 5: 126 | # Set a user's quota 127 | users = mgmt("/mail/users/quota", { "email": sys.argv[3], "quota": sys.argv[4] }) 128 | 129 | elif sys.argv[1] == "user" and len(sys.argv) == 5 and sys.argv[2:4] == ["mfa", "show"]: 130 | # Show MFA status for a user. 131 | status = mgmt("/mfa/status", { "user": sys.argv[4] }, is_json=True) 132 | W = csv.writer(sys.stdout) 133 | W.writerow(["id", "type", "label"]) 134 | for mfa in status["enabled_mfa"]: 135 | W.writerow([mfa["id"], mfa["type"], mfa["label"]]) 136 | 137 | elif sys.argv[1] == "user" and len(sys.argv) in {5, 6} and sys.argv[2:4] == ["mfa", "disable"]: 138 | # Disable MFA (all or a particular device) for a user. 139 | print(mgmt("/mfa/disable", { "user": sys.argv[4], "mfa-id": sys.argv[5] if len(sys.argv) == 6 else None })) 140 | 141 | elif sys.argv[1] == "alias" and len(sys.argv) == 2: 142 | print(mgmt("/mail/aliases")) 143 | 144 | elif sys.argv[1] == "alias" and sys.argv[2] == "add" and len(sys.argv) == 5: 145 | print(mgmt("/mail/aliases/add", { "address": sys.argv[3], "forwards_to": sys.argv[4] })) 146 | 147 | elif sys.argv[1] == "alias" and sys.argv[2] == "remove" and len(sys.argv) == 4: 148 | print(mgmt("/mail/aliases/remove", { "address": sys.argv[3] })) 149 | 150 | else: 151 | print("Invalid command-line arguments.") 152 | sys.exit(1) 153 | -------------------------------------------------------------------------------- /management/csr_country_codes.tsv: -------------------------------------------------------------------------------- 1 | # This list is derived from https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2. 2 | # The columns are ISO_3166-1_alpha-2 code, display name, Wikipedia page name. 3 | # The top 21 countries by number of Internet users are grouped first, see 4 | # https://en.wikipedia.org/wiki/List_of_countries_by_number_of_Internet_users. 5 | CN China 6 | IN India 7 | US United States 8 | JP Japan 9 | BR Brazil 10 | RU Russian Federation Russia 11 | DE Germany 12 | NG Nigeria 13 | GB United Kingdom 14 | FR France 15 | MX Mexico 16 | EG Egypt 17 | KR South Korea 18 | VN Vietnam 19 | ID Indonesia 20 | PH Philippines 21 | TR Turkey 22 | IT Italy 23 | PK Pakistan 24 | ES Spain 25 | CA Canada 26 | AD Andorra 27 | AE United Arab Emirates 28 | AF Afghanistan 29 | AG Antigua and Barbuda 30 | AI Anguilla 31 | AL Albania 32 | AM Armenia 33 | AO Angola 34 | AQ Antarctica 35 | AR Argentina 36 | AS American Samoa 37 | AT Austria 38 | AU Australia 39 | AW Aruba 40 | AX Åland Islands 41 | AZ Azerbaijan 42 | BA Bosnia and Herzegovina 43 | BB Barbados 44 | BD Bangladesh 45 | BE Belgium 46 | BF Burkina Faso 47 | BG Bulgaria 48 | BH Bahrain 49 | BI Burundi 50 | BJ Benin 51 | BL Saint Barthélemy 52 | BM Bermuda 53 | BN Brunei 54 | BO Bolivia 55 | BQ Bonaire, Sint Eustatius and Saba Caribbean Netherlands 56 | BS Bahamas The Bahamas 57 | BT Bhutan 58 | BV Bouvet Island 59 | BW Botswana 60 | BY Belarus 61 | BZ Belize 62 | CC Cocos (Keeling) Islands 63 | CD Congo, the Democratic Republic of the Democratic Republic of the Congo 64 | CF Central African Republic 65 | CG Congo Republic of the Congo 66 | CH Switzerland 67 | CI Côte d'Ivoire 68 | CK Cook Islands 69 | CL Chile 70 | CM Cameroon 71 | CO Colombia 72 | CR Costa Rica 73 | CU Cuba 74 | CV Cabo Verde 75 | CW Curaçao 76 | CX Christmas Island 77 | CY Cyprus 78 | CZ Czech Republic 79 | DJ Djibouti 80 | DK Denmark 81 | DM Dominica 82 | DO Dominican Republic 83 | DZ Algeria 84 | EC Ecuador 85 | EE Estonia 86 | EH Western Sahara 87 | ER Eritrea 88 | ET Ethiopia 89 | FI Finland 90 | FJ Fiji 91 | FK Falkland Islands (Malvinas) Falkland Islands 92 | FM Federated States of Micronesia 93 | FO Faroe Islands 94 | GA Gabon 95 | GD Grenada 96 | GE Georgia Georgia (country) 97 | GF French Guiana 98 | GG Guernsey 99 | GH Ghana 100 | GI Gibraltar 101 | GL Greenland 102 | GM Gambia The Gambia 103 | GN Guinea 104 | GP Guadeloupe 105 | GQ Equatorial Guinea 106 | GR Greece 107 | GS South Georgia and the South Sandwich Islands 108 | GT Guatemala 109 | GU Guam 110 | GW Guinea-Bissau 111 | GY Guyana 112 | HK Hong Kong 113 | HM Heard Island and McDonald Islands 114 | HN Honduras 115 | HR Croatia 116 | HT Haiti 117 | HU Hungary 118 | IE Ireland Republic of Ireland 119 | IL Israel 120 | IM Isle of Man 121 | IO British Indian Ocean Territory 122 | IQ Iraq 123 | IR Iran 124 | IS Iceland 125 | JE Jersey 126 | JM Jamaica 127 | JO Jordan 128 | KE Kenya 129 | KG Kyrgyzstan 130 | KH Cambodia 131 | KI Kiribati 132 | KM Comoros 133 | KN Saint Kitts and Nevis 134 | KP North Korea 135 | KW Kuwait 136 | KY Cayman Islands 137 | KZ Kazakhstan 138 | LA Laos 139 | LB Lebanon 140 | LC Saint Lucia 141 | LI Liechtenstein 142 | LK Sri Lanka 143 | LR Liberia 144 | LS Lesotho 145 | LT Lithuania 146 | LU Luxembourg 147 | LV Latvia 148 | LY Libya 149 | MA Morocco 150 | MC Monaco 151 | MD Moldova 152 | ME Montenegro 153 | MF Saint Martin (French part) Collectivity of Saint Martin 154 | MG Madagascar 155 | MH Marshall Islands 156 | MK Macedonia Republic of Macedonia 157 | ML Mali 158 | MM Myanmar 159 | MN Mongolia 160 | MO Macao Macau 161 | MP Northern Mariana Islands 162 | MQ Martinique 163 | MR Mauritania 164 | MS Montserrat 165 | MT Malta 166 | MU Mauritius 167 | MV Maldives 168 | MW Malawi 169 | MY Malaysia 170 | MZ Mozambique 171 | NA Namibia 172 | NC New Caledonia 173 | NE Niger 174 | NF Norfolk Island 175 | NI Nicaragua 176 | NL Netherlands 177 | NO Norway 178 | NP Nepal 179 | NR Nauru 180 | NU Niue 181 | NZ New Zealand 182 | OM Oman 183 | PA Panama 184 | PE Peru 185 | PF French Polynesia 186 | PG Papua New Guinea 187 | PL Poland 188 | PM Saint Pierre and Miquelon 189 | PN Pitcairn Pitcairn Islands 190 | PR Puerto Rico 191 | PS Palestine State of Palestine 192 | PT Portugal 193 | PW Palau 194 | PY Paraguay 195 | QA Qatar 196 | RE Réunion 197 | RO Romania 198 | RS Serbia 199 | RW Rwanda 200 | SA Saudi Arabia 201 | SB Solomon Islands 202 | SC Seychelles 203 | SD Sudan 204 | SE Sweden 205 | SG Singapore 206 | SH Saint Helena, Ascension and Tristan da Cunha 207 | SI Slovenia 208 | SJ Svalbard and Jan Mayen 209 | SK Slovakia 210 | SL Sierra Leone 211 | SM San Marino 212 | SN Senegal 213 | SO Somalia 214 | SR Suriname 215 | SS South Sudan 216 | ST Sao Tome and Principe 217 | SV El Salvador 218 | SX Sint Maarten (Dutch part) Sint Maarten 219 | SY Syria 220 | SZ Swaziland 221 | TC Turks and Caicos Islands 222 | TD Chad 223 | TF French Southern Territories French Southern and Antarctic Lands 224 | TG Togo 225 | TH Thailand 226 | TJ Tajikistan 227 | TK Tokelau 228 | TL Timor-Leste East Timor 229 | TM Turkmenistan 230 | TN Tunisia 231 | TO Tonga 232 | TT Trinidad and Tobago 233 | TV Tuvalu 234 | TW Taiwan 235 | TZ Tanzania 236 | UA Ukraine 237 | UG Uganda 238 | UM United States Minor Outlying Islands 239 | UY Uruguay 240 | UZ Uzbekistan 241 | VA Vatican City 242 | VC Saint Vincent and the Grenadines 243 | VE Venezuela 244 | VG Virgin Islands, British British Virgin Islands 245 | VI Virgin Islands, U.S. United States Virgin Islands 246 | VU Vanuatu 247 | WF Wallis and Futuna 248 | WS Samoa 249 | YE Yemen 250 | YT Mayotte 251 | ZA South Africa 252 | ZM Zambia 253 | ZW Zimbabwe 254 | -------------------------------------------------------------------------------- /management/daily_tasks.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # This script is run daily (at 3am each night). 3 | 4 | # Set character encoding flags to ensure that any non-ASCII 5 | # characters don't cause problems. See setup/start.sh and 6 | # the management daemon startup script. 7 | export LANGUAGE=en_US.UTF-8 8 | export LC_ALL=en_US.UTF-8 9 | export LANG=en_US.UTF-8 10 | export LC_TYPE=en_US.UTF-8 11 | 12 | # On Mondays, i.e. once a week, send the administrator a report of total emails 13 | # sent and received so the admin might notice server abuse. 14 | if [ "$(date "+%u")" -eq 1 ]; then 15 | management/mail_log.py -t week | management/email_administrator.py "Mail-in-a-Box Usage Report" 16 | fi 17 | 18 | # Take a backup. 19 | management/backup.py 2>&1 | management/email_administrator.py "Backup Status" 20 | 21 | # Provision any new certificates for new domains or domains with expiring certificates. 22 | management/ssl_certificates.py -q 2>&1 | management/email_administrator.py "TLS Certificate Provisioning Result" 23 | 24 | # Run status checks and email the administrator if anything changed. 25 | management/status_checks.py --show-changes 2>&1 | management/email_administrator.py "Status Checks Change Notice" 26 | -------------------------------------------------------------------------------- /management/email_administrator.py: -------------------------------------------------------------------------------- 1 | #!/usr/local/lib/mailinabox/env/bin/python 2 | 3 | # Reads in STDIN. If the stream is not empty, mail it to the system administrator. 4 | 5 | import sys 6 | 7 | import html 8 | import smtplib 9 | 10 | from email.mime.multipart import MIMEMultipart 11 | from email.mime.text import MIMEText 12 | 13 | # In Python 3.6: 14 | #from email.message import Message 15 | 16 | from utils import load_environment 17 | 18 | # Load system environment info. 19 | env = load_environment() 20 | 21 | # Process command line args. 22 | subject = sys.argv[1] 23 | 24 | # Administrator's email address. 25 | admin_addr = "administrator@" + env['PRIMARY_HOSTNAME'] 26 | 27 | # Read in STDIN. 28 | content = sys.stdin.read().strip() 29 | 30 | # If there's nothing coming in, just exit. 31 | if content == "": 32 | sys.exit(0) 33 | 34 | # create MIME message 35 | msg = MIMEMultipart('alternative') 36 | 37 | # In Python 3.6: 38 | #msg = Message() 39 | 40 | msg['From'] = '"{}" <{}>'.format(env['PRIMARY_HOSTNAME'], admin_addr) 41 | msg['To'] = admin_addr 42 | msg['Subject'] = "[{}] {}".format(env['PRIMARY_HOSTNAME'], subject) 43 | 44 | content_html = f'{html.escape(content)}'
45 |
46 | msg.attach(MIMEText(content, 'plain'))
47 | msg.attach(MIMEText(content_html, 'html'))
48 |
49 | # In Python 3.6:
50 | #msg.set_content(content)
51 | #msg.add_alternative(content_html, "html")
52 |
53 | # send
54 | smtpclient = smtplib.SMTP('127.0.0.1', 25)
55 | smtpclient.ehlo()
56 | smtpclient.sendmail(
57 | admin_addr, # MAIL FROM
58 | admin_addr, # RCPT TO
59 | msg.as_string())
60 | smtpclient.quit()
61 |
--------------------------------------------------------------------------------
/management/mfa.py:
--------------------------------------------------------------------------------
1 | import base64
2 | import hmac
3 | import io
4 | import os
5 | import pyotp
6 | import qrcode
7 |
8 | from mailconfig import open_database
9 |
10 | def get_user_id(email, c):
11 | c.execute('SELECT id FROM users WHERE email=?', (email,))
12 | r = c.fetchone()
13 | if not r: raise ValueError("User does not exist.")
14 | return r[0]
15 |
16 | def get_mfa_state(email, env):
17 | c = open_database(env)
18 | c.execute('SELECT id, type, secret, mru_token, label FROM mfa WHERE user_id=?', (get_user_id(email, c),))
19 | return [
20 | { "id": r[0], "type": r[1], "secret": r[2], "mru_token": r[3], "label": r[4] }
21 | for r in c.fetchall()
22 | ]
23 |
24 | def get_public_mfa_state(email, env):
25 | mfa_state = get_mfa_state(email, env)
26 | return [
27 | { "id": s["id"], "type": s["type"], "label": s["label"] }
28 | for s in mfa_state
29 | ]
30 |
31 | def get_hash_mfa_state(email, env):
32 | mfa_state = get_mfa_state(email, env)
33 | return [
34 | { "id": s["id"], "type": s["type"], "secret": s["secret"] }
35 | for s in mfa_state
36 | ]
37 |
38 | def enable_mfa(email, type, secret, token, label, env):
39 | if type == "totp":
40 | validate_totp_secret(secret)
41 | # Sanity check with the provide current token.
42 | totp = pyotp.TOTP(secret)
43 | if not totp.verify(token, valid_window=1):
44 | msg = "Invalid token."
45 | raise ValueError(msg)
46 | else:
47 | msg = "Invalid MFA type."
48 | raise ValueError(msg)
49 |
50 | conn, c = open_database(env, with_connection=True)
51 | c.execute('INSERT INTO mfa (user_id, type, secret, label) VALUES (?, ?, ?, ?)', (get_user_id(email, c), type, secret, label))
52 | conn.commit()
53 |
54 | def set_mru_token(email, mfa_id, token, env):
55 | conn, c = open_database(env, with_connection=True)
56 | c.execute('UPDATE mfa SET mru_token=? WHERE user_id=? AND id=?', (token, get_user_id(email, c), mfa_id))
57 | conn.commit()
58 |
59 | def disable_mfa(email, mfa_id, env):
60 | conn, c = open_database(env, with_connection=True)
61 | if mfa_id is None:
62 | # Disable all MFA for a user.
63 | c.execute('DELETE FROM mfa WHERE user_id=?', (get_user_id(email, c),))
64 | else:
65 | # Disable a particular MFA mode for a user.
66 | c.execute('DELETE FROM mfa WHERE user_id=? AND id=?', (get_user_id(email, c), mfa_id))
67 | conn.commit()
68 | return c.rowcount > 0
69 |
70 | def validate_totp_secret(secret):
71 | if not isinstance(secret, str) or secret.strip() == "":
72 | msg = "No secret provided."
73 | raise ValueError(msg)
74 | if len(secret) != 32:
75 | msg = "Secret should be a 32 characters base32 string"
76 | raise ValueError(msg)
77 |
78 | def provision_totp(email, env):
79 | # Make a new secret.
80 | secret = base64.b32encode(os.urandom(20)).decode('utf-8')
81 | validate_totp_secret(secret) # sanity check
82 |
83 | # Make a URI that we encode within a QR code.
84 | uri = pyotp.TOTP(secret).provisioning_uri(
85 | name=email,
86 | issuer_name=env["PRIMARY_HOSTNAME"] + " Mail-in-a-Box Control Panel"
87 | )
88 |
89 | # Generate a QR code as a base64-encode PNG image.
90 | qr = qrcode.make(uri)
91 | byte_arr = io.BytesIO()
92 | qr.save(byte_arr, format='PNG')
93 | png_b64 = base64.b64encode(byte_arr.getvalue()).decode('utf-8')
94 |
95 | return {
96 | "type": "totp",
97 | "secret": secret,
98 | "qr_code_base64": png_b64
99 | }
100 |
101 | def validate_auth_mfa(email, request, env):
102 | # Validates that a login request satisfies any MFA modes
103 | # that have been enabled for the user's account. Returns
104 | # a tuple (status, [hints]). status is True for a successful
105 | # MFA login, False for a missing token. If status is False,
106 | # hints is an array of codes that indicate what the user
107 | # can try. Possible codes are:
108 | # "missing-totp-token"
109 | # "invalid-totp-token"
110 |
111 | mfa_state = get_mfa_state(email, env)
112 |
113 | # If no MFA modes are added, return True.
114 | if len(mfa_state) == 0:
115 | return (True, [])
116 |
117 | # Try the enabled MFA modes.
118 | hints = set()
119 | for mfa_mode in mfa_state:
120 | if mfa_mode["type"] == "totp":
121 | # Check that a token is present in the X-Auth-Token header.
122 | # If not, give a hint that one can be supplied.
123 | token = request.headers.get('x-auth-token')
124 | if not token:
125 | hints.add("missing-totp-token")
126 | continue
127 |
128 | # Check for a replay attack.
129 | if hmac.compare_digest(token, mfa_mode['mru_token'] or ""):
130 | # If the token fails, skip this MFA mode.
131 | hints.add("invalid-totp-token")
132 | continue
133 |
134 | # Check the token.
135 | totp = pyotp.TOTP(mfa_mode["secret"])
136 | if not totp.verify(token, valid_window=1):
137 | hints.add("invalid-totp-token")
138 | continue
139 |
140 | # On success, record the token to prevent a replay attack.
141 | set_mru_token(email, mfa_mode['id'], token, env)
142 | return (True, [])
143 |
144 | # On a failed login, indicate failure and any hints for what the user can do instead.
145 | return (False, list(hints))
146 |
--------------------------------------------------------------------------------
/management/munin_start.sh:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 | mkdir -p /var/run/munin && chown munin /var/run/munin
3 |
--------------------------------------------------------------------------------
/management/templates/external-dns.html:
--------------------------------------------------------------------------------
1 |
28 |
29 | This is an advanced configuration page.
32 | 33 |Although your box is configured to serve its own DNS, it is possible to host your DNS elsewhere — such as in the DNS control panel provided by your domain name registrar or virtual cloud provider — by copying the DNS zone information shown in the table below into your external DNS server’s control panel.
34 | 35 |If you do so, you are responsible for keeping your DNS entries up to date! If you previously enabled DNSSEC on your domain name by setting a DS record at your registrar, you will likely have to turn it off before changing nameservers.
36 | 37 | 38 |
39 |
40 | You may encounter zone file errors when attempting to create a TXT record with a long string.
41 | RFC 4408 states a TXT record is allowed to contain multiple strings, and this technique can be used to construct records that would exceed the 255-byte maximum length.
42 | You may need to adopt this technique when adding DomainKeys. Use a tool like named-checkzone to validate your zone file.
43 |
You can download your zonefiles here or use the table of records below.
47 | 56 | 57 || QName | 63 |Type | 64 |Value | 65 |
|---|
There are no users on this system! To make an administrative user, 33 | log into this machine using SSH (like when you first set it up) and run:
34 |cd mailinabox
35 | sudo management/cli.py user add me@{{hostname}}
36 | sudo management/cli.py user make-admin me@{{hostname}}
37 | {% else %}
38 | There are no administrative users on this system! To make an administrative user, 39 | log into this machine using SSH (like when you first set it up) and run:
40 |cd mailinabox
41 | sudo management/cli.py user make-admin me@{{hostname}}
42 | {% endif %}
43 | Log in here for your Mail-in-a-Box control panel.
49 | 50 |Webmail lets you check your email from any web browser. Your webmail site is:
11 | 12 |Your username is your whole email address.
13 | 14 | 15 |iOS and macOS only: Open this configuration link on your iOS device or on your Mac desktop to easily set up mail (IMAP/SMTP), Contacts, and Calendar. Your username is your whole email address.
20 | 21 |Use the following settings when you set up your email on your phone, desktop, or other device:
24 | 25 || Option | Value |
|---|---|
| Protocol/Method | IMAP |
| Mail server | {{hostname}} | 31 |
| IMAP Port | 993 |
| IMAP Security | SSL or TLS |
| SMTP Port | 465 |
| SMTP Security | SSL or TLS |
| Username: | Your whole email address. |
| Password: | Your mail password. |
In addition to setting up your email, you’ll also need to set up contacts and calendar synchronization separately.
40 | 41 |As an alternative to IMAP you can also use the POP protocol: choose POP as the protocol, port 995, and SSL or TLS security in your mail client. The SMTP settings and usernames and passwords remain the same. However, we recommend you use IMAP instead.
42 | 43 |On iOS devices, devices on this compatibility list, or using Outlook 2007 or later on Windows 7 and later, you may set up your mail as an Exchange or ActiveSync server. However, we’ve found this to be more buggy than using IMAP as described above. If you encounter any problems, please use the manual settings above.
46 | 47 || Server | {{hostname}} |
|---|---|
| Options | Secure Connection |
Your device should also provide a contacts list and calendar that syncs to this box when you use this method.
53 |Your box uses a technique called greylisting to cut down on spam. Greylisting works by initially rejecting mail from people you haven’t received mail from before. Legitimate mail servers will attempt redelivery shortly afterwards, but the vast majority of spam gets tricked by this. If you are waiting for an email from someone new, such as if you are registering on a new website and are waiting for an email confirmation, please be aware there will be a minimum of 3 minutes delay, depending how soon the remote server attempts redelivery.
63 | 64 |Every incoming email address also receives mail for +tag addresses. If your email address is you@yourdomain.com, you’ll also automatically get mail sent to you+anythinghere@yourdomain.com. Use this as a fast way to segment incoming mail for your own filtering rules without having to create aliases in this control panel.
Your box sets strict email sending policies for your domain names to make it harder for spam and other fraudulent mail to claim to be you. Only this machine is authorized to send email on behalf of your domain names. If you use any other service to send email as you, it will likely get spam filtered by recipients.
69 |Opening munin in a new tab... You may need to allow pop-ups for this site.
7 | 8 | 21 | -------------------------------------------------------------------------------- /management/templates/sync-guide.html: -------------------------------------------------------------------------------- 1 |This box can hold your contacts and calendar, just like it holds your email.
5 | 6 |You can edit your contacts and calendar from your web browser.
13 | 14 || For... | Visit this URL |
|---|---|
| Contacts | https://{{hostname}}/cloud/contacts |
| Calendar | https://{{hostname}}/cloud/calendar |
Log in settings are the same as with mail: your 21 | complete email address and your mail password.
22 |If you set up your mail using Exchange/ActiveSync, 28 | your contacts and calendar may already appear on your device.
29 |Otherwise, here are some apps that can synchronize your contacts and calendar to your Android phone.
30 | 31 || For... | Use... |
|---|---|
| Contacts and Calendar | DAVx⁵ ($5.99; free here) |
| Only Contacts | CardDAV-Sync free (free) |
| Only Calendar | CalDAV-Sync ($2.99) |
Use the following settings:
39 | 40 || Account Type | CardDAV or CalDAV |
| Server Name | {{hostname}} |
| Use SSL | Yes |
| Username | Your complete email address. |
| Password | Your mail password. |
This machine is serving a simple, static website at https://{{hostname}} and at all domain names that you set up an email user or alias for.
7 | 8 |You can replace the default website with your own HTML pages and other static files. This control panel won’t help you design a website, but once you have .html files you can upload them following these instructions:
11 | 12 || Site | 27 |Directory for Files | 28 |29 | |
|---|
To add a domain to this table, create a dummy mail user or alias on the domain first and see the setup guide for adding nameserver records to the new domain at your registrar (but not glue records).
36 | 37 |Welcome to your Mail-in-a-Box control panel.
16 | 17 | -------------------------------------------------------------------------------- /management/utils.py: -------------------------------------------------------------------------------- 1 | import os.path 2 | 3 | # DO NOT import non-standard modules. This module is imported by 4 | # migrate.py which runs on fresh machines before anything is installed 5 | # besides Python. 6 | 7 | # THE ENVIRONMENT FILE AT /etc/mailinabox.conf 8 | 9 | def load_environment(): 10 | # Load settings from /etc/mailinabox.conf. 11 | return load_env_vars_from_file("/etc/mailinabox.conf") 12 | 13 | def load_env_vars_from_file(fn): 14 | # Load settings from a KEY=VALUE file. 15 | import collections 16 | env = collections.OrderedDict() 17 | with open(fn, encoding="utf-8") as f: 18 | for line in f: 19 | env.setdefault(*line.strip().split("=", 1)) 20 | return env 21 | 22 | def save_environment(env): 23 | with open("/etc/mailinabox.conf", "w", encoding="utf-8") as f: 24 | for k, v in env.items(): 25 | f.write(f"{k}={v}\n") 26 | 27 | # THE SETTINGS FILE AT STORAGE_ROOT/settings.yaml. 28 | 29 | def write_settings(config, env): 30 | import rtyaml 31 | fn = os.path.join(env['STORAGE_ROOT'], 'settings.yaml') 32 | with open(fn, "w", encoding="utf-8") as f: 33 | f.write(rtyaml.dump(config)) 34 | 35 | def load_settings(env): 36 | import rtyaml 37 | fn = os.path.join(env['STORAGE_ROOT'], 'settings.yaml') 38 | try: 39 | with open(fn, encoding="utf-8") as f: 40 | config = rtyaml.load(f) 41 | if not isinstance(config, dict): raise ValueError # caught below 42 | return config 43 | except: 44 | return { } 45 | 46 | # UTILITIES 47 | 48 | def safe_domain_name(name): 49 | # Sanitize a domain name so it is safe to use as a file name on disk. 50 | import urllib.parse 51 | return urllib.parse.quote(name, safe='') 52 | 53 | def sort_domains(domain_names, env): 54 | # Put domain names in a nice sorted order. 55 | 56 | # The nice order will group domain names by DNS zone, i.e. the top-most 57 | # domain name that we serve that ecompasses a set of subdomains. Map 58 | # each of the domain names to the zone that contains them. Walk the domains 59 | # from shortest to longest since zones are always shorter than their 60 | # subdomains. 61 | zones = { } 62 | for domain in sorted(domain_names, key=len): 63 | for z in zones.values(): 64 | if domain.endswith("." + z): 65 | # We found a parent domain already in the list. 66 | zones[domain] = z 67 | break 68 | else: 69 | # 'break' did not occur: there is no parent domain, so it is its 70 | # own zone. 71 | zones[domain] = domain 72 | 73 | # Sort the zones. 74 | zone_domains = sorted(zones.values(), 75 | key = lambda d : ( 76 | # PRIMARY_HOSTNAME or the zone that contains it is always first. 77 | not (d == env['PRIMARY_HOSTNAME'] or env['PRIMARY_HOSTNAME'].endswith("." + d)), 78 | 79 | # Then just dumb lexicographically. 80 | d, 81 | )) 82 | 83 | # Now sort the domain names that fall within each zone. 84 | return sorted(domain_names, 85 | key = lambda d : ( 86 | # First by zone. 87 | zone_domains.index(zones[d]), 88 | 89 | # PRIMARY_HOSTNAME is always first within the zone that contains it. 90 | d != env['PRIMARY_HOSTNAME'], 91 | 92 | # Followed by any of its subdomains. 93 | not d.endswith("." + env['PRIMARY_HOSTNAME']), 94 | 95 | # Then in right-to-left lexicographic order of the .-separated parts of the name. 96 | list(reversed(d.split("."))), 97 | )) 98 | 99 | 100 | def sort_email_addresses(email_addresses, env): 101 | email_addresses = set(email_addresses) 102 | domains = {email.split("@", 1)[1] for email in email_addresses if "@" in email} 103 | ret = [] 104 | for domain in sort_domains(domains, env): 105 | domain_emails = {email for email in email_addresses if email.endswith("@" + domain)} 106 | ret.extend(sorted(domain_emails)) 107 | email_addresses -= domain_emails 108 | ret.extend(sorted(email_addresses)) # whatever is left 109 | return ret 110 | 111 | def shell(method, cmd_args, env=None, capture_stderr=False, return_bytes=False, trap=False, input=None): 112 | # A safe way to execute processes. 113 | # Some processes like apt-get require being given a sane PATH. 114 | import subprocess 115 | 116 | if env is None: 117 | env = {} 118 | env.update({ "PATH": "/sbin:/bin:/usr/sbin:/usr/bin" }) 119 | kwargs = { 120 | 'env': env, 121 | 'stderr': None if not capture_stderr else subprocess.STDOUT, 122 | } 123 | if method == "check_output" and input is not None: 124 | kwargs['input'] = input 125 | 126 | if not trap: 127 | ret = getattr(subprocess, method)(cmd_args, **kwargs) 128 | else: 129 | try: 130 | ret = getattr(subprocess, method)(cmd_args, **kwargs) 131 | code = 0 132 | except subprocess.CalledProcessError as e: 133 | ret = e.output 134 | code = e.returncode 135 | if not return_bytes and isinstance(ret, bytes): ret = ret.decode("utf8") 136 | if not trap: 137 | return ret 138 | else: 139 | return code, ret 140 | 141 | def create_syslog_handler(): 142 | import logging.handlers 143 | handler = logging.handlers.SysLogHandler(address='/dev/log') 144 | handler.setLevel(logging.WARNING) 145 | return handler 146 | 147 | def du(path): 148 | # Computes the size of all files in the path, like the `du` command. 149 | # Based on http://stackoverflow.com/a/17936789. Takes into account 150 | # soft and hard links. 151 | total_size = 0 152 | seen = set() 153 | for dirpath, _dirnames, filenames in os.walk(path): 154 | for f in filenames: 155 | fp = os.path.join(dirpath, f) 156 | try: 157 | stat = os.lstat(fp) 158 | except OSError: 159 | continue 160 | if stat.st_ino in seen: 161 | continue 162 | seen.add(stat.st_ino) 163 | total_size += stat.st_size 164 | return total_size 165 | 166 | def wait_for_service(port, public, env, timeout): 167 | # Block until a service on a given port (bound privately or publicly) 168 | # is taking connections, with a maximum timeout. 169 | import socket, time 170 | start = time.perf_counter() 171 | while True: 172 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 173 | s.settimeout(timeout/3) 174 | try: 175 | s.connect(("127.0.0.1" if not public else env['PUBLIC_IP'], port)) 176 | return True 177 | except OSError: 178 | if time.perf_counter() > start+timeout: 179 | return False 180 | time.sleep(min(timeout/4, 1)) 181 | 182 | def get_ssh_port(): 183 | port_value = get_ssh_config_value("port") 184 | 185 | if port_value: 186 | return int(port_value) 187 | 188 | return None 189 | 190 | def get_ssh_config_value(parameter_name): 191 | # Returns ssh configuration value for the provided parameter 192 | import subprocess 193 | try: 194 | output = shell('check_output', ['sshd', '-T']) 195 | except FileNotFoundError: 196 | # sshd is not installed. That's ok. 197 | return None 198 | except subprocess.CalledProcessError: 199 | # error while calling shell command 200 | return None 201 | 202 | for line in output.split("\n"): 203 | if " " not in line: continue # there's a blank line at the end 204 | key, values = line.split(" ", 1) 205 | if key == parameter_name: 206 | return values # space-delimited if there are multiple values 207 | 208 | # Did not find the parameter! 209 | return None 210 | 211 | if __name__ == "__main__": 212 | from web_update import get_web_domains 213 | env = load_environment() 214 | domains = get_web_domains(env) 215 | for domain in domains: 216 | print(domain) 217 | -------------------------------------------------------------------------------- /management/wsgi.py: -------------------------------------------------------------------------------- 1 | from daemon import app 2 | import utils 3 | 4 | app.logger.addHandler(utils.create_syslog_handler()) 5 | 6 | if __name__ == "__main__": 7 | app.run(port=10222) 8 | -------------------------------------------------------------------------------- /setup/bootstrap.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | ######################################################### 3 | # This script is intended to be run like this: 4 | # 5 | # curl https://mailinabox.email/setup.sh | sudo bash 6 | # 7 | ######################################################### 8 | 9 | if [ -z "$TAG" ]; then 10 | # If a version to install isn't explicitly given as an environment 11 | # variable, then install the latest version. But the latest version 12 | # depends on the machine's version of Ubuntu. Existing users need to 13 | # be able to upgrade to the latest version available for that version 14 | # of Ubuntu to satisfy the migration requirements. 15 | # 16 | # Also, the system status checks read this script for TAG = (without the 17 | # space, but if we put it in a comment it would confuse the status checks!) 18 | # to get the latest version, so the first such line must be the one that we 19 | # want to display in status checks. 20 | # 21 | # Allow point-release versions of the major releases, e.g. 22.04.1 is OK. 22 | UBUNTU_VERSION=$( lsb_release -d | sed 's/.*:\s*//' | sed 's/\([0-9]*\.[0-9]*\)\.[0-9]/\1/' ) 23 | if [ "$UBUNTU_VERSION" == "Ubuntu 22.04 LTS" ]; then 24 | # This machine is running Ubuntu 22.04, which is supported by 25 | # Mail-in-a-Box versions 60 and later. 26 | TAG=v71a 27 | elif [ "$UBUNTU_VERSION" == "Ubuntu 18.04 LTS" ]; then 28 | # This machine is running Ubuntu 18.04, which is supported by 29 | # Mail-in-a-Box versions 0.40 through 5x. 30 | echo "Support is ending for Ubuntu 18.04." 31 | echo "Please immediately begin to migrate your data to" 32 | echo "a new machine running Ubuntu 22.04. See:" 33 | echo "https://mailinabox.email/maintenance.html#upgrade" 34 | TAG=v57a 35 | elif [ "$UBUNTU_VERSION" == "Ubuntu 14.04 LTS" ]; then 36 | # This machine is running Ubuntu 14.04, which is supported by 37 | # Mail-in-a-Box versions 1 through v0.30. 38 | echo "Ubuntu 14.04 is no longer supported." 39 | echo "The last version of Mail-in-a-Box supporting Ubuntu 14.04 will be installed." 40 | TAG=v0.30 41 | else 42 | echo "This script may be used only on a machine running Ubuntu 14.04, 18.04, or 22.04." 43 | exit 1 44 | fi 45 | fi 46 | 47 | # Are we running as root? 48 | if [[ $EUID -ne 0 ]]; then 49 | echo "This script must be run as root. Did you leave out sudo?" 50 | exit 1 51 | fi 52 | 53 | # Clone the Mail-in-a-Box repository if it doesn't exist. 54 | if [ ! -d "$HOME/mailinabox" ]; then 55 | if [ ! -f /usr/bin/git ]; then 56 | echo "Installing git . . ." 57 | apt-get -q -q update 58 | DEBIAN_FRONTEND=noninteractive apt-get -q -q install -y git < /dev/null 59 | echo 60 | fi 61 | 62 | if [ "$SOURCE" == "" ]; then 63 | SOURCE=https://github.com/mail-in-a-box/mailinabox 64 | fi 65 | 66 | echo "Downloading Mail-in-a-Box $TAG. . ." 67 | git clone \ 68 | -b "$TAG" --depth 1 \ 69 | "$SOURCE" \ 70 | "$HOME/mailinabox" \ 71 | < /dev/null 2> /dev/null 72 | 73 | echo 74 | fi 75 | 76 | # Change directory to it. 77 | cd "$HOME/mailinabox" || exit 78 | 79 | # Update it. 80 | if [ "$TAG" != "$(git describe --always)" ]; then 81 | echo "Updating Mail-in-a-Box to $TAG . . ." 82 | git fetch --depth 1 --force --prune origin tag "$TAG" 83 | if ! git checkout -q "$TAG"; then 84 | echo "Update failed. Did you modify something in $PWD?" 85 | exit 1 86 | fi 87 | echo 88 | fi 89 | 90 | # Start setup script. 91 | setup/start.sh 92 | -------------------------------------------------------------------------------- /setup/dkim.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # OpenDKIM 3 | # -------- 4 | # 5 | # OpenDKIM provides a service that puts a DKIM signature on outbound mail. 6 | # 7 | # The DNS configuration for DKIM is done in the management daemon. 8 | 9 | source setup/functions.sh # load our functions 10 | source /etc/mailinabox.conf # load global vars 11 | 12 | # Install DKIM... 13 | echo "Installing OpenDKIM/OpenDMARC..." 14 | apt_install opendkim opendkim-tools opendmarc 15 | 16 | # Make sure configuration directories exist. 17 | mkdir -p /etc/opendkim; 18 | mkdir -p "$STORAGE_ROOT/mail/dkim" 19 | 20 | # Used in InternalHosts and ExternalIgnoreList configuration directives. 21 | # Not quite sure why. 22 | echo "127.0.0.1" > /etc/opendkim/TrustedHosts 23 | 24 | # We need to at least create these files, since we reference them later. 25 | # Otherwise, opendkim startup will fail 26 | touch /etc/opendkim/KeyTable 27 | touch /etc/opendkim/SigningTable 28 | 29 | if grep -q "ExternalIgnoreList" /etc/opendkim.conf; then 30 | true # already done #NODOC 31 | else 32 | # Add various configuration options to the end of `opendkim.conf`. 33 | cat >> /etc/opendkim.conf << EOF; 34 | Canonicalization relaxed/simple 35 | MinimumKeyBits 1024 36 | ExternalIgnoreList refile:/etc/opendkim/TrustedHosts 37 | InternalHosts refile:/etc/opendkim/TrustedHosts 38 | KeyTable refile:/etc/opendkim/KeyTable 39 | SigningTable refile:/etc/opendkim/SigningTable 40 | Socket inet:8891@127.0.0.1 41 | RequireSafeKeys false 42 | EOF 43 | fi 44 | 45 | # Create a new DKIM key. This creates mail.private and mail.txt 46 | # in $STORAGE_ROOT/mail/dkim. The former is the private key and 47 | # the latter is the suggested DNS TXT entry which we'll include 48 | # in our DNS setup. Note that the files are named after the 49 | # 'selector' of the key, which we can change later on to support 50 | # key rotation. 51 | # 52 | # A 1024-bit key is seen as a minimum standard by several providers 53 | # such as Google. But they and others use a 2048 bit key, so we'll 54 | # do the same. Keys beyond 2048 bits may exceed DNS record limits. 55 | if [ ! -f "$STORAGE_ROOT/mail/dkim/mail.private" ]; then 56 | opendkim-genkey -b 2048 -r -s mail -D "$STORAGE_ROOT/mail/dkim" 57 | fi 58 | 59 | # Ensure files are owned by the opendkim user and are private otherwise. 60 | chown -R opendkim:opendkim "$STORAGE_ROOT/mail/dkim" 61 | chmod go-rwx "$STORAGE_ROOT/mail/dkim" 62 | 63 | tools/editconf.py /etc/opendmarc.conf -s \ 64 | "Syslog=true" \ 65 | "Socket=inet:8893@[127.0.0.1]" \ 66 | "FailureReports=false" 67 | 68 | # SPFIgnoreResults causes the filter to ignore any SPF results in the header 69 | # of the message. This is useful if you want the filter to perform SPF checks 70 | # itself, or because you don't trust the arriving header. This added header is 71 | # used by spamassassin to evaluate the mail for spamminess. 72 | 73 | tools/editconf.py /etc/opendmarc.conf -s \ 74 | "SPFIgnoreResults=true" 75 | 76 | # SPFSelfValidate causes the filter to perform a fallback SPF check itself 77 | # when it can find no SPF results in the message header. If SPFIgnoreResults 78 | # is also set, it never looks for SPF results in headers and always performs 79 | # the SPF check itself when this is set. This added header is used by 80 | # spamassassin to evaluate the mail for spamminess. 81 | 82 | tools/editconf.py /etc/opendmarc.conf -s \ 83 | "SPFSelfValidate=true" 84 | 85 | # Disables generation of failure reports for sending domains that publish a 86 | # "none" policy. 87 | 88 | tools/editconf.py /etc/opendmarc.conf -s \ 89 | "FailureReportsOnNone=false" 90 | 91 | # AlwaysAddARHeader Adds an "Authentication-Results:" header field even to 92 | # unsigned messages from domains with no "signs all" policy. The reported DKIM 93 | # result will be "none" in such cases. Normally unsigned mail from non-strict 94 | # domains does not cause the results header field to be added. This added header 95 | # is used by spamassassin to evaluate the mail for spamminess. 96 | 97 | tools/editconf.py /etc/opendkim.conf -s \ 98 | "AlwaysAddARHeader=true" 99 | 100 | # Add OpenDKIM and OpenDMARC as milters to postfix, which is how OpenDKIM 101 | # intercepts outgoing mail to perform the signing (by adding a mail header) 102 | # and how they both intercept incoming mail to add Authentication-Results 103 | # headers. The order possibly/probably matters: OpenDMARC relies on the 104 | # OpenDKIM Authentication-Results header already being present. 105 | # 106 | # Be careful. If we add other milters later, this needs to be concatenated 107 | # on the smtpd_milters line. 108 | # 109 | # The OpenDMARC milter is skipped in the SMTP submission listener by 110 | # configuring smtpd_milters there to only list the OpenDKIM milter 111 | # (see mail-postfix.sh). 112 | tools/editconf.py /etc/postfix/main.cf \ 113 | "smtpd_milters=inet:127.0.0.1:8891 inet:127.0.0.1:8893"\ 114 | non_smtpd_milters=\$smtpd_milters \ 115 | milter_default_action=accept 116 | 117 | # We need to explicitly enable the opendmarc service, or it will not start 118 | hide_output systemctl enable opendmarc 119 | 120 | # Restart services. 121 | restart_service opendkim 122 | restart_service opendmarc 123 | restart_service postfix 124 | 125 | -------------------------------------------------------------------------------- /setup/dns.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # DNS 3 | # ----------------------------------------------- 4 | 5 | # This script installs packages, but the DNS zone files are only 6 | # created by the /dns/update API in the management server because 7 | # the set of zones (domains) hosted by the server depends on the 8 | # mail users & aliases created by the user later. 9 | 10 | source setup/functions.sh # load our functions 11 | source /etc/mailinabox.conf # load global vars 12 | 13 | # Prepare nsd's configuration. 14 | # We configure nsd before installation as we only want it to bind to some addresses 15 | # and it otherwise will have port / bind conflicts with bind9 used as the local resolver 16 | mkdir -p /var/run/nsd 17 | mkdir -p /etc/nsd 18 | mkdir -p /etc/nsd/zones 19 | touch /etc/nsd/zones.conf 20 | 21 | cat > /etc/nsd/nsd.conf << EOF; 22 | # Do not edit. Overwritten by Mail-in-a-Box setup. 23 | server: 24 | hide-version: yes 25 | logfile: "/var/log/nsd.log" 26 | 27 | # identify the server (CH TXT ID.SERVER entry). 28 | identity: "" 29 | 30 | # The directory for zonefile: files. 31 | zonesdir: "/etc/nsd/zones" 32 | 33 | # Allows NSD to bind to IP addresses that are not (yet) added to the 34 | # network interface. This allows nsd to start even if the network stack 35 | # isn't fully ready, which apparently happens in some cases. 36 | # See https://www.nlnetlabs.nl/projects/nsd/nsd.conf.5.html. 37 | ip-transparent: yes 38 | 39 | EOF 40 | 41 | # Since we have bind9 listening on localhost for locally-generated 42 | # DNS queries that require a recursive nameserver, and the system 43 | # might have other network interfaces for e.g. tunnelling, we have 44 | # to be specific about the network interfaces that nsd binds to. 45 | for ip in $PRIVATE_IP $PRIVATE_IPV6; do 46 | echo " ip-address: $ip" >> /etc/nsd/nsd.conf; 47 | done 48 | 49 | # Create a directory for additional configuration directives, including 50 | # the zones.conf file written out by our management daemon. 51 | echo "include: /etc/nsd/nsd.conf.d/*.conf" >> /etc/nsd/nsd.conf; 52 | 53 | # Remove the old location of zones.conf that we generate. It will 54 | # now be stored in /etc/nsd/nsd.conf.d. 55 | rm -f /etc/nsd/zones.conf 56 | 57 | # Add log rotation 58 | cat > /etc/logrotate.d/nsd <