diff --git a/data/Dockerfiles/acme/docker-entrypoint.sh b/data/Dockerfiles/acme/docker-entrypoint.sh index c5e6bc36..6715f791 100755 --- a/data/Dockerfiles/acme/docker-entrypoint.sh +++ b/data/Dockerfiles/acme/docker-entrypoint.sh @@ -50,7 +50,8 @@ if [[ -f ${ACME_BASE}/cert.pem ]] && [[ -f ${ACME_BASE}/key.pem ]]; then ISSUER=$(openssl x509 -in ${ACME_BASE}/cert.pem -noout -issuer) if [[ ${ISSUER} != *"Let's Encrypt"* && ${ISSUER} != *"mailcow"* ]]; then echo "Found certificate with issuer other than mailcow snake-oil CA and Let's Encrypt, skipping ACME client..." - exit 0 + sleep 3650d + exec $(readlink -f "$0") else declare -a SAN_ARRAY_NOW SAN_NAMES=$(openssl x509 -noout -text -in ${ACME_BASE}/cert.pem | awk '/X509v3 Subject Alternative Name/ {getline;gsub(/ /, "", $0); print}' | tr -d "DNS:") @@ -79,7 +80,8 @@ fi while true; do if [[ "${SKIP_LETS_ENCRYPT}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then echo "SKIP_LETS_ENCRYPT=y, skipping Let's Encrypt..." - exit 0 + sleep 3650d + exec $(readlink -f "$0") fi if [[ "${SKIP_IP_CHECK}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then SKIP_IP_CHECK=y @@ -164,8 +166,10 @@ while true; do # Unique elements ALL_VALIDATED=(${VALIDATED_MAILCOW_HOSTNAME} $(echo ${VALIDATED_CONFIG_DOMAINS[*]} ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs)) if [[ -z ${ALL_VALIDATED[*]} ]]; then - echo "Cannot validate hostnames, skipping Let's Encrypt..." - exit 0 + echo "Cannot validate hostnames, skipping Let's Encrypt for 1 hour." + echo "Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently." + sleep 1h + exec $(readlink -f "$0") fi ORPHANED_SAN=($(echo ${SAN_ARRAY_NOW[*]} ${ALL_VALIDATED[*]} | tr ' ' '\n' | sort | uniq -u )) @@ -219,7 +223,10 @@ while true; do TRIGGER_RESTART=1 fi [[ ${TRIGGER_RESTART} == 1 ]] && restart_containers ${CONTAINERS_RESTART[*]} - exit 1;; + echo "Retrying in 30 minutes..." + sleep 30m + exec $(readlink -f "$0") + ;; 2) # no change if ! diff ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/cert.pem; then echo "Certificate was not changed, but active certificate does not match the verified certificate, fixing and restarting containers..." @@ -253,10 +260,11 @@ while true; do TRIGGER_RESTART=1 fi [[ ${TRIGGER_RESTART} == 1 ]] && restart_containers ${CONTAINERS_RESTART[*]} - exit 1;; + sleep 3650d + ;; esac echo "ACME certificate validation done. Sleeping for another day." - sleep 86400 + sleep 1d done diff --git a/data/Dockerfiles/rspamd/Dockerfile b/data/Dockerfiles/rspamd/Dockerfile index 32e0fe30..07250232 100644 --- a/data/Dockerfiles/rspamd/Dockerfile +++ b/data/Dockerfiles/rspamd/Dockerfile @@ -18,9 +18,9 @@ RUN apt-get update && apt-get install -y \ && mkdir -p /run/rspamd \ && chown _rspamd:_rspamd /run/rspamd -COPY settings.conf /etc/rspamd/modules.d/settings.conf -COPY ratelimit.lua /usr/share/rspamd/lua/ratelimit.lua -COPY lua_util.lua /usr/share/rspamd/lib/lua_util.lua +#COPY settings.conf /etc/rspamd/modules.d/settings.conf +#COPY ratelimit.lua /usr/share/rspamd/lua/ratelimit.lua +#COPY lua_util.lua /usr/share/rspamd/lib/lua_util.lua COPY docker-entrypoint.sh /docker-entrypoint.sh ENTRYPOINT ["/docker-entrypoint.sh"] diff --git a/data/conf/rspamd/dynmaps/settings.php b/data/conf/rspamd/dynmaps/settings.php index d6ca8a53..552918e1 100644 --- a/data/conf/rspamd/dynmaps/settings.php +++ b/data/conf/rspamd/dynmaps/settings.php @@ -191,8 +191,8 @@ while ($row = array_shift($rows)) { $grouped_lists = $stmt->fetchAll(PDO::FETCH_COLUMN); $value_sane = preg_replace("/\.\./", ".", (preg_replace("/\*/", ".*", $grouped_lists[0]))); ?> - request_header = { - "From" = "()"; + header = { + "From" = "/()/i"; } fetchAll(PDO::FETCH_COLUMN); $value_sane = preg_replace("/\.\./", ".", (preg_replace("/\*/", ".*", $grouped_lists[0]))); ?> - request_header = { - "From" = "()"; + header = { + "From" = "/()/i"; }
+

↪ Private key

+

↪ Private key

↳ Alias-Domain:

- 
-
+ 
-
+

↪ Private key

mail server - - + + SSL %EMAILADDRESS% password-cleartext - - + + STARTTLS %EMAILADDRESS% password-cleartext @@ -51,8 +51,8 @@ header('Content-Type: application/xml'); $records = dns_get_record('_pop3s._tcp.' . $domain, DNS_SRV); // check if POP3 is announced as "not provided" via SRV record if (count($records) == 0 || $records[0]['target'] != '') { ?> - - + + SSL %EMAILADDRESS% password-cleartext @@ -62,8 +62,8 @@ if (count($records) == 0 || $records[0]['target'] != '') { ?> $records = dns_get_record('_pop3._tcp.' . $domain, DNS_SRV); // check if POP3 is announced as "not provided" via SRV record if (count($records) == 0 || $records[0]['target'] != '') { ?> - - + + STARTTLS %EMAILADDRESS% password-cleartext @@ -71,15 +71,15 @@ if (count($records) == 0 || $records[0]['target'] != '') { ?> - - + + SSL %EMAILADDRESS% password-cleartext - - + + STARTTLS %EMAILADDRESS% password-cleartext diff --git a/data/web/autodiscover.php b/data/web/autodiscover.php index 975fd3e0..551cc6dc 100644 --- a/data/web/autodiscover.php +++ b/data/web/autodiscover.php @@ -5,7 +5,7 @@ $default_autodiscover_config = $autodiscover_config; if(file_exists('inc/vars.local.inc.php')) { include_once 'inc/vars.local.inc.php'; } -$configuration = array_merge($default_autodiscover_config, $autodiscover_config); +$autodiscover_config = array_merge($default_autodiscover_config, $autodiscover_config); // Redis $redis = new Redis(); @@ -17,14 +17,14 @@ $data = trim(file_get_contents("php://input")); // Desktop client needs IMAP, unless it's Outlook 2013 or higher on Windows if (strpos($data, 'autodiscover/outlook/responseschema') !== false) { // desktop client - $configuration['autodiscoverType'] = 'imap'; - if ($configuration['useEASforOutlook'] == 'yes' && + $autodiscover_config['autodiscoverType'] = 'imap'; + if ($autodiscover_config['useEASforOutlook'] == 'yes' && // Office for macOS does not support EAS strpos($_SERVER['HTTP_USER_AGENT'], 'Mac') === false && // Outlook 2013 (version 15) or higher preg_match('/(Outlook|Office).+1[5-9]\./', $_SERVER['HTTP_USER_AGENT']) ) { - $configuration['autodiscoverType'] = 'activesync'; + $autodiscover_config['autodiscoverType'] = 'activesync'; } } @@ -88,7 +88,7 @@ else { $displayname = $email; } - if ($configuration['autodiscoverType'] == 'imap') { + if ($autodiscover_config['autodiscoverType'] == 'imap') { ?> @@ -99,8 +99,8 @@ else { settings IMAP - - + + off off @@ -109,8 +109,8 @@ else { SMTP - - + + off off @@ -121,13 +121,13 @@ else { CalDAV - https:///SOGo/dav//Calendar + https:///SOGo/dav//Calendar off CardDAV - https:///SOGo/dav//Contacts + https:///SOGo/dav//Contacts off @@ -135,7 +135,7 @@ else { en:en @@ -147,8 +147,8 @@ else { MobileSync - - + + diff --git a/data/web/inc/functions.dkim.inc.php b/data/web/inc/functions.dkim.inc.php index 7871a0d8..c1730157 100644 --- a/data/web/inc/functions.dkim.inc.php +++ b/data/web/inc/functions.dkim.inc.php @@ -187,6 +187,14 @@ function dkim($_action, $_data = null) { } $dkimdata['dkim_txt'] = 'v=DKIM1;k=rsa;t=s;s=email;p=' . $redis_dkim_key_data; $dkimdata['dkim_selector'] = $redis->hGet('DKIM_SELECTORS', $_data); + $dkimdata['privkey'] = $redis->hGet('DKIM_PRIV_KEYS', $dkimdata['dkim_selector'] . $_data); + if ($GLOBALS['SHOW_DKIM_PRIV_KEYS'] === true) { + $dkimdata['privkey'] = base64_encode($redis->hGet('DKIM_PRIV_KEYS', $dkimdata['dkim_selector'] . '.' . $_data)); + } + else { + $dkimdata['privkey'] = base64_encode('Please set $SHOW_DKIM_PRIV_KEYS to true to show DKIM private keys.'); + } + } return $dkimdata; break; diff --git a/data/web/inc/prerequisites.inc.php b/data/web/inc/prerequisites.inc.php index a394943e..0ba894f7 100644 --- a/data/web/inc/prerequisites.inc.php +++ b/data/web/inc/prerequisites.inc.php @@ -1,8 +1,10 @@ > 2; + o = (n & 3) << 4 | r >> 4; + u = (r & 15) << 2 | i >> 6; + a = i & 63; + if (isNaN(r)) { + u = a = 64 + } else if (isNaN(i)) { + a = 64 + } + t = t + this._keyStr.charAt(s) + this._keyStr.charAt(o) + + this._keyStr.charAt(u) + this._keyStr.charAt(a) + } + return t + }, + decode: function(e) { + var t = ""; + var n, r, i; + var s, o, u, a; + var f = 0; + e = e.replace(/[^A-Za-z0-9\+\/\=]/g, ""); + while (f < e.length) { + s = this._keyStr.indexOf(e.charAt(f++)); + o = this._keyStr.indexOf(e.charAt(f++)); + u = this._keyStr.indexOf(e.charAt(f++)); + a = this._keyStr.indexOf(e.charAt(f++)); + n = s << 2 | o >> 4; + r = (o & 15) << 4 | u >> 2; + i = (u & 3) << 6 | a; + t = t + String.fromCharCode(n); + if (u != 64) { + t = t + String.fromCharCode(r) + } + if (a != 64) { + t = t + String.fromCharCode(i) + } + } + t = Base64._utf8_decode(t); + return t + }, + _utf8_encode: function(e) { + e = e.replace(/\r\n/g, "\n"); + var t = ""; + for (var n = 0; n < e.length; n++) { + var r = e.charCodeAt(n); + if (r < 128) { + t += String.fromCharCode(r) + } else if (r > 127 && r < 2048) { + t += String.fromCharCode(r >> 6 | 192); + t += String.fromCharCode(r & 63 | 128) + } else { + t += String.fromCharCode(r >> 12 | 224); + t += String.fromCharCode(r >> 6 & 63 | 128); + t += String.fromCharCode(r & 63 | 128) + } + } + return t + }, + _utf8_decode: function(e) { + var t = ""; + var n = 0; + var r = c1 = c2 = 0; + while (n < e.length) { + r = e.charCodeAt(n); + if (r < 128) { + t += String.fromCharCode(r); + n++ + } else if (r > 191 && r < 224) { + c2 = e.charCodeAt(n + 1); + t += String.fromCharCode((r & 31) << 6 | c2 & 63); + n += 2 + } else { + c2 = e.charCodeAt(n + 1); + c3 = e.charCodeAt(n + 2); + t += String.fromCharCode((r & 15) << 12 | (c2 & 63) << + 6 | c3 & 63); + n += 3 + } + } + return t + } +} + jQuery(function($){ // http://stackoverflow.com/questions/24816/escaping-html-strings-with-jquery var entityMap = { @@ -560,6 +653,15 @@ jQuery(function($){ } }) + $('#showDKIMprivKey').on('show.bs.modal', function (e) { + $('#priv_key_pre').text("-"); + p_related = $(e.relatedTarget) + if (p_related != null) { + var decoded_key = Base64.decode((p_related.data('priv-key'))); + $('#priv_key_pre').text(decoded_key); + } + }) + $('#test_relayhost').on('click', function (e) { e.preventDefault(); prev = $('#test_relayhost').text(); diff --git a/data/web/lang/lang.de.php b/data/web/lang/lang.de.php index a8851a82..733d3782 100644 --- a/data/web/lang/lang.de.php +++ b/data/web/lang/lang.de.php @@ -108,6 +108,7 @@ $lang['user']['user_settings'] = 'Benutzereinstellungen'; $lang['user']['mailbox_settings'] = 'Mailbox-Einstellungen'; $lang['user']['mailbox_details'] = 'Mailbox-Details'; $lang['user']['change_password'] = 'Passwort ändern'; +$lang['user']['client_configuration'] = 'Konfigurationsanleitungen für E-Mail-Programme und Smartphones anzeigen'; $lang['user']['new_password'] = 'Neues Passwort'; $lang['user']['save_changes'] = 'Änderungen speichern'; $lang['user']['password_now'] = 'Aktuelles Passwort (Änderungen bestätigen)'; diff --git a/data/web/lang/lang.en.php b/data/web/lang/lang.en.php index ddb82f23..aa41d1b0 100644 --- a/data/web/lang/lang.en.php +++ b/data/web/lang/lang.en.php @@ -110,6 +110,7 @@ $lang['user']['user_settings'] = 'User settings'; $lang['user']['mailbox_settings'] = 'Mailbox settings'; $lang['user']['mailbox_details'] = 'Mailbox details'; $lang['user']['change_password'] = 'Change password'; +$lang['user']['client_configuration'] = 'Show configuration guides for email clients and smartphones'; $lang['user']['new_password'] = 'New password'; $lang['user']['save_changes'] = 'Save changes'; $lang['user']['password_now'] = 'Current password (confirm changes)'; diff --git a/data/web/modals/admin.php b/data/web/modals/admin.php index cce43b47..bf17296c 100644 --- a/data/web/modals/admin.php +++ b/data/web/modals/admin.php @@ -91,3 +91,17 @@ if (!isset($_SESSION['mailcow_cc_role'])) { + + diff --git a/data/web/user.php b/data/web/user.php index 4b93b6cc..0d95790d 100644 --- a/data/web/user.php +++ b/data/web/user.php @@ -60,10 +60,26 @@ elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == ' / USER */ - require_once("inc/header.inc.php"); - $_SESSION['return_to'] = $_SERVER['REQUEST_URI']; - $username = $_SESSION['mailcow_cc_username']; + require_once("inc/header.inc.php"); + $_SESSION['return_to'] = $_SERVER['REQUEST_URI']; + $username = $_SESSION['mailcow_cc_username']; $mailboxdata = mailbox('get', 'mailbox_details', $username); + + $clientconfigstr = "host=" . urlencode($mailcow_hostname) . "&email=" . urlencode($username) . "&name=" . urlencode($mailboxdata['name']) . "&port=" . urlencode($autodiscover_config['caldav']['port']); + if ($autodiscover_config['useEASforOutlook'] == 'yes') + $clientconfigstr .= "&outlookEAS=1"; + if (file_exists('thunderbird-plugins/version.csv')) { + $fh = fopen('thunderbird-plugins/version.csv', 'r'); + if ($fh) { + while (($row = fgetcsv($fh, 1000, ';')) !== FALSE) { + if ($row[0] == 'sogo-integrator@inverse.ca') { + $clientconfigstr .= "&integrator=" . urlencode($row[1]); + } + } + fclose($fh); + } + } + ?>

@@ -74,6 +90,7 @@ elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == '

[]

+

[]

diff --git a/docker-compose.yml b/docker-compose.yml index 2bee1e40..fe7a2f5d 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,18 +1,14 @@ -version: '2.1' +version: '2.3' services: unbound-mailcow: image: mailcow/unbound:1.0 build: ./data/Dockerfiles/unbound command: /usr/sbin/unbound + init: true depends_on: mysql-mailcow: condition: service_healthy - healthcheck: - test: ["CMD", "nslookup", "mailcow.email", "127.0.0.1"] - interval: 30s - timeout: 3s - retries: 10 volumes: - ./data/conf/unbound/unbound.conf:/etc/unbound/unbound.conf:ro restart: always @@ -38,6 +34,7 @@ services: - MYSQL_DATABASE=${DBNAME} - MYSQL_USER=${DBUSER} - MYSQL_PASSWORD=${DBPASS} + init: true restart: always dns: - 172.22.1.254 @@ -50,9 +47,6 @@ services: redis-mailcow: image: redis:alpine - depends_on: - unbound-mailcow: - condition: service_healthy volumes: - redis-vol-1:/data/ restart: always @@ -66,11 +60,12 @@ services: - redis clamd-mailcow: - image: mailcow/clamd:1.2 + image: mailcow/clamd:1.3 build: ./data/Dockerfiles/clamd restart: on-failure environment: - SKIP_CLAMD=${SKIP_CLAMD:-n} + init: true dns: - 172.22.1.254 dns_search: mailcow-network @@ -80,13 +75,9 @@ services: - clamd rspamd-mailcow: - image: mailcow/rspamd:1.6 + image: mailcow/rspamd:1.7 build: ./data/Dockerfiles/rspamd - command: > - /bin/bash -c " - sleep 5; - /usr/bin/rspamd -f -u _rspamd -g _rspamd - " + command: "/usr/bin/rspamd -f -u _rspamd -g _rspamd" depends_on: - nginx-mailcow volumes: @@ -97,6 +88,7 @@ services: - dkim-vol-1:/data/dkim - rspamd-vol-1:/var/lib/rspamd restart: always + init: true dns: - 172.22.1.254 dns_search: mailcow-network @@ -142,9 +134,6 @@ services: sogo-mailcow: image: mailcow/sogo:1.8 build: ./data/Dockerfiles/sogo - depends_on: - unbound-mailcow: - condition: service_healthy environment: - DBNAME=${DBNAME} - DBUSER=${DBUSER} @@ -166,9 +155,6 @@ services: dovecot-mailcow: image: mailcow/dovecot:1.8 build: ./data/Dockerfiles/dovecot - depends_on: - unbound-mailcow: - condition: service_healthy volumes: - ./data/conf/dovecot:/usr/local/etc/dovecot - ./data/assets/ssl:/etc/ssl/mail/:ro @@ -204,9 +190,6 @@ services: postfix-mailcow: image: mailcow/postfix:1.4 build: ./data/Dockerfiles/postfix - depends_on: - unbound-mailcow: - condition: service_healthy volumes: - ./data/conf/postfix:/opt/postfix/conf - ./data/assets/ssl:/etc/ssl/mail/:ro @@ -232,9 +215,6 @@ services: memcached-mailcow: image: memcached:alpine - depends_on: - unbound-mailcow: - condition: service_healthy restart: always dns: - 172.22.1.254 @@ -249,15 +229,11 @@ services: - sogo-mailcow - php-fpm-mailcow image: nginx:mainline-alpine - healthcheck: - test: ["CMD", "ping", "php-fpm-mailcow", "-c", "5"] - interval: 5s - timeout: 5s - retries: 10 command: /bin/sh -c "envsubst < /etc/nginx/conf.d/templates/listen_plain.template > /etc/nginx/conf.d/listen_plain.active && envsubst < /etc/nginx/conf.d/templates/listen_ssl.template > /etc/nginx/conf.d/listen_ssl.active && envsubst < /etc/nginx/conf.d/templates/server_name.template > /etc/nginx/conf.d/server_name.active && - nginx -g 'daemon off;'" + until ping phpfpm -c1 > /dev/null; do sleep 1; done && + exec nginx -g 'daemon off;'" environment: - HTTPS_PORT=${HTTPS_PORT:-443} - HTTP_PORT=${HTTP_PORT:-80} @@ -283,8 +259,9 @@ services: acme-mailcow: depends_on: - nginx-mailcow - image: mailcow/acme:1.16 + image: mailcow/acme:1.17 build: ./data/Dockerfiles/acme + init: true dns: - 172.22.1.254 dns_search: mailcow-network @@ -319,6 +296,7 @@ services: - redis-mailcow restart: always privileged: true + init: true environment: - TZ=${TZ} - SKIP_FAIL2BAN=${SKIP_FAIL2BAN:-no}