* Sun Nov 17 2024 <jpp@koozali.org> 1.0-2.sme

- listen only via sockets
- use both unix user and virtual users
- groups and pseudonyms implemented in virtual maps
- support smarthost with and without auth
- support global and per domain delegated mail server
- support ssl
- uses qmail - recipient delimiter in left part of email.
- all domains set as local domains in mydestination
- message_size_limit
- local and remote concurency limit
This commit is contained in:
2024-11-17 22:25:49 -05:00
parent 3e1adb2110
commit aa8479eaa9
38 changed files with 558 additions and 99 deletions

View File

@@ -0,0 +1 @@
15000000

View File

@@ -0,0 +1,3 @@
UID="root"
GID="root"
PERMS=0600

View File

@@ -0,0 +1,5 @@
TEMPLATE_PATH="/home/e-smith/ssl.pem"
OUTPUT_FILENAME="/etc/postfix/ssl/postfix.pem"
UID="root"
GID="root"
PERMS=0640

View File

@@ -1,2 +1,2 @@
inet_interfaces = loopback-only
inet_interfaces = all
inet_protocols = all

View File

@@ -0,0 +1,5 @@
{
# qmail compatibility - instead of +
# default empty
}
recipient_delimiter = -

View File

@@ -1,2 +1,16 @@
# TODO add all domains and hosts related here
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
# SME Primary domain and host: looks up all recipients in /etc/passwd and /etc/aliases
mydestination = $myhostname $mydomain $myhostname.$mydomain localhost.$mydomain localhost {
$OUT = " ";
my $i = 0;
use esmith::DomainsDB;
my $ddb = esmith::DomainsDB->open_ro;
my @domains = map { $_->key } $ddb->get_all_by_prop('type' => 'domain');
foreach my $domain ( @domains )
{
my $d = $ddb->get($domain);
next if (($d->prop('VirtualMail') || "disabled") eq "enabled");
next unless (($d->prop('MailServer') || '') eq '');
next if $domain eq $DomainName;
$OUT .= "$domain ";
}
}

View File

@@ -1,30 +0,0 @@
{
$OUT = '';
my $virtual = 'virtual_alias_domains = ';
use esmith::DomainsDB;
my $domainsdb = esmith::DomainsDB->open_ro();
my $tempstr = '';
for my $domain ($domainsdb->domains)
{
my $primary = $domain->prop('SystemPrimaryDomain');
next if ( $primary eq 'yes' );
my $mail_server = $domain->prop('MailServer')
|| $DelegateMailServer
|| 'localhost';
next if ( $mail_server ne 'localhost' );
$emaildomain = $domain->key;
$tempstr .= "$emaildomain ";
}
if ( $tempstr ne '' )
{
$OUT .= "$virtual";
$OUT .= "$tempstr\n";
$OUT .= "virtual_alias_maps = hash:/etc/postfix/virtual";
}
}

View File

@@ -0,0 +1,21 @@
{
# SME Server Virtual domains
# to configure emails for those domains use pseudonyms to point to a unix account.
# sales@virtualdomain.com -> admin
$OUT = "virtual_alias_domains = ";
my $i = 0;
use esmith::DomainsDB;
my $ddb = esmith::DomainsDB->open_ro;
my @domains = map { $_->key } $ddb->get_all_by_prop('type' => 'domain');
foreach my $domain ( @domains )
{
my $d = $ddb->get($domain);
next unless (($d->prop('VirtualMail') || "disabled") eq "enabled");
next unless (($d->prop('MailServer') || '') eq '');
$OUT .= "$domain " unless $domain eq $DomainName;
$i ++ unless $domain eq $DomainName;;
}
$OUT = "# no SME Server Virtual domains configured" unless $i>0;
}

View File

@@ -0,0 +1,2 @@
# list of all virtual aliases : groups, pseudonyms ...
virtual_alias_maps = hash:/etc/postfix/virtual

View File

@@ -0,0 +1,7 @@
{
#message_size_limit = 10240000 (default)
# our previous default with qmail was 15000000
my $MaxMessageSize = $postfix{'MaxMessageSize'} || "15000000";
$OUT = "message_size_limit = $MaxMessageSize\n";
}

View File

@@ -1,12 +1,9 @@
{
$OUT = '';
my $transport = 'transport_maps = hash:/etc/postfix/transport ';
my $display = 0;
use esmith::DomainsDB;
my $domainsdb = esmith::DomainsDB->open_ro();
for my $domain ($domainsdb->domains)
{
my $mail_server = $domain->prop('MailServer')
@@ -15,10 +12,16 @@
if ( $mail_server ne 'localhost' )
{
$OUT = "$transport\n";
$display = 1;
}
}
$display = 1 if (
$SMTPSmartHost
&&
($SMTPSmartHost ne 'off')
&&
($SMTPSmartHost !~ /^\s*$/)
);
$OUT = "$transport\n" if $display eq 1;
}

View File

@@ -0,0 +1,3 @@
default_destination_concurrency_limit = { $postfix{'ConcurrencyRemote'} || "20"; }
local_destination_concurrency_limit = { $postfix{'ConcurrencyLocal'} || "20"; }

View File

@@ -0,0 +1 @@
2bounce_notice_recipient = { $postfix{'DoubleBounceTo'} || "postmaster"; }

View File

@@ -0,0 +1 @@
smtp_helo_name = { $qpsmtpd{HeloHost} || '$myhostname'}

View File

@@ -0,0 +1,27 @@
smtp_tls_cert_file = /etc/postfix/ssl/postfix.pem
smtpd_tls_cert_file = /etc/postfix/ssl/postfix.pem
smtp_tls_note_starttls_offer = yes
{
# see http://www.postfix.org/postconf.5.html#smtp_tls_security_level
# *smtp_use_tls = yes (default no) this is oportunistic deprecated option
# equivalent of smtp_tls_security_level = may
# *smtp_enforce_tls = yes (default no) also deprecated
# would require it and require remote SMTP server hostname matches
# the information in the remote server certificate, and that the remote SMTP server certificate
# was issued by a CA that is trusted by the Postfix SMTP client
}smtp_tls_security_level = {
my $smarthost = $SMTPSmartHost || "off";
my $userid = ${smtp-auth-proxy}{'Userid'} || "";
my $tls_security_level = $postfix{'tls_security_level'} || "may";
$tls_security_level = "encrypt" if ($smarthost ne "off" && $userid ne "");
$OUT = $tls_security_level;
}
smtp_tls_enforce_peername = { (($postfix{'tls_enforce_peername'}||'yes') eq "yes")? 'yes' : 'no'; }
{
# keeping default for this one
# smtp_tls_ciphers = medium
}{
# keeping default for this one
# smtp_tls_protocols = !SSLv2, !SSLv3
# smtp_tls_protocols = >=TLSv1
}smtp_tls_loglevel = 1

View File

@@ -0,0 +1,15 @@
## SME relay outgoing mails to smarthost
{
my $smarthost = $SMTPSmartHost || "off";
my $userid = ${smtp-auth-proxy}{'Userid'} || "";
my $password = ${smtp-auth-proxy}{'Passwd'} || "";
my $port = ${smtp-auth-proxy}{'PeerPort'} || "25";
return "#Smarthost disabled" unless $smarthost ne "off";
$OUT = "relayhost = [$smarthost]:$port\n";
if ($userid ne "")
{
$OUT .= "smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd\n";
$OUT .= "smtp_sasl_security_options = noanonymous\n";
$OUT .= "smtp_sasl_auth_enable = yes\n";
}
}

View File

@@ -1,4 +1,5 @@
2525 inet n - n - - smtpd
#2525 inet n - n - - smtpd
# :25 is in use by qpsmtpd
#smtp inet n - n - - smtpd
#smtp inet n - n - 1 postscreen
#smtpd pass - - n - - smtpd

View File

@@ -0,0 +1,15 @@
## SME relay outgoing mails to smarthost
{
my $smarthost = $SMTPSmartHost || "off";
my $userid = ${smtp-auth-proxy}{'Userid'} || "";
my $password = ${smtp-auth-proxy}{'Passwd'} || "";
my $port = ${smtp-auth-proxy}{'PeerPort'} || "25";
return "#Smarthost disabled" unless $smarthost ne "off";
$OUT = "";
if ($userid ne "")
{
$OUT .= "[$smarthost]:$port $userid:$password\n";
}
}

View File

@@ -10,15 +10,22 @@
{
my $mail_server = $domain->prop('MailServer')
|| $DelegateMailServer
|| 'localhost';
if ( $mail_server ne 'localhost' )
{
my ($dest,$port) = split(':',$mail_server);
$port = ( $port =~ /^\d+$/)? $port : "25";
$emaildomain = $domain->key;
$OUT .= "\@$emaildomain\t$mail_server\n";
$OUT .= "$emaildomain\t smtp:[$dest]:$port\n";
}
else
{
$emaildomain = $domain->key;
$OUT .= "$emaildomain\t local:\$myhostname\n";
}
}
}

View File

@@ -0,0 +1,5 @@
{
my $smarthost = $SMTPSmartHost || "off";
$OUT = "";
$OUT = "# SME relay smarthost is defined in main.cf relayhost variable" if $SMTPSmartHost ne "off";
}

View File

@@ -0,0 +1,8 @@
{
return "# no DelegateMailServer, we are using our own smtp" unless (defined $DelegateMailServer and $DelegateMailServer);
my ($dest,$port) = split(':',$DelegateMailServer);
my $port = ( $port =~ /^\d+$/)? $port : "25";
$OUT = "* smtp:[$dest]:$port";
}

View File

@@ -0,0 +1,25 @@
{
# mailer-daemon -> postmaster -> root (via /etc/aliases) and also defined as pseudonyms
# abuse -> root (via /etc/aliases) and also defined as pseudonyms
# postmaster -> root via etc/aliases, and admin via pseudonyms
# TODO handle qmail user alias
}
# SME system users
root admin
{
$OUT = "";
use esmith::AccountsDB;
my $adb = esmith::AccountsDB->open_ro or die "Couldn't open AccountsDB";
for my $acct ($adb->get_all_by_prop(type=>"system"))
{
next if ($acct->key eq "admin");
next if ($acct->key eq "alias");
next if ($acct->key eq "shared");
next if ($acct->key eq "root");
$OUT .= $acct->key . "\t\t\tadmin\n";
}
}

View File

@@ -0,0 +1,3 @@
# SME users
# not needed postfix will map all system users directly

View File

@@ -1,3 +1,4 @@
# SME pseudonyms
{
my $dms = $DelegateMailServer;
@@ -11,16 +12,16 @@
for my $pseudo ($adb->pseudonyms)
{
#next unless ($pseudo->key =~ /@/);
#next unless ($pseudo->key =~ /@/);
my $account = $pseudo->prop("Account");
$account = "admin" and warn $pseudo->prop("Account") . " is not a valid account, default to admin " unless $adb->get($account);
my $acct = $adb->get($account);
if ($acct->prop('type') eq "group")
{
$account =~ s/\./:/g;
}
my $account = $pseudo->prop("Account");
$account = "admin" and warn $pseudo->prop("Account") . " is not a valid account, default to admin " unless $adb->get($account);
my $acct = $adb->get($account);
if ($acct->prop('type') eq "group")
{
$account =~ s/\./:/g;
}
$OUT .= $pseudo->key . "\t$account\n";
$OUT .= $pseudo->key . "\t\t\t$account\n";
}
}

View File

@@ -0,0 +1,30 @@
# SME groups
{
# inspired from former /etc/e-smith/events/actions/qmail-update-group
my $adb = esmith::AccountsDB->open_ro or die "Couldn't open AccountsDB";
for my $group ($adb->groups)
{
#next unless ($pseudo->key =~ /@/);
my %properties = $group->props;
my $acct = $group->key;
my @group_members = split(/,/, $properties{Members});
# Check if we should exclude members from this group email address
my @exclude_users = split(/,/, ($properties{EmailExcludeUsers} || ''));
my @exclude_groups = split(/,/, ($properties{EmailExcludeGroups} || ''));
foreach my $exclude_group (@exclude_groups){
my $g = $a->get($exclude_group);
next unless $g;
push @exclude_users, split(/,/, ($g->prop('Members') || ''));
}
my %exclude = map { $_, 1 } @exclude_users;
@exclude_users = keys %exclude;
my @members = ();
foreach my $user (@group_members){
next if grep { $_ eq $user } @exclude_users;
push @members, $user;
}
my $members = join(' ', @members);
$OUT .= "$acct\t\t\t$members\n";
}
}

View File

@@ -0,0 +1,14 @@
# Shared group
{
use esmith::AccountsDB;
my $a = esmith::AccountsDB->open_ro;
$OUT = "shared\t\t\t";
for my $user ( $a->get('admin'), $a->users )
{
next if ( ($user->prop('EveryoneEmail') || 'yes') eq 'no');
$OUT .= $user->key . " ";
}
}

0
root/etc/postfix/ssl/.gitignore vendored Normal file
View File

View File

@@ -0,0 +1,11 @@
#!/bin/bash
/usr/sbin/e-smith/expand-template /etc/postfix/virtual
/usr/sbin/e-smith/expand-template /etc/postfix/sasl_passwd
/usr/sbin/e-smith/expand-template /etc/postfix/transport
# sensitive file, we want to be sure.
touch /etc/postfix/sasl_passwd.db
chmod 0600 /etc/postfix/sasl_passwd.db
chown root:root /etc/postfix/sasl_passwd.db
/usr/sbin/postmap /etc/postfix/virtual
/usr/sbin/postmap /etc/postfix/sasl_passwd
/usr/sbin/postmap /etc/postfix/transport

View File

@@ -0,0 +1,12 @@
#!/bin/bash
/usr/sbin/e-smith/expand-template /etc/postfix/virtual
/usr/sbin/e-smith/expand-template /etc/postfix/sasl_passwd
/usr/sbin/e-smith/expand-template /etc/postfix/transport
# sensitive file, we want to be sure.
touch /etc/postfix/sasl_passwd.db
chmod 0600 /etc/postfix/sasl_passwd.db
chown root:root /etc/postfix/sasl_passwd.db
/usr/sbin/postmap /etc/postfix/virtual
/usr/sbin/postmap /etc/postfix/sasl_passwd
/usr/sbin/postmap /etc/postfix/transport
/usr/sbin/postfix reload

125
root/usr/bin/dotqmail Normal file
View File

@@ -0,0 +1,125 @@
#!/usr//bin/zsh -f
# credit https://www.gentei.org/~yuuji/software/dotqmail/
# original work of HIROSE Yuuji yuuji@example.org
# license none
setopt multios
dotqm=${DOTQMAIL:-.qmail}
DQHOME=${DQHOME:-$HOME}
cd $DQHOME
DEFAULTSPOOL=./Maildir/
PATH=${PATH}:/usr/sbin:/usr/lib; export PATH
if [ -s $DQHOME/.dotqmailexts ]; then
while IFS=: read ext home; do
home=${home/\~\//$HOME/}
home=${(e)home}
case $EXTENSION in
$ext|${ext}-*)
if [ -d $home ]; then
DQHOME=`(cd $home; pwd)`; break
fi ;;
esac
done < $DQHOME/.dotqmailexts
fi
DQBASE=$DQHOME/${dotqm}-
cd $DQHOME
export EXT=${EXTENSION//+/-}
export EXT2=${${(M)EXT%%-*}/-/}
export EXT3=${${(M)EXT2%%-*}/-/}
export EXT4=${${(M)EXT3%%-*}/-/}
# $HOST manipulation is not symmetrical with $EXT
# If $HOSTn has no dots, $HOST(n+1) has same name as $HOSTn
export HOST=$DOMAIN
export HOST2=${HOST%.*}
export HOST3=${HOST2%.*}
export HOST4=${HOST3%.*}
fdq=''
x=${(L)EXT//./:}
dq=${DQBASE}$x
function maildirmake() {
mkdir -m 700 $1 && mkdir -m 700 $1/{new,cur,tmp}
}
[[ -n "$DEBUG" ]] && echo PPP:dq=$dq >> $HOME/ddebug
if [[ $USER == $LOCAL ]]; then
fdq=$DQHOME/${1:-${dotqm}}
[[ -s $fdq ]] || echo "$DEFAULTSPOOL" > $fdq
elif [[ -s $dq ]]; then
fdq=$dq
else
while [[ x"$x" != x"" ]]; do
x=${${(M)x##*-}%-}
dq=${DQBASE}$x${x:+-}default
if [[ -s $dq ]]; then
fdq=$dq; break
fi
done
dq=${DQBASE}$x${x:+-}default
if [[ -s $dq ]]; then
fdq=$dq
fi
fi
function maildir() {
[[ -d $1 ]] || maildirmake $1
dir=$1/new
host=`hostname`
zmodload zsh/datetime || exit 111
(echo -n "$RPLINE"; cat) > $dir/$EPOCHSECONDS.$$.$host
}
function mbox() {
# no locking! do not use poor mbox!
(echo -n $UFLINE
echo -n $RPLINE
cat
echo) >> $1
}
flush() {
[[ -n "$DEBUG" ]] && echo out=$out >> $HOME/ddebug
###echo found: $fdq, default: $DEFAULT, out=$out
[[ -n "$DEBUG" ]] && env > $DQHOME/ENV
#eval "cat ${out:->/dev/null}"
eval "echo '$body' | sed 1,2d ${out:->/dev/null}"
out=""
}
[[ -n "$DEBUG" ]] && echo fdq=$fdq >> $HOME/ddebug
if [[ -n "$fdq" && -s $fdq ]]; then
default=${EXT/$x/}
[[ x"$default" != x"" ]] && export DEFAULT=${default#-}
IFS= body=`cat`
export UFLINE="${${(@f)body}[1]}"$'\n'
export RPLINE="${${(@f)body}[2]}"$'\n'
if [[ -e ${fdq}-owner ]]; then
# If .qmail-ext-owner exists, use local-owner@domain. (dot-qmail(5))
newsender="-f ${LOCAL}-owner@$DOMAIN "
echo newsender=$newsender >> $HOME/ddebug
fi
cat $fdq | while read -r line; do
case "$line" in
\#*) ;;
\|*)
# A program line should executed sequentially and should be
# ceased further instructions when program exits at 99.
[ "$out" ] && flush
echo "$body" | eval "${line#\|}"
[ $? = 99 ] && exit 0
;;
# Other instructions should be processed simultaneously.
.*/|/*/)
out="$out > >(maildir $line)" ;;
.*|/*)
out="$out > >(mbox $line)" ;;
*)
out="$out > >(sendmail ${newsender}-- ${line#\&})" ;;
esac
ec=$?
[[ -n "$DEBUG" ]] && echo "$ec by [$line]" >> $HOME/ddebug
done
flush
exit 0
else
# not found
exit 111
fi

View File

@@ -0,0 +1,14 @@
#!/bin/sh
#credit Ron Bickers <rbickers@logicetc.com>
# $1 = $LOCAL
# $2 = $EXTENSION
# $3 = $DOMAIN
# $4 = $SENDER
export PATH=$PATH:/usr/local/bin:/var/qmail/bin
tail +2 | seekablepipe qmail-local -- \
"$USER" "$HOME" "$LOCAL" "${EXTENSION:+-}" "$EXTENSION"
"$DOMAIN""$SENDER" ./Maildir/
e=$?
(($e == 111)) && exit 75
(($e == 100)) && exit 77
exit $e

View File

@@ -0,0 +1,6 @@
[Service]
ExecStartPre=-/usr/sbin/postmap /etc/postfix/virtual
ExecStartPre=/sbin/e-smith/service-status postfix
[Install]
WantedBy=sme-server.target