web-based administrative UI

closes #19

README.md

@@ -27,11 +27,7 @@ In short, it's like this:
 	cd mailinabox
 	sudo setup/start.sh
 
-Then run the post-install checklist command to see what you need to do next:
-
-	sudo management/whats_next.py
-
-Congratulations! You should now have a working setup. Feel free to login with your mail credentials created earlier in the setup
+Congratulations! You should now have a working setup. You'll be given the address of the administrative interface for further instructions.
 
 **Status**: This is a work in progress. It works for what it is, but it is missing such things as quotas, backup/restore, etc.
 

conf/nginx.conf

@@ -24,6 +24,12 @@ server {
 	root $ROOT;
 	index index.html index.htm;
 
+	# Control Panel
+	rewrite ^/admin$ /admin/;
+	location /admin/ {
+		proxy_pass http://localhost:10222/;
+	}
+
 	# Roundcube Webmail configuration.
 	rewrite ^/mail$ /mail/ redirect;
 	rewrite ^/mail/$ /mail/index.php;

management/auth.py

@@ -2,6 +2,9 @@ import base64, os, os.path
 
 from flask import make_response
 
+import utils
+from mailconfig import get_mail_user_privileges
+
 DEFAULT_KEY_PATH   = '/var/lib/mailinabox/api.key'
 DEFAULT_AUTH_REALM = 'Mail-in-a-Box Management Server'
 
@@ -37,37 +40,69 @@ class KeyAuthService:
 		with create_file_with_mode(self.key_path, 0o640) as key_file:
 			key_file.write(self.key + '\n')
 
-	def is_authenticated(self, request):
-		"""Test if the client key passed in HTTP header matches the service key"""
+	def is_authenticated(self, request, env):
+		"""Test if the client key passed in HTTP Authorization header matches the service key
+		or if the or username/password passed in the header matches an administrator user.
+		Returns 'OK' if the key is good or the user is an administrator, otherwise an error message."""
 
 		def decode(s):
-			return base64.b64decode(s.encode('utf-8')).decode('ascii')
-
-		def parse_api_key(header):
-			if header is None:
-				return
+			return base64.b64decode(s.encode('ascii')).decode('ascii')
 
+		def parse_basic_auth(header):
 			if " " not in header:
-				return
+				return None, None
 			scheme, credentials = header.split(maxsplit=1)
 			if scheme != 'Basic':
-				return
+				return None, None
 
 			credentials = decode(credentials)
 			if ":" not in credentials:
-				return
+				return None, None
 			username, password = credentials.split(':', maxsplit=1)
-			return username
-
-		request_key = parse_api_key(request.headers.get('Authorization'))
-
-		return request_key == self.key
-
-	def make_unauthorized_response(self):
-		return make_response(
-			'You must pass the API key from "{0}" as the username\n'.format(self.key_path),
-			401,
-			{ 'WWW-Authenticate': 'Basic realm="{0}"'.format(self.auth_realm) })
+			return username, password
+
+		header = request.headers.get('Authorization')
+		if not header:
+			return "No authorization header provided."
+
+		username, password = parse_basic_auth(header)
+
+		if username in (None, ""):
+			return "Authorization header invalid."
+		elif username == self.key:
+			return "OK"
+		else:
+			return self.check_imap_login( username, password, env)
+
+	def check_imap_login(self, email, pw, env):
+		# Validate a user's credentials.
+
+		# Sanity check.
+		if email == "" or pw == "":
+			return "Enter an email address and password."
+
+		# Authenticate.
+		try:
+			# Use doveadm to check credentials. doveadm will return
+			# a non-zero exit status if the credentials are no good,
+			# and check_call will raise an exception in that case.
+			utils.shell('check_call', [
+				"/usr/bin/doveadm",
+				"auth", "test",
+				email, pw
+				])
+		except:
+			# Login failed.
+			return "Invalid email address or password."
+
+		# Authorize.
+		# (This call should never fail on a valid user.)
+		privs = get_mail_user_privileges(email, env)
+		if isinstance(privs, tuple): raise Exception("Error getting privileges.")
+		if "admin" not in privs:
+			return "You are not an administrator for this system."
+
+		return "OK"
 
 	def _generate_key(self):
 		raw_key = os.urandom(32)

management/daemon.py

@@ -2,11 +2,12 @@
 
 import os, os.path, re, json
 
+from functools import wraps
+
 from flask import Flask, request, render_template, abort, Response
-app = Flask(__name__)
 
 import auth, utils
-from mailconfig import get_mail_users, add_mail_user, set_mail_password, remove_mail_user
+from mailconfig import get_mail_users, add_mail_user, set_mail_password, remove_mail_user, get_archived_mail_users
 from mailconfig import get_mail_user_privileges, add_remove_mail_user_privilege
 from mailconfig import get_mail_aliases, get_mail_domains, add_mail_alias, remove_mail_alias
 
@@ -14,76 +15,156 @@ env = utils.load_environment()
 
 auth_service = auth.KeyAuthService()
 
-@app.before_request
-def require_auth_key():
-	if not auth_service.is_authenticated(request):
-		abort(401)
+# We may deploy via a symbolic link, which confuses flask's template finding.
+me = __file__
+try:
+	me = os.readlink(__file__)
+except OSError:
+	pass
+
+app = Flask(__name__, template_folder=os.path.abspath(os.path.join(os.path.dirname(me), "templates")))
+
+# Decorator to protect views that require authentication.
+def authorized_personnel_only(viewfunc):
+	@wraps(viewfunc)
+	def newview(*args, **kwargs):
+		# Check if the user is authorized.
+		authorized_status = auth_service.is_authenticated(request, env)
+		if authorized_status == "OK":
+			# Authorized. Call view func.	
+			return viewfunc(*args, **kwargs)
+
+		# Not authorized. Return a 401 (send auth) and a prompt to authorize by default.
+		status = 401
+		headers = { 'WWW-Authenticate': 'Basic realm="{0}"'.format(auth_service.auth_realm) }
+
+		if request.headers.get('X-Requested-With') == 'XMLHttpRequest':
+			# Don't issue a 401 to an AJAX request because the user will
+			# be prompted for credentials, which is not helpful.
+			status = 403
+			headers = None
+
+		if request.headers.get('Accept') in (None, "", "*/*"):
+			# Return plain text output.
+			return Response(authorized_status+"\n", status=status, mimetype='text/plain', headers=headers)
+		else:
+			# Return JSON output.
+			return Response(json.dumps({
+				"status": "error",
+				"reason": authorized_status
+				}+"\n"), status=status, mimetype='application/json', headers=headers)
+
+	return newview
 
 @app.errorhandler(401)
 def unauthorized(error):
 	return auth_service.make_unauthorized_response()
 
+def json_response(data):
+	return Response(json.dumps(data), status=200, mimetype='application/json')
+
+###################################
+
+# Control Panel (unauthenticated views)
+
 @app.route('/')
 def index():
-    return render_template('index.html')
+	# Render the control panel. This route does not require user authentication
+	# so it must be safe!
+	return render_template('index.html',
+		hostname=env['PRIMARY_HOSTNAME'],
+	)
+
+@app.route('/me')
+def me():
+	# Is the caller authorized?
+	authorized_status = auth_service.is_authenticated(request, env)
+	if authorized_status != "OK":
+		return json_response({
+			"status": "not-authorized",
+			"reason": authorized_status,
+			})
+	return json_response({
+		"status": "authorized",
+		"api_key": auth_service.key,
+		})
 
 # MAIL
 
 @app.route('/mail/users')
+@authorized_personnel_only
 def mail_users():
 	if request.args.get("format", "") == "json":
-		users = get_mail_users(env, as_json=True)
-		return Response(json.dumps(users), status=200, mimetype='application/json')
+		return json_response(get_mail_users(env, as_json=True) + get_archived_mail_users(env))
 	else:
 		return "".join(x+"\n" for x in get_mail_users(env))
 
 @app.route('/mail/users/add', methods=['POST'])
+@authorized_personnel_only
 def mail_users_add():
-	return add_mail_user(request.form.get('email', ''), request.form.get('password', ''), env)
+	return add_mail_user(request.form.get('email', ''), request.form.get('password', ''), request.form.get('privileges', ''), env)
 
 @app.route('/mail/users/password', methods=['POST'])
+@authorized_personnel_only
 def mail_users_password():
 	return set_mail_password(request.form.get('email', ''), request.form.get('password', ''), env)
 
 @app.route('/mail/users/remove', methods=['POST'])
+@authorized_personnel_only
 def mail_users_remove():
 	return remove_mail_user(request.form.get('email', ''), env)
 
 
 @app.route('/mail/users/privileges')
+@authorized_personnel_only
 def mail_user_privs():
 	privs = get_mail_user_privileges(request.args.get('email', ''), env)
 	if isinstance(privs, tuple): return privs # error
 	return "\n".join(privs)
 
 @app.route('/mail/users/privileges/add', methods=['POST'])
+@authorized_personnel_only
 def mail_user_privs_add():
 	return add_remove_mail_user_privilege(request.form.get('email', ''), request.form.get('privilege', ''), "add", env)
 
 @app.route('/mail/users/privileges/remove', methods=['POST'])
+@authorized_personnel_only
 def mail_user_privs_remove():
 	return add_remove_mail_user_privilege(request.form.get('email', ''), request.form.get('privilege', ''), "remove", env)
 
 
 @app.route('/mail/aliases')
+@authorized_personnel_only
 def mail_aliases():
-    return "".join(x+"\t"+y+"\n" for x, y in get_mail_aliases(env))
+	if request.args.get("format", "") == "json":
+		return json_response(get_mail_aliases(env, as_json=True))
+	else:
+		return "".join(x+"\t"+y+"\n" for x, y in get_mail_aliases(env))
 
 @app.route('/mail/aliases/add', methods=['POST'])
+@authorized_personnel_only
 def mail_aliases_add():
-	return add_mail_alias(request.form.get('source', ''), request.form.get('destination', ''), env)
+	return add_mail_alias(
+		request.form.get('source', ''),
+		request.form.get('destination', ''),
+		env,
+		update_if_exists=(request.form.get('update_if_exists', '') == '1')
+		)
 
 @app.route('/mail/aliases/remove', methods=['POST'])
+@authorized_personnel_only
 def mail_aliases_remove():
 	return remove_mail_alias(request.form.get('source', ''), env)
 
 @app.route('/mail/domains')
+@authorized_personnel_only
 def mail_domains():
     return "".join(x+"\n" for x in get_mail_domains(env))
 
 # DNS
 
 @app.route('/dns/update', methods=['POST'])
+@authorized_personnel_only
 def dns_update():
 	from dns_update import do_dns_update
 	try:
@@ -91,24 +172,43 @@ def dns_update():
 	except Exception as e:
 		return (str(e), 500)
 
-@app.route('/dns/ds')
-def dns_get_ds_records():
-	from dns_update import get_ds_records
-	try:
-		return get_ds_records(env).replace("\t", " ") # tabs confuse godaddy
-	except Exception as e:
-		return (str(e), 500)
+@app.route('/dns/dump')
+@authorized_personnel_only
+def dns_get_dump():
+	from dns_update import build_recommended_dns
+	return json_response(build_recommended_dns(env))
 
 # WEB
 
 @app.route('/web/update', methods=['POST'])
+@authorized_personnel_only
 def web_update():
 	from web_update import do_web_update
 	return do_web_update(env)
 
 # System
 
+@app.route('/system/status', methods=["POST"])
+@authorized_personnel_only
+def system_status():
+	from whats_next import run_checks
+	class WebOutput:
+		def __init__(self):
+			self.items = []
+		def add_heading(self, heading):
+			self.items.append({ "type": "heading", "text": heading, "extra": [] })
+		def print_ok(self, message):
+			self.items.append({ "type": "ok", "text": message, "extra": [] })
+		def print_error(self, message):
+			self.items.append({ "type": "error", "text": message, "extra": [] })
+		def print_line(self, message, monospace=False):
+			self.items[-1]["extra"].append({ "text": message, "monospace": monospace })
+	output = WebOutput()
+	run_checks(env, output)
+	return json_response(output.items)
+
 @app.route('/system/updates')
+@authorized_personnel_only
 def show_updates():
 	utils.shell("check_call", ["/usr/bin/apt-get", "-qq", "update"])
 	simulated_install = utils.shell("check_output", ["/usr/bin/apt-get", "-qq", "-s", "upgrade"])
@@ -120,6 +220,7 @@ def show_updates():
 	return "\n".join(pkgs)
 
 @app.route('/system/update-packages', methods=["POST"])
+@authorized_personnel_only
 def do_updates():
 	utils.shell("check_call", ["/usr/bin/apt-get", "-qq", "update"])
 	return utils.shell("check_output", ["/usr/bin/apt-get", "-y", "upgrade"], env={
@@ -130,6 +231,7 @@ def do_updates():
 
 if __name__ == '__main__':
 	if "DEBUG" in os.environ: app.debug = True
+	if "APIKEY" in os.environ: auth_service.key = os.environ["APIKEY"]
 
 	if not app.debug:
 		app.logger.addHandler(utils.create_syslog_handler())

management/dns_update.py

@@ -160,11 +160,11 @@ def build_zone(domain, all_domains, additional_records, env, is_zone=True):
 		records.append(("_25._tcp", "TLSA", build_tlsa_record(env), "Recommended when DNSSEC is enabled. Advertises to mail servers connecting to the box that mandatory encryption should be used."))
 
 	# The MX record says where email for the domain should be delivered: Here!
-	records.append((None,  "MX",  "10 %s." % env["PRIMARY_HOSTNAME"], "Required. Specifies the hostname of the machine that handles @%s mail." % domain))
+	records.append((None,  "MX",  "10 %s." % env["PRIMARY_HOSTNAME"], "Required. Specifies the hostname (and priority) of the machine that handles @%s mail." % domain))
 
 	# SPF record: Permit the box ('mx', see above) to send mail on behalf of
 	# the domain, and no one else.
-	records.append((None,  "TXT", '"v=spf1 mx -all"', "Recomended. Specifies that only the box is permitted to send @%s mail." % domain))
+	records.append((None,  "TXT", '"v=spf1 mx -all"', "Recommended. Specifies that only the box is permitted to send @%s mail." % domain))
 
 	# Add DNS records for any subdomains of this domain. We should not have a zone for
 	# both a domain and one of its subdomains.
@@ -192,9 +192,9 @@ def build_zone(domain, all_domains, additional_records, env, is_zone=True):
 
 	# Add defaults if not overridden by the user's custom settings.
 	defaults = [
-		(None,  "A",    env["PUBLIC_IP"],       "Optional. Sets the IP address that %s resolves to, e.g. for web hosting." % domain),
+		(None,  "A",    env["PUBLIC_IP"],       "Optional. Sets the IP address that %s resolves to, e.g. for web hosting. (It is not necessary for receiving mail on this domain.)" % domain),
 		("www", "A",    env["PUBLIC_IP"],       "Optional. Sets the IP address that www.%s resolves to, e.g. for web hosting." % domain),
-		(None,  "AAAA", env.get('PUBLIC_IPV6'), "Optional. Sets the IPv6 address that %s resolves to, e.g. for web hosting." % domain),
+		(None,  "AAAA", env.get('PUBLIC_IPV6'), "Optional. Sets the IPv6 address that %s resolves to, e.g. for web hosting. (It is not necessary for receiving mail on this domain.)" % domain),
 		("www", "AAAA", env.get('PUBLIC_IPV6'), "Optional. Sets the IPv6 address that www.%s resolves to, e.g. for web hosting." % domain),
 	]
 	for qname, rtype, value, explanation in defaults:
@@ -209,7 +209,7 @@ def build_zone(domain, all_domains, additional_records, env, is_zone=True):
 		# Append the DKIM TXT record to the zone as generated by OpenDKIM, after string formatting above.
 		with open(opendkim_record_file) as orf:
 			m = re.match(r"(\S+)\s+IN\s+TXT\s+(\(.*\))\s*;", orf.read(), re.S)
-			records.append((m.group(1), "TXT", m.group(2), "Recommended. Specifies that only the box is permitted to send mail at this domain."))
+			records.append((m.group(1), "TXT", m.group(2), "Recommended. Provides a way for recipients to verify that this machine sent @%s mail." % domain))
 
 		# Append a DMARC record.
 		records.append(("_dmarc", "TXT", '"v=DMARC1; p=quarantine"', "Optional. Specifies that mail that does not originate from the box but claims to be from @%s is suspect and should be quarantined by the recipient's mail system." % domain))
@@ -496,19 +496,6 @@ def sign_zone(domain, zonefile, env):
 	# Remove our temporary file.
 	for fn in files_to_kill:
 		os.unlink(fn)
-
-########################################################################
-
-def get_ds_records(env):
-	zonefiles = get_dns_zones(env)
-	ret = ""
-	for domain, zonefile in zonefiles:
-		fn = "/etc/nsd/zones/" + zonefile + ".ds"
-		if os.path.exists(fn):
-			with open(fn, "r") as fr:
-				ret += fr.read().strip() + "\n"
-	return ret
-	
 	
 ########################################################################
 
@@ -605,9 +592,8 @@ def justtestingdotemail(domain, records):
 
 ########################################################################
 
-if __name__ == "__main__":
-	from utils import load_environment
-	env = load_environment()
+def build_recommended_dns(env):
+	ret = []
 	domains = get_dns_domains(env)
 	zonefiles = get_dns_zones(env)
 	for domain, zonefile in zonefiles:
@@ -616,15 +602,32 @@ if __name__ == "__main__":
 		# remove records that we don't dislay
 		records = [r for r in records if r[3] is not False]
 
-		# put Required at the top
+		# put Required at the top, then Recommended, then everythiing else
 		records.sort(key = lambda r : 0 if r[3].startswith("Required.") else (1 if r[3].startswith("Recommended.") else 2))
 
-		# print
-		for qname, rtype, value, explanation in records:
-			print("; " + explanation)
-			if qname == None:
+		# expand qnames
+		for i in range(len(records)):
+			if records[i][0] == None:
 				qname = domain
 			else:
-				qname = qname + "." + domain
-			print(qname, rtype, value)
+				qname = records[i][0] + "." + domain
+
+			records[i] = {
+				"qname": qname,
+				"rtype": records[i][1],
+				"value": records[i][2],
+				"explanation": records[i][3],
+			}
+
+		# return
+		ret.append((domain, records))
+	return ret
+
+if __name__ == "__main__":
+	from utils import load_environment
+	env = load_environment()
+	for zone, records in build_recommended_dns(env):
+		for record in records:
+			print("; " + record['explanation'])
+			print(record['qname'], record['rtype'], record['value'], sep="\t")
 			print()

management/templates/aliases.html

+<style>
+#alias_table .actions > * { padding-right: 3px; }
+#alias_table .alias-required .remove { display: none }
+</style>
+
+<h2>Aliases</h2>
+
+<h3>Add a mail alias</h3>
+
+<p>Aliases are email forwarders. An alias can forward email to a <a href="javascript:show_panel('users')">mail user</a> or to any email address.</p>
+
+<form class="form-horizontal" role="form" onsubmit="do_add_alias(); return false;">
+  <div class="form-group">
+    <label for="addaliasEmail" class="col-sm-2 control-label">Email Address</label>
+    <div class="col-sm-10">
+      <input type="email" class="form-control" id="addaliasEmail" placeholder="Incoming Email Address">
+    </div>
+  </div>
+  <div class="form-group">
+    <label for="addaliasTargets" class="col-sm-2 control-label">Forward To</label>
+    <div class="col-sm-10">
+      <textarea class="form-control" rows="3" id="addaliasTargets" placeholder="Forward to these email addresses (one per line or separated by commas)"></textarea>
+    </div>
+  </div>
+  <div class="form-group">
+    <div class="col-sm-offset-2 col-sm-10">
+      <button id="add-alias-button" type="submit" class="btn btn-primary">Add</button>
+      <button id="alias-cancel" class="btn btn-default hidden" onclick="aliases_reset_form(); return false;">Cancel</button>
+    </div>
+  </div>
+</form>
+
+<h3>Existing mail aliases</h3>
+<table id="alias_table" class="table" style="width: auto">
+  <thead>
+    <tr>
+      <th></th>
+      <th>Email Address<br></th>
+      <th>Forwards To</th>
+    </tr>
+  </thead>
+  <tbody>
+  </tbody>
+</table>
+
+<p style="margin-top: 1.5em"><small>Hostmaster@, postmaster@, and admin@ email addresses are required on some domains.</small></p>
+
+<div style="display: none">
+  <table>
+  <tr id="alias-template">
+    <td class='actions'>
+        <a href="#" onclick="aliases_edit(this); return false;" class='edit' title="Edit Alias">
+          <span class="glyphicon glyphicon-pencil"></span>
+        </a>
+        <a href="#" onclick="aliases_remove(this); return false;" class='remove' title="Remove Alias">
+          <span class="glyphicon glyphicon-trash"></span>
+        </a>
+    </td>
+    <td class='email'> </td>
+    <td class='target'> </td>
+  </tr>
+  </table>
+</div>
+
+
+<script>
+function show_aliases() {
+  $('#alias_table tbody').html("<tr><td colspan='2' class='text-muted'>Loading...</td></tr>")
+  api(
+    "/mail/aliases",
+    "GET",
+    { format: 'json' },
+    function(r) {
+      $('#alias_table tbody').html("");
+      for (var i = 0; i < r.length; i++) {
+        var n = $("#alias-template").clone();
+        n.attr('id', '');
+
+        if (r[i].required) n.addClass('alias-required');
+        n.attr('data-email', r[i].source);
+        n.find('td.email').text(r[i].source)
+        for (var j = 0; j < r[i].destination.length; j++)
+          n.find('td.target').append($("<div></div>").text(r[i].destination[j]))
+        $('#alias_table tbody').append(n);
+      }
+    })
+}
+
+var is_alias_add_update = false;
+function do_add_alias() {
+  var title = (!is_alias_add_update) ? "Add Alias" : "Update Alias";
+  var email = $("#addaliasEmail").val();
+  var targets = $("#addaliasTargets").val();
+  api(
+    "/mail/aliases/add",
+    "POST",
+    {
+      update_if_exists: is_alias_add_update ? '1' : '0',
+      source: email,
+      destination: targets
+    },
+    function(r) {
+      // Responses are multiple lines of pre-formatted text.
+      show_modal_error(title, $("<pre/>").text(r));
+      show_aliases()
+      aliases_reset_form();
+    },
+    function(r) {
+      show_modal_error(title, r);
+    });
+  return false;
+}
+
+function aliases_reset_form() {
+  $("#addaliasEmail").prop('disabled', false);
+  $("#addaliasEmail").val('')
+  $("#addaliasTargets").val('')
+  $('#alias-cancel').addClass('hidden');
+  $('#add-alias-button').text('Add');
+  is_alias_add_update = false;
+}
+
+function aliases_edit(elem) {
+  var email = $(elem).parents('tr').attr('data-email');
+  var targetdivs = $(elem).parents('tr').find('.target div');
+  var targets = "";
+  for (var i = 0; i < targetdivs.length; i++)
+    targets += $(targetdivs[i]).text() + "\n";
+
+  is_alias_add_update = true;
+  $('#alias-cancel').removeClass('hidden');
+  $("#addaliasEmail").prop('disabled', true);
+  $("#addaliasEmail").val(email);
+  $("#addaliasTargets").val(targets);
+  $('#add-alias-button').text('Update');
+  $('body').animate({ scrollTop: 0 })
+}
+
+function aliases_remove(elem) {
+  var email = $(elem).parents('tr').attr('data-email');
+  show_modal_confirm(
+    "Remove Alias",
+    "Remove " + email + "?",
+    "Remove",
+    function() {
+      api(
+        "/mail/aliases/remove",
+        "POST",
+        {
+          source: email
+        },
+        function(r) {
+          // Responses are multiple lines of pre-formatted text.
+          show_modal_error("Remove User", $("<pre/>").text(r));
+          show_aliases();
+        });
+    });
+}
+</script>
\ No newline at end of file

management/templates/login.html

+<div class="row">
+  <div class="col-sm-offset-2 col-sm-8 col-md-offset-3 col-md-6 col-lg-offset-4 col-lg-4">
+    <center>
+      <h1 style="margin: 1em">{{hostname}}</h1>
+      <p style="margin: 2em">Log in here for your Mail-in-a-Box control panel.</p>
+    </center>
+
+  <form class="form-horizontal" role="form" onsubmit="do_login(); return false;">
+    <div class="form-group">
+      <label for="inputEmail3" class="col-sm-2 control-label">Email</label>
+      <div class="col-sm-10">
+        <input name="email" type="email" class="form-control" id="loginEmail" placeholder="Email">
+      </div>
+    </div>
+    <div class="form-group">
+      <label for="inputPassword3" class="col-sm-2 control-label">Password</label>
+      <div class="col-sm-10">
+        <input name="password" type="password" class="form-control" id="loginPassword" placeholder="Password">
+      </div>
+    </div>
+    <div class="form-group">
+      <div class="col-sm-offset-2 col-sm-10">
+        <div class="checkbox">
+          <label>
+            <input name='remember' type="checkbox" id="loginRemember"> Remember me
+          </label>
+        </div>
+      </div>
+    </div>
+    <div class="form-group">
+      <div class="col-sm-offset-2 col-sm-10">
+        <button type="submit" class="btn btn-default">Sign in</button>
+      </div>
+    </div>
+  </form>
+  </div>
+</div>
+
+<script>
+function do_login() {
+  if ($('#loginEmail').val() == "") {
+    show_modal_error("Login Failed", "Enter your email address.")
+    return false;
+  }
+  if ($('#loginPassword').val() == "") {
+    show_modal_error("Login Failed", "Enter your email password.")
+    return false;
+  }
+
+  // Exchange the email address & password for an API key.
+  api_credentials = [$('#loginEmail').val(), $('#loginPassword').val()]
+
+  api(
+  "/me",
+  "GET",
+  { },
+  function(response){ 
+    // This API call always succeeds. It returns a JSON object indicating
+    // whether the request was authenticated or not.
+    if (response.status != "authorized") {
+      // Show why the login failed.
+      show_modal_error("Login Failed", response.reason)
+
+      // Reset any saved credentials.
+      do_logout();
+
+    } else {
+      // Login succeeded.
+
+      // Save the new credentials.
+      api_credentials = [response.api_key, ""];
+
+      // Try to wipe the username/password information.
+      $('#loginEmail').val('');
+      $('#loginPassword').val('');
+
+      // Remember the credentials.
+      if (typeof localStorage != 'undefined' && typeof sessionStorage != 'undefined') {
+        if ($('#loginRemember').val()) {
+          localStorage.setItem("miab-cp-credentials", api_credentials.join(":"));
+          sessionStorage.removeItem("miab-cp-credentials");
+        } else {
+          localStorage.removeItem("miab-cp-credentials");
+          sessionStorage.setItem("miab-cp-credentials", api_credentials.join(":"));
+        }
+      }
+
+      // Open the next panel the user wants to go to.
+      show_panel(!switch_back_to_panel ? 'system_status' : switch_back_to_panel)
+    }
+  })
+}
+
+function do_logout() {
+  api_credentials = ["", ""];
+  if (typeof localStorage != 'undefined')
+    localStorage.removeItem("miab-cp-credentials");
+  if (typeof sessionStorage != 'undefined')
+    sessionStorage.removeItem("miab-cp-credentials");
+  show_panel('login');
+}
+</script>

management/templates/mail-guide.html

+<div class="container">
+	<h2>Checking and Sending Mail</h2>
+
+	<h4>App Configuration</h4>
+
+	<p>You can access your email using webmail, desktop mail clients, or mobile apps.</p>
+
+	<p>Here is what you need to know for webmail:</p>
+
+	<style>#panel_mail-guide table.table { width: auto; margin-left: 1.5em; }</style>
+
+	<table class="table">
+	<tr><th>Webmail Address:</th> <td><a href="https://{{hostname}}/mail"><b>https://{{hostname}}/mail</b></a></td></tr>
+	<tr><th>Username:</th> <td>Your whole email address.</td></tr>
+	<tr><th>Password:</th> <td>Your mail password.</td></tr>
+	</table>
+
+	<p>On mobile devices you might need to install a &ldquo;mail client&rdquo; app. We recommend <a href="https://play.google.com/store/apps/details?id=com.fsck.k9">K-9 Mail</a>. On a desktop you could try <a href="https://www.mozilla.org/en-US/thunderbird/">Mozilla Thunderbird</a>.</p>
+
+	<p>Configure your device or desktop mail client as follows:</p>
+
+	<table class="table" style="max-width: 30em">
+	<tr><th>Server Name:</th> <td>{{hostname}}</td></tr>
+	<tr><th>Username:</th> <td>Your whole email address.</td></tr>
+	<tr><th>Password:</th> <td>Your mail password.</td></tr>
+	</table>
+
+
+	<table class="table">
+	<thead><tr><th>Protocol</th> <th>Port</th> <th>Options</th></tr></thead>
+	<tr><th>IMAP</th> <td>993</td> <td>SSL</td></tr>
+	<tr><th>SMTP</th> <td>587</td> <td>STARTTLS</td></tr>
+	<tr><th>Exchange ActiveSync</th> <td>n/a</td> <td>Secure Connection</td></tr>
+	</table>
+
+	<p>Depending on your mail program, you will use either IMAP &amp; SMTP or Exchange ActiveSync. See this <a href="http://z-push.org/compatibility/">list of compatible devices</a> for Exchange ActiveSync.</p>
+
+	<h4>Notes</h4>
+
+	<p>Mail-in-a-Box uses <a href="http://en.wikipedia.org/wiki/Greylisting">greylisting</a> to cut down on spam. The first time you receive an email from a recipient, it may be delayed for ten minutes.</p>
+</div>

management/templates/system-external-dns.html

+<style>
+#external_dns_settings .heading td {
+  font-weight: bold;
+  font-size: 120%;
+  padding-top: 1.5em;
+}
+#external_dns_settings .heading.first td {
+  border-top: none;
+  padding-top: 0;
+}
+#external_dns_settings .values td {
+	padding-top: .75em;
+	padding-bottom: 0;
+	max-width: 50vw;
+	word-wrap: break-word;
+}
+#external_dns_settings .explanation td {
+	border: 0;
+	padding-top: .5em;
+	padding-bottom: .75em;
+	font-style: italic;
+	color: #777;
+}
+</style>
+
+<h2>External DNS</h2>
+
+<p class="text-danger">This is for advanced configurations.</p>
+
+<h3>Overview</h3>
+
+<p>Although your box is configured to serve its own DNS, it is possible to host your DNS elsewhere. We do not recommend this.</p>
+
+<p>If you do so, you are responsible for keeping your DNS entries up to date. In particular DNSSEC entries must be re-signed periodically. Do not set a DS record at your registrar or publish DNSSEC entries in your DNS zones if you do not intend to keep them up to date.</p>
+
+<h3>DNS Settings</h3>
+
+<p>Enter the following DNS entries at your DNS provider:</p>
+
+<table id="external_dns_settings" class="table">
+	<thead>
+		<tr>
+			<th>QName</th>
+			<th>Type</th>
+			<th>Value</th>
+		</tr>
+	</thead>
+	<tbody>
+	</tbody>
+</table>
+
+<script>
+function show_system_external_dns() {
+  $('#external_dns_settings tbody').html("<tr><td colspan='2' class='text-muted'>Loading...</td></tr>")
+  api(
+    "/dns/dump",
+    "GET",
+    { },
+    function(zones) {
+      $('#external_dns_settings tbody').html("");
+      for (var j = 0; j < zones.length; j++) {
+        var h = $("<tr class='heading'><td colspan='3'></td></tr>");
+        h.find("td").text(zones[j][0]);
+        $('#external_dns_settings tbody').append(h);
+
+        var r = zones[j][1];
+        for (var i = 0; i < r.length; i++) {
+          var n = $("<tr class='values'><td class='qname'/><td class='rtype'/><td class='value'/></tr>");
+          n.find('.qname').text(r[i].qname);
+          n.find('.rtype').text(r[i].rtype);
+          n.find('.value').text(r[i].value);
+          $('#external_dns_settings tbody').append(n);
+
+          var n = $("<tr class='explanation'><td colspan='3'/></tr>");
+          n.find('td').text(r[i].explanation);
+          $('#external_dns_settings tbody').append(n);
+        }
+      }
+    })
+}
+</script>

management/templates/system-status.html

+<h2>System Status Checks</h2>
+
+<style>
+#system-checks .heading td {
+  font-weight: bold;
+  font-size: 120%;
+  padding-top: 1.5em;
+}
+#system-checks .heading.first td {
+  border-top: none;
+  padding-top: 0;
+}
+#system-checks .error td {
+  color: #733;
+}
+#system-checks .ok td {
+  color: #030;
+}
+#system-checks div.extra {
+  display: none;
+  margin-top: 1em;
+  max-width: 50em;
+  word-wrap: break-word;
+}
+#system-checks a.showhide {
+  display: none;
+  font-size: 85%;
+}
+#system-checks .pre {
+  margin: 1em;
+  font-family: monospace;
+  white-space: pre-wrap;
+}
+</style>
+
+<table id="system-checks" class="table" style="max-width: 60em">
+  <thead>
+  </thead>
+  <tbody>
+  </tbody>
+</table>
+
+<script>
+function show_system_status() {
+  $('#system-checks tbody').html("<tr><td colspan='2' class='text-muted'>Loading...</td></tr>")
+  api(
+    "/system/status",
+    "POST",
+    { },
+    function(r) {
+      $('#system-checks tbody').html("");
+      for (var i = 0; i < r.length; i++) {
+        var n = $("<tr><td class='status'/><td class='message'><p style='margin: 0'/><div class='extra'/><a class='showhide' href='#'/></tr>");
+        if (i == 0) n.addClass('first')
+        n.addClass(r[i].type)
+        if (r[i].type == "ok") n.find('td.status').text("✓")
+        if (r[i].type == "error") n.find('td.status').text("✖")
+        n.find('td.message p').text(r[i].text)
+        $('#system-checks tbody').append(n);
+
+        if (r[i].extra.length > 0) {
+          n.find('a.showhide').show().text("show more").click(function() {
+            $(this).hide();
+            $(this).parent().find('.extra').fadeIn();
+            return false;
+          });
+        }
+
+        for (var j = 0; j < r[i].extra.length; j++) {
+
+          var m = $("<div/>").text(r[i].extra[j].text)
+          if (r[i].extra[j].monospace)
+            m.addClass("pre");
+          n.find('> td.message > div').append(m);
+        }
+      }
+    })
+}
+</script>
\ No newline at end of file

management/templates/users.html

+<h2>Users</h2>
+
+<style>
+#user_table tr.account_inactive td .address { color: #888; text-decoration: line-through; }
+#user_table .aliases { margin: .25em 0 0 1em; font-size: 95%; }
+#user_table .aliases div:before { content: "⇖ "; }
+#user_table .aliases div {  }
+#user_table .actions { margin: .25em 0 0 1em; font-size: 95%; }
+#user_table .actions > * { display: none; }
+#user_table .account_active .actions a.archive { display: inline; }
+#user_table .account_inactive .actions .restore { display: inline; }
+</style>
+
+<h3>Add a mail user</h3>
+
+<p>Add an email address to this system. This will create a new login username/password. (Use <a href="javascript:show_panel('aliases')">aliases</a> to create email addresses that forward to existing accounts.)</p>
+
+<form class="form-inline" role="form" onsubmit="return do_add_user(); return false;">
+  <div class="form-group">
+    <label class="sr-only" for="adduserEmail">Email address</label>
+    <input type="email" class="form-control" id="adduserEmail" placeholder="Email Address">
+  </div>
+  <div class="form-group">
+    <label class="sr-only" for="adduserPassword">Password</label>
+    <input type="password" class="form-control" id="adduserPassword" placeholder="Password">
+  </div>
+  <div class="form-group">
+    <select class="form-control" id="adduserPrivs">
+      <option value="">Normal User</option>
+      <option value="admin">Administrator</option>
+    </select>
+  </div>
+  <button type="submit" class="btn btn-primary">Add User</button>
+</form>
+<p style="margin-top: .5em"><small>
+  Passwords must be at least four characters and may not contain spaces.
+  Administrators get access to this control panel.
+</small></p>
+
+<h3>Existing mail users</h3>
+<table id="user_table" class="table" style="width: auto">
+  <thead>
+    <tr>
+      <th></th>
+      <th>Email Address<br><small style="font-weight: normal">(Also the user&rsquo;s login username.)</small></th>
+      <th>Privileges</th>
+    </tr>
+  </thead>
+  <tbody>
+  </tbody>
+</table>
+
+<div style="display: none">
+  <table>
+  <tr id="user-template">
+    <td class='actions'>
+        <a href="#" onclick="users_remove(this); return false;" class='archive' title="Archive Account">
+          <span class="glyphicon glyphicon-trash"></span>
+        </a>
+    </td>
+    <td class='email'>
+      <div class='address'> </div>
+      <div class='aliases' style='display: none'> </div>
+      <div class='actions'>
+        <span class='restore'>To restore account, create a new account with this email address.</span>
+      </div>
+    </td>
+    <td class='privs'> </td>
+  </tr>
+  </table>
+</div>
+
+
+<script>
+function show_users() {
+  $('#user_table tbody').html("<tr><td colspan='2' class='text-muted'>Loading...</td></tr>")
+  api(
+    "/mail/users",
+    "GET",
+    { format: 'json' },
+    function(r) {
+      $('#user_table tbody').html("");
+      for (var i = 0; i < r.length; i++) {
+        var n = $("#user-template").clone();
+        n.attr('id', '');
+
+        n.addClass("account_" + r[i].status);
+        n.attr('data-email', r[i].email);
+        n.find('td.email .address').text(r[i].email)
+
+        var add_privs = ["admin"];
+
+        for (var j = 0; j < r[i].privileges.length; j++) {
+          var p = $("<div><span class='name'></span> <a href='#' onclick='mod_priv(this, \"remove\"); return false;'><span class=\"glyphicon glyphicon-trash\" style='font-size: 90%'></span></a></div>");
+          p.find('span.name').text(r[i].privileges[j]);
+          n.find('td.privs').append(p);
+          if (add_privs.indexOf(r[i].privileges[j]) >= 0)
+            add_privs.splice(add_privs.indexOf(r[i].privileges[j]), 1);
+        }
+
+        for (var j = 0; j < add_privs.length; j++) {
+          var p = $("<div><small><a href='#' onclick='mod_priv(this, \"add\"); return false;'><span class=\"glyphicon glyphicon-plus\" style='font-size: 90%'></span> <span class='name'></span>?</a></small></div>");
+          p.find('span.name').text(add_privs[j]);
+          n.find('td.privs').append(p);
+        }
+
+        if (r[i].aliases && r[i].aliases.length > 0) {
+          n.find('.aliases').show();
+          for (var j = 0; j < r[i].aliases.length; j++) {
+            n.find('td.email .aliases').append($("<div/>").text(
+              r[i].aliases[j][0]
+              + (r[i].aliases[j][1].length > 0 ? " ⇐ " + r[i].aliases[j][1].join(", ") : "")
+              ))
+          }
+        }
+        $('#user_table tbody').append(n);
+      }
+    })
+}
+
+function do_add_user() {
+  var email = $("#adduserEmail").val();
+  var pw = $("#adduserPassword").val();
+  var privs = $("#adduserPrivs").val();
+  api(
+    "/mail/users/add",
+    "POST",
+    {
+      email: email,
+      password: pw,
+      privileges: privs
+    },
+    function(r) {
+      // Responses are multiple lines of pre-formatted text.
+      show_modal_error("Add User", $("<pre/>").text(r));
+      show_users()
+    },
+    function(r) {
+      show_modal_error("Add User", r);
+    });
+  return false;
+}
+
+function users_remove(elem) {
+  var email = $(elem).parents('tr').attr('data-email');
+  show_modal_confirm(
+    "Archive User",
+    $("<p>Are you sure you want to archive " + email + "?</p> <p>The user's mailboxes will not be deleted (you can do that later), but the user will no longer be able to log into any services on this machine.</p>"),
+    "Archive",
+    function() {
+      api(
+        "/mail/users/remove",
+        "POST",
+        {
+          email: email
+        },
+        function(r) {
+          // Responses are multiple lines of pre-formatted text.
+          show_modal_error("Remove User", $("<pre/>").text(r));
+          show_users();
+        },
+        function(r) {
+          show_modal_error("Remove User", r);
+        });
+    });
+}
+
+function mod_priv(elem, add_remove) {
+  var email = $(elem).parents('tr').attr('data-email');
+  var priv = $(elem).parents('td').find('.name').text();
+
+  // can't remove your own admin access
+  if (priv == "admin" && add_remove == "remove" && api_credentials != null && email == api_credentials[0]) {
+    show_modal_error("Modify Privileges", "You cannot remove the admin privilege from yourself.");
+    return;
+  }
+
+  var add_remove1 = add_remove.charAt(0).toUpperCase() + add_remove.substring(1);
+  show_modal_confirm(
+    "Modify Privileges",
+    "Are you sure you want to " + add_remove + " the " + priv + " privilege for " + email + "?",
+    add_remove1,
+    function() {
+      api(
+        "/mail/users/privileges/" + add_remove,
+        "POST",
+        {
+          email: email,
+          privilege: priv
+        },
+        function(r) {
+          show_users();
+        });
+    });
+}
+</script>
\ No newline at end of file

management/utils.py

@@ -23,6 +23,10 @@ def safe_domain_name(name):
     import urllib.parse
     return urllib.parse.quote(name, safe='')
 
+def unsafe_domain_name(name_encoded):
+    import urllib.parse
+    return urllib.parse.unquote(name_encoded)
+
 def sort_domains(domain_names, env):
     # Put domain names in a nice sorted order. For web_update, PRIMARY_HOSTNAME
     # must appear first so it becomes the nginx default server.
@@ -51,6 +55,17 @@ def sort_domains(domain_names, env):
 
     return groups[0] + groups[1] + groups[2]
 
+def sort_email_addresses(email_addresses, env):
+    email_addresses = set(email_addresses)
+    domains = set(email.split("@", 1)[1] for email in email_addresses if "@" in email)
+    ret = []
+    for domain in sort_domains(domains, env):
+        domain_emails = set(email for email in email_addresses if email.endswith("@" + domain))
+        ret.extend(sorted(domain_emails))
+        email_addresses -= domain_emails
+    ret.extend(sorted(email_addresses)) # whatever is left
+    return ret
+
 def exclusive_process(name):
     # Ensure that a process named `name` does not execute multiple
     # times concurrently.

management/web_update.py

@@ -59,8 +59,11 @@ def do_web_update(env):
 	with open(nginx_conf_fn, "w") as f:
 		f.write(nginx_conf)
 
-	# Kick nginx.
-	shell('check_call', ["/usr/sbin/service", "nginx", "restart"])
+	# Kick nginx. Since this might be called from the web admin
+	# don't do a 'restart'. That would kill the connection before
+	# the API returns its response. A 'reload' should be good
+	# enough and doesn't break any open connections.
+	shell('check_call', ["/usr/sbin/service", "nginx", "reload"])
 
 	return "web updated\n"
 

setup/ssl.sh

@@ -40,8 +40,3 @@ if [ ! -f $STORAGE_ROOT/ssl/ssl_certificate.pem ]; then
 	  -in $STORAGE_ROOT/ssl/ssl_cert_sign_req.csr -signkey $STORAGE_ROOT/ssl/ssl_private_key.pem -out $STORAGE_ROOT/ssl/ssl_certificate.pem
 fi
 
-echo
-echo "Your SSL certificate's fingerpint is:"
-openssl x509 -in $STORAGE_ROOT/ssl/ssl_certificate.pem -noout -fingerprint \
-	| sed "s/SHA1 Fingerprint=//"
-echo

setup/start.sh

@@ -322,3 +322,28 @@ if [ -z "`tools/mail.py user`" ]; then
 	tools/mail.py alias add administrator@$PRIMARY_HOSTNAME $EMAIL_ADDR
 fi
 
+echo
+echo "-----------------------------------------------"
+echo
+echo Your Mail-in-a-Box is running.
+echo
+echo Please log in to the control panel for further instructions at:
+echo
+if management/whats_next.py --check-primary-hostname; then
+	# Show the nice URL if it appears to be resolving and has a valid certificate.
+	echo https://$PRIMARY_HOSTNAME/admin
+	echo
+	echo If there are problems with this URL, instead use:
+	echo
+fi
+echo https://$PUBLIC_IP/admin
+echo
+echo You will be alerted that the website has an invalid certificate. Check that
+echo the certificate fingerprint matches:
+echo
+openssl x509 -in $STORAGE_ROOT/ssl/ssl_certificate.pem -noout -fingerprint \
+        | sed "s/SHA1 Fingerprint=//"
+echo
+echo Then you can confirm the security exception and continue.
+echo
+

tools/mail.py

@@ -12,6 +12,10 @@ def mgmt(cmd, data=None, is_json=False):
 		response = urllib.request.urlopen(req)
 	except urllib.error.HTTPError as e:
 		if e.code == 401:
+			try:
+				print(e.read().decode("utf8"))
+			except:
+				pass
 			print("The management daemon refused access. The API key file may be out of sync. Try 'service mailinabox restart'.", file=sys.stderr)
 		elif hasattr(e, 'read'):
 			print(e.read().decode('utf8'), file=sys.stderr)