- 21 Jun, 2014 3 commits
-
-
Joshua Tauberer authored
-
Joshua Tauberer authored
Don't check NS records for now because they will only appear on zones. If a hostname is a subdomain on a zone and not itself a zone, it will lack NS records. Also stop testing for ADSP, which we dropped in 126ea94c.
-
Joshua Tauberer authored
-
- 20 Jun, 2014 2 commits
-
-
Joshua Tauberer authored
It just echos back the subject given to it.
-
Joshua Tauberer authored
manage the nginx conf in the management daemon too so we can have nginx operate on all domains that we serve mail for
-
- 19 Jun, 2014 6 commits
-
-
Joshua Tauberer authored
-
Joshua Tauberer authored
-
Joshua Tauberer authored
drop support for ADSP which since last November is no longer recommended per http://datatracker.ietf.org/doc/status-change-adsp-rfc5617-to-historic/
-
Joshua Tauberer authored
-
Joshua Tauberer authored
use DANE when sending mail: if the recipient MX has a DANE TLSA record in DNS then Postfix will necessarily encrypt the mail in transport
-
Joshua Tauberer authored
Postfix has a tls_security_level called "dane" which uses DNS-Based Authentication of Named Entities (DANE) to require, if specified in the DNS of the MX host, an encrpyted connection with a known certificate. This commit adds TLSA records.
-
- 18 Jun, 2014 3 commits
-
-
Joshua Tauberer authored
-
Joshua Tauberer authored
run bind9 on the loopback interface for ensuring we are using a DNSSEC-aware nameserver to resolve our own DNS queries (i.e. when sending mail) since we can't trust that the network configuration provided for us gives us a DNSSEC-aware DNS server see #71
-
Joshua Tauberer authored
-
- 17 Jun, 2014 4 commits
-
-
Joshua Tauberer authored
-
Joshua Tauberer authored
dont create a separate zone for PUBLIC_HOSTNAME if it is a subdomain of another zone (hmm, this is a general principle that could apply to any two domains the box is serving)
-
Joshua Tauberer authored
-
Joshua Tauberer authored
* sign zones * in a cron job, periodically re-sign zones because they expire (not tested)
-
- 13 Jun, 2014 3 commits
-
-
Joshua Tauberer authored
-
Joshua Tauberer authored
two more cases of shelling out external programs in a more secure way, see cecda9ce
-
Joshua Tauberer authored
Now that dns_update is a part of the management daemon, we no longer are using STORAGE_ROOT/dns for anything.
-
- 10 Jun, 2014 3 commits
-
-
Joshua Tauberer authored
-
Joshua Tauberer authored
-
Joshua Tauberer authored
-
- 09 Jun, 2014 3 commits
-
-
Joshua Tauberer authored
-
Joshua Tauberer authored
Duplicity will manage the process of creating incremental backups for us. Although duplicity can both encrypt & copy files to a remote host, I really don't like PGP and so I don't want to use that. Instead, we'll back up to a local directory unencrypted, then manually encrypt the full & incremental backup files. Synchronizing the encrypted backup directory to a remote host is a TODO.
-
Joshua Tauberer authored
-
- 08 Jun, 2014 8 commits
-
-
Joshua Tauberer authored
Support dual-stack IPv4/IPv6 mail servers
-
Michael Kropat authored
Testing showed that it may take a few seconds for the default values to populate. If the help text is shown, “Enter the public IP address…,” but no prompt is shown, the user may get confused and try to enter the IP address before mailinabox has had a chance to figure out and display a suitable default value.
-
Joshua Tauberer authored
This re-implements part of PR #69 by @mkropat, who wrote: By default, Postfix adds a Received header — on all mail that you send — that lists the IP of the device you sent the mail from. This feature is great if you're a mail provider and you need to debug why one user is having sending issues. This feature is not so great if you run your own mail server and you don't want every recipient of every email you send to know the device and IP you sent the email from. To limit this filtering to outgoing mail only, we apply the filters just to the submission port. See these guides [1] [2] for more context. [1] http://askubuntu.com/a/78168/11259 [2] http://www.void.gr/kargig/blog/2013/11/24/anonymize-headers-in-postfix/
-
Michael Kropat authored
Addresses #3 Added support by adding parallel code wherever `$PUBLIC_IP` was used. Providing an IPv6 address is completely optional. Playing around on my IPv6-enabled mail server revealed that — before this change — mailinabox might try to use an IPv6 address as the value for `$PUBLIC_IP`, which wouldn't work out well.
-
Joshua Tauberer authored
* using it to enable the Postfix submission service * per @mkropat's suggestion in #69, set an option to distinguish submission from regular smpd in syslog by giving submission a new name (doing this here to test that editconf is working right on master.cf)
-
Joshua Tauberer authored
-
Joshua Tauberer authored
adding a new script archive_conf_files.sh to dump the contents of all files modified by editconf.py so testing is easier
-
Joshua Tauberer authored
Protect private key from being world-readable
-
- 07 Jun, 2014 4 commits
-
-
Michael Kropat authored
Postfix, Dovecot, and nginx all read the key file while they're running as root — before dropping permissions — so no authorization is needed on the private key file beyond being root-readable.
-
Joshua Tauberer authored
Merges branch 'mkropat-populate-hostname-ip'
-
Joshua Tauberer authored
add comments to the new get_default_hostname etc. functions, and simplify the logic in the Vagrantfile and start.sh so that we always call into the same two functions
-
Michael Kropat authored
Default IP+hostname values were incorrect for my VPS provider. I improved the detection, which should give correct results results for almost any provider. Specific issues addressed: - icanhazip.com detection was only enabled in non-interactive mode - `hostname` is by convention a short (non-fqdn) name in Ubuntu - `hostname --fqdn` fails if provider does not pouplate `hosts` file - `hostname -i` fails if provider does not populate `hosts` file - `curl` without `--fail` will someday return crazy results when icanhazip.com returns 500 errors or similar
-
- 06 Jun, 2014 1 commit
-
-
Joshua Tauberer authored
Mask password input on stdin in tools/mail.py
-