use /dev/urandom for roundcube/owncloud key generation, see #596, partially reverts #115 (69f0e1d0)

use /dev/urandom for DNSSEC key generation, fixes #596, partially reverts #115 (69f0e1d0)

ensure /dev/urandom is seeded with a blocking call to /dev/random and using Ubuntu's pollinate servers

add comments about how openssl generates random numbers for genrsa and what could create a perfect storm to make the key not random

see #596

the >'s in pip install package names might be interpreted as shell redirects and was creating files name '=1.0.0' '=2.0.0' and '=1.0.2' (I'm not sure how this was ever working)

the explanatory text for setting up secondary nameservers was hidden until a secondary nameserver is added, so that wasn't helpful

Change Z-Push log level to error

Add log rotation to z-push

During the backup you will get login failures which will confuse iOS

During the backup you will get login failures which will confuse iOS, so it is better to stop php-fpm as well

Change 'Wosign' to 'WoSign'

dont run secondary nameserver checks if the zone's nameservers aren't correct to begin with, possibly because the user is using external DNS, see #582

v0.14 (November 4, 2015)
------------------------

Mail:

* Spamassassin's network-based tests (Pyzor, others) and DKIM tests are now enabled. (Pyzor had always been installed but was not active due to a misconfiguration.)
* Moving spam out of the Spam folder and into Trash would incorrectly train Spamassassin that those messages were not spam.
* Automatically create the Sent and Archive folders for new users.
* The HTML5_Notifier plugin for Roundcube is now included, which when turned on in Roundcube settings provides desktop notifications for new mail.
* The Exchange/ActiveSync backend Z-Push has been updated to fix a problem with CC'd emails not being sent to the CC recipients.

Calender/Contacts:

* CalDAV/CardDAV and Exchange/ActiveSync for calendar/contacts wasn't working in some network configurations.

Web:

* When a new domain is added to the box, rather than applying a new self-signed certificate for that domain, the SSL certificate for the box's primary hostname will be used instead.
* If a custom DNS record is set on a domain or 'www'+domain, web would not be served for that domain. If the custom DNS record is just the box's IP address, that's a configuration mistake, but allow it and let web continue to be served.
* Accommodate really long domain names by increasing an nginx setting.

Control panel:

* Added an option to check for new Mail-in-a-Box versions within status checks. It is off by default so that boxes don't "phone home" without permission.
* Added a random password generator on the users page to simplify creating new accounts.
* When S3 backup credentials are set, the credentials are now no longer ever sent back from the box to the client, for better security.
* Fixed the jumpiness when a modal is displayed.
* Focus is put into the login form fields when the login form is displayed.
* Status checks now include a warning if a custom DNS record has been set on a domain that would normally serve web and as a result that domain no longer is serving web.
* Status checks now check that secondary nameservers, if specified, are actually serving the domains.
* Some errors in the control panel when there is invalid data in the database or an improperly named archived user account have been suppressed.
* Added subresource integrity attributes to all remotely-sourced resources (i.e. via CDNs) to guard against CDNs being used as an attack vector.

System:

* Tweaks to fail2ban settings.
* Fixed a spurrious warning while installing munin.

...but then also have to compare against the intended IP address, which might have a custom override, see #582

secondary NS status checks in 3b91bc2c should not be skipped if the target IP address has been modified by a custom record

see #582

bump HTML5_Notifier version, include its version in the check for whether we need to update Roundcube

Merge branch 'patch-1' of https://github.com/Hoekynl/mailinabox

Added wosign as a suggested free SSL provider.

Update z-push to latest version

For a new user create the archive folder

nginx-ssl.conf changes were partially incorrect, partial revert of 834c42bc

My own /etc/nginx/nginx.conf was messed up, so what I thought were Ubuntu 14.04 defaults weren't, and we lost the ssl_protocols and ssl_prefer_server_ciphers settings. This puts those back.

https://discourse.mailinabox.email/t/dev-master-version-reported-as-poodle-attack-vulnerable-by-ssllabs/898