Some last changes
parent
64d92e504a
commit
5e883b6f51
|
@ -1,4 +1,6 @@
|
|||
data/db/mysql/*
|
||||
data/assets/ssl/*
|
||||
!data/assets/ssl/.empty
|
||||
!data/db/mysql/.mysql_data
|
||||
data/db/redis/*
|
||||
!data/db/redis/.redis_data
|
||||
|
|
|
@ -0,0 +1,16 @@
|
|||
#!/bin/bash
|
||||
. mailcow.conf
|
||||
|
||||
openssl dhparam -out data/assets/ssl/dhparams.pem 2048
|
||||
|
||||
docker run \
|
||||
--rm \
|
||||
-v ${PWD}/data/assets/ssl:/certs \
|
||||
ehazlett/certm \
|
||||
-d /certs ca generate -o=mailcow
|
||||
|
||||
docker run \
|
||||
--rm \
|
||||
-v ${PWD}/data/assets/ssl:/certs \
|
||||
ehazlett/certm \
|
||||
-d /certs client generate --common-name=${MAILCOW_HOSTNAME} -o=mailcow
|
|
@ -25,12 +25,9 @@ else
|
|||
build
|
||||
fi
|
||||
|
||||
sed -i "s#allow-from.*#allow-from=127.0.0.0/8 ${DOCKER_SUBNET}#" data/conf/pdns/recursor.conf
|
||||
|
||||
docker run \
|
||||
-v ${PWD}/data/conf/pdns/:/etc/powerdns/ \
|
||||
--network=${DOCKER_NETWORK} \
|
||||
--network-alias pdns \
|
||||
-h pdns \
|
||||
--name ${NAME} \
|
||||
-d pdns
|
||||
|
|
|
@ -83,12 +83,11 @@ fi
|
|||
|
||||
docker run \
|
||||
-v ${PWD}/data/db/mysql/:/var/lib/mysql/ \
|
||||
-v ${PWD}/data/conf/mysql/:/etc/mysql/conf.d/ \
|
||||
-v ${PWD}/data/assets/mysql:/assets \
|
||||
-v ${PWD}/data/conf/mysql/:/etc/mysql/conf.d/:ro \
|
||||
-v ${PWD}/data/assets/mysql:/assets:ro \
|
||||
--name=${NAME} \
|
||||
--network=${DOCKER_NETWORK} \
|
||||
-h mysql \
|
||||
--network-alias mysql \
|
||||
-e MYSQL_ROOT_PASSWORD=${DBROOT} \
|
||||
-e MYSQL_DATABASE=${DBNAME} \
|
||||
-e MYSQL_USER=${DBUSER} \
|
||||
|
|
|
@ -34,6 +34,5 @@ docker run \
|
|||
-v ${PWD}/data/db/redis/:/data/ \
|
||||
--network=${DOCKER_NETWORK} \
|
||||
-h redis \
|
||||
--network-alias redis \
|
||||
--name=${NAME} \
|
||||
-d redis:${REDISVERS} --appendonly yes
|
||||
|
|
|
@ -32,15 +32,14 @@ else
|
|||
fi
|
||||
|
||||
docker run \
|
||||
-v ${PWD}/data/conf/rspamd/override.d/:/etc/rspamd/override.d/ \
|
||||
-v ${PWD}/data/conf/rspamd/local.d/:/etc/rspamd/local.d/ \
|
||||
-v ${PWD}/data/conf/rspamd/lua/:/etc/rspamd/lua/ \
|
||||
-v ${PWD}/data/conf/rspamd/override.d/:/etc/rspamd/override.d/ro \
|
||||
-v ${PWD}/data/conf/rspamd/local.d/:/etc/rspamd/local.d/ro \
|
||||
-v ${PWD}/data/conf/rspamd/lua/:/etc/rspamd/lua/:ro \
|
||||
-v ${PWD}/data/dkim/txt/:/etc/rspamd/dkim/txt/:ro \
|
||||
-v ${PWD}/data/dkim/keys/:/etc/rspamd/dkim/keys/:ro \
|
||||
--dns=${PDNS_IP} \
|
||||
--dns-search=${DOCKER_NETWORK} \
|
||||
--dns-search=${DOCKER_NETWORK} \
|
||||
--network=${DOCKER_NETWORK} \
|
||||
--network-alias rspamd \
|
||||
-h rspamd \
|
||||
--name ${NAME} \
|
||||
-d rspamd
|
||||
|
|
|
@ -22,10 +22,12 @@ docker run \
|
|||
-v ${PWD}/data/conf/rspamd/dynmaps:/dynmaps:ro \
|
||||
-v ${PWD}/data/dkim/:/shared/dkim/ \
|
||||
-d --network=${DOCKER_NETWORK} \
|
||||
--name ${NAME} --network-alias phpfpm -h phpfpm php:${PHPVERS}
|
||||
--name ${NAME} \
|
||||
-h phpfpm \
|
||||
php:${PHPVERS}
|
||||
|
||||
echo "Installing intl and mysql pdo extension..."
|
||||
docker exec ${NAME} /bin/bash -c "apt-get update && apt-get install -y zlib1g-dev libicu-dev g++ libidn11-dev dovecot-core"
|
||||
docker exec ${NAME} /bin/bash -c "apt-get update && apt-get install -y zlib1g-dev libicu-dev g++ libidn11-dev"
|
||||
docker exec ${NAME} docker-php-ext-configure intl pdo pdo_mysql
|
||||
docker exec ${NAME} docker-php-ext-install intl pdo pdo_mysql
|
||||
echo "Restarting container..."
|
||||
|
|
|
@ -31,7 +31,6 @@ docker run \
|
|||
-v ${PWD}/data/assets/ssl/:/etc/ssl/mail/:ro \
|
||||
-v ${PWD}/data/conf/nginx/:/etc/nginx/conf.d/:ro \
|
||||
--network=${DOCKER_NETWORK} \
|
||||
--network-alias nginx \
|
||||
-h nginx \
|
||||
-d nginx:${NGINXVERS}
|
||||
|
||||
|
|
|
@ -26,9 +26,8 @@ else
|
|||
fi
|
||||
|
||||
docker run \
|
||||
-v ${PWD}/data/conf/rmilter/:/etc/rmilter.conf.d/ \
|
||||
-v ${PWD}/data/conf/rmilter/:/etc/rmilter.conf.d/:ro \
|
||||
--network=${DOCKER_NETWORK} \
|
||||
--network-alias rmilter \
|
||||
-h rmilter \
|
||||
--name ${NAME} \
|
||||
-d rmilter
|
||||
|
|
|
@ -21,6 +21,5 @@ fi
|
|||
docker run \
|
||||
--network=${DOCKER_NETWORK} \
|
||||
-h memcached \
|
||||
--network-alias memcached \
|
||||
--name=${NAME} \
|
||||
-d memcached
|
||||
|
|
52
README.md
52
README.md
|
@ -7,22 +7,22 @@ All configurations were written with security in mind.
|
|||
|
||||
### Exposed ports:
|
||||
|
||||
| Service | External bindings | Internal bindings |
|
||||
|:----------------------|:---------------------------------------------|:-------------------------------|
|
||||
| Postfix | 25/tcp, 465/tcp, 587/tcp | 588/tcp |
|
||||
| Dovecot | 110/tcp, 143/tcp, 993/tcp, 995/tcp, 4190/tcp | 24/tcp, 10001/tcp |
|
||||
| Nginx | 443/tcp | 80/tcp, 8081/tcp |
|
||||
| PowerDNS Recursor | - | 53/udp |
|
||||
| Rspamd | - | 11333/tcp, 11334/tcp |
|
||||
| MariaDB | - | 3306/tcp |
|
||||
| Rmilter | - | 9000/tcp |
|
||||
| PHP FPM | - | 9000/tcp |
|
||||
| SOGo | - | 9000/tcp |
|
||||
| Redis | - | 6379/tcp |
|
||||
| Memcached | - | 11211/tcp |
|
||||
| Service | Hostname, Alias | External bindings | Internal bindings |
|
||||
|:-------------|:-------------------------------|:---------------------------------------------|:-------------------------------|
|
||||
| Postfix | ${MAILCOW_HOSTNAME}, postfix | 25/tcp, 465/tcp, 587/tcp | 588/tcp |
|
||||
| Dovecot | ${MAILCOW_HOSTNAME}, dovecot | 110/tcp, 143/tcp, 993/tcp, 995/tcp, 4190/tcp | 24/tcp, 10001/tcp |
|
||||
| Nginx | nginx | 443/tcp | 80/tcp, 8081/tcp |
|
||||
| PowerDNS | pdns | - | 53/udp |
|
||||
| Rspamd | rspamd | - | 11333/tcp, 11334/tcp |
|
||||
| MariaDB | mysql | - | 3306/tcp |
|
||||
| Rmilter | rmilter | - | 9000/tcp |
|
||||
| PHP FPM | phpfpm | - | 9000/tcp |
|
||||
| SOGo | sogo | - | 9000/tcp |
|
||||
| Redis | redis | - | 6379/tcp |
|
||||
| Memcached | memcached | - | 11211/tcp |
|
||||
|
||||
|
||||
All containers share a network "mailcow-network" (name can be changed, but remove all containers and rebuild them after changing).
|
||||
All containers share a network ${MAILCOW_NETWORK} (name can be changed, but remove all containers and rebuild them after changing).
|
||||
IPs are dynamic and taken from subnet ${DOCKER_SUBNET}.
|
||||
|
||||
## Installation
|
||||
|
||||
|
@ -59,16 +59,8 @@ docker restart rspamd-mailcow
|
|||
|
||||
Open https://${MAILCOW_HOSTNAME}/rspamd in a browser.
|
||||
|
||||
### SSL (or: How to use Let's Encrypt)
|
||||
mailcow dockerized comes with a self-signed certificate. Certificates and DH parameters are saved as `data/assets/ssl/{dhparams.pem,mail.{crt,key}}`.
|
||||
|
||||
First you should renew the DH parameters.
|
||||
Soem say you should use 4096, but be prepared for a long waiting period when generating such a file.
|
||||
|
||||
Assuming you are in the mailcow root folder:
|
||||
```
|
||||
openssl dhparam -out ./data/assets/ssl/dhparams.pem 2048
|
||||
```
|
||||
### SSL (and: How to use Let's Encrypt)
|
||||
mailcow dockerized generates a CA named "mailcow" with a self-signed server certificate in `data/assets/ssl` via `000-build-certs.sh`.
|
||||
|
||||
Get the certbot client:
|
||||
```
|
||||
|
@ -87,8 +79,8 @@ certbot-auto certonly \
|
|||
|
||||
Create hard links to the full path of the new certificates. Assuming you are still in the mailcow root folder:
|
||||
```
|
||||
mv data/assets/ssl/mail.{crt,crt_old}
|
||||
mv data/assets/ssl/mail.{key,key_old}
|
||||
mv data/assets/ssl/cert.{pem,pem.backup}
|
||||
mv data/assets/ssl/key.{pem,pem.backup}
|
||||
ln $(readlink -f /etc/letsencrypt/live/${MAILCOW_HOSTNAME}/fullchain.pem) data/assets/ssl/mail.crt
|
||||
ln $(readlink -f /etc/letsencrypt/live/${MAILCOW_HOSTNAME}/privkey.pem) data/assets/ssl/mail.key
|
||||
```
|
||||
|
@ -113,11 +105,11 @@ When renewing certificates, run the last two steps (link + restart) as post-hook
|
|||
No persistent data is deleted at any time.
|
||||
If an image exists, you will be asked wether or not to repull/rebuild it.
|
||||
|
||||
Build files are numbered "nnn" for dependencies.
|
||||
|
||||
### Logs
|
||||
|
||||
You can use docker logs $name for almost all containers. Only rmilter does not log to stdout. You can check rspamd logs for rmilter reponses.
|
||||
|
||||
When a process dies, the container dies, too. Except for Postfix' container.
|
||||
You can use docker logs $name for almost all containers. Only rmilter does not log to stdout. You can check rspamd logs for rmilter responses.
|
||||
|
||||
### MariaDB
|
||||
|
||||
|
|
|
@ -1,8 +0,0 @@
|
|||
-----BEGIN DH PARAMETERS-----
|
||||
MIIBCAKCAQEAytfW/P+fV4BLTcJhlHG49Vq7hQrmyUPP+NZ/6MUIG8FNlFaXxbFl
|
||||
NtarS/gfOpj+Q5LhS91gToQOqJIij03Jr7t3PdUkkDuIs11y5Ux6zsEQdBhok+yY
|
||||
tYvdYT4lbex1dLX36u/tn2VnPdh2jLltRjWN2jiUxjh/O+vXtfej8u4Rc2oOOOFS
|
||||
f0e2Ye2WeWXvQlhkcGu87kKIqklxbjmqVtE1fx5Ydvrl1P/HQiCq4YQLIx5skgQn
|
||||
e4LyvBdiuA44v1WhXSa0Lb4PcXUQcGhesGJZ/A3M1K/h/ZO47oUyL93odyAO8x3e
|
||||
mLHHsOWAh5MGO0ID2jANwuziri5LEeW4+wIBAg==
|
||||
-----END DH PARAMETERS-----
|
|
@ -1,32 +0,0 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIFezCCA2OgAwIBAgIJALl64rYl1fjjMA0GCSqGSIb3DQEBCwUAMFQxCzAJBgNV
|
||||
BAYTAkRFMQwwCgYDVQQIDANOUlcxCzAJBgNVBAcMAktSMRIwEAYDVQQKDAlTZXJ2
|
||||
ZXJjb3cxFjAUBgNVBAMMDW1haWxjb3cubG9jYWwwHhcNMTYxMjA4MjEzMDM2WhcN
|
||||
MjYxMjA2MjEzMDM2WjBUMQswCQYDVQQGEwJERTEMMAoGA1UECAwDTlJXMQswCQYD
|
||||
VQQHDAJLUjESMBAGA1UECgwJU2VydmVyY293MRYwFAYDVQQDDA1tYWlsY293Lmxv
|
||||
Y2FsMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvd/79BmtXZcgzwJw
|
||||
8i76C8e0waehYypibOkBqnFi4bF6Q7mhB1j/bA4LmXG4UpcX7ULlDozzaM7Hfi9Q
|
||||
v1STYR/S9ShXZNStwDYibOa1q/FG+b4qTjtFiWBW8wH/XxIv6JHX8/IjqwHIs/3B
|
||||
EVEl0LEs1RdNMKgSEJ9wbK3q+0pOvw9B6FnhCE2414SE1e7wYL50+NaKTHQcbft3
|
||||
ZcRGDTEh4euRKMmVTrBwmpYnNtiljJvHU4F9cdAFg8ZailwJerod1VXB93YX3Jtc
|
||||
qRQ9akNjFzLQ/6a4PhKAB8uaStEzri0yBdp+O0Qs/tbloAArAJW3dgE7Omxzso79
|
||||
Du4idDHyRmcLu5rsQzST+7kwaCHHWQ4c2mjlhibICGMUzwks39s1QI8CtjmU6AIy
|
||||
7F/XpYAJ70Fl7qy99ugrz8X50cPBFtLTYX18wZTUjl/s4qy+JPvUBt2MALPj/YnR
|
||||
fXck/emkwscmE1UhaycMW4U21/+5gOhWpFIBCKWnsvRn0SHi7lUzuWBnXvL5tmrA
|
||||
gsaFrm/L2JhW2WerZ61UpOVookYtUbk4Hr+Pq6yTgJShUw2i/B71Qr173PIxRV7u
|
||||
1qJeOWY3UMPLcfiAnEZFAo7cfLRvqZmHiNp6lALdmoiWllnVvzcRwR/DBvg4gaFt
|
||||
R6FeLDArhCdu04WENTd5E3XHRrUCAwEAAaNQME4wHQYDVR0OBBYEFFBMhsQlfxCI
|
||||
1GaT1ZGvGheUOGRkMB8GA1UdIwQYMBaAFFBMhsQlfxCI1GaT1ZGvGheUOGRkMAwG
|
||||
A1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIBADujbXk9XVhkF6/WVTxANXVB
|
||||
tpIojCPEsXYqEhvMGtDGfqd8sJlEWM0vmuUvM52G7ULMf8aVfiOhLUkEFWpadL9v
|
||||
/uZ8EPUc+ZWxxBOEnJbszqrxs94u7K9dxmQnL1rjrW1UtkrT0ptuzJBBQcjdicwe
|
||||
VIl5Cn/eq+mkKZRVlctGtD4r1z8u5rUHoOE4RCOU5mfSafu15zzwiglh9wLuuXHC
|
||||
bi7Onau9gB1EfmhZwUAL2xZZwvlNGRc6Dz1LG+OXVIOgRHeyfnZQa1ErC4FY5J0Y
|
||||
NR+KT7JQW9zivyu0MsV3E2J7GzRAywKyP0m/F/qHJFWxPymILAyWVUlwtJswR5sE
|
||||
bT19zPeajrVrbpUMtQv3FhFObtSyw/eI/yRWUuhBapkk95DWl7OkffkQ5OUHG+fs
|
||||
QWj1d2Mdhf+jkpgqyL1DyPILsG7ADT0dL/3kZoJf1wjeqNfW3dDo0Ex9DlbznP2h
|
||||
ldnMeIQYuyNBqzNfaZGW2WManwHWtASV2Hn76QMVrMfLDnf3RRdEUplW3fsIfLQ0
|
||||
f2YVunLJNvll+2QGdCkmJUbLEvvvWmz0Ve+RalGtKi+VTd2I3u4fvFsAXad48wwq
|
||||
oK5xd6Se0MsTkcOukaPEkggjffmITyg5Hpqmg1yBSoaH5D/wujTy9X3QcQA30fU/
|
||||
ttoPblK2hlItcK4hHnkK
|
||||
-----END CERTIFICATE-----
|
|
@ -1,51 +0,0 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIJKAIBAAKCAgEAvd/79BmtXZcgzwJw8i76C8e0waehYypibOkBqnFi4bF6Q7mh
|
||||
B1j/bA4LmXG4UpcX7ULlDozzaM7Hfi9Qv1STYR/S9ShXZNStwDYibOa1q/FG+b4q
|
||||
TjtFiWBW8wH/XxIv6JHX8/IjqwHIs/3BEVEl0LEs1RdNMKgSEJ9wbK3q+0pOvw9B
|
||||
6FnhCE2414SE1e7wYL50+NaKTHQcbft3ZcRGDTEh4euRKMmVTrBwmpYnNtiljJvH
|
||||
U4F9cdAFg8ZailwJerod1VXB93YX3JtcqRQ9akNjFzLQ/6a4PhKAB8uaStEzri0y
|
||||
Bdp+O0Qs/tbloAArAJW3dgE7Omxzso79Du4idDHyRmcLu5rsQzST+7kwaCHHWQ4c
|
||||
2mjlhibICGMUzwks39s1QI8CtjmU6AIy7F/XpYAJ70Fl7qy99ugrz8X50cPBFtLT
|
||||
YX18wZTUjl/s4qy+JPvUBt2MALPj/YnRfXck/emkwscmE1UhaycMW4U21/+5gOhW
|
||||
pFIBCKWnsvRn0SHi7lUzuWBnXvL5tmrAgsaFrm/L2JhW2WerZ61UpOVookYtUbk4
|
||||
Hr+Pq6yTgJShUw2i/B71Qr173PIxRV7u1qJeOWY3UMPLcfiAnEZFAo7cfLRvqZmH
|
||||
iNp6lALdmoiWllnVvzcRwR/DBvg4gaFtR6FeLDArhCdu04WENTd5E3XHRrUCAwEA
|
||||
AQKCAgEArhCYOb8QX6wcN6pVQLAwKnx6CM5T9UT11kIFdOtdaun42/1g0guUnMqD
|
||||
d7f48j3xgWDB/ATbYEmwOM3HiJ9QPMmf63+AHr+aSYtXI96czXPzTSA4SF+t77KS
|
||||
A1Thd5aEtQB+qPRiHnMUO211gRqTQC4sm20xJlntta90sSz/Lj+A0UZ7dTZwRdx6
|
||||
h5jE7hqN4yK2uSh0wIHxTiIp4vF8Brv0A9igynOCnRDDKfRdHrqdibmFkdgz2BKL
|
||||
+7HrbsvRJOFaWCi2GNX6KhODbr1PUAtW2/2J+9QrMzxigsL0P4JpjlOAeD1FW6+0
|
||||
UCtRdsywn2ihN10JnxWtOxQ6iWVlzut52uDnwUa09GThSVnurJihV9mSWyk9lNuy
|
||||
0kILtSmYn6UbokOgmfjH0E2Ks1qbskD8GlI9g/wkhs5YC+ZYW2MP9FG39n4/QSnk
|
||||
boOTqht8JylWPVyzmvvcRf5nfEOZ5mF82L28Y/OfPn0gakYARxn1EnzpguF3ffFD
|
||||
NEn9lWzEAbldlnDslzi6YPOeyQwA6iLCesag5LSGdADrM7kAGHksJggeUb02BSd6
|
||||
Nmy6MVMF6tzQYdaqgKXoqKs5nRJLZR1k70ftju2UNWEN24aUd6U2lDOlkaYoucSk
|
||||
NohTUKXX0dibSGd9eU7hCNS75YoG1x2gCEOatVelG4EZQfIU/EECggEBAN6gBjv4
|
||||
kDuIZ1wk0BBt/ijARH8FAzHm0hr8oyWpq6Sdrq5y9iAbvFNwEXJ/ft6NNcCF9maT
|
||||
e5oG5NpoaV0FN5W8qQ8rGnESV/fZOxJEr1yJPEq4yDIspHEXkBjvTgYWjuXRve9n
|
||||
NtsSv1crRFxW5IizPkZklbJUZD7oH5iHB15UGfdpKr5Fx3JpsaXht3dMEJ4YQetF
|
||||
Mr9jcBGwYCYmlWgpKkD+HadgjbNdG4ztKTFEU7/ElEIIR86IDcqJsz0XsmZIjwUU
|
||||
3lsPhVo8Km8ohvGA/WqAaf6ebN9PXjiUFXfjHlveHPTtrd5MCutnxUk0kY4/srmB
|
||||
5avH3bxXbKiufiMCggEBANpXEGY9f020vHFUC0vNOeCym8XuXqFyvx6Cl6tTlj8S
|
||||
dZCWoHljnJg2HbbJcdh92rri9f+ahNNpZ9/0PQi9yBThWt9aP90Tw3+BhxUyvlPL
|
||||
FsFX5IdNq403Ls9iyZuj1Rf9lc65d9lr7TVC5CMI7+BN3CftjvOw3yGucJno+MLW
|
||||
AvENx3+NnZ2Hy9nNJp54lbDJe8anP57kvDIKcbmmvVW2ktQKcZqAyBUq0E8mOtkz
|
||||
66ZRV+/pSnwugb0Eols3s54OvtOoGBnq1r8GVhf/x23J0UvBoHqqURQFJ5oTKxQW
|
||||
zAJ7suGn3xUKBOatypXgg8ZL67rQqo0PxoNK0RcJuUcCggEAHWrf6ATMalF39wEW
|
||||
TVV7hD8DzhUHewyZLt+7XzqwZ6w+bObcBxojJJNmes7GIPpf4/TPvnY2mv/WNdYe
|
||||
NiB+W9b2L/7uG4rk/OdDmwJgecXYpbcNHTQw9pC6hdD5amyIrW2tv3jQEtrDVe1t
|
||||
txX0VOv6iqq37Tyhkn5xzmHpY1mRpNPMxh/KXyAATX8qEyWF/J4P99rI/elR4cSA
|
||||
sAnhLEZkQvpRSNDFaLIg9dpQ2yXAO1LqlF8rverUh7LycFw1QrbLz0wWpcnDQU05
|
||||
/j5Itpjo463cU7zzff6q4KcQvyrP1Cvhf6v4katSthCcTTQZF8brAwBbLPvYHQ8g
|
||||
WJnWKQKCAQAVJ8ZxAZhqIQ75NBl8GMB44xVw0i3dGs8l16V2djzik5lMjyuxV1N+
|
||||
9A9g/JfJUDh3TzJit8gS6+2ip3madTkDvOofJhF2DEou+o/qH+aNG+pyhV+hNIdg
|
||||
wW4Jrhq2t+MX1fxD8XiJWom7VWXhdyY255RjUgM93W9hRhOm9gnUZwQV8y3XUBNr
|
||||
hhLcYaJSTIDEhmE12FKzxJnvh0+Jm3xQ58XGQdTMEZpRYrqYUK33Ca7ViKAqoMIU
|
||||
0jTD6cUJbZY7xFX9EBZ1vGleTPDelmvuWVWsL3CrMgF1HSK/LQhJhAP0YaPtdWSK
|
||||
F1RuPXyZlQ1vkz+d9EXyMQsdAYzM3KZVAoIBAF0gvM4fY0EvSDKevWnZtLyINHZV
|
||||
TC2HhElAREmblbziQ1GO00nCw+RXYmA7fMHuMNnHMcB/QubpMQxEPetAbtcX9jXW
|
||||
iBNIpHTQwNWBe+IGd1I7n6FA6Cqis4tdNFmaWxXv1aMpzU7K/aVcO3sK3SsjSy6A
|
||||
4bDJ9mlGCnIv5zc1on3lpMARBUGRF8mAQ6ejMuUjubtPa8cSUhUv3hoH0xG9bLJh
|
||||
0VDZ6bZ7QFLpNxFUlX7muSj8DNsjR77TBuN+Buk+pI68GDl6177Gm6UkZRYx4yi5
|
||||
xFCP9932L2tufcQaRsiIHdNEFAGMMPe2M22DUmSI0cSNgx4xKuLGJI4PkTM=
|
||||
-----END RSA PRIVATE KEY-----
|
|
@ -183,8 +183,8 @@ service lmtp {
|
|||
user = vmail
|
||||
}
|
||||
listen = *,[::]
|
||||
ssl_cert = </etc/ssl/mail/mail.crt
|
||||
ssl_key = </etc/ssl/mail/mail.key
|
||||
ssl_cert = </etc/ssl/mail/cert.pem
|
||||
ssl_key = </etc/ssl/mail/key.pem
|
||||
userdb {
|
||||
args = /etc/dovecot/sql/dovecot-mysql.conf
|
||||
driver = sql
|
||||
|
|
|
@ -1,8 +1,8 @@
|
|||
server {
|
||||
listen 443;
|
||||
ssl on;
|
||||
ssl_certificate /etc/ssl/mail/mail.crt;
|
||||
ssl_certificate_key /etc/ssl/mail/mail.key;
|
||||
ssl_certificate /etc/ssl/mail/cert.pem;
|
||||
ssl_certificate_key /etc/ssl/mail/key.pem;
|
||||
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
|
||||
|
|
|
@ -1,4 +1,4 @@
|
|||
allow-from=127.0.0.0/8 172.18.0.0/16
|
||||
allow-from=127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8
|
||||
config-dir=/etc/powerdns
|
||||
daemon=no
|
||||
disable-syslog=yes
|
||||
|
|
|
@ -1,7 +1,7 @@
|
|||
biff = no
|
||||
append_dot_mydomain = no
|
||||
smtpd_tls_cert_file = /etc/ssl/mail/mail.crt
|
||||
smtpd_tls_key_file = /etc/ssl/mail/mail.key
|
||||
smtpd_tls_cert_file = /etc/ssl/mail/cert.pem
|
||||
smtpd_tls_key_file = /etc/ssl/mail/key.pem
|
||||
smtpd_use_tls=yes
|
||||
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
|
||||
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
|
||||
|
@ -45,8 +45,8 @@ relay_domains = proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_mxdomain_maps.cf
|
|||
relay_recipient_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_relay_recipient_maps.cf
|
||||
sender_dependent_default_transport_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_tls_enforce_out_policy.cf
|
||||
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
|
||||
smtp_tls_cert_file = /etc/ssl/mail/mail.crt
|
||||
smtp_tls_key_file = /etc/ssl/mail/mail.key
|
||||
smtp_tls_cert_file = /etc/ssl/mail/cert.pem
|
||||
smtp_tls_key_file = /etc/ssl/mail/key.pem
|
||||
smtp_tls_loglevel = 1
|
||||
smtp_dns_support_level = dnssec
|
||||
smtp_tls_security_level = dane
|
||||
|
|
|
@ -1,12 +1,7 @@
|
|||
<?php
|
||||
function hash_password($password) {
|
||||
$salt_str = bin2hex(openssl_random_pseudo_bytes(8));
|
||||
if ($GLOBALS['HASHING'] == "SHA512-CRYPT") {
|
||||
return "{SHA512-CRYPT}".crypt($password, '$6$'.$salt_str.'$');
|
||||
}
|
||||
else {
|
||||
return "{SSHA256}".base64_encode(hash('sha256', $password.$salt_str, true).$salt_str);
|
||||
}
|
||||
return "{SSHA256}".base64_encode(hash('sha256', $password.$salt_str, true).$salt_str);
|
||||
}
|
||||
function hasDomainAccess($username, $role, $domain) {
|
||||
global $pdo;
|
||||
|
@ -37,6 +32,23 @@ function hasDomainAccess($username, $role, $domain) {
|
|||
}
|
||||
return false;
|
||||
}
|
||||
function verify_ssha256($password, $hash) {
|
||||
// Remove tag if any
|
||||
$hash = ltrim($hash, '{SSHA256}');
|
||||
// Decode hash
|
||||
$dhash = base64_decode($hash);
|
||||
// Get first 32 bytes of binary which equals a SHA256 hash
|
||||
$ohash = substr($dhash, 0, 32);
|
||||
// Remove SHA256 hash from decoded hash to get original salt string
|
||||
$osalt = str_replace($ohash, '', $dhash);
|
||||
// Check single salted SHA256 hash against extracted hash
|
||||
if (hash('sha256', $password . $osalt, true) == $ohash) {
|
||||
return true;
|
||||
}
|
||||
else {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
function doveadm_authenticate($hash, $algorithm, $password) {
|
||||
$descr = array(0 => array('pipe', 'r'), 1 => array('pipe', 'w'), 2 => array('pipe', 'w'));
|
||||
$pipes = array();
|
||||
|
@ -76,7 +88,7 @@ function check_login($user, $pass) {
|
|||
$stmt->execute(array(':user' => $user));
|
||||
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
|
||||
foreach ($rows as $row) {
|
||||
if (doveadm_authenticate($row['password'], $GLOBALS['HASHING'], $pass) !== false) {
|
||||
if (verify_ssha256($row['password'], $pass) !== false) {
|
||||
unset($_SESSION['ldelay']);
|
||||
return "admin";
|
||||
}
|
||||
|
@ -88,7 +100,7 @@ function check_login($user, $pass) {
|
|||
$stmt->execute(array(':user' => $user));
|
||||
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
|
||||
foreach ($rows as $row) {
|
||||
if (doveadm_authenticate($row['password'], $GLOBALS['HASHING'], $pass) !== false) {
|
||||
if (doveadm_authenticate($row['password'], $pass) !== false) {
|
||||
unset($_SESSION['ldelay']);
|
||||
return "domainadmin";
|
||||
}
|
||||
|
@ -99,7 +111,7 @@ function check_login($user, $pass) {
|
|||
$stmt->execute(array(':user' => $user));
|
||||
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
|
||||
foreach ($rows as $row) {
|
||||
if (doveadm_authenticate($row['password'], $GLOBALS['HASHING'], $pass) !== false) {
|
||||
if (doveadm_authenticate($row['password'], $pass) !== false) {
|
||||
unset($_SESSION['ldelay']);
|
||||
return "user";
|
||||
}
|
||||
|
|
|
@ -31,6 +31,4 @@ $DEFAULT_LANG = "en";
|
|||
// See https://bootswatch.com/
|
||||
$DEFAULT_THEME = "lumen";
|
||||
|
||||
$HASHING = "SSHA256";
|
||||
|
||||
?>
|
||||
|
|
|
@ -2,9 +2,11 @@
|
|||
|
||||
. mailcow.conf
|
||||
|
||||
if [[ -z $(which ss) ]]; then echo "Please install the ss util first."; exit 1; fi
|
||||
|
||||
for port in ${SMTP_PORT} ${SMTPS_PORT} ${SUBMISSION_PORT} ${IMAP_PORT} ${IMAPS_PORT} ${POP_PORT} ${POPS_PORT} ${SIEVE_PORT} 443; do
|
||||
if [[ ! -z $(ss -tlnp "( sport = :$port )" 2> /dev/null | grep LISTEN | grep -vi docker) ]]; then
|
||||
echo "Port $port is in use by other process."
|
||||
echo "Port $port is in use by another process."
|
||||
err=1
|
||||
fi
|
||||
done
|
||||
|
|
Loading…
Reference in New Issue