From 4755bb323b1d16f593c45c7695b2ff1645b455e9 Mon Sep 17 00:00:00 2001 From: Markus Heberling Date: Sun, 18 Nov 2018 13:31:09 +0100 Subject: [PATCH 1/4] Allow setting ACL_ANYONE in the configuration --- .gitignore | 1 + data/Dockerfiles/dovecot/docker-entrypoint.sh | 1 + data/Dockerfiles/sogo/bootstrap-sogo.sh | 14 +++++++++++--- data/conf/dovecot/dovecot.conf | 2 +- docker-compose.yml | 2 ++ update.sh | 14 ++++++++++++++ 6 files changed, 30 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 91233788..34ee1353 100644 --- a/.gitignore +++ b/.gitignore @@ -20,6 +20,7 @@ data/conf/rspamd/override.d/* data/conf/nginx/*.conf data/conf/nginx/*.custom data/conf/nginx/*.bak +data/conf/dovecot/acl_anyone data/conf/dovecot/extra.conf data/conf/rspamd/custom/* data/conf/portainer/ diff --git a/data/Dockerfiles/dovecot/docker-entrypoint.sh b/data/Dockerfiles/dovecot/docker-entrypoint.sh index 86b0db77..f0680057 100755 --- a/data/Dockerfiles/dovecot/docker-entrypoint.sh +++ b/data/Dockerfiles/dovecot/docker-entrypoint.sh @@ -85,6 +85,7 @@ map { } EOF +echo -n ${ACL_ANYONE} > /usr/local/etc/dovecot/acl_anyone # Create userdb dict for Dovecot cat < /usr/local/etc/dovecot/sql/dovecot-dict-sql-userdb.conf diff --git a/data/Dockerfiles/sogo/bootstrap-sogo.sh b/data/Dockerfiles/sogo/bootstrap-sogo.sh index 9fc8b502..6c777f05 100755 --- a/data/Dockerfiles/sogo/bootstrap-sogo.sh +++ b/data/Dockerfiles/sogo/bootstrap-sogo.sh @@ -204,9 +204,17 @@ sed -i \ /usr/lib/GNUstep/SOGo/WebServerResources/js/Common/Common.app.js \ /usr/lib/GNUstep/SOGo/WebServerResources/js/Common.js -# Patch ACLs (comment this out to enable any or authenticated targets for ACL) -if patch -sfN --dry-run /usr/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox < /acl.diff > /dev/null; then - patch /usr/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox < /acl.diff; +# Patch ACLs +if [[ ${ACL_ANYONE} == 'allow' ]]; then + #enable any or authenticated targets for ACL + if patch -R -sfN --dry-run /usr/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox < /acl.diff > /dev/null; then + patch -R /usr/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox < /acl.diff; + fi +else + #disable any or authenticated targets for ACL + if patch -sfN --dry-run /usr/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox < /acl.diff > /dev/null; then + patch /usr/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox < /acl.diff; + fi fi exec gosu sogo /usr/sbin/sogod diff --git a/data/conf/dovecot/dovecot.conf b/data/conf/dovecot/dovecot.conf index 230defb5..4dbcc92e 100644 --- a/data/conf/dovecot/dovecot.conf +++ b/data/conf/dovecot/dovecot.conf @@ -275,7 +275,7 @@ protocol sieve { } plugin { # Allow "any" or "authenticated" to be used in ACLs - #acl_anyone = allow + acl_anyone = > mailcow.conf echo 'MAILDIR_GC_TIME=1440' >> mailcow.conf fi + elif [[ ${option} == "ACL_ANYONE" ]]; then + if ! grep -q ${option} mailcow.conf; then + echo "Adding new option \"${option}\" to mailcow.conf" + echo '# Set this to allow to enable the anyone pseudo user. Disabled by default. +' >> mailcow.conf + echo '# When enabled, ACL can be created, that apply to "All authenticated users" +' >> mailcow.conf + echo '# This should probably only be activated on mail hosts, that are used exclusivly by one organisation. +' >> mailcow.conf + echo '# Otherwise a user might share data with too many other users. +' >> mailcow.conf + echo 'ACL_ANYONE=disallow' >> mailcow.conf + fi elif ! grep -q ${option} mailcow.conf; then echo "Adding new option \"${option}\" to mailcow.conf" echo "${option}=n" >> mailcow.conf From 61f623e8ea131b65bb19c47ecb6a4d080c0f7076 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Peters?= Date: Wed, 2 Jan 2019 08:15:44 +0100 Subject: [PATCH 2/4] Update docker-compose.yml --- docker-compose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 7a2bd9bb..9d4a2fdf 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -138,7 +138,7 @@ services: - phpfpm sogo-mailcow: - image: mailcow/sogo:1.49 + image: mailcow/sogo:1.50 build: ./data/Dockerfiles/sogo environment: - DBNAME=${DBNAME} @@ -163,7 +163,7 @@ services: - sogo dovecot-mailcow: - image: mailcow/dovecot:1.52 + image: mailcow/dovecot:1.53 build: ./data/Dockerfiles/dovecot cap_add: - NET_BIND_SERVICE From 7f728cdae82721289272892f817f896c2b0ab969 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Peters?= Date: Wed, 16 Jan 2019 10:48:18 +0100 Subject: [PATCH 3/4] Update docker-compose.yml --- docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 9d4a2fdf..fbe1f015 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -163,7 +163,7 @@ services: - sogo dovecot-mailcow: - image: mailcow/dovecot:1.53 + image: mailcow/dovecot:1.54 build: ./data/Dockerfiles/dovecot cap_add: - NET_BIND_SERVICE From 31fba0d5e66a43dd760d1cee7c416d922226ec57 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Peters?= Date: Wed, 16 Jan 2019 10:50:06 +0100 Subject: [PATCH 4/4] Update update.sh --- update.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/update.sh b/update.sh index d06fbeca..656c809f 100755 --- a/update.sh +++ b/update.sh @@ -206,7 +206,7 @@ for option in ${CONFIG_ARRAY[@]}; do elif [[ ${option} == "ACL_ANYONE" ]]; then if ! grep -q ${option} mailcow.conf; then echo "Adding new option \"${option}\" to mailcow.conf" - echo '# Set this to allow to enable the anyone pseudo user. Disabled by default. + echo '# Set this to "allow" to enable the anyone pseudo user. Disabled by default. ' >> mailcow.conf echo '# When enabled, ACL can be created, that apply to "All authenticated users" ' >> mailcow.conf