Commit Graph

3025 Commits (2170e07731a423cf30cb8f70b0a171c7bfcfa606)
 

Author SHA1 Message Date
Florent Daigniere 5634354911 document how to publish an MTA-STS policy
Florent Daigniere a019607873 towncrier
Florent Daigniere 52d3a33875 Remove the domains that have a valid MTA-STS policy
gmail.com
comcast.net
mail.ru
googlemail.com
wp.pl
Florent Daigniere 4f96e99144 MTA-STS (use rather than publish policies)
Dimitri Huisman 00276d8b70
Merge branch 'master' into AdminLTE-3
bors[bot] 1d9850490c
Merge
1958: Update the documentation on reverse proxies r=mergify[bot] a=nextgens

## What type of PR?

documentation

## What does this PR do?

Update the documentation on reverse proxies; this is mostly cosmetic (fix the links, use example.com where appropriate, ...).

It also removes the last option (run Mailu without its frontend) as that won't work with SSO and is a terrible idea anyway.

I wonder if we should just get rid of that section

### Related issue(s)
- 
- 
- 
- 

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Florent Daigniere 8106892ee8 towncrier
Florent Daigniere 394c2fe22c Document REAL_IP_HEADER and REAL_IP_FROM
Fix a security vulnerability whereby we were not clearing other headers
Florent Daigniere 6bba0cecfc Strip the Forwarded header since nothing is compatible with it yet
Florent Daigniere 0e45bb3ae5 use example.com
Florent Daigniere d65993886a Fix the links
Florent Daigniere 9e306bf255 use example.com
Florent Daigniere 5ed77750f2 clarify
Florent Daigniere 13e0b56a0d This breaks SSO
bors[bot] 6e32092abd
Merge
1873: Completed Hebrew translation r=mergify[bot] a=yarons

The Hebrew translation is incomplete so I've completed it.

Co-authored-by: Yaron Shahrabani <sh.yaron@gmail.com>
bors[bot] 4c52eb3e0e
Merge
1957: BugFix 1952 - use punycode encoding in HTTP headers for webmail/radicale r=mergify[bot] a=Diman0

## What type of PR?

Bug fix

## What does this PR do?

Fixes a bug introduced by the SSO implementation and an already existing bug for radicale.
In auth.py we did not use punycode (ACE) encoding for the domain part of an email. 
Since we pass the user name in the HTTP header to webmail/radicale, we would sometime pass non-ascii. E.g. user@exämple.io.
This is illegal. HTTP headers may only contain ASCII. The domain part of the user name therefore now uses punycode encoding.

I tested that I can log in with the form user@exämple.io and user@xn--exmple-cua.io for
- admin
- roundcube (also tested sending emails of course)
- rainloop (also tested sending emails of course)
- radicale (webdav)
- thunderbird - sending/receiving emails and accessing/modifying the webdav calendar added in radicale.
  - for the calendar you can use the normal and punnycode notation
  - for email you can only use punnycode. This is a limitation of thunderbird. It does not accept email addresses with non-ascii in the domain part of an email address.

### Related issue(s)
- closes   

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [n/a] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Dimitri Huisman <diman@huisman.xyz>
Dimitri Huisman 169a540692 Use punycode for HTTP header for radicale and create changelog
Dimitri Huisman 4f5cb0974e Make sure HTTP header only contains ASCII
bors[bot] ecb39fed04
Merge
1947: k8s is helm-charts only r=mergify[bot] a=nextgens

## What type of PR?

documentation

## What does this PR do?

Remove the k8s documentation templates and document that helm charts is the supported way to do it.

### Related issue(s)

- 
- closes 
- closes  
- closes 
- closes 
- closes 
and
- closes 
- closes 
- closes 


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Florent Daigniere e742c5432b simplify
Florent Daigniere 0a6f3448ec k8s is helm-chart only
bors[bot] ecaaf25dcb
Merge
1939: Ensure that we don't do multiple DNS lookups in the sieve script r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

It ensures that DNS lookups don't introduce inconsistent state. We may want to go further and actually check the return codes of rspamc too.

I haven't tested it but it should work.

### Related issue(s)
- 



Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Florent Daigniere 368b40b4fd doh
bors[bot] db0370858e
Merge
1941: Fix a bug whereby adding new HOSTNAMEs won't necessarily lead to certificates being renewed. r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

Fix a bug whereby adding new HOSTNAMEs won't necessarily lead to certificates being renewed.

certbot's defaut behaviour has changed when --renew-with-new-domains was introduced

### Related issue(s)
- close 

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Florent Daigniere 3e676e232a fix
bors[bot] 7efce99769
Merge
1902: Make smtp_tls_policy_maps easily configurable r=mergify[bot] a=nextgens

## What type of PR?

Feature

## What does this PR do?

- Make smtp_tls_policy_maps easily configurable. This is useful to force TLS verification of specific destinations (or relays).
We should probably discuss what's on the list by default. I have found a top100 list online, ran it through a script to check all the records and found 90 destinations we could use.
- disable TLS session tickets (this reduces the PFS window from 1day to 1h)
- enable system CAs by default (to allow for OUTBOUND_TLS_LEVEL above encrypt without additional overrides)

### Related issue(s)
- closes  
- 

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Florent Daigniere ae8db08bdf Ensure that we don't do multiple DNS lookups in the sieve script
bors[bot] 53fe567d06
Merge
1925: Optimize Rainloop: Change to NGINX r=mergify[bot] a=Erriez

## What type of PR?

- Reduce build time.
- Reduce image size.
- Faster user response using CGI.

## What does this PR do?

### Related issue(s)
- Mention an issue like: ,  and 
- Auto close an issue like: closes 

## Prerequistes

Documentation updates TBD (requires some guidance):
- [ ] In case of feature or enhancement: documentation updated accordingly
- [ ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.

## Technical details

- Image from `php:7.4-apache` to `nginx:1.21-alpine` followed by PHP7 installation.
- Move `.ini` files to directory `defaults/`.
- Move files `sso.php and include.php` to directory `login/`.
- NGINX configuration:
  - `access_log off;` as this is handled by front.
  - `error_log /dev/stderr err; configured to reduce output. The logging in `start.py` is useless.
  - PHP configuration optimized for CGI usage and requires a config file `config/php-rainloop.conf` -> `/etc/php7/php-fpm.d/rainloop.conf`.
  - `.ini` files are parsed / substituted by `socrate` Python module.

Further optimization is possible by completely removing Python. This is only used to parse the `.ini` files and can be done via Bash scripts. This saves more build time and image size can be reduced to 112MB.

## Reviewing

This PR requires multiple reviewers and extensive testing before merging into master. Data/settings are compatible with previous images.

Co-authored-by: Erriez <Erriez@users.noreply.github.com>
Florent Daigniere 65a27b1c7f add additional options to make DANE easier
Florent Daigniere fb8d52ceb2 Merge branch 'master' of https://github.com/Mailu/Mailu into tls_policy_map
bors[bot] a461f5fa7c
Merge
1904: Allow specific users to send email from any address r=mergify[bot] a=nextgens

## What type of PR?

Feature

## What does this PR do?

Allow specific users to send email from any address using the WILDCARD_SENDERS configuration variable.

### Related issue(s)
- closes 

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Co-authored-by: David Fairbrother <DavidFair@users.noreply.github.com>
Co-authored-by: Diman0 <diman@huisman.xyz>
Co-authored-by: Dimitri Huisman <52963853+Diman0@users.noreply.github.com>
Co-authored-by: Erriez <Erriez@users.noreply.github.com>
bors[bot] 5062ee58dc
Merge
1935: Fix bug : logs flooded with "unbound udp connect failed: Address not available for" r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

Revert back to alpine 1.12 for the resolver/unbound container. The official fix is at:
08968baec1
but alpine doesn't ship it yet:
https://pkgs.alpinelinux.org/packages?name=unbound&branch=v3.14

### Related issue(s)
- closes  


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Florent Daigniere e1ddbb6eec Rollback to alpine 1.12
it ships unbound 1.10 that doesn't have the bug I think
08968baec1
Florent Daigniere b4102ba464 doh
Florent Daigniere fc5758e352 Clarify that it will only work for existing addresses
Florent Daigniere 9ec7590171 Merge branch 'master' of https://github.com/Mailu/Mailu into wildcard_senders
Florent Daigniere 3d018f916c Merge branch 'wildcard_senders' of github.com:nextgens/Mailu into wildcard_senders
Florent Daigniere 7252a73e11 WILDCARD_SENDERS can have spaces
Erriez 6cecacb6da Add catch_workers_output to php-rainloop.conf
bors[bot] b57df78dac
Merge
1916: Ratelimit outgoing emails per user r=mergify[bot] a=nextgens

## What type of PR?

Feature

## What does this PR do?

A conflict-free version of  implementing per-user sender limits

### Related issue(s)
- close  
- close 
- close  

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Co-authored-by: Dimitri Huisman <diman@huisman.xyz>
Dimitri Huisman 4c056db4aa Added documentation for all user statuses.
Erriez 6437540704 Change error_log to warn
Dimitri Huisman e5972bd9ec Set default message rate limit to 200/day
Dimitri Huisman b7403c850a Document the new setting in webadministration.rst.
bors[bot] 34b35ca9b7
Merge
1922: Harden postfix's configuration r=mergify[bot] a=nextgens

## What type of PR?

enhancement

## What does this PR do?

It hardens the default configuration:
- disable AUTH commands on port 25 (nginx was not advertising the capability: normal clients wouldn't attempt it)
- fix Forward Secrecy by ensuring that we don't use session tickets and don't cache on forensically carveable mediums
- prevent clear-text credentials from being sent while authenticating to remote relays (this may break things if the relay doesn't support challenge-based authentication NOR STARTTLS - unlikely).
- switch to default RSA keysizes (2048 bits and they get rekeyed every 3 months -modern clients will do ECC)
- enable ECC certificates (much smaller than RSA keys, faster for better security margin)
- configure nginx so that it doesn't send the legacy/root CA (clients that require it are unlikely to do TLS1.2 any ways)

I don't think that any of those changes is impactful enough to warrant being documented.

### Related issue(s)
- close 

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Co-authored-by: Jack Murray <github@c0rporation.com>
Jack Murray dd127f8f06 Change letsencrypt timer from 1h --> 1 day
There's no need to be calling certbot so frequently
Florent Daigniere 6704cb869a Switch to 3072bits dhparam (instead of 4096bits)
We aim for 128bits of security here
Florent Daigniere f74497d929 Merge remote-tracking branch 'upstream/master' into harden_postfix
Jack Murray e304c352a1 Change letsencrypt timer from 1h --> 1 day
There's no need to be calling certbot so frequently
Erriez 5adc4f08f6 Restore curl