Commit Graph

973 Commits (3afaeecfbb47a5fb00918a02f14f5f635544c033)

Author SHA1 Message Date
Dimitri Huisman e5972bd9ec Set default message rate limit to 200/day
Jack Murray dd127f8f06 Change letsencrypt timer from 1h --> 1 day
There's no need to be calling certbot so frequently
Florent Daigniere 6704cb869a Switch to 3072bits dhparam (instead of 4096bits)
We aim for 128bits of security here
Jack Murray e304c352a1 Change letsencrypt timer from 1h --> 1 day
There's no need to be calling certbot so frequently
Florent Daigniere facc4b6427 Allow specific users to send email from any address
Florent Daigniere ee54a615c1 Alpine has removed support for btree and hash
David Fairbrother 24747e33de Add ability to set no WEBROOT_REDIRECT to Nginx
Adds a 'none' env option to WEBROOT_REDIRECT so that no `location /`
configuration is written to nginx.conf.

This is useful for setting up Mailu and Mailman where we override the
root to proxy to the mailing list server instead. Without this change
the nginx container will not start, or for 1.7 users can set their
WEBMAIL_PATH to / with no webmail to get the same results.

This fix means that future users don't have to choose between webmail
and a root override and makes the configuration intention clear.
Florent Daigniere 0b16291153 doh
Florent Daigniere 1db08018da Ensure that we get certificate validation on top90
I have found a list of the top100 email destinations online and ran them
through a script to ensure that all of their MX servers had valid
configuration... this is the result
Florent Daigniere b066a5e2ac add a default tls_policy_map
Florent Daigniere 1df79f8132 give PFS a chance
Florent Daigniere 925105075c this is required in fact
Diman0 5afbf37292 Resolve build issues
Dimitri Huisman df64601b28
Merge branch 'master' into AdminLTE-3
Florent Daigniere 772e5efb7d Disable pipelining to prevent bypass
Florent Daigniere c76a76c0b0 make it optional, add a knob
Florent Daigniere 109a8aa000 Ensure that we always have CERT+INTERMEDIARY CA
Let's encrypt may change things up in the future...
Florent Daigniere dccd8afd51 Thanks @Diman0!
ENEEDSLEEP
Florent Daigniere 974bcba5ab Restore LOGIN as tests assume it's there
Florent Daigniere 2b05e72ce4 Revert "maybe fix the tests"
This reverts commit f971b47fb9.
Florent Daigniere f971b47fb9 maybe fix the tests
Florent Daigniere 4a871c0905 this causes trouble with the test
Florent Daigniere 12c842c4b9 In fact in fullchain we want all but the last
Florent Daigniere 24f9bf1064 format certs for nginx
Florent Daigniere 98b903fe13 don't send the rootcert
Florent Daigniere 92ec446c20 doh
Florent Daigniere f05cc99dc0 Add ECC certs for modern clients
Florent Daigniere cb68cb312b Reduce the size of the RSA key to 3072bits
This is already generous for certificates that have a 3month validity!

We rekey every single time.
Florent Daigniere 5e7d5adf17 AUTH shouldn't happen on port 25
Florent Daigniere 55cdb1a534 be explicit about what we support
Florent Daigniere ecadf46ac6 fix PFS
Florent Daigniere 7285c6bfd9 admin won't understand LOGIN
Florent Daigniere de3620da4a Don't send credentials in clear ever
Florent Daigniere 4535c42e70 This isn't required
Florent Daigniere 1101e401e8 Apply the restriction on the right port
Florent Daigniere 6d244222da better error message
Florent Daigniere d6ce5d0c06 Remove a warning: limits don't apply to trusted hosts
Florent Daigniere bcdc137677 Alpine has removed support for btree and hash
Florent Daigniere 1438253a06 Ratelimit outgoing emails per user
bors[bot] 48f3b1fd49
Merge
1656: Add ability to set no WEBROOT_REDIRECT to Nginx r=mergify[bot] a=DavidFair

## What type of PR?

Enhancement / Documentation

## What does this PR do?

From commit:

---

Adds a 'none' env option to WEBROOT_REDIRECT so that no `location /`
configuration is written to nginx.conf.

This is useful for setting up Mailu and Mailman where we override the
root to proxy to the mailing list server instead. Without this change
the nginx container will not start, or for 1.7 users can set their
WEBMAIL_PATH to / with no webmail to get the same results.

This fix means that future users don't have to choose between webmail
and a root override and makes the configuration intention clear.

---

I've also added bullet points to break up a long flowing sentence in `configuration.rst` - it should be a bit easier to read now

### Related issue(s)
No Related Issue - I just jumped to a PR

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly

@ Maintainers - Is this worthy of the changelog, it's useful to know about but I imagine the number of people it affects is equally minimal?
- [ ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: David Fairbrother <DavidFair@users.noreply.github.com>
Diman0 588904078e Set default of AUTH_RATELIMIT_SUBNET to False. Increase default AUTH_RATELIMIT value.
Florent Daigniere defea3258d update arm builds too
Florent Daigniere d44608ed04 Merge remote-tracking branch 'upstream/master' into upgrade-alpine
Florent Daigniere f8362d04e4 Switch to openssl to workaround alpine
bors[bot] 6ea4e3217a
Merge
1901: treat localpart case insensitive again r=mergify[bot] a=ghostwheel42

## What type of PR?

bug-fix

## What does this PR do?

fixes error introduced by  where the localpart of an email address was handled case sensitive.
this screwed things up at various other places.
 
### Related issue(s)

closes 
closes 

Co-authored-by: Alexander Graf <ghostwheel42@users.noreply.github.com>
Alexander Graf 6856c2c80f treat localpart case insensitive again
by lowercasing it where necessary
bors[bot] 656cf22126
Merge
1856: update asset builder dependencies r=mergify[bot] a=ghostwheel42

## What type of PR?

update asset builder dependencies

## What does this PR do?

only include needed dependencies to build mailu assets with nodejs v8

### Related issue(s)

update dependencies as discussed in 


Co-authored-by: Alexander Graf <ghostwheel42@users.noreply.github.com>
bors[bot] 9289fa6420
Merge
1896: save dkim key after creation r=mergify[bot] a=ghostwheel42

## What type of PR?

bug-fix

## What does this PR do?

saves generated dkim key after creation vi web ui.
after the model change the domain object needs to be added and flushed via sqlalchemy.

### Related issue(s)

closes 


Co-authored-by: Alexander Graf <ghostwheel42@users.noreply.github.com>
bors[bot] 9a4c6385e5
Merge
1888: Use threads in gunicorn rather than workers/processes r=mergify[bot] a=nextgens

## What type of PR?

enhancement

## What does this PR do?

This ensures that we share the auth-cache... will enable memory savings
and may improve performances when a higher number of cores is available

"smarter default"

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Alexander Graf 54b46a13c6 save dkim key after creation
bors[bot] bf65a1248f
Merge
1885: fix 1884: always lookup a FQDN r=mergify[bot] a=nextgens

## What type of PR?

bugfix

## What does this PR do?

Fix bug . Ensure that we avoid the musl resolver bug by always looking up a FQDN

### Related issue(s)
- closes 

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
bors[bot] bace7ba6e3
Merge
1890: fix Email class in model.py r=mergify[bot] a=ghostwheel42

## What type of PR?

bug-fix

## What does this PR do?

fixes class Email - keep email, localpart and domain in sync.

### Related issue(s)

closes 


Co-authored-by: Alexander Graf <ghostwheel42@users.noreply.github.com>
Alexander Graf ad1b036f20 fix Email class
Florent Daigniere 8d9f3214cc Use threads in gunicorn rather than processes
This ensures that we share the auth-cache... will enable memory savings
and may improve performances when a higher number of cores is available

"smarter default"
Florent Daigniere fa915d7862 Fix 1294 ensure podop's socket is owned by postfix
Florent Daigniere 9d2629a04e fix 1884: always lookup a FQDN
Yaron Shahrabani e0bf75ae17
Completed Hebrew translation
Florent Daigniere 1d65529c94 The lookup could fail; ensure we set something
Florent Daigniere 8bc1d6c08b Replace PUBLIC_HOSTNAME/IP in Received headers
This will ensure that we don't get spam points for not respecting the
RFC
bors[bot] c5ff72d657
Merge
1857: disable startdate when autoreply is disabled r=mergify[bot] a=ghostwheel42

## What type of PR?

bug-fix

## What does this PR do?

disable the reply startdate field when autoreply is disabled


Co-authored-by: Alexander Graf <ghostwheel42@users.noreply.github.com>
Florent Daigniere a0dcd46483 fix : Handle colons in passwords
Alexander Graf 180026bd77 also disable startdate
Alexander Graf 56cfcf8b64 converted tabs to spaces
Alexander Graf 6377ccb2cb re-add jquery and select2 used in app.js
Alexander Graf 3c8a8aa8f0 use less v3 to make less-loader happy
Alexander Graf 1bb059f4c1 switched to newest possible versions for nodejs v8
Alexander Graf 858312a5cb remove explicit jQuery dependency
Alexander Graf 3bb0d68ead add cargo to build cryptography
Alexander Graf 9790dcdabe updated dependencies
Florent Daigniere 72735ab320 remove cyrus-sasl-plain
Florent Daigniere 420afa53f8 Upgrade to alpine 3.14
bors[bot] 4a5f6b1f92
Merge
1791: Enhanced session handling r=mergify[bot] a=ghostwheel42

## What type of PR?

bug-fix

## What does this PR do?

- replaces flask_kvsession and simplekv with a mailu-specific session store
- call cleanup_sessions before first request and not on startup.
  this allows to run cmdline actions without redis (and makes it faster)
- allow running without redis for debugging purposes by setting MEMORY_SESSIONS to True
- don't sign session id, as it has plenty of entropy (as suggested by nextgens)
- adds method to prune a user's sessions

### Related issue(s)
- enhances and close 


Co-authored-by: Alexander Graf <ghostwheel42@users.noreply.github.com>
Alexander Graf 8b71a92219 use fixed msg for key derivation
Alexander Graf 92896ae646 fix bugs in model and schema introduced by
Alexander Graf 6740c77e43 small bugfix for exception
Alexander Graf fab3168c23 Merge remote-tracking branch 'upstream/master' into kvsession
Alexander Graf fbd945390d cleaned imports and fixed datetime and passlib use
Dimitri Huisman 6dc1a19390
Merge branch 'master' into import-export
bors[bot] fc1a663da2
Merge
1754: centralize Webmail authentication behind the admin panel (SSO) r=mergify[bot] a=nextgens

## What type of PR?

Enhancement: it centralizes the authentication of webmails to the admin interface.

## What does this PR do?

It implements the glue required for webmails to do SSO using the admin interface.
One of the main advantages of centralizing things this way is that it reduces significantly the attack surface available to an unauthenticated attacker (no webmail access until there is a valid Flask session).

Others include the ability to implement 2FA down the line and rate-limit things as required.

### Related issue(s)
- 

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
bors[bot] 4ff90683ca
Merge
1758: Implement a simpler credential cache (alternative to ) r=mergify[bot] a=nextgens

## What type of PR?

Feature: it implements a credential cache to speedup authentication requests.

## What does this PR do?

Credentials are stored in cold-storage using a slow, salted/iterated hash function to prevent offline bruteforce attacks. This creates a performance bottleneck for no valid reason (see the
rationale/long version on https://github.com/Mailu/Mailu/issues/1194#issuecomment-762115549).

The new credential cache makes things fast again.

This is the simpler version of  (with no new dependencies)

### Related issue(s)
- close 
- close  
- close 

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


1776: optimize generation of transport nexthop r=mergify[bot] a=ghostwheel42

## What type of PR?

bug-fix and enhancement.

## What does this PR do?

Possibly there should be more input validation when editing a relay, but for now this tries to make the best out of the existing "smtp" attribute while maintaining backwards compatibility. When relay is empty, the transport's nexthop is the MX of the relayed domain to fix  

```
RELAY			NEXTHOP						TRANSPORT
empty			use MX of relay domain				smtp:domain
:port			use MX of relay domain and use port	smtp:domain:port
target			resolve A/AAAA of target			smtp:[target]
target:port		resolve A/AAAA of target and use port	smtp:[target]:port
mx:target		resolve MX of target				smtp:target
mx:target:port	resolve MX of target and use port	smtp:target:port
lmtp:target		resolve A/AAAA of target			lmtp:target
lmtp:target:port	resolve A/AAAA of target and use port	lmtp:target:port

target can also be an IPv4 or IPv6 address (an IPv6 address must be enclosed in []: [2001:DB8::]).
```

When there is proper input validation and existing database entries are migrated this function can be made much shorter again.

### Related issue(s)
- closes  
- closes  

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [X] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Co-authored-by: Alexander Graf <ghostwheel42@users.noreply.github.com>
bors[bot] d9da8e4bb2
Merge
1746: DNS records for client autoconfiguration (RFC6186) r=Diman0 a=nextgens

## What type of PR?

Feature

## What does this PR do?

Add instructions on how to configure rfc6186 DNS records for client autoconfiguration

### Related issue(s)
- 
- 

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
bors[bot] 5d1264e381
Merge
1694: update compression algorithms for current dovecot r=nextgens a=lub

## What type of PR?

enhancement

## What does this PR do?

This adds additional compression algorithms in accordance with
https://doc.dovecot.org/configuration_manual/zlib_plugin/

### Related issue(s)

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: lub <git@lubiland.de>
bors[bot] a1345114bc
Merge
1649: Update docs/reverse.rst with Traefik v2+ info r=mergify[bot] a=patryk-tech

## What type of PR?

Documentation

## What does this PR do?

Adds information about using Traefik v2+ as a reverse proxy.

### Related issue(s)
Closes  

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


1673: Remove rspamd unused env var from start script r=mergify[bot] a=cbachert

## What type of PR?
Cleanup

## What does this PR do?
Remove unused environment variable FRONT_ADDRESS in rspamd. FRONT_ADDRESS references were removed with commit 8172f3e in PR  like mentioned in chat https://matrix.to/#/!MINuyJjJSrfowljYCK:tedomum.net/$160401946364NGNmI:imninja.net?via=huisman.xyz&via=matrix.org&via=imninja.net
```
Mailu$ grep -r "FRONT_ADDRESS" core/rspamd/
core/rspamd/start.py:os.environ["FRONT_ADDRESS"] = system.get_host_address_from_environment("FRONT", "front")
```

### Related issue(s)
N/A

## Prerequistes
- [x] Documentation updated accordingly: No documentation to update
- [x] Add to changelog: Minor change

Co-authored-by: Patryk Tech <git@patryk.tech>
Co-authored-by: cbachert <cbachert@users.noreply.github.com>
Alexander Graf 3f23e199f6 modified generation of session key and added refresh
- the session key is now generated using
  - a hash of the uid seeded by the apps secret_key (size: SESSION_KEY_BITS)
  - a random token (size: 128 bits)
  - the session's creation time (size: 32 bits)

- redis server side sessions are now refreshed after 1/2 the session lifetime
  even if not modified
- the cookie is also updated if necessary
Alexander Graf 9ef8aaf698 removed double confiog and fixed shaker
Alexander Graf a1fd44fced added lmtp: prefix and documentation
lub 40ad3ca032 only load zlib when compression is used
lub 2316ef1162 update compression algorithms for dovecot 3.3.14
xz is deprecated; lz4 and zstd were not present in our configs before
Florent Daigniere 875308d405 Revert "In fact it could be global"
This reverts commit f52984e4c3.
Florent Daigniere f52984e4c3 In fact it could be global
Florent Daigniere ae9206e968 Implement a simple credential cache
DjVinnii 419fed5e6e Add language selector
Alexander Graf 731ce8ede9 fix permanent sessions. hash uid using SECRET_KEY
clean session in redis only once when starting
Alexander Graf 4b8bbf760b default to 128 bits
Alexander Graf 4b71bd56c4 replace flask_kvsession with mailu's own storage
DjVinnii 7dafa22762 Add /language/<language> route for changing the locale using a session variable
DjVinnii f30cca1263 Do imports based on AdminLTE plugins
DjVinnii a4bb42faeb Remove extra space between 'AdminLTE' and 'on' in footer
DjVinnii b2498e8c8f Refactor box macro to card
DjVinnii 5ddea07c9a Fix form input append class