252015-05-15 17:56:16ClintonEbadisystem aliases are screwing up some hcoop.net addresses242015-05-15 06:38:06ClintonEbadisuexec does not like the mailman uid, but we're getting somewhere232015-05-15 00:15:35ClintonEbadiPoor mccarthy, filled with hack: yes, we're reverting to an un-config-packaged apache222015-05-14 23:12:36ClintonEbadisome sins of the past will not be repeated212015-05-14 22:48:36ClintonEbadimailman202015-05-14 20:22:57ClintonEbadialmost there, I think192015-05-14 18:05:02ClintonEbadimodifying init script is not cool182015-05-14 13:28:46ClintonEbadisomething is up with system mail, made some tweaks but we'll see172015-05-14 06:37:33ClintonEbadialso need to check configs162015-05-14 06:30:38ClintonEbadimailman should be quick152015-05-14 02:21:48ClintonEbadisasl was easy and the deleuze pam stuff was a red herring, but we have to patch exim so it balances out142015-05-13 23:59:49ClintonEbadiI guess we have to use sasl, gsasl sucks132015-05-13 22:54:08ClintonEbadimore exim nonsense122015-05-13 21:47:57ClintonEbadifail2ban needs to be made persistent to restore112015-05-13 21:13:25ClintonEbadi102015-05-13 21:04:38ClintonEbadi92015-05-13 06:13:59ClintonEbadi82015-05-13 06:10:35ClintonEbadihere's the part where I realize domtool doesn't actually support multiple mailservers.72015-05-13 05:04:42ClintonEbadiuserdb stuff62015-05-13 04:42:41ClintonEbadi52015-05-13 04:39:37ClintonEbadicrazy idea: storing files generated by domtool for exim inone directory might make sense42015-05-13 04:35:05ClintonEbadimore things done32015-05-13 02:25:47ClintonEbadithe exim config makes me unhappy, as it has ages. Writing it down might do something about it. Later.22015-05-13 01:03:47ClintonEbadinote things done to get exim up12015-04-19 19:48:26ClintonEbadi"hcoop works on jessie" proves to be half of a liemccarthy.hcoop.net is our first Debian Jessie VM, and is intended to run mail services and the member portal.

ServerDeleuze decided to start dying one day so a few evils were committed in moving services.

There was insufficient time to do a proper switch to dovecot, but courier seems to work with our patches at least for normal users. /var/local/lib/spamd is symlinked to spamd's openafs home for legacy purposes -- shared index file is updated, but existing index files based on the template will have the old location. /etc/pam.d/imap is ugly as hell though. We need to kill courier with fire asap, or see if we can customize using krb5.conf:

Installed exim4-daemon-heavy procmail spf-tools-perl courier-authlib-userdb sasl2-bin, merged deleuze's config onto the current Debian base exim4 config. No config package has been created. History is lost from deleuze at the moment (diff -ur ...). Added /etc/ferm/service.{in,out}.d/exim to allow connecting to spamd on hopper and open smtp generally. adduser Debian-exim mail hcoop-tlscert sasl to allow it to read /etc/courier/exim.dat and hcoop tls cert, and auth against sasld mkdir /etc/courier /etc/spamassassin for userdb and spamd. domtool-publish should at least make the spamassassin dir... touch /var/domtool/{local,relay,mailman}_domains.cfg -- but domtool-publish's redo_exim function procedure should test if these exist before using (it is non-fatal for a mail node to not be relaying for anything, but currently requires creating empty files to actually work)

sasl2-bin, default options except for setting START=yes in /etc/default/saslauthd worked for exim auth

Blockers: FIXED Exim now requires that chown() to the delivering user succeeds. This doesn't in afs, because we have tokens for $USER.daemon and not $USER. Need to update so that the chown call is permitted to fail, and then try to come up with a general upstream solution that does not compromise security by default. exim 4.68 (works) exim 4.84 (doesn't work) basic_errno = errno; addr->message = string_sprintf("while setting perms on mailbox %s", filename); addr->transport_return = FAIL; goto RETURN; }]]>Delivery to mailman not on localhost does not work. Need a condition for checking if we are the mailman host, and using something like remote_smtp_smarthost to relay to the mailman host if needed (which is for now with deleuze). I think conf.d/router/470_exim4-config_mailman is the right place (set a different transport if we are not the mailman host) mailmandb is not copied to host unless it is the mailman host, needs to be relayed to all hosts Let's not get stuck with only one mailman node going forward -- it should be possible to have multiple mailman nodes (but only one per domain) Default hcoop firewall rules must be updated to allow smtp to mccarthy Actually, shouldn't -- firewall should be ok since it uses dns but double check (then just ferm reload after switching, done) check all .forward and .procmailrc for any programs run and ensure they are installed on mccarthy check all domtool config for anyone setting deleuze as their mx or MailNodes manually Things that need review in the config: dc_other_hostnames, dc_relay_nets, unix_domains look like they could be unified, simplifying the config DomTool overrides local_domains, and we replace local_domains with unix_domains almost everywhere. domtool should probably generate another domainlist, and we should modify the few places where we need to check user hosted domains (idea for a descriptive name: hosted_domains). I think we're doing sender verification wrong Do we want to check CHECK_RCPT_DOMAIN_DNSBLS in addition to IP_DNSBLS? Load limits do not appear to cause major problems, but review them because they were made for when deleuze was seriously overloaded Similarly, retry/30_exim4_config has weird retry times because afs used to time out on deleuze from overloaded. Revisit. We gain tokens in various places by setting an arbitrary environment variable and using side effects of $run{}. There has got to be a better way to grab afs tokens when needed. Domtool created files in /etc/ (aliases.hosted + wildcard), /etc/exim4, ... perhaps move all domtool generated files into one directory to help make it immediately obvious what is generated by domtool? All of the files generated by domtool have their paths configured in the exim config afaict. Misc Changes from Debian: /etc/mailname to hcoop.net We drop rather than warn for domains in CHECK_RCPT_IP_DNSBLS Several important addresses @hcoop.net only routed because of /etc/aliases on deleuze. Put into domtool, and discovered that system aliases were interfering. We need hcoop.net to be a local domain for local user resolution, removed some aliases to allow domtool generated aliases to be used: Added logs to /etc/aliases. May try using domain "mccarthy.hcoop.net" where DNS = noDns with emailAlias ... end (do not want to override zone settings from hcoop.net, just want to add new aliases) Major changes of note from deleuze: Using default of /etc/mailman for visible name instead of dc_visiblename SPF checking will deny and not just warn DKIM checking is on dev_null router not included (unused) trouble_user log ic not included (one time problem, years ago...) Using official hcoop cert not listening on smtps port -- looks deprecated? lowuid router used to send mail for lowuids to logs@hcoop.net. Still requires domtool to have a logs@hcoop.net alias to function. Set /etc/mailname to mccarthy.hcoop.net. /etc/exim4/get-token stores tokens in /var/local/mail-tokens instead of /tmp/exim4 and is shared with courier instead of courier having its own script. Also attempts to krenew a ticket, only kiniting a new ticket if it cannot be renewed for at least another 30 minutes. mailman transport can be configured to forward to another host (copied back to deleuze for transition)

Installed mailman which brought in apache2.4. We do not yet have a config package due to waklog not building, punting for now since mailman is on the local file system. Copied /etc/mailman from deleuze, plus one new bit for review later Add /etc/mailman to path for vhosts_cfg instead of symlinking into /usr/lib/mailman/Mailman. Cloned vhosts_cfg.py from deleuze to test things Mailman defaults to setgid for programs. This is terrible. See if it just needs a dpkg-reconfigure. Installed /etc/cron.d/hcoop-mailman-update-exim-db from deleuze Stock apache suexec will not suexec as users with UID < 100, bumped to 113:116. todo: . should be really quick switch mailman host in domtool /pipermail is broken, apache won't suexec to list and perms are broken. Adjust list user ID later, and use suexec.

fastcgi php support is not yet ready and suphp is gone in jessie with non-trivial work required to support it. Config is base apache, + vhosts dir (just enough to work for now). todo: apache sync logs cron job so members can see their list vhost traffic

Fix fail2ban ferm resets rules ever time it reloads. Add a ferm hook to reload fail2ban on firewall reload fail2ban configuration needs to be updated to store a persistent database sudo $command > file does not work, piping does however. Probably a new sudo option to detect output redirection and squelch output. systemd work: domtool unit files seem to work OK so far ferm is likely starting earlier than it should be, and may fail if the generated config references any pts users dnscache-run starts very late by virtue of daemontools starting late. Either hack daemontools to be WantedBy=nss-lookup.target (systemd equiv of LSB $named service), or make dnscache-run a native systemd service. Hacked momentarily by adding Google DNS servers as backups CategorySystemAdministration