mccarthy.hcoop.net is our first Debian Jessie VM, and is intended to run mail services and the member portal.

1. The Ugly

ServerDeleuze decided to start dying one day so a few evils were committed in moving services.

1.1. Courier

There was insufficient time to do a proper switch to dovecot, but courier seems to work with our patches at least for normal users.

/var/local/lib/spamd is symlinked to spamd's openafs home for legacy purposes -- shared index file is updated, but existing index files based on the template will have the old location.

/etc/pam.d/imap is ugly as hell though. We need to kill courier with fire asap, or see if we can customize using krb5.conf:

#@include common-auth
#@include common-account
#@include common-password
#@include common-session

session         required       pam_afs_session.so debug nopag always_aklog
auth            required       pam_krb5.so debug
auth            required       pam_afs_session.so debug nopag always_aklog
account         required       pam_krb5.so

1.2. Exim

Installed exim4-daemon-heavy procmail spf-tools-perl courier-authlib-userdb sasl2-bin, merged deleuze's config onto the current Debian base exim4 config. No config package has been created. History is lost from deleuze at the moment (diff -ur ...).

Added /etc/ferm/service.{in,out}.d/exim to allow connecting to spamd on hopper and open smtp generally.

adduser Debian-exim mail hcoop-tlscert sasl to allow it to read /etc/courier/exim.dat and hcoop tls cert, and auth against sasld

mkdir /etc/courier /etc/spamassassin for userdb and spamd. domtool-publish should at least make the spamassassin dir...

touch /var/domtool/{local,relay,mailman}_domains.cfg -- but domtool-publish's redo_exim function procedure should test if these exist before using (it is non-fatal for a mail node to not be relaying for anything, but currently requires creating empty files to actually work)

1.2.1. SASL Setup

sasl2-bin, default options except for setting START=yes in /etc/default/saslauthd worked for exim auth

1.2.2. Exim Notes

Blockers:

• Exim now requires that chown() to the delivering user succeeds. This doesn't in afs, because we have tokens for $USER.daemon and not $USER. Need to update so that the chown call is permitted to fail, and then try to come up with a general upstream solution that does not compromise security by default.

  • exim 4.68 (works)

          (void)Uchown(filename, uid, gid);
          (void)Uchmod(filename, mode);

  • exim 4.84 (doesn't work)

          if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
            {
            addr->basic_errno = errno;
            addr->message = string_sprintf("while setting perms on mailbox %s",
              filename);
            addr->transport_return = FAIL;
            goto RETURN;
            }

• Delivery to mailman not on localhost does not work. Need a condition for checking if we are the mailman host, and using something like remote_smtp_smarthost to relay to the mailman host if needed (which is for now with deleuze).

  • I think conf.d/router/470_exim4-config_mailman is the right place (set a different transport if we are not the mailman host)

  • mailmandb is not copied to host unless it is the mailman host, needs to be relayed to all hosts
    • Let's not get stuck with only one mailman node going forward -- it should be possible to have multiple mailman nodes (but only one per domain)
• Default hcoop firewall rules must be updated to allow smtp to mccarthy

Annoyances:

• Overriding MailNodes in domtool does not work entirely -- have to AddMX = false and add the mx record manually as well. Does it even make sense the handleMail and not set a default MX to the correct hcoop mail servers? You can always add additional...

  • otoh, might want set more than one and not make it active for experiments...

Things that need review in the config:

• dc_other_hostnames, dc_relay_nets, unix_domains look like they could be unified, simplifying the config

• DomTool overrides local_domains, and we replace local_domains with unix_domains almost everywhere. domtool should probably generate another domainlist, and we should modify the few places where we need to check user hosted domains (idea for a descriptive name: hosted_domains).

• I think we're doing sender verification wrong

• Do we want to check CHECK_RCPT_DOMAIN_DNSBLS in addition to IP_DNSBLS?

• Load limits do not appear to cause major problems, but review them because they were made for when deleuze was seriously overloaded
  • Similarly, retry/30_exim4_config has weird retry times because afs used to time out on deleuze from overloaded. Revisit.

• We gain tokens in various places by setting an arbitrary environment variable and using side effects of $run{}. There has got to be a better way to grab afs tokens when needed.

• Domtool created files in /etc/ (aliases.hosted + wildcard), /etc/exim4, ... perhaps move all domtool generated files into one directory to help make it immediately obvious what is generated by domtool? All of the files generated by domtool have their paths configured in the exim config afaict.

Misc Changes from Debian:

• /etc/mailname to hcoop.net

• We drop rather than warn for domains in CHECK_RCPT_IP_DNSBLS

Major changes of note from deleuze:

• Using default of /etc/mailman for visible name instead of dc_visiblename
• SPF checking will deny and not just warn
• DKIM checking is on

• dev_null router not included (unused)

• trouble_user logic not included (one time problem, years ago...)

• Using official hcoop cert

2. Setup Issues

• Fix fail2ban

  • ferm resets rules ever time it reloads. Add a ferm hook to reload fail2ban on firewall reload fail2ban configuration needs to be updated to store a persistent database

• sudo $command > file does not work, piping does however. Probably a new sudo option to detect output redirection and squelch output.

• systemd work:
  • domtool unit files seem to work OK so far
  • ferm is likely starting earlier than it should be, and may fail if the generated config references any pts users

  • dnscache-run starts very late by virtue of daemontools starting late. Either hack daemontools to be WantedBy=nss-lookup.target (systemd equiv of LSB $named service), or make dnscache-run a native systemd service.

    • Hacked momentarily by adding Google DNS servers as backups

CategorySystemAdministration