From eb02fb37a1069ca1d97c8efbc272c91dbb28587d Mon Sep 17 00:00:00 2001 From: Joerg Lehmann Date: Mon, 5 Jul 2021 15:10:51 +0200 Subject: [PATCH] push as of 05jul2021 --- README.md | 67 ++++++++- ansible/roles/common/tasks/main.yml | 6 + .../roles/mailserver/files/backup-mysql-dbs | 4 + .../mailserver/files/backup-mysql-dbs.sh | 21 +++ .../mailserver/files/default_website.html | 39 +++++- .../roles/mailserver/files/dkim_signing.conf | 5 + ansible/roles/mailserver/files/dovecot.conf | 4 +- ansible/roles/mailserver/files/local.conf | 2 + .../roles/mailserver/files/mail.nbit.ch.conf | 22 ++- ansible/roles/mailserver/files/master.cf | 78 +++++++++++ .../roles/mailserver/files/renew-certificates | 1 - .../files/submission_header_cleanup | 6 + ansible/roles/mailserver/handlers/main.yml | 3 + ansible/roles/mailserver/tasks/main.yml | 127 +++++++++++++++++- .../roles/mailserver/templates/accounts.cf.j2 | 2 +- .../roles/mailserver/templates/aliases.cf.j2 | 2 +- .../roles/mailserver/templates/domains.cf.j2 | 2 +- ansible/roles/mailserver/templates/main.cf.j2 | 10 +- .../templates/recipient-access.cf.j2 | 2 +- .../templates/sender-login-maps.cf.j2 | 2 +- .../mailserver/templates/tls-policy.cf.j2 | 2 +- 21 files changed, 381 insertions(+), 26 deletions(-) create mode 100644 ansible/roles/mailserver/files/backup-mysql-dbs create mode 100644 ansible/roles/mailserver/files/backup-mysql-dbs.sh create mode 100644 ansible/roles/mailserver/files/dkim_signing.conf create mode 100644 ansible/roles/mailserver/files/local.conf create mode 100644 ansible/roles/mailserver/files/master.cf delete mode 100644 ansible/roles/mailserver/files/renew-certificates create mode 100644 ansible/roles/mailserver/files/submission_header_cleanup diff --git a/README.md b/README.md index 30a0af1..3559c00 100644 --- a/README.md +++ b/README.md @@ -39,21 +39,60 @@ Root-Passwort setzen (das machen wir von Hand) ## Ansible Playbook laufen lassen ```bash $ cd ansible -$ ansible-playbook -i production mailserver.yml +$ ansible-playbook -i production --ask-vault-pass mailserver.yml ``` ## Zertifikate erzeugen ```bash -# systemctl stop nginx -# certbot certonly --noninteractive --standalone --agree-tos -m postmaster@nbit.ch -d mail2.nbit.ch -d smtp.nbit.ch -d imap.nbit.ch -# systemctl start nginx +# curl https://get.acme.sh | sh -s email=postmaster@nbit.ch +# acme.sh --issue -d mail.nbit.ch -d smtp.nbit.ch -d imap.nbit.ch -w /var/www/default_webroot + +[Fr Mär 5 10:16:02 CET 2021] Your cert is in /root/.acme.sh/mail.nbit.ch/mail.nbit.ch.cer +[Fr Mär 5 10:16:02 CET 2021] Your cert key is in /root/.acme.sh/mail.nbit.ch/mail.nbit.ch.key +[Fr Mär 5 10:16:02 CET 2021] The intermediate CA cert is in /root/.acme.sh/mail.nbit.ch/ca.cer +[Fr Mär 5 10:16:02 CET 2021] And the full chain certs is there: /root/.acme.sh/mail.nbit.ch/fullchain.cer + +Install Certificate: +# acme.sh --install-cert -d mail.nbit.ch --key-file /etc/letsencrypt/nbit.ch/mail.nbit.ch.key --fullchain-file /etc/letsencrypt/nbit.ch/fullchain.cer --reloadcmd "service nginx force-reload" ``` +## SELinux Policy for Certificates +``` +[root@mail ~]# cat my-mailserver.te + +module my-mailserver 1.0; + +require { + type dovecot_t; + type postfix_smtpd_t; + type public_content_t; + class file read; + class file open; + class file getattr; +} + +#============= dovecot_t ============== +allow dovecot_t public_content_t:file read; +allow dovecot_t public_content_t:file open; + +#============= postfix_smtpd_t ============== +allow postfix_smtpd_t public_content_t:file read; +allow postfix_smtpd_t public_content_t:file open; +allow postfix_smtpd_t public_content_t:file getattr; + + +[root@mail ~]# checkmodule -M -m -o my-mailserver.mod my-mailserver.te +[root@mail ~]# semodule_package -o my-mailserver.pp -m my-mailserver.mod +[root@mail ~]# semodule -i my-mailserver.pp +``` + + ## DB erstellen ```bash # mysql MariaDB [(none)]> create database vmail CHARACTER SET 'utf8'; MariaDB [(none)]> grant select on vmail.* to 'vmail'@'localhost' identified by 'vmaildbpass'; +MariaDB [(none)]> grant SELECT, UPDATE, INSERT, DELETE on vmail.* to 'mailboxadm'@'localhost' identified by 'mailboxadmdbpass'; # anderes Passwort waehlen! MariaDB [(none)]> use vmail; @@ -62,6 +101,7 @@ Folgende Statements durchfuehren: CREATE TABLE `domains` ( `id` int unsigned NOT NULL AUTO_INCREMENT, `domain` varchar(255) NOT NULL, + `mailboxadmin` boolean DEFAULT '0', PRIMARY KEY (`id`), UNIQUE KEY (`domain`) ); @@ -74,6 +114,7 @@ CREATE TABLE `accounts` ( `quota` int unsigned DEFAULT '0', `enabled` boolean DEFAULT '0', `sendonly` boolean DEFAULT '0', + `mailboxadmin` boolean DEFAULT '0', PRIMARY KEY (id), UNIQUE KEY (`username`, `domain`), FOREIGN KEY (`domain`) REFERENCES `domains` (`domain`) @@ -101,4 +142,22 @@ CREATE TABLE `tlspolicies` ( ); ``` +## Mail Domains und Users einrichten + +```bash +MariaDB [(none)]> insert into domains (domain) values ('mysystems.tld'); + +$ doveadm pw -s SHA512-CRYPT +MariaDB [(none)]> insert into accounts (username, domain, password, quota, enabled, sendonly) values ('user1', 'mysystems.tld', '{SHA512-CRYPT}$6$wHyJsS[...]', 2048, true, false); + +MariaDB [(none)]> insert into aliases (source_username, source_domain, destination_username, destination_domain, enabled) values ('alias', 'mysystems.tld', 'user1', 'mysystems.tld', true); +``` + ## DKIM Signing (manuell einrichten) + +```bash +# mkdir /var/lib/rspamd/dkim +# rspamadm dkim_keygen -b 2048 -s 2020 -k /var/lib/rspamd/dkim/2020.key > /var/lib/rspamd/dkim/2020.txt +# chown -R _rspamd:_rspamd /var/lib/rspamd/dkim +# chmod 440 /var/lib/rspamd/dkim/* +``` diff --git a/ansible/roles/common/tasks/main.yml b/ansible/roles/common/tasks/main.yml index 893fda8..bf8153c 100644 --- a/ansible/roles/common/tasks/main.yml +++ b/ansible/roles/common/tasks/main.yml @@ -15,6 +15,9 @@ - telnet - git - yum-utils + - wget + - unzip + - tar - name: Enable SELinux selinux: @@ -82,6 +85,7 @@ service: "{{ item }}" permanent: yes state: disabled + immediate: yes loop: - cockpit notify: reload firewalld @@ -91,8 +95,10 @@ port: "{{ item }}" permanent: yes state: enabled + immediate: yes loop: - 10050/tcp + - 587/tcp notify: reload firewalld - name: Create ~/.forward diff --git a/ansible/roles/mailserver/files/backup-mysql-dbs b/ansible/roles/mailserver/files/backup-mysql-dbs new file mode 100644 index 0000000..5b48206 --- /dev/null +++ b/ansible/roles/mailserver/files/backup-mysql-dbs @@ -0,0 +1,4 @@ +# +# Backup Mysql DBs (dump) +# +55 3 * * * root /usr/local/bin/backup-mysql-dbs.sh >/dev/null diff --git a/ansible/roles/mailserver/files/backup-mysql-dbs.sh b/ansible/roles/mailserver/files/backup-mysql-dbs.sh new file mode 100644 index 0000000..5a08783 --- /dev/null +++ b/ansible/roles/mailserver/files/backup-mysql-dbs.sh @@ -0,0 +1,21 @@ +#!/bin/bash +umask 077 +echo "Alle MySQL-Datenbanken sichern:" +# Bereinigte Liste der Datenbanken erzeugen +DBASELIST=`mktemp` +mysqlshow | awk '{print $2}' | grep -v Databases | sort >$DBASELIST +# Wohin sollen die ganzen Backups geschrieben werden? +cd /backup/mysql-dumps +dir="mysql-dumps-$(hostname)-$(date +%Y%m%d)" +mkdir -p ${dir} +cd ${dir} +for x in `cat $DBASELIST`; do + echo "Datenbank: $x sichern"; + mysqldump --opt --single-transaction $x >$x.sql; +done; +cd /backup/mysql-dumps +tar cvzf ${dir}.tar.gz ${dir} >/dev/null && rm -rf /backup/mysql-dumps/${dir} + +# Cleanup +find /backup/mysql-dumps -type f -mtime +100 \( ! -name "backup-*-*1.????.tar.gz" ! -name "mysql-dumps-???????1.tar.gz" \) -exec rm {} \; + diff --git a/ansible/roles/mailserver/files/default_website.html b/ansible/roles/mailserver/files/default_website.html index 3d9db70..17715a0 100644 --- a/ansible/roles/mailserver/files/default_website.html +++ b/ansible/roles/mailserver/files/default_website.html @@ -1 +1,38 @@ -

mail2.nbit.ch

+ + + + + + + + + + nbit Informatik GmbH - Mailserver + + + + + + + +
+
+ + +

+

Mailserver der nbit Informatik GmbH

+

+

+Webmail +

+

+Mailbox Management +

+
+
+ + diff --git a/ansible/roles/mailserver/files/dkim_signing.conf b/ansible/roles/mailserver/files/dkim_signing.conf new file mode 100644 index 0000000..2fa3cf9 --- /dev/null +++ b/ansible/roles/mailserver/files/dkim_signing.conf @@ -0,0 +1,5 @@ +path = "/var/lib/rspamd/dkim/$selector.key"; +selector = "2020"; + +### Enable DKIM signing for alias sender addresses +allow_username_mismatch = true; diff --git a/ansible/roles/mailserver/files/dovecot.conf b/ansible/roles/mailserver/files/dovecot.conf index c1b6b84..8d738d1 100644 --- a/ansible/roles/mailserver/files/dovecot.conf +++ b/ansible/roles/mailserver/files/dovecot.conf @@ -11,8 +11,8 @@ protocols = imap lmtp sieve ## ssl = required -ssl_cert =