Initial mail server docker image #1
Open
opened 2022-02-11 09:21:11 +00:00 by jon_nfc
·
108 comments
No Branch/Tag Specified
Labels
Clear labels
Bug
Used in discussion about a bug in comments or commits
CVE-2023-5764
Denotes items related to the CVE
CodeReview
Used in comments (issues/MR/commits) to denote code review related items
Documentation
Documentation items
Feature
Used in discussion about a Feature in comments or commits
Lint
Used in comments (issues/MR/commits) to denote lint tasks todo, done, fixed
Privacy
Used in comments (issues/MR/commits) to denote privacy related items
Security
Used in comments (issues/MR/commits) to denote Security related items
breaking-change
label used to denote that the issue/Merge Request does/will introduce a breaking change
bug::reproducable
Given to an issue when the bug has been confirmed as re-producable. Can also be used in comments and commits.
bug::unable to reproduce
Given to an issue when the bug that is not able to be reproduced. Can also be used in comments and commits.
code review::complete
code review::not started
code review::rejected
code review::underway
difficulty::Full Development
Level 3. Difficulty representing that the task to complete must be planned and created.
difficulty::Good First Issue
Level 1. Difficulty representing that the task is very simple and with limited knowledge can be completed.
difficulty::Prior Knowledge
Level 2. Difficulty representing that the task requires some prior knowledge of either the technology or the project for task completion.
documentation::complete
Issues, Merge Requests
documentation::no change required
Issues, Merge Requests and used to denote no documentation changes required
documentation::not started
Issues, Merge Requests
documentation::stalled
Issues, Merge Requests
documentation::underway
Issues, Merge Requests
impact::0
impact::1
impact::2
impact::3
impact::4
impact::5
ops::ansible-roles
OPS project tag
ops::automation
ops::gitlab-ci
OPS project tag
ops::marcas
OPS project tag
ops::python-gitlab-management
OPS project tag
ops::website
priority::0
priority::1
priority::2
priority::3
priority::4
priority::5
stage::Ready for Development
stage::develop
Stage for use in Issues and Merge Requests. Can also be used in discussion in comments and commits
stage::feedback required
stage::planning
Stage for use in Issues and Merge Requests. Can also be used in discussion in comments and commits
stage::test
Stage for use in Issues and Merge Requests. Can also be used in discussion in comments and commits
stale
Label given to issues/merge requests that are considered stale due to no collaboration and is a mark for closure.
triage
Tag given to issues/merge requests requiring triaging by the team.
triage::not_confidential
This tag is given by the triage bot so that URLs can be added to an issue/comment. A triage policy for NFC wide should remove this label.
type::CI / CD
type::automation
This type is used to denote an automation job
type::bug
Type for Issues and Merge Requests. Can also be used in discussion in comments and commits
type::compliance
type::discussion
Type for Issues. Can also be used in discussion in comments.
type::documentation
Type for Issues and Merge Requests. Can also be used in discussion in comments and commits
type::feature
type for Issues and Merge Requests. Can also be used in discussion in comments and commits
type::invalid
label given to tickets that require no action or are deem as invalid.
type::quality assurance
Type for Issues and Merge Requests. Can also be used in discussion in comments and commits
type::question
Type for Issues. Can also be used in discussion in comments.
type::security
Type for Issues and Merge Requests.
type::specification
Design specification
workflow::complete
Issues, Merge Requests
workflow::not ready
workflow::not ready::blocked
workflow::not started
Issues, Merge Requests
workflow::ready to commence
Issues, Merge Requests
workflow::stalled
Label given to issues/merge requests where no work has occured in x days iaw triage policy.
workflow::underway
Issues, Merge Requests
workflow::underway::develop
Milestone
No items
No Milestone
docker-mail - v0.1.0
Projects
Clear projects
No project
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: docker/docker-mail#1
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
No description provided.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
📝 Summary
Create a docker container that can be used as a complete mail server. (mailboxes, mta and lmtp)
✅ Requirements
release version bumps and tags
release on dev branch use tag
nightly?on
git tagpublish to docker hub with tag labelhas backup and restore capabilities (create backup and restore backup)
🔗 References
🚧 Tasks
pagesdirectory to contain docs for website publishinggitlab-ci linked as git submodule
repo syncs to github
commitizen added (
.cz.yamlfile)use pytest to create unit tests
passes open relay tests
post screen
~Documentation for log rotate
from prev issue
📝 Description
As G-Suite is closing down, we now requure an email server. one needs to be built within a docker container that meets the requirements below. SSO auth will be required to tie all of our services together.
Requirements
Secure cyphers only with imap/smtps/submission
smtpd_tls_mandatory_protocols=>=TLSv1(Postfix ≥ 3.6)IMAPS
SMTPS
default no plaintext auth
smtpd_tls_auth_only = yesprefer inbound tcp/25 ssl
smtpd_tls_security_level=maysubmission tcp/587 enforced encryption
smtpd_tls_security_level = encryptsubmission authentication
smtps tcp/465 enforced encryption
smtpd_tls_security_level = encryptsmtps authentication
LDAP Authentication
Back-ups
fetchmail for yahoo and gmail accounts
docker container health check
Webmail
roundcube docker
docker hub
nginx to php-fpm container
roundcube fetchmail setup note the useage of
fetchmail.plfrom postfix as it reads fetchmail config from the setup databasePrivacy / security config
postconf -e disable_vrfy_command=yesDisables being able to find a valid address
dkim and spf signing by postfix
https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-dkim-with-postfix-on-debian-wheezy
https://kb.kolabenterprise.com/guides/configure-dkim-signing-and-verification-using-amavis
versions of software removed from email headerd
versions of software removed form protocols (i.e. as seen when telneting)
reconfigure port 25 to only serve inbound from email servers
Nice to haves
To Do
what happens between smtp server connections? can my smtp request encryption on inbound and fallback to non encrypted if ot support by inbound smtp server
can a user be a part of two domains?
can i get a free google vps with my gmail account
what performance settings are recommended?
webmail
prevent out of office from going to non hosted domains
read receipts not automatically sent
🔗 Links / References
child of nofusscomputing/ops#47
Dovecot Migration from Gmail and Dovecot Migration from Gmail No2
LDAP
a blog on dovecot, postfix and ldap
dovecot lmtp setup for postfix
dovecot sasl auth postfix
more extensive use of ldap
dovecot
Public Namespace quota
dovecot mailbox sharing
Virtual Mailboxes
Postfix:
postfix ldap lookups examples
postfix manual
Spamassassin
Other:
docker container with all the bells email
hardening
Non-Postfix mailbox store: separate domains, non-UNIX accounts
dovecot LDAP groups
ACL setup, dovecot
dovecot shared howto
Server fault, working config but only wants to show inbox
log rotate setup for role
winmail.dat conversion
Send E-Mail on behalf of
sieve scripts stored in ldap. useful for filtering.
sa-learn (spamassassin) database backup
DKIM, SPF and DMARC
RFC7208 Sender Policy Framework (SPF)
🚧 Tasks
services in a docker container
migrate emails from google to this server
backup smtp mta to have a long > 3week wait before failing message it cant forward to dovecot primary, if primary offline
remove users IP address when sending mail
new user welcome message
email quota messages
restrict what can be done with dovecot sieve
user notified if banned for sending email with bad extensions
bounce emails that are spam that was sent by users
add postfix spool to docker volumes
when a tag is created on dev branch, don't tag docker image as latest. tag it dev.
disable backscatter emailing from postfix
postfix notify submission user of spam block submission policy lines 6-9
assigned to @jon_nfc
marked this issue as related to nofusscomputing/infrastructure/config#15
marked this issue as related to nofusscomputing/ops#47
removed the relation with nofusscomputing/ops#47
mentioned in merge request nofusscomputing/infrastructure/config!11
removed the relation with nofusscomputing/infrastructure/config#15
marked this issue as related to nofusscomputing/infrastructure/config#15
time tracking migrated
27h 46m from config 15
82h 34m from config mr 11
added 82h 34m of time spent
added 27h 46m of time spent
changed the description
changed the description
marked this issue as related to nofusscomputing/ops#41
changed title from {-Create initial-} docker image to {+Initial mail server+} docker image
changed the description
changed the description
changed the description
changed the description
made the issue confidential
changed the description
changed the description
changed the description
added 1h 33m of time spent
added 1h 20m of time spent
mentioned in commit
4a6f36d078mentioned in commit
bbd2f14662mentioned in merge request !1
changed the description
added 1h 10m of time spent
moved orig mr time to !1
subtracted 82h 34m of time spent
Security and Feature Audit Checklist
IMAP
Default folders auto create Inbox, drafts, Sent, Trash, Spam, All Mail, Stared, archive
items marked for deletion are expunged
When added to a ldap group, it shows up under shared namespace
can send using an alias as from field
cant set any email in from field and send email
can't connect using no encryption
Shared Email. Reply from shared box states in from field
user replied on behalf ofSMTP
tcp/587 access
can't connect without encryption
must be authenticated
only accept email to hosted virtual domains
open relay check conducted
can receive inbound email from another hosting provider
user can only send from themselves or an alias
All mail through postfix is scanned by amavis (inbound smtp and submission and/or tcp/465)
submission tcp/587 messages are DKIM Signed
inbound SMTP messages DKIM validated
inbound messages SPF validated
Applications
logs to /var/log/{appname}.log
No
Warningsin mail.logNo
Errorsin mail.logAll apps that allow external connections, log success and failures to log file
Dovecot
No
Warningsin logNo
Errorsin logPostfix
prefer encryption for inbound mail from another smtp server
No
Warningsin logNo
Errorsin logamavis
No
Warningsin logNo
Errorsin logAudit checklist
Ensure that the checklist thought process covers each of the workflows of email: in, through and out.
added 2h 45m of time spent
if in user1 sent folder and from filed is user 2 move to user2 sent folder
added 1h of time spent
sieve filter to move to dest user inbox
added 20m of time spent
Docs virtual folder
marked the checklist item on
git tagpublish to docker hub with tag label as completedmarked the checklist item release version bumps and tags as completed
marked the checklist item gitlab-ci linked as git submodule as completed
marked the checklist item repo syncs to github as completed
marked the checklist item commitizen added (
.cz.yamlfile) as completedmarked the checklist item Secure cyphers only with imap/smtps/submission
smtpd_tls_mandatory_protocols=>=TLSv1(Postfix ≥ 3.6) as completedmarked the checklist item IMAPS as completed
marked the checklist item submission tcp/587 enforced encryption
smtpd_tls_security_level = encryptas completedmarked the checklist item submission authentication as completed
marked the checklist item LDAP Authentication as completed
marked the checklist item roundcube docker as completed
marked the checklist item nginx to php-fpm container as completed
marked the checklist item roundcube fetchmail setup note the useage of
fetchmail.plfrom postfix as it reads fetchmail config from the setup database as completedmarked the checklist item versions of software removed from email headerd as completed
marked the checklist item versions of software removed form protocols (i.e. as seen when telneting) as completed
marked the checklist item reconfigure port 25 to only serve inbound from email servers as completed
marked the checklist item can a user be a part of two domains? as completed
marked the checklist item webmail as completed
marked the checklist item use a unix socket from dovecot for post fix to auth against. as completed
marked the checklist item dovecot lmtp setup for postfix as completed
marked the checklist item remove users IP address when sending mail as completed
marked the checklist item services in a docker container as completed
marked the checklist item new user welcome message as completed
marked the checklist item new user welcome message as incomplete
marked the checklist item email quota messages as completed
mentioned in merge request !2
changed the description
mentioned in merge request !3
added 1h 30m of time spent
changed the description
mentioned in merge request !4
mentioned in merge request !5
marked the checklist item release on dev branch use tag
nightly? as completedmarked the checklist item
pagesdirectory to contain docs for website publishing as completedmarked the checklist item fetchmail for yahoo and gmail accounts as completed
marked the checklist item docker hub as completed
mentioned in merge request !6
changed the description
marked the checklist item new user welcome message as completed
changed the description
added 1h 4m of time spent
changed the description
changed the description
changed the description
changed the description
mentioned in merge request !7
changed the description
marked the checklist item tlsv1 secure and suitable for smtp inbound? as completed
marked the checklist item default no plaintext auth
smtpd_tls_auth_only = yesas completedmarked the checklist item prefer inbound tcp/25 ssl
smtpd_tls_security_level=mayas completedmarked the checklist item
postconf -e disable_vrfy_command=yesas completedmarked the checklist item dkim and spf signing by postfix as completed
marked the checklist item log rotate setup for role as completed
marked the checklist item restrict what can be done with dovecot sieve as completed
added 10m of time spent
changed the description
mentioned in merge request !9
changed the description
changed the description
added 10m of time spent
changed the description
marked the checklist item postfix notify submission user of spam block submission policy lines 6-9 as completed
task complete in MR !9
backup ref https://stackoverflow.com/questions/11467698/how-to-backup-filesystem-with-tar-using-a-bash-script
marked the checklist item user notified if banned for sending email with bad extensions as completed
marked the checklist item bounce emails that are spam that was sent by users as completed
marked the checklist item add postfix spool to docker volumes as completed
added 40m of time spent
mentioned in issue nofusscomputing/ops#55
mentioned in issue nofusscomputing/ops#67