evgeny/modoboa-installer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #493 from modoboa/rspamd

Browse Source 
Added Rspamd installation
This commit is contained in:
Antoine Nguyen
2025-08-19 17:40:00 +02:00
committed by GitHub
parent fbedc6a051 2c6c3a7573
commit af1fb15953
40 changed files with 711 additions and 165 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.gitignore vendored
View File

@@ -58,3 +58,8 @@ target/
# PyCharm
.idea/
#KDE
*.kdev4
installer.cfg

22
README.rst
View File

@@ -9,8 +9,8 @@ An installer which deploy a complete mail server based on Modoboa.
This tool is still in beta stage, it has been tested on:
* Debian 10 and upper
* Ubuntu Bionic Beaver (18.04) and upper
* Debian 12 and upper
* Ubuntu Focal Fossa (20.04) and upper
.. warning::
@@ -43,7 +43,7 @@ The following components are installed by the installer:
* Nginx and uWSGI
* Postfix
* Dovecot
* Amavis (with SpamAssassin and ClamAV)
* Amavis (with SpamAssassin and ClamAV) or Rspamd
* automx (autoconfiguration service)
* OpenDKIM
* Radicale (CalDAV and CardDAV server)
@@ -229,6 +229,22 @@ If you want to use already generated certs, simply edit the
tls_cert_file_path = *path to tls fullchain file*
tls_key_file_path = *path to tls key file*
Antispam
========
You have 3 options regarding antispam : disabled, Amavis, Rspamd
Amavis
------
Amavis
Rspamd
------
Rspamd
.. |workflow| image:: https://github.com/modoboa/modoboa-installer/workflows/Modoboa%20installer/badge.svg
.. |codecov| image:: https://codecov.io/gh/modoboa/modoboa-installer/graph/badge.svg?token=Fo2o1GdHZq
:target: https://codecov.io/gh/modoboa/modoboa-installer

2
checks.py → modoboa_installer/checks.py
View File

@@ -26,7 +26,7 @@ def check_version():
"Check README file for instructions about how to update.\n"
"No support will be provided without an up-to-date installer!"
)
answer = utils.user_input("Continue anyway? (Y/n) ")
answer = utils.user_input("Continue anyway? (y/N) ")
if not answer.lower().startswith("y"):
sys.exit(0)
else:

7
modoboa_installer/compatibility_matrix.py
View File

@@ -37,3 +37,10 @@ REMOVED_EXTENSIONS = {
"modoboa-radicale": "2.4.0",
"modoboa-webmail": "2.4.0",
}
APP_INCOMPATIBILITY = {
"opendkim": ["rspamd"],
"amavis": ["rspamd"],
"postwhite": ["rspamd"],
"spamassassin": ["rspamd"]
}

103
modoboa_installer/config_dict_template.py
View File

@@ -27,6 +27,26 @@ ConfigDictTemplate = [
}
]
},
{
"name": "antispam",
"values": [
{
"option": "enabled",
"default": "true",
"customizable": True,
"values": ["true", "false"],
"question": "Do you want to setup an antispam utility?"
},
{
"option": "type",
"default": "amavis",
"customizable": True,
"question": "Please select your antispam utility",
"values": ["rspamd", "amavis"],
"if": ["antispam.enabled=true"]
}
]
},
{
"name": "certificate",
"values": [
@@ -50,7 +70,7 @@ ConfigDictTemplate = [
},
{
"name": "letsencrypt",
"if": "certificate.type=letsencrypt",
"if": ["certificate.type=letsencrypt"],
"values": [
{
"option": "email",
@@ -85,7 +105,7 @@ ConfigDictTemplate = [
},
{
"name": "postgres",
"if": "database.engine=postgres",
"if": ["database.engine=postgres"],
"values": [
{
"option": "user",
@@ -101,7 +121,7 @@ ConfigDictTemplate = [
},
{
"name": "mysql",
"if": "database.engine=mysql",
"if": ["database.engine=mysql"],
"values": [
{
"option": "user",
@@ -185,6 +205,13 @@ ConfigDictTemplate = [
"customizable": True,
"question": "Please enter Modoboa db password",
},
{
"option": "cron_error_recipient",
"default": "root",
"customizable": True,
"question":
"Please enter a mail recipient for cron error reports"
},
{
"option": "extensions",
"default": ""
@@ -224,12 +251,60 @@ ConfigDictTemplate = [
},
]
},
{
"name": "rspamd",
"if": ["antispam.enabled=true", "antispam.type=rspamd"],
"values": [
{
"option": "enabled",
"default": ["antispam.enabled=true", "antispam.type=rspamd"],
},
{
"option": "user",
"default": "_rspamd",
},
{
"option": "password",
"default": make_password,
"customizable": True,
"question": "Please enter Rspamd interface password",
},
{
"option": "dnsbl",
"default": "true",
},
{
"option": "dkim_keys_storage_dir",
"default": "/var/lib/dkim"
},
{
"option": "key_map_path",
"default": "/var/lib/dkim/keys.path.map"
},
{
"option": "selector_map_path",
"default": "/var/lib/dkim/selectors.path.map"
},
{
"option": "greylisting",
"default": "true"
},
{
"option": "whitelist_auth",
"default": "true"
},
{
"option": "whitelist_auth_weigth",
"default": "-5"
}
],
},
{
"name": "amavis",
"values": [
{
"option": "enabled",
"default": "true",
"default": ["antispam.enabled=true", "antispam.type=amavis"],
},
{
"option": "user",
@@ -250,8 +325,6 @@ ConfigDictTemplate = [
{
"option": "dbpassword",
"default": make_password,
"customizable": True,
"question": "Please enter amavis db password"
},
],
},
@@ -299,6 +372,14 @@ ConfigDictTemplate = [
"option": "postmaster_address",
"default": "postmaster@%(domain)s",
},
{
"option": "radicale_auth_socket_path",
"default": "/var/run/dovecot/auth-radicale",
},
{
"option": "move_spam_to_junk",
"default": "true",
},
]
},
{
@@ -319,7 +400,7 @@ ConfigDictTemplate = [
"values": [
{
"option": "enabled",
"default": "true",
"default": "false",
},
{
"option": "config_dir",
@@ -353,7 +434,7 @@ ConfigDictTemplate = [
"values": [
{
"option": "enabled",
"default": "true",
"default": ["antispam.enabled=true", "antispam.type=amavis"],
},
{
"option": "config_dir",
@@ -363,10 +444,11 @@ ConfigDictTemplate = [
},
{
"name": "spamassassin",
"if": ["antispam.enabled=true", "antispam.type=amavis"],
"values": [
{
"option": "enabled",
"default": "true",
"default": ["antispam.enabled=true", "antispam.type=amavis"],
},
{
"option": "config_dir",
@@ -432,10 +514,11 @@ ConfigDictTemplate = [
},
{
"name": "opendkim",
"if": ["antispam.enabled=true", "antispam.type=amavis"],
"values": [
{
"option": "enabled",
"default": "true",
"default": ["antispam.enabled=true", "antispam.type=amavis"],
},
{
"option": "user",

51
modoboa_installer/disclaimers.py Normal file
View File

@@ -0,0 +1,51 @@
from . import utils
def installation_disclaimer(args, config):
"""Display installation disclaimer."""
hostname = config.get("general", "hostname")
utils.printcolor(
"Notice:\n"
"It is recommanded to run this installer on a FRESHLY installed server.\n"
"(ie. with nothing special already installed on it)\n",
utils.CYAN
)
utils.printcolor(
"Warning:\n"
"Before you start the installation, please make sure the following "
"DNS records exist for domain '{}':\n"
" {} IN A <IP ADDRESS OF YOUR SERVER>\n"
" @ IN MX {}.\n".format(
args.domain,
hostname.replace(".{}".format(args.domain), ""),
hostname
),
utils.YELLOW
)
utils.printcolor(
"Your mail server will be installed with the following components:",
utils.BLUE)
def upgrade_disclaimer(config):
"""Display upgrade disclaimer."""
utils.printcolor(
"Your mail server is about to be upgraded and the following components"
" will be impacted:", utils.BLUE
)
def backup_disclaimer():
"""Display backup disclamer. """
utils.printcolor(
"Your mail server will be backed up locally.\n"
" !! You should really transfer the backup somewhere else...\n"
" !! Custom configuration (like for postfix) won't be saved.", utils.BLUE)
def restore_disclaimer():
"""Display restore disclamer. """
utils.printcolor(
"You are about to restore a previous installation of Modoboa.\n"
"If a new version has been released in between, please update your database!",
utils.BLUE)

27
modoboa_installer/package.py
View File

@@ -2,6 +2,8 @@
import re
from os.path import isfile as file_exists
from . import utils
@@ -49,6 +51,29 @@ class DEBPackage(Package):
def restore_system(self):
utils.exec_cmd("rm -f {}".format(self.policy_file))
def add_custom_repository(self,
name: str,
url: str,
key_url: str,
codename: str,
with_source: bool = True):
key_file = f"/etc/apt/keyrings/{name}.gpg"
utils.exec_cmd(
f"wget -O - {key_url} | gpg --dearmor | tee {key_file} > /dev/null"
)
line_types = ["deb"]
if with_source:
line_types.append("deb-src")
for line_type in line_types:
line = (
f"{line_type} [arch=amd64 signed-by={key_file}] "
f"{url} {codename} main"
)
target_file = f"/etc/apt/sources.list.d/{name}.list"
tee_option = "-a" if file_exists(target_file) else ""
utils.exec_cmd(f'echo "{line}" | tee {tee_option} {target_file}')
self.index_updated = False
def update(self, force=False):
"""Update local cache."""
if self.index_updated and not force:
@@ -89,7 +114,7 @@ class RPMPackage(Package):
def __init__(self, dist_name):
"""Initialize backend."""
super(RPMPackage, self).__init__(dist_name)
super().__init__(dist_name)
if "centos" in dist_name:
self.install("epel-release")

7
modoboa_installer/scripts/clamav.py
View File

@@ -42,9 +42,10 @@ class Clamav(base.Installer):
"""Additional tasks."""
if package.backend.FORMAT == "deb":
user = self.config.get(self.appname, "user")
system.add_user_to_group(
user, self.config.get("amavis", "user")
)
if self.config.getboolean("amavis", "enabled"):
system.add_user_to_group(
user, self.config.get("amavis", "user")
)
pattern = (
"s/^AllowSupplementaryGroups false/"
"AllowSupplementaryGroups true/")

41
modoboa_installer/scripts/dovecot.py
View File

@@ -4,6 +4,7 @@ import glob
import os
import pwd
import shutil
import stat
import uuid
from .. import database
@@ -15,6 +16,7 @@ from . import base
class Dovecot(base.Installer):
"""Dovecot installer."""
appname = "dovecot"
@@ -26,9 +28,13 @@ class Dovecot(base.Installer):
"dovecot", "dovecot-pigeonhole"]
}
config_files = [
"dovecot.conf", "dovecot-dict-sql.conf.ext", "conf.d/10-ssl.conf",
"conf.d/10-master.conf", "conf.d/20-lmtp.conf", "conf.d/10-ssl-keys.try",
"conf.d/dovecot-oauth2.conf.ext"
"dovecot.conf",
"dovecot-dict-sql.conf.ext",
"conf.d/10-ssl.conf",
"conf.d/10-master.conf",
"conf.d/20-lmtp.conf",
"conf.d/10-ssl-keys.try",
"conf.d/dovecot-oauth2.conf.ext",
]
with_user = True
@@ -40,7 +46,15 @@ class Dovecot(base.Installer):
def get_config_files(self):
"""Additional config files."""
return self.config_files + [
_config_files = self.config_files
if self.app_config["move_spam_to_junk"]:
_config_files += [
"conf.d/custom_after_sieve/spam-to-junk.sieve",
"conf.d/90-sieve.conf",
]
return _config_files + [
"dovecot-sql-{}.conf.ext=dovecot-sql.conf.ext"
.format(self.dbengine),
"dovecot-sql-master-{}.conf.ext=dovecot-sql-master.conf.ext"
@@ -117,10 +131,22 @@ class Dovecot(base.Installer):
"ssl_protocol_parameter": ssl_protocol_parameter,
"modoboa_2_2_or_greater": "" if self.modoboa_2_2_or_greater else "#",
"not_modoboa_2_2_or_greater": "" if not self.modoboa_2_2_or_greater else "#",
"do_move_spam_to_junk": "" if self.app_config["move_spam_to_junk"] else "#",
"oauth2_introspection_url": oauth2_introspection_url
})
return context
def install_config_files(self):
"""Create sieve dir if needed."""
if self.app_config["move_spam_to_junk"]:
utils.mkdir_safe(
f"{self.config_dir}/conf.d/custom_after_sieve",
stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP |
stat.S_IROTH | stat.S_IXOTH,
0, 0
)
super().install_config_files()
def post_run(self):
"""Additional tasks."""
if self.dbengine == "postgres":
@@ -137,7 +163,8 @@ class Dovecot(base.Installer):
self.get_file_path("fix_modoboa_postgres_schema.sql")
)
for f in glob.glob("{}/*".format(self.get_file_path("conf.d"))):
utils.copy_file(f, "{}/conf.d".format(self.config_dir))
if os.path.isfile(f):
utils.copy_file(f, "{}/conf.d".format(self.config_dir))
# Make postlogin script executable
utils.exec_cmd("chmod +x /usr/local/bin/postlogin.sh")
# Only root should have read access to the 10-ssl-keys.try
@@ -145,6 +172,10 @@ class Dovecot(base.Installer):
utils.exec_cmd("chmod 600 /etc/dovecot/conf.d/10-ssl-keys.try")
# Add mailboxes user to dovecot group for modoboa mailbox commands.
# See https://github.com/modoboa/modoboa/issues/2157.
if self.app_config["move_spam_to_junk"]:
# Compile sieve script
sieve_file = f"{self.config_dir}/conf.d/custom_after_sieve/spam-to-junk.sieve"
utils.exec_cmd(f"/usr/bin/sievec {sieve_file}")
system.add_user_to_group(self.mailboxes_owner, 'dovecot')
def restart_daemon(self):

2
modoboa_installer/scripts/files/dovecot/conf.d/90-sieve.conf → modoboa_installer/scripts/files/dovecot/conf.d/90-sieve.conf.tpl
View File

@@ -38,7 +38,7 @@ plugin {
# Identical to sieve_before, only the specified scripts are executed after the
# user's script (only when keep is still in effect!). Multiple script file or
# directory paths can be specified by appending an increasing number.
#sieve_after =
%{do_move_spam_to_junk}sieve_after = /etc/dovecot/conf.d/custom_after_sieve
#sieve_after2 =
#sieve_after2 = (etc...)

4
modoboa_installer/scripts/files/dovecot/conf.d/custom_after_sieve/spam-to-junk.sieve.tpl Normal file
View File

@@ -0,0 +1,4 @@
require "fileinto";
if header :contains "X-Spam-Status" "Yes" {
fileinto "Junk";
}

1
modoboa_installer/scripts/files/modoboa/crontab.tpl
View File

@@ -3,6 +3,7 @@
#
PYTHON=%{venv_path}/bin/python
INSTANCE=%{instance_path}
MAILTO=%{cron_error_recipient}
# Operations on mailboxes
%{dovecot_enabled}* * * * * %{dovecot_mailboxes_owner} $PYTHON $INSTANCE/manage.py handle_mailbox_operations

2
modoboa_installer/scripts/files/modoboa/supervisor-rq-dkim.tpl
View File

@@ -3,7 +3,7 @@ autostart=true
autorestart=true
command=%{venv_path}/bin/python %{home_dir}/instance/manage.py rqworker dkim
directory=%{home_dir}
user=%{opendkim_user}
user=%{dkim_user}
redirect_stderr=true
numprocs=1
stopsignal=TERM

7
modoboa_installer/scripts/files/nginx/modoboa.conf.tpl
View File

@@ -37,6 +37,13 @@ server {
try_files $uri $uri/ =404;
}
%{rspamd_enabled} location /rspamd/ {
%{rspamd_enabled} proxy_pass http://localhost:11334/;
%{rspamd_enabled}
%{rspamd_enabled} proxy_set_header Host $host;
%{rspamd_enabled} proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
%{rspamd_enabled} }
location ~ ^/(api|accounts) {
include uwsgi_params;
uwsgi_param UWSGI_SCRIPT instance.wsgi:application;

11
modoboa_installer/scripts/files/postfix/anonymize_headers.pcre.tpl Normal file
View File

@@ -0,0 +1,11 @@
if /^\s*Received:.*Authenticated sender.*\(Postfix\)/
/^Received: from .*? \([\w\-.]* \[.*?\]\)(.*|\n.*)\(Authenticated sender: (.+)\)\s+by.+\(Postfix\) with (.*)/
REPLACE Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with $3
endif
if /^\s*Received: from .*rspamd.localhost .*\(Postfix\)/
/^Received: from.* (.*|\n.*)\((.+) (.+)\)\s+by (.+) \(Postfix\) with (.*)/
REPLACE Received: from rspamd (rspamd $3) by $4 (Postfix) with $5
endif
/^\s*X-Enigmail/ IGNORE
/^\s*X-Originating-IP/ IGNORE
/^\s*X-Forward/ IGNORE

45
modoboa_installer/scripts/files/postfix/main.cf.tpl
View File

@@ -122,10 +122,19 @@ strict_rfc821_envelopes = yes
%{opendkim_enabled}milter_default_action = accept
%{opendkim_enabled}milter_content_timeout = 30s
# Rspamd setup
%{rspamd_enabled}smtpd_milters = inet:localhost:11332
%{rspamd_enabled}non_smtpd_milters = inet:localhost:11332
%{rspamd_enabled}milter_default_action = accept
%{rspamd_enabled}milter_protocol = 6
# List of authorized senders
smtpd_sender_login_maps =
proxy:%{db_driver}:/etc/postfix/sql-sender-login-map.cf
# Add authenticated header to hide public client IP
smtpd_sasl_authenticated_header = yes
# Recipient restriction rules
smtpd_recipient_restrictions =
check_policy_service inet:127.0.0.1:9999
@@ -142,27 +151,27 @@ smtpd_recipient_restrictions =
## Postcreen settings
#
postscreen_access_list =
permit_mynetworks
cidr:/etc/postfix/postscreen_spf_whitelist.cidr
postscreen_blacklist_action = enforce
%{rspamd_disabled}postscreen_access_list =
%{rspamd_disabled} permit_mynetworks
%{rspamd_disabled} cidr:/etc/postfix/postscreen_spf_whitelist.cidr
%{rspamd_disabled}postscreen_blacklist_action = enforce
# Use some DNSBL
postscreen_dnsbl_sites =
zen.spamhaus.org=127.0.0.[2..11]*3
bl.spameatingmonkey.net=127.0.0.2*2
bl.spamcop.net=127.0.0.2
postscreen_dnsbl_threshold = 3
postscreen_dnsbl_action = enforce
%{rspamd_disabled}postscreen_dnsbl_sites =
%{rspamd_disabled} zen.spamhaus.org=127.0.0.[2..11]*3
%{rspamd_disabled} bl.spameatingmonkey.net=127.0.0.2*2
%{rspamd_disabled} bl.spamcop.net=127.0.0.2
%{rspamd_disabled}postscreen_dnsbl_threshold = 3
%{rspamd_disabled}postscreen_dnsbl_action = enforce
postscreen_greet_banner = Welcome, please wait...
postscreen_greet_action = enforce
%{rspamd_disabled}postscreen_greet_banner = Welcome, please wait...
%{rspamd_disabled}postscreen_greet_action = enforce
postscreen_pipelining_enable = yes
postscreen_pipelining_action = enforce
%{rspamd_disabled}postscreen_pipelining_enable = yes
%{rspamd_disabled}postscreen_pipelining_action = enforce
postscreen_non_smtp_command_enable = yes
postscreen_non_smtp_command_action = enforce
%{rspamd_disabled}postscreen_non_smtp_command_enable = yes
%{rspamd_disabled}postscreen_non_smtp_command_action = enforce
postscreen_bare_newline_enable = yes
postscreen_bare_newline_action = enforce
%{rspamd_disabled}postscreen_bare_newline_enable = yes
%{rspamd_disabled}postscreen_bare_newline_action = enforce

6
modoboa_installer/scripts/files/postfix/master.cf.tpl
View File

@@ -9,7 +9,8 @@
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n - - - 1 postscreen
%{rspamd_disabled}smtp inet n - - - 1 postscreen
%{rspamd_enabled}smtp inet n - - - - smtpd
smtpd pass - - - - - smtpd
%{amavis_enabled} -o smtpd_proxy_filter=inet:[127.0.0.1]:10024
%{amavis_enabled} -o smtpd_proxy_options=speed_adjust
@@ -26,6 +27,7 @@ submission inet n - - - - smtpd
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=reject_sender_login_mismatch
-o milter_macro_daemon_name=ORIGINATING
-o cleanup_service_name=ascleanup
%{amavis_enabled} -o smtpd_proxy_filter=inet:[127.0.0.1]:10026
#smtps inet n - - - - smtpd
# -o syslog_name=postfix/smtps
@@ -41,6 +43,8 @@ submission inet n - - - - smtpd
#628 inet n - - - - qmqpd
pickup unix n - - 60 1 pickup
cleanup unix n - - - 0 cleanup
ascleanup unix n - - - 0 cleanup
-o header_checks=pcre:/etc/postfix/anonymize_headers.pcre
qmgr unix n - n 300 1 qmgr
#qmgr unix n - n 300 1 oqmgr
tlsmgr unix - - - 1000? 1 tlsmgr

14
modoboa_installer/scripts/files/rspamd/local.d/antivirus.conf.tpl Normal file
View File

@@ -0,0 +1,14 @@
clamav {
scan_mime_parts = true;
scan_text_mime = true;
scan_image_mime = true;
retransmits = 2;
timeout = 30;
symbol = "CLAM_VIRUS";
type = "clamav";
servers = "127.0.0.1:3310"
patterns {
# symbol_name = "pattern";
JUST_EICAR = "Test.EICAR";
}
}

3
modoboa_installer/scripts/files/rspamd/local.d/arc.conf.tpl Normal file
View File

@@ -0,0 +1,3 @@
try_fallback = false;
selector_map = "%selector_map_path";
path_map = "%key_map_path";

3
modoboa_installer/scripts/files/rspamd/local.d/dkim_signing.conf.tpl Normal file
View File

@@ -0,0 +1,3 @@
try_fallback = false;
selector_map = "%selector_map_path";
path_map = "%key_map_path";

21
modoboa_installer/scripts/files/rspamd/local.d/dmarc.conf.tpl Normal file
View File

@@ -0,0 +1,21 @@
reporting {
# Required attributes
enabled = true; # Enable reports in general
email = 'postmaster@%hostname'; # Source of DMARC reports
domain = '%hostname'; # Domain to serve
org_name = '%hostname'; # Organisation
# Optional parameters
#bcc_addrs = ["postmaster@example.com"]; # additional addresses to copy on reports
report_local_controller = false; # Store reports for local/controller scans (for testing only)
#helo = 'rspamd.localhost'; # Helo used in SMTP dialog
#smtp = '127.0.0.1'; # SMTP server IP
#smtp_port = 25; # SMTP server port
from_name = '%hostname DMARC REPORT'; # SMTP FROM
msgid_from = 'rspamd'; # Msgid format
#max_entries = 1k; # Maxiumum amount of entries per domain
#keys_expire = 2d; # Expire date for Redis keys
#only_domains = '/path/to/map'; # Only store reports from domains or eSLDs listed in this map
# Available from 3.3
#exclude_domains = '/path/to/map'; # Exclude reports from domains or eSLDs listed in this map
#exclude_domains = ["example.com", "another.com"]; # Alternative, use array to exclude reports from domains or eSLDs
}

5
modoboa_installer/scripts/files/rspamd/local.d/force_actions.conf.tpl Normal file
View File

@@ -0,0 +1,5 @@
rules {
DMARC_POLICY_QUARANTINE {
action = "add header";
}
}

2
modoboa_installer/scripts/files/rspamd/local.d/greylist.conf.tpl Normal file
View File

@@ -0,0 +1,2 @@
%{greylisting_disabled}enabled = false;
servers = "127.0.0.1:6379";

5
modoboa_installer/scripts/files/rspamd/local.d/groups.conf.tpl Normal file
View File

@@ -0,0 +1,5 @@
symbols {
"WHITELIST_AUTHENTICATED" {
weight = %whitelist_auth_weigth;
}
}

20
modoboa_installer/scripts/files/rspamd/local.d/metrics.conf.tpl Normal file
View File

@@ -0,0 +1,20 @@
actions {
reject = 15; # normal value is 15, 150 so it will never be rejected
add_header = 6; # set to 0.1 for testing, 6 for normal operation.
rewrite_subject = 8; # Default: 8
greylist = 4; # Default: 4
}
group "antivirus" {
symbol "JUST_EICAR" {
weight = 10;
description = "Eicar test signature";
}
symbol "CLAM_VIRUS_FAIL" {
weight = 0;
}
symbol "CLAM_VIRUS" {
weight = 10;
description = "ClamAV found a Virus";
}
}

16
modoboa_installer/scripts/files/rspamd/local.d/milter_headers.conf.tpl Normal file
View File

@@ -0,0 +1,16 @@
use = ["x-spam-status","x-virus","authentication-results" ];
extended_spam_headers = false;
skip_local = false;
skip_authenticated = false;
routines {
x-virus {
header = "X-Virus";
remove = 1;
symbols = ["CLAM_VIRUS", "JUST_EICAR"];
}
}

1
modoboa_installer/scripts/files/rspamd/local.d/mx_check.conf.tpl Normal file
View File

@@ -0,0 +1 @@
enabled = true;

6
modoboa_installer/scripts/files/rspamd/local.d/rbl.conf.tpl Normal file
View File

@@ -0,0 +1,6 @@
# to disable all predefined rules if the user doesn't want dnsbl
url_whitelist = [];
rbls {
}

2
modoboa_installer/scripts/files/rspamd/local.d/redis.conf.tpl Normal file
View File

@@ -0,0 +1,2 @@
write_servers = "localhost";
read_servers = "localhost";

8
modoboa_installer/scripts/files/rspamd/local.d/settings.conf.tpl Normal file
View File

@@ -0,0 +1,8 @@
authenticated {
priority = high;
authenticated = yes;
apply {
groups_disabled = ["rbl", "spf"];
}
%{whitelist_auth_enabled} symbols ["WHITELIST_AUTHENTICATED"];
}

6
modoboa_installer/scripts/files/rspamd/local.d/spf.conf.tpl Normal file
View File

@@ -0,0 +1,6 @@
spf_cache_size = 1k;
spf_cache_expire = 1d;
max_dns_nesting = 10;
max_dns_requests = 30;
min_cache_ttl = 5m;
disable_ipv6 = false;

1
modoboa_installer/scripts/files/rspamd/local.d/worker-controller.inc.tpl Normal file
View File

@@ -0,0 +1 @@
enable_password = %controller_password

1
modoboa_installer/scripts/files/rspamd/local.d/worker-normal.inc.tpl Normal file
View File

@@ -0,0 +1 @@
enabled = false;

3
modoboa_installer/scripts/files/rspamd/local.d/worker-proxy.inc.tpl Normal file
View File

@@ -0,0 +1,3 @@
upstream "local" {
self_scan = yes;
}

18
modoboa_installer/scripts/modoboa.py
View File

@@ -49,13 +49,7 @@ class Modoboa(base.Installer):
self.instance_path = self.config.get("modoboa", "instance_path")
self.extensions = self.config.get("modoboa", "extensions").split()
self.devmode = self.config.getboolean("modoboa", "devmode")
# Sanity check for amavis
self.amavis_enabled = False
if "modoboa-amavis" in self.extensions:
if self.config.getboolean("amavis", "enabled"):
self.amavis_enabled = True
else:
self.extensions.remove("modoboa-amavis")
self.amavis_enabled = self.config.getboolean("amavis", "enabled")
self.dovecot_enabled = self.config.getboolean("dovecot", "enabled")
self.opendkim_enabled = self.config.getboolean("opendkim", "enabled")
self.dkim_cron_enabled = False
@@ -241,6 +235,7 @@ class Modoboa(base.Installer):
"dovecot_mailboxes_owner": (
self.config.get("dovecot", "mailboxes_owner")),
"opendkim_user": self.config.get("opendkim", "user"),
"dkim_user": "_rspamd" if self.config.getboolean("rspamd", "enabled") else self.config.get("opendkim", "user"),
"minutes": random.randint(1, 59),
"hours": f"{random_hour},{random_hour+12}",
"modoboa_2_2_or_greater": "" if self.modoboa_2_2_or_greater else "#",
@@ -284,6 +279,15 @@ class Modoboa(base.Installer):
if self.config.getboolean("opendkim", "enabled"):
settings["admin"]["dkim_keys_storage_dir"] = (
self.config.get("opendkim", "keys_storage_dir"))
if self.config.getboolean("rspamd", "enabled"):
settings["admin"]["dkim_keys_storage_dir"] = (
self.config.get("rspamd", "dkim_keys_storage_dir"))
settings["modoboa_rspamd"] = {
"key_map_path": self.config.get("rspamd", "key_map_path"),
"selector_map_path": self.config.get("rspamd", "selector_map_path")
}
settings = json.dumps(settings)
query = (
"UPDATE core_localconfig SET _parameters='{}'"

23
modoboa_installer/scripts/postfix.py
View File

@@ -18,10 +18,9 @@ class Postfix(base.Installer):
appname = "postfix"
packages = {
"deb": ["postfix"],
"rpm": ["postfix"],
"deb": ["postfix", "postfix-pcre"],
}
config_files = ["main.cf", "master.cf"]
config_files = ["main.cf", "master.cf", "anonymize_headers.pcre"]
def get_packages(self):
"""Additional packages."""
@@ -60,7 +59,9 @@ class Postfix(base.Installer):
"modoboa_instance_path": self.config.get(
"modoboa", "instance_path"),
"opendkim_port": self.config.get(
"opendkim", "port")
"opendkim", "port"),
"rspamd_disabled": "" if not self.config.getboolean(
"rspamd", "enabled") else "#"
})
return context
@@ -101,8 +102,18 @@ class Postfix(base.Installer):
utils.exec_cmd("postalias {}".format(aliases_file))
# Postwhite
install("postwhite", self.config, self.upgrade, self.archive_path)
condition = (
not self.config.getboolean("rspamd", "enabled") and
self.config.getboolean("postwhite", "enabled")
)
if condition:
install("postwhite", self.config, self.upgrade, self.archive_path)
def backup(self, path):
"""Launch postwhite backup."""
backup("postwhite", self.config, path)
condition = (
not self.config.getboolean("rspamd", "enabled") and
self.config.getboolean("postwhite", "enabled")
)
if condition:
backup("postwhite", self.config, path)

154
modoboa_installer/scripts/rspamd.py Normal file
View File

@@ -0,0 +1,154 @@
"""Rspamd related functions."""
import os
import pwd
import stat
from .. import package
from .. import utils
from .. import system
from . import base
from . import install
class Rspamd(base.Installer):
"""Rspamd installer."""
appname = "rspamd"
packages = {
"deb": [
"rspamd", "redis"
]
}
config_files = [
"local.d/arc.conf",
"local.d/dkim_signing.conf",
"local.d/dmarc.conf",
"local.d/force_actions.conf",
"local.d/greylist.conf",
"local.d/metrics.conf",
"local.d/milter_headers.conf",
"local.d/mx_check.conf",
"local.d/redis.conf",
"local.d/settings.conf",
"local.d/spf.conf",
"local.d/worker-normal.inc",
"local.d/worker-proxy.inc",
]
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
self.generate_password_condition = (
not self.upgrade or utils.user_input(
"Do you want to (re)generate rspamd password ? (y/N)").lower().startswith("y")
)
@property
def config_dir(self):
"""Return appropriate config dir."""
return "/etc/rspamd"
def install_packages(self):
debian_based_dist, codename = utils.is_dist_debian_based()
if debian_based_dist:
utils.mkdir_safe(
"/etc/apt/keyrings",
stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP |
stat.S_IROTH | stat.S_IXOTH,
0, 0
)
package.backend.add_custom_repository(
"rspamd",
"http://rspamd.com/apt-stable/",
"https://rspamd.com/apt-stable/gpg.key",
codename
)
package.backend.update()
return super().install_packages()
def install_config_files(self):
"""Make sure config directory exists."""
user = self.config.get(self.appname, "user")
pw = pwd.getpwnam(user)
targets = [
[self.app_config["dkim_keys_storage_dir"], pw[2], pw[3]]
]
for target in targets:
if not os.path.exists(target[0]):
utils.mkdir(
target[0],
stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP |
stat.S_IROTH | stat.S_IXOTH,
target[1], target[2]
)
super().install_config_files()
def get_config_files(self):
"""Return appropriate config files."""
_config_files = self.config_files
if self.config.getboolean("clamav", "enabled"):
_config_files.append("local.d/antivirus.conf")
if self.app_config["dnsbl"].lower() == "true":
_config_files.append("local.d/rbl.conf")
if self.app_config["whitelist_auth"].lower() == "true":
_config_files.append("local.d/groups.conf")
if self.generate_password_condition:
_config_files.append("local.d/worker-controller.inc")
return _config_files
def get_template_context(self):
_context = super().get_template_context()
_context["greylisting_disabled"] = "" if not self.app_config["greylisting"].lower() == "true" else "#"
_context["whitelist_auth_enabled"] = "" if self.app_config["whitelist_auth"].lower() == "true" else "#"
if self.generate_password_condition:
code, controller_password = utils.exec_cmd(
r"rspamadm pw -p {}".format(self.app_config["password"]))
if code != 0:
utils.error("Error setting rspamd password. "
"Please make sure it is not 'q1' or 'q2'."
"Storing the password in plain. See"
"https://rspamd.com/doc/quickstart.html#setting-the-controller-password")
_context["controller_password"] = self.app_config["password"]
else:
controller_password = controller_password.decode().replace("\n", "")
_context["controller_password"] = controller_password
return _context
def post_run(self):
"""Additional tasks."""
user = self.config.get(self.appname, "user")
system.add_user_to_group(
self.config.get("modoboa", "user"),
user
)
if self.config.getboolean("clamav", "enabled"):
install("clamav", self.config, self.upgrade, self.archive_path)
def custom_backup(self, path):
"""Backup custom configuration if any."""
custom_config_dir = os.path.join(self.config_dir,
"/local.d/")
custom_backup_dir = os.path.join(path, "/rspamd/")
local_files = [f for f in os.listdir(custom_config_dir)
if os.path.isfile(custom_config_dir, f)
]
for file in local_files:
utils.copy_file(file, custom_backup_dir)
if len(local_files) != 0:
utils.success("Rspamd custom configuration saved!")
def restore(self):
"""Restore custom config files."""
custom_config_dir = os.path.join(self.config_dir,
"/local.d/")
custom_backup_dir = os.path.join(self.archive_path, "/rspamd/")
backed_up_files = [
f for f in os.listdir(custom_backup_dir)
if os.path.isfile(custom_backup_dir, f)
]
for f in backed_up_files:
utils.copy_file(f, custom_config_dir)
utils.success("Custom Rspamd configuration restored.")

97
modoboa_installer/utils.py
View File

@@ -1,5 +1,6 @@
"""Utility functions."""
import configparser
import contextlib
import datetime
import getpass
@@ -13,12 +14,9 @@ import string
import subprocess
import sys
import uuid
try:
import configparser
except ImportError:
import ConfigParser as configparser
from . import config_dict_template
from .compatibility_matrix import APP_INCOMPATIBILITY
ENV = {}
@@ -34,12 +32,7 @@ class FatalError(Exception):
def user_input(message):
"""Ask something to the user."""
try:
from builtins import input
except ImportError:
answer = raw_input(message)
else:
answer = input(message)
answer = input(message)
return answer
@@ -102,6 +95,17 @@ def dist_name():
return dist_info()[0].lower()
def is_dist_debian_based() -> (bool, str):
"""Check if current OS is Debian based or not."""
status, codename = exec_cmd("lsb_release -c -s")
codename = codename.decode().strip().lower()
return codename in [
"bionic", "bookworm", "bullseye", "buster",
"focal", "jammy", "jessie", "sid", "stretch",
"trusty", "wheezy", "xenial"
], codename
def mkdir(path, mode, uid, gid):
"""Create a directory."""
if not os.path.exists(path):
@@ -173,25 +177,29 @@ def copy_from_template(template, dest, context):
fp.write(ConfigFileTemplate(buf).substitute(context))
def check_config_file(dest, interactive=False, upgrade=False, backup=False, restore=False):
def check_config_file(dest,
interactive=False,
upgrade=False,
backup=False,
restore=False):
"""Create a new installer config file if needed."""
is_present = True
if os.path.exists(dest):
return is_present, update_config(dest, False)
if upgrade:
printcolor(
error(
"You cannot upgrade an existing installation without a "
"configuration file.", RED)
"configuration file.")
sys.exit(1)
elif backup:
is_present = False
printcolor(
error(
"Your configuration file hasn't been found. A new one will be generated. "
"Please edit it with correct password for the databases !", RED)
"Please edit it with correct password for the databases !")
elif restore:
printcolor(
error(
"You cannot restore an existing installation without a "
f"configuration file. (file : {dest} has not been found...", RED)
f"configuration file. (file : {dest} has not been found...")
sys.exit(1)
printcolor(
@@ -277,6 +285,16 @@ def random_key(l=16):
return key
def check_if_condition(config, entry):
"""Check if the "if" directive is present and computes it"""
section_if = True
for condition in entry:
config_key, value = condition.split("=")
section_name, option = config_key.split(".")
section_if = config.get(section_name, option) == value
return section_if
def validate(value, config_entry):
if value is None:
return False
@@ -297,11 +315,14 @@ def validate(value, config_entry):
return True
def get_entry_value(entry, interactive):
if callable(entry["default"]):
def get_entry_value(entry: dict, interactive: bool, config: configparser.ConfigParser) -> string:
default_entry = entry["default"]
if type(default_entry) is type(list()):
default_value = str(check_if_condition(config, default_entry)).lower()
elif callable(default_entry):
default_value = entry["default"]()
else:
default_value = entry["default"]
default_value = default_entry
user_value = None
if entry.get("customizable") and interactive:
while (user_value != '' and not validate(user_value, entry)):
@@ -337,16 +358,22 @@ def load_config_template(interactive):
config = configparser.ConfigParser()
# only ask about options we need, else still generate default
for section in tpl_dict:
interactive_section = interactive
if "if" in section:
config_key, value = section.get("if").split("=")
section_name, option = config_key.split(".")
interactive_section = (
config.get(section_name, option) == value and interactive)
else:
interactive_section = interactive
condition = check_if_condition(config, section["if"])
interactive_section = condition and interactive
config.add_section(section["name"])
for config_entry in section["values"]:
value = get_entry_value(config_entry, interactive_section)
if config_entry.get("if") is not None:
interactive_section = (interactive_section and
check_if_condition(
config, config_entry["if"]
)
)
value = get_entry_value(config_entry,
interactive_section,
config)
config.set(section["name"], config_entry["option"], value)
return config
@@ -446,7 +473,7 @@ def validate_backup_path(path: str, silent_mode: bool):
if not path_exists:
if not silent_mode:
create_dir = input(
f"\"{path}\" doesn't exist, would you like to create it? [Y/n]\n"
f"\"{path}\" doesn't exist, would you like to create it? [y/N]\n"
).lower()
if silent_mode or (not silent_mode and create_dir.startswith("y")):
@@ -461,7 +488,7 @@ def validate_backup_path(path: str, silent_mode: bool):
if len(os.listdir(path)) != 0:
if not silent_mode:
delete_dir = input(
"Warning: backup directory is not empty, it will be purged if you continue... [Y/n]\n").lower()
"Warning: backup directory is not empty, it will be purged if you continue... [y/N]\n").lower()
if silent_mode or (not silent_mode and delete_dir.startswith("y")):
try:
@@ -504,3 +531,15 @@ def create_oauth2_app(app_name: str, client_id: str, config) -> tuple[str, str]:
)
exec_cmd(cmd)
return client_id, client_secret
def check_app_compatibility(section, config):
"""Check that the app can be installed in regards to other enabled apps."""
incompatible_app = []
if section in APP_INCOMPATIBILITY.keys():
for app in APP_INCOMPATIBILITY[section]:
if config.getboolean(app, "enabled"):
error(f"{section} cannot be installed if {app} is enabled. "
"Please disable one of them.")
incompatible_app.append(app)
return len(incompatible_app) == 0

111
run.py
View File

@@ -3,15 +3,12 @@
"""An installer for Modoboa."""
import argparse
import configparser
import datetime
import os
try:
import configparser
except ImportError:
import ConfigParser as configparser
import sys
import checks
from modoboa_installer import checks
from modoboa_installer import compatibility_matrix
from modoboa_installer import constants
from modoboa_installer import package
@@ -19,75 +16,24 @@ from modoboa_installer import scripts
from modoboa_installer import ssl
from modoboa_installer import system
from modoboa_installer import utils
from modoboa_installer import disclaimers
PRIMARY_APPS = [
"amavis",
"fail2ban",
"modoboa",
"automx",
"radicale",
"uwsgi",
"nginx",
"opendkim",
"postfix",
"dovecot"
]
def installation_disclaimer(args, config):
"""Display installation disclaimer."""
hostname = config.get("general", "hostname")
utils.printcolor(
"Notice:\n"
"It is recommanded to run this installer on a FRESHLY installed server.\n"
"(ie. with nothing special already installed on it)\n",
utils.CYAN
)
utils.printcolor(
"Warning:\n"
"Before you start the installation, please make sure the following "
"DNS records exist for domain '{}':\n"
" {} IN A <IP ADDRESS OF YOUR SERVER>\n"
" @ IN MX {}.\n".format(
args.domain,
hostname.replace(".{}".format(args.domain), ""),
hostname
),
utils.YELLOW
)
utils.printcolor(
"Your mail server will be installed with the following components:",
utils.BLUE)
def upgrade_disclaimer(config):
"""Display upgrade disclaimer."""
utils.printcolor(
"Your mail server is about to be upgraded and the following components"
" will be impacted:", utils.BLUE
)
def backup_disclaimer():
"""Display backup disclamer. """
utils.printcolor(
"Your mail server will be backed up locally.\n"
" !! You should really transfer the backup somewhere else...\n"
" !! Custom configuration (like for postfix) won't be saved.", utils.BLUE)
def restore_disclaimer():
"""Display restore disclamer. """
utils.printcolor(
"You are about to restore a previous installation of Modoboa.\n"
"If a new version has been released in between, please update your database!",
utils.BLUE)
def backup_system(config, args):
"""Launch backup procedure."""
backup_disclaimer()
disclaimers.backup_disclaimer()
backup_path = None
if args.silent_backup:
if not args.backup_path:
@@ -135,12 +81,11 @@ def config_file_update_complete(backup_location):
utils.BLUE)
def main(input_args):
"""Install process."""
def parser_setup(input_args):
parser = argparse.ArgumentParser()
versions = (
["latest"] + list(compatibility_matrix.COMPATIBILITY_MATRIX.keys())
)
)
parser.add_argument("--debug", action="store_true", default=False,
help="Enable debug output")
parser.add_argument("--force", action="store_true", default=False,
@@ -168,7 +113,7 @@ def main(input_args):
parser.add_argument(
"--backup", action="store_true", default=False,
help="Backing up interactively previously installed instance"
)
)
parser.add_argument(
"--silent-backup", action="store_true", default=False,
help="For script usage, do not require user interaction "
@@ -181,13 +126,18 @@ def main(input_args):
"--restore", type=str, metavar="path",
help="Restore a previously backup up modoboa instance on a NEW machine. "
"You MUST provide backup directory"
),
)
parser.add_argument(
"--skip-checks", action="store_true", default=False,
help="Skip the checks the installer performs initially")
parser.add_argument("domain", type=str,
help="The main domain of your future mail server")
args = parser.parse_args(input_args)
return parser.parse_args(input_args)
def main(input_args):
"""Install process."""
args = parser_setup(input_args)
if args.debug:
utils.ENV["debug"] = True
@@ -246,28 +196,36 @@ def main(input_args):
config.set("modoboa", "version", args.version)
config.set("modoboa", "install_beta", str(args.beta))
if config.get("antispam", "type") == "amavis":
antispam_apps = ["amavis", "opendkim"]
else:
antispam_apps = ["rspamd"]
if args.backup or args.silent_backup:
backup_system(config, args)
return
# Display disclaimer python 3 linux distribution
if args.upgrade:
upgrade_disclaimer(config)
disclaimers.upgrade_disclaimer(config)
elif args.restore:
restore_disclaimer()
disclaimers.restore_disclaimer()
scripts.restore_prep(args.restore)
else:
installation_disclaimer(args, config)
disclaimers.installation_disclaimer(args, config)
# Show concerned components
components = []
for section in config.sections():
if section in ["general", "database", "mysql", "postgres",
if section in ["general", "antispam", "database", "mysql", "postgres",
"certificate", "letsencrypt", "backup"]:
continue
if (config.has_option(section, "enabled") and
not config.getboolean(section, "enabled")):
continue
incompatible_app_detected = not utils.check_app_compatibility(section, config)
if incompatible_app_detected:
sys.exit(0)
components.append(section)
utils.printcolor(" ".join(components), utils.YELLOW)
if not args.force:
@@ -284,19 +242,26 @@ def main(input_args):
ssl_backend = ssl.get_backend(config)
if ssl_backend and not args.upgrade:
ssl_backend.generate_cert()
for appname in PRIMARY_APPS:
for appname in PRIMARY_APPS + antispam_apps:
scripts.install(appname, config, args.upgrade, args.restore)
system.restart_service("cron")
package.backend.restore_system()
hostname = config.get("general", "hostname")
if not args.restore:
utils.success(
"Congratulations! You can enjoy Modoboa at https://{} (admin:password)"
.format(config.get("general", "hostname"))
f"Congratulations! You can enjoy Modoboa at https://{hostname} "
"(admin:password)"
)
else:
utils.success(
"Restore complete! You can enjoy Modoboa at https://{} (same credentials as before)"
.format(config.get("general", "hostname"))
f"Restore complete! You can enjoy Modoboa at https://{hostname} "
"(same credentials as before)"
)
if config.getboolean("rspamd", "enabled"):
rspamd_password = config.get("rspamd", "password")
utils.success(
f"You can also enjoy rspamd at https://{hostname}/rspamd "
f"(password: {rspamd_password})"
)
utils.success(
"\n"

13
tests.py
View File

@@ -47,7 +47,7 @@ class ConfigFileTestCase(unittest.TestCase):
def test_interactive_mode(self, mock_user_input):
"""Check interactive mode."""
mock_user_input.side_effect = [
"0", "0", "", "", "", "", ""
"0", "0", "", "", "", "", "", ""
]
with open(os.devnull, "w") as fp:
sys.stdout = fp
@@ -99,7 +99,7 @@ class ConfigFileTestCase(unittest.TestCase):
def test_interactive_mode_letsencrypt(self, mock_user_input):
"""Check interactive mode."""
mock_user_input.side_effect = [
"1", "admin@example.test", "0", "", "", "", "", ""
"0", "0", "1", "admin@example.test", "0", "", "", "", ""
]
with open(os.devnull, "w") as fp:
sys.stdout = fp
@@ -126,12 +126,13 @@ class ConfigFileTestCase(unittest.TestCase):
"example.test"])
self.assertTrue(os.path.exists(self.cfgfile))
self.assertIn(
"modoboa automx amavis clamav dovecot nginx razor postfix"
" postwhite spamassassin uwsgi",
"fail2ban modoboa automx amavis clamav dovecot nginx "
"postfix postwhite spamassassin uwsgi radicale opendkim",
out.getvalue()
)
self.assertNotIn("It seems that your config file is outdated.",
out.getvalue()
self.assertNotIn(
"It seems that your config file is outdated.",
out.getvalue()
)
@patch("modoboa_installer.utils.user_input")