DNS: added www subdomain to zonefile

chatmaild/pyproject.toml

@@ -10,10 +10,6 @@ dependencies = [
   "iniconfig",
   "deltachat-rpc-server",
   "deltachat-rpc-client",
-  "ConfigArgParse",
-  "deltachat",
-  "setuptools>=60",
-  "setuptools-scm>=8",
 ]
 
 [tool.setuptools]
@@ -26,7 +22,6 @@ where = ['src']
 doveauth = "chatmaild.doveauth:main"
 filtermail = "chatmaild.filtermail:main"
 echobot = "chatmaild.echo:main"
-greeterbot = "chatmaild.greeterbot:main"
 chatmail-metrics = "chatmaild.metrics:main"
 
 [project.entry-points.pytest11]

chatmaild/src/chatmaild/database.py

@@ -46,17 +46,11 @@ class Connection:
             )
         return result
 
-    def get_user_list(self) -> set[str]:
-        """Get a set of all users."""
-        q = "SELECT addr from users"
-        return set([tup[0] for tup in self._sqlconn.execute(q).fetchall()])
-
 
 class Database:
-    def __init__(self, path: str, read_only=False):
+    def __init__(self, path: str):
         self.path = Path(path)
-        if not read_only:
-            self.ensure_tables()
+        self.ensure_tables()
 
     def _get_connection(
         self, write=False, transaction=False, closing=False

chatmaild/src/chatmaild/doveauth.py

@@ -46,7 +46,7 @@ def is_allowed_to_create(config: Config, user, cleartext_password) -> bool:
         len(localpart) > config.username_max_length
         or len(localpart) < config.username_min_length
     ):
-        if localpart not in ("echo", "hello"):
+        if localpart != "echo":
             logging.warning(
                 "localpart %s has to be between %s and %s chars long",
                 localpart,

chatmaild/src/chatmaild/greeterbot.py

@@ -1,132 +0,0 @@
-import time
-
-import deltachat
-from deltachat.tracker import ConfigureFailed
-from time import sleep
-import tempfile
-import os
-import configargparse
-import pkg_resources
-import secrets
-
-from chatmaild.database import Database
-from chatmaild.config import read_config
-from chatmaild.newemail import ALPHANUMERIC_PUNCT, CONFIG_PATH
-
-PASSDB_PATH = "/home/vmail/passdb.sqlite"
-
-
-def setup_account(data_dir: str, debug: bool) -> deltachat.Account:
-    """Create a deltachat account with a given addr/password combination.
-
-    :param data_dir: the directory where the data(base) is stored.
-    :param debug: whether to show log messages for the account.
-    :return: the deltachat account object.
-    """
-    chatmail_config = read_config(CONFIG_PATH)
-    addr = "hello@" + chatmail_config.mail_domain
-
-    try:
-        os.mkdir(os.path.join(data_dir, addr))
-    except FileExistsError:
-        pass
-    db_path = os.path.join(data_dir, addr, "db.sqlite")
-
-    ac = deltachat.Account(db_path)
-    if debug:
-        ac.add_account_plugin(deltachat.events.FFIEventLogger(ac))
-
-    ac.set_config("mvbox_move", "0")
-    ac.set_config("sentbox_watch", "0")
-    ac.set_config("bot", "1")
-    ac.set_config("mdns_enabled", "0")
-
-    if not ac.is_configured():
-        cleartext_password = "".join(
-            secrets.choice(ALPHANUMERIC_PUNCT)
-            for _ in range(chatmail_config.password_min_length + 3)
-        )
-        ac.set_config("mail_pw", cleartext_password)
-        ac.set_config("addr", addr)
-
-        configtracker = ac.configure()
-        try:
-            configtracker.wait_finish()
-        except ConfigureFailed:
-            print(
-                "configuration setup failed for %s with password:\n%s"
-                % (ac.get_config("addr"), ac.get_config("mail_pw"))
-            )
-            raise
-
-    ac.start_io()
-    avatar = pkg_resources.resource_filename(__name__, "avatar.jpg")
-    ac.set_avatar(avatar)
-    ac.set_config("displayname", f"Hello at {chatmail_config.mail_domain}!")
-    return ac
-
-
-class GreetBot:
-    def __init__(self, passdb, account):
-        self.db = Database(passdb, read_only=True)
-        self.account = account
-        self.domain = account.get_config("addr").split("@")[1]
-        with self.db.read_connection() as conn:
-            self.existing_users = conn.get_user_list()
-
-    def greet_users(self):
-        with self.db.read_connection() as conn:
-            users = conn.get_user_list()
-        new_users = users.difference(self.existing_users)
-        self.existing_users = users
-        time.sleep(20)  # wait until Delta is configured on the user side
-        for user in new_users:
-            for ci_prefix in ["ac1_", "ac2_", "ac3_", "ac4_", "ac5_", "ci-"]:
-                if user.startswith(ci_prefix):
-                    continue
-            if user not in [c.addr for c in self.account.get_contacts()]:
-                print("Inviting", user)
-                contact = self.account.create_contact(user)
-                chat = contact.create_chat()
-                chat.send_text(
-                    "Welcome to %s! Here you can try out Delta Chat." % (self.domain,)
-                )
-                chat.send_text(
-                    "I prepared some webxdc apps for you, if you are interested:"
-                )
-                chat.send_file(pkg_resources.resource_filename(__name__, "editor.xdc"))
-                chat.send_file(
-                    pkg_resources.resource_filename(__name__, "tower-builder.xdc")
-                )
-                chat.send_text(
-                    "You can visit https://webxdc.org/apps to discover more apps! "
-                    "Some of these games you can also play with friends, directly in the chat."
-                )
-
-
-def main():
-    args = configargparse.ArgumentParser()
-    args.add_argument("--db_path", help="location of the Delta Chat database")
-    args.add_argument(
-        "--passdb", default=PASSDB_PATH, help="location of the chatmail passdb"
-    )
-    args.add_argument("--show-ffi", action="store_true", help="print Delta Chat log")
-    ops = args.parse_args()
-
-    # ensuring account data directory
-    if ops.db_path is None:
-        tempdir = tempfile.TemporaryDirectory(prefix="hellobot")
-        ops.db_path = tempdir.name
-    elif not os.path.exists(ops.db_path):
-        os.mkdir(ops.db_path)
-
-    ac = setup_account(ops.db_path, ops.show_ffi)
-    greeter = GreetBot(ops.passdb, ac)
-    print("waiting for new chatmail users...")
-    while 1:
-        greeter.greet_users()
-        sleep(5)
-
-
-if __name__ == "__main__":
-    main()

chatmaild/src/chatmaild/greeterbot.service.f

@@ -1,11 +0,0 @@
-[Unit]
-Description=Chatmail greeterbot, a Delta Chat bot to greet new users
-
-[Service]
-ExecStart={execpath} --passdb {passdb_path} --db_path /home/vmail/greeterbot/ --show-ffi
-User=vmail
-Restart=always
-RestartSec=30
-
-[Install]
-WantedBy=multi-user.target

chatmaild/src/chatmaild/tests/mail-data/plain.eml

@@ -7,7 +7,7 @@ Date: Sun, 15 Oct 2023 16:41:44 +0000
 Message-ID: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>
 References: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>
 Chat-Version: 1.0
-Autocrypt: addr={from_addr}; prefer-encrypt=mutual;
+Autocrypt: addr=foobar@c2.testrun.org; prefer-encrypt=mutual;
 	keydata=xjMEZSrw3hYJKwYBBAHaRw8BAQdAiEKNQFU28c6qsx4vo/JHdt73RXdjMOmByf/XsGiJ7m
 	nNFzxmb29iYXJAYzIudGVzdHJ1bi5vcmc+wosEEBYIADMCGQEFAmUq8N4CGwMECwkIBwYVCAkKCwID
 	FgIBFiEEGil0OvTIa6RngmCLUYNnEa9leJAACgkQUYNnEa9leJCX3gEAhm0MehE5byBBU1avPczr/I
@@ -20,4 +20,4 @@ Content-Type: text/plain; charset=utf-8; format=flowed; delsp=no
 
 Hi!
 
-
+

cmdeploy/src/cmdeploy/__init__.py

@@ -101,13 +101,11 @@ def _install_remote_venv_with_chatmaild(config) -> None:
         "doveauth",
         "filtermail",
         "echobot",
-        "greeterbot",
     ):
         params = dict(
             execpath=f"{remote_venv_dir}/bin/{fn}",
             config_path=remote_chatmail_inipath,
             remote_venv_dir=remote_venv_dir,
-            passdb_path="/home/vmail/passdb.sqlite",
         )
         source_path = importlib.resources.files("chatmaild").joinpath(f"{fn}.service.f")
         content = source_path.read_text().format(**params).encode()
@@ -128,6 +126,71 @@ def _install_remote_venv_with_chatmaild(config) -> None:
         )
 
 
+def _configure_opendkim(domain: str, dkim_selector: str = "dkim") -> bool:
+    """Configures OpenDKIM"""
+    need_restart = False
+
+    main_config = files.template(
+        src=importlib.resources.files(__package__).joinpath("opendkim/opendkim.conf"),
+        dest="/etc/opendkim.conf",
+        user="root",
+        group="root",
+        mode="644",
+        config={"domain_name": domain, "opendkim_selector": dkim_selector},
+    )
+    need_restart |= main_config.changed
+
+    files.directory(
+        name="Add opendkim directory to /etc",
+        path="/etc/opendkim",
+        user="opendkim",
+        group="opendkim",
+        mode="750",
+        present=True,
+    )
+
+    keytable = files.template(
+        src=importlib.resources.files(__package__).joinpath("opendkim/KeyTable"),
+        dest="/etc/dkimkeys/KeyTable",
+        user="opendkim",
+        group="opendkim",
+        mode="644",
+        config={"domain_name": domain, "opendkim_selector": dkim_selector},
+    )
+    need_restart |= keytable.changed
+
+    signing_table = files.template(
+        src=importlib.resources.files(__package__).joinpath("opendkim/SigningTable"),
+        dest="/etc/dkimkeys/SigningTable",
+        user="opendkim",
+        group="opendkim",
+        mode="644",
+        config={"domain_name": domain, "opendkim_selector": dkim_selector},
+    )
+    need_restart |= signing_table.changed
+
+    files.directory(
+        name="Add opendkim socket directory to /var/spool/postfix",
+        path="/var/spool/postfix/opendkim",
+        user="opendkim",
+        group="opendkim",
+        mode="750",
+        present=True,
+    )
+
+    if not host.get_fact(File, f"/etc/dkimkeys/{dkim_selector}.private"):
+        server.shell(
+            name="Generate OpenDKIM domain keys",
+            commands=[
+                f"opendkim-genkey -D /etc/dkimkeys -d {domain} -s {dkim_selector}"
+            ],
+            _sudo=True,
+            _sudo_user="opendkim",
+        )
+
+    return need_restart
+
+
 def _install_mta_sts_daemon() -> bool:
     need_restart = False
 
@@ -307,107 +370,6 @@ def _configure_nginx(domain: str, debug: bool = False) -> bool:
     return need_restart
 
 
-def remove_opendkim() -> None:
-    """Remove OpenDKIM, deprecated"""
-    files.file(
-        name="Remove legacy opendkim.conf",
-        path="/etc/opendkim.conf",
-        present=False,
-    )
-
-    files.directory(
-        name="Remove legacy opendkim socket directory from /var/spool/postfix",
-        path="/var/spool/postfix/opendkim",
-        present=False,
-    )
-
-    apt.packages(name="Remove openDKIM", packages="opendkim", present=False)
-
-
-def _configure_rspamd(dkim_selector: str, mail_domain: str) -> bool:
-    """Configures rspamd for Rate Limiting."""
-    need_restart = False
-
-    apt.packages(
-        name="apt install rspamd",
-        packages="rspamd",
-    )
-
-    for module in ["phishing", "rbl", "hfilter", "ratelimit"]:
-        disabled_module_conf = files.put(
-            name=f"disable {module} rspamd plugin",
-            src=importlib.resources.files(__package__).joinpath("rspamd/disabled.conf"),
-            dest=f"/etc/rspamd/local.d/{module}.conf",
-            user="root",
-            group="root",
-            mode="644",
-        )
-        need_restart |= disabled_module_conf.changed
-
-    options_inc = files.put(
-        name="disable fuzzy checks",
-        src=importlib.resources.files(__package__).joinpath("rspamd/options.inc"),
-        dest="/etc/rspamd/local.d/options.inc",
-        user="root",
-        group="root",
-        mode="644",
-    )
-    need_restart |= options_inc.changed
-
-    # https://rspamd.com/doc/modules/force_actions.html
-    force_actions_conf = files.put(
-        name="Set up rules to reject on DKIM, SPF and DMARC fails",
-        src=importlib.resources.files(__package__).joinpath(
-            "rspamd/force_actions.conf"
-        ),
-        dest="/etc/rspamd/local.d/force_actions.conf",
-        user="root",
-        group="root",
-        mode="644",
-    )
-    need_restart |= force_actions_conf.changed
-
-    dkim_directory = "/var/lib/rspamd/dkim/"
-    dkim_key_path = f"{dkim_directory}{mail_domain}.{dkim_selector}.key"
-    dkim_dns_file = f"{dkim_directory}{mail_domain}.{dkim_selector}.zone"
-
-    dkim_config = files.template(
-        src=importlib.resources.files(__package__).joinpath(
-            "rspamd/dkim_signing.conf.j2"
-        ),
-        dest="/etc/rspamd/local.d/dkim_signing.conf",
-        user="root",
-        group="root",
-        mode="644",
-        config={
-            "dkim_selector": str(dkim_selector),
-            "mail_domain": mail_domain,
-            "dkim_key_path": dkim_key_path,
-        },
-    )
-    need_restart |= dkim_config.changed
-
-    files.directory(
-        name="ensure DKIM key directory exists",
-        path=dkim_directory,
-        present=True,
-        user="_rspamd",
-        group="_rspamd",
-    )
-
-    if not host.get_fact(File, dkim_key_path):
-        server.shell(
-            name="Generate DKIM domain keys with rspamd",
-            commands=[
-                f"rspamadm dkim_keygen -b 2048 -s {dkim_selector} -d {mail_domain} -k {dkim_key_path} > {dkim_dns_file}"
-            ],
-            _sudo=True,
-            _sudo_user="_rspamd",
-        )
-
-    return need_restart
-
-
 def check_config(config):
     mail_domain = config.mail_domain
     if mail_domain != "testrun.org" and not mail_domain.endswith(".testrun.org"):
@@ -435,6 +397,14 @@ def deploy_chatmail(config_path: Path) -> None:
     server.group(name="Create vmail group", group="vmail", system=True)
     server.user(name="Create vmail user", user="vmail", group="vmail", system=True)
 
+    server.group(name="Create opendkim group", group="opendkim", system=True)
+    server.user(
+        name="Add postfix user to opendkim group for socket access",
+        user="postfix",
+        groups=["opendkim"],
+        system=True,
+    )
+
     # Run local DNS resolver `unbound`.
     # `resolvconf` takes care of setting up /etc/resolv.conf
     # to use 127.0.0.1 as the resolver.
@@ -469,6 +439,14 @@ def deploy_chatmail(config_path: Path) -> None:
         packages=["dovecot-imapd", "dovecot-lmtpd"],
     )
 
+    apt.packages(
+        name="Install OpenDKIM",
+        packages=[
+            "opendkim",
+            "opendkim-tools",
+        ],
+    )
+
     apt.packages(
         name="Install nginx",
         packages=["nginx"],
@@ -490,18 +468,16 @@ def deploy_chatmail(config_path: Path) -> None:
     debug = False
     dovecot_need_restart = _configure_dovecot(config, debug=debug)
     postfix_need_restart = _configure_postfix(config, debug=debug)
+    opendkim_need_restart = _configure_opendkim(mail_domain)
     mta_sts_need_restart = _install_mta_sts_daemon()
     nginx_need_restart = _configure_nginx(mail_domain)
 
-    remove_opendkim()
-    rspamd_need_restart = _configure_rspamd("dkim", mail_domain)
-
     systemd.service(
-        name="Start and enable rspamd",
-        service="rspamd.service",
+        name="Start and enable OpenDKIM",
+        service="opendkim.service",
         running=True,
         enabled=True,
-        restarted=rspamd_need_restart,
+        restarted=opendkim_need_restart,
     )
 
     systemd.service(

cmdeploy/src/cmdeploy/chatmail.zone.f

@@ -7,7 +7,7 @@ _imap._tcp.{chatmail_domain}.        SRV 0 1 143 {chatmail_domain}.
 _imaps._tcp.{chatmail_domain}.       SRV 0 1 993 {chatmail_domain}.
 {chatmail_domain}.                   CAA 128 issue "letsencrypt.org;accounturi={acme_account_url}"
 {chatmail_domain}.                   TXT "v=spf1 a:{chatmail_domain} -all"
-_dmarc.{chatmail_domain}.            TXT "v=DMARC1;p=reject;rua=mailto:{email};ruf=mailto:{email};fo=1;adkim=s;aspf=s"
+_dmarc.{chatmail_domain}.            TXT "v=DMARC1;p=reject;rua=mailto:{email};ruf=mailto:{email};fo=1;adkim=r;aspf=r"
 _mta-sts.{chatmail_domain}.          TXT "v=STSv1; id={sts_id}"
 mta-sts.{chatmail_domain}.           CNAME {chatmail_domain}.
 www.{chatmail_domain}.               CNAME {chatmail_domain}.

cmdeploy/src/cmdeploy/dns.py

@@ -60,9 +60,6 @@ def show_dns(args, out):
                 continue
             line = line.replace("\t", " ")
             lines.append(line)
-        lines[0] = f"dkim._domainkey.{mail_domain}. IN TXT " + lines[0].strip(
-            "dkim._domainkey IN TXT "
-        )
         return "\n".join(lines)
 
     print("Checking your DKIM keys and DNS entries...")
@@ -71,9 +68,7 @@ def show_dns(args, out):
     except subprocess.CalledProcessError:
         print("Please run `cmdeploy run` first.")
         return
-    dkim_entry = read_dkim_entries(
-        out.shell_output(f"{ssh} -- cat /var/lib/rspamd/dkim/{mail_domain}.dkim.zone")
-    )
+    dkim_entry = read_dkim_entries(out.shell_output(f"{ssh} -- opendkim-genzone -F"))
 
     ipv6 = dns.get_ipv6()
     reverse_ipv6 = dns.check_ptr_record(ipv6, mail_domain)
@@ -147,8 +142,8 @@ def show_dns(args, out):
         domain, data = "\n".join(dkim_lines).split(" IN TXT ")
         current = dns.get("TXT", domain.strip()[:-1])
         if current:
-            current = "( %s" % (current.replace('" "', '"\n "'))
-            if current != data:
+            current = "( %s )" % (current.replace('" "', '"\n "'))
+            if current.replace(";", "\\;") != data:
                 to_print.append(dkim_entry)
         else:
             to_print.append(dkim_entry)

cmdeploy/src/cmdeploy/postfix/main.cf.j2

@@ -46,7 +46,7 @@ inet_protocols = all
 virtual_transport = lmtp:unix:private/dovecot-lmtp
 virtual_mailbox_domains = {{ config.mail_domain }}
 
-smtpd_milters = inet:127.0.0.1:11332
+smtpd_milters = unix:opendkim/opendkim.sock
 non_smtpd_milters = $smtpd_milters
 
 header_checks = regexp:/etc/postfix/submission_header_cleanup

cmdeploy/src/cmdeploy/rspamd/disabled.conf

@@ -1 +0,0 @@
-enabled = false;

cmdeploy/src/cmdeploy/rspamd/dkim_signing.conf.j2

@@ -1,10 +0,0 @@
-selector = {{ config.dkim_selector }}
-use_esld = false  # don't cut c1.testrun.org down to testrun.org
-domain = {
-    {{ config.mail_domain }} {
-        selectors [
-            selector = {{ config.dkim_selector }}
-            path = {{ config.dkim_key_path }}
-        ]
-    }
-}

cmdeploy/src/cmdeploy/rspamd/force_actions.conf

@@ -1,30 +0,0 @@
-rules {
-    REJECT_DKIM_SPF {
-        action = "reject";
-        # Reject if
-        #   - R_DKIM_RJECT: DKIM reject inserted by `dkim` module.
-        #   - R_DKIM_PERMFAIL: permanent failure inserted by `dkim` module e.g. no DKIM DNS record found.
-        #   - No DKIM signing (R_DKIM_NA symbol inserted by `dkim` module)
-        #
-        #   - SPF failure (R_SPF_FAIL)
-        #   - SPF permanent failure, e.g. failed to resolve DNS record referenced from SPF (R_SPF_PERMFAIL)
-        #
-        #   - DMARC policy failure (DMARC_POLICY_REJECT)
-        #
-        # Do not reject if:
-        #   - R_DKIM_TEMPFAIL, it is a DNS resolution failure
-        #     and we do not want to lose messages because of faulty network.
-        #
-        #   - R_SPF_SOFTFAIL
-        #   - R_SPF_NEUTRAL
-        #   - R_SPF_DNSFAIL
-        #   - R_SPF_NA
-        #
-        #   - DMARC_DNSFAIL
-        #   - DMARC_NA
-        #   - DMARC_POLICY_SOFTFAIL
-        #   - DMARC_POLICY_QUARANTINE
-        #   - DMARC_BAD_POLICY
-        expression = "R_DKIM_REJECT | R_DKIM_PERMFAIL | R_DKIM_NA | R_SPF_FAIL | R_SPF_PERMFAIL | DMARC_POLICY_REJECT";
-    }
-}

cmdeploy/src/cmdeploy/rspamd/options.inc

@@ -1 +0,0 @@
-filters = "dkim";

cmdeploy/src/cmdeploy/tests/online/test_1_basic.py

@@ -42,16 +42,6 @@ def test_reject_forged_from(cmsetup, maildata, gencreds, lp, forgeaddr):
     assert "500" in str(e.value)
 
 
-@pytest.mark.parametrize("from_addr", ["fake@example.org", "fake@testrun.org"])
-def test_reject_missing_dkim(cmsetup, maildata, from_addr):
-    """Test that emails with missing or wrong DMARC, DKIM, and SPF entries are rejected."""
-    recipient = cmsetup.gen_users(1)[0]
-    msg = maildata("plain.eml", from_addr=from_addr, to_addr=recipient.addr).as_string()
-    with smtplib.SMTP(cmsetup.maildomain, 25) as s:
-        with pytest.raises(smtplib.SMTPDataError, match="Spam message rejected"):
-            s.sendmail(from_addr=from_addr, to_addrs=recipient.addr, msg=msg)
-
-
 @pytest.mark.slow
 def test_exceed_rate_limit(cmsetup, gencreds, maildata, chatmail_config):
     """Test that the per-account send-mail limit is exceeded."""