Add scripts/generate-dns-zone.sh

README.md

@@ -1,61 +1,26 @@
-# Chatmail instances optimized for Delta Chat apps 
+# Chat Mail server configuration
 
-This repository helps to setup a ready-to-use chatmail instance
+This repository setups a ready-to-go chatmail instance
 comprised of a minimal setup of the battle-tested 
-[postfix smtp](https://www.postfix.org) and [dovecot imap](https://www.dovecot.org) services. 
+[postfix smtp server](https://www.postfix.org) and [dovecot imap server](https://www.dovecot.org).
 
-The setup is designed and optimized for providing chatmail accounts 
-for use by [Delta Chat apps](https://delta.chat).
+## Getting started 
 
-Chatmail accounts are automatically created by a first login, 
-after which the initially specified password is required for using them. 
-
-## Getting Started deploying your own chatmail instance
-
-1. Prepare your local (presumably Linux) system:
+1. prepare your local system:
 
     scripts/init.sh 
 
-2. Setup a domain with `A` and `AAAA` records for your chatmail server.
+2. setup a domain with `A` and `AAAA` records for your chatmail server
 
-3. Set environment variable to the chatmail domain you want to setup:
+3. set environment variable to the chatmail domain you want to setup:
 
     export CHATMAIL_DOMAIN=c1.testrun.org   # replace with your host
 
-4. Deploy the chat mail instance to your chatmail server: 
+4. run the deploy of the chat mail instance: 
 
     scripts/deploy.sh 
 
-   This script uses `pyinfra` and `ssh` to setup packages and configure
-   the chatmail instance on your remote server. 
-
-5. Run `scripts/generate-dns-zone.sh` and 
-   transfer the generated DNS records at your DNS provider
-
-6. Start a Delta Chat app and create a new account 
-   by typing an e-mail address with an arbitrary username 
-   and `@<your-chatmail-domain>` appended. 
-   Use an at least 10-character random password. 
-
-
-### Ports
-
-Postfix listens on ports 25 (smtp) and 587 (submission) and 465 (submissions).
-Dovecot listens on ports 143(imap) and 993 (imaps).
-
-Delta Chat will, however, discover all ports and configurations 
-automatically by reading the `autoconfig.xml` file from the chatmail instance. 
-
-
-## Emergency Commands to disable automatic account creation 
-
-If you need to stop account creation,
-e.g. because some script is wildly creating accounts, run:
-
-    touch /etc/chatmail-nocreate
-
-While this file is present, account creation will be blocked. 
-
+5. run `scripts/generate-dns-zone.sh` and create the generated DNS records at your DNS provider
 
 ## Running tests and benchmarks (offline and online) 
 
@@ -70,26 +35,28 @@ While this file is present, account creation will be blocked.
 
     scripts/bench.sh 
 
+## Running tests (offline and online) 
 
-## Development Background for chatmail instances 
+```
+## Dovecot/Postfix configuration
 
-This repository drives the development of "chatmail instances", 
-comprised of minimal setups of 
+### Ports
 
-- [postfix smtp server](https://www.postfix.org) 
-- [dovecot imap server](https://www.dovecot.org) 
+Postfix listens on ports 25 (smtp) and 587 (submission) and 465 (submissions).
+Dovecot listens on ports 143(imap) and 993 (imaps).
 
-as well as two custom services that are integrated with these two: 
+## DNS
 
-- `chatmaild/src/chatmaild/dictproxy.py` implements 
-  create-on-login account creation semantics and is used
-  by Dovecot during login authentication and by Postfix
-  which in turn uses Dovecot SASL to authenticate users
-  to send mails for them. 
-
-- `chatmaild/src/chatmaild/filtermail.py` prevents 
-  unencrypted e-mail from leaving the chatmail instance
-  and is integrated into postfix's outbound mail pipelines. 
+For DKIM you must add a DNS entry as found in /etc/opendkim/selector.txt on your chatmail instance.
+The above `scripts/deploy.sh` prints out the DKIM selector and DNS entry you
+need to setup with your DNS provider. 
 
+## Emergency Commands
 
+If you need to stop account creation,
+e.g. because some script is wildly creating accounts,
+just run `touch /tmp/nocreate`.
+You can remove the file
+as soon as the attacker was banned
+by different means.
 

chatmaild/src/chatmaild/dictproxy.py

@@ -21,40 +21,15 @@ def encrypt_password(password: str):
     return "{SHA512-CRYPT}" + passhash
 
 
-def is_allowed_to_create(user, cleartext_password) -> bool:
-    """Return True if user and password are admissable."""
+def create_user(db, user, password):
     if os.path.exists(NOCREATE_FILE):
-        logging.warning(f"blocked account creation because {NOCREATE_FILE!r} exists.")
-        return False
-
-    if len(cleartext_password) < 10:
-        logging.warning("Password needs to be at least 10 characters long")
-        return False
-
-    parts = user.split("@")
-    if len(parts) != 2:
-        logging.warning(f"user {user!r} is not a proper e-mail address")
-        return False
-    localpart, domain = parts
-
-    if domain == "nine.testrun.org":
-        # nine.testrun.org policy, username has to be exactly nine chars
-        if len(localpart) != 9:
-            logging.warning(f"localpart {localpart!r} has not exactly nine chars")
-            return False
-
-    return True
-
-
-def create_user(db, user, encrypted_password):
+        logging.warning(
+            f"Didn't create account: {NOCREATE_FILE} exists. Delete the file to enable account creation."
+        )
+        return
     with db.write_transaction() as conn:
-        conn.create_user(user, encrypted_password)
-    return dict(
-        home=f"/home/vmail/{user}",
-        uid="vmail",
-        gid="vmail",
-        password=encrypted_password,
-    )
+        conn.create_user(user, password)
+    return dict(home=f"/home/vmail/{user}", uid="vmail", gid="vmail", password=password)
 
 
 def get_user_data(db, user):
@@ -70,18 +45,16 @@ def lookup_userdb(db, user):
     return get_user_data(db, user)
 
 
-def lookup_passdb(db, user, cleartext_password):
+def lookup_passdb(db, user, password):
     userdata = get_user_data(db, user)
     if not userdata:
-        if not is_allowed_to_create(user, cleartext_password):
-            return
-        encrypted_password = encrypt_password(cleartext_password)
-        userdata = create_user(db=db, user=user, encrypted_password=encrypted_password)
+        return create_user(db, user, encrypt_password(password))
     userdata["password"] = userdata["password"].strip()
     return userdata
 
 
 def handle_dovecot_request(msg, db, mail_domain):
+    print(f"received msg: {msg!r}", file=sys.stderr)
     short_command = msg[0]
     if short_command == "L":  # LOOKUP
         parts = msg[1:].split("\t")
@@ -99,11 +72,12 @@ def handle_dovecot_request(msg, db, mail_domain):
                     reply_command = "N"
             elif type == "passdb":
                 if user.endswith(f"@{mail_domain}"):
-                    res = lookup_passdb(db, user, cleartext_password=args[0])
+                    res = lookup_passdb(db, user, password=args[0])
                 if res:
                     reply_command = "O"
                 else:
                     reply_command = "N"
+        print(f"res: {res!r}", file=sys.stderr)
         json_res = json.dumps(res) if res else ""
         return f"{reply_command}{json_res}\n"
     return None
@@ -128,6 +102,7 @@ def main():
                     break
                 res = handle_dovecot_request(msg, db, mail_domain)
                 if res:
+                    print(f"sending result: {res!r}", file=sys.stderr)
                     self.wfile.write(res.encode("ascii"))
                     self.wfile.flush()
 

deploy-chatmail/src/deploy_chatmail/__init__.py

@@ -183,17 +183,6 @@ def _configure_dovecot(mail_server: str, debug: bool = False) -> bool:
         mode="644",
     )
 
-    # as per https://doc.dovecot.org/configuration_manual/os/
-    # it is recommended to set the following inotify limits
-    for name in ("max_user_instances", "max_user_watches"):
-        key = f"fs.inotify.{name}"
-        server.sysctl(
-            name=f"Change {key}",
-            key=key,
-            value=65535,
-            persist=True,
-        )
-
     return need_restart
 
 
@@ -202,7 +191,7 @@ def _configure_nginx(domain: str, debug: bool = False) -> bool:
     need_restart = False
 
     main_config = files.template(
-        src=importlib.resources.files(__package__).joinpath("nginx/nginx.conf.j2"),
+        src=importlib.resources.files(__package__).joinpath("nginx.conf.j2"),
         dest="/etc/nginx/nginx.conf",
         user="root",
         group="root",
@@ -212,7 +201,7 @@ def _configure_nginx(domain: str, debug: bool = False) -> bool:
     need_restart |= main_config.changed
 
     autoconfig = files.template(
-        src=importlib.resources.files(__package__).joinpath("nginx/autoconfig.xml.j2"),
+        src=importlib.resources.files(__package__).joinpath("autoconfig.xml.j2"),
         dest="/var/www/html/.well-known/autoconfig/mail/config-v1.1.xml",
         user="root",
         group="root",
@@ -277,12 +266,6 @@ def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> N
     opendkim_need_restart = _configure_opendkim(mail_domain, dkim_selector)
     nginx_need_restart = _configure_nginx(mail_domain)
 
-    # deploy web pages and info if we have them
-    pkg_root = importlib.resources.files(__package__)
-    www_path = pkg_root.joinpath(f"../../../www/{mail_domain}").resolve()
-    if www_path.is_dir():
-        files.rsync(f"{www_path}/", "/var/www/html", flags=["-avz"])
-
     systemd.service(
         name="Start and enable OpenDKIM",
         service="opendkim.service",

deploy-chatmail/src/deploy_chatmail/dovecot/dovecot.conf.j2

@@ -118,24 +118,6 @@ service auth-worker {
   user = vmail
 }
 
-service imap-login {
-    # High-security mode.
-    # Each process serves a single connection and exits afterwards.
-    # This is the default, but we set it explicitly to be sure.
-    # See <https://doc.dovecot.org/admin_manual/login_processes/#high-security-mode> for details.
-    service_count = 1
-
-    # Inrease the number of simultaneous connections.
-    #
-    # As of Dovecot 2.3.19.1 the default is 100 processes.
-    # Combined with `service_count = 1` it means only 100 connections
-    # can be handled simultaneously.
-    process_limit = 10000
-
-    # Avoid startup latency for new connections.
-    process_min_avail = 10
-}
-
 ssl = required
 ssl_cert = </var/lib/acme/live/{{ config.hostname }}/fullchain
 ssl_key = </var/lib/acme/live/{{ config.hostname }}/privkey

scripts/bench.sh

@@ -1,4 +1,4 @@
 #!/bin/bash
 set -e
 
-venv/bin/pytest online-tests/benchmark.py -vrx 
+online-tests/venv/bin/pytest online-tests/benchmark.py -vrx 

tests/chatmaild/test_dictproxy.py

@@ -1,10 +1,9 @@
 import os
-import json
 
 import pytest
 
 import chatmaild.dictproxy
-from chatmaild.dictproxy import get_user_data, lookup_passdb, handle_dovecot_request
+from chatmaild.dictproxy import get_user_data, lookup_passdb
 from chatmaild.database import Database, DBError
 
 
@@ -15,13 +14,13 @@ def db(tmpdir):
     return Database(db_path)
 
 
-
 def test_basic(db):
-    lookup_passdb(db, "link2xt@c1.testrun.org", "Pieg9aeToe3eghuthe5u")
+    chatmaild.dictproxy.NOCREATE_FILE = "/tmp/nocreate"
+    if os.path.exists(chatmaild.dictproxy.NOCREATE_FILE):
+        os.remove(chatmaild.dictproxy.NOCREATE_FILE)
+    lookup_passdb(db, "link2xt@c1.testrun.org", "asdf")
     data = get_user_data(db, "link2xt@c1.testrun.org")
     assert data
-    data2 = lookup_passdb(db, "link2xt@c1.testrun.org", "Pieg9aeToe3eghuthe5u")
-    assert data == data2
 
 
 def test_dont_overwrite_password_on_wrong_login(db):
@@ -33,12 +32,14 @@ def test_dont_overwrite_password_on_wrong_login(db):
     assert res["password"] == res2["password"]
 
 
-def test_nocreate_file(db, monkeypatch, tmpdir):
-    p = tmpdir.join("nocreate")
-    p.write("")
-    monkeypatch.setattr(chatmaild.dictproxy, "NOCREATE_FILE", str(p))
-    lookup_passdb(db, "newuser1@something.org", "zequ0Aimuchoodaechik")
+def test_nocreate_file(db):
+    chatmaild.dictproxy.NOCREATE_FILE = "/tmp/nocreate"
+    with open(chatmaild.dictproxy.NOCREATE_FILE, "w+") as f:
+        f.write("")
+    assert os.path.exists(chatmaild.dictproxy.NOCREATE_FILE)
+    lookup_passdb(db, "newuser1@something.org", "kajdlqweqwe")
     assert not get_user_data(db, "newuser1@something.org")
+    os.remove(chatmaild.dictproxy.NOCREATE_FILE)
 
 
 def test_db_version(db):
@@ -50,15 +51,3 @@ def test_too_high_db_version(db):
         conn.execute("PRAGMA user_version=%s;" % (999,))
     with pytest.raises(DBError):
         db.ensure_tables()
-
-
-def test_handle_dovecot_request(db):
-    msg = ('Lshared/passdb/laksjdlaksjdlaksjdlk12j3l1k2j3123/'
-           'some42@c3.testrun.org\tsome42@c3.testrun.org')
-    res = handle_dovecot_request(msg, db, "c3.testrun.org")
-    assert res
-    assert res[0] == "O" and res.endswith("\n")
-    userdata = json.loads(res[1:].strip())
-    assert userdata["home"] == "/home/vmail/some42@c3.testrun.org"
-    assert userdata["uid"] == userdata["gid"] == "vmail"
-    assert userdata["password"].startswith("{SHA512-CRYPT}")

tests/conftest.py

@@ -195,8 +195,8 @@ def gencreds(maildomain):
             num = next(count)
             alphanumeric = "abcdefghijklmnopqrstuvwxyz1234567890"
             user = "".join(random.choices(alphanumeric, k=10))
-            user = f"ac{num}_{user}"[:9]
-            password = "".join(random.choices(alphanumeric, k=12))
+            user = f"ac{num}_{user}"
+            password = "".join(random.choices(alphanumeric, k=10))
             yield f"{user}@{domain}", f"{password}"
 
     return lambda domain=None: next(gen(domain))

tests/online/test_0_login.py

@@ -23,11 +23,6 @@ def test_login_basic_functioning(imap_or_smtp, gencreds, lp):
     with pytest.raises(imap_or_smtp.AuthError):
         imap_or_smtp.login(user, password + "wrong")
 
-    lp.sec(f"creating users with a short password is not allowed")
-    user, _password = gencreds()
-    with pytest.raises(imap_or_smtp.AuthError):
-        imap_or_smtp.login(user, "admin")
-
 
 def test_login_same_password(imap_or_smtp, gencreds):
     """Test two different users logging in with the same password

www/nine.testrun.org/index.html

@@ -1,61 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-    <meta charset="utf-8" />
-    <title>nine.testrun.org - Experimenting with the Future of Email</title>
-    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <style>
-        .wrapper {
-            width: 100%;
-            max-width: 596px;
-            margin: 0 auto;
-        }
-
-        .section {
-            width: 100%;
-            max-width: 596px;
-        }
-
-        .text {
-            box-sizing: border-box;
-            padding: 9px;
-            font-size: 18px;
-            font-family: "Courier New", monospace;
-            color: white;
-            background-position: left top;
-            background-image: url(collage-bg.png);
-            background-repeat: no-repeat;
-            background-size: 100% 100%;
-        }
-        h1, h2, h3 {
-            font-size: 16px;
-            font-weight: bold;
-        }
-    </style>
-</head>
-<body>
-    <div class="wrapper">
-        <img class="section" src="collage-top.png" />
-        <div class="section text">
-            <h1>welcome  to nine.testrun.org</h1>
-            <p>
-                to get an account,
-                invent a word with <i>exactly</i> nine characters
-                and append @nine.testrun.org to it.
-                eg. <b>hellofits@nine.testrun.org</b>
-            </p>
-            <p>
-                if the email address is not yet taken, you'll get that account.
-                the first login sets your password.
-                that's it.
-            </p>
-        </div>
-        <img class="section" src="collage-down.png" />
-        <div class="section text">
-            <h1>faq</h1>
-            <p><i>why are other email providers 1000 times more complicated?</i></p>
-            <p>because they want to for $reasons</p>
-        </div>
-    </div>
-</body>
-</html>