create build venv in chatmaild/venv

README.md

@@ -47,13 +47,3 @@ Dovecot listens on ports 143(imap) and 993 (imaps).
 For DKIM you must add a DNS entry as found in /etc/opendkim/selector.txt on your chatmail instance.
 The above `scripts/deploy.sh` prints out the DKIM selector and DNS entry you
 need to setup with your DNS provider. 
-
-## Emergency Commands
-
-If you need to stop account creation,
-e.g. because some script is wildly creating accounts,
-just run `touch /tmp/nocreate`.
-You can remove the file
-as soon as the attacker was banned
-by different means.
-

chatmaild/pyproject.toml

@@ -10,6 +10,7 @@ dependencies = [
 ]
 
 [project.scripts]
+doveauth = "chatmaild.doveauth:main"
 doveauth-dictproxy = "chatmaild.dictproxy:main"
 filtermail = "chatmaild.filtermail:main"
 

chatmaild/src/chatmaild/dictproxy.py

@@ -1,4 +1,3 @@
-import logging
 import os
 import sys
 import json
@@ -12,8 +11,6 @@ import subprocess
 
 from .database import Database
 
-NOCREATE_FILE = "/etc/chatmail-nocreate"
-
 
 def encrypt_password(password: str):
     password = password.encode("ascii")
@@ -30,9 +27,6 @@ def encrypt_password(password: str):
 
 
 def create_user(db, user, password):
-    if os.path.exists(NOCREATE_FILE):
-        logging.warning(f"Didn't create account: {NOCREATE_FILE} exists. Delete the file to enable account creation.")
-        return
     with db.write_transaction() as conn:
         conn.create_user(user, password)
     return dict(home=f"/home/vmail/{user}", uid="vmail", gid="vmail", password=password)
@@ -59,7 +53,7 @@ def lookup_passdb(db, user, password):
     return userdata
 
 
-def handle_dovecot_request(msg, db, mail_domain):
+def handle_dovecot_request(msg, db):
     print(f"received msg: {msg!r}", file=sys.stderr)
     short_command = msg[0]
     if short_command == "L":  # LOOKUP
@@ -70,15 +64,13 @@ def handle_dovecot_request(msg, db, mail_domain):
         res = ""
         if namespace == "shared":
             if type == "userdb":
-                if user.endswith(f"@{mail_domain}"):
+                res = lookup_userdb(db, user)
-                    res = lookup_userdb(db, user)
                 if res:
                     reply_command = "O"
                 else:
                     reply_command = "N"
             elif type == "passdb":
-                if user.endswith(f"@{mail_domain}"):
+                res = lookup_passdb(db, user, password=args[0])
-                    res = lookup_passdb(db, user, password=args[0])
                 if res:
                     reply_command = "O"
                 else:
@@ -97,8 +89,6 @@ def main():
     socket = sys.argv[1]
     passwd_entry = pwd.getpwnam(sys.argv[2])
     db = Database(sys.argv[3])
-    with open("/etc/mailname", "r") as fp:
-        mail_domain = fp.read().strip()
 
     class Handler(StreamRequestHandler):
         def handle(self):
@@ -106,7 +96,7 @@ def main():
                 msg = self.rfile.readline().strip().decode()
                 if not msg:
                     break
-                res = handle_dovecot_request(msg, db, mail_domain)
+                res = handle_dovecot_request(msg, db)
                 if res:
                     print(f"sending result: {res!r}", file=sys.stderr)
                     self.wfile.write(res.encode("ascii"))

chatmaild/src/chatmaild/doveauth.py

@@ -0,0 +1,65 @@
+#!/usr/bin/env python3
+import base64
+import sys
+
+from .database import Database
+
+
+def get_user_data(db, user):
+    with db.read_connection() as conn:
+        result = conn.get_user(user)
+    if result:
+        result["uid"] = "vmail"
+        result["gid"] = "vmail"
+    return result
+
+
+def create_user(db, user, password):
+    with db.write_transaction() as conn:
+        conn.create_user(user, password)
+    return dict(home=f"/home/vmail/{user}", uid="vmail", gid="vmail", password=password)
+
+
+def verify_user(db, user, password):
+    userdata = get_user_data(db, user)
+    if userdata:
+        if userdata.get("password") == password:
+            userdata["status"] = "ok"
+        else:
+            userdata["status"] = "fail"
+    else:
+        userdata = create_user(db, user, password)
+        userdata["status"] = "ok"
+
+    return userdata
+
+
+def lookup_user(db, user):
+    userdata = get_user_data(db, user)
+    if userdata:
+        userdata["status"] = "ok"
+    else:
+        userdata["status"] = "fail"
+    return userdata
+
+
+def dump_result(res):
+    for key, value in res.items():
+        print(f"{key}={value}")
+
+
+def main():
+    db = Database("/home/vmail/passdb.sqlite")
+    if sys.argv[1] == "hexauth":
+        login = base64.b16decode(sys.argv[2]).decode()
+        password = base64.b16decode(sys.argv[3]).decode()
+        res = verify_user(db, login, password)
+        dump_result(res)
+    elif sys.argv[1] == "hexlookup":
+        login = base64.b16decode(sys.argv[2]).decode()
+        res = lookup_user(db, login)
+        dump_result(res)
+
+
+if __name__ == "__main__":
+    main()

chatmaild/src/chatmaild/test_doveauth.py

@@ -1,9 +1,7 @@
-import os
-
 import pytest
 
-import chatmaild.dictproxy
+from .dictproxy import get_user_data
-from .dictproxy import get_user_data, lookup_passdb
+from .doveauth import verify_user
 from .database import Database, DBError
 
 
@@ -15,31 +13,16 @@ def db(tmpdir):
 
 
 def test_basic(db):
-    chatmaild.dictproxy.NOCREATE_FILE = "/tmp/nocreate"
+    verify_user(db, "link2xt@c1.testrun.org", "asdf")
-    if os.path.exists(chatmaild.dictproxy.NOCREATE_FILE):
-        os.remove(chatmaild.dictproxy.NOCREATE_FILE)
-    lookup_passdb(db, "link2xt@c1.testrun.org", "asdf")
     data = get_user_data(db, "link2xt@c1.testrun.org")
     assert data
 
 
-def test_dont_overwrite_password_on_wrong_login(db):
+def test_verify_or_create(db):
-    """Test that logging in with a different password doesn't create a new user"""
+    res = verify_user(db, "newuser1@something.org", "kajdlkajsldk12l3kj1983")
-    res = lookup_passdb(db, "newuser1@something.org", "kajdlkajsldk12l3kj1983")
+    assert res["status"] == "ok"
-    assert res["password"]
+    res = verify_user(db, "newuser1@something.org", "kajdlqweqwe")
-    res2 = lookup_passdb(db, "newuser1@something.org", "kajdlqweqwe")
+    assert res["status"] == "fail"
-    # this function always returns a password hash, which is actually compared by dovecot.
-    assert res["password"] == res2["password"]
-
-
-def test_nocreate_file(db):
-    chatmaild.dictproxy.NOCREATE_FILE = "/tmp/nocreate"
-    with open(chatmaild.dictproxy.NOCREATE_FILE, "w+") as f:
-        f.write("")
-    assert os.path.exists(chatmaild.dictproxy.NOCREATE_FILE)
-    lookup_passdb(db, "newuser1@something.org", "kajdlqweqwe")
-    assert not get_user_data(db, "newuser1@something.org")
-    os.remove(chatmaild.dictproxy.NOCREATE_FILE)
 
 
 def test_db_version(db):

deploy-chatmail/src/deploy_chatmail/__init__.py

@@ -244,13 +244,6 @@ def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> N
         restarted=dovecot_need_restart,
     )
 
-    # This file is used by auth proxy.
-    # https://wiki.debian.org/EtcMailName
-    server.shell(
-        name="Setup /etc/mailname",
-        commands=[f"echo {mail_domain} >/etc/mailname; chmod 644 /etc/mailname"],
-    )
-
     def callback():
         result = server.shell(
             commands=[

deploy-chatmail/src/deploy_chatmail/acmetool/__init__.py

@@ -50,8 +50,8 @@ def deploy_acmetool(nginx_hook=False, email="", domains=[]):
     systemd.service(
         name="Setup acmetool-redirector service",
         service="acmetool-redirector.service",
-        running=False,
+        running=True,
-        enabled=False,
+        enabled=True,
         restarted=service_file.changed,
     )
 

deploy-chatmail/src/deploy_chatmail/dovecot/dovecot.conf.j2

@@ -16,12 +16,6 @@ mail_debug = yes
 
 mail_plugins = quota
 
-# these are the capabilities Delta Chat cares about actually 
-# so let's keep the network overhead per login small
-# https://github.com/deltachat/deltachat-core-rust/blob/master/src/imap/capabilities.rs
-imap_capability = IMAP4rev1 IDLE MOVE QUOTA CONDSTORE
-
-
 # Authentication for system users.
 passdb {
   driver = dict

deploy-chatmail/src/deploy_chatmail/postfix/master.cf.j2

@@ -70,6 +70,8 @@ showq     unix  n       -       y       -       -       showq
 error     unix  -       -       y       -       -       error
 retry     unix  -       -       y       -       -       error
 discard   unix  -       -       y       -       -       discard
+local     unix  -       n       n       -       -       local
+virtual   unix  -       n       n       -       -       virtual
 lmtp      unix  -       -       y       -       -       lmtp
 anvil     unix  -       -       y       -       1       anvil
 scache    unix  -       -       y       -       1       scache

scripts/init.sh

@@ -6,7 +6,6 @@ deploy-chatmail/venv/bin/pip install -e deploy-chatmail
 deploy-chatmail/venv/bin/pip install -e chatmaild
 
 python3 -m venv chatmaild/venv
-sudo apt install -y dovecot-core && sudo systemctl disable --now dovecot
 chatmaild/venv/bin/pip install --upgrade pytest build 'setuptools>=68'
 chatmaild/venv/bin/pip install -e chatmaild
 

scripts/test.sh

@@ -1,3 +1,7 @@
 #!/bin/bash
-chatmaild/venv/bin/pytest chatmaild/ $@
+set -e
-online-tests/venv/bin/pytest online-tests/ -vrx --durations=5 $@
+pushd chatmaild/src/chatmaild
+../../venv/bin/pytest
+popd
+
+online-tests/venv/bin/pytest online-tests/ -vrx --durations=5