Commit message (Collapse) | Author | Age | Files | ||
---|---|---|---|---|---|
... | |||||
* | MX: chroot postscreen(8), smtpd(8) and cleanup(8) daemons. | Guilhem Moulin | 2018-12-09 | 8 | |
| | | | | | | Unlike what we wrote in 2014 (cf. 4fb4be4d279dd94cab33fc778cfa318b93d6926f) the postscreen(8) server can run chrooted, meaning we can also chroot the smtpd(8), tlsproxy(8), dnsblog(8) and cleanup(8) daemons. | ||||
* | MX: don't override 5XY reject codes to 554. | Guilhem Moulin | 2018-12-09 | 1 | |
| | |||||
* | postfix: remove explicit default 'mail_owner = postfix'. | Guilhem Moulin | 2018-12-06 | 6 | |
| | |||||
* | postfix ≥3.0: don't advertise SMTPUTF8 support. | Guilhem Moulin | 2018-12-06 | 1 | |
| | | | | | | | | | | | | | | | | | We're relaying messages to our LMTP daemons (Dovecot, Amavisd) and some downstream SMTP servers, not all of which are under our control. Forwarding messages with UTF-8 envelope addresses or RFC 5322 headers yields undeliverable messages, and the bounces make us a potential backscatter source. So it's better to disable SMTPUTF8 at this point. Cf. also http://www.postfix.org/SMTPUTF8_README.html and https://unix.stackexchange.com/questions/320091/configure-postfix-and-dovecot-lmtp-to-receive-mail-via-smtputf8 . See also upstream's comment at https://marc.info/?l=postfix-users&m=149183235529042&w=2 : “Perhaps SMTPUTF8 autodetection could be more granular: UTF8 in the envelope is definitely problematic for a receiver that does not support SMTPUTF8, while UTF8 in a message header is less so.” | ||||
* | Upgrade 'ikiwiki-pandoc' to v0.5.1. | Guilhem Moulin | 2018-12-06 | 1 | |
| | | | | | https://raw.githubusercontent.com/sciunto-org/ikiwiki-pandoc/v0.5.1/pandoc.pm Currently at commit 9292e45cea1be120adb3babd5b835b547f4c825a . | ||||
* | Roundcube: improve serving of static resources. | Guilhem Moulin | 2018-12-06 | 1 | |
| | | | | | | | | | | | | | | | We only serve whitelisted extensions (css, js, png, etc.), and only for some selected sub-directories. Access to everything else (incl. log files and config files) is denied with a 404. This is unlike upstream's .htaccess file, which blacklists restricted locations and happily serves the rest: https://github.com/roundcube/roundcubemail/blob/master/.htaccess#L8 To find out which extensions exist on the file system, run find -L /var/lib/roundcube/{plugins,program/js,program/resources,skins} -type f \ | sed -n 's/.*\.//p' | sort | uniq -c | ||||
* | Remove trailing spaces. | Guilhem Moulin | 2018-12-05 | 3 | |
| | |||||
* | DKIM: also include the "d=" tag in key filenames, not only the "s=" tag. | Guilhem Moulin | 2018-12-05 | 7 | |
| | | | | | While the combination of "s=" tag (selector) & "d=" tag signing domain maps to a unique key, the selector alone doesn't necessarily. | ||||
* | Upgrade DKIM keys to rsa2048, and allow for multiple keys. | Guilhem Moulin | 2018-12-04 | 7 | |
| | |||||
* | Don't include hostname in ansible headers. | Guilhem Moulin | 2018-12-03 | 1 | |
| | |||||
* | gencerts: Also show the algorithm for SSH host keys. | Guilhem Moulin | 2018-12-03 | 1 | |
| | |||||
* | Install unbound on metal hosts. | Guilhem Moulin | 2018-12-03 | 4 | |
| | | | | (A validating, recursive, caching DNS resolver.) | ||||
* | Define new host "calima" serving Nextcloud. | Guilhem Moulin | 2018-12-03 | 19 | |
| | |||||
* | Upgrade wiki baseline to Debian Stretch. | Guilhem Moulin | 2018-12-03 | 4 | |
| | |||||
* | Upgrade MX baseline to Debian Stretch. | Guilhem Moulin | 2018-12-03 | 2 | |
| | |||||
* | Upgrade webmail baseline to Debian Stretch. | Guilhem Moulin | 2018-12-03 | 7 | |
| | |||||
* | ssh_known_hosts: also list ed25519 host (pub)keys. | Guilhem Moulin | 2018-12-03 | 1 | |
| | |||||
* | Upgrade syntax to Ansible 2.7 (apt module). | Guilhem Moulin | 2018-12-03 | 25 | |
| | |||||
* | certs/gencerts.sh: wibble | Guilhem Moulin | 2018-12-03 | 1 | |
| | |||||
* | Postfix: replace cdb & btree tables with lmdb ones. | Guilhem Moulin | 2018-12-03 | 15 | |
| | | | | Cf. lmdb_table(5). | ||||
* | IPsec: allow ISAKMP over IPv6. | Guilhem Moulin | 2018-12-03 | 2 | |
| | |||||
* | Upgrade baseline to Debian Stretch. | Guilhem Moulin | 2018-12-03 | 23 | |
| | |||||
* | Skip samhain installation. | Guilhem Moulin | 2018-12-03 | 4 | |
| | | | | It's become too verbose (too many false-positive)… | ||||
* | Harden anti spam on the MX:es. | Guilhem Moulin | 2018-06-09 | 6 | |
| | |||||
* | More logcheck-database tweaks. | Guilhem Moulin | 2018-04-04 | 3 | |
| | |||||
* | lacme: explicitely bind to [::]:80. | Guilhem Moulin | 2018-04-04 | 1 | |
| | |||||
* | Postfix: replace 'fifo' types with 'unix', as it's the new default. | Guilhem Moulin | 2018-04-04 | 1 | |
| | |||||
* | sympa: wibble | Guilhem Moulin | 2018-04-04 | 2 | |
| | |||||
* | Firewall: Allow DNS queries over TCP. | Guilhem Moulin | 2018-04-04 | 1 | |
| | |||||
* | APT: use deb.debian.org as archive source. | Guilhem Moulin | 2018-04-04 | 1 | |
| | |||||
* | Postscreen: improve DNSBL sites and scores. | Guilhem Moulin | 2018-04-04 | 1 | |
| | |||||
* | Amavis: bind server to INADDR_LOOPBACK | Guilhem Moulin | 2018-04-04 | 1 | |
| | |||||
* | Perform recipient address verification on the MSA itself. | Guilhem Moulin | 2018-04-04 | 4 | |
| | |||||
* | LDAP: Expose part of the database to Nextcloud. | Guilhem Moulin | 2018-04-04 | 2 | |
| | |||||
* | Upgrade syntax to Ansible 2.5. | Guilhem Moulin | 2018-04-04 | 5 | |
| | |||||
* | Upgrade syntax to Ansible 2.4. | Guilhem Moulin | 2017-11-23 | 7 | |
| | |||||
* | More logcheck-database tweaks. | Guilhem Moulin | 2017-09-14 | 3 | |
| | |||||
* | Fix detection of KVM guests. | Guilhem Moulin | 2017-07-29 | 3 | |
| | |||||
* | rkhunter: Disable remote updates to fix CVE-2017-7480. | Guilhem Moulin | 2017-07-29 | 1 | |
| | |||||
* | Use MariaDB as default MySQL flavor. | Guilhem Moulin | 2017-07-29 | 6 | |
| | |||||
* | Don't install debsecan anymore by default. | Guilhem Moulin | 2017-06-26 | 2 | |
| | | | | https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=789196 | ||||
* | MySQL: Use a single InnoDB file per table. | Guilhem Moulin | 2017-06-15 | 1 | |
| | |||||
* | Webmail: don't allow outgoing TCP/993 connections. | Guilhem Moulin | 2017-06-15 | 1 | |
| | | | | We're going through IPsec to communicate with the IMAP server. | ||||
* | postfix-sender-login: strip extension before lookup. | Guilhem Moulin | 2017-06-13 | 1 | |
| | | | | | | Users can add an extension (following postconf(5)'s $recipient_delimiter) to the local part of any envelope sender address already allowed. | ||||
* | More logcheck-database tweaks. | Guilhem Moulin | 2017-06-07 | 1 | |
| | |||||
* | postfix-msa: anonymize SASL-authenticated senders using IPv6. | Guilhem Moulin | 2017-06-06 | 1 | |
| | |||||
* | dovecot-auth-proxy: Fix synopsis line. | Guilhem Moulin | 2017-06-05 | 1 | |
| | |||||
* | postscreen: lower zen.spamhaus.org DNSBL score from 3 to 2 on the MX:es. | Guilhem Moulin | 2017-06-05 | 1 | |
| | | | | | So being listed on that BL doesn't yield a flat reject if the IP isn't also listed to other lists. | ||||
* | postfix-sender-login: wibble | Guilhem Moulin | 2017-06-05 | 2 | |
| | |||||
* | dovecot: enable user iteration and add a cronjob for `doveadm purge -A` | Guilhem Moulin | 2017-06-05 | 9 | |
| |