From 49b3867c1b39e9832f460a344573c1673b964b1e Mon Sep 17 00:00:00 2001 From: Marek Walczak <2558195+mwlczk@users.noreply.github.com> Date: Sun, 31 Dec 2017 12:33:48 +0100 Subject: [PATCH] debian stretch slim (#784) * Switch to stretch-slim as base image. - first step correct the testdata, as newer packages are more strict about the mail-structure. * Switch to stretch-slim: correcting the test-environment and the build - add missing build-step to make - clean the userdb aswell - use timeout of netcat, as postgrey would not close the connection - there is 2 extra mail-logs -> assert_output 5 - cosmetic: use "" instead of '' * Switch to stretch-slim: new image: - smaller size - 0 CVEs compared to 11 CVEs in ubuntu 16.04 Image better backport situation - postfix 3.1.6 vs 3.1.0 - fail2ban 0.9.6 vs 0.9.3 ... changes needed because of stretch-slim: - add missing gnupg and iproute2 package - remove non-free rar, unrar-free should do - rsyslog does not add syslog user and has different conf-structure - pyzor command discover was deprecated and is missing in the new stretch package - dovecot does not know SSLv2 anymore. removed because of warnings in log - iptables does not know imap3, IMAP working group chose imap2 in favor of imap3 * Switch to debian stretch slim: SSLv2 seems to be a not known protocol anymore - good! * switch to debian stretch slim: make this test more stable. there might be more than only one mail.log (mail.info, mail.warn, ...) * switch to debian stretc slim: new openssl 1.1.0 needs stronger ciphers, removed some weekers ones. Please, look through the new list of cipher! this needs to be done in another commit for all other SSL/TLS-Endpoints aswell. * Switch to debian stretch slim: let our server pre-empt the cipher list. Did a read through, wwwDOTpostfixDOTorg/FORWARD_SECRECY_READMEDOThtml and wwwDOTpostfixDOTorg/TLS_READMEDOThtml * Switch to debian stretch slim: lets give this openssl-based test a new and independent but identical container. many other test on the main 'mail' container might interfere here. * Switch to debian stretch slim: remove unused lines --- Dockerfile | 15 ++++----- Makefile | 31 +++++++++++++++---- target/dovecot/10-ssl.conf | 2 +- target/fail2ban/jail.conf | 16 +++++----- target/postfix/main.cf | 7 +++-- test/config/dovecot-lmtp/conf.d/10-ssl.conf | 4 +-- test/email-templates/amavis-spam.txt | 1 - test/email-templates/amavis-virus.txt | 1 - .../existing-alias-external.txt | 2 +- test/email-templates/existing-alias-local.txt | 2 +- .../existing-catchall-local.txt | 2 +- .../existing-user-and-cc-local-alias.txt | 2 +- test/email-templates/existing-user1.txt | 2 +- test/email-templates/non-existing-user.txt | 2 +- test/email-templates/postgrey.txt | 2 +- test/email-templates/send-privacy-email.txt | 3 +- test/email-templates/sieve-pipe.txt | 2 +- test/tests.bats | 15 +++++---- 18 files changed, 65 insertions(+), 46 deletions(-) diff --git a/Dockerfile b/Dockerfile index 15b23283..efdf2780 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM ubuntu:16.04 +FROM debian:stretch-slim MAINTAINER Thomas VIAL ENV DEBIAN_FRONTEND noninteractive @@ -41,6 +41,8 @@ RUN apt-get update -q --fix-missing && \ file \ gamin \ gzip \ + gnupg \ + iproute2 \ iptables \ locales \ liblz4-tool \ @@ -60,7 +62,6 @@ RUN apt-get update -q --fix-missing && \ postfix-pcre \ postfix-policyd-spf-python \ pyzor \ - rar \ razor \ ripole \ rpm2cpio \ @@ -133,6 +134,8 @@ COPY target/amavis/conf.d/* /etc/amavis/conf.d/ RUN sed -i -r 's/#(@| \\%)bypass/\1bypass/g' /etc/amavis/conf.d/15-content_filter_mode && \ adduser clamav amavis && \ adduser amavis clamav && \ + # no syslog user in debian compared to ubuntu + adduser --system syslog && \ useradd -u 5000 -d /home/docker -s /bin/bash -p $(echo docker | openssl passwd -1 -stdin) docker && \ (echo "0 4 * * * /usr/local/bin/virus-wiper" ; crontab -l) | crontab - @@ -144,8 +147,7 @@ RUN echo "ignoreregex =" >> /etc/fail2ban/filter.d/postfix-sasl.conf && mkdir /v # Enables Pyzor and Razor USER amavis RUN razor-admin -create && \ - razor-admin -register && \ - pyzor discover + razor-admin -register USER root # Configure DKIM (opendkim) @@ -177,8 +179,8 @@ RUN sed -i -r "/^#?compress/c\compress\ncopytruncate" /etc/logrotate.conf && \ chown -R clamav:root /var/log/mail/clamav.log && \ touch /var/log/mail/freshclam.log && \ chown -R clamav:root /var/log/mail/freshclam.log && \ - sed -i -r 's|/var/log/mail|/var/log/mail/mail|g' /etc/rsyslog.d/50-default.conf && \ - sed -i -r 's|;auth,authpriv.none|;mail.none;mail.error;auth,authpriv.none|g' /etc/rsyslog.d/50-default.conf && \ + sed -i -r 's|/var/log/mail|/var/log/mail/mail|g' /etc/rsyslog.conf && \ + sed -i -r 's|;auth,authpriv.none|;mail.none;mail.error;auth,authpriv.none|g' /etc/rsyslog.conf && \ sed -i -r 's|LogFile /var/log/clamav/|LogFile /var/log/mail/|g' /etc/clamav/clamd.conf && \ sed -i -r 's|UpdateLogFile /var/log/clamav/|UpdateLogFile /var/log/mail/|g' /etc/clamav/freshclam.conf && \ sed -i -r 's|/var/log/clamav|/var/log/mail|g' /etc/logrotate.d/clamav-daemon && \ @@ -205,4 +207,3 @@ EXPOSE 25 587 143 465 993 110 995 4190 CMD supervisord -c /etc/supervisor/supervisord.conf ADD target/filebeat.yml.tmpl /etc/filebeat/filebeat.yml.tmpl - diff --git a/Makefile b/Makefile index b68b3f63..47df3a16 100644 --- a/Makefile +++ b/Makefile @@ -1,8 +1,8 @@ NAME = tvial/docker-mailserver:testing -all: build-no-cache generate-accounts run fixtures tests clean -all-fast: build generate-accounts run fixtures tests clean -no-build: generate-accounts run fixtures tests clean +all: build-no-cache generate-accounts run generate-accounts-after-run fixtures tests clean +all-fast: build generate-accounts run generate-accounts-after-run fixtures tests clean +no-build: generate-accounts run generate-accounts-after-run fixtures tests clean build-no-cache: cd test/docker-openldap/ && docker build -f Dockerfile -t ldap --no-cache . @@ -36,6 +36,23 @@ run: -e DMS_DEBUG=0 \ -h mail.my-domain.com -t $(NAME) sleep 15 + docker run -d --name mail_privacy \ + -v "`pwd`/test/config":/tmp/docker-mailserver \ + -v "`pwd`/test":/tmp/docker-mailserver-test \ + -e ENABLE_CLAMAV=1 \ + -e ENABLE_SPAMASSASSIN=1 \ + -e SA_TAG=-5.0 \ + -e SA_TAG2=2.0 \ + -e SA_KILL=3.0 \ + -e SA_SPAM_SUBJECT="SPAM: " \ + -e VIRUSMAILS_DELETE_DELAY=7 \ + -e SASL_PASSWD="external-domain.com username:password" \ + -e ENABLE_MANAGESIEVE=1 \ + --cap-add=SYS_PTRACE \ + -e PERMIT_DOCKER=host \ + -e DMS_DEBUG=0 \ + -h mail.my-domain.com -t $(NAME) + sleep 15 docker run -d --name mail_pop3 \ -v "`pwd`/test/config":/tmp/docker-mailserver \ -v "`pwd`/test":/tmp/docker-mailserver-test \ @@ -164,7 +181,7 @@ run: generate-accounts-after-run: docker run --rm -e MAIL_USER=added@localhost.localdomain -e MAIL_PASS=mypassword -t $(NAME) /bin/sh -c 'echo "$$MAIL_USER|$$(doveadm pw -s SHA512-CRYPT -u $$MAIL_USER -p $$MAIL_PASS)"' >> test/config/postfix-accounts.cf sleep 10 - + fixtures: cp config/postfix-accounts.cf config/postfix-accounts.cf.bak # Setup sieve & create filtering folder (INBOX/spam) @@ -191,7 +208,7 @@ fixtures: docker exec mail_disabled_clamav_spamassassin /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user1.txt" # postfix virtual transport lmtp docker exec mail_lmtp_ip /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user1.txt" - + docker exec mail_privacy /bin/sh -c "openssl s_client -quiet -starttls smtp -connect 0.0.0.0:587 < /tmp/docker-mailserver-test/email-templates/send-privacy-email.txt" docker exec mail_override_hostname /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user1.txt" # Wait for mails to be analyzed sleep 80 @@ -204,6 +221,7 @@ clean: # Remove running test containers -docker rm -f \ mail \ + mail_privacy \ mail_pop3 \ mail_smtponly \ mail_smtponly_without_config \ @@ -227,4 +245,5 @@ clean: test/config/empty \ test/config/without-accounts \ test/config/without-virtual \ - test/config/with-domain + test/config/with-domain \ + test/config/dovecot-lmtp/userdb diff --git a/target/dovecot/10-ssl.conf b/target/dovecot/10-ssl.conf index 232fa58b..4623d60c 100644 --- a/target/dovecot/10-ssl.conf +++ b/target/dovecot/10-ssl.conf @@ -46,7 +46,7 @@ ssl_key =