From: Frank Brehm Date: Sun, 9 Aug 2020 04:38:12 +0000 (+0200) Subject: daily autocommit X-Git-Url: https://git.uhu-banane.de/?a=commitdiff_plain;h=50eb8d7bbd072b1c5a504bf594ad0c118df8ee21;p=config%2Fsarah%2Fetc.git daily autocommit --- diff --git a/.etckeeper b/.etckeeper index d93b3ba..3c44cc7 100755 --- a/.etckeeper +++ b/.etckeeper @@ -28,7 +28,6 @@ mkdir -p './initramfs-tools/scripts/nfs-top' mkdir -p './initramfs-tools/scripts/panic' mkdir -p './insserv/overrides' mkdir -p './kernel/install.d' -mkdir -p './letsencrypt/renewal' mkdir -p './letsencrypt/renewal-hooks/deploy' mkdir -p './letsencrypt/renewal-hooks/post' mkdir -p './letsencrypt/renewal-hooks/pre' @@ -940,6 +939,8 @@ maybe chmod 0644 'ldap/ldap.conf' maybe chmod 0755 'ldap/schema' maybe chmod 0644 'ldap/schema/amavis.schema' maybe chmod 0755 'letsencrypt' +maybe chmod 0644 'letsencrypt/.updated-options-ssl-nginx-conf-digest.txt' +maybe chmod 0644 'letsencrypt/.updated-ssl-dhparams-pem-digest.txt' maybe chmod 0755 'letsencrypt/accounts' maybe chmod 0755 'letsencrypt/accounts/acme-v02.api.letsencrypt.org' maybe chmod 0700 'letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory' @@ -947,16 +948,35 @@ maybe chmod 0700 'letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/f8 maybe chmod 0644 'letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/f8ceb21f0246f5173cb38ecbde9a58d6/meta.json' maybe chmod 0400 'letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/f8ceb21f0246f5173cb38ecbde9a58d6/private_key.json' maybe chmod 0644 'letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/f8ceb21f0246f5173cb38ecbde9a58d6/regr.json' +maybe chmod 0700 'letsencrypt/archive' +maybe chmod 0755 'letsencrypt/archive/mail.uhu-banane.net' +maybe chmod 0644 'letsencrypt/archive/mail.uhu-banane.net/cert1.pem' +maybe chmod 0644 'letsencrypt/archive/mail.uhu-banane.net/chain1.pem' +maybe chmod 0644 'letsencrypt/archive/mail.uhu-banane.net/fullchain1.pem' +maybe chmod 0600 'letsencrypt/archive/mail.uhu-banane.net/privkey1.pem' maybe chmod 0644 'letsencrypt/cli.ini' maybe chmod 0755 'letsencrypt/csr' maybe chmod 0644 'letsencrypt/csr/0000_csr-certbot.pem' +maybe chmod 0644 'letsencrypt/csr/0001_csr-certbot.pem' +maybe chmod 0644 'letsencrypt/csr/0002_csr-certbot.pem' +maybe chmod 0644 'letsencrypt/csr/0003_csr-certbot.pem' maybe chmod 0700 'letsencrypt/keys' maybe chmod 0600 'letsencrypt/keys/0000_key-certbot.pem' +maybe chmod 0600 'letsencrypt/keys/0001_key-certbot.pem' +maybe chmod 0600 'letsencrypt/keys/0002_key-certbot.pem' +maybe chmod 0600 'letsencrypt/keys/0003_key-certbot.pem' +maybe chmod 0700 'letsencrypt/live' +maybe chmod 0644 'letsencrypt/live/README' +maybe chmod 0755 'letsencrypt/live/mail.uhu-banane.net' +maybe chmod 0644 'letsencrypt/live/mail.uhu-banane.net/README' +maybe chmod 0644 'letsencrypt/options-ssl-nginx.conf' maybe chmod 0755 'letsencrypt/renewal' maybe chmod 0755 'letsencrypt/renewal-hooks' maybe chmod 0755 'letsencrypt/renewal-hooks/deploy' maybe chmod 0755 'letsencrypt/renewal-hooks/post' maybe chmod 0755 'letsencrypt/renewal-hooks/pre' +maybe chmod 0644 'letsencrypt/renewal/mail.uhu-banane.net.conf' +maybe chmod 0644 'letsencrypt/ssl-dhparams.pem' maybe chmod 0644 'lftp.conf' maybe chmod 0644 'libaudit.conf' maybe chmod 0755 'libnl-3' @@ -1561,6 +1581,8 @@ maybe chmod 0644 'systemd/sleep.conf' maybe chmod 0755 'systemd/system' maybe chmod 0644 'systemd/system.conf' maybe chmod 0755 'systemd/system/.old' +maybe chmod 0755 'systemd/system/certbot.service.d' +maybe chmod 0644 'systemd/system/certbot.service.d/posthook.conf' maybe chmod 0755 'systemd/system/clamav-daemon.service.d' maybe chmod 0644 'systemd/system/clamav-daemon.service.d/extend.conf' maybe chmod 0755 'systemd/system/default.target.wants' diff --git a/cron.d/certbot b/cron.d/certbot index e38dbb9..f24dc1d 100644 --- a/cron.d/certbot +++ b/cron.d/certbot @@ -14,4 +14,4 @@ SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin -0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew +0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew --post-hook /usr/local/sbin/restart_mailservices diff --git a/dovecot/dovecot.conf b/dovecot/dovecot.conf index a885485..50a1bb7 100644 --- a/dovecot/dovecot.conf +++ b/dovecot/dovecot.conf @@ -2,13 +2,13 @@ # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-10-amd64 x86_64 Debian 10.5 # Hostname: sarah.uhu-banane.de -auth_debug = yes -auth_debug_passwords = yes +auth_debug = no +auth_debug_passwords = no auth_default_realm = uhu-banane.net auth_master_user_separator = * auth_mechanisms = PLAIN LOGIN auth_verbose = yes -auth_verbose_passwords = plain +auth_verbose_passwords = no dict { acl = mysql:/etc/dovecot/dovecot-share-folder.conf quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf @@ -171,10 +171,12 @@ service quota-warning { } } ssl = required -ssl_cert = =1.3.7. +`[cert name]/cert.pem` : will break many server configurations, and should not be used + without reading further documentation (see link below). + +WARNING: DO NOT MOVE OR RENAME THESE FILES! + Certbot expects these files to remain in this location in order + to function properly! + +We recommend not moving these files. For more information, see the Certbot +User Guide at https://certbot.eff.org/docs/using.html#where-are-my-certificates. diff --git a/letsencrypt/live/mail.uhu-banane.net/README b/letsencrypt/live/mail.uhu-banane.net/README new file mode 100644 index 0000000..5050078 --- /dev/null +++ b/letsencrypt/live/mail.uhu-banane.net/README @@ -0,0 +1,14 @@ +This directory contains your keys and certificates. + +`privkey.pem` : the private key for your certificate. +`fullchain.pem`: the certificate file used in most server software. +`chain.pem` : used for OCSP stapling in Nginx >=1.3.7. +`cert.pem` : will break many server configurations, and should not be used + without reading further documentation (see link below). + +WARNING: DO NOT MOVE OR RENAME THESE FILES! + Certbot expects these files to remain in this location in order + to function properly! + +We recommend not moving these files. For more information, see the Certbot +User Guide at https://certbot.eff.org/docs/using.html#where-are-my-certificates. diff --git a/letsencrypt/live/mail.uhu-banane.net/cert.pem b/letsencrypt/live/mail.uhu-banane.net/cert.pem new file mode 120000 index 0000000..d05018c --- /dev/null +++ b/letsencrypt/live/mail.uhu-banane.net/cert.pem @@ -0,0 +1 @@ +../../archive/mail.uhu-banane.net/cert1.pem \ No newline at end of file diff --git a/letsencrypt/live/mail.uhu-banane.net/chain.pem b/letsencrypt/live/mail.uhu-banane.net/chain.pem new file mode 120000 index 0000000..167cb72 --- /dev/null +++ b/letsencrypt/live/mail.uhu-banane.net/chain.pem @@ -0,0 +1 @@ +../../archive/mail.uhu-banane.net/chain1.pem \ No newline at end of file diff --git a/letsencrypt/live/mail.uhu-banane.net/fullchain.pem b/letsencrypt/live/mail.uhu-banane.net/fullchain.pem new file mode 120000 index 0000000..9c3ef24 --- /dev/null +++ b/letsencrypt/live/mail.uhu-banane.net/fullchain.pem @@ -0,0 +1 @@ +../../archive/mail.uhu-banane.net/fullchain1.pem \ No newline at end of file diff --git a/letsencrypt/live/mail.uhu-banane.net/privkey.pem b/letsencrypt/live/mail.uhu-banane.net/privkey.pem new file mode 120000 index 0000000..ead5dc6 --- /dev/null +++ b/letsencrypt/live/mail.uhu-banane.net/privkey.pem @@ -0,0 +1 @@ +../../archive/mail.uhu-banane.net/privkey1.pem \ No newline at end of file diff --git a/letsencrypt/options-ssl-nginx.conf b/letsencrypt/options-ssl-nginx.conf new file mode 100644 index 0000000..292d429 --- /dev/null +++ b/letsencrypt/options-ssl-nginx.conf @@ -0,0 +1,13 @@ +# This file contains important security parameters. If you modify this file +# manually, Certbot will be unable to automatically provide future security +# updates. Instead, Certbot will print and log an error message with a path to +# the up-to-date file that you will need to refer to when manually updating +# this file. + +ssl_session_cache shared:le_nginx_SSL:1m; +ssl_session_timeout 1440m; + +ssl_protocols TLSv1 TLSv1.1 TLSv1.2; +ssl_prefer_server_ciphers on; + +ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS"; diff --git a/letsencrypt/renewal/mail.uhu-banane.net.conf b/letsencrypt/renewal/mail.uhu-banane.net.conf new file mode 100644 index 0000000..7ab9de2 --- /dev/null +++ b/letsencrypt/renewal/mail.uhu-banane.net.conf @@ -0,0 +1,13 @@ +# renew_before_expiry = 30 days +version = 0.31.0 +archive_dir = /etc/letsencrypt/archive/mail.uhu-banane.net +cert = /etc/letsencrypt/live/mail.uhu-banane.net/cert.pem +privkey = /etc/letsencrypt/live/mail.uhu-banane.net/privkey.pem +chain = /etc/letsencrypt/live/mail.uhu-banane.net/chain.pem +fullchain = /etc/letsencrypt/live/mail.uhu-banane.net/fullchain.pem + +# Options used in the renewal process +[renewalparams] +account = f8ceb21f0246f5173cb38ecbde9a58d6 +authenticator = nginx +server = https://acme-v02.api.letsencrypt.org/directory diff --git a/letsencrypt/ssl-dhparams.pem b/letsencrypt/ssl-dhparams.pem new file mode 100644 index 0000000..9b182b7 --- /dev/null +++ b/letsencrypt/ssl-dhparams.pem @@ -0,0 +1,8 @@ +-----BEGIN DH PARAMETERS----- +MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz ++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a +87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7 +YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi +7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD +ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg== +-----END DH PARAMETERS----- diff --git a/motd b/motd index 7a9abdd..66a2643 100644 --- a/motd +++ b/motd @@ -6,8 +6,10 @@ Debian GNU/Linux 10 (buster) |____/ \__,_|_| \__,_|_| |_| -Wie man sein Kind nicht nennen sollte: - Marc Rele +Glücklichsein ist eine Gabe des Schicksals und kommt nicht von außen; +man muß es sich selbst erkämpfen. Das ist aber auch tröstend, denn man +kann es sich erkämpfen. + -- Wilhelm von Humboldt -Today is Setting Orange, the 1st day of Bureaucracy in the YOLD 3186 +Today is Sweetmorn, the 2nd day of Bureaucracy in the YOLD 3186 diff --git a/postfix/main.cf b/postfix/main.cf index f784959..07e0320 100644 --- a/postfix/main.cf +++ b/postfix/main.cf @@ -92,9 +92,9 @@ inet_interfaces = all # # SSL key, certificate, CA # -smtpd_tls_key_file = /etc/ssl/private/iRedMail.key -smtpd_tls_cert_file = /etc/ssl/certs/iRedMail.crt -smtpd_tls_CAfile = /etc/ssl/certs/iRedMail.crt +smtpd_tls_key_file = /etc/letsencrypt/live/mail.uhu-banane.net/privkey.pem +smtpd_tls_cert_file = /etc/letsencrypt/live/mail.uhu-banane.net/fullchain.pem +smtpd_tls_CAfile = $smtpd_tls_cert_file # # Disable SSLv2, SSLv3 @@ -144,7 +144,7 @@ smtpd_tls_security_level = may smtp_tls_security_level = may # Use the same CA file as smtpd. -smtp_tls_CAfile = $smtpd_tls_CAfile +smtp_tls_CAfile = $smtpd_tls_cert_file smtp_tls_note_starttls_offer = yes # Enable long, non-repeating, queue IDs (queue file names). @@ -309,3 +309,5 @@ smtpd_tls_received_header = yes smtpd_banner = $myhostname ESMTP $mail_name $mail_version smtpd_sasl_authenticated_header = yes +smtp_tls_cert_file = $smtpd_tls_cert_file +smtp_tls_key_file = $smtpd_tls_key_file diff --git a/systemd/system/certbot.service.d/posthook.conf b/systemd/system/certbot.service.d/posthook.conf new file mode 100644 index 0000000..022e63d --- /dev/null +++ b/systemd/system/certbot.service.d/posthook.conf @@ -0,0 +1,2 @@ +[Service] +ExecStart=/usr/bin/certbot -q renew --post-hook /usr/local/sbin/restart_mailservices