mirror of
https://github.com/docker-mailserver/docker-mailserver.git
synced 2025-08-02 17:14:31 +02:00
fix: Remove mkcert.sh usage + _setup_ssl refactor. (#2196)
* chore(refactor): DRY up the `_setup_ssl` method
- `/etc/postfix/ssl` was a bit misleading in usage here. As a maintainer (of my own contribution!) I was confused why only `/etc/postfix/ssl` was referenced and not `/etc/dovecot/ssl`.
- The postfix specific path is unnecessary, dovecot was referencing it via it's config, the same can be done from postfix to a generic DMS specific config location instead.
- This location is defined and created early as `/etc/dms/tls` (with var `DMS_TLS_PATH`). All usage of `/etc/postfix/ssl` has been replaced, making it easier to grok. Several `mkdir` commands related to this have been dropped as a result.
- Likewise, a related `TMP_DMS_TLS_PATH` var provides a reference to the config volume path `/tmp/docker-mailserver` which is used for conditions on presently hard-coded paths.
- Other values that benefit from being DRY have been lifted up into vars. Definitely easier to follow now and makes some further opportunities clearer to tackle in a future refactor.
- `chmod` has been updated where appropriate. Public key/cert is acceptable to have as readable by non-root users (644). The custom type with single fullchain file was not root accessible only, but should as it contains a private key.
- That said, the security benefit can be a bit moot due to source files that were copied remain present, the user would be responsible to ensure similar permissions on their source files.
- I've not touched LetsEncrypt section as I don't have time to investigate into that yet (not familiar with that portion).
---
* chore: Remove mkcert logic and dovecot cert
- No longer serving a purpose.
- Our own TLS startup script handles a variety of cert scenarios, while the dropped code was always generating a self-signed cert and persisting an unused cert regardless with `ONE_DIR=1`.
- To avoid similar issues that DH params had with doveadm validating filepath values in the SSL config, the default dummy values match postfix pointing to "snakeoil" cert. That serves the same purpose as mkcert was covering in the image.
- Bonus, no more hassle with differing mkcert target paths for users replacing our supplied Dovecot with the latest community edition.
---
* Error handling for SSL_TYPE
- Added a panic utility to exit early when SSL_TYPE conditions are misconfigured.
- Some info text had order of key/cert occurrence swapped to be consistent with key then cert.
- Some existing comments moved and rephrased.
- Additional comments added.
- `-f` test for cert files instead of `-e` (true also for directories/devices/symlinks).
- _notify messages lifted out of conditionals so that they always output when the case is hit.
- ~~Empty SSL_TYPE collapsed into catch all panic, while it's contents is now mapped to a new 'disabled' value.~~
---
* Use sedfile + improve sed expressions + update case style
- Uses sedfile when appropriate (file change intentional, not optional match/check).
- sed expressions modified to be DRY and reduce escaping via `-r` flag (acceptable if actual text content contains no `?`,`+`,`()` or `{}` characters, [otherwise they must be escaped](https://www.gnu.org/software/sed/manual/html_node/Extended-regexps.html)).
- sed captures anything matched between the parenthesis`()` and inserts it via `\1` as part of the replacement.
- case statements adopt the `(` prefix, adopting recent shell style for consistency.
---
* Refactor SSL_TYPE=disabled
- Postfix is also disabled now.
- Included heavy inline documentation reference for maintainers.
- Dropped an obsolete postfix config option 'use_tls' on the relayhost function, it was replaced by 'security_level'.
---
* I'm a friggin' sed wizard now
- The `modern` TLS_LEVEL is the default values for the configs they modify. As such, `sedfile` outputs an "Error" which isn't an actual concern, back to regular `sed`.
- I realized that multiple edits for the same file can all be done at once via `-e` (assuming other sed options are the same for each operation), and that `g` suffix is global scope for single line match, not whole file (default as sed iterates through individual lines).
- Some postfix replacements have `smtp` and `smtpd` lines, collapsed into a single `smtpd?` instead now that I know sed better.
---
* tests(fix): Tests that require SSL/TLS to pass
- SSL_TYPE=snakeoil added as temporary workaround.
- nmap tests are being dropped. These were added about 4-5 years ago, I have since made these redundant with the `testssl.sh` tests.
- Additionally the `--link` option is deprecated and IIRC these grades were a bit misleading when I initially used nmap in my own TLS cipher suite update PRs in the past.
- The removed SSL test is already handled in mail_ssl_manual.bats
ldap test:
- Replace `--link` alias option with `--network` and alias assignment.
- Parameterized some values and added the `SSL_TYPE` to resolve the starttls test failure.
privacy test:
- Also needed `SSL_TYPE` to pass the starttls test.
`tests.bats` had another starttls test for imap:
- Workaround for now is to give the main test container `SSL_TYPE=snakeoil`.
---
* Remove the expired lets-encrypt cert
This expired in March 2021. It was originally required when first added back in 2016 as LetsEncrypt was fairly new and not as broadly accepted into OS trust stores.
No longer the case today.
---
* chore: Housekeeping
Not required for this PR branch, little bit of tidying up while working on these two test files.
- privacy test copied over content when extracted from `tests.bats` that isn't relevant.
- ldap test was not as easy to identify the source of DOVECOT_TLS. Added comment to make the prefix connection to `configomat.sh` and `.ext` files more easier to find.
- Additionally converted the two localhost FQDN to vars.
---
* Default SSL_TYPE becomes `''` (aka equivalent to desired `disabled` case)
- This is to prevent other tests from failing by hitting the panic catchall case.
- More ideal would be adjusting tests to default to `disabled`, rather than treating `disabled` as an empty / unset SSL_TYPE value.
---
* Add inline documentation for `dms_panic`
- This could later be better formatted and placed into contributor docs.
Panic with kill (shutdown) not exit (errex):
- `kill 1` from `_shutdown` will send SIGTERM signal to PID 1 (init process).
- `exit 1` within the `start-mailserver.sh` init scripts context, will just exit the initialization script leaving the container running when it shouldn't.
The two previous `_shutdown` methods can benefit from using `dms_panic` wrapper instead to standardize on panic messages.
This commit is contained in:
Brennan Kinney
GitHub
parent
2bf24e4c08
commit
c851f5b6aa
12 changed files with 452 additions and 427 deletions
|
|
@ -6,11 +6,12 @@
|
|||
ssl = required
|
||||
|
||||
# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
|
||||
# dropping root privileges, so keep the key file unreadable by anyone but
|
||||
# root. Included doc/mkcert.sh can be used to easily generate self-signed
|
||||
# certificate, just make sure to update the domains in dovecot-openssl.cnf
|
||||
ssl_cert = </etc/dovecot/ssl/dovecot.pem
|
||||
ssl_key = </etc/dovecot/ssl/dovecot.key
|
||||
# dropping root privileges, so keep the key file unreadable by anyone but root.
|
||||
# These [snakeoil files actually exist](https://askubuntu.com/questions/396120/what-is-the-purpose-of-the-ssl-cert-snakeoil-key), but shouldn't ever be used in production!
|
||||
# As `SSL_TYPE` env is required by docker-mailserver, these "snakeoil" files will be replaced on container startup.
|
||||
ssl_cert = </etc/ssl/certs/ssl-cert-snakeoil.pem
|
||||
ssl_key = </etc/ssl/private/ssl-cert-snakeoil.key
|
||||
# Fallback/Hybrid cert support. docker-mailserver will enable these when using ENV vars `SSL_ALT_CERT_PATH` and `SSL_ALT_KEY_PATH`.
|
||||
#ssl_alt_cert = </path/to/alternative/cert.pem
|
||||
#ssl_alt_key = </path/to/alternative/key.pem
|
||||
|
||||
|
|
|
|||
|
|
@ -1,28 +0,0 @@
|
|||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDqblYh5sZvyTNs
|
||||
bbPk3IWa5pZv57GTo/ZkHFJ8O3KIIOUSL/UBVwe298ornYnNar62ZrtL/CgcJdWn
|
||||
DiEm6t/6lJNjaqdVXKTP6PlnXjVmU0Wgww11HLFlKroaMQ4RhVgutXR57JTBEyIY
|
||||
fDBfoto7ujHaFza8nThE3BsVgrGcBjZgYtVbJeAzRvuM/hufxVlfLN+pSzCxrnyX
|
||||
kuZAYut8Yut/c7arLD+A20Ya5b1yIW+7FshSUDICXa9ll/EufzjaFLqJinJSRWEF
|
||||
F0FNVY2QFkqCjQZv86a3FP7USCmDJtPFDnY1ZUVUJjo4JP6LWi0Pr345814W+ydv
|
||||
dIRGnQA1AgMBAAECggEBAIsnz6z0BdqZPhMg02YImK4oLihjCf+vljQ6s6PWzdeM
|
||||
Xy16lh6jgIrVb4aQTxpGQMqZFJi4Jz7+HmK5emhVh3qA8zRSPN3ozlQz4MfBHkWN
|
||||
LImO/tADpjF9OVcOw2EXHA8t2uP80RgCuXx7S2OZkZ1emvTwTqeLU7lcRh9woukP
|
||||
i/HXJscru5rBGWnU2gmOgHBv/0sqARPh97I1z+YdXbs40OcxTQzV6nqWWLa0W+8d
|
||||
nNXDDyGgsMLdOsVxgU2AZ3atP3jL9+OnAwTL6Z9IhYIbnkgxk0NWNe+TmUPtl1sm
|
||||
E9LOLIGh7t2SMOE6XbEFM4OiZ5Nyhahf2EBlgSk9oYECgYEA/kIu49TRnbnaXIYh
|
||||
jIBMUxI892tFYqN6Lxxz1n+An/uGm+CX92mhSoVzSqn6HsrEKTDot8LSlQyWZ5sP
|
||||
eAT8IcKYHouMbbLLOFDZ4jm3jDx/wHmZU14skzLrEZ9y+rr0QdQ3+7dgtMhqs4DV
|
||||
n61Udhph5frNbs2BOI403hs1M+UCgYEA7AljQRHBn/FHiBf+7I1aSwXFcAGhVIMH
|
||||
s61VuDfhQZbL/X5+U6YF1cy3uyDQVQvTzmvAc6JTXOTXBhKMvuxn/Bqgq5aFoJmJ
|
||||
F7bQLsRRzzDp8IylBmMyXysu9jmXa+yocwGGvSRpuAvMRw8MTs0oJ3tMcRRmU1in
|
||||
jySmLaj1dhECgYEAq7BJNXNZ8GW1e9DfCp7/6wBfxrra6ZZ2RSWzWt5SHrWb2do5
|
||||
A8qCLW4bwgkxamWFPENYge2+gQM09NUSBvtmve1HByk4NEMNUwPVfRt4Q+v+YBw8
|
||||
Wr024Fb7wLSo0YI4udLx0rmrRagn1PpkRiSm6fE6ti87VVzTqzrrnCdHL7kCgYEA
|
||||
qhEJhrS4gflixNglQWOHj06VN2K1TyMpxXg6rwT0NEHmsLsXYkXZJnbeWuIFuYFQ
|
||||
FwbkH2zyC5iGpUVwS5AiTC8TXQ6TMWfusztxPIEPQO3JYRy1Oqj2fkOrDpXoWEao
|
||||
CFUtM9KsqYM2qGxbPdvr9qaMKV29bIgQEr8hTPzT/0ECgYAMXndIG6nHWM8frU38
|
||||
U7j2UxVPnrpi1UhPMLHPy16m3RhzLaZ6e/kR8cipVnm7BcW6XkA8a5D8EH2FRFkJ
|
||||
99nTN1OXHa1reD7jym9CxgCcIcNNOF6rawcob6eICVYsCvu2Yaf+8e4Yl9Ra7O33
|
||||
FhNi6I7WYCMbCh1SYxW9Zcclcw==
|
||||
-----END PRIVATE KEY-----
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIDnTCCAoWgAwIBAgIJAOj/MFaMvgN9MA0GCSqGSIb3DQEBCwUAMGUxHDAaBgNV
|
||||
BAoME0RvdmVjb3QgbWFpbCBzZXJ2ZXIxEjAQBgNVBAsMCWxvY2FsaG9zdDESMBAG
|
||||
A1UEAwwJbG9jYWxob3N0MR0wGwYJKoZIhvcNAQkBFg5yb290QGxvY2FsaG9zdDAe
|
||||
Fw0xNjEyMzAxOTM3MDdaFw0yNjEyMzAxOTM3MDdaMGUxHDAaBgNVBAoME0RvdmVj
|
||||
b3QgbWFpbCBzZXJ2ZXIxEjAQBgNVBAsMCWxvY2FsaG9zdDESMBAGA1UEAwwJbG9j
|
||||
YWxob3N0MR0wGwYJKoZIhvcNAQkBFg5yb290QGxvY2FsaG9zdDCCASIwDQYJKoZI
|
||||
hvcNAQEBBQADggEPADCCAQoCggEBAOpuViHmxm/JM2xts+TchZrmlm/nsZOj9mQc
|
||||
Unw7cogg5RIv9QFXB7b3yiudic1qvrZmu0v8KBwl1acOISbq3/qUk2Nqp1VcpM/o
|
||||
+WdeNWZTRaDDDXUcsWUquhoxDhGFWC61dHnslMETIhh8MF+i2ju6MdoXNrydOETc
|
||||
GxWCsZwGNmBi1Vsl4DNG+4z+G5/FWV8s36lLMLGufJeS5kBi63xi639ztqssP4Db
|
||||
RhrlvXIhb7sWyFJQMgJdr2WX8S5/ONoUuomKclJFYQUXQU1VjZAWSoKNBm/zprcU
|
||||
/tRIKYMm08UOdjVlRVQmOjgk/otaLQ+vfjnzXhb7J290hEadADUCAwEAAaNQME4w
|
||||
HQYDVR0OBBYEFGX+1qq4hMBPkQhIFZH75EI7rvpMMB8GA1UdIwQYMBaAFGX+1qq4
|
||||
hMBPkQhIFZH75EI7rvpMMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
|
||||
AEm+lKAOnkj4ub4RwvwFleu5nyYAP4218k0IM6n52/N7WWXIJ1eYFl9qumEBfWu1
|
||||
RQkC3Tr06UgEji3eO3gjyxjIEe+kAoyac320ppfHIhEoIy1v5xt4LLzjb3aXJal2
|
||||
v3gvyyh5oIrtU6xZJ1XGmivdWRSg7if98AtC4YAjWh2Kq4WWsO/VImdG3uNNeNuQ
|
||||
yVh8sffxIRO3/P/5ktF0lRM7NXZMtSzl7BtvV9aHY/iZ73T4uArqvzF8ayxZpbJO
|
||||
c6j8SZBv5A2wByl8FDYdta13ANRybIGRhpPJPEYeEpEC7s9bKm7GTTMc0JX2L7Nx
|
||||
jQM+vzvuCnID+tpo6qGo0Uo=
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -1,44 +1,42 @@
|
|||
load 'test_helper/common'
|
||||
|
||||
function setup() {
|
||||
run_setup_file_if_necessary
|
||||
run_setup_file_if_necessary
|
||||
}
|
||||
|
||||
function teardown() {
|
||||
run_teardown_file_if_necessary
|
||||
run_teardown_file_if_necessary
|
||||
}
|
||||
|
||||
function setup_file() {
|
||||
local PRIVATE_CONFIG
|
||||
PRIVATE_CONFIG="$(duplicate_config_for_container .)"
|
||||
docker run -d --name mail_privacy \
|
||||
-v "${PRIVATE_CONFIG}":/tmp/docker-mailserver \
|
||||
-v "$(pwd)/test/test-files":/tmp/docker-mailserver-test:ro \
|
||||
-e SASL_PASSWD="external-domain.com username:password" \
|
||||
-e ENABLE_MANAGESIEVE=1 \
|
||||
--cap-add=SYS_PTRACE \
|
||||
-e PERMIT_DOCKER=host \
|
||||
-e DMS_DEBUG=0 \
|
||||
-h mail.my-domain.com -t "${NAME}"
|
||||
local PRIVATE_CONFIG
|
||||
PRIVATE_CONFIG="$(duplicate_config_for_container .)"
|
||||
docker run -d --name mail_privacy \
|
||||
-v "${PRIVATE_CONFIG}":/tmp/docker-mailserver \
|
||||
-v "$(pwd)/test/test-files":/tmp/docker-mailserver-test:ro \
|
||||
-e SASL_PASSWD="external-domain.com username:password" \
|
||||
-e ENABLE_MANAGESIEVE=1 \
|
||||
--cap-add=SYS_PTRACE \
|
||||
-e PERMIT_DOCKER=host \
|
||||
-e DMS_DEBUG=0 \
|
||||
-h mail.my-domain.com \
|
||||
-e SSL_TYPE='snakeoil' \
|
||||
--tty \
|
||||
"${NAME}" # Image name
|
||||
|
||||
wait_for_amavis_port_in_container mail_privacy
|
||||
wait_for_smtp_port_in_container mail_privacy
|
||||
wait_for_amavis_port_in_container mail_privacy
|
||||
wait_for_smtp_port_in_container mail_privacy
|
||||
}
|
||||
|
||||
function teardown_file() {
|
||||
docker rm -f mail_privacy
|
||||
docker rm -f mail_privacy
|
||||
}
|
||||
|
||||
@test "first" {
|
||||
skip 'this test must come first to reliably identify when to run setup_file'
|
||||
}
|
||||
|
||||
#
|
||||
# LDAP
|
||||
#
|
||||
|
||||
# postfix
|
||||
|
||||
# What this test should cover: https://github.com/docker-mailserver/docker-mailserver/issues/681
|
||||
@test "checking postfix: remove privacy details of the sender" {
|
||||
docker exec mail_privacy /bin/sh -c "openssl s_client -quiet -starttls smtp -connect 0.0.0.0:587 < /tmp/docker-mailserver-test/email-templates/send-privacy-email.txt"
|
||||
# shellcheck disable=SC2016
|
||||
|
|
@ -52,7 +50,6 @@ function teardown_file() {
|
|||
assert_output 0
|
||||
}
|
||||
|
||||
|
||||
@test "last" {
|
||||
skip 'this test is only there to reliably mark the end for the teardown_file'
|
||||
}
|
||||
|
|
|
|||
|
|
@ -11,10 +11,10 @@ function teardown() {
|
|||
|
||||
function setup_file() {
|
||||
# Internal copies made by `start-mailserver.sh`:
|
||||
export PRIMARY_KEY='/etc/postfix/ssl/key'
|
||||
export PRIMARY_CERT='/etc/postfix/ssl/cert'
|
||||
export FALLBACK_KEY='/etc/postfix/ssl/fallback_key'
|
||||
export FALLBACK_CERT='/etc/postfix/ssl/fallback_cert'
|
||||
export PRIMARY_KEY='/etc/dms/tls/key'
|
||||
export PRIMARY_CERT='/etc/dms/tls/cert'
|
||||
export FALLBACK_KEY='/etc/dms/tls/fallback_key'
|
||||
export FALLBACK_CERT='/etc/dms/tls/fallback_cert'
|
||||
|
||||
# Volume mounted certs:
|
||||
export SSL_KEY_PATH='/config/ssl/key.ecdsa.pem'
|
||||
|
|
|
|||
|
|
@ -1,54 +1,73 @@
|
|||
load 'test_helper/common'
|
||||
|
||||
function setup() {
|
||||
run_setup_file_if_necessary
|
||||
run_setup_file_if_necessary
|
||||
}
|
||||
|
||||
function teardown() {
|
||||
run_teardown_file_if_necessary
|
||||
run_teardown_file_if_necessary
|
||||
}
|
||||
|
||||
function setup_file() {
|
||||
pushd test/docker-openldap/ || return 1
|
||||
docker build -f Dockerfile -t ldap --no-cache .
|
||||
popd || return 1
|
||||
pushd test/docker-openldap/ || return 1
|
||||
docker build -f Dockerfile -t ldap --no-cache .
|
||||
popd || return 1
|
||||
|
||||
docker run -d --name ldap_for_mail \
|
||||
-e LDAP_DOMAIN="localhost.localdomain" \
|
||||
-h ldap.my-domain.com -t ldap
|
||||
export FQDN_MAIL='mail.my-domain.com'
|
||||
export FQDN_LDAP='ldap.my-domain.com'
|
||||
export FQDN_LOCALHOST_A='localhost.localdomain'
|
||||
export FQDN_LOCALHOST_B='localhost.otherdomain'
|
||||
export DMS_TEST_NETWORK='test-network-ldap'
|
||||
|
||||
local PRIVATE_CONFIG
|
||||
PRIVATE_CONFIG="$(duplicate_config_for_container .)"
|
||||
docker run -d --name mail_with_ldap \
|
||||
-v "${PRIVATE_CONFIG}":/tmp/docker-mailserver \
|
||||
-v "$(pwd)/test/test-files":/tmp/docker-mailserver-test:ro \
|
||||
-e ENABLE_LDAP=1 \
|
||||
-e LDAP_SERVER_HOST=ldap \
|
||||
-e LDAP_START_TLS=no \
|
||||
-e SPOOF_PROTECTION=1 \
|
||||
-e LDAP_SEARCH_BASE=ou=people,dc=localhost,dc=localdomain \
|
||||
-e LDAP_BIND_DN=cn=admin,dc=localhost,dc=localdomain \
|
||||
-e LDAP_BIND_PW=admin \
|
||||
-e LDAP_QUERY_FILTER_USER="(&(mail=%s)(mailEnabled=TRUE))" \
|
||||
-e LDAP_QUERY_FILTER_GROUP="(&(mailGroupMember=%s)(mailEnabled=TRUE))" \
|
||||
-e LDAP_QUERY_FILTER_ALIAS="(|(&(mailAlias=%s)(objectClass=PostfixBookMailForward))(&(mailAlias=%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE)))" \
|
||||
-e LDAP_QUERY_FILTER_DOMAIN="(|(&(mail=*@%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE))(&(mailGroupMember=*@%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE))(&(mailalias=*@%s)(objectClass=PostfixBookMailForward)))" \
|
||||
-e LDAP_QUERY_FILTER_SENDERS="(|(&(mail=%s)(mailEnabled=TRUE))(&(mailGroupMember=%s)(mailEnabled=TRUE))(|(&(mailAlias=%s)(objectClass=PostfixBookMailForward))(&(mailAlias=%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE)))(uniqueIdentifier=some.user.id))" \
|
||||
-e DOVECOT_TLS=no \
|
||||
-e DOVECOT_PASS_FILTER="(&(objectClass=PostfixBookMailAccount)(uniqueIdentifier=%n))" \
|
||||
-e DOVECOT_USER_FILTER="(&(objectClass=PostfixBookMailAccount)(uniqueIdentifier=%n))" \
|
||||
-e REPORT_RECIPIENT=1 \
|
||||
-e ENABLE_SASLAUTHD=1 \
|
||||
-e SASLAUTHD_MECHANISMS=ldap \
|
||||
-e POSTMASTER_ADDRESS=postmaster@localhost.localdomain \
|
||||
-e DMS_DEBUG=0 \
|
||||
--link ldap_for_mail:ldap \
|
||||
-h mail.my-domain.com -t "${NAME}"
|
||||
wait_for_smtp_port_in_container mail_with_ldap
|
||||
# NOTE: If the network already exists, test will fail to start.
|
||||
docker network create "${DMS_TEST_NETWORK}"
|
||||
|
||||
docker run -d --name ldap_for_mail \
|
||||
--env LDAP_DOMAIN="${FQDN_LOCALHOST_A}" \
|
||||
--network "${DMS_TEST_NETWORK}" \
|
||||
--network-alias 'ldap' \
|
||||
--hostname "${FQDN_LDAP}" \
|
||||
--tty \
|
||||
ldap # Image name
|
||||
|
||||
# _setup_ldap uses configomat with .ext files and ENV vars like DOVECOT_TLS with a prefix (eg DOVECOT_ or LDAP_)
|
||||
local PRIVATE_CONFIG
|
||||
PRIVATE_CONFIG="$(duplicate_config_for_container .)"
|
||||
docker run -d --name mail_with_ldap \
|
||||
-v "${PRIVATE_CONFIG}:/tmp/docker-mailserver" \
|
||||
-v "$(pwd)/test/test-files:/tmp/docker-mailserver-test:ro" \
|
||||
-e SPOOF_PROTECTION=1 \
|
||||
-e ENABLE_LDAP=1 \
|
||||
-e LDAP_SERVER_HOST=ldap \
|
||||
-e LDAP_START_TLS=no \
|
||||
-e LDAP_SEARCH_BASE=ou=people,dc=localhost,dc=localdomain \
|
||||
-e LDAP_BIND_DN=cn=admin,dc=localhost,dc=localdomain \
|
||||
-e LDAP_BIND_PW=admin \
|
||||
-e LDAP_QUERY_FILTER_USER="(&(mail=%s)(mailEnabled=TRUE))" \
|
||||
-e LDAP_QUERY_FILTER_GROUP="(&(mailGroupMember=%s)(mailEnabled=TRUE))" \
|
||||
-e LDAP_QUERY_FILTER_ALIAS="(|(&(mailAlias=%s)(objectClass=PostfixBookMailForward))(&(mailAlias=%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE)))" \
|
||||
-e LDAP_QUERY_FILTER_DOMAIN="(|(&(mail=*@%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE))(&(mailGroupMember=*@%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE))(&(mailalias=*@%s)(objectClass=PostfixBookMailForward)))" \
|
||||
-e LDAP_QUERY_FILTER_SENDERS="(|(&(mail=%s)(mailEnabled=TRUE))(&(mailGroupMember=%s)(mailEnabled=TRUE))(|(&(mailAlias=%s)(objectClass=PostfixBookMailForward))(&(mailAlias=%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE)))(uniqueIdentifier=some.user.id))" \
|
||||
-e DOVECOT_TLS=no \
|
||||
-e DOVECOT_PASS_FILTER="(&(objectClass=PostfixBookMailAccount)(uniqueIdentifier=%n))" \
|
||||
-e DOVECOT_USER_FILTER="(&(objectClass=PostfixBookMailAccount)(uniqueIdentifier=%n))" \
|
||||
-e REPORT_RECIPIENT=1 \
|
||||
-e ENABLE_SASLAUTHD=1 \
|
||||
-e SASLAUTHD_MECHANISMS=ldap \
|
||||
-e POSTMASTER_ADDRESS="postmaster@${FQDN_LOCALHOST_A}" \
|
||||
-e DMS_DEBUG=0 \
|
||||
-e SSL_TYPE='snakeoil' \
|
||||
--network "${DMS_TEST_NETWORK}" \
|
||||
--hostname "${FQDN_MAIL}" \
|
||||
--tty \
|
||||
"${NAME}" # Image name
|
||||
|
||||
wait_for_smtp_port_in_container mail_with_ldap
|
||||
}
|
||||
|
||||
function teardown_file() {
|
||||
docker rm -f ldap_for_mail mail_with_ldap
|
||||
docker rm -f ldap_for_mail mail_with_ldap
|
||||
docker network rm "${DMS_TEST_NETWORK}"
|
||||
}
|
||||
|
||||
@test "first" {
|
||||
|
|
@ -64,31 +83,31 @@ function teardown_file() {
|
|||
|
||||
# postfix
|
||||
@test "checking postfix: ldap lookup works correctly" {
|
||||
run docker exec mail_with_ldap /bin/sh -c "postmap -q some.user@localhost.localdomain ldap:/etc/postfix/ldap-users.cf"
|
||||
run docker exec mail_with_ldap /bin/sh -c "postmap -q some.user@${FQDN_LOCALHOST_A} ldap:/etc/postfix/ldap-users.cf"
|
||||
assert_success
|
||||
assert_output "some.user@localhost.localdomain"
|
||||
run docker exec mail_with_ldap /bin/sh -c "postmap -q postmaster@localhost.localdomain ldap:/etc/postfix/ldap-aliases.cf"
|
||||
assert_output "some.user@${FQDN_LOCALHOST_A}"
|
||||
run docker exec mail_with_ldap /bin/sh -c "postmap -q postmaster@${FQDN_LOCALHOST_A} ldap:/etc/postfix/ldap-aliases.cf"
|
||||
assert_success
|
||||
assert_output "some.user@localhost.localdomain"
|
||||
run docker exec mail_with_ldap /bin/sh -c "postmap -q employees@localhost.localdomain ldap:/etc/postfix/ldap-groups.cf"
|
||||
assert_output "some.user@${FQDN_LOCALHOST_A}"
|
||||
run docker exec mail_with_ldap /bin/sh -c "postmap -q employees@${FQDN_LOCALHOST_A} ldap:/etc/postfix/ldap-groups.cf"
|
||||
assert_success
|
||||
assert_output "some.user@localhost.localdomain"
|
||||
assert_output "some.user@${FQDN_LOCALHOST_A}"
|
||||
|
||||
# Test of the user part of the domain is not the same as the uniqueIdentifier part in the ldap
|
||||
run docker exec mail_with_ldap /bin/sh -c "postmap -q some.user.email@localhost.localdomain ldap:/etc/postfix/ldap-users.cf"
|
||||
run docker exec mail_with_ldap /bin/sh -c "postmap -q some.user.email@${FQDN_LOCALHOST_A} ldap:/etc/postfix/ldap-users.cf"
|
||||
assert_success
|
||||
assert_output "some.user.email@localhost.localdomain"
|
||||
assert_output "some.user.email@${FQDN_LOCALHOST_A}"
|
||||
|
||||
# Test email receiving from a other domain then the primary domain of the mailserver
|
||||
run docker exec mail_with_ldap /bin/sh -c "postmap -q some.other.user@localhost.otherdomain ldap:/etc/postfix/ldap-users.cf"
|
||||
run docker exec mail_with_ldap /bin/sh -c "postmap -q some.other.user@${FQDN_LOCALHOST_B} ldap:/etc/postfix/ldap-users.cf"
|
||||
assert_success
|
||||
assert_output "some.other.user@localhost.otherdomain"
|
||||
run docker exec mail_with_ldap /bin/sh -c "postmap -q postmaster@localhost.otherdomain ldap:/etc/postfix/ldap-aliases.cf"
|
||||
assert_output "some.other.user@${FQDN_LOCALHOST_B}"
|
||||
run docker exec mail_with_ldap /bin/sh -c "postmap -q postmaster@${FQDN_LOCALHOST_B} ldap:/etc/postfix/ldap-aliases.cf"
|
||||
assert_success
|
||||
assert_output "some.other.user@localhost.otherdomain"
|
||||
run docker exec mail_with_ldap /bin/sh -c "postmap -q employees@localhost.otherdomain ldap:/etc/postfix/ldap-groups.cf"
|
||||
assert_output "some.other.user@${FQDN_LOCALHOST_B}"
|
||||
run docker exec mail_with_ldap /bin/sh -c "postmap -q employees@${FQDN_LOCALHOST_B} ldap:/etc/postfix/ldap-groups.cf"
|
||||
assert_success
|
||||
assert_output "some.other.user@localhost.otherdomain"
|
||||
assert_output "some.other.user@${FQDN_LOCALHOST_B}"
|
||||
}
|
||||
|
||||
@test "checking postfix: ldap custom config files copied" {
|
||||
|
|
@ -136,17 +155,17 @@ function teardown_file() {
|
|||
}
|
||||
|
||||
@test "checking dovecot: ldap mail delivery works" {
|
||||
run docker exec mail_with_ldap /bin/sh -c "sendmail -f user@external.tld some.user@localhost.localdomain < /tmp/docker-mailserver-test/email-templates/test-email.txt"
|
||||
run docker exec mail_with_ldap /bin/sh -c "sendmail -f user@external.tld some.user@${FQDN_LOCALHOST_A} < /tmp/docker-mailserver-test/email-templates/test-email.txt"
|
||||
sleep 10
|
||||
run docker exec mail_with_ldap /bin/sh -c "ls -A /var/mail/localhost.localdomain/some.user/new | wc -l"
|
||||
run docker exec mail_with_ldap /bin/sh -c "ls -A /var/mail/${FQDN_LOCALHOST_A}/some.user/new | wc -l"
|
||||
assert_success
|
||||
assert_output 1
|
||||
}
|
||||
|
||||
@test "checking dovecot: ldap mail delivery works for a different domain then the mailserver" {
|
||||
run docker exec mail_with_ldap /bin/sh -c "sendmail -f user@external.tld some.other.user@localhost.otherdomain < /tmp/docker-mailserver-test/email-templates/test-email.txt"
|
||||
run docker exec mail_with_ldap /bin/sh -c "sendmail -f user@external.tld some.other.user@${FQDN_LOCALHOST_B} < /tmp/docker-mailserver-test/email-templates/test-email.txt"
|
||||
sleep 10
|
||||
run docker exec mail_with_ldap /bin/sh -c "ls -A /var/mail/localhost.localdomain/some.other.user/new | wc -l"
|
||||
run docker exec mail_with_ldap /bin/sh -c "ls -A /var/mail/${FQDN_LOCALHOST_A}/some.other.user/new | wc -l"
|
||||
assert_success
|
||||
assert_output 1
|
||||
}
|
||||
|
|
@ -163,7 +182,7 @@ function teardown_file() {
|
|||
}
|
||||
|
||||
@test "checking dovecot: postmaster address" {
|
||||
run docker exec mail_with_ldap /bin/sh -c "grep 'postmaster_address = postmaster@localhost.localdomain' /etc/dovecot/conf.d/15-lda.conf"
|
||||
run docker exec mail_with_ldap /bin/sh -c "grep 'postmaster_address = postmaster@${FQDN_LOCALHOST_A}' /etc/dovecot/conf.d/15-lda.conf"
|
||||
assert_success
|
||||
}
|
||||
|
||||
|
|
@ -220,7 +239,7 @@ function teardown_file() {
|
|||
|
||||
@test "checking pflogsum delivery" {
|
||||
# checking default sender is correctly set when env variable not defined
|
||||
run docker exec mail_with_ldap grep "mailserver-report@mail.my-domain.com" /etc/logrotate.d/maillog
|
||||
run docker exec mail_with_ldap grep "mailserver-report@${FQDN_MAIL}" /etc/logrotate.d/maillog
|
||||
assert_success
|
||||
|
||||
# checking default logrotation setup
|
||||
|
|
|
|||
267
test/tests.bats
267
test/tests.bats
|
|
@ -14,27 +14,30 @@ setup_file() {
|
|||
PRIVATE_CONFIG="$(duplicate_config_for_container . mail)"
|
||||
mv "${PRIVATE_CONFIG}/user-patches/user-patches.sh" "${PRIVATE_CONFIG}/user-patches.sh"
|
||||
docker run --rm -d --name mail \
|
||||
-v "${PRIVATE_CONFIG}":/tmp/docker-mailserver \
|
||||
-v "$(pwd)/test/test-files":/tmp/docker-mailserver-test:ro \
|
||||
-v "$(pwd)/test/onedir":/var/mail-state \
|
||||
-e ENABLE_CLAMAV=1 \
|
||||
-e SPOOF_PROTECTION=1 \
|
||||
-e ENABLE_SPAMASSASSIN=1 \
|
||||
-e REPORT_RECIPIENT=user1@localhost.localdomain \
|
||||
-e REPORT_SENDER=report1@mail.my-domain.com \
|
||||
-e SA_TAG=-5.0 \
|
||||
-e SA_TAG2=2.0 \
|
||||
-e SA_KILL=3.0 \
|
||||
-e AMAVIS_LOGLEVEL=2 \
|
||||
-e SA_SPAM_SUBJECT="SPAM: " \
|
||||
-e VIRUSMAILS_DELETE_DELAY=7 \
|
||||
-e ENABLE_SRS=1 \
|
||||
-e SASL_PASSWD="external-domain.com username:password" \
|
||||
-e ENABLE_MANAGESIEVE=1 \
|
||||
--cap-add=SYS_PTRACE \
|
||||
-e PERMIT_DOCKER=host \
|
||||
-e DMS_DEBUG=0 \
|
||||
-h mail.my-domain.com -t "${NAME}"
|
||||
-v "${PRIVATE_CONFIG}":/tmp/docker-mailserver \
|
||||
-v "$(pwd)/test/test-files":/tmp/docker-mailserver-test:ro \
|
||||
-v "$(pwd)/test/onedir":/var/mail-state \
|
||||
-e ENABLE_CLAMAV=1 \
|
||||
-e SPOOF_PROTECTION=1 \
|
||||
-e ENABLE_SPAMASSASSIN=1 \
|
||||
-e REPORT_RECIPIENT=user1@localhost.localdomain \
|
||||
-e REPORT_SENDER=report1@mail.my-domain.com \
|
||||
-e SA_TAG=-5.0 \
|
||||
-e SA_TAG2=2.0 \
|
||||
-e SA_KILL=3.0 \
|
||||
-e AMAVIS_LOGLEVEL=2 \
|
||||
-e SA_SPAM_SUBJECT="SPAM: " \
|
||||
-e VIRUSMAILS_DELETE_DELAY=7 \
|
||||
-e ENABLE_SRS=1 \
|
||||
-e SASL_PASSWD="external-domain.com username:password" \
|
||||
-e ENABLE_MANAGESIEVE=1 \
|
||||
-e PERMIT_DOCKER=host \
|
||||
-e DMS_DEBUG=0 \
|
||||
-e SSL_TYPE='snakeoil' \
|
||||
-h mail.my-domain.com \
|
||||
--cap-add=SYS_PTRACE \
|
||||
--tty \
|
||||
"${NAME}"
|
||||
|
||||
wait_for_finished_setup_in_container mail
|
||||
|
||||
|
|
@ -43,34 +46,34 @@ setup_file() {
|
|||
docker exec mail addmailuser pass@localhost.localdomain 'may be \a `p^a.*ssword'
|
||||
|
||||
# setup sieve
|
||||
docker cp "${PRIVATE_CONFIG}/sieve/dovecot.sieve" mail:/var/mail/localhost.localdomain/user1/.dovecot.sieve
|
||||
docker cp "${PRIVATE_CONFIG}/sieve/dovecot.sieve" mail:/var/mail/localhost.localdomain/user1/.dovecot.sieve
|
||||
|
||||
# this relies on the checksum file beeing updated after all changes have been applied
|
||||
wait_for_changes_to_be_detected_in_container mail
|
||||
|
||||
wait_for_smtp_port_in_container mail
|
||||
wait_for_smtp_port_in_container mail
|
||||
|
||||
# wait for clamav to be fully setup or we will get errors on the log
|
||||
repeat_in_container_until_success_or_timeout 60 mail test -e /var/run/clamav/clamd.ctl
|
||||
|
||||
# sending test mails
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/amavis-spam.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/amavis-virus.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-alias-external.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-alias-local.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-alias-recipient-delimiter.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user1.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user2.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user3.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-added.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user-and-cc-local-alias.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-regexp-alias-external.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-regexp-alias-local.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-catchall-local.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/sieve-spam-folder.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/sieve-pipe.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/non-existing-user.txt"
|
||||
docker exec mail /bin/sh -c "sendmail root < /tmp/docker-mailserver-test/email-templates/root-email.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/amavis-spam.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/amavis-virus.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-alias-external.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-alias-local.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-alias-recipient-delimiter.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user1.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user2.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user3.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-added.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user-and-cc-local-alias.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-regexp-alias-external.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-regexp-alias-local.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-catchall-local.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/sieve-spam-folder.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/sieve-pipe.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/non-existing-user.txt"
|
||||
docker exec mail /bin/sh -c "sendmail root < /tmp/docker-mailserver-test/email-templates/root-email.txt"
|
||||
|
||||
wait_for_empty_mail_queue_in_container mail
|
||||
}
|
||||
|
|
@ -432,20 +435,6 @@ EOF
|
|||
assert_success
|
||||
}
|
||||
|
||||
#
|
||||
# ssl
|
||||
#
|
||||
|
||||
@test "checking ssl: generated default cert works correctly" {
|
||||
run docker exec mail /bin/sh -c "timeout 1 openssl s_client -connect 0.0.0.0:587 -starttls smtp -CApath /etc/ssl/certs/ | grep 'Verify return code: 0 (ok)'"
|
||||
assert_success
|
||||
}
|
||||
|
||||
@test "checking ssl: lets-encrypt-x3-cross-signed.pem is installed" {
|
||||
run docker exec mail grep 'BEGIN CERTIFICATE' /etc/ssl/certs/lets-encrypt-x3-cross-signed.pem
|
||||
assert_success
|
||||
}
|
||||
|
||||
#
|
||||
# postsrsd
|
||||
#
|
||||
|
|
@ -701,86 +690,86 @@ EOF
|
|||
|
||||
|
||||
@test "checking quota: setquota user must be existing" {
|
||||
run docker exec mail /bin/sh -c "addmailuser quota_user@domain.tld mypassword"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "addmailuser quota_user@domain.tld mypassword"
|
||||
assert_success
|
||||
|
||||
run docker exec mail /bin/sh -c "setquota quota_user 50M"
|
||||
assert_failure
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 50M"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "setquota quota_user 50M"
|
||||
assert_failure
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 50M"
|
||||
assert_success
|
||||
|
||||
run docker exec mail /bin/sh -c "setquota username@fulldomain 50M"
|
||||
assert_failure
|
||||
run docker exec mail /bin/sh -c "setquota username@fulldomain 50M"
|
||||
assert_failure
|
||||
|
||||
run docker exec mail /bin/sh -c "delmailuser -y quota_user@domain.tld"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "delmailuser -y quota_user@domain.tld"
|
||||
assert_success
|
||||
}
|
||||
@test "checking quota: setquota <quota> must be well formatted" {
|
||||
run docker exec mail /bin/sh -c "addmailuser quota_user@domain.tld mypassword"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "addmailuser quota_user@domain.tld mypassword"
|
||||
assert_success
|
||||
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 26GIGOTS"
|
||||
assert_failure
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 123"
|
||||
assert_failure
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld M"
|
||||
assert_failure
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld -60M"
|
||||
assert_failure
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 26GIGOTS"
|
||||
assert_failure
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 123"
|
||||
assert_failure
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld M"
|
||||
assert_failure
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld -60M"
|
||||
assert_failure
|
||||
|
||||
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 10B"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 10k"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 10M"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 10G"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 10T"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 10B"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 10k"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 10M"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 10G"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 10T"
|
||||
assert_success
|
||||
|
||||
|
||||
run docker exec mail /bin/sh -c "delmailuser -y quota_user@domain.tld"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "delmailuser -y quota_user@domain.tld"
|
||||
assert_success
|
||||
}
|
||||
|
||||
|
||||
@test "checking quota: delquota user must be existing" {
|
||||
run docker exec mail /bin/sh -c "addmailuser quota_user@domain.tld mypassword"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "addmailuser quota_user@domain.tld mypassword"
|
||||
assert_success
|
||||
|
||||
run docker exec mail /bin/sh -c "delquota uota_user@domain.tld"
|
||||
assert_failure
|
||||
run docker exec mail /bin/sh -c "delquota quota_user"
|
||||
assert_failure
|
||||
run docker exec mail /bin/sh -c "delquota dontknowyou@domain.tld"
|
||||
assert_failure
|
||||
run docker exec mail /bin/sh -c "delquota uota_user@domain.tld"
|
||||
assert_failure
|
||||
run docker exec mail /bin/sh -c "delquota quota_user"
|
||||
assert_failure
|
||||
run docker exec mail /bin/sh -c "delquota dontknowyou@domain.tld"
|
||||
assert_failure
|
||||
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 10T"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "delquota quota_user@domain.tld"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "grep -i 'quota_user@domain.tld' /tmp/docker-mailserver/dovecot-quotas.cf"
|
||||
assert_failure
|
||||
run docker exec mail /bin/sh -c "setquota quota_user@domain.tld 10T"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "delquota quota_user@domain.tld"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "grep -i 'quota_user@domain.tld' /tmp/docker-mailserver/dovecot-quotas.cf"
|
||||
assert_failure
|
||||
|
||||
run docker exec mail /bin/sh -c "delmailuser -y quota_user@domain.tld"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "delmailuser -y quota_user@domain.tld"
|
||||
assert_success
|
||||
}
|
||||
@test "checking quota: delquota allow when no quota for existing user" {
|
||||
run docker exec mail /bin/sh -c "addmailuser quota_user@domain.tld mypassword"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "addmailuser quota_user@domain.tld mypassword"
|
||||
assert_success
|
||||
|
||||
run docker exec mail /bin/sh -c "grep -i 'quota_user@domain.tld' /tmp/docker-mailserver/dovecot-quotas.cf"
|
||||
assert_failure
|
||||
run docker exec mail /bin/sh -c "grep -i 'quota_user@domain.tld' /tmp/docker-mailserver/dovecot-quotas.cf"
|
||||
assert_failure
|
||||
|
||||
run docker exec mail /bin/sh -c "delquota quota_user@domain.tld"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "delquota quota_user@domain.tld"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "delquota quota_user@domain.tld"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "delquota quota_user@domain.tld"
|
||||
assert_success
|
||||
|
||||
run docker exec mail /bin/sh -c "delmailuser -y quota_user@domain.tld"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "delmailuser -y quota_user@domain.tld"
|
||||
assert_success
|
||||
}
|
||||
|
||||
@test "checking quota: dovecot quota present in postconf" {
|
||||
|
|
@ -1216,60 +1205,6 @@ EOF
|
|||
assert_failure
|
||||
}
|
||||
|
||||
|
||||
#
|
||||
# PCI compliance
|
||||
#
|
||||
|
||||
# dovecot
|
||||
@test "checking dovecot: only A grade TLS ciphers are used" {
|
||||
run docker run --rm -i --link mail:dovecot \
|
||||
--entrypoint sh instrumentisto/nmap -c \
|
||||
'nmap --script ssl-enum-ciphers -p 993 dovecot | grep "least strength: A"'
|
||||
assert_success
|
||||
}
|
||||
|
||||
@test "checking dovecot: nmap produces no warnings on TLS ciphers verifying" {
|
||||
run docker run --rm -i --link mail:dovecot \
|
||||
--entrypoint sh instrumentisto/nmap -c \
|
||||
'nmap --script ssl-enum-ciphers -p 993 dovecot | grep "warnings" | wc -l'
|
||||
assert_success
|
||||
assert_output 0
|
||||
}
|
||||
|
||||
# postfix submission TLS
|
||||
@test "checking postfix submission: only A grade TLS ciphers are used" {
|
||||
run docker run --rm -i --link mail:postfix \
|
||||
--entrypoint sh instrumentisto/nmap -c \
|
||||
'nmap --script ssl-enum-ciphers -p 587 postfix | grep "least strength: A"'
|
||||
assert_success
|
||||
}
|
||||
|
||||
@test "checking postfix submission: nmap produces no warnings on TLS ciphers verifying" {
|
||||
run docker run --rm -i --link mail:postfix \
|
||||
--entrypoint sh instrumentisto/nmap -c \
|
||||
'nmap --script ssl-enum-ciphers -p 587 postfix | grep "warnings" | wc -l'
|
||||
assert_success
|
||||
assert_output 0
|
||||
}
|
||||
|
||||
# postfix smtps SSL
|
||||
@test "checking postfix smtps: only A grade TLS ciphers are used" {
|
||||
run docker run --rm -i --link mail:postfix \
|
||||
--entrypoint sh instrumentisto/nmap -c \
|
||||
'nmap --script ssl-enum-ciphers -p 465 postfix | grep "least strength: A"'
|
||||
assert_success
|
||||
}
|
||||
|
||||
@test "checking postfix smtps: nmap produces no warnings on TLS ciphers verifying" {
|
||||
run docker run --rm -i --link mail:postfix \
|
||||
--entrypoint sh instrumentisto/nmap -c \
|
||||
'nmap --script ssl-enum-ciphers -p 465 postfix | grep "warnings" | wc -l'
|
||||
assert_success
|
||||
assert_output 0
|
||||
}
|
||||
|
||||
|
||||
#
|
||||
# supervisor
|
||||
#
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue