From d89441b47bd83570f89dd6ed74f1530f132e8965 Mon Sep 17 00:00:00 2001 From: Spitap Date: Tue, 13 Jun 2023 15:59:37 +0200 Subject: [PATCH] Send only mailboxes --- doc/upgrade.rst | 57 +++++++++++++++++++++++++++++---- modoboa/admin/handlers.py | 3 +- modoboa/admin/models/mailbox.py | 2 ++ modoboa/admin/postfix_maps.py | 26 +++++++++++++++ 4 files changed, 80 insertions(+), 8 deletions(-) diff --git a/doc/upgrade.rst b/doc/upgrade.rst index 953c00661..8b250a3c8 100644 --- a/doc/upgrade.rst +++ b/doc/upgrade.rst @@ -119,9 +119,9 @@ Specific instructions .. note:: This version has not been released yet. -* Django has been updated to 4.2LTS. Please upgrade all your extensions alongside modoboa. -* Support for Python 3.7 has been dropped, minimum Python version is now 3.8. -* Support for Postgres 11 has been dropped, minimum Postgres version is now 12. +* Django has been updated to 4.2LTS. Please upgrade all your extensions alongside modoboa +* Support for Python 3.7 has been dropped, minimum Python version is now 3.8 +* Support for Postgres 11 has been dropped, minimum Postgres version is now 12 If you use Postgresql, you need to install pyscopg3+: @@ -131,7 +131,7 @@ If you use Postgresql, you need to install pyscopg3+: RQ has been added. This should replace the use of cron jobs in the future. For now, only ``manage_dkim_keys`` has been migrated. This will make the dkim -key generation asynchronious but the task will be started as soon as the generation +key generation asynchronous but the task will be started as soon as the generation is required. Follow these instructions to perform the update in case you used supervisord for the @@ -140,9 +140,10 @@ installation (this apply if you used ``modoboa-installer``): 1. Edit settings.py (``/srv/modoboa/instance/instance/settings.py`` by default) and add: .. sourcecode:: python + INSTALLED_APPS = ( - ..., - 'django_rq', + ..., + 'django_rq', ) and add the RQ section bellow the ``#REDIS`` section: @@ -168,7 +169,7 @@ and add the RQ section bellow the ``#REDIS`` section: } } -Then by default you will need to restart ``uwsgi`` service. ``systemctl restart uwsgi`` on Debian. +Then by default you will need to restart ``uwsgi`` service (``systemctl restart uwsgi`` on Debian). 2. Create a new supervisord config (``/etc/supervisor/conf.d/modoboaworkerd.conf`` by default) : @@ -192,6 +193,48 @@ You can help you with ``/etc/supervisor/conf.d/policyd.conf`` (by default). Then restart supervisor. ``#> supervisorctl reread && supervisorctl update`` on Debian. +Admins now have the option to setup a receive-only mailbox or a send-only mailbox. + +Generate new maps for postfix from your virtual environment: + +.. sourcecode:: python + > python3 manage.py generate_postfix_maps --destdir /etc/postfix/ --force-overwrite + +Send-only mailboxes do not have access to IMAP. +You need to change your dovecot configuration to enable it. + +If you use ``Postgres``: +Change ``user_query`` in ``/etc/dovecot/dovecot-sql-master.conf.ext``: + +.. sourcecode:: + user_query = SELECT '%{home_dir}/%%d/%%n' AS home, %mailboxes_owner_uid as uid, %mailboxes_owner_gid as gid, '*:bytes=' || mb.quota || 'M' AS quota_rule FROM admin_mailbox mb INNER JOIN admin_domain dom ON mb.domain_id=dom.id INNER JOIN core_user u ON u.id=mb.user_id WHERE mb.is_send_only AND mb.address='%%n' AND dom.name='%%d' + + +You need to add ``proxy:pgsql:/etc/postfix/sql-send-only.cf`` to ``smtpd_recipient_restrictions`` in ``/etc/postfix/main.cf``: + +.. sourcecode:: + smtpd_recipient_restrictions = + ... + check_recipient_access + proxy:pgsql:/etc/postfix/sql-send-only.cf + ... + + +If you use ``MySQL``: +Change ``password_query`` in ``/etc/dovecot/dovecot-sql-master.conf.ext``: + +.. sourcecode:: + user_query = SELECT '%{home_dir}/%%d/%%n' AS home, %mailboxes_owner_uid as uid, %mailboxes_owner_gid as gid, CONCAT('*:bytes=', mb.quota, 'M') AS quota_rule FROM admin_mailbox mb INNER JOIN admin_domain dom ON mb.domain_id=dom.id INNER JOIN core_user u ON u.id=mb.user_id WHERE mb.is_send_only=1 AND mb.address='%%n' AND dom.name='%%d' + +You need to add ``proxy:mysql:/etc/postfix/sql-send-only.cf`` to ``smtpd_recipient_restrictions`` in ``/etc/postfix/main.cf``: + +.. sourcecode:: + smtpd_recipient_restrictions = + ... + check_recipient_access + proxy:pgsql:/etc/postfix/sql-send-only.cf + ... + 2.1.0 ===== diff --git a/modoboa/admin/handlers.py b/modoboa/admin/handlers.py index 78ac894e9..d88648bf1 100644 --- a/modoboa/admin/handlers.py +++ b/modoboa/admin/handlers.py @@ -159,7 +159,8 @@ def register_postfix_maps(sender, **kwargs): return [ postfix_maps.DomainsMap, postfix_maps.DomainsAliasesMap, postfix_maps.AliasesMap, postfix_maps.MaintainMap, - postfix_maps.SenderLoginMap + postfix_maps.SenderLoginMap, + postfix_maps.SendOnlyAccountMap ] diff --git a/modoboa/admin/models/mailbox.py b/modoboa/admin/models/mailbox.py index 25075b03e..fd8d4bdc9 100644 --- a/modoboa/admin/models/mailbox.py +++ b/modoboa/admin/models/mailbox.py @@ -103,6 +103,8 @@ class Mailbox(mixins.MessageLimitMixin, AdminObject): domain = models.ForeignKey(Domain, on_delete=models.CASCADE) user = models.OneToOneField(User, on_delete=models.CASCADE) + is_send_only = models.BooleanField(default=False) + objects = MailboxManager() class Meta: diff --git a/modoboa/admin/postfix_maps.py b/modoboa/admin/postfix_maps.py index d7c1eda64..6b7131a35 100644 --- a/modoboa/admin/postfix_maps.py +++ b/modoboa/admin/postfix_maps.py @@ -94,6 +94,32 @@ class MaintainMap(object): ) +class SendOnlyAccountMap(object): + + filename = "sql-send-only.cf" + mysql = ( + "SELECT '550 Requested mail action not taken: mailbox disabled' " + "FROM admin_mailbox mb INNER JOIN admin_domain dom " + "ON mb.domain_id=dom.id " + "WHERE mb.is_send_only=1 AND dom.name='%d' AND mb.address='%u' " + "LIMIT 1" + ) + postgres = ( + "SELECT '550 Requested mail action not taken: mailbox disabled' " + "FROM admin_mailbox mb INNER JOIN admin_domain dom " + "ON mb.domain_id=dom.id " + "WHERE mb.is_send_only AND dom.name='%d' AND mb.address='%u' " + "LIMIT 1" + ) + sqlite = ( + "SELECT '550 Requested mail action not taken: mailbox disabled' " + "FROM admin_mailbox mb INNER JOIN admin_domain dom " + "ON mb.domain_id=dom.id " + "WHERE mb.is_send_only=1 AND dom.name='%d' AND mb.address='%u' " + "LIMIT 1" + ) + + class SenderLoginMap(object): """Map file to list authorized sender addresses for a given account: * Its mailbox