git subrepo commit (merge) mailcow/src/mailcow-dockerized
subrepo: subdir: "mailcow/src/mailcow-dockerized"
merged: "c7b1dc37"
upstream: origin: "https://github.com/mailcow/mailcow-dockerized.git"
branch: "master"
commit: "a366494c"
git-subrepo: version: "0.4.6"
origin: "???"
commit: "???"
Change-Id: Id574ecd4e02e3c4fbf8a1efd49be11c0b6d19a3f
diff --git a/mailcow/src/mailcow-dockerized/data/conf/dovecot/dovecot.conf b/mailcow/src/mailcow-dockerized/data/conf/dovecot/dovecot.conf
index b7aca75..159e39f 100644
--- a/mailcow/src/mailcow-dockerized/data/conf/dovecot/dovecot.conf
+++ b/mailcow/src/mailcow-dockerized/data/conf/dovecot/dovecot.conf
@@ -24,6 +24,11 @@
mail_attachment_fs = crypt:set_prefix=mail_crypt_global:posix:
mail_attachment_dir = /var/attachments
mail_attachment_min_size = 128k
+# Significantly speeds up very large mailboxes, but is only safe to enable if
+# you do not manually modify the files in the `cur` directories in
+# mailcowdockerized_vmail-vol-1.
+# https://docs.mailcow.email/manual-guides/Dovecot/u_e-dovecot-performance/
+maildir_very_dirty_syncs = yes
# Dovecot 2.2
#ssl_protocols = !SSLv3
diff --git a/mailcow/src/mailcow-dockerized/data/conf/nginx/includes/site-defaults.conf b/mailcow/src/mailcow-dockerized/data/conf/nginx/includes/site-defaults.conf
index ef2c4fb..1d03e93 100644
--- a/mailcow/src/mailcow-dockerized/data/conf/nginx/includes/site-defaults.conf
+++ b/mailcow/src/mailcow-dockerized/data/conf/nginx/includes/site-defaults.conf
@@ -114,7 +114,7 @@
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_redirect off;
- error_page 403 /_rspamderror.php;
+ error_page 401 /_rspamderror.php;
}
proxy_pass http://rspamd:11334/;
proxy_set_header Host $http_host;
diff --git a/mailcow/src/mailcow-dockerized/data/conf/nginx/site.conf b/mailcow/src/mailcow-dockerized/data/conf/nginx/site.conf
index 1b46d2b..fb40de8 100644
--- a/mailcow/src/mailcow-dockerized/data/conf/nginx/site.conf
+++ b/mailcow/src/mailcow-dockerized/data/conf/nginx/site.conf
@@ -1,5 +1,6 @@
proxy_cache_path /tmp levels=1:2 keys_zone=sogo:10m inactive=24h max_size=1g;
-server_names_hash_bucket_size 64;
+server_names_hash_max_size 512;
+server_names_hash_bucket_size 128;
map $http_x_forwarded_proto $client_req_scheme {
default $scheme;
diff --git a/mailcow/src/mailcow-dockerized/data/conf/nginx/templates/listen_ssl.template b/mailcow/src/mailcow-dockerized/data/conf/nginx/templates/listen_ssl.template
index 93ec80c..40c402d 100644
--- a/mailcow/src/mailcow-dockerized/data/conf/nginx/templates/listen_ssl.template
+++ b/mailcow/src/mailcow-dockerized/data/conf/nginx/templates/listen_ssl.template
@@ -1,2 +1,3 @@
-listen ${HTTPS_PORT} ssl http2;
-listen [::]:${HTTPS_PORT} ssl http2;
+listen ${HTTPS_PORT} ssl;
+listen [::]:${HTTPS_PORT} ssl;
+http2 on;
diff --git a/mailcow/src/mailcow-dockerized/data/conf/postfix/main.cf b/mailcow/src/mailcow-dockerized/data/conf/postfix/main.cf
index 02539c0..bb68e39 100644
--- a/mailcow/src/mailcow-dockerized/data/conf/postfix/main.cf
+++ b/mailcow/src/mailcow-dockerized/data/conf/postfix/main.cf
@@ -27,7 +27,7 @@
maximal_queue_lifetime = 5d
delay_warning_time = 4h
message_size_limit = 104857600
-milter_default_action = accept
+milter_default_action = tempfail
milter_protocol = 6
minimal_backoff_time = 300s
plaintext_reject_code = 550
@@ -40,34 +40,6 @@
postscreen_cache_cleanup_interval = 24h
postscreen_cache_map = proxy:btree:$data_directory/postscreen_cache
postscreen_dnsbl_action = enforce
-postscreen_dnsbl_sites = wl.mailspike.net=127.0.0.[18;19;20]*-2
- hostkarma.junkemailfilter.com=127.0.0.1*-2
- list.dnswl.org=127.0.[0..255].0*-2
- list.dnswl.org=127.0.[0..255].1*-4
- list.dnswl.org=127.0.[0..255].2*-6
- list.dnswl.org=127.0.[0..255].3*-8
- ix.dnsbl.manitu.net*2
- bl.spamcop.net*2
- bl.suomispam.net*2
- hostkarma.junkemailfilter.com=127.0.0.2*3
- hostkarma.junkemailfilter.com=127.0.0.4*2
- hostkarma.junkemailfilter.com=127.0.1.2*1
- backscatter.spameatingmonkey.net*2
- bl.ipv6.spameatingmonkey.net*2
- bl.spameatingmonkey.net*2
- b.barracudacentral.org=127.0.0.2*7
- bl.mailspike.net=127.0.0.2*5
- bl.mailspike.net=127.0.0.[10;11;12]*4
- dnsbl.sorbs.net=127.0.0.10*8
- dnsbl.sorbs.net=127.0.0.5*6
- dnsbl.sorbs.net=127.0.0.7*3
- dnsbl.sorbs.net=127.0.0.8*2
- dnsbl.sorbs.net=127.0.0.6*2
- dnsbl.sorbs.net=127.0.0.9*2
- zen.spamhaus.org=127.0.0.[10;11]*8
- zen.spamhaus.org=127.0.0.[4..7]*6
- zen.spamhaus.org=127.0.0.3*4
- zen.spamhaus.org=127.0.0.2*3
postscreen_dnsbl_threshold = 6
postscreen_dnsbl_ttl = 5m
postscreen_greet_action = enforce
@@ -197,7 +169,6 @@
parent_domain_matches_subdomains = debug_peer_list,fast_flush_domains,mynetworks,qmqpd_authorized_clients
# DO NOT EDIT ANYTHING BELOW #
-# User overrides #
-
+# Overrides #
myhostname = mail.benkard.de
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 172.22.1.0/24 [fe80::]/10 [fc00::]/7
diff --git a/mailcow/src/mailcow-dockerized/data/conf/postfix/postscreen_access.cidr b/mailcow/src/mailcow-dockerized/data/conf/postfix/postscreen_access.cidr
index 5509433..43cfb20 100644
--- a/mailcow/src/mailcow-dockerized/data/conf/postfix/postscreen_access.cidr
+++ b/mailcow/src/mailcow-dockerized/data/conf/postfix/postscreen_access.cidr
@@ -1,15 +1,20 @@
-# Whitelist generated by Postwhite v3.4 on Mon 21 Mar 2022 06:50:26 PM CET
+# Whitelist generated by Postwhite v3.4 on Sun Oct 1 00:14:59 UTC 2023
# https://github.com/stevejenkins/postwhite/
-# 1898 total rules
+# 2019 total rules
2a00:1450:4000::/36 permit
2a01:111:f400::/48 permit
-2a01:111:f403::/48 permit
-2a01:4180:4050:0400::/64 permit
-2a01:4180:4050:0800::/64 permit
-2a01:4180:4051:0400::/64 permit
+2a01:111:f403:8000::/50 permit
+2a01:111:f403::/49 permit
+2a01:111:f403:c000::/51 permit
+2a01:111:f403:f000::/52 permit
2a01:4180:4051:0800::/64 permit
2a02:a60:0:5::/64 permit
2c0f:fb50:4000::/36 permit
+2.207.151.53 permit
+3.14.230.16 permit
+3.70.123.177 permit
+3.129.120.190 permit
+3.210.190.0/24 permit
8.20.114.31 permit
8.25.194.0/23 permit
8.25.196.0/23 permit
@@ -19,41 +24,55 @@
13.70.32.43 permit
13.72.50.45 permit
13.74.143.28 permit
-13.77.161.179 permit
13.78.233.182 permit
13.92.31.129 permit
13.110.208.0/21 permit
+13.110.209.0/24 permit
13.110.216.0/22 permit
13.110.224.0/20 permit
13.111.0.0/16 permit
-17.41.0.0/16 permit
+15.200.21.50 permit
+15.200.44.248 permit
+15.200.201.185 permit
+17.57.155.0/24 permit
+17.57.156.0/24 permit
17.57.155.0/24 permit
17.57.156.0/24 permit
17.58.0.0/16 permit
-17.110.0.0/15 permit
-17.142.0.0/15 permit
-17.162.0.0/15 permit
-17.164.0.0/16 permit
-17.171.37.0/24 permit
-17.172.0.0/16 permit
-17.179.168.0/23 permit
+18.156.89.250 permit
+18.157.243.190 permit
18.194.95.56 permit
18.198.96.88 permit
20.47.149.138 permit
-20.48.0.0/12 permit
+18.216.232.154 permit
+18.234.1.244 permit
+18.236.40.242 permit
+20.51.6.32/30 permit
20.52.52.2 permit
20.52.128.133 permit
+20.59.80.4/30 permit
20.63.210.192/28 permit
-20.64.0.0/10 permit
+20.69.8.108/30 permit
+20.70.246.20 permit
+20.76.201.171 permit
+20.83.222.104/30 permit
+20.88.157.184/30 permit
20.94.180.64/28 permit
+20.97.34.220/30 permit
+20.98.148.156/30 permit
+20.98.194.68/30 permit
+20.105.209.76/30 permit
+20.107.239.64/30 permit
+20.112.250.133 permit
+20.118.139.208/30 permit
20.185.213.160/27 permit
20.185.213.224/27 permit
20.185.214.0/27 permit
20.185.214.2 permit
20.185.214.32/27 permit
20.185.214.64/27 permit
-20.192.0.0/10 permit
-23.100.85.1 permit
+20.231.239.246 permit
+20.236.44.162 permit
23.103.224.0/19 permit
23.249.208.0/20 permit
23.251.224.0/19 permit
@@ -78,45 +97,34 @@
27.123.206.56/29 permit
27.123.206.76/30 permit
27.123.206.80/28 permit
-34.194.25.167 permit
-34.194.144.120 permit
+31.25.48.222 permit
+34.195.217.107 permit
+34.202.239.6 permit
34.212.163.75 permit
+34.215.104.144 permit
34.225.212.172 permit
34.247.168.44 permit
+35.161.32.253 permit
+35.167.93.243 permit
35.176.132.251 permit
35.190.247.0/24 permit
35.191.0.0/16 permit
-37.188.97.188 permit
37.218.248.47 permit
37.218.249.47 permit
37.218.251.62 permit
39.156.163.64/29 permit
40.71.187.0/24 permit
-40.76.4.15 permit
40.77.102.222 permit
40.92.0.0/15 permit
-40.97.116.82 permit
-40.97.128.194 permit
-40.97.148.226 permit
-40.97.153.146 permit
-40.97.156.114 permit
-40.97.160.2 permit
-40.97.161.50 permit
-40.97.164.146 permit
+40.92.0.0/16 permit
40.107.0.0/16 permit
40.112.65.63 permit
-40.112.72.205 permit
-40.113.200.201 permit
40.117.80.0/24 permit
-40.121.71.46 permit
-41.74.192.0/22 permit
-41.74.196.0/22 permit
-41.74.200.0/23 permit
-41.74.204.0/23 permit
-41.74.206.0/24 permit
-42.159.163.81 permit
-42.159.163.82 permit
-42.159.163.83 permit
+43.228.184.0/22 permit
+44.206.138.57 permit
+44.209.42.157 permit
+44.236.56.93 permit
+44.238.220.251 permit
43.228.184.0/22 permit
46.226.48.0/21 permit
46.228.36.37 permit
@@ -167,6 +175,8 @@
46.243.88.175 permit
46.243.88.176 permit
46.243.88.177 permit
+46.243.95.179 permit
+46.243.95.180 permit
50.18.45.249 permit
50.18.121.236 permit
50.18.121.248 permit
@@ -178,31 +188,41 @@
50.31.32.0/19 permit
50.31.156.96/27 permit
50.31.205.0/24 permit
-51.4.71.62 permit
-51.4.72.0/24 permit
+51.137.58.21 permit
+51.140.75.55 permit
+51.144.100.179 permit
51.4.80.0/27 permit
51.5.72.0/24 permit
51.5.80.0/27 permit
51.137.58.21 permit
51.140.75.55 permit
51.144.100.179 permit
-51.163.158.0/24 permit
-51.163.159.21 permit
52.5.230.59 permit
52.27.5.72 permit
52.27.28.47 permit
-52.33.191.91 permit
+52.28.63.81 permit
52.36.138.31 permit
52.37.142.146 permit
-52.38.191.253 permit
-52.41.64.145 permit
+52.58.216.183 permit
+52.59.143.3 permit
52.60.41.5 permit
52.60.115.116 permit
+52.61.91.9 permit
+52.71.0.205 permit
52.82.172.0/22 permit
52.94.124.0/28 permit
52.95.48.152/29 permit
52.95.49.88/29 permit
+52.96.91.34 permit
+52.96.111.82 permit
+52.96.172.98 permit
+52.96.214.50 permit
+52.96.222.194 permit
+52.96.222.226 permit
+52.96.223.2 permit
+52.96.229.242 permit
52.100.0.0/14 permit
+52.103.0.0/17 permit
52.119.213.144/28 permit
52.160.39.140 permit
52.165.175.144 permit
@@ -214,23 +234,24 @@
52.222.73.83 permit
52.222.73.120 permit
52.222.75.85 permit
+52.222.89.228 permit
52.234.172.96/28 permit
52.236.28.240/28 permit
-52.237.141.173 permit
52.244.206.214 permit
52.247.53.144 permit
52.250.107.196 permit
52.250.126.174 permit
52.251.55.143 permit
54.90.148.255 permit
-54.156.255.69 permit
54.172.97.247 permit
54.186.193.102 permit
-54.191.223.5 permit
+54.191.223.56 permit
54.194.61.95 permit
54.195.113.45 permit
+54.213.20.246 permit
54.214.39.184 permit
54.216.77.168 permit
+54.221.227.204 permit
54.240.0.0/18 permit
54.240.64.0/19 permit
54.240.96.0/19 permit
@@ -238,7 +259,9 @@
54.244.54.130 permit
54.244.242.0/24 permit
54.246.232.180 permit
+54.255.61.23 permit
62.13.128.0/24 permit
+62.13.128.150 permit
62.13.129.128/25 permit
62.13.136.0/22 permit
62.13.140.0/22 permit
@@ -247,8 +270,10 @@
62.13.150.0/23 permit
62.13.152.0/23 permit
62.17.146.128/26 permit
-62.140.7.0/24 permit
-62.140.10.21 permit
+62.179.121.0/24 permit
+62.201.172.0/27 permit
+62.201.172.32/27 permit
+62.253.227.114 permit
63.32.13.159 permit
63.80.14.0/23 permit
63.128.21.0/24 permit
@@ -256,20 +281,21 @@
63.143.59.128/25 permit
64.18.0.0/20 permit
64.20.241.45 permit
-64.34.47.128/27 permit
-64.34.57.192/26 permit
+64.69.212.0/24 permit
+64.71.149.160/28 permit
64.71.149.160/28 permit
64.79.155.0/24 permit
64.89.44.85 permit
+64.79.155.193 permit
+64.79.155.205 permit
+64.79.155.206 permit
+64.89.44.85 permit
64.89.45.80 permit
64.89.45.194 permit
64.89.45.196 permit
-64.95.144.196 permit
64.127.115.252 permit
64.132.88.0/23 permit
64.132.92.0/24 permit
-64.135.77.0/24 permit
-64.135.83.0/24 permit
64.147.123.17 permit
64.147.123.18 permit
64.147.123.19 permit
@@ -290,6 +316,7 @@
64.207.219.71 permit
64.207.219.72 permit
64.207.219.73 permit
+64.207.219.78 permit
64.207.219.77 permit
64.207.219.78 permit
64.207.219.79 permit
@@ -300,9 +327,6 @@
64.207.219.142 permit
64.207.219.143 permit
64.233.160.0/19 permit
-65.38.115.76 permit
-65.38.115.84 permit
-65.39.215.0/24 permit
65.52.80.137 permit
65.54.51.64/26 permit
65.54.61.64/26 permit
@@ -342,6 +366,7 @@
66.111.4.225 permit
66.111.4.229 permit
66.111.4.230 permit
+66.119.150.192/26 permit
66.162.193.226/31 permit
66.163.184.0/21 permit
66.163.184.0/24 permit
@@ -373,7 +398,7 @@
66.196.81.234 permit
66.211.168.230/31 permit
66.211.170.86/31 permit
-66.211.170.88/30 permit
+66.211.170.88/29 permit
66.218.74.64/30 permit
66.218.74.68/31 permit
66.218.75.112/30 permit
@@ -445,6 +470,7 @@
68.142.230.72/30 permit
68.142.230.76/31 permit
68.142.230.78 permit
+68.232.140.138 permit
68.232.192.0/20 permit
69.63.178.128/25 permit
69.63.181.0/24 permit
@@ -452,6 +478,10 @@
69.65.42.195 permit
69.65.49.192/29 permit
69.72.32.0/20 permit
+69.72.40.93 permit
+69.72.40.94/31 permit
+69.72.40.96/30 permit
+69.72.47.205 permit
69.147.84.227 permit
69.162.98.0/24 permit
69.169.224.0/20 permit
@@ -460,7 +490,6 @@
70.37.151.128/25 permit
70.42.149.0/24 permit
70.42.149.35 permit
-72.3.185.0/24 permit
72.14.192.0/18 permit
72.21.192.0/19 permit
72.21.217.142 permit
@@ -522,15 +551,11 @@
72.30.239.228/31 permit
72.30.239.244/30 permit
72.30.239.248/31 permit
-72.32.154.0/24 permit
-72.32.217.0/24 permit
-72.32.243.0/24 permit
72.34.168.76 permit
72.34.168.80 permit
72.34.168.85 permit
72.34.168.86 permit
72.52.72.32/28 permit
-72.52.72.36 permit
74.6.128.0/21 permit
74.6.128.0/24 permit
74.6.129.0/24 permit
@@ -559,7 +584,7 @@
74.125.0.0/16 permit
74.202.227.40 permit
74.209.250.0/24 permit
-74.209.250.12 permit
+76.223.128.0/19 permit
76.223.176.0/20 permit
77.238.176.0/22 permit
77.238.176.0/24 permit
@@ -582,8 +607,11 @@
77.238.189.142 permit
77.238.189.146/31 permit
77.238.189.148/30 permit
+81.7.169.128/25 permit
81.223.46.0/27 permit
-84.16.77.1 permit
+82.165.229.31 permit
+82.165.230.21 permit
+84.116.36.0/24 permit
85.158.136.0/21 permit
86.61.88.25 permit
87.198.219.130 permit
@@ -627,8 +655,6 @@
87.252.219.254 permit
87.253.232.0/21 permit
89.22.108.0/24 permit
-91.220.42.0/24 permit
-94.236.119.0/26 permit
94.245.112.0/27 permit
94.245.112.10/31 permit
95.131.104.0/21 permit
@@ -638,6 +664,7 @@
96.43.148.64/28 permit
96.43.148.64/31 permit
96.43.151.64/28 permit
+98.97.248.0/21 permit
98.136.44.181 permit
98.136.44.182/31 permit
98.136.44.184 permit
@@ -1142,22 +1169,20 @@
98.139.245.212/31 permit
99.78.197.208/28 permit
103.2.140.0/22 permit
-103.9.8.121 permit
-103.9.8.122 permit
-103.9.8.123 permit
103.9.96.0/22 permit
-103.13.69.0/24 permit
103.47.204.0/22 permit
-103.96.21.0/24 permit
-103.96.23.0/24 permit
+103.47.204.0/22 permit
103.151.192.0/23 permit
-103.237.104.0/22 permit
+103.168.172.128/27 permit
104.43.243.237 permit
+104.44.112.128/25 permit
104.47.0.0/17 permit
+104.47.20.0/23 permit
+104.47.75.0/24 permit
+104.47.108.0/23 permit
104.130.96.0/28 permit
104.130.122.0/23 permit
104.214.25.77 permit
-104.215.148.63 permit
104.215.186.3 permit
104.245.209.192/26 permit
106.10.144.64/27 permit
@@ -1320,9 +1345,9 @@
117.120.16.0/21 permit
119.42.242.52/31 permit
119.42.242.156 permit
+121.244.91.48 permit
+122.15.156.182 permit
123.126.78.64/29 permit
-124.47.150.0/24 permit
-124.47.189.0/24 permit
124.108.96.0/24 permit
124.108.96.24/31 permit
124.108.96.28/31 permit
@@ -1335,20 +1360,37 @@
128.127.70.0/26 permit
128.245.0.0/20 permit
128.245.64.0/20 permit
+128.245.176.0/20 permit
+128.245.242.0/24 permit
+128.245.242.16 permit
+128.245.242.17 permit
+128.245.242.18 permit
+128.245.243.0/24 permit
+128.245.244.0/24 permit
+128.245.245.0/24 permit
+128.245.246.0/24 permit
+128.245.247.0/24 permit
129.41.77.70 permit
129.41.169.249 permit
+129.80.5.164 permit
+129.80.67.121 permit
+129.145.74.12 permit
+129.146.88.28 permit
+129.146.147.105 permit
129.146.236.58 permit
+129.151.67.221 permit
+129.153.62.216 permit
+129.153.104.71 permit
+129.153.168.146 permit
+129.153.190.200 permit
129.153.194.228 permit
129.159.87.137 permit
+129.213.195.191 permit
130.61.9.72 permit
+130.162.39.83 permit
130.211.0.0/22 permit
-130.248.172.0/24 permit
-130.248.173.0/24 permit
-131.107.0.0/16 permit
131.253.30.0/24 permit
131.253.121.0/26 permit
-131.253.121.20 permit
-131.253.121.52 permit
132.145.13.209 permit
132.226.26.225 permit
132.226.49.32 permit
@@ -1358,9 +1400,13 @@
134.170.141.64/26 permit
134.170.143.0/24 permit
134.170.174.0/24 permit
-135.84.80.192/26 permit
+135.84.80.0/24 permit
+135.84.81.0/24 permit
135.84.82.0/24 permit
+135.84.83.0/24 permit
135.84.216.0/22 permit
+136.143.160.0/24 permit
+136.143.161.0/24 permit
136.143.182.0/23 permit
136.143.184.0/24 permit
136.143.188.0/24 permit
@@ -1369,34 +1415,50 @@
136.147.176.0/20 permit
136.147.176.0/24 permit
136.147.182.0/24 permit
+136.179.50.206 permit
138.91.172.26 permit
139.60.152.0/22 permit
-139.178.64.159 permit
-139.178.64.195 permit
+139.138.35.44 permit
+139.138.46.121 permit
+139.138.46.176 permit
+139.138.46.219 permit
+139.138.57.55 permit
+139.138.58.119 permit
+141.148.159.229 permit
141.193.32.0/23 permit
143.55.224.0/21 permit
143.55.232.0/22 permit
143.55.236.0/22 permit
+143.244.80.0/20 permit
+144.24.6.140 permit
+144.34.8.247 permit
+144.34.9.247 permit
+144.34.32.247 permit
+144.34.33.247 permit
144.178.36.0/24 permit
144.178.38.0/24 permit
+145.253.228.160/29 permit
+145.253.239.128/29 permit
146.20.112.0/26 permit
146.20.113.0/24 permit
146.20.191.0/24 permit
146.20.215.0/24 permit
-146.101.78.0/24 permit
-147.75.65.173 permit
-147.75.65.174 permit
-147.75.98.190 permit
+146.20.215.182 permit
147.160.158.0/24 permit
147.243.1.47 permit
147.243.1.48 permit
147.243.1.153 permit
147.243.128.24 permit
147.243.128.26 permit
-148.105.0.14 permit
+148.105.0.0/16 permit
148.105.8.0/21 permit
149.72.0.0/16 permit
+149.72.248.236 permit
+149.97.173.180 permit
+150.230.98.160 permit
152.67.105.195 permit
+152.69.200.236 permit
+155.248.208.51 permit
157.55.0.192/26 permit
157.55.1.128/26 permit
157.55.2.0/25 permit
@@ -1412,37 +1474,48 @@
157.56.232.0/21 permit
157.56.240.0/20 permit
157.56.248.0/21 permit
+157.58.30.128/25 permit
157.58.196.96/29 permit
157.58.249.3 permit
157.151.208.65 permit
157.255.1.64/29 permit
+158.101.211.207 permit
+158.120.80.0/21 permit
+159.92.159.0/24 permit
159.92.157.0/24 permit
+159.92.157.16 permit
+159.92.157.17 permit
+159.92.157.18 permit
159.92.158.0/24 permit
159.92.159.0/24 permit
159.92.160.0/24 permit
159.92.161.0/24 permit
159.92.162.0/24 permit
+159.112.240.0/20 permit
+159.112.242.162 permit
159.135.132.128/25 permit
159.135.140.80/29 permit
159.135.224.0/20 permit
+159.135.228.10 permit
159.183.0.0/16 permit
+160.1.62.192 permit
161.38.192.0/20 permit
161.38.204.0/22 permit
161.71.32.0/19 permit
161.71.64.0/20 permit
-162.208.119.181 permit
162.247.216.0/22 permit
163.47.180.0/23 permit
163.114.130.16 permit
163.114.132.120 permit
+165.173.128.0/24 permit
166.78.68.0/22 permit
166.78.68.221 permit
-166.78.69.146 permit
166.78.69.169 permit
166.78.69.170 permit
166.78.71.131 permit
167.89.0.0/17 permit
167.89.46.159 permit
+167.89.54.103 permit
167.89.64.9 permit
167.89.65.0 permit
167.89.65.53 permit
@@ -1457,10 +1530,16 @@
167.216.129.210 permit
167.216.131.180 permit
167.220.67.232/29 permit
-167.220.67.238 permit
168.138.5.36 permit
+168.138.73.51 permit
168.245.0.0/17 permit
+168.245.12.252 permit
+168.245.46.9 permit
+168.245.127.231 permit
+169.148.129.0/24 permit
+169.148.131.0/24 permit
170.10.68.0/22 permit
+170.10.128.0/24 permit
170.10.129.0/24 permit
170.10.133.0/24 permit
172.217.0.0/19 permit
@@ -1475,10 +1554,8 @@
173.194.0.0/16 permit
173.203.79.182 permit
173.203.81.39 permit
-173.224.160.128/25 permit
-173.224.160.188 permit
173.224.161.128/25 permit
-173.228.155.0/24 permit
+173.224.165.0/26 permit
174.36.84.8/29 permit
174.36.84.16/29 permit
174.36.84.32/29 permit
@@ -1491,20 +1568,17 @@
174.36.114.152/29 permit
174.37.67.28/30 permit
174.129.203.189 permit
+175.41.215.51 permit
176.32.105.0/24 permit
176.32.127.0/24 permit
178.236.10.128/26 permit
-180.189.28.0/24 permit
182.50.76.0/22 permit
182.50.78.64/28 permit
183.240.219.64/29 permit
+185.4.120.0/23 permit
185.12.80.0/22 permit
-185.28.196.0/22 permit
185.58.84.93 permit
-185.58.85.0/24 permit
185.58.86.0/24 permit
-185.72.128.75 permit
-185.72.128.76 permit
185.72.128.80 permit
185.80.93.204 permit
185.80.93.227 permit
@@ -1512,6 +1586,9 @@
185.189.236.0/22 permit
185.211.120.0/22 permit
185.250.236.0/22 permit
+185.250.239.148 permit
+185.250.239.168 permit
+185.250.239.190 permit
188.125.68.132 permit
188.125.68.152/31 permit
188.125.68.156 permit
@@ -1563,7 +1640,7 @@
188.125.85.238 permit
188.172.128.0/20 permit
192.0.64.0/18 permit
-192.28.128.0/18 permit
+192.18.139.154 permit
192.30.252.0/22 permit
192.64.236.0/24 permit
192.64.237.0/24 permit
@@ -1579,17 +1656,18 @@
192.254.113.10 permit
192.254.113.101 permit
192.254.114.176 permit
-192.254.118.63 permit
-193.7.206.0/25 permit
193.7.207.0/25 permit
193.109.254.0/23 permit
193.122.128.100 permit
+193.123.56.63 permit
+194.19.134.0/25 permit
194.64.234.129 permit
194.104.109.0/24 permit
194.104.111.0/24 permit
194.106.220.0/23 permit
194.154.193.192/27 permit
-195.130.217.0/24 permit
+195.4.92.0/23 permit
+195.234.109.226 permit
195.234.109.226 permit
195.245.230.0/23 permit
198.2.128.0/18 permit
@@ -1605,19 +1683,24 @@
198.37.144.0/20 permit
198.37.152.186 permit
198.61.254.0/23 permit
+198.61.254.21 permit
198.61.254.231 permit
198.74.56.28 permit
198.178.234.57 permit
+198.244.48.0/20 permit
+198.244.60.0/22 permit
198.245.80.0/20 permit
198.245.81.0/24 permit
199.15.176.173 permit
-199.15.212.0/22 permit
199.15.213.187 permit
199.15.226.37 permit
199.16.156.0/22 permit
199.33.145.1 permit
199.33.145.32 permit
199.59.148.0/22 permit
+199.67.84.0/24 permit
+199.67.86.0/24 permit
+199.67.88.0/24 permit
199.101.161.130 permit
199.101.162.0/25 permit
199.122.120.0/21 permit
@@ -1676,7 +1759,7 @@
204.92.114.204/31 permit
204.141.32.0/23 permit
204.141.42.0/23 permit
-204.153.121.0/24 permit
+204.220.160.0/20 permit
204.232.168.0/24 permit
205.139.110.0/24 permit
205.201.128.0/20 permit
@@ -1685,9 +1768,10 @@
205.201.136.0/23 permit
205.201.139.0/24 permit
205.207.104.0/22 permit
-205.207.104.108 permit
205.220.167.17 permit
+205.220.167.98 permit
205.220.179.17 permit
+205.220.179.98 permit
205.251.233.32 permit
205.251.233.36 permit
206.25.247.143 permit
@@ -1715,7 +1799,6 @@
207.67.98.192/27 permit
207.68.176.0/26 permit
207.68.176.96/27 permit
-207.82.80.0/24 permit
207.126.144.0/20 permit
207.171.160.0/19 permit
207.211.30.64/26 permit
@@ -1723,6 +1806,7 @@
207.211.31.0/25 permit
207.211.41.113 permit
207.218.90.0/24 permit
+207.218.90.122 permit
207.250.68.0/24 permit
208.40.232.70 permit
208.43.21.28/30 permit
@@ -1760,6 +1844,7 @@
208.72.249.240/29 permit
208.74.204.9 permit
208.75.120.0/22 permit
+208.75.121.246 permit
208.75.122.246 permit
208.82.237.96/29 permit
208.82.237.104/31 permit
@@ -1773,13 +1858,12 @@
209.46.117.168 permit
209.46.117.179 permit
209.61.151.0/24 permit
+209.61.151.236 permit
+209.61.151.249 permit
+209.61.151.251 permit
209.67.98.46 permit
209.67.98.59 permit
209.85.128.0/17 permit
-212.4.136.0/26 permit
-212.25.240.80 permit
-212.25.240.83 permit
-212.25.240.84/31 permit
212.25.240.88 permit
212.82.96.0/24 permit
212.82.96.32/27 permit
@@ -1823,6 +1907,7 @@
212.123.28.40 permit
213.167.75.0/25 permit
213.167.81.0/25 permit
+213.46.255.0/24 permit
213.199.128.139 permit
213.199.128.145 permit
213.199.138.181 permit
@@ -1861,6 +1946,7 @@
216.46.168.0/24 permit
216.58.192.0/19 permit
216.66.217.240/29 permit
+216.71.138.33 permit
216.74.162.13 permit
216.74.162.14 permit
216.82.240.0/20 permit
@@ -1874,6 +1960,7 @@
216.136.162.65 permit
216.136.162.120/29 permit
216.136.168.80/28 permit
+216.145.221.0/24 permit
216.198.0.0/18 permit
216.203.30.55 permit
216.203.33.178/31 permit
@@ -1881,22 +1968,30 @@
216.239.32.0/19 permit
217.77.141.52 permit
217.77.141.59 permit
+217.175.194.0/24 permit
222.73.195.64/29 permit
223.165.113.0/24 permit
223.165.115.0/24 permit
223.165.118.0/23 permit
223.165.120.0/23 permit
+2001:0868:0100:0600::/64 permit
2001:4860:4000::/36 permit
+2001:748:100:40::2:0/112 permit
2404:6800:4000::/36 permit
+2603:1010:3:3::5b permit
+2603:1020:201:10::10f permit
+2603:1030:20e:3::23c permit
+2603:1030:b:3::152 permit
+2603:1030:c02:8::14 permit
2607:f8b0:4000::/36 permit
-2620:109:c003:104::215 permit
2620:109:c003:104::/64 permit
-2620:109:c006:104::215 permit
+2620:109:c003:104::215 permit
2620:109:c006:104::/64 permit
+2620:109:c006:104::215 permit
2620:109:c00d:104::/64 permit
-2620:10d:c090:450::120 permit
-2620:10d:c091:450::16 permit
-2620:119:50c0:207::215 permit
+2620:10d:c090:400::8:1 permit
+2620:10d:c091:400::8:1 permit
2620:119:50c0:207::/64 permit
+2620:119:50c0:207::215 permit
2800:3f0:4000::/36 permit
194.25.134.0/24 permit # t-online.de
diff --git a/mailcow/src/mailcow-dockerized/data/conf/rspamd/custom/bad_asn.map b/mailcow/src/mailcow-dockerized/data/conf/rspamd/custom/bad_asn.map
index 1858c55..a8d49cf 100644
--- a/mailcow/src/mailcow-dockerized/data/conf/rspamd/custom/bad_asn.map
+++ b/mailcow/src/mailcow-dockerized/data/conf/rspamd/custom/bad_asn.map
@@ -27,4 +27,5 @@
#197518 2 #Rackmarkt SL, Spain
#197695 2 #Domain names registrar REG.RU Ltd, Russia
#198068 2 #P.A.G.M. OU, Estonia
-#201942 5 #Soltia Consulting SL, Spain
\ No newline at end of file
+#201942 5 #Soltia Consulting SL, Spain
+#213373 4 #IP Connect Inc
\ No newline at end of file
diff --git a/mailcow/src/mailcow-dockerized/data/conf/rspamd/local.d/composites.conf b/mailcow/src/mailcow-dockerized/data/conf/rspamd/local.d/composites.conf
index 337a2eb..e6fa24c 100644
--- a/mailcow/src/mailcow-dockerized/data/conf/rspamd/local.d/composites.conf
+++ b/mailcow/src/mailcow-dockerized/data/conf/rspamd/local.d/composites.conf
@@ -8,7 +8,7 @@
}
# Bad policy from free mail providers
FREEMAIL_POLICY_FAILURE {
- expression = "-g+:policies & !DMARC_POLICY_ALLOW & !MAILLIST & ( FREEMAIL_ENVFROM | FREEMAIL_FROM ) & !WHITELISTED_FWD_HOST";
+ expression = "FREEMAIL_FROM & !DMARC_POLICY_ALLOW & !MAILLIST& !WHITELISTED_FWD_HOST & -g+:policies";
score = 16.0;
}
# Applies to freemail with undisclosed recipients
@@ -68,3 +68,53 @@
ENCRYPTED_CHAT {
expression = "CHAT_VERSION_HEADER & ENCRYPTED_PGP";
}
+# Remove bayes ham if fuzzy denied
+FUZZY_HAM_MISMATCH {
+ expression = "( -FUZZY_DENIED | -MAILCOW_FUZZY_DENIED | -LOCAL_FUZZY_DENIED ) & ( ^BAYES_HAM | ^NEURAL_HAM_LONG | ^NEURAL_HAM_SHORT )";
+}
+# Remove bayes spam if local fuzzy white
+FUZZY_SPAM_MISMATCH {
+ expression = "( -LOCAL_FUZZY_WHITE ) & ( ^BAYES_SPAM | ^NEURAL_SPAM_LONG | ^NEURAL_SPAM_SHORT )";
+}
+WL_FWD_HOST {
+ expression = "-WHITELISTED_FWD_HOST & (^g+:rbl | ^g+:policies | ^g+:hfilter | ^g:neural)";
+}
+ENCRYPTED_CHAT {
+ expression = "CHAT_VERSION_HEADER & ENCRYPTED_PGP";
+}
+
+CLAMD_SPAM_FOUND {
+ expression = "CLAM_SECI_SPAM & !MAILCOW_WHITE";
+ description = "Probably Spam, Securite Spam Flag set through ClamAV";
+ score = 5;
+}
+
+CLAMD_BAD_PDF {
+ expression = "CLAM_SECI_PDF & !MAILCOW_WHITE";
+ description = "Bad PDF Found, Securite bad PDF Flag set through ClamAV";
+ score = 8;
+}
+
+CLAMD_BAD_JPG {
+ expression = "CLAM_SECI_JPG & !MAILCOW_WHITE";
+ description = "Bad JPG Found, Securite bad JPG Flag set through ClamAV";
+ score = 8;
+}
+
+CLAMD_ASCII_MALWARE {
+ expression = "CLAM_SECI_ASCII & !MAILCOW_WHITE";
+ description = "ASCII malware found, Securite ASCII malware Flag set through ClamAV";
+ score = 8;
+}
+
+CLAMD_HTML_MALWARE {
+ expression = "CLAM_SECI_HTML & !MAILCOW_WHITE";
+ description = "HTML malware found, Securite HTML malware Flag set through ClamAV";
+ score = 8;
+}
+
+CLAMD_JS_MALWARE {
+ expression = "CLAM_SECI_JS & !MAILCOW_WHITE";
+ description = "JS malware found, Securite JS malware Flag set through ClamAV";
+ score = 8;
+}
\ No newline at end of file
diff --git a/mailcow/src/mailcow-dockerized/data/conf/rspamd/local.d/multimap.conf b/mailcow/src/mailcow-dockerized/data/conf/rspamd/local.d/multimap.conf
index 17ada99..888bf36 100644
--- a/mailcow/src/mailcow-dockerized/data/conf/rspamd/local.d/multimap.conf
+++ b/mailcow/src/mailcow-dockerized/data/conf/rspamd/local.d/multimap.conf
@@ -159,8 +159,8 @@
}
URLHAUS_ABUSE_CH {
- type = "url";
- filter = "full";
+ type = "selector";
+ selector = "urls";
map = "https://urlhaus.abuse.ch/downloads/text_online/";
score = 10.0;
}
@@ -175,7 +175,7 @@
type = "header";
header = "subject";
regexp = true;
- map = "http://nullnull.org/bad-subject-regex.txt";
+ map = "http://fuzzy.mailcow.email/bad-subject-regex.txt";
score = 6.0;
symbols_set = ["BAD_SUBJECT_00"];
}
diff --git a/mailcow/src/mailcow-dockerized/data/conf/rspamd/lua/rspamd.local.lua b/mailcow/src/mailcow-dockerized/data/conf/rspamd/lua/rspamd.local.lua
index 6318bd2..acc4055 100644
--- a/mailcow/src/mailcow-dockerized/data/conf/rspamd/lua/rspamd.local.lua
+++ b/mailcow/src/mailcow-dockerized/data/conf/rspamd/lua/rspamd.local.lua
@@ -221,6 +221,16 @@
local tagged_rcpt = task:get_symbol("TAGGED_RCPT")
local mailcow_domain = task:get_symbol("RCPT_MAILCOW_DOMAIN")
+ local function remove_moo_tag()
+ local moo_tag_header = task:get_header('X-Moo-Tag', false)
+ if moo_tag_header then
+ task:set_milter_reply({
+ remove_headers = {['X-Moo-Tag'] = 0},
+ })
+ end
+ return true
+ end
+
if tagged_rcpt and tagged_rcpt[1].options and mailcow_domain then
local tag = tagged_rcpt[1].options[1]
rspamd_logger.infox("found tag: %s", tag)
@@ -229,6 +239,7 @@
if action ~= 'no action' and action ~= 'greylist' then
rspamd_logger.infox("skipping tag handler for action: %s", action)
+ remove_moo_tag()
return true
end
@@ -243,6 +254,7 @@
local function tag_callback_subfolder(err, data)
if err or type(data) ~= 'string' then
rspamd_logger.infox(rspamd_config, "subfolder tag handler for rcpt %s returned invalid or empty data (\"%s\") or error (\"%s\")", body, data, err)
+ remove_moo_tag()
else
rspamd_logger.infox("Add X-Moo-Tag header")
task:set_milter_reply({
@@ -261,6 +273,7 @@
)
if not redis_ret_subfolder then
rspamd_logger.infox(rspamd_config, "cannot make request to load tag handler for rcpt")
+ remove_moo_tag()
end
else
@@ -268,7 +281,10 @@
local sbj = task:get_header('Subject')
new_sbj = '=?UTF-8?B?' .. tostring(util.encode_base64('[' .. tag .. '] ' .. sbj)) .. '?='
task:set_milter_reply({
- remove_headers = {['Subject'] = 1},
+ remove_headers = {
+ ['Subject'] = 1,
+ ['X-Moo-Tag'] = 0
+ },
add_headers = {['Subject'] = new_sbj}
})
end
@@ -284,6 +300,7 @@
)
if not redis_ret_subject then
rspamd_logger.infox(rspamd_config, "cannot make request to load tag handler for rcpt")
+ remove_moo_tag()
end
end
@@ -295,6 +312,7 @@
if #rcpt_split == 2 then
if rcpt_split[1] == 'postmaster' then
rspamd_logger.infox(rspamd_config, "not expanding postmaster alias")
+ remove_moo_tag()
else
rspamd_http.request({
task=task,
@@ -307,7 +325,8 @@
end
end
end
-
+ else
+ remove_moo_tag()
end
end,
priority = 19
@@ -340,6 +359,10 @@
if not bcc_dest then
return -- stop
end
+ -- dot stuff content before sending
+ local email_content = tostring(task:get_content())
+ email_content = string.gsub(email_content, "\r\n%.", "\r\n..")
+ -- send mail
lua_smtp.sendmail({
task = task,
host = os.getenv("IPV4_NETWORK") .. '.253',
@@ -347,8 +370,8 @@
from = task:get_from(stp)[1].addr,
recipients = bcc_dest,
helo = 'bcc',
- timeout = 10,
- }, task:get_content(), sendmail_cb)
+ timeout = 20,
+ }, email_content, sendmail_cb)
end
-- determine from
@@ -499,3 +522,146 @@
end
end
})
+
+rspamd_config:register_symbol({
+ name = 'MOO_FOOTER',
+ type = 'prefilter',
+ callback = function(task)
+ local lua_mime = require "lua_mime"
+ local lua_util = require "lua_util"
+ local rspamd_logger = require "rspamd_logger"
+ local rspamd_redis = require "rspamd_redis"
+ local ucl = require "ucl"
+ local redis_params = rspamd_parse_redis_server('footer')
+ local envfrom = task:get_from(1)
+ local uname = task:get_user()
+ if not envfrom or not uname then
+ return false
+ end
+ local uname = uname:lower()
+ local env_from_domain = envfrom[1].domain:lower() -- get smtp from domain in lower case
+
+ local function newline(task)
+ local t = task:get_newlines_type()
+
+ if t == 'cr' then
+ return '\r'
+ elseif t == 'lf' then
+ return '\n'
+ end
+
+ return '\r\n'
+ end
+ local function redis_cb_footer(err, data)
+ if err or type(data) ~= 'string' then
+ rspamd_logger.infox(rspamd_config, "domain wide footer request for user %s returned invalid or empty data (\"%s\") or error (\"%s\")", uname, data, err)
+ else
+ -- parse json string
+ local parser = ucl.parser()
+ local res,err = parser:parse_string(data)
+ if not res then
+ rspamd_logger.infox(rspamd_config, "parsing domain wide footer for user %s returned invalid or empty data (\"%s\") or error (\"%s\")", uname, data, err)
+ else
+ local footer = parser:get_object()
+
+ if footer and type(footer) == "table" and (footer.html or footer.plain) then
+ rspamd_logger.infox(rspamd_config, "found domain wide footer for user %s: html=%s, plain=%s", uname, footer.html, footer.plain)
+
+ local envfrom_mime = task:get_from(2)
+ local from_name = ""
+ if envfrom_mime and envfrom_mime[1].name then
+ from_name = envfrom_mime[1].name
+ elseif envfrom and envfrom[1].name then
+ from_name = envfrom[1].name
+ end
+
+ local replacements = {
+ auth_user = uname,
+ from_user = envfrom[1].user,
+ from_name = from_name,
+ from_addr = envfrom[1].addr,
+ from_domain = envfrom[1].domain:lower()
+ }
+ if footer.html then
+ footer.html = lua_util.jinja_template(footer.html, replacements, true)
+ end
+ if footer.plain then
+ footer.plain = lua_util.jinja_template(footer.plain, replacements, true)
+ end
+
+ -- add footer
+ local out = {}
+ local rewrite = lua_mime.add_text_footer(task, footer.html, footer.plain) or {}
+
+ local seen_cte
+ local newline_s = newline(task)
+
+ local function rewrite_ct_cb(name, hdr)
+ if rewrite.need_rewrite_ct then
+ if name:lower() == 'content-type' then
+ local nct = string.format('%s: %s/%s; charset=utf-8',
+ 'Content-Type', rewrite.new_ct.type, rewrite.new_ct.subtype)
+ out[#out + 1] = nct
+ return
+ elseif name:lower() == 'content-transfer-encoding' then
+ out[#out + 1] = string.format('%s: %s',
+ 'Content-Transfer-Encoding', 'quoted-printable')
+ seen_cte = true
+ return
+ end
+ end
+ out[#out + 1] = hdr.raw:gsub('\r?\n?$', '')
+ end
+
+ task:headers_foreach(rewrite_ct_cb, {full = true})
+
+ if not seen_cte and rewrite.need_rewrite_ct then
+ out[#out + 1] = string.format('%s: %s', 'Content-Transfer-Encoding', 'quoted-printable')
+ end
+
+ -- End of headers
+ out[#out + 1] = newline_s
+
+ if rewrite.out then
+ for _,o in ipairs(rewrite.out) do
+ out[#out + 1] = o
+ end
+ else
+ out[#out + 1] = task:get_rawbody()
+ end
+ local out_parts = {}
+ for _,o in ipairs(out) do
+ if type(o) ~= 'table' then
+ out_parts[#out_parts + 1] = o
+ out_parts[#out_parts + 1] = newline_s
+ else
+ out_parts[#out_parts + 1] = o[1]
+ if o[2] then
+ out_parts[#out_parts + 1] = newline_s
+ end
+ end
+ end
+ task:set_message(out_parts)
+ else
+ rspamd_logger.infox(rspamd_config, "domain wide footer request for user %s returned invalid or empty data (\"%s\")", uname, data)
+ end
+ end
+ end
+ end
+
+ local redis_ret_footer = rspamd_redis_make_request(task,
+ redis_params, -- connect params
+ env_from_domain, -- hash key
+ false, -- is write
+ redis_cb_footer, --callback
+ 'HGET', -- command
+ {"DOMAIN_WIDE_FOOTER", env_from_domain} -- arguments
+ )
+ if not redis_ret_footer then
+ rspamd_logger.infox(rspamd_config, "cannot make request to load footer for domain")
+ end
+
+ return true
+ end,
+ priority = 1
+})
diff --git a/mailcow/src/mailcow-dockerized/data/conf/sogo/sogo.conf b/mailcow/src/mailcow-dockerized/data/conf/sogo/sogo.conf
index 97a34e9..b424efd 100644
--- a/mailcow/src/mailcow-dockerized/data/conf/sogo/sogo.conf
+++ b/mailcow/src/mailcow-dockerized/data/conf/sogo/sogo.conf
@@ -62,7 +62,7 @@
SOGoFirstDayOfWeek = "1";
SOGoSieveFolderEncoding = "UTF-8";
- SOGoPasswordChangeEnabled = YES;
+ SOGoPasswordChangeEnabled = NO;
SOGoSentFolderName = "Sent";
SOGoMailShowSubscribedFoldersOnly = NO;
NGImap4ConnectionStringSeparator = "/";
@@ -83,6 +83,7 @@
//SoDebugBaseURL = YES;
//ImapDebugEnabled = YES;
//SOGoEASDebugEnabled = YES;
+ SOGoEASSearchInBody = YES; // Experimental. Enabled since 2023-10
//LDAPDebugEnabled = YES;
//PGDebugEnabled = YES;
//MySQL4DebugEnabled = YES;