1 package PMG
::Config
::Base
;
8 use PVE
::JSONSchema
qw(get_standard_option);
9 use PVE
::SectionConfig
;
11 use base
qw(PVE::SectionConfig);
15 type
=> { description
=> "Section type." },
17 description
=> "Secion ID.",
18 type
=> 'string', format
=> 'pve-configid',
27 sub format_section_header
{
28 my ($class, $type, $sectionId) = @_;
30 die "internal error ($type ne $sectionId)" if $type ne $sectionId;
32 return "section: $type\n";
36 sub parse_section_header
{
37 my ($class, $line) = @_;
39 if ($line =~ m/^section:\s*(\S+)\s*$/) {
41 my $errmsg = undef; # set if you want to skip whole section
42 eval { PVE
::JSONSchema
::pve_verify_configid
($section); };
44 my $config = {}; # to return additional attributes
45 return ($section, $section, $errmsg, $config);
50 package PMG
::Config
::Admin
;
55 use base
qw(PMG::Config::Base);
64 description
=> "Send daily reports.",
69 description
=> "Demo mode - do not start SMTP filter.",
74 description
=> "Administrator E-Mail address.",
75 type
=> 'string', format
=> 'email',
76 default => 'admin@domain.tld',
79 description
=> "HTTP proxy port.",
85 description
=> "HTTP proxy server address.",
89 description
=> "HTTP proxy user name.",
93 description
=> "HTTP proxy password.",
101 dailyreport
=> { optional
=> 1 },
102 demo
=> { optional
=> 1 },
103 email
=> { optional
=> 1 },
104 proxyport
=> { optional
=> 1 },
105 proxyserver
=> { optional
=> 1 },
106 proxyuser
=> { optional
=> 1 },
107 proxypassword
=> { optional
=> 1 },
111 package PMG
::Config
::Spam
;
116 use base
qw(PMG::Config::Base);
125 description
=> "This option is used to specify which languages are considered OK for incoming mail.",
127 pattern
=> '(all|([a-z][a-z])+( ([a-z][a-z])+)*)',
131 description
=> "Whether to use the naive-Bayesian-style classifier.",
136 description
=> "Use the Auto-Whitelist plugin.",
141 description
=> "Whether to use Razor2, if it is available.",
146 description
=> "Enable OCR to scan pictures.",
150 wl_bounce_relays
=> {
151 description
=> "Whitelist legitimate bounce relays.",
155 description
=> "Additional score for bounce mails.",
162 description
=> "Enable real time blacklists (RBL) checks.",
167 description
=> "Maximum size of spam messages in bytes.",
177 use_awl
=> { optional
=> 1 },
178 use_razor
=> { optional
=> 1 },
179 use_ocr
=> { optional
=> 1 },
180 wl_bounce_relays
=> { optional
=> 1 },
181 languages
=> { optional
=> 1 },
182 use_bayes
=> { optional
=> 1 },
183 bounce_score
=> { optional
=> 1 },
184 rbl_checks
=> { optional
=> 1 },
185 maxspamsize
=> { optional
=> 1 },
189 package PMG
::Config
::ClamAV
;
194 use base
qw(PMG::Config::Base);
203 description
=> "ClamAV database mirror server.",
205 default => 'database.clamav.net',
207 archiveblockencrypted
=> {
208 description
=> "Wether to block encrypted archives. Mark encrypted archives as viruses.",
213 description
=> "Nested archives are scanned recursively, e.g. if a ZIP archive contains a TAR file, all files within it will also be scanned. This options specifies how deeply the process should be continued. Warning: setting this limit too high may result in severe damage to the system.",
219 description
=> "Number of files to be scanned within an archive, a document, or any other kind of container. Warning: disabling this limit or setting it too high may result in severe damage to the system.",
225 description
=> "Files larger than this limit won't be scanned.",
231 description
=> "Sets the maximum amount of data to be scanned for each input file.",
234 default => 100000000,
237 description
=> "This option sets the lowest number of Credit Card or Social Security numbers found in a file to generate a detect.",
247 archiveblockencrypted
=> { optional
=> 1 },
248 archivemaxrec
=> { optional
=> 1 },
249 archivemaxfiles
=> { optional
=> 1 },
250 archivemaxsize
=> { optional
=> 1 },
251 maxscansize
=> { optional
=> 1 },
252 dbmirror
=> { optional
=> 1 },
253 maxcccount
=> { optional
=> 1 },
257 package PMG
::Config
::Mail
;
262 use PVE
::ProcFSTools
;
264 use base
qw(PMG::Config::Base);
271 sub physical_memory
{
273 return $physicalmem if $physicalmem;
275 my $info = PVE
::ProcFSTools
::read_meminfo
();
276 my $total = int($info->{memtotal
} / (1024*1024));
281 sub get_max_filters
{
282 # estimate optimal number of filter servers
286 my $memory = physical_memory
();
287 my $add_servers = int(($memory - 512)/$servermem);
288 $max_servers += $add_servers if $add_servers > 0;
289 $max_servers = 40 if $max_servers > 40;
291 return $max_servers - 2;
295 # estimate optimal number of smtpd daemons
297 my $max_servers = 25;
299 my $memory = physical_memory
();
300 my $add_servers = int(($memory - 512)/$servermem);
301 $max_servers += $add_servers if $add_servers > 0;
302 $max_servers = 100 if $max_servers > 100;
307 # estimate optimal number of proxpolicy servers
309 my $memory = physical_memory
();
310 $max_servers = 5 if $memory >= 500;
317 description
=> "SMTP port number for outgoing mail (trusted).",
324 description
=> "SMTP port number for incoming mail (untrusted). This must be a different number than 'int_port'.",
331 description
=> "The default mail delivery transport (incoming mails).",
332 type
=> 'string', format
=> 'address',
335 description
=> "SMTP port number for relay host.",
342 description
=> "Disable MX lookups for default relay.",
347 description
=> "When set, all outgoing mails are deliverd to the specified smarthost.",
348 type
=> 'string', format
=> 'address',
351 description
=> "ESMTP banner.",
354 default => 'ESMTP Proxmox',
357 description
=> "Maximum number of pmg-smtp-filter processes.",
361 default => get_max_filters
(),
364 description
=> "Maximum number of pmgpolicy processes.",
368 default => get_max_policy
(),
371 description
=> "Maximum number of SMTP daemon processes (in).",
375 default => get_max_smtpd
(),
378 description
=> "Maximum number of SMTP daemon processes (out).",
382 default => get_max_smtpd
(),
384 conn_count_limit
=> {
385 description
=> "How many simultaneous connections any client is allowed to make to this service. To disable this feature, specify a limit of 0.",
391 description
=> "The maximal number of connection attempts any client is allowed to make to this service per minute. To disable this feature, specify a limit of 0.",
396 message_rate_limit
=> {
397 description
=> "The maximal number of message delivery requests that any client is allowed to make to this service per minute.To disable this feature, specify a limit of 0.",
403 description
=> "Hide received header in outgoing mails.",
408 description
=> "Maximum email size. Larger mails are rejected.",
411 default => 1024*1024*10,
414 description
=> "SMTP delay warning time (in hours).",
420 description
=> "Use Realtime Blacklists.",
425 description
=> "Use TLS.",
430 description
=> "Use Sender Policy Framework.",
435 description
=> "Use Greylisting.",
440 description
=> "Use SMTP HELO tests.",
445 description
=> "Reject unknown clients.",
449 rejectunknownsender
=> {
450 description
=> "Reject unknown senders.",
455 description
=> "Enable receiver verification. The value (if greater than 0) spefifies the numerical reply code when the Postfix SMTP server rejects a recipient address (450 or 550).",
462 description
=> "Optional list of DNS white/blacklist domains (see postscreen_dnsbl_sites parameter).",
470 int_port
=> { optional
=> 1 },
471 ext_port
=> { optional
=> 1 },
472 smarthost
=> { optional
=> 1 },
473 relay
=> { optional
=> 1 },
474 relayport
=> { optional
=> 1 },
475 relaynomx
=> { optional
=> 1 },
476 dwarning
=> { optional
=> 1 },
477 max_smtpd_in
=> { optional
=> 1 },
478 max_smtpd_out
=> { optional
=> 1 },
479 greylist
=> { optional
=> 1 },
480 helotests
=> { optional
=> 1 },
481 use_rbl
=> { optional
=> 1 },
482 tls
=> { optional
=> 1 },
483 spf
=> { optional
=> 1 },
484 maxsize
=> { optional
=> 1 },
485 banner
=> { optional
=> 1 },
486 max_filters
=> { optional
=> 1 },
487 max_policy
=> { optional
=> 1 },
488 hide_received
=> { optional
=> 1 },
489 rejectunknown
=> { optional
=> 1 },
490 rejectunknownsender
=> { optional
=> 1 },
491 conn_count_limit
=> { optional
=> 1 },
492 conn_rate_limit
=> { optional
=> 1 },
493 message_rate_limit
=> { optional
=> 1 },
494 verifyreceivers
=> { optional
=> 1 },
495 dnsbl_sites
=> { optional
=> 1 },
510 PMG
::Config
::Admin-
>register();
511 PMG
::Config
::Mail-
>register();
512 PMG
::Config
::Spam-
>register();
513 PMG
::Config
::ClamAV-
>register();
515 # initialize all plugins
516 PMG
::Config
::Base-
>init();
522 my $class = ref($type) || $type;
524 my $cfg = PVE
::INotify
::read_file
("pmg.conf");
526 return bless $cfg, $class;
532 PVE
::INotify
::write_file
("pmg.conf", $self);
535 my $lockfile = "/var/lock/pmgconfig.lck";
538 my ($code, $errmsg) = @_;
540 my $p = PVE
::Tools
::lock_file
($lockfile, undef, $code);
542 $errmsg ?
die "$errmsg: $err" : die $err;
548 my ($self, $section, $key, $value) = @_;
550 my $pdata = PMG
::Config
::Base-
>private();
552 my $plugin = $pdata->{plugins
}->{$section};
553 die "no such section '$section'" if !$plugin;
555 if (defined($value)) {
556 my $tmp = PMG
::Config
::Base-
>check_value($section, $key, $value, $section, 0);
557 $self->{ids
}->{$section} = { type
=> $section } if !defined($self->{ids
}->{$section});
558 $self->{ids
}->{$section}->{$key} = PMG
::Config
::Base-
>decode_value($section, $key, $tmp);
560 if (defined($self->{ids
}->{$section})) {
561 delete $self->{ids
}->{$section}->{$key};
568 # get section value or default
570 my ($self, $section, $key) = @_;
572 my $pdata = PMG
::Config
::Base-
>private();
573 my $pdesc = $pdata->{propertyList
}->{$key};
574 die "no such property '$section/$key'\n"
575 if !(defined($pdesc) && defined($pdata->{options
}->{$section}) &&
576 defined($pdata->{options
}->{$section}->{$key}));
578 if (defined($self->{ids
}->{$section}) &&
579 defined(my $value = $self->{ids
}->{$section}->{$key})) {
583 return $pdesc->{default};
586 # get a whole section with default value
588 my ($self, $section) = @_;
590 my $pdata = PMG
::Config
::Base-
>private();
591 return undef if !defined($pdata->{options
}->{$section});
595 foreach my $key (keys %{$pdata->{options
}->{$section}}) {
597 my $pdesc = $pdata->{propertyList
}->{$key};
599 if (defined($self->{ids
}->{$section}) &&
600 defined(my $value = $self->{ids
}->{$section}->{$key})) {
601 $res->{$key} = $value;
604 $res->{$key} = $pdesc->{default};
610 # get a whole config with default values
614 my $pdata = PMG
::Config
::Base-
>private();
618 foreach my $type (keys %{$pdata->{plugins
}}) {
619 my $plugin = $pdata->{plugins
}->{$type};
620 $res->{$type} = $self->get_section($type);
627 my ($filename, $fh) = @_;
629 local $/ = undef; # slurp mode
631 my $raw = <$fh> if defined($fh);
633 return PMG
::Config
::Base-
>parse_config($filename, $raw);
637 my ($filename, $fh, $cfg) = @_;
639 my $raw = PMG
::Config
::Base-
>write_config($filename, $cfg);
641 PVE
::Tools
::safe_print
($filename, $fh, $raw);
644 PVE
::INotify
::register_file
('pmg.conf', "/etc/pmg/pmg.conf",
647 undef, always_call_parser
=> 1);
649 # parsers/writers for other files
651 my $domainsfilename = "/etc/pmg/domains";
653 sub read_pmg_domains
{
654 my ($filename, $fh) = @_;
659 while (defined(my $line = <$fh>)) {
660 if ($line =~ m/^\s*(\S+)\s*$/) {
662 push @$domains, $domain;
670 sub write_pmg_domains
{
671 my ($filename, $fh, $domain) = @_;
673 foreach my $domain (sort @$domain) {
674 PVE
::Tools
::safe_print
($filename, $fh, "$domain\n");
678 PVE
::INotify
::register_file
('domains', $domainsfilename,
681 undef, always_call_parser
=> 1);
683 my $transport_map_filename = "/etc/postfix/transport";
685 sub read_transport_map
{
686 my ($filename, $fh) = @_;
688 return [] if !defined($fh);
692 while (defined(my $line = <$fh>)) {
694 next if $line =~ m/^\s*$/;
695 next if $line =~ m/^\s*\#/;
697 if ($line =~ m/^(\S+)\s+smtp:([^\s:]+):(\d+)\s*$/) {
703 if ($host =~ m/^\[(.*)\]$/) {
708 my $key = "$host:$port";
710 $res->{$key}->{nomx
} = $nomx;
711 $res->{$key}->{host
} = $host;
712 $res->{$key}->{port
} = $port;
713 $res->{$key}->{transport
} = $key;
715 push @{$res->{$key}->{domains
}}, $domain;
721 foreach my $t (sort keys %$res) {
722 push @$ta, $res->{$t};
728 sub write_ransport_map
{
729 my ($filename, $fh, $tmap) = @_;
733 foreach my $t (sort { $a->{transport
} cmp $b->{transport
} } @$tmap) {
734 my $domains = $t->{domains
};
736 foreach my $d (sort @$domains) {
738 PVE
::Tools
::safe_print
($filename, $fh, "$d smtp:[$t->{host}]:$t->{port}\n");
740 PVE
::Tools
::safe_print
($filename, $fh, "$d smtp:$t->{host}:$t->{port}\n");
746 PVE
::INotify
::register_file
('transport', $transport_map_filename,
747 \
&read_transport_map
,
748 \
&write_ransport_map
,
749 undef, always_call_parser
=> 1);
751 # config file generation using templates
753 sub get_template_vars
{
756 my $vars = { pmg
=> $self->get_config() };
758 my $nodename = PVE
::INotify
::nodename
();
759 my $int_ip = PMG
::Cluster
::remote_node_ip
($nodename);
760 my $int_net_cidr = PMG
::Utils
::find_local_network_for_ip
($int_ip);
761 $vars->{ipconfig
}->{int_ip
} = $int_ip;
762 # $vars->{ipconfig}->{int_net_cidr} = $int_net_cidr;
764 my $transportnets = []; # fixme
765 $vars->{postfix
}->{transportnets
} = join(' ', @$transportnets);
767 my $mynetworks = [ '127.0.0.0/8', '[::1]/128' ];
768 push @$mynetworks, @$transportnets;
769 push @$mynetworks, $int_net_cidr;
771 # add default relay to mynetworks
772 if (my $relay = $self->get('mail', 'relay')) {
773 if (Net
::IP
::ip_is_ipv4
($relay)) {
774 push @$mynetworks, "$relay/32";
775 } elsif (Net
::IP
::ip_is_ipv6
($relay)) {
776 push @$mynetworks, "[$relay]/128";
778 # DNS name - do nothing ?
782 $vars->{postfix
}->{mynetworks
} = join(' ', @$mynetworks);
785 $usepolicy = 1 if $self->get('mail', 'greylist') ||
786 $self->get('mail', 'spf') || $self->get('mail', 'use_rbl');
787 $vars->{postfix
}->{usepolicy
} = $usepolicy;
789 my $resolv = PVE
::INotify
::read_file
('resolvconf');
790 $vars->{dns
}->{hostname
} = $nodename;
791 $vars->{dns
}->{domain
} = $resolv->{search
};
796 # rewrite file from template
797 # return true if file has changed
798 sub rewrite_config_file
{
799 my ($self, $tmplname, $dstfn) = @_;
801 my $demo = $self->get('admin', 'demo');
803 my $srcfn = ($tmplname =~ m
|^.?
/|) ?
804 $tmplname : "/var/lib/pmg/templates/$tmplname";
807 my $demosrc = "$srcfn.demo";
808 $srcfn = $demosrc if -f
$demosrc;
811 my ($perm, $uid, $gid);
813 my $srcfd = IO
::File-
>new ($srcfn, "r")
814 || die "cant read template '$srcfn' - $!: ERROR";
816 if ($dstfn eq '/etc/fetchmailrc') {
817 (undef, undef, $uid, $gid) = getpwnam('fetchmail');
819 } elsif ($dstfn eq '/etc/clamav/freshclam.conf') {
820 # needed if file contains a HTTPProxyPasswort
822 $uid = getpwnam('clamav');
823 $gid = getgrnam('adm');
827 my $template = Template-
>new({});
829 my $vars = $self->get_template_vars();
833 $template->process($srcfd, $vars, \
$output) ||
834 die $template->error();
838 my $old = PVE
::Tools
::file_get_contents
($dstfn, 128*1024) if -f
$dstfn;
840 return 0 if defined($old) && ($old eq $output); # no change
842 PVE
::Tools
::file_set_contents
($dstfn, $output, $perm);
844 if (defined($uid) && defined($gid)) {
845 chown($uid, $gid, $dstfn);
851 # rewrite spam configuration
852 sub rewrite_config_spam
{
855 my $use_awl = $self->get('spam', 'use_awl');
856 my $use_bayes = $self->get('spam', 'use_bayes');
857 my $use_razor = $self->get('spam', 'use_razor');
861 # delete AW and bayes databases if those features are disabled
863 $changes = 1 if unlink '/root/.spamassassin/auto-whitelist';
867 $changes = 1 if unlink '/root/.spamassassin/bayes_journal';
868 $changes = 1 if unlink '/root/.spamassassin/bayes_seen';
869 $changes = 1 if unlink '/root/.spamassassin/bayes_toks';
872 # make sure we have a custom.cf file (else cluster sync fails)
873 IO
::File-
>new('/etc/mail/spamassassin/custom.cf', 'a', 0644);
875 $changes = 1 if $self->rewrite_config_file(
876 'local.cf.in', '/etc/mail/spamassassin/local.cf');
878 $changes = 1 if $self->rewrite_config_file(
879 'init.pre.in', '/etc/mail/spamassassin/init.pre');
881 $changes = 1 if $self->rewrite_config_file(
882 'v310.pre.in', '/etc/mail/spamassassin/v310.pre');
884 $changes = 1 if $self->rewrite_config_file(
885 'v320.pre.in', '/etc/mail/spamassassin/v320.pre');
888 mkdir "/root/.razor";
890 $changes = 1 if $self->rewrite_config_file(
891 'razor-agent.conf.in', '/root/.razor/razor-agent.conf');
893 if (! -e
'/root/.razor/identity') {
896 PVE
::Tools
::run_command
(['razor-admin', '-discover'], timeout
=> $timeout);
897 PVE
::Tools
::run_command
(['razor-admin', '-register'], timeout
=> $timeout);
900 syslog
('info', msgquote
("registering razor failed: $err")) if $err;
907 # rewrite ClamAV configuration
908 sub rewrite_config_clam
{
911 return $self->rewrite_config_file(
912 'clamd.conf.in', '/etc/clamav/clamd.conf');
915 sub rewrite_config_freshclam
{
918 return $self->rewrite_config_file(
919 'freshclam.conf.in', '/etc/clamav/freshclam.conf');
922 sub rewrite_config_postgres
{
925 my $pgconfdir = "/etc/postgresql/9.6/main";
929 $changes = 1 if $self->rewrite_config_file(
930 'pg_hba.conf.in', "$pgconfdir/pg_hba.conf");
932 $changes = 1 if $self->rewrite_config_file(
933 'postgresql.conf.in', "$pgconfdir/postgresql.conf");
938 # rewrite /root/.forward
939 sub rewrite_dot_forward
{
942 my $dstfn = '/root/.forward';
944 my $email = $self->get('admin', 'email');
947 if ($email && $email =~ m/\s*(\S+)\s*/) {
950 # empty .forward does not forward mails (see man local)
953 my $old = PVE
::Tools
::file_get_contents
($dstfn, 128*1024) if -f
$dstfn;
955 return 0 if defined($old) && ($old eq $output); # no change
957 PVE
::Tools
::file_set_contents
($dstfn, $output);
962 # rewrite /etc/postfix/*
963 sub rewrite_config_postfix
{
966 # make sure we have required files (else postfix start fails)
967 IO
::File-
>new($domainsfilename, 'a', 0644);
968 IO
::File-
>new($transport_map_filename, 'a', 0644);
972 if ($self->get('mail', 'tls')) {
974 PMG
::Utils
::gen_proxmox_tls_cert
();
976 syslog
('info', msgquote
("generating certificate failed: $@")) if $@;
979 $changes = 1 if $self->rewrite_config_file(
980 'main.cf.in', '/etc/postfix/main.cf');
982 $changes = 1 if $self->rewrite_config_file(
983 'master.cf.in', '/etc/postfix/master.cf');
985 #rewrite_config_transports ($class);
986 #rewrite_config_whitelist ($class);
987 #rewrite_config_tls_policy ($class);
989 # make sure aliases.db is up to date
990 system('/usr/bin/newaliases');
996 my ($self, $restart_services) = @_;
998 if ($self->rewrite_config_postfix() && $restart_services) {
999 PMG
::Utils
::service_cmd
('postfix', 'restart');
1002 if ($self->rewrite_dot_forward() && $restart_services) {
1003 # no need to restart anything
1006 if ($self->rewrite_config_postgres() && $restart_services) {
1007 # do nothing (too many side effects)?
1008 # does not happen anyways, because config does not change.
1011 if ($self->rewrite_config_spam() && $restart_services) {
1012 PMG
::Utils
::service_cmd
('pmg-smtp-filter', 'restart');
1015 if ($self->rewrite_config_clam() && $restart_services) {
1016 PMG
::Utils
::service_cmd
('clamav-daemon', 'restart');
1019 if ($self->rewrite_config_freshclam() && $restart_services) {
1020 PMG
::Utils
::service_cmd
('clamav-freshclam', 'restart');