1 package PMG
::Config
::Base
;
8 use PVE
::JSONSchema
qw(get_standard_option);
9 use PVE
::SectionConfig
;
11 use base
qw(PVE::SectionConfig);
15 type
=> { description
=> "Section type." },
17 description
=> "Secion ID.",
18 type
=> 'string', format
=> 'pve-configid',
27 sub format_section_header
{
28 my ($class, $type, $sectionId) = @_;
30 if ($type eq 'ldap') {
31 $sectionId =~ s/^ldap_//;
32 return "$type: $sectionId\n";
34 return "section: $type\n";
39 sub parse_section_header
{
40 my ($class, $line) = @_;
42 if ($line =~ m/^(ldap|section):\s*(\S+)\s*$/) {
43 my ($raw_type, $raw_id) = (lc($1), $2);
44 my $type = $raw_type eq 'section' ?
$raw_id : $raw_type;
45 my $section_id = "${raw_type}_${raw_id}";
46 my $errmsg = undef; # set if you want to skip whole section
47 eval { PVE
::JSONSchema
::pve_verify_configid
($raw_id); };
49 my $config = {}; # to return additional attributes
50 return ($type, $section_id, $errmsg, $config);
55 package PMG
::Config
::Admin
;
60 use base
qw(PMG::Config::Base);
69 description
=> "Send daily reports.",
74 description
=> "Demo mode - do not start SMTP filter.",
79 description
=> "Administrator E-Mail address.",
80 type
=> 'string', format
=> 'email',
81 default => 'admin@domain.tld',
84 description
=> "HTTP proxy port.",
90 description
=> "HTTP proxy server address.",
94 description
=> "HTTP proxy user name.",
98 description
=> "HTTP proxy password.",
106 dailyreport
=> { optional
=> 1 },
107 demo
=> { optional
=> 1 },
108 proxyport
=> { optional
=> 1 },
109 proxyserver
=> { optional
=> 1 },
110 proxyuser
=> { optional
=> 1 },
111 proxypassword
=> { optional
=> 1 },
115 package PMG
::Config
::Spam
;
120 use base
qw(PMG::Config::Base);
129 description
=> "This option is used to specify which languages are considered OK for incoming mail.",
131 pattern
=> '(all|([a-z][a-z])+( ([a-z][a-z])+)*)',
135 description
=> "Whether to use the naive-Bayesian-style classifier.",
140 description
=> "Use the Auto-Whitelist plugin.",
145 description
=> "Whether to use Razor2, if it is available.",
150 description
=> "Enable OCR to scan pictures.",
154 wl_bounce_relays
=> {
155 description
=> "Whitelist legitimate bounce relays.",
159 description
=> "Additional score for bounce mails.",
166 description
=> "Enable real time blacklists (RBL) checks.",
171 description
=> "Maximum size of spam messages in bytes.",
181 use_awl
=> { optional
=> 1 },
182 use_razor
=> { optional
=> 1 },
183 use_ocr
=> { optional
=> 1 },
184 wl_bounce_relays
=> { optional
=> 1 },
185 languages
=> { optional
=> 1 },
186 use_bayes
=> { optional
=> 1 },
187 bounce_score
=> { optional
=> 1 },
188 rbl_checks
=> { optional
=> 1 },
189 maxspamsize
=> { optional
=> 1 },
193 package PMG
::Config
::ClamAV
;
198 use base
qw(PMG::Config::Base);
207 description
=> "ClamAV database mirror server.",
209 default => 'database.clamav.net',
211 archiveblockencrypted
=> {
212 description
=> "Wether to block encrypted archives. Mark encrypted archives as viruses.",
217 description
=> "Nested archives are scanned recursively, e.g. if a ZIP archive contains a TAR file, all files within it will also be scanned. This options specifies how deeply the process should be continued. Warning: setting this limit too high may result in severe damage to the system.",
223 description
=> "Number of files to be scanned within an archive, a document, or any other kind of container. Warning: disabling this limit or setting it too high may result in severe damage to the system.",
229 description
=> "Files larger than this limit won't be scanned.",
235 description
=> "Sets the maximum amount of data to be scanned for each input file.",
238 default => 100000000,
241 description
=> "This option sets the lowest number of Credit Card or Social Security numbers found in a file to generate a detect.",
251 archiveblockencrypted
=> { optional
=> 1 },
252 archivemaxrec
=> { optional
=> 1 },
253 archivemaxfiles
=> { optional
=> 1 },
254 archivemaxsize
=> { optional
=> 1 },
255 maxscansize
=> { optional
=> 1 },
256 dbmirror
=> { optional
=> 1 },
257 maxcccount
=> { optional
=> 1 },
261 package PMG
::Config
::LDAP
;
266 use base
qw(PMG::Config::Base);
275 description
=> "LDAP protocol mode ('ldap' or 'ldaps').",
277 enum
=> ['ldap', 'ldaps'],
285 mode
=> { optional
=> 1 },
289 package PMG
::Config
::Mail
;
294 use PVE
::ProcFSTools
;
296 use base
qw(PMG::Config::Base);
303 sub physical_memory
{
305 return $physicalmem if $physicalmem;
307 my $info = PVE
::ProcFSTools
::read_meminfo
();
308 my $total = int($info->{memtotal
} / (1024*1024));
313 sub get_max_filters
{
314 # estimate optimal number of filter servers
318 my $memory = physical_memory
();
319 my $add_servers = int(($memory - 512)/$servermem);
320 $max_servers += $add_servers if $add_servers > 0;
321 $max_servers = 40 if $max_servers > 40;
323 return $max_servers - 2;
327 # estimate optimal number of smtpd daemons
329 my $max_servers = 25;
331 my $memory = physical_memory
();
332 my $add_servers = int(($memory - 512)/$servermem);
333 $max_servers += $add_servers if $add_servers > 0;
334 $max_servers = 100 if $max_servers > 100;
342 description
=> "The default mail delivery transport (incoming mails).",
346 description
=> "SMTP port number for relay host.",
353 description
=> "Disable MX lookups for default relay.",
358 description
=> "When set, all outgoing mails are deliverd to the specified smarthost.",
362 description
=> "ESMTP banner.",
365 default => 'ESMTP Proxmox',
368 description
=> "Maximum number of filter processes.",
372 default => get_max_filters
(),
375 description
=> "Maximum number of SMTP daemon processes (in).",
379 default => get_max_smtpd
(),
382 description
=> "Maximum number of SMTP daemon processes (out).",
386 default => get_max_smtpd
(),
388 conn_count_limit
=> {
389 description
=> "How many simultaneous connections any client is allowed to make to this service. To disable this feature, specify a limit of 0.",
395 description
=> "The maximal number of connection attempts any client is allowed to make to this service per minute. To disable this feature, specify a limit of 0.",
400 message_rate_limit
=> {
401 description
=> "The maximal number of message delivery requests that any client is allowed to make to this service per minute.To disable this feature, specify a limit of 0.",
407 description
=> "Hide received header in outgoing mails.",
412 description
=> "Maximum email size. Larger mails are rejected.",
415 default => 1024*1024*10,
418 description
=> "SMTP delay warning time (in hours).",
424 description
=> "Use Realtime Blacklists.",
429 description
=> "Use TLS.",
434 description
=> "Use Sender Policy Framework.",
439 description
=> "Use Greylisting.",
444 description
=> "Use SMTP HELO tests.",
449 description
=> "Reject unknown clients.",
453 rejectunknownsender
=> {
454 description
=> "Reject unknown senders.",
459 description
=> "Enable receiver verification. The value (if greater than 0) spefifies the numerical reply code when the Postfix SMTP server rejects a recipient address (450 or 550).",
466 description
=> "Optional list of DNS white/blacklist domains (see postscreen_dnsbl_sites parameter).",
474 relay
=> { optional
=> 1 },
475 relayport
=> { optional
=> 1 },
476 relaynomx
=> { optional
=> 1 },
477 dwarning
=> { optional
=> 1 },
478 max_smtpd_in
=> { optional
=> 1 },
479 max_smtpd_out
=> { optional
=> 1 },
480 greylist
=> { optional
=> 1 },
481 helotests
=> { optional
=> 1 },
482 use_rbl
=> { optional
=> 1 },
483 tls
=> { optional
=> 1 },
484 spf
=> { optional
=> 1 },
485 maxsize
=> { optional
=> 1 },
486 banner
=> { optional
=> 1 },
487 max_filters
=> { optional
=> 1 },
488 hide_received
=> { optional
=> 1 },
489 rejectunknown
=> { optional
=> 1 },
490 rejectunknownsender
=> { optional
=> 1 },
491 conn_count_limit
=> { optional
=> 1 },
492 conn_rate_limit
=> { optional
=> 1 },
493 message_rate_limit
=> { optional
=> 1 },
494 verifyreceivers
=> { optional
=> 1 },
495 dnsbl_sites
=> { optional
=> 1 },
512 PMG
::Config
::Admin-
>register();
513 PMG
::Config
::Mail-
>register();
514 PMG
::Config
::Spam-
>register();
515 PMG
::Config
::LDAP-
>register();
516 PMG
::Config
::ClamAV-
>register();
518 # initialize all plugins
519 PMG
::Config
::Base-
>init();
525 my $class = ref($type) || $type;
527 my $cfg = PVE
::INotify
::read_file
("pmg.conf");
529 return bless $cfg, $class;
533 # this does not work for ldap entries
535 my ($self, $section, $key, $value) = @_;
537 my $pdata = PMG
::Config
::Base-
>private();
539 die "internal error" if $section eq 'ldap';
541 my $plugin = $pdata->{plugins
}->{$section};
542 die "no such section '$section'" if !$plugin;
544 my $configid = "section_$section";
545 if (defined($value)) {
546 my $tmp = PMG
::Config
::Base-
>check_value($section, $key, $value, $section, 0);
547 print Dumper
($self->{ids
});
548 $self->{ids
}->{$configid} = { type
=> $section } if !defined($self->{ids
}->{$configid});
549 $self->{ids
}->{$configid}->{$key} = PMG
::Config
::Base-
>decode_value($section, $key, $tmp);
551 if (defined($self->{ids
}->{$configid})) {
552 delete $self->{ids
}->{$configid}->{$key};
559 # get section value or default
560 # this does not work for ldap entries
562 my ($self, $section, $key) = @_;
564 my $pdata = PMG
::Config
::Base-
>private();
565 return undef if !defined($pdata->{options
}->{$section});
566 return undef if !defined($pdata->{options
}->{$section}->{$key});
567 my $pdesc = $pdata->{propertyList
}->{$key};
568 return undef if !defined($pdesc);
570 my $configid = "section_$section";
571 if (defined($self->{ids
}->{$configid}) &&
572 defined(my $value = $self->{ids
}->{$configid}->{$key})) {
576 return $pdesc->{default};
579 # get a whole section with default value
580 # this does not work for ldap entries
582 my ($self, $section) = @_;
584 my $pdata = PMG
::Config
::Base-
>private();
585 return undef if !defined($pdata->{options
}->{$section});
589 foreach my $key (keys %{$pdata->{options
}->{$section}}) {
591 my $pdesc = $pdata->{propertyList
}->{$key};
593 my $configid = "section_$section";
594 if (defined($self->{ids
}->{$configid}) &&
595 defined(my $value = $self->{ids
}->{$configid}->{$key})) {
596 $res->{$key} = $value;
599 $res->{$key} = $pdesc->{default};
605 # get a whole config with default values
606 # this does not work for ldap entries
610 my $pdata = PMG
::Config
::Base-
>private();
614 foreach my $type (keys %{$pdata->{plugins
}}) {
615 next if $type eq 'ldap';
616 my $plugin = $pdata->{plugins
}->{$type};
617 $res->{$type} = $self->get_section($type);
624 my ($filename, $fh) = @_;
626 local $/ = undef; # slurp mode
630 return PMG
::Config
::Base-
>parse_config($filename, $raw);
634 my ($filename, $fh, $cfg) = @_;
636 my $raw = PMG
::Config
::Base-
>write_config($filename, $cfg);
638 PVE
::Tools
::safe_print
($filename, $fh, $raw);
641 PVE
::INotify
::register_file
('pmg.conf', "/etc/proxmox/pmg.conf",
645 # parsers/writers for other files
647 my $domainsfilename = "/etc/proxmox/domains";
649 sub read_pmg_domains
{
650 my ($filename, $fh) = @_;
655 while (defined(my $line = <$fh>)) {
656 if ($line =~ m/^\s*(\S+)\s*$/) {
658 push @$domains, $domain;
666 sub write_pmg_domains
{
667 my ($filename, $fh, $domain) = @_;
669 foreach my $domain (sort @$domain) {
670 PVE
::Tools
::safe_print
($filename, $fh, "$domain\n");
674 PVE
::INotify
::register_file
('domains', $domainsfilename,
677 undef, always_call_parser
=> 1);
679 my $transport_map_filename = "/etc/postfix/transport";
681 sub read_transport_map
{
682 my ($filename, $fh) = @_;
684 return [] if !defined($fh);
688 while (defined(my $line = <$fh>)) {
690 next if $line =~ m/^\s*$/;
691 next if $line =~ m/^\s*\#/;
693 if ($line =~ m/^(\S+)\s+smtp:([^\s:]+):(\d+)\s*$/) {
699 if ($host =~ m/^\[(.*)\]$/) {
704 my $key = "$host:$port";
706 $res->{$key}->{nomx
} = $nomx;
707 $res->{$key}->{host
} = $host;
708 $res->{$key}->{port
} = $port;
709 $res->{$key}->{transport
} = $key;
711 push @{$res->{$key}->{domains
}}, $domain;
717 foreach my $t (sort keys %$res) {
718 push @$ta, $res->{$t};
724 sub write_ransport_map
{
725 my ($filename, $fh, $tmap) = @_;
729 foreach my $t (sort { $a->{transport
} cmp $b->{transport
} } @$tmap) {
730 my $domains = $t->{domains
};
732 foreach my $d (sort @$domains) {
734 PVE
::Tools
::safe_print
($filename, $fh, "$d smtp:[$t->{host}]:$t->{port}\n");
736 PVE
::Tools
::safe_print
($filename, $fh, "$d smtp:$t->{host}:$t->{port}\n");
742 PVE
::INotify
::register_file
('transport', $transport_map_filename,
743 \
&read_transport_map
,
744 \
&write_ransport_map
,
745 undef, always_call_parser
=> 1);
747 # config file generation using templates
749 sub rewrite_config_file
{
750 my ($self, $tmplname, $dstfn) = @_;
752 my $demo = $self->get('admin', 'demo');
754 my $srcfn = ($tmplname =~ m
|^.?
/|) ?
755 $tmplname : "/var/lib/pmg/templates/$tmplname";
758 my $demosrc = "$srcfn.demo";
759 $srcfn = $demosrc if -f
$demosrc;
762 my $srcfd = IO
::File-
>new ($srcfn, "r")
763 || die "cant read template '$srcfn' - $!: ERROR";
764 my $dstfd = PMG
::AtomicFile-
>open ($dstfn, "w")
765 || die "cant open config file '$dstfn' - $!: ERROR";
767 if ($dstfn eq '/etc/fetchmailrc') {
768 my ($login, $pass, $uid, $gid) = getpwnam('fetchmail');
770 chown($uid, $gid, ${*$dstfd}{'io_atomicfile_temp'});
772 chmod (0600, ${*$dstfd}{'io_atomicfile_temp'});
773 } elsif ($dstfn eq '/etc/clamav/freshclam.conf') {
774 # needed if file contains a HTTPProxyPasswort
776 my $uid = getpwnam('clamav');
777 my $gid = getgrnam('adm');
780 chown ($uid, $gid, ${*$dstfd}{'io_atomicfile_temp'});
782 chmod (0600, ${*$dstfd}{'io_atomicfile_temp'});
785 my $template = Template-
>new({});
787 my $vars = { pmg
=> $self->get_config() };
789 my $nodename = PVE
::INotify
::nodename
();
790 my $int_ip = PMG
::Cluster
::remote_node_ip
($nodename);
791 my $int_net_cidr = PMG
::Utils
::find_local_network_for_ip
($int_ip);
793 $vars->{ipconfig
}->{int_ip
} = $int_ip;
794 # $vars->{ipconfig}->{int_net_cidr} = $int_net_cidr;
795 $vars->{ipconfig
}->{int_port
} = 26;
796 $vars->{ipconfig
}->{ext_port
} = 25;
798 my $transportnets = []; # fixme
799 $vars->{postfix
}->{transportnets
} = join(' ', @$transportnets);
801 my $mynetworks = [ '127.0.0.0/8', '[::1]/128' ];
802 push @$mynetworks, @$transportnets;
803 push @$mynetworks, $int_net_cidr;
805 # add default relay to mynetworks
806 if (my $relay = $self->get('mail', 'relay')) {
807 if (Net
::IP
::ip_is_ipv4
($relay)) {
808 push @$mynetworks, "$relay/32";
809 } elsif (Net
::IP
::ip_is_ipv6
($relay)) {
810 push @$mynetworks, "[$relay]/128";
812 warn "unable to detect IP version of relay '$relay'";
816 $vars->{postfix
}->{mynetworks
} = join(' ', @$mynetworks);
819 $usepolicy = 1 if $self->get('mail', 'greylist') ||
820 $self->get('mail', 'spf') || $self->get('mail', 'use_rbl');
821 $vars->{postfix
}->{usepolicy
} = $usepolicy;
823 my $resolv = PVE
::INotify
::read_file
('resolvconf');
824 $vars->{dns
}->{hostname
} = $nodename;
825 $vars->{dns
}->{domain
} = $resolv->{search
};
827 $template->process($srcfd, $vars, $dstfd) ||
828 die $template->error();
834 sub rewrite_config_script
{
835 my ($self, $tmplname, $dstfn) = @_;
837 $self->rewrite_config_file($tmplname, $dstfn);
838 system("chmod +x $dstfn");
841 # rewrite spam configuration
842 sub rewrite_config_spam
{
845 my $use_awl = $self->get('spam', 'use_awl');
846 my $use_bayes = $self->get('spam', 'use_bayes');
847 my $use_razor = $self->get('spam', 'use_razor');
849 # delete AW and bayes databases if those features are disabled
850 unlink '/root/.spamassassin/auto-whitelist' if !$use_awl;
852 unlink '/root/.spamassassin/bayes_journal';
853 unlink '/root/.spamassassin/bayes_seen';
854 unlink '/root/.spamassassin/bayes_toks';
857 # make sure we have a custom.cf file (else cluster sync fails)
858 IO
::File-
>new('/etc/mail/spamassassin/custom.cf', 'a', 0644);
860 $self->rewrite_config_file('local.cf.in', '/etc/mail/spamassassin/local.cf');
861 $self->rewrite_config_file('init.pre.in', '/etc/mail/spamassassin/init.pre');
862 $self->rewrite_config_file('v310.pre.in', '/etc/mail/spamassassin/v310.pre');
863 $self->rewrite_config_file('v320.pre.in', '/etc/mail/spamassassin/v320.pre');
866 mkdir "/root/.razor";
867 $self->rewrite_config_file('razor-agent.conf.in', '/root/.razor/razor-agent.conf');
868 if (! -e
'/root/.razor/identity') {
871 PVE
::Tools
::run_command
(['razor-admin', '-discover'], timeout
=> $timeout);
872 PVE
::Tools
::run_command
(['razor-admin', '-register'], timeout
=> $timeout);
875 syslog
('info', msgquote
("registering razor failed: $err")) if $err;
880 # rewrite ClamAV configuration
881 sub rewrite_config_clam
{
884 $self->rewrite_config_file('clamd.conf.in', '/etc/clamav/clamd.conf');
885 $self->rewrite_config_file('freshclam.conf.in', '/etc/clamav/freshclam.conf');
888 sub rewrite_config_postgres
{
891 my $pgconfdir = "/etc/postgresql/9.6/main";
893 $self->rewrite_config_file('pg_hba.conf.in', "$pgconfdir/pg_hba.conf");
894 $self->rewrite_config_file('postgresql.conf.in', "$pgconfdir/postgresql.conf");
897 # rewrite /root/.forward
898 sub rewrite_dot_forward
{
901 my $fname = '/root/.forward';
903 my $email = $self->get('administration', 'email');
904 open(TMP
, ">$fname");
905 if ($email && $email =~ m/\s*(\S+)\s*/) {
908 # empty .forward does not forward mails (see man local)
913 # rewrite /etc/postfix/*
914 sub rewrite_config_postfix
{
917 # make sure we have required files (else postfix start fails)
918 IO
::File-
>new($domainsfilename, 'a', 0644);
919 IO
::File-
>new($transport_map_filename, 'a', 0644);
921 if ($self->get('mail', 'tls')) {
923 my $resolv = PVE
::INotify
::read_file
('resolvconf');
924 my $domain = $resolv->{search
};
926 my $company = $domain; # what else ?
927 my $cn = "*.$domain";
928 PMG
::Utils
::gen_proxmox_tls_cert
(0, $company, $cn);
930 syslog
('info', msgquote
("generating certificate failed: $@")) if $@;
933 $self->rewrite_config_file('main.cf.in', '/etc/postfix/main.cf');
934 $self->rewrite_config_file('master.cf.in', '/etc/postfix/master.cf');
935 #rewrite_config_transports ($class);
936 #rewrite_config_whitelist ($class);
937 #rewrite_config_tls_policy ($class);
939 # make sure aliases.db is up to date
940 system('/usr/bin/newaliases');
946 $self->rewrite_config_postfix();
947 $self->rewrite_dot_forward();
948 $self->rewrite_config_postgres();
949 $self->rewrite_config_spam();
950 $self->rewrite_config_clam();