1 package PMG
::Config
::Base
;
8 use PVE
::JSONSchema
qw(get_standard_option);
9 use PVE
::SectionConfig
;
11 use base
qw(PVE::SectionConfig);
15 type
=> { description
=> "Section type." },
17 description
=> "Secion ID.",
18 type
=> 'string', format
=> 'pve-configid',
27 sub format_section_header
{
28 my ($class, $type, $sectionId) = @_;
30 die "internal error ($type ne $sectionId)" if $type ne $sectionId;
32 return "section: $type\n";
36 sub parse_section_header
{
37 my ($class, $line) = @_;
39 if ($line =~ m/^section:\s*(\S+)\s*$/) {
41 my $errmsg = undef; # set if you want to skip whole section
42 eval { PVE
::JSONSchema
::pve_verify_configid
($section); };
44 my $config = {}; # to return additional attributes
45 return ($section, $section, $errmsg, $config);
50 package PMG
::Config
::Admin
;
55 use base
qw(PMG::Config::Base);
64 description
=> "Send daily reports.",
69 description
=> "Demo mode - do not start SMTP filter.",
74 description
=> "Administrator E-Mail address.",
75 type
=> 'string', format
=> 'email',
76 default => 'admin@domain.tld',
79 description
=> "HTTP proxy port.",
85 description
=> "HTTP proxy server address.",
89 description
=> "HTTP proxy user name.",
93 description
=> "HTTP proxy password.",
101 dailyreport
=> { optional
=> 1 },
102 demo
=> { optional
=> 1 },
103 email
=> { optional
=> 1 },
104 proxyport
=> { optional
=> 1 },
105 proxyserver
=> { optional
=> 1 },
106 proxyuser
=> { optional
=> 1 },
107 proxypassword
=> { optional
=> 1 },
111 package PMG
::Config
::Spam
;
116 use base
qw(PMG::Config::Base);
125 description
=> "This option is used to specify which languages are considered OK for incoming mail.",
127 pattern
=> '(all|([a-z][a-z])+( ([a-z][a-z])+)*)',
131 description
=> "Whether to use the naive-Bayesian-style classifier.",
136 description
=> "Use the Auto-Whitelist plugin.",
141 description
=> "Whether to use Razor2, if it is available.",
146 description
=> "Enable OCR to scan pictures.",
150 wl_bounce_relays
=> {
151 description
=> "Whitelist legitimate bounce relays.",
155 description
=> "Additional score for bounce mails.",
162 description
=> "Enable real time blacklists (RBL) checks.",
167 description
=> "Maximum size of spam messages in bytes.",
177 use_awl
=> { optional
=> 1 },
178 use_razor
=> { optional
=> 1 },
179 use_ocr
=> { optional
=> 1 },
180 wl_bounce_relays
=> { optional
=> 1 },
181 languages
=> { optional
=> 1 },
182 use_bayes
=> { optional
=> 1 },
183 bounce_score
=> { optional
=> 1 },
184 rbl_checks
=> { optional
=> 1 },
185 maxspamsize
=> { optional
=> 1 },
189 package PMG
::Config
::ClamAV
;
194 use base
qw(PMG::Config::Base);
203 description
=> "ClamAV database mirror server.",
205 default => 'database.clamav.net',
207 archiveblockencrypted
=> {
208 description
=> "Wether to block encrypted archives. Mark encrypted archives as viruses.",
213 description
=> "Nested archives are scanned recursively, e.g. if a ZIP archive contains a TAR file, all files within it will also be scanned. This options specifies how deeply the process should be continued. Warning: setting this limit too high may result in severe damage to the system.",
219 description
=> "Number of files to be scanned within an archive, a document, or any other kind of container. Warning: disabling this limit or setting it too high may result in severe damage to the system.",
225 description
=> "Files larger than this limit won't be scanned.",
231 description
=> "Sets the maximum amount of data to be scanned for each input file.",
234 default => 100000000,
237 description
=> "This option sets the lowest number of Credit Card or Social Security numbers found in a file to generate a detect.",
247 archiveblockencrypted
=> { optional
=> 1 },
248 archivemaxrec
=> { optional
=> 1 },
249 archivemaxfiles
=> { optional
=> 1 },
250 archivemaxsize
=> { optional
=> 1 },
251 maxscansize
=> { optional
=> 1 },
252 dbmirror
=> { optional
=> 1 },
253 maxcccount
=> { optional
=> 1 },
257 package PMG
::Config
::Mail
;
262 use PVE
::ProcFSTools
;
264 use base
qw(PMG::Config::Base);
271 sub physical_memory
{
273 return $physicalmem if $physicalmem;
275 my $info = PVE
::ProcFSTools
::read_meminfo
();
276 my $total = int($info->{memtotal
} / (1024*1024));
281 sub get_max_filters
{
282 # estimate optimal number of filter servers
286 my $memory = physical_memory
();
287 my $add_servers = int(($memory - 512)/$servermem);
288 $max_servers += $add_servers if $add_servers > 0;
289 $max_servers = 40 if $max_servers > 40;
291 return $max_servers - 2;
295 # estimate optimal number of smtpd daemons
297 my $max_servers = 25;
299 my $memory = physical_memory
();
300 my $add_servers = int(($memory - 512)/$servermem);
301 $max_servers += $add_servers if $add_servers > 0;
302 $max_servers = 100 if $max_servers > 100;
307 # estimate optimal number of proxpolicy servers
309 my $memory = physical_memory
();
310 $max_servers = 5 if $memory >= 500;
317 description
=> "SMTP port number for outgoing mail (trusted).",
324 description
=> "SMTP port number for incoming mail (untrusted). This must be a different number than 'int_port'.",
331 description
=> "The default mail delivery transport (incoming mails).",
332 type
=> 'string', format
=> 'address',
335 description
=> "SMTP port number for relay host.",
342 description
=> "Disable MX lookups for default relay.",
347 description
=> "When set, all outgoing mails are deliverd to the specified smarthost.",
348 type
=> 'string', format
=> 'address',
351 description
=> "ESMTP banner.",
354 default => 'ESMTP Proxmox',
357 description
=> "Maximum number of pmg-smtp-filter processes.",
361 default => get_max_filters
(),
364 description
=> "Maximum number of pmgpolicy processes.",
368 default => get_max_policy
(),
371 description
=> "Maximum number of SMTP daemon processes (in).",
375 default => get_max_smtpd
(),
378 description
=> "Maximum number of SMTP daemon processes (out).",
382 default => get_max_smtpd
(),
384 conn_count_limit
=> {
385 description
=> "How many simultaneous connections any client is allowed to make to this service. To disable this feature, specify a limit of 0.",
391 description
=> "The maximal number of connection attempts any client is allowed to make to this service per minute. To disable this feature, specify a limit of 0.",
396 message_rate_limit
=> {
397 description
=> "The maximal number of message delivery requests that any client is allowed to make to this service per minute.To disable this feature, specify a limit of 0.",
403 description
=> "Hide received header in outgoing mails.",
408 description
=> "Maximum email size. Larger mails are rejected.",
411 default => 1024*1024*10,
414 description
=> "SMTP delay warning time (in hours).",
420 description
=> "Use Realtime Blacklists.",
425 description
=> "Use TLS.",
430 description
=> "Use Sender Policy Framework.",
435 description
=> "Use Greylisting.",
440 description
=> "Use SMTP HELO tests.",
445 description
=> "Reject unknown clients.",
449 rejectunknownsender
=> {
450 description
=> "Reject unknown senders.",
455 description
=> "Enable receiver verification. The value spefifies the numerical reply code when the Postfix SMTP server rejects a recipient address.",
457 enum
=> ['450', '550'],
460 description
=> "Optional list of DNS white/blacklist domains (see postscreen_dnsbl_sites parameter).",
468 int_port
=> { optional
=> 1 },
469 ext_port
=> { optional
=> 1 },
470 smarthost
=> { optional
=> 1 },
471 relay
=> { optional
=> 1 },
472 relayport
=> { optional
=> 1 },
473 relaynomx
=> { optional
=> 1 },
474 dwarning
=> { optional
=> 1 },
475 max_smtpd_in
=> { optional
=> 1 },
476 max_smtpd_out
=> { optional
=> 1 },
477 greylist
=> { optional
=> 1 },
478 helotests
=> { optional
=> 1 },
479 use_rbl
=> { optional
=> 1 },
480 tls
=> { optional
=> 1 },
481 spf
=> { optional
=> 1 },
482 maxsize
=> { optional
=> 1 },
483 banner
=> { optional
=> 1 },
484 max_filters
=> { optional
=> 1 },
485 max_policy
=> { optional
=> 1 },
486 hide_received
=> { optional
=> 1 },
487 rejectunknown
=> { optional
=> 1 },
488 rejectunknownsender
=> { optional
=> 1 },
489 conn_count_limit
=> { optional
=> 1 },
490 conn_rate_limit
=> { optional
=> 1 },
491 message_rate_limit
=> { optional
=> 1 },
492 verifyreceivers
=> { optional
=> 1 },
493 dnsbl_sites
=> { optional
=> 1 },
505 use PVE
::Tools
qw($IPV4RE $IPV6RE);
509 PMG
::Config
::Admin-
>register();
510 PMG
::Config
::Mail-
>register();
511 PMG
::Config
::Spam-
>register();
512 PMG
::Config
::ClamAV-
>register();
514 # initialize all plugins
515 PMG
::Config
::Base-
>init();
517 PVE
::JSONSchema
::register_format
(
518 'transport-domain', \
&pmg_verify_transport_domain
);
519 sub pmg_verify_transport_domain
{
520 my ($name, $noerr) = @_;
522 # like dns-name, but can contain leading dot
523 my $namere = "([a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?)";
525 if ($name !~ /^\.?(${namere}\.)*${namere}$/) {
526 return undef if $noerr;
527 die "value does not look like a valid transport domain\n";
535 my $class = ref($type) || $type;
537 my $cfg = PVE
::INotify
::read_file
("pmg.conf");
539 return bless $cfg, $class;
545 PVE
::INotify
::write_file
("pmg.conf", $self);
548 my $lockfile = "/var/lock/pmgconfig.lck";
551 my ($code, $errmsg) = @_;
553 my $p = PVE
::Tools
::lock_file
($lockfile, undef, $code);
555 $errmsg ?
die "$errmsg: $err" : die $err;
561 my ($self, $section, $key, $value) = @_;
563 my $pdata = PMG
::Config
::Base-
>private();
565 my $plugin = $pdata->{plugins
}->{$section};
566 die "no such section '$section'" if !$plugin;
568 if (defined($value)) {
569 my $tmp = PMG
::Config
::Base-
>check_value($section, $key, $value, $section, 0);
570 $self->{ids
}->{$section} = { type
=> $section } if !defined($self->{ids
}->{$section});
571 $self->{ids
}->{$section}->{$key} = PMG
::Config
::Base-
>decode_value($section, $key, $tmp);
573 if (defined($self->{ids
}->{$section})) {
574 delete $self->{ids
}->{$section}->{$key};
581 # get section value or default
583 my ($self, $section, $key) = @_;
585 my $pdata = PMG
::Config
::Base-
>private();
586 my $pdesc = $pdata->{propertyList
}->{$key};
587 die "no such property '$section/$key'\n"
588 if !(defined($pdesc) && defined($pdata->{options
}->{$section}) &&
589 defined($pdata->{options
}->{$section}->{$key}));
591 if (defined($self->{ids
}->{$section}) &&
592 defined(my $value = $self->{ids
}->{$section}->{$key})) {
596 return $pdesc->{default};
599 # get a whole section with default value
601 my ($self, $section) = @_;
603 my $pdata = PMG
::Config
::Base-
>private();
604 return undef if !defined($pdata->{options
}->{$section});
608 foreach my $key (keys %{$pdata->{options
}->{$section}}) {
610 my $pdesc = $pdata->{propertyList
}->{$key};
612 if (defined($self->{ids
}->{$section}) &&
613 defined(my $value = $self->{ids
}->{$section}->{$key})) {
614 $res->{$key} = $value;
617 $res->{$key} = $pdesc->{default};
623 # get a whole config with default values
627 my $pdata = PMG
::Config
::Base-
>private();
631 foreach my $type (keys %{$pdata->{plugins
}}) {
632 my $plugin = $pdata->{plugins
}->{$type};
633 $res->{$type} = $self->get_section($type);
640 my ($filename, $fh) = @_;
642 local $/ = undef; # slurp mode
644 my $raw = <$fh> if defined($fh);
646 return PMG
::Config
::Base-
>parse_config($filename, $raw);
650 my ($filename, $fh, $cfg) = @_;
652 my $raw = PMG
::Config
::Base-
>write_config($filename, $cfg);
654 PVE
::Tools
::safe_print
($filename, $fh, $raw);
657 PVE
::INotify
::register_file
('pmg.conf', "/etc/pmg/pmg.conf",
660 undef, always_call_parser
=> 1);
662 # parsers/writers for other files
664 my $domainsfilename = "/etc/pmg/domains";
666 sub postmap_pmg_domains
{
667 PMG
::Utils
::run_postmap
($domainsfilename);
670 sub read_pmg_domains
{
671 my ($filename, $fh) = @_;
677 while (defined(my $line = <$fh>)) {
679 next if $line =~ m/^\s*$/;
680 if ($line =~ m/^#(.*)\s*$/) {
684 if ($line =~ m/^(\S+)\s.*$/) {
686 $domains->{$domain} = {
687 domain
=> $domain, comment
=> $comment };
690 warn "parse error in '$filename': $line\n";
699 sub write_pmg_domains
{
700 my ($filename, $fh, $domains) = @_;
702 foreach my $domain (sort keys %$domains) {
703 my $comment = $domains->{$domain}->{comment
};
704 PVE
::Tools
::safe_print
($filename, $fh, "#$comment\n")
705 if defined($comment) && $comment !~ m/^\s*$/;
707 PVE
::Tools
::safe_print
($filename, $fh, "$domain 1\n");
711 PVE
::INotify
::register_file
('domains', $domainsfilename,
714 undef, always_call_parser
=> 1);
716 my $transport_map_filename = "/etc/pmg/transport";
718 sub postmap_pmg_transport
{
719 PMG
::Utils
::run_postmap
($transport_map_filename);
722 sub read_transport_map
{
723 my ($filename, $fh) = @_;
725 return [] if !defined($fh);
730 while (defined(my $line = <$fh>)) {
732 next if $line =~ m/^\s*$/;
733 if ($line =~ m/^#(.*)\s*$/) {
738 if ($line =~ m/^(\S+)\s+smtp:(\S+):(\d+)\s*$/) {
739 my ($domain, $host, $port) = ($1, $2, $3);
742 if ($host =~ m/^\[(.*)\]$/) {
754 $res->{$domain} = $data;
757 warn "parse error in '$filename': $line\n";
765 sub write_transport_map
{
766 my ($filename, $fh, $tmap) = @_;
770 foreach my $domain (sort keys %$tmap) {
771 my $data = $tmap->{$domain};
773 my $comment = $data->{comment
};
774 PVE
::Tools
::safe_print
($filename, $fh, "#$comment\n")
775 if defined($comment) && $comment !~ m/^\s*$/;
777 my $use_mx = $data->{use_mx
};
778 $use_mx = 0 if $data->{host
} =~ m/^(?:$IPV4RE|$IPV6RE)$/;
781 PVE
::Tools
::safe_print
(
782 $filename, $fh, "$data->{domain} smtp:$data->{host}:$data->{port}\n");
784 PVE
::Tools
::safe_print
(
785 $filename, $fh, "$data->{domain} smtp:[$data->{host}]:$data->{port}\n");
790 PVE
::INotify
::register_file
('transport', $transport_map_filename,
791 \
&read_transport_map
,
792 \
&write_transport_map
,
793 undef, always_call_parser
=> 1);
795 # config file generation using templates
797 sub get_template_vars
{
800 my $vars = { pmg
=> $self->get_config() };
802 my $nodename = PVE
::INotify
::nodename
();
803 my $int_ip = PMG
::Cluster
::remote_node_ip
($nodename);
804 my $int_net_cidr = PMG
::Utils
::find_local_network_for_ip
($int_ip);
805 $vars->{ipconfig
}->{int_ip
} = $int_ip;
806 # $vars->{ipconfig}->{int_net_cidr} = $int_net_cidr;
808 my $transportnets = [];
810 my $tmap = PVE
::INotify
::read_file
('transport');
811 foreach my $domain (sort keys %$tmap) {
812 my $data = $tmap->{$domain};
813 my $host = $data->{host
};
814 if ($host =~ m/^$IPV4RE$/) {
815 push @$transportnets, "$host/32";
816 } elsif ($host =~ m/^$IPV6RE$/) {
817 push @$transportnets, "[$host]/128";
821 $vars->{postfix
}->{transportnets
} = join(' ', @$transportnets);
823 my $mynetworks = [ '127.0.0.0/8', '[::1]/128' ];
824 push @$mynetworks, @$transportnets;
825 push @$mynetworks, $int_net_cidr;
827 # add default relay to mynetworks
828 if (my $relay = $self->get('mail', 'relay')) {
829 if ($relay =~ m/^$IPV4RE$/) {
830 push @$mynetworks, "$relay/32";
831 } elsif ($relay =~ m/^$IPV6RE$/) {
832 push @$mynetworks, "[$relay]/128";
834 # DNS name - do nothing ?
838 $vars->{postfix
}->{mynetworks
} = join(' ', @$mynetworks);
841 $usepolicy = 1 if $self->get('mail', 'greylist') ||
842 $self->get('mail', 'spf') || $self->get('mail', 'use_rbl');
843 $vars->{postfix
}->{usepolicy
} = $usepolicy;
845 my $resolv = PVE
::INotify
::read_file
('resolvconf');
846 $vars->{dns
}->{hostname
} = $nodename;
847 $vars->{dns
}->{domain
} = $resolv->{search
};
852 # rewrite file from template
853 # return true if file has changed
854 sub rewrite_config_file
{
855 my ($self, $tmplname, $dstfn) = @_;
857 my $demo = $self->get('admin', 'demo');
859 my $srcfn = ($tmplname =~ m
|^.?
/|) ?
860 $tmplname : "/var/lib/pmg/templates/$tmplname";
863 my $demosrc = "$srcfn.demo";
864 $srcfn = $demosrc if -f
$demosrc;
867 my ($perm, $uid, $gid);
869 my $srcfd = IO
::File-
>new ($srcfn, "r")
870 || die "cant read template '$srcfn' - $!: ERROR";
872 if ($dstfn eq '/etc/fetchmailrc') {
873 (undef, undef, $uid, $gid) = getpwnam('fetchmail');
875 } elsif ($dstfn eq '/etc/clamav/freshclam.conf') {
876 # needed if file contains a HTTPProxyPasswort
878 $uid = getpwnam('clamav');
879 $gid = getgrnam('adm');
883 my $template = Template-
>new({});
885 my $vars = $self->get_template_vars();
889 $template->process($srcfd, $vars, \
$output) ||
890 die $template->error();
894 my $old = PVE
::Tools
::file_get_contents
($dstfn, 128*1024) if -f
$dstfn;
896 return 0 if defined($old) && ($old eq $output); # no change
898 PVE
::Tools
::file_set_contents
($dstfn, $output, $perm);
900 if (defined($uid) && defined($gid)) {
901 chown($uid, $gid, $dstfn);
907 # rewrite spam configuration
908 sub rewrite_config_spam
{
911 my $use_awl = $self->get('spam', 'use_awl');
912 my $use_bayes = $self->get('spam', 'use_bayes');
913 my $use_razor = $self->get('spam', 'use_razor');
917 # delete AW and bayes databases if those features are disabled
919 $changes = 1 if unlink '/root/.spamassassin/auto-whitelist';
923 $changes = 1 if unlink '/root/.spamassassin/bayes_journal';
924 $changes = 1 if unlink '/root/.spamassassin/bayes_seen';
925 $changes = 1 if unlink '/root/.spamassassin/bayes_toks';
928 # make sure we have a custom.cf file (else cluster sync fails)
929 IO
::File-
>new('/etc/mail/spamassassin/custom.cf', 'a', 0644);
931 $changes = 1 if $self->rewrite_config_file(
932 'local.cf.in', '/etc/mail/spamassassin/local.cf');
934 $changes = 1 if $self->rewrite_config_file(
935 'init.pre.in', '/etc/mail/spamassassin/init.pre');
937 $changes = 1 if $self->rewrite_config_file(
938 'v310.pre.in', '/etc/mail/spamassassin/v310.pre');
940 $changes = 1 if $self->rewrite_config_file(
941 'v320.pre.in', '/etc/mail/spamassassin/v320.pre');
944 mkdir "/root/.razor";
946 $changes = 1 if $self->rewrite_config_file(
947 'razor-agent.conf.in', '/root/.razor/razor-agent.conf');
949 if (! -e
'/root/.razor/identity') {
952 PVE
::Tools
::run_command
(['razor-admin', '-discover'], timeout
=> $timeout);
953 PVE
::Tools
::run_command
(['razor-admin', '-register'], timeout
=> $timeout);
956 syslog
('info', msgquote
("registering razor failed: $err")) if $err;
963 # rewrite ClamAV configuration
964 sub rewrite_config_clam
{
967 return $self->rewrite_config_file(
968 'clamd.conf.in', '/etc/clamav/clamd.conf');
971 sub rewrite_config_freshclam
{
974 return $self->rewrite_config_file(
975 'freshclam.conf.in', '/etc/clamav/freshclam.conf');
978 sub rewrite_config_postgres
{
981 my $pgconfdir = "/etc/postgresql/9.6/main";
985 $changes = 1 if $self->rewrite_config_file(
986 'pg_hba.conf.in', "$pgconfdir/pg_hba.conf");
988 $changes = 1 if $self->rewrite_config_file(
989 'postgresql.conf.in', "$pgconfdir/postgresql.conf");
994 # rewrite /root/.forward
995 sub rewrite_dot_forward
{
998 my $dstfn = '/root/.forward';
1000 my $email = $self->get('admin', 'email');
1003 if ($email && $email =~ m/\s*(\S+)\s*/) {
1006 # empty .forward does not forward mails (see man local)
1009 my $old = PVE
::Tools
::file_get_contents
($dstfn, 128*1024) if -f
$dstfn;
1011 return 0 if defined($old) && ($old eq $output); # no change
1013 PVE
::Tools
::file_set_contents
($dstfn, $output);
1018 # rewrite /etc/postfix/*
1019 sub rewrite_config_postfix
{
1022 # make sure we have required files (else postfix start fails)
1023 postmap_pmg_domains
();
1024 postmap_pmg_transport
();
1026 IO
::File-
>new($transport_map_filename, 'a', 0644);
1030 if ($self->get('mail', 'tls')) {
1032 PMG
::Utils
::gen_proxmox_tls_cert
();
1034 syslog
('info', msgquote
("generating certificate failed: $@")) if $@;
1037 $changes = 1 if $self->rewrite_config_file(
1038 'main.cf.in', '/etc/postfix/main.cf');
1040 $changes = 1 if $self->rewrite_config_file(
1041 'master.cf.in', '/etc/postfix/master.cf');
1043 #rewrite_config_transports ($class);
1044 #rewrite_config_whitelist ($class);
1045 #rewrite_config_tls_policy ($class);
1047 # make sure aliases.db is up to date
1048 system('/usr/bin/newaliases');
1053 sub rewrite_config
{
1054 my ($self, $restart_services) = @_;
1056 if ($self->rewrite_config_postfix() && $restart_services) {
1057 PMG
::Utils
::service_cmd
('postfix', 'restart');
1060 if ($self->rewrite_dot_forward() && $restart_services) {
1061 # no need to restart anything
1064 if ($self->rewrite_config_postgres() && $restart_services) {
1065 # do nothing (too many side effects)?
1066 # does not happen anyways, because config does not change.
1069 if ($self->rewrite_config_spam() && $restart_services) {
1070 PMG
::Utils
::service_cmd
('pmg-smtp-filter', 'restart');
1073 if ($self->rewrite_config_clam() && $restart_services) {
1074 PMG
::Utils
::service_cmd
('clamav-daemon', 'restart');
1077 if ($self->rewrite_config_freshclam() && $restart_services) {
1078 PMG
::Utils
::service_cmd
('clamav-freshclam', 'restart');