iRedMail
// Document IndexAttention
Check out the lightweight on-premises email archiving software developed by iRedMail team: Spider Email Archiver.
Fixed issues:
roccoro for the report.Updated packages:
SECURITY UPDATE: Roundcube v1.6.5 and 1.5.6. Both fix a new cross-site scripting (XSS) vulnerability.
NOTES:
- Ubuntu 18.04 gets Roundcube v1.5.6 instead of v1.6.5 due to old php version, v1.5.6 contains the security fix too. Anyway, please consider upgrade OS to at least 20.04 LTS as soon as possible.
- CentOS / Rocky 7 gets Roundcube v1.5.2 due to old php version, this version does NOT contain the security fix which is fixed in v1.5.4, v1.5.5, v1.5.6, or v1.6.3, v1.6.4, v1.6.5. Please upgrade OS to at least CentOS Stream 8 / Rocky 8 and switch php to v8 immediately by following this tutorial.
Fail2ban: Do not ban client which triggers lost connection after UNKNOWN error.
Updated packages:
SECURITY UPDATE: Roundcube v1.6.4 and 1.5.5. Both fix a new cross-site scripting (XSS) vulnerability.
NOTES:
- Ubuntu 18.04 gets Roundcube v1.5.5 instead of v1.6.4 due to old php version, v1.5.5 contains the security fix too. Anyway, please consider upgrade OS to at least 20.04 LTS as soon as possible.
- CentOS / Rocky 7 gets Roundcube v1.5.2 due to old php version, this version does NOT contain the security fix which is fixed in v1.5.4, v1.5.5, v1.6.3, v1.6.4. Please upgrade OS to at least CentOS / Rocky 8 and switch php to v8 immediately by following this tutorial.
Fixed issues:
Not switch to nftables on Ubuntu 22.04.
Note: If you have custom firewall rules in
/opt/iredmail/custom/firewall/custom.shwithiptablescommand, you must switch to nftables manually.
Not disable cron job used to clean up Amavisd SQL db when Amavisd is not enabled.
/opt/iredmail/bin/apply_all_custom_settings.spamd service on Debian/Ubuntu.proc_get_status required by Roundcube plugin enigma.Updated packages:
SECURITY UPDATE: roundcube v1.6.3 and 1.5.4. Both fix the cross-site scripting (XSS) vulnerability.
NOTES:
- Ubuntu 18.04 gets Roundcube v1.5.4 instead of v1.6.3 due to old php version, v1.5.4 contains the security fix too. Anyway, please consider upgrade OS to 20.04 LTS as soon as possible.
- CentOS / Rocky 7 gets Roundcube v1.5.2 due to old php version, this version does NOT contain the security fix which is fixed in v1.5.4 and v1.6.3, please upgrade OS to at least CentOS / Rocky 8 and switch php to v8 immediately by following this tutorial.
smtputf8_enable = no).Supports new distribution releases:
Improvements:
Fixed issues:
rsyslog-rotate)./SOGo/. This avoid accessing to URI
with /SOGo prefix like /SOGotesting.Updated packages:
Supports new distribution releases:
Improvements:
Fixed issues:
URIBL_BLACK.Updated packages:
Improvements:
damiandabrowski5@GitHub for the contribution.uwsgi_read_timeout to 900 seconds for iRedAdmin-Pro,
so that exporting massive accounts can finish in time not cause the
famous '504 gateway timeout' error. Tested with 50000 mail accounts.Fixed issues:
Updated packages:
Roundcube webmail 1.5.3. Notes:
mlmmjadmin 3.1.5
Supports new distribution releases:
Improvements:
Fixed issues:
Updated packages:
Fixed issues:
/var/run/clamav/clamd.ctl.
Amavisd on some system may fail to connect to /tmp/clamd.socket.Updated packages:
Supports new distribution release:
Dovecot:
EECDH+CHACHA20 and remove weak AES256+EDH.Fail2ban:
Nginx:
ssl_session_cache parameter. See iredmail/iRedMail#136.SOGo:
/Microsoft-Server-ActiveSync in Nginx).Fixed issues:
Package updates:
Remove unused sql columns in vmail.mailbox:
Fix improper SQL column types in vmail and sogo databases:
SOGo:
Amavisd:
php-fpm:
Fixed issues:
Package updates:
add_subscribers() and
remove_subscribers() for backends.multi_accept on;. Thanks jinleileiking@GitHub.Fixed issues:
amavisd_wblist if antispam component is
not enabled.Package updates:
MariaDB and PostgreSQL backends:
maillist_owners. Used to store owner of (subscribable)
mailing lists.OpenLDAP:
mailList:listOwner: used to store owner(s) of (subscribable) mailing list.listModerator: used to store moderator(s) of (subscribable) mailing list.Dovecot:
Postfix:
ddXX.kasserver.com.Fail2ban:
ClamAV:
clamav-freshclam, not cron job anymore.Fixed issues:
/opt/iredmail/custom/<PROGRAM>/custom.sh after system reboot.
Note: it's now done by a cron job with special time @reboot for root user./opt/iredmail/bin/create_user: not set correct password and quota size.Package updates:
iRedAPD:
sql_ml_access_policy by default.Postfix:
static.X.X.X.X.clients.your-server.de.Package update:
Postfix:
SpamAssassin:
URIBL_SBL, URIBL_SBL_A.Fail2ban:
banned_db action.Fixed issues:
main.cf and master.cf if they're
regular files.web.py.Package updates:
Supports now distribution release:
Add /opt/iredmail/custom/custom.sh. It will be ran at the end of EACH
deployment.
Postfix:
Amavisd:
Fixed issues:
sope* packages while upgrading SOGo packages.Package updates:
SOGo:
Warning
SOGo may not successfully kill all its child processes and causes sogo
service failed to start. If it occurs, please stop SOGo service manually
(service sogo stop), kill orphan processes (pkill -9 sogod), then start
it manually (service sogo restart).
Nginx:
Amavisd:
msgs.from_address (changed
from VARCHAR to VARBINARY) for MariaDB and OpenLDAP backends.Dovecot:
Postfix:
(ns|ip)XXXX.ip-XX-XX-XX.eu,
"XX" is digit numbers) offered by OVH.com.
Note: If you run mail server on OVH platform with a fixed hostname and
valid PTR DNS record, it's not impacted.Chronyd (ntp alternative on CentOS 8):
-x option for chronyd if system is running in a LXC container.Package updates:
BIND (cache-only) DNS server:
127.0.0.1 in ifcfg-XXX scripts on CentOS.
Thanks Igor Cej for the feedback and help.Postfix:
<ip>.mail-campmail.facebook.com.Roundcube:
/opt/iredmail/custom/roundcube/custom.sh for advance customization.
It will be ran each time you (re-)deploy Roundcube or upgrade.127.0.0.1) IMAP server without TLS on Ubuntu 20.04
and CentOS 8. This is also considered as secure by Dovecot.SOGo:
Connect to local (127.0.0.1) IMAP server without TLS on Ubuntu 20.04
and CentOS 8. This is also considered as secure by Dovecot.
We received reports that Roundcube and SOGo have problem when TLS is explicitly enabled for IMAP service, unfortunately we didn't figure out what causes the issue yet. As a temporary fix, we choose to disable TLS for local connection.
Fail2ban:
Package updates:
Possible issue after upgraded on CentOS 8:
Old CentOS 8 releases shipped Dovecot-2.2.x, but the new 8.2.2004 release
suprisely ships Dovecot-2.3.8 which has some backward-incompatible settings.
iRedMail Easy will upgrade it from old version 2.2.36 and re-generates
its config files, it MAY fail to (re)start if you have unsupported
customized parameters set in config file under
/opt/iredmail/custom/dovecot/conf-enabled/.
Mostly customized parameter is ssl_protocols, it should be replace by
ssl_min_protocol.
For example, if you still need to support TLSv1, please set
ssl_min_protocol = TLSv1 instead. Default value is TLSv1.2.
Supports now distribution releases:
Postfix:
[] in mynetworks.postmaster (system) user which is used as
2bounce recipient.Fail2ban:
backend = pooling and journalmatch = (empty value)
to avoid performance issue and startup warnings in fail2ban log file.nginx-http-auth.Antispam:
debian-spamd to amavis group.msgs.time_iso.Adminer:
adminer.css
in same directory (/opt/www/adminer/).Improvements of iRedMail Easy platform:
Package updates:
Antispam:
/etc/mail/spamassassin/local.cf and razor.conf, must be owned by
user/group which is running Amavisd service, with permission 0640./opt/iredmail/custom/spamassassin/custom.cf for custom SpamAssassin
rules.Dovecot:
/etc/dovecot/dovecot-{mysql,pgsql,ldap}.conf./opt/iredmail/custom/dovecot/master-users for custom master users.
Please do not modify /etc/dovecot/dovecot-master-users.Firewall:
Nginx:
301 (permanent redirect) causes incorrect
redirection after switching homepage application from SOGo to other
web application. It's now replaced by 302 (temporarily redirect).Roundcube:
markasjunk.Improvements of iRedMail Easy platform:
/root/iRedMail/iRedMail.tips.Package updates:
CentOS 8 is now supported, all 3 backends (MariaDB, PostgreSQL, OpenLDAP) are available.
Note: RedHat dropped OpenLDAP server in RHEL 8, iRedMail Easy installs the
OpenLDAP server packages (symas-openldap-*) from yum repository offered
by Symas (the company behind OpenLDAP), package symas-openldap conflicts
with the openldap package available in official RHEL/CentOS 8 yum repo.
Drop support for OpenBSD 6.4, 6.5.
New script /opt/iredmail/bin/create_user: create single user with quota
support. Note: available for SQL backends.
Dovecot:
Nginx:
/opt/iredmail/custom/nginx/webapps/ used to store custom
settings for web applications, it should be useful if sysadmin wants to
add ACL control for the web application.Currently only 3 applications are supported: iRedAdmin, Roundcube, Adminer.
For example, Nginx loads /etc/nginx/templates/iredadmin.tmpl for
iRedAdmin, also loads extra settings from
/opt/iredmail/custom/nginx/webapps/iredadmin.conf. If you want to
limit the access to network 192.168.0.0/24, you can create file
/opt/iredmail/custom/nginx/webapps/iredadmin.conf with content below
and reload Nginx service:
```
allow 192.168.0.0/24;
deny all;
```
autoconfig.* and autodiscover.*.Roundcube:
pspell as default spell check engine.Amavisd:
msgs.subject doesn't support storing emoji characters.ClamAV:
libclamavunrar9 on Ubuntu for rar files.mlmmj (Mailing list manager):
altermime program is not available.Fail2ban:
Package updates:
Improvements of iRedMail Easy platform:
/etc/rsyslog.d/1-iredmail-iredapd.conf was incorrectly
rewritten by Prosody component./etc/rsyslog.d/0-iredmail-misc.conf, this file is now removed.PostgreSQL backend:
sender_relayhost.Postfix:
/opt/iredmail/custom/postfix/aliases: alias file./opt/iredmail/custom/postfix/sender_bcc: hash file./opt/iredmail/custom/postfix/recipient_bcc: hash file.Roundcube:
markasjunk by default. When message is moved to Junk
folder, it will be learnt as spam message. When message is moved from
Junk to any other folder, it will be learnt as clean message.Antispam:
From:
equals to To: address.OLE2BlockMacros was set to true, it's now false.Nginx:
Firewalll:
Netdata:
Backup scripts:
Improvements of iRedMail Easy platform:
request_slowlog_timeout to 60 seconds.Package updates:
Firewall:
iRedAdmin:
mlmmjadmin:
netdata:
Package updates:
Improvements of iRedMail Easy platform:
syspatch command.iRedMail Easy now supports OpenBSD 6.6.
Warning: OpenBSD 6.4 and 6.5 support will be dropped when 6.7 is out.
Dovecot:
Netdata:
OpenLDAP:
/opt/iredmail/custom/openldap/schema/ to store extra
LDAP schema files.Apparmor config file has been updated on Ubuntu to allow slapd program
to read config files from this directory.
mdb database since OpenBSD 6.6. OpenBSD 6.5 uses hdb.Postfix:
Roundcube:
Changes to iRedMail Easy platform:
ansible_all_ipv6_addresses is
undefined.OpenLDAP:
calentry.schema, calresource.schema.Postfix:
LIMIT 1 in SQL queries for better performance.Dovecot:
Firewall:
Nginx:
AntiSpam:
autodiscover:
Undefined offset php error./var/log/autoconfig/autoconfig.log.netdata:
Nginx was not chosen, netdata is inaccessible although
Nginx is actually deployed as dependent component.Move http auth file to /opt/iredmail/custom/netdata/.
Since netdata-1.17.0, netdata sets permission of directory
/opt/netdata/etc/netdata/ to 0700, this causes Nginx can not read
the http auth file.
Backup scripts:
Changes to iRedMail Easy platform:
priority parameter in iRedMail yum repo. (CentOS 7 only)/opt/iredmail/custom/openldap/custom.sh while
deploying or upgrading OpenLDAP. You can write shell commands in this
file to update other config files for advanced customization. for
example, updating /etc/sysconfig/slapd (CentOS) or
/etc/ldap/slapd (Debian/Ubuntu) to make OpenLDAP listening on all
available network interfaces and IP addresses./root/iRedMail/iRedMail.tips.Package updates:
Postfix:
Nginx:
/adminer/ to /adminer.Dovecot:
Add setting sieve_redirect_envelope_from=recipient. It's used to
rewrite sender address in redirected message (with sieve directive
redirect) to the final recipient address of the message.
For example, someone@gmail.com sends an email to user@domain.com
which is hosted on your server, and this user has sieve rule to
redirect received message to forward@3rd-domain.com, with default
Dovecot setting (sieve_redirect_envelope_from=sender), user
forward@3rd-domain.com will receive this email with sender address
someone@gmail.com in mail header, but with
sieve_redirect_envelope_from=recipient, the sender address will
be user@domain.com.
Log delivery_time of LDA/LMTP.
php-fpm:
post_max_size 1MB larger than upload_max_filesize, so
that Roundcube can successfully upload mail attachment.OpenDMARC:
public_suffix_list.dat every
2 days.SpamAssassin:
score SPF_FAIL 5: sender does not match SPF record (fail)score TO_EQ_FM_SPF_FAIL 5: To == From and external SPF failedscore TO_EQ_FM_DOM_SPF_FAIL 5: To domain == From domain and external SPF failedClamAV:
Fixed issues:
Package updates:
Changes to iRedMail Easy platform:
curl as required packages.%7.3) instead of version number for php on OpenBSD.Dovecot:
mailbox.enablequota-status. This
will cause mail rejection.Firewall:
/opt/iredmail/custom/firewall/custom.sh after each deployment.Dovecot:
dovecot-mysql for OpenLDAP backend on CentOS.Postfix:
/etc/resolv.conf to /var/spool/postfix/etc/.Nginx:
ATTENTION: directive ssl on; has been removed (in
/etc/nginx/templates/ssl.tmpl) due to it's deprecated by Nginx itself.
If you have custom web host, please use listen <port> ssl; in the
server {} block (in /etc/nginx/sites-enabled/*.conf) instead.
For example:
Old config file /etc/nginx/sites-enabled/00-default-ssl.conf:
server {
listen 443;
...
}
New directive:
server {
listen 443 ssl;
...
}
Firewall:
Package updates:
OpenDMARC integration.
Disable DMARC under
Settings tab.Roundcube:
password plugin: /opt/iredmail/custom/roundcube/config_password.inc.phpmanagesieve plugin: /opt/iredmail/custom/roundcube/config_managesieve.inc.phpPostfix:
Fixed: improper order of restriction rules in smtpd_sender_restrictions.
File /etc/postfix/sender_access.pcre is not used anymore, all content
in this file should be moved to
/opt/iredmail/custom/postfix/sender_access.pcre instead.
Nginx:
/etc/nginx/conf-available/gzip.conf).Few programs moved and/or renamed:
/opt/iredmail/bin/fail2ban_unbanip -> /opt/iredmail/bin/fail2ban/unbanip./opt/iredmail/bin/generate_password_hash.py -> /opt/iredmail/bin/generate_password_hash./opt/iredmail/bin/dovecot/scan_reported_mails.sh -> /opt/iredmail/bin/dovecot/scan_reported_mailsFixed issues of iRedMail Easy platform:
/etc/nginx/templates/misc.tmpl).freshclam immediately to fetch/update ClamAV virus database.Package updates:
Fail2ban:
Dovecot:
autoconfig:
/.well-known/autoconfig/mail/config-v1.1.xml.Improvements of iRedMail Easy platform:
Package updates:
Postfix:
header_checks and body_checks pcre maps.SOGo:
Package updates:
Improvements of iRedMail Easy platform:
Supports OpenBSD 6.5.
WARNING: OpenBSD 6.4 support will be removed when OpenBSD 6.6 is out. That means you must upgrade OpenBSD 6.4 to 6.5 before 6.6 is out.
Fixed: not enable php ldap extension for Roundcube for OpenLDAP backend.
iRedMail.tips file to postmaster after deployment.Roundcube
Dovecot:
Able to track user last (POP3/IMAP) login for OpenLDAP and MariaDB backends. It's disabled by default, you can enable it in iRedMail Easy user portal, in mail server profile page, tab "Settings".
Note: Dovecot doesn't support this with PostgreSQL yet.
Here's detailed tutorial to show you what changes are applied to Dovecot: Track user last login time.
Improvements of iRedMail Easy platform:
iRedMail.tips file to postmaster after deployment.Dovecot:
imapsieve setting to handle different IMAP command sent by
Microsoft Outlook (it sometimes uses APPEND instead of COPY for
moving message to another folder).iRedAPD:
Update to version 2.7, with SRS (Sender Rewriting Scheme) support.
Note: SRS is disabled by default, you can enable it in mail server profile page with the iRedMail Easy web UI.
Switch logging to syslog (and logrotate).
iRedAdmin:
BIND (local cache-only DNS server):
netdata:
SpamAssassin:
AutoConfig/AutoDiscover
autoconfig.<domain> and autodiscover.<domain> are not
required if the web domain is hosted on iRedMail server, Outlook will
look for https://<web-domain>/autodiscover/autodiscover.xml.Fail2ban:
SOGo:
Backup:
-o ldif-wrap=no, to avoid break long
line to multiple lines. The dumped LDIF file is easier to work with
grep and other command line tools.Improvements of iRedMail Easy platform:
::1 if system doesn't
have IPv6 support.nginx -t for troubleshooting before
restart nginx servvice, it's very useful for troubleshooting.Trusted clients in mail server profile page, under tab
Settings. You can list all trusted IP addresses or CIDR networks here,
they will be whitelisted by few components:mynetworks in /etc/postfix/main.cfMYNETWORKS in /opt/iredapd/settings.pyignoreip in /etc/fail2ban/ignoreip.localFixed issues of iRedMail Easy platform:
Improvements:
Fixed issues:
Package updates:
Enable imapsieve plugin in Dovecot by default.
Message moved to Junk folder will be copied to a directory for spam learning later, vice verse, message moved out of Junk will be copied for ham learning later.
The spam/ham learning will be performed every 10 minutes with a cron job.
Now encourage your users to report spams by moving spams to Junk folder. :)
Fixed issues:
Updated packages:
Hello, 2019. :)
Attention
/etc/iredmail-release on your server./opt/www/well-known, mostly used for Let's Encrypt cert
request./etc/init.d/ip6tables/etc/default/ip6tablesmonitor by default.departmentNumber.imjournal for rate limit control.