forked from iredmail/iRedMail
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathChangeLog
2037 lines (1809 loc) · 89.1 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
iRedMail-1.x.x:
* Updated packages:
+ netdata -> 1.35.1
iRedMail-1.6.0:
* Supports new distribution release:
+ Ubuntu 22.04 LTS (jammy)
* Improvements:
- [SOGo] Create SQL VIEW in `vmail` database, so that end users can
change their own passwords.
* Updated packages:
+ iRedAdmin -> 1.7
+ netdata -> 1.34.1
+ mlmmjadmin -> 3.1.4
iRedMail-1.5.2:
* Improvements:
- Roundcube: Log client IPs by default.
* Fixed issues:
- Can not login to SOGo webmail due to small (Nginx) proxy buffer size.
Thanks to Sysadminfromhell for the report in https://forum.iredmail.org/.
- [Amavisd] Override @av_scanners_backup settings in other config
snippet files.
- [MySQL] Can not remove record which contains non-ascii character
from table `domain_admins` with unexpected collate.
* Updated packages:
+ netdata -> 1.33.1.
iRedMail-1.5.1:
* Updated packages:
+ Roundcube webmail -> 1.5.2.
Addresses one XSS security fix, also fixes some minor issues.
iRedMail-1.5.0:
* Supports new distribution releases:
+ OpenBSD 7.0
* DROPPED distribution release:
- CentOS 7, CentOS 8. Please use CentOS Stream 8 or Rocky Linux 8 instead.
- CentOS 7 is too old.
- CentOS 8 is end-of-life after Dec 31, 2021.
- Debian 10. Please use Debian 11 instead.
- Debian 10 enters LTS on July 2022. "Debian LTS is not handled by
the Debian security team, but by a separate group of volunteers
and companies interested in making it a success."
- Ubuntu 18.04. Please use Ubuntu 20.04 instead.
- Users chose 20.04 more than 18.04, so better just let it go.
* Improvements:
+ Nginx: Greatly improve the performance of keep-alive connections over
SSL by enabling `ssl_session_cache`.
See also #136, thanks to @ludovicandrieux.
+ Nginx: Enable TLSv1.3 by default.
See also #137, thanks to @ludovicandrieux.
+ Nginx/Dovecot: Add new ssl cipher: EECDH+CHACHA20, remove weak one: AES256+EDH.
See also #138, thanks to @ludovicandrieux.
+ Postfix now enables smtps (port 465) by default.
+ Fail2ban: Add one more rule to catch auth error in Postfix log file.
+ SOGo is now available on Debian 11 (bullseye). Thanks to SOGo team.
* Fixed issues:
- Updating password in Roundcube may fail with error
`Encryption function missing`.
* Updated packages:
+ Roundcube webmail -> 1.5.1. Note: PHP 5.5 or later is required.
+ mlmmjadmin -> 3.1.3
+ netdata -> 1.32.1
+ iRedAPD -> 5.0.4
+ iRedAdmin -> 1.6
+ [OpenBSD] fail2ban -> 0.11.2
+ [OpenBSD] uwsgi -> 2.0.20
iRedMail-1.4.2:
* Improvements:
- Remove unused LDAP attribute in iredmail.schema:
- lastLoginDate
- lastLoginIP
- lastLoginProtocol
- Remove unused sql columns in `vmail` database:
- mailbox.lastlogindate
- mailbox.lastloginipv4
- mailbox.lastloginprotocol
* Fixed issues:
- Incorrect PostgreSQL column types in `vmail` and `sogo` databases.
iRedMail-1.4.1:
* Supports new distribution releases:
+ Debian 11 (bullseye)
+ FreeBSD 13.0
* Improvements:
+ Introduce new LDAP attribute/value pairs and SQL columns used to
enable or disable per-user SOGo webmail, calendar and activesync
services.
+ Add some ban rules in Amavisd:
+ ALLOW_MS_OFFICE: Allow all Microsoft Office documents.
+ ALLOW_MS_WORD: Allow Microsoft Word documents (.doc, .docx).
+ ALLOW_MS_EXCEL: Allow Microsoft Excel documents (.xls, .xlsx).
+ ALLOW_MS_PPT: Allow Microsoft PowerPoint documents (.ppt, .pptx).
* Fixed issues:
- Allow more sendgrid HELO hostnames.
Thanks to Jim Nelin for the feedback.
* Updated packages:
+ iRedAdmin -> 1.5
+ iRedAPD -> 5.0.3
+ netdata -> 1.31.0
+ mlmmjadmin -> 3.1.2
iRedMail-1.4.0:
* Supports new distribution releases:
+ CentOS 8 Stream. All backends are supported: MariaDB, PostgreSQL, OpenLDAP.
+ AlmaLinux 8. All backends are supported: MariaDB, PostgreSQL, OpenLDAP.
+ Rocky Linux 8. All backends are supported: MariaDB, PostgreSQL, OpenLDAP.
Tested with Rocky Linux 8.3 rc1.
+ OpenBSD 6.9. All backends are supported: MariaDB, PostgreSQL, OpenLDAP.
* DROPPED distribution release:
- Debian 9 (stretch). Please use Debian 10 instead.
* Improvements:
- SQL backends: New sql table `maillist_owners`. Used to store owners
of subscribeable mailing lists. With this new table, if self-service
is enabled in iRedAdmin-Pro, mailing list owner is able to login to
iRedAdmin-Pro and manage profile and members of owned mailing lists.
- SQL backends: Drop 4 unused SQL columns in `vmail.mailbox` table:
- allowedsenders
- rejectedsenders
- allowedrecipients
- rejectedrecipients
- OpenLDAP backend: New attributes `listModerator` and `listOwner`.
Used to to store moderator and owner of subscribeable mailing lists.
With these new attributes, if self-service is enabled in
iRedAdmin-Pro, mailing list owner is able to login to iRedAdmin-Pro
and manage profile and members of owned mailing lists.
- Fail2ban now stores (base64) encoded log lines in SQL database to
avoid possible SQL injection.
- Enable long queue id support in logwatch.
* Fixed issues:
- Whitelist HELO hostname used by Microsoft Outlook/Hotmail servers.
- tools/backup_pgsql.sh: Not dump databases with `--clean` argument.
- Not install nftables package on Ubuntu 20.04.
- [OpenBSD] Used wrong Python MySQL driver name in iRedAPD.
- Fail2ban can not store banned IP address when its country name
contains quotes.
* Updated packages:
+ Roundcube webmail -> 1.4.11. Security and bug fixes.
+ netdata -> 1.30.1
+ mlmmjadmin -> 3.1
+ iRedAPD -> 5.0
+ iRedAdmin -> 1.3
iRedMail-1.3.2:
* Supports new distribution releases:
+ OpenBSD 6.8. All backends are supported: MariaDB, PostgreSQL, OpenLDAP.
Note: Fail2ban is not available on OpenBSD 6.8, because the latest
Fail2ban-0.11.1 doesn't fully support Python-3.8.6 offered by
OpenBSD 6.8.
+ FreeBSD 12.2.
* DROPPED distribution release:
- OpenBSD 6.7. Please use the latest stable release 6.8 instead.
* Improvements:
+ [Nginx] Enable http2 support by default.
+ [Roundcube] Enable plugin `zipdownload` by default. It adds an
option to download all attachments in a message to one zip file,
when the message has multiple attachments.
+ [Amavisd] Log matched virus database name.
* Fixed issues:
- [FreeBSD] Can not correctly generate random password on FreeBSD
12.1-RELEASE-p10.
- [Fail2ban] Not catch all Roundcube login failures.
- tools/create_mail_user_OpenLDAP.*: missing required ldap attr/value
pairs: `enabledService=managesievetls` and `enabledService=sievetls`.
* Updated packages:
+ Roundcube webmail -> 1.4.9
+ netdata -> 1.26.0
+ uwsgi -> 2.0.19.1. OpenBSD only.
+ mlmmjadmin -> 3.0.4
+ iRedAPD-4.6
+ iRedAdmin-1.2
+ FreeBSD: perl-5.32
iRedMail-1.3.1:
* Fixed issues:
- Fail2ban match rules were not up to date to match log lines produced
by the latest Roundcube.
Thanks Igor Cej for the feedback.
* Updated packages:
+ Roundcube webmail 1.4.7, with one security fix.
+ netdata -> 1.23.1
+ iRedAPD-4.2, with a critical issue fixed.
iRedMail-1.3:
* Supports new distribution releases:
+ Ubuntu 20.04. All backends are supported: MariaDB, PostgreSQL, OpenLDAP.
+ OpenBSD 6.7. All backends are supported: MariaDB, PostgreSQL, OpenLDAP.
* DROPPED distribution release:
- OpenBSD 6.6. Please use the latest stable release 6.7 instead.
* Improvements:
+ Enable SOGo for CentOS 8 and Ubuntu 20.04. Thanks to SOGo team.
+ Port scripts `tools/*.py` to Python 3.
* Fixed issues:
- Enable TLSv1 on CentOS 7 due to the php package doesn't support TLSv1.2.
- Fix incorrect permission of Fail2ban log file, should be 0755 so
that netdata can read banned/unbanned info.
- Add missing INDEX for SQL column `msgs.time_iso` in `amavisd`
database.
* Updated packages:
+ Roundcube webmail -> 1.4.6, it includes few security fixes.
+ iRedAPD -> 4.1. WARNING: Python 3.5+ is required, Python 2 support
has been completely dropped.
+ mlmmjadmin -> 3.0. WARNING: Python 3.5+ is required, Python 2
support has been completely dropped.
+ netdata -> 1.23.0
iRedMail-1.2.1:
* Switch self-signed ssl cert key length to 4096.
* Swith DKIM key length to 2048.
* Updated packages:
+ Roundcube webmail -> 1.4.4. it includes few security fixes.
iRedMail-1.2:
* Supports new distribution release:
+ CentOS 8
* Dropped distribution release:
- OpenBSD 6.5. Please use the latest stable release 6.6 instead.
* Improvements:
+ Able to store banned IP addresses in SQL db.
iRedAdmin-Pro customers can view banned addresses and unban them on
web UI directly.
+ Fail2ban now works on OpenBSD.
+ Track last login of both POP3/IMAP logins.
* Fixed issues:
- Use 'pspell' spell check engine instead of default 'googie' which
sends data to Roundcube website.
- Not install package `libclamunrar9` for unpacking rar file on Ubuntu.
- installer: not correctly update allowed_clients in php-fpm pool
config file for FreeBSD Jail.
- Amavisd can not store mail subject with emoji characters.
* Updated packages:
+ Roundcube webmail -> 1.4.3
+ iRedAPD -> 3.6
+ netdata -> 1.21.1
iRedMail-1.1:
* Improvements:
- tools/backup_*.sh: do not rely on Python to calculate dates.
* Fixed issues:
- PostgreSQL backend: improper index for table `vmail.sender_relayhost`.
- LDAP backend: improper filter which causes missing external members
while querying (not-subscribeable) mailing list with alias domain.
Thanks to Alyssa Hullinger for the report.
- Backup MX doesn't work.
- rsyslog config file `/etc/rsyslog.d/1-iredmail-iredapd.conf` doesn't
work on CentOS.
- Installer:
- Not enable IPv6 in Nginx.
- Not disable checks for energid in netdata.
Port 9998 is used by Amavisd and energid (not installed by
iRedMail) by default, netdata will try to send http request to
this port, hence it causes error message in Amavisd log file each
time netdata starts.
- Not correctly set Nginx log file path in Fail2ban.
- Not set message size limit in Roundcube ($config['max_message_size']).
- Not remove `!SSLv2` in Dovecot on Ubuntu 18.04.
Note: SSLv2 is actually disabled by OpenSSL.
* Updated packages:
+ Roundcube -> 1.4.2.
+ iRedAdmin -> 1.0
+ iRedAPD -> 3.4.
+ FreeBSD: postgresql-12, python-3.8, php-7.4
iRedMail-1.0:
* Supports new distribution release:
+ OpenBSD 6.6
* Improvements:
- Netdata: Replace few Python modules by Go modules to collect data
for better performance.
- Disable email notification since netdata is too sensitive and the
notification message is "useless".
* Fixed issues:
- Timeout for clamd service to load virus database is too short on
CentOS 7.
- Rejects the new Facebook servers which contain IP address in their
HELO identities.
* Updated packages:
+ Roundcube webmail -> 1.4.1
+ iRedAPD -> 3.3
+ iRedAdmin -> 0.9.9
+ netdata -> 1.19.0
iRedMail-1.0-beta2:
* Removed OpenDMARC integration due to internal bug which caused incorrect
email rejection. Bug reported to upstream:
https://github.com/trusteddomainproject/OpenDMARC/issues/50
* Improvements:
+ tools/backup_*.sh: Remove old empty backup directory.
* Fixed issues:
- Incorect SSL CA file path on FreeBSD.
- Improper postrotate command for log files on Linux.
* Updated packages:
+ iRedAPD -> 3.2
+ netdata -> 1.18.0
iRedMail-1.0-beta1:
* Supports new distribution release:
+ OpenBSD 6.5
+ Debian 10
* Drop support for old distribution releases:
- OpenBSD 6.4
- Ubuntu 16.04, 18.10.
NOTE: We have no plan to support non-LTS edition anymore, only the
latest LTS edition will be supported.
* Drop support for OpenBSD ldapd backend.
* Improvements:
+ Dovecot:
- Enable quota-status service. Postfix can query this service and
reject email immediately if user's mailbox is over quota.
- Enable tracking user loast login time by default for
MySQL/MariaDB and OpenLDAP backends.
Note: Dovecot doesn't support this with PostgreSQL yet.
+ netdata: Disable sending anonymous statistics to netdata cloud.
* Fixed issues:
- Improper order of restriction rules in Postfix
`smtpd_sender_restrictions` setting.
- Fail2ban jail config file doesn't correctly set sshd port number(s).
- Loose Fail2ban filter rules (postfix/dovecot) to reduce negative bans.
- [Linux] Not send kill signal to php-fpm daemon process to reopen log
file after logrotation.
- tools/create_mail_user_OpenLDAP.py:
- Fix missing comma which causes incorrect value of
ldap attribute 'enabledService'.
Thanks Michael Chong.
* Updated packages:
+ Roundcube webmail -> 1.3.10
+ iRedAdmin -> 0.9.8
+ iRedAPD -> 3.1
+ mlmmjadmin -> 2.1
+ netdata -> 1.17.0
+ php -> 7.3 (FreeBSD only)
iRedMail-0.9.9 (Dec 17, 2018):
* Supports new distribution release:
+ OpenBSD 6.4
+ Ubuntu 18.10. WARNING: It receives only 9 months of security and
maintenance updates, until July 2019.
NOT RECOMMENDED FOR PRODUCTION SERVER.
* Improvements:
+ netdata is able to monitor OpenLDAP.
+ SOGo now supports resource management with OpenLDAP backend.
+ Add rc script and rules for ip6tables on Debian/Ubuntu.
+ iRedAdmin is now running as a standalone uwsgi instance (service
name 'iredadmin'), not controlled by 'uwsgi' service anymore.
+ Use /opt/www to store web applications on all Linux distros and
OpenBSD.
+ Able to set per-user mailbox format (e.g. mdbox) and mailbox folder
appended to maildir path in SQL/LDAP.
+ Switch to utf8mb4 as default character set in MySQL.
+ Set file/directory permission to 0400 for dumpped SQL backup files.
+ OpenLDAP log file has been moved to /var/log/openldap/openldap.log
(was /var/log/openldap.log).
* Fixed issues:
- Not correctly generate/update firewall rules if ssh is listening on
2 network ports.
- Not index ldap attribute `mobile`.
- Not always specify a plain text footer file for altermime to update
email sent to mlmmj mailing list.
+ Use accurate Nginx url match for Roundcube.
- mlmmjadmin:
- Not set correct owner/group for config file.
- Not use correct syslog socket path on FreeBSD.
- SQL backends:
- Not handle alias domains for relay in Postfix.
* Updated packages:
+ Roundcube -> 1.3.8
+ iRedAdmin -> 0.9.2
+ iRedAPD -> 2.3
+ mlmmjadmin -> 1.9
+ netdata -> 1.11.1
+ uwsgi -> 2.0.17.1 (OpenBSD only)
iRedMail-0.9.8:
* Supports new distribution release:
+ OpenBSD 6.2, 6.3
+ Ubuntu 18.04
* Dropped distribution releases:
+ RHEL/CentOS 6
+ Ubuntu 14.04 LTS, 17.04
+ Debian 8
+ OpenBSD 6.1
* Remove components:
- Apache has been removed, Nginx is the only one web server available.
* New components:
+ netdata (1.10.0) monitor integration: http://my-netdata.io
Note: netdata currently works on Linux and FreeBSD, not OpenBSD.
- Integrate netdata on Linux server:
https://docs.iredmail.org/integration.netdata.linux.html
- Integrate netdata on FreeBSD server:
https://docs.iredmail.org/integration.netdata.freebsd.html
+ Integrate 'mlmmj' mailing list manager, and 'mlmmjadmin' RESTful API
server for easy mlmmj management.
- mlmmj: http://mlmmj.org/
- mlmmjadmin (developed and maintained by iRedMail team):
https://github.com/iredmail/mlmmjadmin
- Integrate mlmmj & mlmmjadmin:
- LDAP backends: https://docs.iredmail.org/integration.mlmmj.ldap.html
- MySQL/MariaDB backends: https://docs.iredmail.org/integration.mlmmj.mysql.html
- PostgreSQL backend: https://docs.iredmail.org/integration.mlmmj.pgsql.html
Note: mlmmj & mlmmjadmin are now core components in iRedMail.
* Improvements:
- SQL backends:
- New table: maillists.
- New columns: domain.maillists, forwardings.is_maillist.
- Removed column: mailbox.local_part.
It's inherited from PostfixAdmin at the beginning, but not used
by any applications, time to drop it.
- Table renamed: alias_moderators -> moderators.
- LDAP backend:
- Allow mail list account to use 2 attributes: member, uniqueMember.
- Nginx: redirect all traffic from http to https by default.
- Fail2ban: new jail `postfix-pregreet`.
- Dovecot: Log subject, sender, size in mail deliver log.
- Amavisd: Add new sql column `maddr.email_raw` and trigger to store
email address without address extension.
* Fixed issues:
- iRedMail Installer:
- not correctly configure SOGo with IPv6 SQL server address.
Thanks to Wraptor <nijs.thibaut _at_ gmail.com> for the report in
forum.
- not check whether mailbox storage is set to /root.
- Postfix: don't block the HELOs used by SendGrid.
- Nginx:
- Use single config file for default web hosts.
- [SECURITY FIX] Not block access to Roundcube sensitive files.
- SOGo: Cannot sync contacts on Android devices via EAS.
- Amavisd: cannot store mail subject if contains emoji.
- SQL backends:
- User under disabled domain is able to send email with smtp protocol.
- Add new SQL column `mailbox.enableimaptls`, required by
Dovecot-2.3.
- tools/backup_sogo.sh
- Not set correct owner and permission on backup files.
- Cannot remove old backup files.
- tools/backup_openldap.sh:
- Cannot log backup result to SQL db.
Note: backup is fine, just no log in SQL db.
Thanks swejun <ingvar _at_ zebware.com> for the feedback and fix
in forum.
- tools/create_mail_user_*:
- Not use current date as password last change date for newly
created user.
- tools/migrate_sql_alias_table.py:
- Doesn't support 'utf8' charset.
Thanks Kacper Guzik <kacper.guzik _at_ zenbox _dot_ pl> for the
report and code contribution.
* Updated packages:
+ Roundcube -> 1.3.5
+ iRedAdmin -> 0.9
+ iRedAPD -> 2.2
+ uwsgi -> 2.0.17 (OpenBSD only)
+ SOGo -> 4.0 (switched yum/apt repo to SOGo v4 nightly builds)
iRedMail-0.9.7:
* Supports new distribution release:
+ OpenBSD 6.1. OpenBSD 6.0 is not supported anymore.
+ Ubuntu 17.04. Ubuntu 16.10 is not supported anymore.
+ Debian 9 (code name: stretch). Tested with Debian 9 RC3.
* Improvements:
- SQL structure change (for SQL backends): drop few columns in sql
table `vmail.alias`, and creates 2 new tables: forwardings,
alias_moderators. For more technical details, please check this issue:
https://bitbucket.org/zhb/iredmail/issues/101
- SOGo:
+ New script 'tools/backup_sogo.sh'. used to backs up SOGo data
with 'sogo-tool backup' command.
- Fail2ban:
+ Add one new regular expession to filter Roundcube log.
+ Enable 2 new jails: apache-auth, nginx-http-auth.
+ Split jail.local to multiple modular jail config files under
/etc/fail2ban/jail.d.
- Nginx: Use different directories to store different type of config
files for easier customization.
- /etc/nginx/conf.d/ - store configurations used inside 'http {}'
- /etc/nginx/sites-available/ - store config files for web sites.
All files under this directory are NOT loaded by default.
- /etc/nginx/sites-enabled/ - store config files for web sites.
All files under this directory will be loaded by default.
Usually file under this directory is a symbol link to file under
/etc/nginx/sites-available/. This way we can easily enable or
disable a site without renaming or moving its config file.
- /etc/nginx/sites-conf.d/ - store per-site modular config files.
for example, for web domain 'iredmail.org', we use directory
'/etc/nginx/sites-conf.d/iredmail.org/' to store modular config
files for all its http settings, and
'/etc/nginx/sites-conf.d/iredmail.org-ssl/' for all https
settings. You can use a prefixed digital number or letter to
define the order of config files loaded by Nginx. For example,
'00-listen.conf' will be loaded before other files.
NOTE: of course you're not forced to use this directory, and
you're free to write all settings in one file like
'/etc/nginx/sites-available/<site>.conf'. it's just a different
way (which we think it's better) to manage per-site settings.
Examples:
- sites-conf.d/iredmail.org/server_name.conf: define the server
name ('server_name iredmail.org;')
- sites-conf.d/iredmail.org/listen.conf: define the listen port
('port 80;').
- sites-conf.d/iredmail.org/root.conf: define the document root
directory ('root /var/www/vhosts/iredmail.org;')
- Generate /root/.my.cnf-<sql-user>:
- /root/my.cnf-vmail
- /root/my.cnf-vmailadmin
- /root/my.cnf-amavisd
- /root/my.cnf-iredapd
- /root/my.cnf-iredadmin
- /root/my.cnf-sogo
- /root/my.cnf-roundcube
* Fixed issues:
- Enable 'iterate_query =' in 'dovecot-mysql.conf', so that doveadm
works fine if it needs to get all mail users.
- Not enable cron job for iRedAdmin script: tools/delete_mailboxes.py.
Thanks sergiocesar <sergio _at_ winc.net> for the report.
- tools/backup_mysql.sh: Backup sql databases with mysqldump option
'--skip-comments' to avoid possible backdooring hack.
FYI: https://blog.tarq.io/cve-2016-5483-backdooring-mysqldump-backups/
- FreeBSD:
- installing port 'archives/arj' interrupts iRedMail installation.
This is caused by global variable 'LANGUAGE=C'.
- Cannot reset MySQL (5.7) password.
* Updated packages:
+ iRedAPD -> 2.1
+ iRedAdmin -> 0.8
+ Roundcube -> 1.3.0
+ uwsgi -> 2.0.15 (OpenBSD only)
iRedMail-0.9.6:
* Supports new distribution release:
+ OpenBSD 6.0. OpenBSD 5.9 is not supported anymore.
+ FreeBSD 11.0.
+ Ubuntu 16.10. WARNING: Ubuntu 16.10 will end of life in July 2017,
Ubuntu 16.04 LTS edition is recommended for a production server.
* Improvements:
- Use rsyslog (requires version 8.x) instead of internal logging system
for Dovecot on CentOS 7 and Ubuntu 16.04, 16.10.
rsyslog is default syslog program on CentOS, Debian and Ubuntu.
With rsyslog, we're able to discard log messages which matches
given regular expressions if it produces too fast. for example,
HAProxy performs health check every few seconds for POP3/IMAP (and
other) services, we can easily discard those health check related
logs to save disk space.
- Switch Awstats user authentication from SQL/LDAP to basic auth based
on file, Awstats is now available for both Apache and Nginx.
- Installer:
+ Able to choose not to install web server and web applications.
- Nginx:
- Add HSTS header for Roundcube, iRedAdmin, SOGo.
- Add sample config files to run Roundcube, iRedAdmin, SOGo as a
subdomain.
- Roundcube webmail:
- Enable plugin `enigma` by default for PGP encryption.
WARNING: The plugin uses gpg binary on the server and stores all
keys (including private keys of the users) on the server.
Encryption/decryption is done server-side. So, this plugin
is for users that trust the server.
If you get error `Identity must have a user name defined` while
first trying to generate gpg key, please add a name for your
email account in Roundcube: `Settings -> Identities`.
- SOGo:
- List all contacts by default in SOGo global address book.
- FreeBSD:
- Switch from OpenSSL to LibreSSL by default.
* Fixed issues:
- LDAP backends: mail accounts (user, alias, list) are still active
when domain is disabled.
- Fix the HTTPROXY vulnerability in Apache and Nginx.
Reference: https://httpoxy.org/
- Not convert domain name and email address to lower cases while
creating mail accounts with scripts tools/create_mail_user_*.
Thanks Santosh Gupta <head.it _at_ satmatechnologies.com> for the
report.
- SOGo:
- Not correctly redirect access to https in Apache.
- Postfix:
- Not enable opportunistic TLS support for remote smtp clients.
- Incorrect HELO restriction rule which causes Postfix rejects smtp
session with HELO "[IP_ADDRESS]" (with squared brackets).
- Nginx:
- Not allow access to '/.well-known/'.
- Not forward real client IP address to SOGo.
- Config file for catch-all virtual host `default.conf` has been
renamed to `00-default.conf`, to make sure it will be loaded
before other virtual host config files.
- Roundcube webmail:
- Missing cron job used to clean up old Roundcube temporary files
(bin/gc.sh).
- Not set proper file owner (apache/nginx) and permission (0600)
for config file of password plugin.
- iRedAPD:
- Not add FreeBSD Jail IP address as trusted client. This causes
mail delivery failure while sending to user under same domain.
Thanks Erez Zabusky <erez_z _at_ cre8ip.com> for the report.
- OpenBSD:
- not enable uwsgi service.
- not create symbol links for PHP programs.
* Updated packages:
+ Roundcube -> 1.2.3
+ iRedAPD -> 2.0
+ iRedAdmin -> 0.7
+ uwsgi -> 2.0.14 (OpenBSD only)
+ FreeBSD:
- php-7.0
- mysql-5.7
iRedMail-0.9.5-1:
* Fixed issues:
- Postfix:
- Cannot deliver email to system account.
- OpenLDAP:
- Incorrect default password scheme if module 'pw-sha2' is not
available.
- PHP
- Allow functions: 'popen', 'openlog'. Required by Roundcube.
- Incorrect compress command used in logrotate config files.
- Add missing package 'mcrypt' on RHEL/CentOS 6.
* Updated packages:
+ iRedAPD -> 1.9.1
iRedMail-0.9.5:
* Supports new distribution release:
+ Ubuntu 16.04 LTS (code name: xenial).
+ OpenBSD 5.9.
* Drop support for old distribution releases:
- Ubuntu 15.10 (code name: wily).
- OpenBSD 5.8.
- Debian 7 (code name: Wheezy). Please use Debian 8 instead.
Debian team stops offering security updates for Debian 7 after
April 25, 2016. Reference: https://wiki.debian.org/DebianOldStable
* Improvements:
- Postfix:
+ Supports Postfix parameter `sender_dependent_relayhost_maps`.
+ SMTP SASL AUTH is disabled on port 25. Please use port 587 instead.
- Amavisd:
+ Add custom Amavisd log template (at log level 0) to always log
SpamAssassin testing result.
- OpenLDAP:
+ Switch OpenLDAP backend to mdb (Memory-Mapped DB backend to slapd)
on Linux and FreeBSD (not available on OpenBSD yet).
+ Enable OpenLDAP overlay 'pw-sha2' to support password verification
with sha2 algorithms.
- SOGo:
+ SOGo is configured to store password in SSHA512 (instead of ssha)
hash by default.
+ Switch SOGo to 3.x from 2.x on Linux/FreeBSD (OpenBSD offers v2).
+ Able to enable/disable sogo service for a single user with new SQL
column `mailbox.enablesogo` and LDAP attribute/value
`enabledService=sogo`.
- OpenBSD ldapd(8):
+ Add script and daily cron job to backup ldapd.
* Fixed issues:
- Not correctly setup Fail2ban jail `action=` setting to block bad ssh
client IP address.
- Improper proxy timeout setting in SOGo and Nginx which cause SOGo
error 'client disconnected during delivery of response'.
- Not correctly add Postfix alias 'virusalert: root' for
non-(Debian/Ubuntu) OSes.
- Not create directory used to store php session files.
- Not enable cron job to auto update SpamAssassin rules on RHEL/CentOS.
* Updated packages:
+ Roundcube webmail -> 1.1.5
+ iRedAdmin -> 0.6
+ iRedAPD -> 1.9.0
iRedMail-0.9.4:
* New scripts:
- tools/fail2ban_unban_ip.sh. Used to unban specified IP addresses
from ALL fail2ban jails.
* Fixed issues:
- Not enable port 25 in OpenBSD PF rule.
- Not detect IPv6 support on server.
- Not correct set file permission of /etc/mail/mailer.conf on FreeBSD.
- Not install port 'www/sogo-activesync' on FreeBSD.
- Installation inside FreeBSD Jail:
- Not correctly set MySQL/PostgreSQL/SOGo/Amavisd bind addresses.
- Not updating Postfix `mynetworks=` to use specified local
address.
Thanks Peter2121 <peter _at_ flytrace.com> for the report in forum.
- Use only 2 DNSBL services in postscreen service:
zen.spamhaus.org, b.barracudacentral.org.
- Cannot use specified MySQL root password on command line while
installing with remote MySQL server.
* Updated packages:
+ Roundcube webmail -> 1.1.4
+ iRedAPD -> 1.8.0
+ iRedAdmin -> 0.5
+ uwsgi -> 2.0.12 (OpenBSD only)
iRedMail-0.9.3:
* Works on new distribution releases:
- Ubuntu 15.10. [Note: old 15.04 is not supported.]
- OpenBSD 5.8. Notes:
+ 5.7 and earlier releases are not supported.
+ spamd(8) is not enabled and replaced by postscreen, because
postscreen is better to reduce spam (e.g. with help of DNSBL
services).
* Remove components:
- Cluebringer has been removed. It's not under active development and
no new release since 2013 (the latest stable release doesn't support
IPv6), we have greylisting and throttling support in iRedAPD as
replacement.
* Improvements:
- SOGo Groupware is now available on FreeBSD.
- Enable HSTS (HTTP Strict Transport Security) in both Apache and Nginx.
- Update Fail2ban filter to catch postscreen log.
- Enable global address book for SQL backends in SOGo by default,
domains are isolated. Thanks dnwahs <shawn _at_ mcsp.net> for the
sharing in iRedMail forum.
- Supports per-user alias address in SQL backends. 2 new sql columns
are required: `alias.is_alias`, `alias.alias_to`.
- Enable postscreen service in Postfix by default.
Important Note: all users must use port 587 for sending email, port
25 doesn't accept submitted mail by authenticated users anymore.
- New SQL table `amavisd.outbound_wblist`, used to store whitelists
and blacklists for outbound messages. It's required by iRedAPD
plugin 'amavisd_wblist'.
* New scripts:
- tools/ldap_assign_user_to_groups.py. Used to assign user to specified
mailing lists, or remove membership.
- tools/ldap_move_members_to_another_group.py. Used to move or copy ALL
members of specified mailing list to another.
* Fixed issues:
- Key length 2048 of DKIM key is too long, too many complains because
many DNS vendors don't support it. So we generate with 1024 instead.
- Not add 'virusalert' in Postfix alias file.
- Not use correct postrotate command to rotate log file on Debian.
- Incorrectly set default fireewall zone on RHEL/CentOS 7 if you
didn't choose to restart firewall immediately.
- 'daemonze =' is required by RHEL/CentOS v6, but not v7.
- Incorrect Dovecot Master User account used by SOGo.
- Dovecot Master User doesn't work with LDAP backend.
- Incorrect quota warning priorities in Dovecot.
Thanks Peter <rs _at_ samplezone.ch> for the feedback.
- Incorrect Amavisd setting to sign DKIM on inbound messages.
- [RHEL/CentOS] Cannot start uwsgi service with 'daemonize' setting in
/etc/uwsgi.ini.
- Not preserve the case of ${extension} while delivering message to
mailbox.
* Updated packages:
+ Roundcube webmail -> 1.1.3.
+ uwsgi -> 2.0.11.2 (OpenBSD only)
+ iRedAPD -> 1.7.0
+ iRedAdmin -> 0.4.3
+ FreeBSD:
- php-5.6
iRedMail-0.9.2:
* SOGo now works on Debian 8.
* Improvements:
- LMTP (port 24) and managesieve (port 4190) services are now listening
on only localhost (127.0.0,1 and ::1) by default.
- Improve Fail2ban filter `postfix.iredmail.conf` to prevent DoS
attack to SMTP service.
* Fixed issues:
- Cannot create required SQL tables in `vmail` database with PostgreSQL
backend.
- catch-all support doesn't work with [email protected].
Thanks to stevekez <[email protected]> for the contribution
in iRedMail support forum.
- uwsgi service doesn't work on RHEL/CentOS. A new version of uwsgi
package was submitted to EPEL repo with higher priority (not
submitted by iRedMail team), it's not compatible with settings
configured by iRedMail, this causes uwsgi service cannot be started.
- Cannot import MySQL database on Jailed FreeBSD.
- Not install required port 'databases/py-sqlalchemy' on FreeBSD.
- Fix 'The Logjam Attack' ssl related issue. Reference:
https://weakdh.org/
* Updated packages:
+ iRedAPD -> 1.6.0, bug fixes.
iRedMail-0.9.1:
* Works on new distribution releases:
- Debian 8, Ubuntu 15.04. Notes:
o Roundcube and iRedAdmin are now stored under /opt/www.
o Cluebringer is not installed due to package missing in official
repo, that means your server doesn't support greylisting and
throttling.
o SOGo is not installed due to package missing in upstream (SOGo)
repo.
- OpenBSd 5.7. Notes:
o No official MySQL binary packages, so please use MariaDB instead.
* Drop support for old distribution releases:
- Ubuntu 12.04, 14.10. Please use Ubuntu 14.04 LTS or 15.04 instead.
* Improvements:
- Log most terminal output of iRedMail installation to file
'runtime/install.log', used for troubleshooting after installation.
- Backup scripts are able to delete old backup copies. Default setting
is keeping backup copies for 90 days.
- [LDAP] Allow mailing list account to use attributes: gidNumber,
memberUid.
- Don't install both Apache and Nginx, just one of them.
Debian/Ubuntu package maintainer over-designed the post-install
script, it will restart service after package installed, if we have
both installed, installing another one will fail, because network
ports are used by the first one.
Same reason as above, if we have both installed, upgrading both of
them will trigger service restarting too. This may cause the
currently running web service cannot start.
- Make Dovecot subscribe newly created folder automatically.
Thanks Michael Telatynski <postmaster _at_ webdevguru.co.uk> for the
patch.
- Able to restrict user to login for specified IP addresses or
networks, multiple IP addresses or networks must be separated by
comma.
o LDAP: IP addresses or networks must be listed in attribute
`allowNets` in user object.
o SQL: IP addresses or networks must be listed in SQL column
`mailbox.allow_nets`.
- Bypass greylisting for some big ISPs
(samples/cluebringer/greylisting-whitelist.sql).
- Setup Fail2ban to monitor SOGo log file.
- Add two new Fail2ban filters to help catch spam.
* Fixed issues:
- Amavisd cannot ban zipped '.exe' file on RHEL/CentOS.
- Install package `unrar` as rar unarchiver on RHEL/CentOS/Debian/Ubuntu.
- Incorrect log file and owner/group in /etc/logrotate.d/policyd.
- Cannot send email to [email protected] when per-domain catch-all
is enabled. Note: not fixed with LDAP backend yet.
- Cannot send mail with Roundcube and PHP 5.6.
- Cannot run PHP scripts under web document root with Nginx.
- Not use user's identity as envelope sender for 'return receipt'
responses.
- Not backup SOGo SQL database.
- Incorrect path of command 'sogo-tool' on OpenBSD.
- Not apply service restriction in Dovecot SQL query file while acting
as SASL server.
* Updated packages:
+ Roundcube webmail -> 1.1.1
+ uwsgi -> 2.0.10. OpenBSD only.
+ iRedAdmin -> 0.4.2 (open source edition).
+ iRedAPD -> 1.5.0.
* Known issues:
+ OpenLDAP backend:
- if you have catch-all account enabled for mail domain, email
sent to [email protected] will be delivered to catch-all
account.
iRedMail-0.9.0:
* Works on new distribution releases:
- RHEL/CentOS 7
- Ubuntu 14.10 (codename: utopic)
- OpenBSD 5.6. Note: Nginx is used as web server, the new built-in
httpd daemon (not Apache-1.3) is not used.
* SOGo groupware integration:
SOGo groupware provides a rich AJAX-based Web interface and supports
multiple native clients through the use of standard protocols such as
CalDAV, CardDAV and GroupDAV, as well as Microsoft ActiveSync.
Check its website for more details: http://sogo.nu/
Important notes of SOGo integration in iRedMail:
o SOGo integration is available on below Linux distributions and releases:
- RHEL/CentOS 6. SOGo project doesn't provide RPMs for CentOS 7 yet.
- Debian 7.
- Ubuntu 12.04 and 14.04. No official packages for 14.10 yet.
- OpenBSD 5.6.
o Full/native Exchange protocol support requires OpenChange and Samba4,
but they're not integrated in iRedMail, so iRedMail-0.9.0 doesn't
provide full/native support for Microsoft Outlook clients, Apple
Mail.app and iOS devices. BlackBerry 10 works fine.
Check our tutorial to setup your mail clients:
http://www.iredmail.org/docs/index.html#configure-mail-client-applications
o If you choose to install both Roundcube webmail and SOGo, Managesieve
service is disabled in SOGo by default, because sieve rules generated
by SOGo is not compatible with Roundcube webmail. but if you don't
install Roundcube, managesieve will be enabled in SOGo by default, plus
vacation and forwarding support.
o User cannot change password with PostgreSQL backend.
* Improvements:
- Nginx support is now available on all Linux/BSD distributions.
If you choose to use Nginx as default web server, both Awstats and
Cluebringer are not accessible, because Nginx doesn't have official
SQL/LDAP auth modules. You have to switch to Apache instead, and
reset mail user password to MD5.
- MariaDB support is now available on FreeBSD.
- Add new index for SQL column 'msgs.spam_level' in 'amavisd' database.
- With MySQL/PostgreSQL backends, password hash is now SSHA512 by
default password on Linux, and BCRYPT on FreeBSD and OpenBSD.
Both Roundcube password plugin and iRedAdmin support them.