🐄 Moorch Update 2022 - ClamAV, Dovecot & Olefy Update (#4497)

* [API] Fix minor issue in api docs * [GH-Actions][stale] Add neverstale label to exempt list * [Web] add github version tag * [Web] add github version tag * [Web] add github version tag * [Web] add github version tag * [Web] add github version tag * [Web] add github version tag error handling * [Web] add github version tag error handling * Passwordless SOGo auth: support for calendar invitations and calendar/contacts subscriptions Inviting someone to a calendar event triggers a request to /SOGo/so/otheruser@example.com/freebusy.ifb/ajaxRead. Subscribing to someone's calendar/contacts triggers a request to /SOGo/so/otheruser@example.com/foldersSearch. The email address in the URL is different from the logged-in user, which needs to be handled appropriately by sogo-auth.php. * [Web] add github version tag - adjust css * [Compose] Update SOGo Autoreply Schedule to 5m Based on the advice of inverse (SOGo developer). Thanks to https://github.com/jmber Closes: https://github.com/mailcow/mailcow-dockerized/issues/4436 * [Web] add github version tag - move twig globals * [Web] add github version tag - missing </div> * Passwordless SOGo auth: improvements for when accessing other users * [WebAuthn] fido2 passwordless auth - fix (#4440) * [WebAuthn] fido2 revert * [WebAuthn] set UV flags to 'discouraged' * [WebAuthn] revert - set UV flags to 'discouraged' * Update clamav to 0.104.2 * Update clamav to 0.104.2 * Update dovecot to 2.3.18 Update gosu to 1.14 Use debian bullseye as base * [Web] Updated lang.es.json [CI SKIP] (#4453) Co-authored-by: Fijxu <fijxu@zzls.xyz> Co-authored-by: milkmaker <milkmaker@mailcow.de> Co-authored-by: Fijxu <fijxu@zzls.xyz> * Fix broken documentation links (#4458) * Fix broken documentation links * Fix a few more broken documentation links * Fix broken documentation links in translation files * Fall back to empty string if WATCHDOG_NOTIFY_EMAIL undefined (#4457) By default, `.env` (`mailcow.conf`) does not define `WATCHDOG_NOTIFY_EMAIL`. Using it in `docker-compose.yml` without having it defined leads to Compose v2 displaying this warning on startup: > WARNING: The WATCHDOG_NOTIFY_EMAIL variable is not set. Defaulting to a blank string. Related to https://github.com/mailcow/mailcow-dockerized/issues/4315 * [Web] Updated lang.sk.json [CI SKIP] (#4461) Co-authored-by: Lukáš Matula <lukas@gbely.net> Co-authored-by: milkmaker <milkmaker@mailcow.de> Co-authored-by: Lukáš Matula <lukas@gbely.net> * oletools: disable template injection detection (#4464) Seems to be causing a lot of false positives lately * Fix minor typo in comment (#4466) Correction of the comment, so that the explanation is correct and can be understood. * Update issue templates to issue forms (#4465) This PR updates the issue templates to GitHubs new issue forms * [Web] Fix padding issue in UI admin panel (#4481) * [Web] fix admin panel padding issue * [Web] fix admin panel padding issue * [Web] Updated lang.sk.json [CI SKIP] (#4489) Co-authored-by: Lukáš Matula <lukas@gbely.net> Co-authored-by: milkmaker <milkmaker@mailcow.de> Co-authored-by: Lukáš Matula <lukas@gbely.net> * increase opcache.interned_strings_buffer to 16 (#4487) since version 23.0.2 Nextcloud recommends having a value greater than 8 for `opcache.interned_strings_buffer`. As this memory will be only used when needed this should have no impact on installations that are not using nextcloud. related discussion: https://help.nextcloud.com/t/nextcloud-23-02-opcache-interned-strings-buffer/134007/19 related nextcloud issue: https://github.com/nextcloud/server/issues/31223 * nextcloud - add missing redirections (#4366) adds missing location directives to the nginx configuration of nextcloud 22, to prevent warnings in nextcloud admin center of missing redirections * Update imapsync to 2.178 (#4491) * Update and fix oletools (#4479) As noticed by @MAGICCC (#4464 (comment)), our olefy image does not work anymore if you rebuild it. This is because @HeinleinSupport recently updated their repository with the changes from @decalage2's repository, which renamed olvba3 to olevba. Since @HeinleinSupport does not recommend using its own patched branch and is very slow in pulling in changes from upstream (@decalage2), let's switch to the latter. This also allowed me to revert #4464. Finally, a minor patch to rspamd is necessary. While the documentation says In the extended mode the oletools module will not trigger on specific categories, but will always set a threat string with all found flags when at least a macro was found. This is not actually true -- it only sets it when suspicious or autoexec threats were detected. But it's a one-line patch to make rspamd behave as documented and we should submit that patch to @rspamd too. With this patch, I have confirmed that Mailcow will reject any incoming, non-whitelisted message containing attachments with macros. * [Web] Fix excluded domain list in quaratine view Previously excluded domains from quarantine were not shown. * [Dovecot] Update syslogng Version to 3.28 (#4496) Co-authored-by: Niklas Meyer <niklas.meyer@tinc.gmbh> Co-authored-by: ntimo <git@nowitzki.me> Co-authored-by: Peter <magic@kthx.at> Co-authored-by: FreddleSpl0it <patschul@posteo.de> Co-authored-by: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Co-authored-by: Michael Kuron <mkuron@users.noreply.github.com> Co-authored-by: milkmaker <milkmaker@mailcow.de> Co-authored-by: Fijxu <fijxu@zzls.xyz> Co-authored-by: Slavi Pantaleev <slavi@devture.com> Co-authored-by: Lukáš Matula <lukas@gbely.net> Co-authored-by: Max <mail@heavygale.de> Co-authored-by: Michael Cramer <michael@bigmichi1.de> Co-authored-by: Robert Christian <soulsymphonies@users.noreply.github.com> Co-authored-by: André <andre.peters@debinux.de> Co-authored-by: Niklas Meyer <niklas.meyer@tinc.gmbh>
2022-03-02 16:32:17 +01:00
parent b1314bd9a3
commit c520f21d28
30 changed files with 1537 additions and 641 deletions
--- a/data/Dockerfiles/clamd/Dockerfile
+++ b/data/Dockerfiles/clamd/Dockerfile
@@ -2,18 +2,26 @@ FROM debian:bullseye-slim

 LABEL maintainer "André Peters <andre.peters@servercow.de>"

-ARG CLAMAV=0.103.5
+ARG CLAMAV=0.104.2
+ARG TINI_VERSION=v0.19.0
+
 RUN apt-get update && apt-get install -y --no-install-recommends \
  ca-certificates \
-  zlib1g-dev \
-  libcurl4-openssl-dev \
-  libncurses5-dev \
-  libzip-dev \
-  libpcre2-dev \
-  libxml2-dev \
-  libssl-dev \
  build-essential \
+  pkg-config \
+  python3 \
+  python3-pip \
+  valgrind \
+  check \
+  libbz2-dev \
+  libcurl4-openssl-dev \
  libjson-c-dev \
+  libmilter-dev \
+  libncurses5-dev \
+  libpcre2-dev \
+  libssl-dev \
+  libxml2-dev \
+  zlib1g-dev \
  curl \
  bash \
  wget \
@@ -22,39 +30,47 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
  rsync \
  dos2unix \
  netcat \
+  && python3 -m pip install cmake \
  && rm -rf /var/lib/apt/lists/* \
  && wget -O - https://www.clamav.net/downloads/production/clamav-${CLAMAV}.tar.gz | tar xfvz - \
  && cd clamav-${CLAMAV} \
-  && ./configure \
-  --prefix=/usr \
-  --libdir=/usr/lib \
-  --sysconfdir=/etc/clamav \
-  --mandir=/usr/share/man \
-  --infodir=/usr/share/info \
-  --disable-llvm \
-  --with-user=clamav \
-  --with-group=clamav \
-  --with-dbdir=/var/lib/clamav \
-  --enable-clamdtop \
-  --enable-bigstack \
-  --with-pcre \
-  && make -j4 \
-  && make install \
-  && make clean \
+  && cmake . \
+      -D CMAKE_INSTALL_PREFIX=/usr \
+      -D CMAKE_INSTALL_LIBDIR=/usr/lib \
+      -D APP_CONFIG_DIRECTORY=/etc/clamav \
+      -D CMAKE_INSTALL_MANDIR=/usr/share/man \
+      -D CMAKE_INSTALL_INFODIR=/usr/share/info \
+      -D CLAMAV_USER=clamav \
+      -D CLAMAV_GROUP=clamav \
+      -D DATABASE_DIRECTORY=/var/lib/clamav \
+      -D ENABLE_APP=ON \
+      -D ENABLE_JSON_SHARED=OFF \
+      -D CMAKE_BUILD_TYPE=MinSizeRel \
+  && cmake --build . -j4 \
+  && cmake --build . --target install \
  && cd .. && rm -rf clamav-${CLAMAV} \
  && apt-get -y --auto-remove purge build-essential \
-  && apt-get -y purge zlib1g-dev \
-  libncurses5-dev \
-  libzip-dev \
-  libpcre2-dev \
-  libxml2-dev \
-  libssl-dev \
+  && apt-get -y purge pkg-config \
+  python3 \
+  python3-pip \
+  valgrind \
+  check \
+  libbz2-dev \
+  libcurl4-openssl-dev \
  libjson-c-dev \
+  libmilter-dev \
+  libncurses5-dev \
+  libpcre2-dev \
+  libssl-dev \
+  libxml2-dev \
+  zlib1g-dev \
+
  && addgroup --system --gid 700 clamav \
  && adduser --system --no-create-home --home /var/lib/clamav --uid 700 --gid 700 --disabled-login clamav \
  && rm -rf /tmp/* /var/tmp/*

 COPY clamd.sh ./
-COPY tini /sbin/tini
+ADD https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini /sbin/tini
+RUN chmod +x /sbin/tini

 CMD ["/sbin/tini", "-g", "--", "/clamd.sh"]
--- a/data/Dockerfiles/clamd/tini
+++ b/data/Dockerfiles/clamd/tini
--- a/data/Dockerfiles/dovecot/Dockerfile
+++ b/data/Dockerfiles/dovecot/Dockerfile
@@ -1,10 +1,10 @@
-FROM debian:buster-slim
+FROM debian:bullseye-slim
 LABEL maintainer "Andre Peters <andre.peters@servercow.de>"

 ARG DEBIAN_FRONTEND=noninteractive
-ARG DOVECOT=2.3.17.1
+ARG DOVECOT=2.3.18
 ENV LC_ALL C
-ENV GOSU_VERSION 1.12
+ENV GOSU_VERSION 1.14

 # Add groups and users before installing Dovecot to not break compatibility
 RUN groupadd -g 5000 vmail \
@@ -89,7 +89,7 @@ RUN groupadd -g 5000 vmail \
  && chmod +x /usr/local/bin/gosu \
  && gosu nobody true \
  && apt-key adv --fetch-keys https://repo.dovecot.org/DOVECOT-REPO-GPG \
-  && echo "deb https://repo.dovecot.org/ce-${DOVECOT}/debian/buster buster main" > /etc/apt/sources.list.d/dovecot.list \
+  && echo "deb https://repo.dovecot.org/ce-${DOVECOT}/debian/bullseye bullseye main" > /etc/apt/sources.list.d/dovecot.list \
  && apt-get update \
  && apt-get -y --no-install-recommends install \
  dovecot-lua \
--- a/data/Dockerfiles/dovecot/imapsync
+++ b/data/Dockerfiles/dovecot/imapsync
--- a/data/Dockerfiles/dovecot/syslog-ng-redis_slave.conf
+++ b/data/Dockerfiles/dovecot/syslog-ng-redis_slave.conf
@@ -1,4 +1,4 @@
-@version: 3.19
+@version: 3.28
@include "scl.conf"
 options {
  chain_hostnames(off);
--- a/data/Dockerfiles/dovecot/syslog-ng.conf
+++ b/data/Dockerfiles/dovecot/syslog-ng.conf
@@ -1,4 +1,4 @@
-@version: 3.19
+@version: 3.28
@include "scl.conf"
 options {
  chain_hostnames(off);
--- a/data/Dockerfiles/olefy/Dockerfile
+++ b/data/Dockerfiles/olefy/Dockerfile
@@ -8,9 +8,9 @@ RUN apk add --virtual .build-deps gcc musl-dev python3-dev libffi-dev openssl-de
  && apk add --update --no-cache python3 py3-pip openssl tzdata libmagic \
  && pip3 install --upgrade pip \
  && pip3 install --upgrade asyncio python-magic \
-  && pip3 install --upgrade https://github.com/HeinleinSupport/oletools/archive/master.zip \
+  && pip3 install --upgrade https://github.com/decalage2/oletools/archive/master.zip \
  && apk del .build-deps
-#  && sed -i 's/decompress_stream(bytearray(compressed_code))/bytes2str(decompress_stream(bytearray(compressed_code)))/g' /usr/lib/python3.8/site-packages/oletools/olevba.py
+#  && sed -i 's/template_injection_detected = True/template_injection_detected = False/g' /usr/lib/python3.9/site-packages/oletools/olevba.py

 ADD olefy.py /app/

--- a/data/Dockerfiles/rspamd/Dockerfile
+++ b/data/Dockerfiles/rspamd/Dockerfile
@@ -21,7 +21,8 @@ RUN apt-get update && apt-get install -y \
  && apt-get clean \
  && mkdir -p /run/rspamd \
  && chown _rspamd:_rspamd /run/rspamd \
-  && echo 'alias ll="ls -la --color"' >> ~/.bashrc
+  && echo 'alias ll="ls -la --color"' >> ~/.bashrc \
+  && sed -i 's/#analysis_keyword_table > 0/analysis_cat_table.macro_exist == "M"/g' /usr/share/rspamd/lualib/lua_scanners/oletools.lua

 COPY settings.conf /etc/rspamd/settings.conf
 COPY metadata_exporter.lua /usr/share/rspamd/plugins/metadata_exporter.lua