mirror of
https://github.com/YunoHost/yunohost.git
synced 2024-09-03 20:06:10 +02:00
Merge pull request #940 from YunoHost/enh-diagnosis-mail
Enh diagnosis mail
This commit is contained in:
Alexandre Aubin
GitHub
commit
c02961fe6b
9 changed files with 59 additions and 24 deletions
|
|
@ -35,7 +35,8 @@ do_pre_regen() {
|
|||
> "${default_dir}/postsrsd"
|
||||
|
||||
# adapt it for IPv4-only hosts
|
||||
if [ ! -f /proc/net/if_inet6 ]; then
|
||||
ipv6="$(yunohost settings get 'smtp.allow_ipv6')"
|
||||
if [ "$ipv6" == "False" ] || [ ! -f /proc/net/if_inet6 ]; then
|
||||
sed -i \
|
||||
's/ \[::ffff:127.0.0.0\]\/104 \[::1\]\/128//g' \
|
||||
"${postfix_dir}/main.cf"
|
||||
|
|
|
|||
|
|
@ -12,6 +12,7 @@ from moulinette.utils.filesystem import read_yaml
|
|||
|
||||
from yunohost.diagnosis import Diagnoser
|
||||
from yunohost.domain import _get_maindomain, domain_list
|
||||
from yunohost.settings import settings_get
|
||||
|
||||
DEFAULT_DNS_BLACKLIST = "/usr/share/yunohost/other/dnsbl_list.yml"
|
||||
|
||||
|
|
@ -59,8 +60,8 @@ class MailDiagnoser(Diagnoser):
|
|||
yield dict(meta={"test": "outgoing_port_25", "ipversion": ipversion},
|
||||
data={},
|
||||
status="ERROR",
|
||||
summary="diagnosis_mail_ougoing_port_25_blocked",
|
||||
details=["diagnosis_mail_ougoing_port_25_blocked_details",
|
||||
summary="diagnosis_mail_outgoing_port_25_blocked",
|
||||
details=["diagnosis_mail_outgoing_port_25_blocked_details",
|
||||
"diagnosis_mail_outgoing_port_25_blocked_relay_vpn"])
|
||||
|
||||
|
||||
|
|
@ -76,23 +77,27 @@ class MailDiagnoser(Diagnoser):
|
|||
data={},
|
||||
ipversion=ipversion)
|
||||
except Exception as e:
|
||||
yield dict(meta={"test": "mail_ehlo", "ipversion": ipversion},
|
||||
yield dict(meta={"test": "mail_ehlo", "reason": "remote_server_failed",
|
||||
"ipversion": ipversion},
|
||||
data={"error": str(e)},
|
||||
status="WARNING",
|
||||
summary="diagnosis_mail_ehlo_could_not_diagnose",
|
||||
details=["diagnosis_mail_ehlo_could_not_diagnose_details"])
|
||||
continue
|
||||
|
||||
if r["status"] == "error_smtp_unreachable":
|
||||
if r["status"] != "ok":
|
||||
summary = r["status"].replace("error_smtp_", "diagnosis_mail_ehlo_")
|
||||
yield dict(meta={"test": "mail_ehlo", "ipversion": ipversion},
|
||||
data={},
|
||||
status="ERROR",
|
||||
summary="diagnosis_mail_ehlo_unavailable")
|
||||
summary=summary,
|
||||
details=[summary + "_details"])
|
||||
elif r["helo"] != self.ehlo_domain:
|
||||
yield dict(meta={"test": "mail_ehlo", "ipversion": ipversion},
|
||||
data={"wrong_ehlo": r["helo"], "right_ehlo": self.ehlo_domain},
|
||||
status="ERROR",
|
||||
summary="diagnosis_mail_ehlo_wrong")
|
||||
summary="diagnosis_mail_ehlo_wrong",
|
||||
details=["diagnosis_mail_ehlo_wrong_details"])
|
||||
|
||||
|
||||
def check_fcrdns(self):
|
||||
|
|
@ -103,20 +108,30 @@ class MailDiagnoser(Diagnoser):
|
|||
"""
|
||||
|
||||
for ip in self.ips:
|
||||
if ":" in ip:
|
||||
details = ["diagnosis_mail_fcrdns_nok_details",
|
||||
"diagnosis_mail_fcrdns_nok_alternatives_6"]
|
||||
else:
|
||||
details = ["diagnosis_mail_fcrdns_nok_details",
|
||||
"diagnosis_mail_fcrdns_nok_alternatives_4"]
|
||||
|
||||
try:
|
||||
rdns_domain, _, _ = socket.gethostbyaddr(ip)
|
||||
except socket.herror:
|
||||
yield dict(meta={"test": "mail_fcrdns", "ip": ip},
|
||||
data={"ehlo_domain": self.ehlo_domain},
|
||||
status="ERROR",
|
||||
summary="diagnosis_mail_fcrdns_dns_missing")
|
||||
summary="diagnosis_mail_fcrdns_dns_missing",
|
||||
details=details)
|
||||
continue
|
||||
if rdns_domain != self.ehlo_domain:
|
||||
details = ["diagnosis_mail_fcrdns_different_from_ehlo_domain_details"] + details
|
||||
yield dict(meta={"test": "mail_fcrdns", "ip": ip},
|
||||
data={"ehlo_domain": self.ehlo_domain,
|
||||
"rdns_domain": rdns_domain},
|
||||
status="ERROR",
|
||||
summary="diagnosis_mail_fcrdns_different_from_ehlo_domain")
|
||||
summary="diagnosis_mail_fcrdns_different_from_ehlo_domain",
|
||||
details=details)
|
||||
|
||||
|
||||
def check_blacklist(self):
|
||||
|
|
@ -189,7 +204,7 @@ class MailDiagnoser(Diagnoser):
|
|||
yield dict(meta={"test": "mail_queue"},
|
||||
data={'nb_pending': pending_emails},
|
||||
status="WARNING",
|
||||
summary="diagnosis_mail_queue_too_many_pending_emails")
|
||||
summary="diagnosis_mail_queue_too_big")
|
||||
else:
|
||||
yield dict(meta={"test": "mail_queue"},
|
||||
data={'nb_pending': pending_emails},
|
||||
|
|
@ -207,12 +222,13 @@ class MailDiagnoser(Diagnoser):
|
|||
if global_ipv4:
|
||||
outgoing_ips.append(global_ipv4)
|
||||
|
||||
ipv6 = Diagnoser.get_cached_report("ip", {"test": "ipv6"}) or {}
|
||||
if ipv6.get("status") == "SUCCESS":
|
||||
outgoing_ipversions.append(6)
|
||||
global_ipv6 = ipv6.get("data", {}).get("global", {})
|
||||
if global_ipv6:
|
||||
outgoing_ips.append(global_ipv6)
|
||||
if settings_get("smtp.ipv6"):
|
||||
ipv6 = Diagnoser.get_cached_report("ip", {"test": "ipv6"}) or {}
|
||||
if ipv6.get("status") == "SUCCESS":
|
||||
outgoing_ipversions.append(6)
|
||||
global_ipv6 = ipv6.get("data", {}).get("global", {})
|
||||
if global_ipv6:
|
||||
outgoing_ips.append(global_ipv6)
|
||||
return (outgoing_ipversions, outgoing_ips)
|
||||
|
||||
def main(args, env, loggers):
|
||||
|
|
|
|||
|
|
@ -573,7 +573,7 @@
|
|||
"apps_catalog_obsolete_cache": "La memòria cau del catàleg d'aplicacions és buida o obsoleta.",
|
||||
"apps_catalog_update_success": "S'ha actualitzat el catàleg d'aplicacions!",
|
||||
"diagnosis_mail_ougoing_port_25_ok": "El port de sortida 25 no està bloquejat i els correus es poden enviar a altres servidors.",
|
||||
"diagnosis_mail_ougoing_port_25_blocked": "Sembla que el port de sortida 25 està bloquejat. Hauríeu d'intentar desbloquejar-lo al panell de configuració del proveïdor d'accés a internet (o allotjador). Mentrestant, el servidor no podrà enviar correus a altres servidors.",
|
||||
"diagnosis_mail_outgoing_port_25_blocked": "Sembla que el port de sortida 25 està bloquejat. Hauríeu d'intentar desbloquejar-lo al panell de configuració del proveïdor d'accés a internet (o allotjador). Mentrestant, el servidor no podrà enviar correus a altres servidors.",
|
||||
"diagnosis_description_mail": "Correu electrònic",
|
||||
"migration_description_0013_futureproof_apps_catalog_system": "Migrar al nou sistema de catàleg d'aplicacions resistent al pas del temps",
|
||||
"app_upgrade_script_failed": "Hi ha hagut un error en el script d'actualització de l'aplicació",
|
||||
|
|
|
|||
|
|
@ -185,17 +185,25 @@
|
|||
"diagnosis_swap_notsomuch": "The system has only {total} swap. You should consider having at least {recommended} to avoid situations where the system runs out of memory.",
|
||||
"diagnosis_swap_ok": "The system has {total} of swap!",
|
||||
"diagnosis_mail_outgoing_port_25_ok": "Outgoing port 25 is open, emails can be sent",
|
||||
"diagnosis_mail_outgoing_port_25_blocked": "Outgoing port 25 appears to be bloecked in IPv{ipversion}",
|
||||
"diagnosis_mail_outgoing_port_25_blocked": "Outgoing port 25 appears to be blocked in IPv{ipversion}",
|
||||
"diagnosis_mail_outgoing_port_25_blocked_details": "You should first try to unblock it in your internet service provider (or hosting provider) configuration panel or by sending a ticket to your hosting provider. Meanwhile, the server won't be able to send emails to other servers.",
|
||||
"diagnosis_mail_outgoing_port_25_blocked_relay_vpn": "Some providers won't let you unblock outgoing port 25 because they don't care about Net Neutrality.<br> - Some of them provide the alternative of <a href='https://yunohost.org/#/smtp_relay'>using a mail server relay</a> though it implies that the relay will be able to spy on your email traffic.<br>- A privacy-friendly alternative is to use a VPN *with a dedicated public IP* to bypass this kind of limits. See <a href='https://yunohost.org/#/vpn_advantage'>https://yunohost.org/#/vpn_advantage</a><br>- Finally, it's also possible to <a href='https://yunohost.org/#/isp'>change of provider</a>",
|
||||
"diagnosis_mail_ehlo_ok": "Postfix mail service answer correctly from outside",
|
||||
"diagnosis_mail_ehlo_unavailable": "Postfix mail service don't answer to EHLO request on IPv{ipversion}",
|
||||
"diagnosis_mail_ehlo_wrong": "A mail server answers {wrong_ehlo} instead {right_ehlo} on IPv{ipversion}",
|
||||
"diagnosis_mail_ehlo_unreachable": "SMTP server unreachable on IPv{ipversion}",
|
||||
"diagnosis_mail_ehlo_unreachable_details": "Could not open a connection on port 25 through IPv{ipversion}, probably because of a firewall, port forwarding issue or postfix service down",
|
||||
"diagnosis_mail_ehlo_bad_answer": "A non-SMTP service answered on port 25 on IPv{ipversion}",
|
||||
"diagnosis_mail_ehlo_bad_answer_details": "It could be due to an other machine answering instead of your server.",
|
||||
"diagnosis_mail_ehlo_wrong": "An other SMTP server answers on IPv{ipversion}",
|
||||
"diagnosis_mail_ehlo_wrong_details": "The remote diagnoser return a wrong EHLO answer from your IPv{ipversion}.<br>Received: <code>{wrong_ehlo}</code><br>Expected: {right_ehlo}<br>You probably have a port forwarding issue or a reverse proxy server unconfigured for mail.",
|
||||
"diagnosis_mail_ehlo_could_not_diagnose": "Could not diagnose if postfix mail server is reachable from outside in IPv{ipversion}.",
|
||||
"diagnosis_mail_ehlo_could_not_diagnose_details": "Error: {error}",
|
||||
"diagnosis_mail_fcrdns_ok": "Your reverse DNS is well configured",
|
||||
"diagnosis_mail_fcrdns_dns_missing": "No reverse DNS defined for the ip {ip}",
|
||||
"diagnosis_mail_fcrdns_different_from_ehlo_domain": "Your reverse DNS {rdns_domain} is different from your EHLO domain {ehlo_domain} on {ip}",
|
||||
"diagnosis_mail_fcrdns_nok_details": "You should first try to configure the reverse DNS with <code>{ehlo_domain}</code> on your internet service provider (or hosting provider) config panel or by sending a ticket to your hosting provider. Meanwhile, some outgoing mails won't be delivered.",
|
||||
"diagnosis_mail_fcrdns_nok_alternatives_4": "Some providers won't let you configure it or the feature is broken on their config panel. If you are experiencing some server refusing your email for this reason, you could try those solutions:<br> - Some ISP provide the alternative of <a href='https://yunohost.org/#/smtp_relay'>using a mail server relay</a> though it implies that the relay will be able to spy on your email traffic.<br>- A privacy-friendly alternative is to use a VPN *with a dedicated public IP* to bypass this kind of limits. See <a href='https://yunohost.org/#/vpn_advantage'>https://yunohost.org/#/vpn_advantage</a><br>- Finally, it's also possible to <a href='https://yunohost.org/#/isp'>change of provider</a>",
|
||||
"diagnosis_mail_fcrdns_nok_alternatives_6": "Some providers won't let you configure it or the feature is broken on their config panel in IPv6. If your reverse DNS is ok in IPv4, you can try to disable the use of IPv6 to send mail by running <cmd>yunohost settings set smtp.ipv6 -v off ; yunohost tools regen-conf postfix</cmd>. Note: with this last solution you won't be able to send or received emails from the rare ipv6 only servers.",
|
||||
"diagnosis_mail_fcrdns_different_from_ehlo_domain": "The reverse DNS is different from your EHLO domain on {ip}",
|
||||
"diagnosis_mail_fcrdns_different_from_ehlo_domain_details": "Current reverse DNS: <code>{rdns_domain}</code><br>Expected value: <code>{ehlo_domain}</code>",
|
||||
"diagnosis_mail_blacklist_ok": "IPs and domains used by this server to send mail are not on most used email blacklists",
|
||||
"diagnosis_mail_blacklist_listed_by": "{item} is blacklisted on {blacklist_name}",
|
||||
"diagnosis_mail_blacklist_reason": "The blacklist explains: {reason}",
|
||||
|
|
@ -304,6 +312,7 @@
|
|||
"global_settings_setting_security_postfix_compatibility": "Compatibility vs. security tradeoff for the Postfix server. Affects the ciphers (and other security-related aspects)",
|
||||
"global_settings_unknown_setting_from_settings_file": "Unknown key in settings: '{setting_key:s}', discard it and save it in /etc/yunohost/settings-unknown.json",
|
||||
"global_settings_setting_service_ssh_allow_deprecated_dsa_hostkey": "Allow the use of (deprecated) DSA hostkey for the SSH daemon configuration",
|
||||
"global_settings_setting_smtp_allow_ipv6": "Allow the use of IPv6 to receive and send mail",
|
||||
"global_settings_unknown_type": "Unexpected situation, the setting {setting:s} appears to have the type {unknown_type:s} but it is not a type supported by the system.",
|
||||
"good_practices_about_admin_password": "You are now about to define a new administration password. The password should be at least 8 characters long—though it is good practice to use a longer password (i.e. a passphrase) and/or to use a variation of characters (uppercase, lowercase, digits and special characters).",
|
||||
"good_practices_about_user_password": "You are now about to define a new user password. The password should be at least 8 characters long—though it is good practice to use a longer password (i.e. a passphrase) and/or to a variation of characters (uppercase, lowercase, digits and special characters).",
|
||||
|
|
|
|||
|
|
@ -515,7 +515,7 @@
|
|||
"app_upgrade_script_failed": "Eraro okazis en la skripto pri ĝisdatiga programo",
|
||||
"diagnosis_diskusage_verylow": "Stokado {mountpoint} (sur aparato {device)) restas nur {free} ({free_percent}%) spaco. Vi vere konsideru purigi iom da spaco.",
|
||||
"diagnosis_ram_verylow": "La sistemo nur restas {available} ({available_percent}%) RAM! (el {total})",
|
||||
"diagnosis_mail_ougoing_port_25_blocked": "Eliranta haveno 25 ŝajnas esti blokita. Vi devas provi malŝlosi ĝin en via agorda panelo de provizanto (aŭ gastiganto). Dume la servilo ne povos sendi retpoŝtojn al aliaj serviloj.",
|
||||
"diagnosis_mail_outgoing_port_25_blocked": "Eliranta haveno 25 ŝajnas esti blokita. Vi devas provi malŝlosi ĝin en via agorda panelo de provizanto (aŭ gastiganto). Dume la servilo ne povos sendi retpoŝtojn al aliaj serviloj.",
|
||||
"diagnosis_http_bad_status_code": "Ne povis atingi vian servilon kiel atendite, ĝi redonis malbonan statuskodon. Povas esti, ke alia maŝino respondis anstataŭ via servilo. Vi devus kontroli, ke vi ĝuste redonas la havenon 80, ke via nginx-agordo ĝisdatigas kaj ke reverso-prokuro ne interbatalas.",
|
||||
"main_domain_changed": "La ĉefa domajno estis ŝanĝita",
|
||||
"yunohost_postinstall_end_tip": "La post-instalado finiĝis! Por fini vian agordon, bonvolu konsideri:\n - aldonado de unua uzanto tra la sekcio 'Uzantoj' de la retadreso (aŭ 'yunohost user create <username>' en komandlinio);\n - diagnozi problemojn atendantajn solvi por ke via servilo funkciu kiel eble plej glate tra la sekcio 'Diagnosis' de la retadministrado (aŭ 'yunohost diagnosis run' en komandlinio);\n - legante la partojn 'Finigi vian agordon' kaj 'Ekkoni Yunohost' en la administra dokumentado: https://yunohost.org/admindoc.",
|
||||
|
|
|
|||
|
|
@ -554,7 +554,7 @@
|
|||
"diagnosis_swap_none": "El sistema no tiene mas espacio de intercambio. Considera agregar por lo menos {recommended} de espacio de intercambio para evitar que el sistema se quede sin memoria.",
|
||||
"diagnosis_swap_notsomuch": "Al sistema le queda solamente {total} de espacio de intercambio. Considera agregar al menos {recommended} para evitar que el sistema se quede sin memoria.",
|
||||
"diagnosis_mail_ougoing_port_25_ok": "El puerto de salida 25 no esta bloqueado y los correos electrónicos pueden ser enviados a otros servidores.",
|
||||
"diagnosis_mail_ougoing_port_25_blocked": "El puerto de salida 25 parece estar bloqueado. Intenta desbloquearlo con el panel de configuración de tu proveedor de servicios de Internet (o proveedor de halbergue). Mientras tanto, el servidor no podrá enviar correos electrónicos a otros servidores.",
|
||||
"diagnosis_mail_outgoing_port_25_blocked": "El puerto de salida 25 parece estar bloqueado. Intenta desbloquearlo con el panel de configuración de tu proveedor de servicios de Internet (o proveedor de halbergue). Mientras tanto, el servidor no podrá enviar correos electrónicos a otros servidores.",
|
||||
"diagnosis_regenconf_allgood": "Todos los archivos de configuración están en linea con la configuración recomendada!",
|
||||
"diagnosis_regenconf_manually_modified": "El archivo de configuración {file} fue modificado manualmente.",
|
||||
"diagnosis_regenconf_manually_modified_details": "Esto este probablemente BIEN siempre y cuando sepas lo que estas haciendo ;) !",
|
||||
|
|
|
|||
|
|
@ -551,7 +551,7 @@
|
|||
"diagnosis_security_all_good": "Aucune vulnérabilité de sécurité critique n'a été trouvée.",
|
||||
"apps_catalog_init_success": "Système de catalogue d'applications initialisé !",
|
||||
"apps_catalog_failed_to_download": "Impossible de télécharger le catalogue des applications {apps_catalog}:{error}",
|
||||
"diagnosis_mail_ougoing_port_25_blocked": "Le port sortant 25 semble être bloqué. Vous devriez essayer de le débloquer dans le panneau de configuration de votre fournisseur de services Internet (ou hébergeur). En attendant, le serveur ne pourra pas envoyer de courrier électronique à d'autres serveurs.",
|
||||
"diagnosis_mail_outgoing_port_25_blocked": "Le port sortant 25 semble être bloqué. Vous devriez essayer de le débloquer dans le panneau de configuration de votre fournisseur de services Internet (ou hébergeur). En attendant, le serveur ne pourra pas envoyer de courrier électronique à d'autres serveurs.",
|
||||
"domain_cannot_remove_main_add_new_one": "Vous ne pouvez pas supprimer '{domain:s}' car il s'agit du domaine principal et de votre seul domaine. Vous devez d'abord ajouter un autre domaine à l'aide de 'yunohost domain add <another-domain.com>', puis définir comme domaine principal à l'aide de ' yunohost domain main-domain -n <nomd'un-autre-domaine.com>' et vous pouvez ensuite supprimer le domaine '{domain:s}' à l'aide de 'yunohost domain remove {domain:s}'.'",
|
||||
"diagnosis_security_vulnerable_to_meltdown_details": "Pour résoudre ce problème, vous devez mettre à niveau votre système et redémarrer pour charger le nouveau noyau Linux (ou contacter votre fournisseur de serveur si cela ne fonctionne pas). Voir https://meltdownattack.com/ pour plus d'informations.",
|
||||
"diagnosis_description_basesystem": "Système de base",
|
||||
|
|
|
|||
|
|
@ -70,6 +70,7 @@ DEFAULTS = OrderedDict([
|
|||
("security.postfix.compatibility", {"type": "enum", "default": "intermediate",
|
||||
"choices": ["intermediate", "modern"]}),
|
||||
("pop3.enabled", {"type": "bool", "default": False}),
|
||||
("smtp.allow_ipv6", {"type": "bool", "default": True}),
|
||||
])
|
||||
|
||||
|
||||
|
|
@ -320,6 +321,7 @@ def reconfigure_ssh(setting_name, old_value, new_value):
|
|||
if old_value != new_value:
|
||||
service_regen_conf(names=['ssh'])
|
||||
|
||||
@post_change_hook("smtp.allow_ipv6")
|
||||
@post_change_hook("security.postfix.compatibility")
|
||||
def reconfigure_postfix(setting_name, old_value, new_value):
|
||||
if old_value != new_value:
|
||||
|
|
|
|||
|
|
@ -125,6 +125,13 @@ def find_expected_string_keys():
|
|||
yield "password_listed"
|
||||
for i in [1, 2, 3, 4]:
|
||||
yield "password_too_simple_%s" % i
|
||||
|
||||
checks = ["outgoing_port_25_ok", "ehlo_ok", "fcrdns_ok",
|
||||
"blacklist_ok", "queue_ok", "ehlo_bad_answer",
|
||||
"ehlo_unreachable", "ehlo_bad_answer_details",
|
||||
"ehlo_unreachable_details", ]
|
||||
for check in checks:
|
||||
yield "diagnosis_mail_%s" % check
|
||||
|
||||
###############################################################################
|
||||
# Load en locale json keys #
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue