2014-10-12 12:47:46 +00:00
CHANGELOG
=========
2015-04-09 12:12:04 +00:00
In Development
--------------
Mail:
* POP3S is now enabled (port 995).
2015-04-09 13:34:46 +00:00
* In order to guard against misconfiguration that can lead to domain control validation hijacking, email addresses that begin with admin, administrator, postmaster, hostmaster, and webmaster can no longer be used for (new) mail user accounts, and aliases for these addresses may direct mail only to the box's administrator(s).
2015-04-09 12:12:04 +00:00
store IDNs (internationalized domain names) in IDNA (ASCII) in our database, not in Unicode
I changed my mind. In 1bf8f1991f6f08e0fb1e3d2572d280d894a5e431 I allowed Unicode domain names to go into the database. I thought that was nice because it's what the user *means*. But it's not how the web works. Web and DNS were working, but mail wasn't. Postfix (as shipped with Ubuntu 14.04 without support for SMTPUTF8) exists in an ASCII-only world. When it goes to the users/aliases table, it queries in ASCII (IDNA) only and had no hope of delivering mail if the domain was in full Unicode in the database. I was thinking ahead to SMTPUTF8, where we *could* put Unicode in the database (though that would prevent IDNA-encoded addressing from being deliverable) not realizing it isn't well supported yet anyway.
It's IDNA that goes on the wire in most places anyway (SMTP without SMTPUTF8 (and therefore how Postfix queries our users/aliases tables), DNS zone files, nginx config, CSR 'CN' field, X509 Common Name and Subject Alternative Names fields), so we should really be talking in terms of IDNA (i.e. ASCII).
This partially reverts commit 1bf8f1991f6f08e0fb1e3d2572d280d894a5e431, where I added a lot of Unicode=>IDNA conversions when writing configuration files. Instead I'm doing Unicode=>IDNA before email addresses get into the users/aliases table. Now we assume the database uses IDNA-encoded ASCII domain names. When adding/removing aliases, addresses are converted to ASCII (w/ IDNA). User accounts must be ASCII-only anyway because of Dovecot's auth limitations, so we don't do any IDNA conversion (don't want to change the user's login info behind their back!). The aliases control panel page converts domains back to Unicode for display to be nice. The status checks converts the domains to Unicode just for the output headings.
A migration is added to convert existing aliases with Unicode domains into IDNA. Any custom DNS or web settings with Unicode may need to be changed.
Future support for SMTPUTF8 will probably need to add columns in the users/aliases table so that it lists both IDNA and Unicode forms.
2015-03-29 13:33:31 +00:00
System:
* Internationalized Domain Names (IDNs) should now work in email. If you had custom DNS or custom web settings for internationalized domains, check that they are still working.
2015-04-01 14:14:34 +00:00
v0.08 (April 1, 2015)
---------------------
2015-03-03 11:47:00 +00:00
2015-03-08 19:02:49 +00:00
Mail:
* The Roundcube vacation_sieve plugin by @arodier is now installed to make it easier to set vacation auto-reply messages from within Roundcube.
2015-03-22 13:58:24 +00:00
* Authentication-Results headers for DMARC, added in v0.07, were mistakenly added for outbound mail --- that's now removed.
* The Trash folder is now created automatically for new mail accounts, addressing a Roundcube error.
2015-03-08 19:02:49 +00:00
2015-03-30 00:53:30 +00:00
DNS:
* Custom DNS TXT records were not always working and they can now override the default SPF, DKIM, and DMARC records.
2015-03-08 18:35:57 +00:00
System:
2015-02-12 19:53:17 +00:00
* ownCloud updated to version 8.0.2.
2015-03-08 18:35:57 +00:00
* Brute-force SSH and IMAP login attempts are now prevented by properly configuring fail2ban.
2015-03-22 13:58:24 +00:00
* Status checks are run each night and any changes from night to night are emailed to the box administrator (the first user account).
2015-03-08 18:35:57 +00:00
2015-03-03 11:47:00 +00:00
Control panel:
* The new check that system services are running mistakenly checked that the Dovecot Managesieve service is publicly accessible. Although the service binds to the public network interface we don't open the port in ufw. On some machines it seems that ufw blocks the connection from the status checks (which seems correct) and on some machines (mine) it doesn't, which is why I didn't notice the problem.
2015-03-08 20:55:39 +00:00
* The current backup chain will now try to predict how many days until it is deleted (always at least 3 days after the next full backup).
2015-03-22 13:59:05 +00:00
* The list of aliases that forward to a user are removed from the Mail Users page because when there are many alises it is slow and times-out.
2015-03-28 15:19:05 +00:00
* Some status check errors are turned into warnings, especially those that might not apply if External DNS is used.
2015-03-03 11:47:00 +00:00
2015-02-28 22:09:12 +00:00
v0.07 (February 28, 2015)
-------------------------
2015-01-17 15:00:16 +00:00
2015-01-31 21:36:37 +00:00
Mail:
2015-02-16 23:58:17 +00:00
* If the box manages mail for a domain and a subdomain of that domain, outbound mail from the subdomain was not DKIM-signed and would therefore fail DMARC tests on the receiving end, possibly result in the mail heading into spam folders.
2015-01-31 21:36:37 +00:00
* Auto-configuration for Mozilla Thunderbird, Evolution, KMail, and Kontact is now available.
2015-02-13 13:20:55 +00:00
* Domains that only have a catch-all alias or domain alias no longer automatically create/require admin@ and postmaster@ addresses since they'll forward anyway.
2015-02-13 13:22:46 +00:00
* Roundcube is updated to version 1.1.0.
2015-02-16 23:58:17 +00:00
* Authentication-Results headers for DMARC are now added to incoming mail.
2015-02-13 13:20:55 +00:00
DNS:
* If a custom CNAME record is set on a 'www' subdomain, the default A/AAAA records were preventing the CNAME from working.
* If a custom DNS A record overrides one provided by the box, the a corresponding default IPv6 record by the box is removed since it will probably be incorrect.
* Internationalized domain names (IDNs) are now supported for DNS and web, but email is not yet tested.
Web:
* Static websites now deny access to certain dot (.) files and directories which typically have sensitive info: .ht*, .svn*, .git*, .hg*, .bzr*.
* The nginx server no longer reports its version and OS for better privacy.
* The HTTP->HTTPS redirect is now more efficient.
2015-02-17 00:40:43 +00:00
* When serving a 'www.' domain, reuse the SSL certificate for the parent domain if it covers the 'www' subdomain too
2015-02-17 00:44:30 +00:00
* If a custom DNS CNAME record is set on a domain, don't offer to put a website on that domain. (Same logic already applies to custom A/AAAA records.)
2015-01-31 21:36:37 +00:00
2015-01-17 15:23:57 +00:00
Control panel:
* Status checks now check that system services are actually running by pinging each port that should have something running on it.
2015-01-31 21:36:37 +00:00
* The status checks are now parallelized so they may be a little faster.
2015-02-28 22:06:09 +00:00
* The status check for MX records now allow any priority, in case an unusual setup is required.
2015-02-13 13:20:55 +00:00
* The interface for setting website domain-specific directories is simplified.
2015-02-13 13:29:01 +00:00
* The mail guide now says that to use Outlook, Outlook 2007 or later on Windows 7 and later is required.
2015-02-28 22:06:09 +00:00
* External DNS settings now skip the special "_secondary_nameserver" key which is used for storing secondary NS information.
2015-01-17 15:23:57 +00:00
Setup:
* Install cron if it isn't already installed.
* Fix a units problem in the minimum memory check.
2015-02-13 13:20:55 +00:00
* If you override the STORAGE_ROOT, your setting will now persist if you re-run setup.
2015-02-13 13:41:52 +00:00
* Hangs due to apt wanting the user to resolve a conflict should now be fixed (apt will just clobber the problematic file now).
internationalized domain names (DNS, web, CSRs, normalize to Unicode in database, prohibit non-ASCII characters in user account names)
* For non-ASCII domain names, we will keep the Unicode encoding in our users/aliases table. This is nice for the user and also simplifies things like sorting domain names (using Unicode lexicographic order is good, using ASCII lexicogrpahic order on IDNA is confusing).
* Write nsd config, nsd zone files, nginx config, and SSL CSRs with domains in IDNA-encoded ASCII.
* When checking SSL certificates, treat the CN and SANs as IDNA.
* Since Chrome has an interesting feature of converting Unicode to IDNA in <input type="email"> form fields, we'll also forcibly convert IDNA to Unicode in the domain part of email addresses before saving email addresses in the users/aliases tables so that the table is normalized to Unicode.
* Don't allow non-ASCII characters in user account email addresses. Dovecot gets confused when querying the Sqlite database (which we observed even for non-word ASCII characters too, so it may not be related to the character encoding).
2015-01-17 13:41:53 +00:00
2015-01-04 20:18:13 +00:00
v0.06 (January 4, 2015)
-----------------------
2014-12-26 13:22:14 +00:00
2015-01-02 23:22:33 +00:00
Mail:
2015-01-02 23:47:19 +00:00
* Set better default system limits to accommodate boxes handling mail for 20+ users.
2015-01-02 23:22:33 +00:00
2015-01-04 16:03:55 +00:00
Contacts/calendar:
* Update to ownCloud to 7.0.4.
* Contacts syncing via ActiveSync wasn't working.
2014-12-26 13:22:14 +00:00
Control panel:
2015-01-02 23:47:19 +00:00
* New control panel for setting custom DNS settings (without having to use the API).
* Status checks showed a false positive for Spamhause blacklists and for secondary DNS in some cases.
2015-01-02 22:55:28 +00:00
* Status checks would fail to load if openssh-sever was not pre-installed, but openssh-server is not required.
2014-12-26 13:22:14 +00:00
* The local DNS cache is cleared before running the status checks using 'rncd' now rather than restarting 'bind9', which should be faster and wont interrupt other services.
2015-01-02 23:47:19 +00:00
* Multi-domain and wildcard certificate can now be installed through the control panel.
2015-01-02 23:39:09 +00:00
* The DNS API now allows the setting of SRV records.
2014-12-26 13:22:14 +00:00
2015-01-02 23:37:14 +00:00
Misc:
2015-01-02 23:47:19 +00:00
* IPv6 configuration error in postgrey, nginx.
* Missing dependency on sudo.
2015-01-02 23:37:14 +00:00
2014-11-18 16:52:02 +00:00
v0.05 (November 18, 2014)
-------------------------
2014-11-14 14:13:24 +00:00
Mail:
* The maximum size of outbound mail sent via webmail and Exchange/ActiveSync has been increased to 128 MB, the same as when using SMTP.
* Spam is no longer wrapped as an attachment inside a scary Spamassassin explanation. The original message is simply moved straight to the Spam folder unchanged.
2014-11-18 16:32:37 +00:00
* There is a new iOS/Mac OS X Configuration Profile link in the control panel which makes it easier to configure IMAP/SMTP/CalDAV/CardDAV on iOS devices and Macs.
2014-11-14 14:13:24 +00:00
* "Domain aliases" can now be configured in the control panel.
* Updated to [Roundcube 1.0.3 ](http://trac.roundcube.net/wiki/Changelog ).
2014-11-18 16:47:14 +00:00
* IMAP/SMTP is now recommended even on iOS devices as Exchange/ActiveSync is terribly buggy.
2014-11-14 14:13:24 +00:00
Control panel:
* Installing an SSL certificate for the primary hostname would cause problems until a restart (services needed to be restarted).
* Installing SSL certificates would fail if /tmp was on a different filesystem.
* Better error messages when installing a SSL certificate fails.
* The local DNS cache is now cleared each time the system status checks are run.
* Documented how to use +tag addressing.
* Minor UI tweaks.
Other:
* Updated to [ownCloud 7.0.3 ](http://owncloud.org/changelog/ ).
* The ownCloud API is now exposed properly.
* DNSSEC now works on `.guide` domains now too (RSASHA256).
2014-10-15 16:36:34 +00:00
v0.04 (October 15, 2014)
------------------------
2014-10-12 12:47:46 +00:00
2014-10-12 21:08:00 +00:00
Breaking changes:
* On-disk backups are now retained for a minimum of 3 days instead of 14. Beyond that the user is responsible for making off-site copies.
2014-10-15 15:32:02 +00:00
* IMAP no longer supports the legacy SSLv3 protocol. SSLv3 is now known to be insecure. I don't believe any modern devices will be affected by this. HTTPS and SMTP submission already had SSLv3 disabled.
2014-10-12 21:08:00 +00:00
2014-10-12 12:47:46 +00:00
Control panel:
* The control panel has a new page for installing SSL certificates.
* The control panel has a new page for hosting static websites.
* The control panel now shows mailbox sizes on disk.
* It is now possible to create catch-all aliases from the control panel.
* Many usability improvements in the control panel.
DNS:
* Custom DNS A/AAAA records on subdomains were ignored.
* It is now possible to set up a secondary DNS server.
* DNS zones were updating even when nothing changed.
* Strict SPF and DMARC settings are now set on all subdomains not used for mail.
Security:
* DNSSEC is now supported for the .email TLD which required a different key algorithm.
* Nginx and Postfix now use 2048 bits of DH parameters instead of 1024.
Other:
2014-10-15 15:45:13 +00:00
* Spam filter learning by dragging mail in and out of the Spam folder should hopefully be working now.
2014-10-12 12:47:46 +00:00
* Some things were broken if the machine had an IPv6 address.
* Other things were broken if the machine was on a non-utf8 locale.
* No longer implementing webfinger.
* Removes apache before installing nginx, in case it has been installed by distro.
v0.03 (September 24, 2014)
--------------------------
* Update existing installs of Roundcube.
* Disabled catch-alls pending figuring out how to get users to take precedence.
* Z-Push was not working because in v0.02 we had accidentally moved to a different version.
* Z-Push is now locked to a specific commit so it doesn't change on us accidentally.
* The start script is now symlinked to /usr/local/bin/mailinabox.
v0.02 (September 21, 2014)
--------------------------
* Open the firewall to an alternative SSH port if set.
* Fixed missing dependencies.
* Set Z-Push to use sync command with ownCloud.
* Support more concurrent connections for z-push.
* In the status checks, handle wildcard certificates.
* Show the status of backups in the control panel.
* The control panel can now update a user's password.
* Some usability improvements in the control panel.
* Warn if a SSL cert is expiring in 30 days.
* Use SHA2 to generate CSRs.
* Better logic for determining when to take a full backup.
* Reduce DNS TTL, not that it seems to really matter.
* Add SSHFP DNS records.
* Add an API for setting custom DNS records
* Update to ownCloud 7.0.2.
* Some things were broken if the machine had an IPv6 address.
* Use a dialogs library to ask users questions during setup.
* Other fixes.
v0.01 (August 19, 2014)
-----------------------
First release.
