@@ -42,6 +42,15 @@ public function __construct() {
4242 global $ conf ; //TODO: maybe $conf should be passed to constructor
4343 }
4444
45+ private function install_acme () {
46+ $ install_cmd = 'wget -O - https://get.acme.sh | sh ' ;
47+ $ ret = null ;
48+ $ val = 0 ;
49+ exec ($ install_cmd . ' 2>&1 ' , $ ret , $ val );
50+
51+ return ($ val == 0 ? true : false );
52+ }
53+
4554 //: TODO Implement the translation function and language files for the installer.
4655 public function lng ($ text ) {
4756 return $ text ;
@@ -1044,58 +1053,12 @@ public function configure_postfix($options = '') {
10441053 $ postfix_version = preg_replace ('/.*=\s*/ ' , '' , $ out [0 ]);
10451054 unset($ out );
10461055
1047- //* mysql-virtual_domains.cf
1048- $ this ->process_postfix_config ('mysql-virtual_domains.cf ' );
1049-
1050- //* mysql-virtual_forwardings.cf
1051- $ this ->process_postfix_config ('mysql-virtual_forwardings.cf ' );
1052-
1053- //* mysql-virtual_alias_domains.cf
1054- $ this ->process_postfix_config ('mysql-virtual_alias_domains.cf ' );
1055-
1056- //* mysql-virtual_alias_maps.cf
1057- $ this ->process_postfix_config ('mysql-virtual_alias_maps.cf ' );
1058-
1059- //* mysql-virtual_mailboxes.cf
1060- $ this ->process_postfix_config ('mysql-virtual_mailboxes.cf ' );
1061-
1062- //* mysql-virtual_email2email.cf
1063- $ this ->process_postfix_config ('mysql-virtual_email2email.cf ' );
1064-
1065- //* mysql-virtual_transports.cf
1066- $ this ->process_postfix_config ('mysql-virtual_transports.cf ' );
1067-
1068- //* mysql-virtual_recipient.cf
1069- $ this ->process_postfix_config ('mysql-virtual_recipient.cf ' );
1070-
1071- //* mysql-virtual_sender.cf
1072- $ this ->process_postfix_config ('mysql-virtual_sender.cf ' );
1073-
1074- //* mysql-virtual_sender_login_maps.cf
1075- $ this ->process_postfix_config ('mysql-virtual_sender_login_maps.cf ' );
1076-
1077- //* mysql-virtual_client.cf
1078- $ this ->process_postfix_config ('mysql-virtual_client.cf ' );
1079-
1080- //* mysql-virtual_relaydomains.cf
1081- $ this ->process_postfix_config ('mysql-virtual_relaydomains.cf ' );
1082-
1083- //* mysql-virtual_relayrecipientmaps.cf
1084- $ this ->process_postfix_config ('mysql-virtual_relayrecipientmaps.cf ' );
1085-
1086- //* mysql-virtual_outgoing_bcc.cf
1087- $ this ->process_postfix_config ('mysql-virtual_outgoing_bcc.cf ' );
1088-
1089- //* mysql-virtual_policy_greylist.cf
1090- $ this ->process_postfix_config ('mysql-virtual_policy_greylist.cf ' );
1091-
1092- //* mysql-virtual_gids.cf.master
1093- $ this ->process_postfix_config ('mysql-virtual_gids.cf ' );
1094-
1095- //* mysql-virtual_uids.cf
1096- $ this ->process_postfix_config ('mysql-virtual_uids.cf ' );
1056+ //* Install virtual mappings
1057+ foreach (glob ('tpl/mysql-virtual_*.master ' ) as $ filename ) {
1058+ $ this ->process_postfix_config ( basename ($ filename , '.master ' ) );
1059+ }
10971060
1098- //* mysql-virtual_alias_domains .cf
1061+ //* mysql-verify_recipients .cf
10991062 $ this ->process_postfix_config ('mysql-verify_recipients.cf ' );
11001063
11011064 // test if lmtp if available
@@ -1789,11 +1752,18 @@ public function configure_rspamd() {
17891752 $ new_options [] = $ value ;
17901753 }
17911754 if ($ mail_config ['reject_sender_login_mismatch ' ] == 'y ' ) {
1792- array_splice ($ new_options , 0 , 0 , array ('reject_authenticated_sender_login_mismatch ' ));
1793-
1755+ // insert before permit_mynetworks
17941756 for ($ i = 0 ; isset ($ new_options [$ i ]); $ i ++) {
17951757 if ($ new_options [$ i ] == 'permit_mynetworks ' ) {
1796- array_splice ($ new_options , $ i +1 , 0 , array ('reject_sender_login_mismatch ' ));
1758+ array_splice ($ new_options , $ i , 0 , array ('reject_authenticated_sender_login_mismatch ' ));
1759+ break ;
1760+ }
1761+ }
1762+
1763+ // insert before permit_sasl_authenticated
1764+ for ($ i = 0 ; isset ($ new_options [$ i ]); $ i ++) {
1765+ if ($ new_options [$ i ] == 'permit_sasl_authenticated ' ) {
1766+ array_splice ($ new_options , $ i , 0 , array ('reject_sender_login_mismatch ' ));
17971767 break ;
17981768 }
17991769 }
@@ -2939,6 +2909,21 @@ public function make_ispconfig_ssl_cert() {
29392909 $ acme = explode ("\n" , shell_exec ('which /usr/local/ispconfig/server/scripts/acme.sh /root/.acme.sh/acme.sh ' ));
29402910 $ acme = reset ($ acme );
29412911
2912+ if ((!$ acme || !is_executable ($ acme )) && (!$ le_client || !is_executable ($ le_client ))) {
2913+ $ success = $ this ->install_acme ();
2914+ if (!$ success ) {
2915+ swriteln ('Failed installing acme.sh. Will not be able to issue certificate during install. ' );
2916+ } else {
2917+ $ acme = explode ("\n" , shell_exec ('which /usr/local/ispconfig/server/scripts/acme.sh /root/.acme.sh/acme.sh ' ));
2918+ $ acme = reset ($ acme );
2919+ if ($ acme && is_executable ($ acme )) {
2920+ swriteln ('Installed acme.sh and using it for certificate creation during install. ' );
2921+ } else {
2922+ swriteln ('Failed installing acme.sh. Will not be able to issue certificate during install. ' );
2923+ }
2924+ }
2925+ }
2926+
29422927 $ restore_conf_symlink = false ;
29432928
29442929 // we only need this for apache, so use fixed conf index
@@ -2969,15 +2954,24 @@ public function make_ispconfig_ssl_cert() {
29692954 $ issued_successfully = false ;
29702955
29712956 // Backup existing ispserver ssl files
2972- if (file_exists ($ ssl_crt_file ) || is_link ($ ssl_crt_file ))
2973- rename ($ ssl_crt_file , $ ssl_crt_file .'-temporary.bak ' );
2974- if (file_exists ($ ssl_key_file ) || is_link ($ ssl_key_file ))
2975- rename ($ ssl_key_file , $ ssl_key_file .'-temporary.bak ' );
2976- if (file_exists ($ ssl_pem_file ) || is_link ($ ssl_pem_file ))
2977- rename ($ ssl_pem_file , $ ssl_pem_file .'-temporary.bak ' );
2957+ if (file_exists ($ ssl_crt_file ) || is_link ($ ssl_crt_file )) {
2958+ rename ($ ssl_crt_file , $ ssl_crt_file . '-temporary.bak ' );
2959+ }
2960+ if (file_exists ($ ssl_key_file ) || is_link ($ ssl_key_file )) {
2961+ rename ($ ssl_key_file , $ ssl_key_file . '-temporary.bak ' );
2962+ }
2963+ if (file_exists ($ ssl_pem_file ) || is_link ($ ssl_pem_file )) {
2964+ rename ($ ssl_pem_file , $ ssl_pem_file . '-temporary.bak ' );
2965+ }
29782966
29792967 // Attempt to use Neilpang acme.sh first, as it is now the preferred LE client
29802968 if (is_executable ($ acme )) {
2969+ $ acme_cert_dir = dirname ($ acme ) . '/ ' . $ hostname ;
2970+
2971+ swriteln ('acme.sh is installed, overriding certificate path to use ' . $ acme_cert_dir );
2972+
2973+ # acme.sh does not set umask, resulting in incorrect permissions (ispconfig issue #6015)
2974+ $ old_umask = umask (0022 );
29812975
29822976 $ out = null ;
29832977 $ ret = null ;
@@ -3000,6 +2994,7 @@ public function make_ispconfig_ssl_cert() {
30002994 $ acme_chain = "--fullchain-file " . escapeshellarg ($ ssl_crt_file );
30012995 exec ("$ acme --install-cert -d " . escapeshellarg ($ hostname ) . " $ acme_key $ acme_chain " );
30022996 $ issued_successfully = true ;
2997+ umask ($ old_umask );
30032998
30042999 // Make temporary backup of self-signed certs permanent
30053000 if (file_exists ($ ssl_crt_file .'-temporary.bak ' ) || is_link ($ ssl_crt_file .'-temporary.bak ' ))
@@ -3012,6 +3007,8 @@ public function make_ispconfig_ssl_cert() {
30123007 } else {
30133008 swriteln ('Issuing certificate via acme.sh failed. Please check that your hostname can be verified by letsencrypt ' );
30143009
3010+ umask ($ old_umask );
3011+
30153012 // Restore temporary backup of self-signed certs
30163013 if (file_exists ($ ssl_crt_file .'-temporary.bak ' ) || is_link ($ ssl_crt_file .'-temporary.bak ' ))
30173014 rename ($ ssl_crt_file .'-temporary.bak ' , $ ssl_crt_file );
@@ -3075,7 +3072,7 @@ public function make_ispconfig_ssl_cert() {
30753072 rename ($ ssl_key_file .'-temporary.bak ' , $ ssl_key_file );
30763073 if (file_exists ($ ssl_pem_file .'-temporary.bak ' ) || is_link ($ ssl_pem_file .'-temporary.bak ' ))
30773074 rename ($ ssl_pem_file .'-temporary.bak ' , $ ssl_pem_file );
3078-
3075+
30793076 }
30803077 } else {
30813078 swriteln ('Did not find any valid acme client (acme.sh or certbot) ' );
0 commit comments