@@ -43,6 +43,15 @@ public function __construct() {
4343 global $ conf ; //TODO: maybe $conf should be passed to constructor
4444 }
4545
46+ private function install_acme () {
47+ $ install_cmd = 'wget -O - https://get.acme.sh | sh ' ;
48+ $ ret = null ;
49+ $ val = 0 ;
50+ exec ($ install_cmd . ' 2>&1 ' , $ ret , $ val );
51+
52+ return ($ val == 0 ? true : false );
53+ }
54+
4655 //: TODO Implement the translation function and language files for the installer.
4756 public function lng ($ text ) {
4857 return $ text ;
@@ -674,9 +683,6 @@ public function grant_master_database_rights($verbose = false) {
674683 if ($ verbose ){
675684 echo $ query ."\n" ;
676685 }
677- if (!$ this ->dbmaster ->query ($ query , $ value ['db ' ] . '.software_update_inst ' , $ value ['user ' ], $ host )) {
678- $ this ->warning ('Unable to set rights of user in master database: ' .$ value ['db ' ]."\n Query: " .$ query ."\n Error: " .$ this ->dbmaster ->errorMessage );
679- }
680686
681687 $ query = "GRANT SELECT, UPDATE(`updated`) ON ?? TO ?@? " ;
682688 if ($ verbose ){
@@ -1051,58 +1057,12 @@ public function configure_postfix($options = '') {
10511057 $ postfix_version = preg_replace ('/.*=\s*/ ' , '' , $ out [0 ]);
10521058 unset($ out );
10531059
1054- //* mysql-virtual_domains.cf
1055- $ this ->process_postfix_config ('mysql-virtual_domains.cf ' );
1056-
1057- //* mysql-virtual_forwardings.cf
1058- $ this ->process_postfix_config ('mysql-virtual_forwardings.cf ' );
1059-
1060- //* mysql-virtual_alias_domains.cf
1061- $ this ->process_postfix_config ('mysql-virtual_alias_domains.cf ' );
1062-
1063- //* mysql-virtual_alias_maps.cf
1064- $ this ->process_postfix_config ('mysql-virtual_alias_maps.cf ' );
1065-
1066- //* mysql-virtual_mailboxes.cf
1067- $ this ->process_postfix_config ('mysql-virtual_mailboxes.cf ' );
1068-
1069- //* mysql-virtual_email2email.cf
1070- $ this ->process_postfix_config ('mysql-virtual_email2email.cf ' );
1071-
1072- //* mysql-virtual_transports.cf
1073- $ this ->process_postfix_config ('mysql-virtual_transports.cf ' );
1074-
1075- //* mysql-virtual_recipient.cf
1076- $ this ->process_postfix_config ('mysql-virtual_recipient.cf ' );
1077-
1078- //* mysql-virtual_sender.cf
1079- $ this ->process_postfix_config ('mysql-virtual_sender.cf ' );
1080-
1081- //* mysql-virtual_sender_login_maps.cf
1082- $ this ->process_postfix_config ('mysql-virtual_sender_login_maps.cf ' );
1083-
1084- //* mysql-virtual_client.cf
1085- $ this ->process_postfix_config ('mysql-virtual_client.cf ' );
1086-
1087- //* mysql-virtual_relaydomains.cf
1088- $ this ->process_postfix_config ('mysql-virtual_relaydomains.cf ' );
1089-
1090- //* mysql-virtual_relayrecipientmaps.cf
1091- $ this ->process_postfix_config ('mysql-virtual_relayrecipientmaps.cf ' );
1092-
1093- //* mysql-virtual_outgoing_bcc.cf
1094- $ this ->process_postfix_config ('mysql-virtual_outgoing_bcc.cf ' );
1095-
1096- //* mysql-virtual_policy_greylist.cf
1097- $ this ->process_postfix_config ('mysql-virtual_policy_greylist.cf ' );
1098-
1099- //* mysql-virtual_gids.cf.master
1100- $ this ->process_postfix_config ('mysql-virtual_gids.cf ' );
1101-
1102- //* mysql-virtual_uids.cf
1103- $ this ->process_postfix_config ('mysql-virtual_uids.cf ' );
1060+ //* Install virtual mappings
1061+ foreach (glob ('tpl/mysql-virtual_*.master ' ) as $ filename ) {
1062+ $ this ->process_postfix_config ( basename ($ filename , '.master ' ) );
1063+ }
11041064
1105- //* mysql-virtual_alias_domains .cf
1065+ //* mysql-verify_recipients .cf
11061066 $ this ->process_postfix_config ('mysql-verify_recipients.cf ' );
11071067
11081068 // test if lmtp if available
@@ -1240,6 +1200,7 @@ public function configure_postfix($options = '') {
12401200 touch ($ config_dir .'/mime_header_checks ' );
12411201 touch ($ config_dir .'/nested_header_checks ' );
12421202 touch ($ config_dir .'/body_checks ' );
1203+ touch ($ config_dir .'/sasl_passwd ' );
12431204
12441205 //* Create the mailman files
12451206 if (!is_dir ('/var/lib/mailman/data ' )) exec ('mkdir -p /var/lib/mailman/data ' );
@@ -1796,11 +1757,18 @@ public function configure_rspamd() {
17961757 $ new_options [] = $ value ;
17971758 }
17981759 if ($ mail_config ['reject_sender_login_mismatch ' ] == 'y ' ) {
1799- array_splice ($ new_options , 0 , 0 , array ('reject_authenticated_sender_login_mismatch ' ));
1800-
1760+ // insert before permit_mynetworks
18011761 for ($ i = 0 ; isset ($ new_options [$ i ]); $ i ++) {
18021762 if ($ new_options [$ i ] == 'permit_mynetworks ' ) {
1803- array_splice ($ new_options , $ i +1 , 0 , array ('reject_sender_login_mismatch ' ));
1763+ array_splice ($ new_options , $ i , 0 , array ('reject_authenticated_sender_login_mismatch ' ));
1764+ break ;
1765+ }
1766+ }
1767+
1768+ // insert before permit_sasl_authenticated
1769+ for ($ i = 0 ; isset ($ new_options [$ i ]); $ i ++) {
1770+ if ($ new_options [$ i ] == 'permit_sasl_authenticated ' ) {
1771+ array_splice ($ new_options , $ i , 0 , array ('reject_sender_login_mismatch ' ));
18041772 break ;
18051773 }
18061774 }
@@ -2946,6 +2914,21 @@ public function make_ispconfig_ssl_cert() {
29462914 $ acme = explode ("\n" , shell_exec ('which /usr/local/ispconfig/server/scripts/acme.sh /root/.acme.sh/acme.sh ' ));
29472915 $ acme = reset ($ acme );
29482916
2917+ if ((!$ acme || !is_executable ($ acme )) && (!$ le_client || !is_executable ($ le_client ))) {
2918+ $ success = $ this ->install_acme ();
2919+ if (!$ success ) {
2920+ swriteln ('Failed installing acme.sh. Will not be able to issue certificate during install. ' );
2921+ } else {
2922+ $ acme = explode ("\n" , shell_exec ('which /usr/local/ispconfig/server/scripts/acme.sh /root/.acme.sh/acme.sh ' ));
2923+ $ acme = reset ($ acme );
2924+ if ($ acme && is_executable ($ acme )) {
2925+ swriteln ('Installed acme.sh and using it for certificate creation during install. ' );
2926+ } else {
2927+ swriteln ('Failed installing acme.sh. Will not be able to issue certificate during install. ' );
2928+ }
2929+ }
2930+ }
2931+
29492932 $ restore_conf_symlink = false ;
29502933
29512934 // we only need this for apache, so use fixed conf index
@@ -2976,15 +2959,24 @@ public function make_ispconfig_ssl_cert() {
29762959 $ issued_successfully = false ;
29772960
29782961 // Backup existing ispserver ssl files
2979- if (file_exists ($ ssl_crt_file ) || is_link ($ ssl_crt_file ))
2980- rename ($ ssl_crt_file , $ ssl_crt_file .'-temporary.bak ' );
2981- if (file_exists ($ ssl_key_file ) || is_link ($ ssl_key_file ))
2982- rename ($ ssl_key_file , $ ssl_key_file .'-temporary.bak ' );
2983- if (file_exists ($ ssl_pem_file ) || is_link ($ ssl_pem_file ))
2984- rename ($ ssl_pem_file , $ ssl_pem_file .'-temporary.bak ' );
2962+ if (file_exists ($ ssl_crt_file ) || is_link ($ ssl_crt_file )) {
2963+ rename ($ ssl_crt_file , $ ssl_crt_file . '-temporary.bak ' );
2964+ }
2965+ if (file_exists ($ ssl_key_file ) || is_link ($ ssl_key_file )) {
2966+ rename ($ ssl_key_file , $ ssl_key_file . '-temporary.bak ' );
2967+ }
2968+ if (file_exists ($ ssl_pem_file ) || is_link ($ ssl_pem_file )) {
2969+ rename ($ ssl_pem_file , $ ssl_pem_file . '-temporary.bak ' );
2970+ }
29852971
29862972 // Attempt to use Neilpang acme.sh first, as it is now the preferred LE client
29872973 if (is_executable ($ acme )) {
2974+ $ acme_cert_dir = dirname ($ acme ) . '/ ' . $ hostname ;
2975+
2976+ swriteln ('acme.sh is installed, overriding certificate path to use ' . $ acme_cert_dir );
2977+
2978+ # acme.sh does not set umask, resulting in incorrect permissions (ispconfig issue #6015)
2979+ $ old_umask = umask (0022 );
29882980
29892981 $ out = null ;
29902982 $ ret = null ;
@@ -3007,6 +2999,7 @@ public function make_ispconfig_ssl_cert() {
30072999 $ acme_chain = "--fullchain-file " . escapeshellarg ($ ssl_crt_file );
30083000 exec ("$ acme --install-cert -d " . escapeshellarg ($ hostname ) . " $ acme_key $ acme_chain " );
30093001 $ issued_successfully = true ;
3002+ umask ($ old_umask );
30103003
30113004 // Make temporary backup of self-signed certs permanent
30123005 if (file_exists ($ ssl_crt_file .'-temporary.bak ' ) || is_link ($ ssl_crt_file .'-temporary.bak ' ))
@@ -3019,6 +3012,8 @@ public function make_ispconfig_ssl_cert() {
30193012 } else {
30203013 swriteln ('Issuing certificate via acme.sh failed. Please check that your hostname can be verified by letsencrypt ' );
30213014
3015+ umask ($ old_umask );
3016+
30223017 // Restore temporary backup of self-signed certs
30233018 if (file_exists ($ ssl_crt_file .'-temporary.bak ' ) || is_link ($ ssl_crt_file .'-temporary.bak ' ))
30243019 rename ($ ssl_crt_file .'-temporary.bak ' , $ ssl_crt_file );
@@ -3082,7 +3077,7 @@ public function make_ispconfig_ssl_cert() {
30823077 rename ($ ssl_key_file .'-temporary.bak ' , $ ssl_key_file );
30833078 if (file_exists ($ ssl_pem_file .'-temporary.bak ' ) || is_link ($ ssl_pem_file .'-temporary.bak ' ))
30843079 rename ($ ssl_pem_file .'-temporary.bak ' , $ ssl_pem_file );
3085-
3080+
30863081 }
30873082 } else {
30883083 swriteln ('Did not find any valid acme client (acme.sh or certbot) ' );
0 commit comments