debian stretch slim #784

mwlczk · 2017-12-28T10:10:20Z

switch to debian:stretch-slim:

first step correct the testdata, as newer packages are more strict
about the mail-structure.
add missing build-step in make
clean the userdb aswell
use timeout of netcat (nc -w), as postgrey would not close the connection
there is 2 extra mail-log-files (mail.info and mail.warn) -> count only mail.log
cosmetic: use "" instead of ''

new image benefits:

smaller size (52MB less)
0 CVEs compared to 11 CVEs in ubuntu 16.04 Image

better backport situation:

postfix 3.1.6 vs 3.1.0
fail2ban 0.9.6 vs 0.9.3
openssl 1.1.0f vs 1.0.2g
dovecot 2.2.27 vs 2.2.22
....

changes in Dockerfile and configfiles needed because of stretch-slim:

add missing gnupg and iproute2 package
remove non-free rar, unrar-free should do
rsyslog does not add syslog user and has different conf-structure
pyzor command discover was deprecated and is missing in the new
stretch package
dovecot does not know SSLv2 anymore. removed because of warnings in
log
iptables does not know imap3, IMAP working group chose imap2 in favor
of imap3
s. following commits aswell

- first step correct the testdata, as newer packages are more strict about the mail-structure.

- add missing build-step to make - clean the userdb aswell - use timeout of netcat, as postgrey would not close the connection - there is 2 extra mail-logs -> assert_output 5 - cosmetic: use "" instead of ''

new image: - smaller size - 0 CVEs compared to 11 CVEs in ubuntu 16.04 Image better backport situation - postfix 3.1.6 vs 3.1.0 - fail2ban 0.9.6 vs 0.9.3 ... changes needed because of stretch-slim: - add missing gnupg and iproute2 package - remove non-free rar, unrar-free should do - rsyslog does not add syslog user and has different conf-structure - pyzor command discover was deprecated and is missing in the new stretch package - dovecot does not know SSLv2 anymore. removed because of warnings in log - iptables does not know imap3, IMAP working group chose imap2 in favor of imap3

mwlczk · 2017-12-28T12:21:42Z

The tests run fine on my machine. Need to look into it, why Travis breaks. They changed the architecture mid-December though. Any hints on that would be great

mwlczk · 2017-12-28T15:31:50Z

retrigger travis ci to get a closer look into the build.

mwlczk · 2017-12-28T16:14:33Z

this is odd: travis might have some caching (or no-cache) issues.
First build run had 9 failures.
Second build run had only 1 failure - but no source code has been changed in between.

Gonna hunt that last failure down now.

SSLv2 seems to be a not known protocol anymore - good!

mwlczk · 2017-12-28T18:16:18Z

One more Travis try

mwlczk · 2017-12-28T18:47:47Z

Last two Travis runs exit at different tests.

make this test more stable. there might be more than only one mail.log (mail.info, mail.warn, ...)

new openssl 1.1.0 needs stronger ciphers, removed some weekers ones. Please, look through the new list of cipher! this needs to be done in another commit for all other SSL/TLS-Endpoints aswell.

let our server pre-empt the cipher list. Did a read through, wwwDOTpostfixDOTorg/FORWARD_SECRECY_READMEDOThtml and wwwDOTpostfixDOTorg/TLS_READMEDOThtml

mwlczk · 2017-12-29T22:28:13Z

Travis makes me wonder. If I seemingly fix one bug/test, it fails another test, which is executed earlier in the queue and passed all the times before.

…w and independent but identical container. many other test on the main 'mail' container might interfere here.

johansmitsnl · 2017-12-31T10:26:21Z

@mwlczk First of great PR!

A very good contribution, myself also tried to change this image to Debian because of better backport support that lacks in Ubuntu sometimes, couldn't agree more.

Sometimes travis is busy and due to the amount of containers that are started some tests are not yet ready to be tested and this gives sometimes some mixed test results. This is a improvement that needs to be applied to this project #324.

Looking forward to merging this PR but some questions:

Could you remove commented old code?
Besides the tests are you using the PR live?
Any notes that should be considered when merging, todo's or ...?

johansmitsnl · 2017-12-31T10:26:41Z

Dockerfile

@@ -60,7 +62,7 @@ RUN apt-get update -q --fix-missing && \
    postfix-pcre \
    postfix-policyd-spf-python \
    pyzor \
-    rar \
+    # rar \


Remove the line if not used

johansmitsnl · 2017-12-31T10:26:58Z

Dockerfile

@@ -177,8 +180,9 @@ RUN sed -i -r "/^#?compress/c\compress\ncopytruncate" /etc/logrotate.conf && \
  chown -R clamav:root /var/log/mail/clamav.log && \
  touch /var/log/mail/freshclam.log && \
  chown -R clamav:root /var/log/mail/freshclam.log && \
-  sed -i -r 's|/var/log/mail|/var/log/mail/mail|g' /etc/rsyslog.d/50-default.conf && \
-  sed -i -r 's|;auth,authpriv.none|;mail.none;mail.error;auth,authpriv.none|g' /etc/rsyslog.d/50-default.conf && \
+  # no separate 50-default.conf


Remove the line if not used

johansmitsnl · 2017-12-31T10:27:54Z

test/tests.bats

-  run docker exec mail_with_postgrey /bin/sh -c "nc 0.0.0.0 10023 < /tmp/docker-mailserver-test/nc_templates/postgrey_whitelist.txt"
-  sleep 8
+  run docker exec mail_with_postgrey /bin/sh -c "nc -w 8 0.0.0.0 10023 < /tmp/docker-mailserver-test/nc_templates/postgrey_whitelist.txt"
+  # sleep 8


Remove the line if not used

mwlczk · 2017-12-31T10:53:58Z

@johansmitsnl

removed commented old code
am using this PR live
Notes: We should have a look at the cipher-suites for all
TLS-Endpoints (smtp, smtpd, imaps, pop3s, ...), because newer
package (e.g. openssl) might cause problems with older stuff.
Anyway we should keep an eye to update them in a next PR.

mwlczk added 3 commits December 28, 2017 10:04

Switch to stretch-slim as base image.

0e411ef

- first step correct the testdata, as newer packages are more strict about the mail-structure.

Switch to stretch-slim: correcting the test-environment and the build

a129de1

- add missing build-step to make - clean the userdb aswell - use timeout of netcat, as postgrey would not close the connection - there is 2 extra mail-logs -> assert_output 5 - cosmetic: use "" instead of ''

mwlczk changed the title ~~Stretch slim~~ debian stretch slim Dec 28, 2017

mwlczk closed this Dec 28, 2017

mwlczk reopened this Dec 28, 2017

Switch to debian stretch slim:

0dafce3

SSLv2 seems to be a not known protocol anymore - good!

mwlczk closed this Dec 28, 2017

mwlczk reopened this Dec 28, 2017

mwlczk closed this Dec 28, 2017

mwlczk reopened this Dec 28, 2017

mwlczk added 3 commits December 28, 2017 19:59

switch to debian stretch slim:

b154fb5

make this test more stable. there might be more than only one mail.log (mail.info, mail.warn, ...)

switch to debian stretc slim:

3dee443

new openssl 1.1.0 needs stronger ciphers, removed some weekers ones. Please, look through the new list of cipher! this needs to be done in another commit for all other SSL/TLS-Endpoints aswell.

Switch to debian stretch slim:

1069591

let our server pre-empt the cipher list. Did a read through, wwwDOTpostfixDOTorg/FORWARD_SECRECY_READMEDOThtml and wwwDOTpostfixDOTorg/TLS_READMEDOThtml

mwlczk closed this Dec 29, 2017

mwlczk reopened this Dec 29, 2017

Switch to debian stretch slim: lets give this openssl-based test a ne…

a9adb9c

…w and independent but identical container. many other test on the main 'mail' container might interfere here.

This was referenced Dec 30, 2017

Panic/Error/Fatal: dovecot 2.2.22 core dumped - fixed by using dovecot 2.2.27 #773

Closed

postgrey is version 1.35, which is ancient… #616

Closed

johansmitsnl suggested changes Dec 31, 2017

View reviewed changes

Switch to debian stretch slim: remove unused lines

d664ed3

johansmitsnl approved these changes Dec 31, 2017

View reviewed changes

johansmitsnl merged commit 49b3867 into docker-mailserver:master Dec 31, 2017

johansmitsnl mentioned this pull request Dec 31, 2017

Find the right interface for the container #607 #746

Closed

mwlczk deleted the stretch-slim branch January 1, 2018 15:34

mwlczk mentioned this pull request Feb 12, 2018

Nist tls #831

Merged

kortenkamp mentioned this pull request Feb 20, 2018

iOS 9 devices cannot send mails using SMTP #856

Closed

17Halbe mentioned this pull request Mar 22, 2018

Password creation fix #914

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

debian stretch slim #784

debian stretch slim #784

mwlczk commented Dec 28, 2017 •

edited

mwlczk commented Dec 28, 2017

mwlczk commented Dec 28, 2017

mwlczk commented Dec 28, 2017

mwlczk commented Dec 28, 2017

mwlczk commented Dec 28, 2017

mwlczk commented Dec 29, 2017

johansmitsnl commented Dec 31, 2017

johansmitsnl Dec 31, 2017

johansmitsnl Dec 31, 2017

johansmitsnl Dec 31, 2017

mwlczk commented Dec 31, 2017

debian stretch slim #784

debian stretch slim #784

Conversation

mwlczk commented Dec 28, 2017 • edited

mwlczk commented Dec 28, 2017

mwlczk commented Dec 28, 2017

mwlczk commented Dec 28, 2017

mwlczk commented Dec 28, 2017

mwlczk commented Dec 28, 2017

mwlczk commented Dec 29, 2017

johansmitsnl commented Dec 31, 2017

johansmitsnl Dec 31, 2017

Choose a reason for hiding this comment

johansmitsnl Dec 31, 2017

Choose a reason for hiding this comment

johansmitsnl Dec 31, 2017

Choose a reason for hiding this comment

mwlczk commented Dec 31, 2017

mwlczk commented Dec 28, 2017 •

edited