Sympl issueshttps://gitlab.com/sympl.io/sympl/-/issues2023-06-10T21:36:53Zhttps://gitlab.com/sympl.io/sympl/-/issues/325sympl: Removing packages doesn't clean up links and other files2023-06-10T21:36:53ZPaul Cammishsympl: Removing packages doesn't clean up links and other filesRemoving FTP and related monitoring.
This will involve checking what's left over after uninstalling each package, versus what was there originally then updating debian/postrm or similar to ensure things are cleaned up properly.
Origina...Removing FTP and related monitoring.
This will involve checking what's left over after uninstalling each package, versus what was there originally then updating debian/postrm or similar to ensure things are cleaned up properly.
Originally raised [on the forum](https://forum.sympl.io/t/removing-ftp-and-related-monitoring/290).https://gitlab.com/sympl.io/sympl/-/issues/338sympl-mail-dict-proxy - passed username incorrect? (bookworm)2023-06-10T20:43:17ZPaul Cammishsympl-mail-dict-proxy - passed username incorrect? (bookworm)Something changes with bookworm, and it now seems to dict proxy is now being sent `Lshared/passdb/<username><tab><username>` rather than the expected `Lshared/passdb/<username>`.
Trimming the tab and everything after this 'fixes' it, bu...Something changes with bookworm, and it now seems to dict proxy is now being sent `Lshared/passdb/<username><tab><username>` rather than the expected `Lshared/passdb/<username>`.
Trimming the tab and everything after this 'fixes' it, but it needs investigation as to why this happens.https://gitlab.com/sympl.io/sympl/-/issues/327letsencrypt initialisation uses incorrect e-mail address2023-05-12T15:40:23ZPaul Cammishletsencrypt initialisation uses incorrect e-mail address# Summary
When letsencrypt is initialised, if a second website has already been created, that site's domain is used to register with letsencrypt rather than the system's hostname domain.
# Steps to reproduce
1. Automatically install ...# Summary
When letsencrypt is initialised, if a second website has already been created, that site's domain is used to register with letsencrypt rather than the system's hostname domain.
# Steps to reproduce
1. Automatically install sympl on Debian 11.
2. 'sympl web create banana.DOMAIN'
3. Follow wiki instructions to rename system from localhost.localdomain to apple.DOMAIN
4. 'echo "letsencrypt" > /srv/apple.DOMAIN/config/ssl-provider'
5. 'sudo sympl-ssl --verbose --force $newhost'
# What is the current bug behavior?
When letsencrypt is run for the first time, if a website other than the default one has already been created, the wrong domain is used to register with letsencrypt
# What is the expected correct behavior?
The system hostname domain should be used
# Relevant logs and/or screenshots
```
* Examining certificates for apple.DOMAIN
SSL set 0: The certificate subject is not valid for this domain apple.DOMAIN.
SSL set 0: The certificate subject is not valid for this domain apple.DOMAIN.
No valid certificate sets found.
Fetching a new certificate from LetsEncrypt.
Created new account with email address: root@banana.DOMAIN
Requesting verification for apple.DOMAIN from https://acme-v02.api.letsencrypt.org/directory
Successfully verified apple.DOMAIN
Requesting verification for www.apple.DOMAIN from https://acme-v02.api.letsencrypt.org/directory
!! Unable to verify www.apple.DOMAIN (status: invalid)
!! Check http://www.apple.DOMAIN/.well-known/acme-challenge/V45LrunGXuYPgAU8fnsLSvQDZReL0DemhcFc0Nf0APY works.
Successfully fetched new certificate and created set 1
Rolled over to SSL set 1
```
You can see that while the correct certificate is requested (apple.DOMAIN), the wrong e-mail address (root@banana.DOMAIN) is used to register with letsencrypt.
# Possible fixes
Sorry, no idea.
/cc @kelduumhttps://gitlab.com/sympl.io/sympl/-/issues/321Add DNS records without preventing automatic generation2023-03-16T12:58:49ZPaul CammishAdd DNS records without preventing automatic generationI have my domain sign my emails with DKIM, using the host name as a selector, but I can also use an external SMTP server for some things, which has given me a public key to add to DNS. I guess in this case, I want to be able to add recor...I have my domain sign my emails with DKIM, using the host name as a selector, but I can also use an external SMTP server for some things, which has given me a public key to add to DNS. I guess in this case, I want to be able to add records to the DNS for the domain, but if I edit the DNS file, all other records will stop being updated. It would be good if there could be a different file for additional records so that the automatic file would still match its checksum.https://gitlab.com/sympl.io/sympl/-/issues/330sympl-webmail: Webmail should discourage over-use of the To: field2023-03-16T12:40:32ZPaul Cammishsympl-webmail: Webmail should discourage over-use of the To: fieldAs mentioned in https://forum.sympl.io/t/roundcube-max-disclosed-recipients/320, its possible to have Roundcube ask if you really want to send to lots of disclosed recipients.
This would be nice to add to the default configuration, alth...As mentioned in https://forum.sympl.io/t/roundcube-max-disclosed-recipients/320, its possible to have Roundcube ask if you really want to send to lots of disclosed recipients.
This would be nice to add to the default configuration, although with a reasonably high number.https://gitlab.com/sympl.io/sympl/-/issues/326sympl-web: sympl-web-rotate-logs doen't use an efficent naming convention.2022-08-05T14:02:45ZPaul Cammishsympl-web: sympl-web-rotate-logs doen't use an efficent naming convention.`sympl-web-rotate-logs` uses what is basically the worst case for backup efficiently in the logging, although this works like logrotate.
You get ~30 days of old logs, each named `.[1-3]?[0-9]` the older ones of which are gzipped. Each t...`sympl-web-rotate-logs` uses what is basically the worst case for backup efficiently in the logging, although this works like logrotate.
You get ~30 days of old logs, each named `.[1-3]?[0-9]` the older ones of which are gzipped. Each time it rotates, the highest number is dropped, and everything is moved up a number.
This isn't terrible for finding the old data, but it's not ideal, and it means each time you run a backup, *all* of the logs have changed, so even a quiet site ends up with all the logs being backed up again.
The logs should be datestamped, and then the oldest one(s) removed, that way each day's logs don't end up getting backed up over and over again for a month.https://gitlab.com/sympl.io/sympl/-/issues/324FTP logs should be written to /var/log/pure-ftp/connection.log or similar2022-04-25T11:58:29ZPaul CammishFTP logs should be written to /var/log/pure-ftp/connection.log or similarAt the moment they only get written to `/var/log/messages`, which isn't that logical as there's also a `/var/log/pure-ftpd/` directory, where you'd expect to find them.
Also, we shouldn't be logging the RDNS for connections without the ...At the moment they only get written to `/var/log/messages`, which isn't that logical as there's also a `/var/log/pure-ftpd/` directory, where you'd expect to find them.
Also, we shouldn't be logging the RDNS for connections without the IP where at all possible, as it's trivial to fake.https://gitlab.com/sympl.io/sympl/-/issues/319multiple: 'tempfile is deprecated; consider using mktemp instead.'2022-03-28T10:02:58ZPaul Cammishmultiple: 'tempfile is deprecated; consider using mktemp instead.'Reported in https://forum.sympl.host/t/tempfile-is-deprecated-messages/245
Cron weekly (and likely others) report `WARNING: tempfile is deprecated; consider using mktemp instead. ` when running the jobs.
On investigation, `tempfile` is...Reported in https://forum.sympl.host/t/tempfile-is-deprecated-messages/245
Cron weekly (and likely others) report `WARNING: tempfile is deprecated; consider using mktemp instead. ` when running the jobs.
On investigation, `tempfile` is used in:
```list
core/lib/symbiosis/config_file.rb
core/test.d/tc_utils.rb
core/test.d/tc_config_file.rb
dns/lib/symbiosis/config_files/tinydns.rb
firewall/sbin/sympl-firewall-blacklist
firewall/sbin/sympl-firewall-whitelist
firewall/sbin/sympl-firewall
firewall/test.d/tc_blacklistdb.r
ftp/test.d/tc_ftp.rb
mail/sympl/test.d/tc_poppassd.rb
mail/sympl/test.d/tc_dict_handler.rb
web/lib/symbiosis/config_files/apache.rb
web/lib/symbiosis/config_files/webalizer.rb
web/test.d/tc_apache_logger.rb
web/test.d/tb_sympl_web_configure.rb
```
More investigation is probably needed as it looks to be originating with the ruby tempfile.rb library.https://gitlab.com/sympl.io/sympl/-/issues/312sympl-firewall: iptables-persistent conflict2022-03-28T10:01:35ZPaul Cammishsympl-firewall: iptables-persistent conflictIt looks like when iptables-persistent is installed with a reasonable standard config, it can prevent DNS lookups when there's no IPv4 resolvers, which leads to the sympl-firewall hook waiting indefinitely and eventually being killed, an...It looks like when iptables-persistent is installed with a reasonable standard config, it can prevent DNS lookups when there's no IPv4 resolvers, which leads to the sympl-firewall hook waiting indefinitely and eventually being killed, and therefore no IPv6 coming up (and therefore no DNS resolution) which leads to other oddities.
Likely fix: make sure the hook doesn't stall indefinitely and instead times out.https://gitlab.com/sympl.io/sympl/-/issues/320sympl-firewall: does not play nicely with iptables-persistent2021-12-06T19:55:39ZPaul Cammishsympl-firewall: does not play nicely with iptables-persistentYou can get in an odd state if you don't have any v4 DNS resolvers and have iptables-persistent installed, where it will eventually fail to bring up the IPv6 address on the server, after timing out, and sympl-fireall will fail in an odd ...You can get in an odd state if you don't have any v4 DNS resolvers and have iptables-persistent installed, where it will eventually fail to bring up the IPv6 address on the server, after timing out, and sympl-fireall will fail in an odd was, meaning the server acts unusually.
Adding iptables-persistent (and friends) to the conflicts list should prevent this.https://gitlab.com/sympl.io/sympl/-/issues/314sympl-ftp: SSL cert isn't updated once rotated2021-09-20T22:46:56ZPaul Cammishsympl-ftp: SSL cert isn't updated once rotatedThere's nothing to restart the pure-ftpd service once the SSL cert is updated, so a monthly restart may be worthwhile.
From: https://forum.sympl.host/t/ftps-certificate-expired-error/225There's nothing to restart the pure-ftpd service once the SSL cert is updated, so a monthly restart may be worthwhile.
From: https://forum.sympl.host/t/ftps-certificate-expired-error/225https://gitlab.com/sympl.io/sympl/-/issues/20octoDNS as interface to DNS providers2021-09-05T00:36:13ZPaul CammishoctoDNS as interface to DNS providersoctoDNS has support for a number of providers, so it may be worth looking at integrating it.
https://github.com/github/octodns#supported-providersoctoDNS has support for a number of providers, so it may be worth looking at integrating it.
https://github.com/github/octodns#supported-providershttps://gitlab.com/sympl.io/sympl/-/issues/304sympl11 - Exim configuration uses tainting workaround2021-08-13T16:12:36ZPaul Cammishsympl11 - Exim configuration uses tainting workaroundThe configuration in Exim 4.94 has introduced the concept of training for user-submitted variables.
This causes some issues with the Sympl configuration as we need to be able to read the relevant information based on the input to route ...The configuration in Exim 4.94 has introduced the concept of training for user-submitted variables.
This causes some issues with the Sympl configuration as we need to be able to read the relevant information based on the input to route mail correctly.
A workaround has been applied to the relevant parts, but this should be removed before it leaves testing.https://gitlab.com/sympl.io/sympl/-/issues/313sympl-mail: Exim deny-unusual-characters acl is a little over-strict for outg...2021-07-01T13:14:18ZPaul Cammishsympl-mail: Exim deny-unusual-characters acl is a little over-strict for outgoing mail.Non-local domains deny `%` and `!` in email addresses, although they're valid, and it seems like Xero are using `!`'s in emails in some cases.
Replacing `local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./` with `local_parts = ^[./|] : ^.*@ :...Non-local domains deny `%` and `!` in email addresses, although they're valid, and it seems like Xero are using `!`'s in emails in some cases.
Replacing `local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./` with `local_parts = ^[./|] : ^.*@ : ^.*/\\.\\./` in https://gitlab.mythic-beasts.com/sympl/sympl/-/blob/buster/mail/exim4/sympl.d/10-acl/50-acl-check-rcpt/20-deny-unusual-characters should fix this.https://gitlab.com/sympl.io/sympl/-/issues/202Apache should support the PROXY protocol2021-05-14T14:44:13ZPaul CammishApache should support the PROXY protocolTo support reverse proxies passing through the originating source IP (for things like diagnostic logging, anti abuse and so on) Sympl should ideally support the PROXY protocol.
See https://www.haproxy.org/download/1.8/doc/proxy-protocol...To support reverse proxies passing through the originating source IP (for things like diagnostic logging, anti abuse and so on) Sympl should ideally support the PROXY protocol.
See https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt and mod_remoteip.
This may have to be a per-IP configuration looking at the Apache docs, or an overall system configuration. It would be nice however if it could be transparently configured.Future Planshttps://gitlab.com/sympl.io/sympl/-/issues/311sympl-core: MOTD refers to v9.0 and v10.02021-04-13T11:38:10ZPaul Cammishsympl-core: MOTD refers to v9.0 and v10.0Since switching to continuous releases, we should remove the '.0' references on the MOTDSince switching to continuous releases, we should remove the '.0' references on the MOTDhttps://gitlab.com/sympl.io/sympl/-/issues/228sympl-ssl dies when config directory is mangled2021-02-12T18:08:31ZPaul Cammishsympl-ssl dies when config directory is mangledThis looks to be a problem in Symbiosis also, but only appeared when upgrading from Symbiosis to Sympl.
What's happening is that sympl-ssl is being run, but if it has no certs for a site and a mangled config directory, it will fail and ...This looks to be a problem in Symbiosis also, but only appeared when upgrading from Symbiosis to Sympl.
What's happening is that sympl-ssl is being run, but if it has no certs for a site and a mangled config directory, it will fail and prevent the package from being configured.https://gitlab.com/sympl.io/sympl/-/issues/253sympl-test: Race condition with certificate testing2021-02-12T18:08:31ZPaul Cammishsympl-test: Race condition with certificate testingIt looks like on occasion a self-signed cert is being created, but being tested before it's valid.
Job [#9899](https://gitlab.mythic-beasts.com/sympl/sympl/-/jobs/9899) failed for 80f6dd1c78f1401f5980105fc948fa74a2f01759:
```
=========...It looks like on occasion a self-signed cert is being created, but being tested before it's valid.
Job [#9899](https://gitlab.mythic-beasts.com/sympl/sympl/-/jobs/9899) failed for 80f6dd1c78f1401f5980105fc948fa74a2f01759:
```
===============================================================================
Failure:
Exception raised:
OpenSSL::X509::CertificateError(<Not valid for rcyexz5q3p.test -- certificate is not yet valid (9)>)
test_ssl_verify_with_root_ca(SSLTest)
/etc/sympl/test.d/tc_ssl.rb:562:in `test_ssl_verify_with_root_ca'
559: #
560: assert_nothing_raised{ @domain.ssl_x509_certificate_file = @domain.directory+"/config/ssl.combined" }
561: assert_nothing_raised{ @domain.ssl_key_file = @domain.directory+"/config/ssl.combined" }
=> 562: assert_nothing_raised{ @domain.ssl_verify(@domain.ssl_x509_certificate, @domain.ssl_key, @domain.ssl_certificate_store, true) }
563: end
564:
565: def test_ssl_verify_with_intermediate_ca
===============================================================================
```https://gitlab.com/sympl.io/sympl/-/issues/278sympl-ssl: Reimplmentation2021-02-12T18:08:30ZPaul Cammishsympl-ssl: ReimplmentationComplete reimplementation of sympl-ssl in Python, maintaining all the existing functionality and resolving long-standing issues.Complete reimplementation of sympl-ssl in Python, maintaining all the existing functionality and resolving long-standing issues.Paul CammishPaul Cammishhttps://gitlab.com/sympl.io/sympl/-/issues/303sympl-firewall: Traffic on the local IPv6 network can trigger blacklisting of...2021-01-23T17:45:17ZPaul Cammishsympl-firewall: Traffic on the local IPv6 network can trigger blacklisting of the LANSympl will track IPv6 traffic at a /64 resolution, but this means if something on the same LAN is flagged and blacklisted, it will effectively disable IPv6 traffic from the same /64, which can interfere with monitoring or similar.
What ...Sympl will track IPv6 traffic at a /64 resolution, but this means if something on the same LAN is flagged and blacklisted, it will effectively disable IPv6 traffic from the same /64, which can interfere with monitoring or similar.
What should probably happen is that Sympl is a bit more granular with it's filtering of V6 addresses on the same /64, and instead only blocks individual IPs if it sees them acting suspicious.