mirror of
https://github.com/freedombox/FreedomBox.git
synced 2026-02-25 08:43:36 +00:00
828cc73320
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org> Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
65 lines
1.9 KiB
Python
65 lines
1.9 KiB
Python
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
"""
|
|
Generate DKIM keys for signing outgoing messages.
|
|
|
|
See: https://rspamd.com/doc/modules/dkim_signing.html
|
|
"""
|
|
|
|
import pathlib
|
|
import re
|
|
import shutil
|
|
import subprocess
|
|
|
|
from plinth import actions
|
|
|
|
_keys_dir = pathlib.Path('/var/lib/rspamd/dkim/')
|
|
|
|
DOMAIN_PART_REGEX = r'^[a-zA-Z0-9]([-a-zA-Z0-9]{,61}[a-zA-Z0-9])?$'
|
|
|
|
|
|
def _validate_domain_name(domain):
|
|
for part in domain.split('.'):
|
|
if not re.match(DOMAIN_PART_REGEX, part):
|
|
raise ValueError('Invalid domain name')
|
|
|
|
|
|
def get_public_key(domain):
|
|
"""Return the DKIM public key for the given domain."""
|
|
output = actions.superuser_run('email',
|
|
['dkim', 'get_dkim_public_key', domain])
|
|
return output.strip()
|
|
|
|
|
|
def action_get_dkim_public_key(domain):
|
|
"""Privileged action to get the public key from DKIM key."""
|
|
_validate_domain_name(domain)
|
|
key_file = _keys_dir / f'{domain}.dkim.key'
|
|
output = subprocess.check_output(
|
|
['openssl', 'rsa', '-in',
|
|
str(key_file), '-pubout'], stderr=subprocess.DEVNULL)
|
|
print(''.join(output.decode().splitlines()[1:-1]))
|
|
|
|
|
|
def action_setup_dkim(domain):
|
|
"""Create DKIM key for a given domain."""
|
|
_validate_domain_name(domain)
|
|
|
|
_keys_dir.mkdir(exist_ok=True)
|
|
_keys_dir.chmod(0o500)
|
|
shutil.chown(_keys_dir, '_rspamd', '_rspamd')
|
|
|
|
# Default path is /var/lib/dkim/$domain.$selector.key. Default selector is
|
|
# "dkim". Use these to simplify key management until we have a need to
|
|
# implement creating new or multiple keys.
|
|
key_file = _keys_dir / f'{domain}.dkim.key'
|
|
if key_file.exists():
|
|
return
|
|
|
|
# Ed25519 is widely *not* accepted as of 2022-01. See:
|
|
# https://serverfault.com/questions/1023674
|
|
subprocess.run([
|
|
'rspamadm', 'dkim_keygen', '-t', 'rsa', '-b', '2048', '-s', 'dkim',
|
|
'-d', domain, '-k', (str(key_file))
|
|
], check=True)
|
|
key_file.chmod(0o400)
|