Ns8-automx - Email client autoconfiguration

App
, ,
1

As discussed in Email client autodiscovery…

I’m happy to announce the initial release of ns8-automx, providing email client autoconfiguration for NethServer 8:

To install, run add-module ghcr.io/danb35/automx:0.1.1 1. It requires NS8 core 3.20.1 or later and a working mail installation. Better, add my software repository at https://danb35.github.io/ns8-repomd/ and install it from there.

This module is a packaging and integration of GitHub - croessner/automx · GitHub under NethServer 8.

User guide is at ns8-automx/docs/USER-GUIDE.md at master · danb35/ns8-automx · GitHub

Features

  • Provides auto-configuration XML documents compatible with Thunderbird and Outlook.
  • Provides .mobileconfig profiles for Apple devices (though not cryptographically signed, see below for more information).
  • .mobileconfig download page at https://autoconfig.<domain>/mobileconfig which users can use to download the configuration profile.
  • Reads available mail domains from the mail module, and provides a toggle to enable or disable each.
    • Creates Traefik routes for any enabled domains.
    • Uses ns8-dnshelper (Ns8-dnshelper - Tool to allow other modules to control your DNS records), if present, to add DNS records for autoconfig.<domain>, autodiscover.<domain>, and _autodiscover._tcp.<domain>, for any enabled domain that dnshelper can manage.
    • Ensures that DNS records (specifically, CNAME records for autoconfig.<domain> and autodiscover.<domain>) are present before creating routes, so that Let’s Encrypt certificate creation should succeed.
  • Optional Display Name lookup from the configured accounts provider (enabled by default, can be disabled).
    • This has the potential to leak information. Queries for the autoconfiguration information are unauthenticated using all three mechanisms, so this would allow an attacker to determine a user’s full name given an email address. Disable this option if you want to foreclose this possibility. Turning it off does not stop the endpoints from revealing whether the address/account exists.
  • Tested against Betterbird (Thunderbird fork), Outlook LTSC, and Apple Mail on macOS via .mobileconfig download.
  • Tested against OpenLDAP and Active Directory domain providers on NethServer 8.
    • Not tested against remote AD.

Not implemented yet

  • .mobileconfig signing. Apple’s .mobileconfig profiles can be signed with a valid x.509 certificate, and that’s planned for future implementation. At this time, these profiles will give warnings that they’re “Not verified,” but they’ve still been verified to work.
  • PACC. This is a “Internet-Draft” standard, and I’m not aware of any clients that currently implement it.
  • OAuth. NS8 doesn’t presently support this for mail. automx does, so if/when NS8 does, I expect to add that capability.
  • Autodiscover v2.
  • Support for more than one mail instance in the cluster. More than one mail instance on a single node is an invalid configuration because of port conflicts, but it’s possible to have one instance per node in a cluster. I don’t know how much demand there would be to support this.
  • I’d like a button in the /users-admin/ page that lets users download their own .mobileconfig file, but it doesn’t look like there’s any way for this (or any other) module to add to that page.
  • Support for aliases. This module does not currently resolve email aliases to the underlying username.
3 Likes