Ns8-automx - Email client autoconfiguration

App
, ,
1

As discussed in Email client autodiscovery…

I’m happy to announce the initial release of ns8-automx, providing email client autoconfiguration for NethServer 8:

To install, run add-module ghcr.io/danb35/automx:0.1.1 1. It requires NS8 core 3.20.1 or later and a working mail installation. Better, add my software repository at https://danb35.github.io/ns8-repomd/ and install it from there.

This module is a packaging and integration of GitHub - croessner/automx · GitHub under NethServer 8.

User guide is at ns8-automx/docs/USER-GUIDE.md at master · danb35/ns8-automx · GitHub

Features

  • Provides auto-configuration XML documents compatible with Thunderbird and Outlook.
  • Provides .mobileconfig profiles for Apple devices (though not cryptographically signed, see below for more information).
  • .mobileconfig download page at https://autoconfig.<domain>/mobileconfig which users can use to download the configuration profile.
  • Reads available mail domains from the mail module, and provides a toggle to enable or disable each.
    • Creates Traefik routes for any enabled domains.
    • Uses ns8-dnshelper (Ns8-dnshelper - Tool to allow other modules to control your DNS records), if present, to add DNS records for autoconfig.<domain>, autodiscover.<domain>, and _autodiscover._tcp.<domain>, for any enabled domain that dnshelper can manage.
    • Ensures that DNS records (specifically, CNAME records for autoconfig.<domain> and autodiscover.<domain>) are present before creating routes, so that Let’s Encrypt certificate creation should succeed.
  • Optional Display Name lookup from the configured accounts provider (enabled by default, can be disabled).
    • This has the potential to leak information. Queries for the autoconfiguration information are unauthenticated using all three mechanisms, so this would allow an attacker to determine a user’s full name given an email address. Disable this option if you want to foreclose this possibility. Turning it off does not stop the endpoints from revealing whether the address/account exists.
  • Tested against Betterbird (Thunderbird fork), Outlook LTSC, and Apple Mail on macOS via .mobileconfig download.
  • Tested against OpenLDAP and Active Directory domain providers on NethServer 8.
    • Not tested against remote AD.

Not implemented yet

  • .mobileconfig signing. Apple’s .mobileconfig profiles can be signed with a valid x.509 certificate, and that’s planned for future implementation. At this time, these profiles will give warnings that they’re “Not verified,” but they’ve still been verified to work.
  • PACC. This is a “Internet-Draft” standard, and I’m not aware of any clients that currently implement it.
  • OAuth. NS8 doesn’t presently support this for mail. automx does, so if/when NS8 does, I expect to add that capability.
  • Autodiscover v2.
  • Support for more than one mail instance in the cluster. More than one mail instance on a single node is an invalid configuration because of port conflicts, but it’s possible to have one instance per node in a cluster. I don’t know how much demand there would be to support this.
  • I’d like a button in the /users-admin/ page that lets users download their own .mobileconfig file, but it doesn’t look like there’s any way for this (or any other) module to add to that page.
  • Support for aliases. This module does not currently resolve email aliases to the underlying username.
  • ActiveSync.
5 Likes
2

:heart: :heart: :heart: merci !

3

Cool

Does it also work with Activesync and Sogo?

4

Sogo shouldn’t need autoconfiguration; it’s its own web client. This is for desktop/mobile clients like Outlook, Thunderbird, Parula, Apple Mail, etc.–enter your email address, and it can look up the rest of the configuration details from your server this way, without your (or your users) needing to enter server addresses, ports, etc.

As to ActiveSync, I’m afraid I’m not very familiar with it–how would it be used here?

5

Sogo had indeed a webclient, but Outlook or IOS mail connects to Sogo by Activesync.

6
1 Like
7

Looking into it a bit more, I see how it could be useful. automx does support ActiveSync, but I haven’t implemented it as yet. I’ll put it on the list.

1 Like
8

image
image733×1161 90.9 KB

I’ve added a few features:

  • ActiveSync
  • CalDAV/CardDAV in .mobileconfig profiles
  • Signing .mobileconfig profiles

…among others, but those are the big ones. Haven’t pushed it as a release yet, though, as I don’t have anything that uses ActiveSync to test it out–if you do, I’d appreciate your doing so. If you haven’t installed ns8-automx yet, you can install the latest with add-module ghcr.io/danb35/automx:latest 1. If you’ve installed it previously (and it’s still installed), you can update with update-module ghcr.io/danb35/automx:latest automx1. Let me know how it goes.

Edit: Turns out my iPhone does do ActiveSync, and I was able to test it against SOGo successfully. I’ve therefore released 0.2.0. Release notes here: Release 0.2.0 · danb35/ns8-automx · GitHub

9

Just released 0.2.1, with two small changes

  • Rebased to upstream 3.0b5, which incorporates a fix I’d submitted dealing with capitalized Autodiscover paths.
  • Email alias resolution isn’t enabled by default on upgrades from 0.1. It wasn’t available in that version, so admins shouldn’t be surprised here. You can still turn it on, of course. It’s on by default in new installations of 0.2.
1 Like