freifunk/mail2-nixos-config
0
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

roundcube: recreate the session key on any restart of the install service, which includes any reboot

Browse source
This commit is contained in:
Daniel Frank 2019-09-07 00:48:56 +02:00
parent 0f1deedeb9
commit ef3386d983
Signed by: tokudan
GPG key ID: 063CCCAD04182D32
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
roundcube.nix
View file

@ -95,13 +95,13 @@ in
mkdir -p ${config.variables.roundcubeDataDir}/temp ${config.variables.roundcubeDataDir}/logs mkdir -p ${config.variables.roundcubeDataDir}/temp ${config.variables.roundcubeDataDir}/logs
chown -Rc ${config.variables.roundcubeUser} ${config.variables.roundcubeDataDir} chown -Rc ${config.variables.roundcubeUser} ${config.variables.roundcubeDataDir}
chmod -c 700 ${config.variables.roundcubeDataDir} chmod -c 700 ${config.variables.roundcubeDataDir}
if [ ! -s "${config.variables.roundcubeDataDir}/des_key" ]; then # Regenerate the key every now and then. This invalidates all sessions, but during reboot should be good enough.
${pkgs.coreutils}/bin/dd if=/dev/urandom bs=32 count=1 2>/dev/null | ${pkgs.coreutils}/bin/base64 > "${config.variables.roundcubeDataDir}/des_key" [ -f "${config.variables.roundcubeDataDir}/des_key" ] && ${pkgs.coreutils}/bin/shred "${config.variables.roundcubeDataDir}/des_key"
chown -c "${config.variables.roundcubeUser}":root "${config.variables.roundcubeDataDir}/des_key" ${pkgs.coreutils}/bin/dd if=/dev/urandom bs=32 count=1 2>/dev/null | ${pkgs.coreutils}/bin/base64 > "${config.variables.roundcubeDataDir}/des_key"
chmod -c 400 "${config.variables.roundcubeDataDir}/des_key" chown -c "${config.variables.roundcubeUser}":root "${config.variables.roundcubeDataDir}/des_key"
fi chmod -c 400 "${config.variables.roundcubeDataDir}/des_key"
if [ -s "${config.variables.roundcubeDataDir}/roundcube.sqlite" ]; then if [ -s "${config.variables.roundcubeDataDir}/roundcube.sqlite" ]; then
# Just go ahead and remove the sessions on a boot # Just go ahead and remove the sessions, the key to decrypt them has just been destroyed anyway.
${pkgs.sqlite}/bin/sqlite3 "${config.variables.roundcubeDataDir}/roundcube.sqlite" "DELETE FROM session;" ${pkgs.sqlite}/bin/sqlite3 "${config.variables.roundcubeDataDir}/roundcube.sqlite" "DELETE FROM session;"
fi fi
''; '';