diff --git a/.etckeeper b/.etckeeper
index 239bb44d..365e817c 100755
--- a/.etckeeper
+++ b/.etckeeper
@@ -16,7 +16,6 @@ mkdir -p './clamav/onupdateexecute.d'
mkdir -p './clamav/virusevent.d'
mkdir -p './dbus-1/session.d'
mkdir -p './dbus-1/system.d'
-mkdir -p './dovecot/private'
mkdir -p './dpkg/dpkg.cfg.d'
mkdir -p './fail2ban/fail2ban.d'
mkdir -p './gss/mech.d'
@@ -42,9 +41,6 @@ mkdir -p './network/if-post-down.d'
mkdir -p './network/if-pre-up.d'
mkdir -p './nginx/modules-available'
mkdir -p './opt'
-mkdir -p './php/8.0/cgi/conf.d'
-mkdir -p './php/8.0/cli/conf.d'
-mkdir -p './php/8.0/fpm/conf.d'
mkdir -p './postfix/dynamicmaps.cf.d'
mkdir -p './postfix/sasl'
mkdir -p './qemu/fsfreeze-hook.d'
@@ -52,13 +48,11 @@ mkdir -p './security/limits.d'
mkdir -p './security/namespace.d'
mkdir -p './ssh/ssh_config.d'
mkdir -p './ssh/sshd_config.d'
-mkdir -p './ssl/private'
mkdir -p './systemd/network'
-mkdir -p './tmpfiles.d'
mkdir -p './udev/hwdb.d'
maybe chmod 0755 '.'
maybe chmod 0700 '.etckeeper'
-maybe chmod 0644 '.gitignore'
+maybe chmod 0600 '.gitignore'
maybe chmod 0755 'ImageMagick-6'
maybe chmod 0644 'ImageMagick-6/coder.xml'
maybe chmod 0644 'ImageMagick-6/colors.xml'
@@ -78,6 +72,7 @@ maybe chmod 0644 'ImageMagick-6/type.xml'
maybe chmod 0755 'NetworkManager'
maybe chmod 0755 'NetworkManager/dispatcher.d'
maybe chmod 0755 'NetworkManager/dispatcher.d/cloud-init-hook-network-manager'
+maybe chmod 0755 'NetworkManager/dispatcher.d/ntp'
maybe chmod 0755 'X11'
maybe chmod 0755 'X11/Xsession.d'
maybe chmod 0644 'X11/Xsession.d/90gpg-agent'
@@ -86,6 +81,7 @@ maybe chmod 0644 'adduser.conf'
maybe chmod 0755 'aide'
maybe chmod 0755 'aide/aide.conf.d'
maybe chmod 0755 'aide/aide.settings.d'
+maybe chmod 0644 'aliases'
maybe chmod 0755 'alternatives'
maybe chmod 0644 'alternatives/README'
maybe chmod 0755 'amavis'
@@ -114,6 +110,8 @@ maybe chmod 0644 'amavis/en_US/template-virus-sender.txt'
maybe chmod 0755 'apache2'
maybe chmod 0755 'apache2/conf-available'
maybe chmod 0644 'apache2/conf-available/javascript-common.conf'
+maybe chmod 0644 'apache2/conf-available/php8.0-cgi.conf'
+maybe chmod 0644 'apache2/conf-available/php8.0-fpm.conf'
maybe chmod 0755 'apache2/mods-available'
maybe chmod 0755 'apm'
maybe chmod 0755 'apm/event.d'
@@ -246,7 +244,10 @@ maybe chmod 0755 'apparmor.d/local'
maybe chmod 0644 'apparmor.d/local/README'
maybe chmod 0644 'apparmor.d/local/lsb_release'
maybe chmod 0644 'apparmor.d/local/nvidia_modprobe'
+maybe chmod 0644 'apparmor.d/local/usr.bin.freshclam'
maybe chmod 0644 'apparmor.d/local/usr.bin.man'
+maybe chmod 0644 'apparmor.d/local/usr.sbin.clamd'
+maybe chmod 0644 'apparmor.d/local/usr.sbin.ntpd'
maybe chmod 0644 'apparmor.d/lsb_release'
maybe chmod 0644 'apparmor.d/nvidia_modprobe'
maybe chmod 0755 'apparmor.d/tunables'
@@ -262,6 +263,7 @@ maybe chmod 0644 'apparmor.d/tunables/kernelvars'
maybe chmod 0644 'apparmor.d/tunables/multiarch'
maybe chmod 0755 'apparmor.d/tunables/multiarch.d'
maybe chmod 0644 'apparmor.d/tunables/multiarch.d/site.local'
+maybe chmod 0644 'apparmor.d/tunables/ntpd'
maybe chmod 0644 'apparmor.d/tunables/proc'
maybe chmod 0644 'apparmor.d/tunables/run'
maybe chmod 0644 'apparmor.d/tunables/securityfs'
@@ -270,8 +272,11 @@ maybe chmod 0644 'apparmor.d/tunables/sys'
maybe chmod 0644 'apparmor.d/tunables/xdg-user-dirs'
maybe chmod 0755 'apparmor.d/tunables/xdg-user-dirs.d'
maybe chmod 0644 'apparmor.d/tunables/xdg-user-dirs.d/site.local'
+maybe chmod 0644 'apparmor.d/usr.bin.freshclam'
maybe chmod 0644 'apparmor.d/usr.bin.man'
+maybe chmod 0644 'apparmor.d/usr.sbin.clamd'
maybe chmod 0644 'apparmor.d/usr.sbin.mariadbd'
+maybe chmod 0644 'apparmor.d/usr.sbin.ntpd'
maybe chmod 0755 'apparmor/init'
maybe chmod 0755 'apparmor/init/network-interface-security'
maybe chmod 0644 'apparmor/parser.conf'
@@ -284,6 +289,7 @@ maybe chmod 0444 'apt/apt.conf.d/01autoremove-kernels'
maybe chmod 0644 'apt/apt.conf.d/05etckeeper'
maybe chmod 0644 'apt/apt.conf.d/20listchanges'
maybe chmod 0644 'apt/apt.conf.d/70debconf'
+maybe chmod 0644 'apt/apt.conf.d/90rkhunter'
maybe chmod 0755 'apt/auth.conf.d'
maybe chmod 0755 'apt/keyrings'
maybe chmod 0644 'apt/keyrings/rspamd.gpg'
@@ -318,13 +324,16 @@ maybe chmod 0644 'ca-certificates.conf'
maybe chmod 0755 'ca-certificates/update.d'
maybe chmod 0755 'calendar'
maybe chmod 0644 'calendar/default'
+maybe chmod 0644 'chkrootkit.conf'
maybe chmod 0755 'clamav'
maybe chmod 0755 'clamav-unofficial-sigs'
maybe chmod 0644 'clamav-unofficial-sigs/master.conf'
maybe chmod 0644 'clamav-unofficial-sigs/os.conf'
maybe chmod 0644 'clamav-unofficial-sigs/user.conf'
maybe chmod 0644 'clamav/clamd.conf'
-maybe chmod 0644 'clamav/freshclam.conf'
+maybe chown 'clamav' 'clamav/freshclam.conf'
+maybe chgrp 'adm' 'clamav/freshclam.conf'
+maybe chmod 0444 'clamav/freshclam.conf'
maybe chmod 0755 'clamav/onerrorexecute.d'
maybe chmod 0755 'clamav/onupdateexecute.d'
maybe chmod 0755 'clamav/virusevent.d'
@@ -399,16 +408,21 @@ maybe chmod 0644 'console-setup/compose.VISCII.inc'
maybe chmod 0644 'console-setup/remap.inc'
maybe chmod 0755 'cron.d'
maybe chmod 0644 'cron.d/.placeholder'
+maybe chmod 0644 'cron.d/amavisd-new'
maybe chmod 0644 'cron.d/e2scrub_all'
maybe chmod 0644 'cron.d/kernel'
maybe chmod 0644 'cron.d/php'
maybe chmod 0755 'cron.daily'
maybe chmod 0644 'cron.daily/.placeholder'
maybe chmod 0755 'cron.daily/apt-compat'
+maybe chmod 0755 'cron.daily/chkrootkit'
maybe chmod 0755 'cron.daily/dpkg'
maybe chmod 0755 'cron.daily/etckeeper'
maybe chmod 0755 'cron.daily/logrotate'
maybe chmod 0755 'cron.daily/man-db'
+maybe chmod 0755 'cron.daily/mlocate'
+maybe chmod 0755 'cron.daily/ntp'
+maybe chmod 0755 'cron.daily/rkhunter'
maybe chmod 0755 'cron.hourly'
maybe chmod 0644 'cron.hourly/.placeholder'
maybe chmod 0755 'cron.monthly'
@@ -416,6 +430,7 @@ maybe chmod 0644 'cron.monthly/.placeholder'
maybe chmod 0755 'cron.weekly'
maybe chmod 0644 'cron.weekly/.placeholder'
maybe chmod 0755 'cron.weekly/man-db'
+maybe chmod 0755 'cron.weekly/rkhunter'
maybe chmod 0644 'crontab'
maybe chmod 0755 'cruft'
maybe chmod 0755 'cruft/filters-unex'
@@ -426,9 +441,11 @@ maybe chmod 0755 'dbus-1/system.d'
maybe chmod 0644 'debconf.conf'
maybe chmod 0644 'debian_version'
maybe chmod 0755 'default'
+maybe chmod 0644 'default/amavisd-snmp-subagent'
maybe chmod 0644 'default/console-setup'
maybe chmod 0644 'default/cron'
maybe chmod 0644 'default/dbus'
+maybe chmod 0644 'default/dovecot'
maybe chmod 0644 'default/fail2ban'
maybe chmod 0644 'default/grub'
maybe chmod 0755 'default/grub.d'
@@ -439,7 +456,12 @@ maybe chmod 0644 'default/locale'
maybe chmod 0644 'default/networking'
maybe chmod 0644 'default/nginx'
maybe chmod 0644 'default/nss'
+maybe chmod 0644 'default/ntp'
+maybe chmod 0644 'default/ntpdate'
+maybe chmod 0644 'default/opendkim'
+maybe chmod 0644 'default/postgrey'
maybe chmod 0644 'default/redis-server'
+maybe chmod 0644 'default/rkhunter'
maybe chmod 0644 'default/rsync'
maybe chmod 0644 'default/ssh'
maybe chmod 0644 'default/useradd'
@@ -449,6 +471,8 @@ maybe chmod 0644 'dhcp/debug'
maybe chmod 0755 'dhcp/dhclient-enter-hooks.d'
maybe chmod 0755 'dhcp/dhclient-exit-hooks.d'
maybe chmod 0755 'dhcp/dhclient-exit-hooks.d/hook-dhclient'
+maybe chmod 0644 'dhcp/dhclient-exit-hooks.d/ntp'
+maybe chmod 0644 'dhcp/dhclient-exit-hooks.d/ntpdate'
maybe chmod 0644 'dhcp/dhclient-exit-hooks.d/rfc3442-classless-routes'
maybe chmod 0644 'dhcp/dhclient-exit-hooks.d/timesyncd'
maybe chmod 0644 'dhcp/dhclient.conf'
@@ -456,10 +480,14 @@ maybe chmod 0755 'dictionaries-common'
maybe chmod 0644 'discover-modprobe.conf'
maybe chmod 0755 'discover.conf.d'
maybe chmod 0644 'discover.conf.d/00discover'
-maybe chmod 0755 'dkimkeys'
+maybe chown 'opendkim' 'dkimkeys'
+maybe chgrp 'opendkim' 'dkimkeys'
+maybe chmod 0700 'dkimkeys'
maybe chmod 0644 'dkimkeys/README.PrivateKeys'
maybe chmod 0755 'dkms'
maybe chmod 0644 'dkms/framework.conf'
+maybe chmod 0755 'dkms/kernel_install.d_dkms'
+maybe chmod 0755 'dkms/sign_helper.sh'
maybe chmod 0755 'dkms/template-dkms-mkbmdeb'
maybe chmod 0644 'dkms/template-dkms-mkbmdeb/Makefile'
maybe chmod 0755 'dkms/template-dkms-mkbmdeb/debian'
@@ -483,12 +511,41 @@ maybe chmod 0755 'dkms/template-dkms-mkdeb/debian/prerm'
maybe chmod 0755 'dkms/template-dkms-mkdeb/debian/rules'
maybe chmod 0755 'dovecot'
maybe chmod 0755 'dovecot/conf.d'
+maybe chmod 0644 'dovecot/conf.d/10-auth.conf'
+maybe chmod 0644 'dovecot/conf.d/10-director.conf'
+maybe chmod 0644 'dovecot/conf.d/10-logging.conf'
+maybe chmod 0644 'dovecot/conf.d/10-mail.conf'
+maybe chmod 0644 'dovecot/conf.d/10-master.conf'
maybe chmod 0644 'dovecot/conf.d/10-ssl.conf'
+maybe chmod 0644 'dovecot/conf.d/10-tcpwrapper.conf'
+maybe chmod 0644 'dovecot/conf.d/15-lda.conf'
+maybe chmod 0644 'dovecot/conf.d/15-mailboxes.conf'
maybe chmod 0644 'dovecot/conf.d/20-imap.conf'
+maybe chmod 0644 'dovecot/conf.d/20-lmtp.conf'
+maybe chmod 0644 'dovecot/conf.d/20-managesieve.conf'
+maybe chmod 0644 'dovecot/conf.d/20-pop3.conf'
+maybe chmod 0644 'dovecot/conf.d/90-acl.conf'
+maybe chmod 0644 'dovecot/conf.d/90-plugin.conf'
+maybe chmod 0644 'dovecot/conf.d/90-quota.conf'
+maybe chmod 0644 'dovecot/conf.d/90-sieve-extprograms.conf'
maybe chmod 0644 'dovecot/conf.d/90-sieve.conf'
+maybe chmod 0644 'dovecot/conf.d/auth-checkpassword.conf.ext'
+maybe chmod 0644 'dovecot/conf.d/auth-deny.conf.ext'
+maybe chmod 0644 'dovecot/conf.d/auth-dict.conf.ext'
+maybe chmod 0644 'dovecot/conf.d/auth-master.conf.ext'
+maybe chmod 0644 'dovecot/conf.d/auth-passwdfile.conf.ext'
+maybe chmod 0644 'dovecot/conf.d/auth-sql.conf.ext'
+maybe chmod 0644 'dovecot/conf.d/auth-static.conf.ext'
+maybe chmod 0644 'dovecot/conf.d/auth-system.conf.ext'
+maybe chgrp 'dovecot' 'dovecot/dovecot-dict-auth.conf.ext'
+maybe chmod 0640 'dovecot/dovecot-dict-auth.conf.ext'
+maybe chgrp 'dovecot' 'dovecot/dovecot-dict-sql.conf.ext'
+maybe chmod 0640 'dovecot/dovecot-dict-sql.conf.ext'
maybe chmod 0644 'dovecot/dovecot-mysql.conf'
+maybe chgrp 'dovecot' 'dovecot/dovecot-sql.conf.ext'
+maybe chmod 0640 'dovecot/dovecot-sql.conf.ext'
maybe chmod 0644 'dovecot/dovecot.conf'
-maybe chmod 0755 'dovecot/private'
+maybe chmod 0700 'dovecot/private'
maybe chmod 0755 'dovecot/sieve'
maybe chmod 0755 'dovecot/sieve-after'
maybe chmod 0644 'dovecot/sieve-after/spam-to-folder.sieve'
@@ -501,6 +558,8 @@ maybe chmod 0644 'dpkg/dpkg.cfg'
maybe chmod 0755 'dpkg/dpkg.cfg.d'
maybe chmod 0755 'dpkg/origins'
maybe chmod 0644 'dpkg/origins/debian'
+maybe chmod 0644 'dpkg/shlibs.default'
+maybe chmod 0644 'dpkg/shlibs.override'
maybe chmod 0644 'e2scrub.conf'
maybe chmod 0755 'emacs'
maybe chmod 0755 'emacs/site-start.d'
@@ -803,7 +862,12 @@ maybe chmod 0644 'hosts'
maybe chmod 0644 'hosts.allow'
maybe chmod 0644 'hosts.deny'
maybe chmod 0755 'init.d'
+maybe chmod 0755 'init.d/amavis'
+maybe chmod 0755 'init.d/amavis-mc'
+maybe chmod 0755 'init.d/amavisd-snmp-subagent'
maybe chmod 0755 'init.d/apparmor'
+maybe chmod 0755 'init.d/clamav-daemon'
+maybe chmod 0755 'init.d/clamav-freshclam'
maybe chmod 0755 'init.d/cloud-config'
maybe chmod 0755 'init.d/cloud-final'
maybe chmod 0755 'init.d/cloud-init'
@@ -811,6 +875,7 @@ maybe chmod 0755 'init.d/cloud-init-local'
maybe chmod 0755 'init.d/console-setup.sh'
maybe chmod 0755 'init.d/cron'
maybe chmod 0755 'init.d/dbus'
+maybe chmod 0755 'init.d/dovecot'
maybe chmod 0755 'init.d/fail2ban'
maybe chmod 0755 'init.d/hwclock.sh'
maybe chmod 0755 'init.d/keyboard-setup.sh'
@@ -819,11 +884,18 @@ maybe chmod 0755 'init.d/lm-sensors'
maybe chmod 0755 'init.d/mariadb'
maybe chmod 0755 'init.d/networking'
maybe chmod 0755 'init.d/nginx'
+maybe chmod 0755 'init.d/ntp'
+maybe chmod 0755 'init.d/opendkim'
+maybe chmod 0755 'init.d/php8.0-fpm'
+maybe chmod 0755 'init.d/postfix'
+maybe chmod 0755 'init.d/postgrey'
maybe chmod 0755 'init.d/procps'
maybe chmod 0755 'init.d/qemu-guest-agent'
maybe chmod 0755 'init.d/redis-server'
+maybe chmod 0755 'init.d/rspamd'
maybe chmod 0755 'init.d/rsync'
maybe chmod 0755 'init.d/rsyslog'
+maybe chmod 0755 'init.d/screen-cleanup'
maybe chmod 0755 'init.d/ssh'
maybe chmod 0755 'init.d/sudo'
maybe chmod 0755 'init.d/udev'
@@ -847,6 +919,7 @@ maybe chmod 0755 'initramfs-tools/scripts/panic'
maybe chmod 0644 'initramfs-tools/update-initramfs.conf'
maybe chmod 0644 'inputrc'
maybe chmod 0755 'insserv.conf.d'
+maybe chmod 0644 'insserv.conf.d/postfix'
maybe chmod 0755 'iproute2'
maybe chmod 0644 'iproute2/bpf_pinning'
maybe chmod 0644 'iproute2/ematch_map'
@@ -866,22 +939,27 @@ maybe chmod 0644 'issue.net'
maybe chmod 0755 'kernel'
maybe chmod 0644 'kernel-img.conf'
maybe chmod 0755 'kernel/header_postinst.d'
+maybe chmod 0755 'kernel/header_postinst.d/dkms'
maybe chmod 0755 'kernel/install.d'
maybe chmod 0755 'kernel/postinst.d'
maybe chmod 0755 'kernel/postinst.d/apt-auto-removal'
+maybe chmod 0755 'kernel/postinst.d/dkms'
maybe chmod 0755 'kernel/postinst.d/initramfs-tools'
maybe chmod 0755 'kernel/postinst.d/zz-update-grub'
maybe chmod 0755 'kernel/postrm.d'
maybe chmod 0755 'kernel/postrm.d/initramfs-tools'
maybe chmod 0755 'kernel/postrm.d/zz-update-grub'
maybe chmod 0755 'kernel/prerm.d'
+maybe chmod 0755 'kernel/prerm.d/dkms'
maybe chmod 0644 'ld.so.conf'
maybe chmod 0755 'ld.so.conf.d'
+maybe chmod 0644 'ld.so.conf.d/fakeroot-x86_64-linux-gnu.conf'
maybe chmod 0644 'ld.so.conf.d/libc.conf'
maybe chmod 0644 'ld.so.conf.d/x86_64-linux-gnu.conf'
maybe chmod 0755 'ldap'
maybe chmod 0644 'ldap/ldap.conf'
maybe chmod 0755 'ldap/schema'
+maybe chmod 0644 'ldap/schema/amavis.schema'
maybe chmod 0755 'letsencrypt'
maybe chmod 0644 'letsencrypt/.updated-options-ssl-apache-conf-digest.txt'
maybe chmod 0644 'letsencrypt/.updated-options-ssl-nginx-conf-digest.txt'
@@ -3521,11 +3599,16 @@ maybe chmod 0755 'logrotate.d'
maybe chmod 0644 'logrotate.d/alternatives'
maybe chmod 0644 'logrotate.d/apt'
maybe chmod 0644 'logrotate.d/btmp'
+maybe chmod 0644 'logrotate.d/clamav-daemon'
+maybe chmod 0644 'logrotate.d/clamav-freshclam'
maybe chmod 0644 'logrotate.d/dpkg'
maybe chmod 0644 'logrotate.d/fail2ban'
maybe chmod 0644 'logrotate.d/mysql-server'
maybe chmod 0644 'logrotate.d/nginx'
+maybe chmod 0644 'logrotate.d/php8.0-fpm'
maybe chmod 0644 'logrotate.d/redis-server'
+maybe chmod 0644 'logrotate.d/rkhunter'
+maybe chmod 0644 'logrotate.d/rspamd'
maybe chmod 0644 'logrotate.d/rsyslog'
maybe chmod 0644 'logrotate.d/wtmp'
maybe chmod 0755 'logwatch'
@@ -3539,6 +3622,7 @@ maybe chmod 0644 'magic'
maybe chmod 0644 'magic.mime'
maybe chmod 0755 'mail'
maybe chmod 0755 'mail/m4'
+maybe chmod 0644 'mail/m4/opendkim.m4'
maybe chmod 0644 'mailcap'
maybe chmod 0644 'mailcap.order'
maybe chmod 0644 'mailname'
@@ -3546,6 +3630,7 @@ maybe chmod 0644 'manpath.config'
maybe chmod 0644 'mime.types'
maybe chmod 0644 'mke2fs.conf'
maybe chmod 0755 'modprobe.d'
+maybe chmod 0644 'modprobe.d/dkms.conf'
maybe chmod 0644 'modules'
maybe chmod 0755 'modules-load.d'
maybe chmod 0755 'monit'
@@ -3572,9 +3657,13 @@ maybe chmod 0644 'neofetch/neofetch.config'
maybe chmod 0644 'netconfig'
maybe chmod 0755 'network'
maybe chmod 0755 'network/if-down.d'
+maybe chmod 0755 'network/if-down.d/clamav-freshclam-ifupdown'
+maybe chmod 0755 'network/if-down.d/postfix'
maybe chmod 0755 'network/if-post-down.d'
maybe chmod 0755 'network/if-pre-up.d'
maybe chmod 0755 'network/if-up.d'
+maybe chmod 0755 'network/if-up.d/clamav-freshclam-ifupdown'
+maybe chmod 0755 'network/if-up.d/postfix'
maybe chmod 0644 'network/interfaces'
maybe chmod 0755 'network/interfaces.d'
maybe chmod 0644 'network/interfaces.d/50-cloud-init.cfg'
@@ -3619,6 +3708,7 @@ maybe chmod 0644 'nginx/uwsgi_params'
maybe chmod 0644 'nginx/uwsgi_params.default'
maybe chmod 0644 'nginx/win-utf'
maybe chmod 0644 'nsswitch.conf'
+maybe chmod 0644 'ntp.conf'
maybe chmod 0755 'opendkim'
maybe chmod 0644 'opendkim.conf'
maybe chmod 0755 'opendkim/keys'
@@ -3639,6 +3729,7 @@ maybe chmod 0644 'pam.d/common-password'
maybe chmod 0644 'pam.d/common-session'
maybe chmod 0644 'pam.d/common-session-noninteractive'
maybe chmod 0644 'pam.d/cron'
+maybe chmod 0644 'pam.d/dovecot'
maybe chmod 0644 'pam.d/login'
maybe chmod 0644 'pam.d/newusers'
maybe chmod 0644 'pam.d/other'
@@ -3660,12 +3751,60 @@ maybe chmod 0755 'php'
maybe chmod 0755 'php/8.0'
maybe chmod 0755 'php/8.0/cgi'
maybe chmod 0755 'php/8.0/cgi/conf.d'
+maybe chmod 0644 'php/8.0/cgi/php.ini'
maybe chmod 0755 'php/8.0/cli'
maybe chmod 0755 'php/8.0/cli/conf.d'
+maybe chmod 0644 'php/8.0/cli/php.ini'
maybe chmod 0755 'php/8.0/fpm'
maybe chmod 0755 'php/8.0/fpm/conf.d'
+maybe chmod 0644 'php/8.0/fpm/php-fpm.conf'
+maybe chmod 0644 'php/8.0/fpm/php.ini'
maybe chmod 0755 'php/8.0/fpm/pool.d'
+maybe chmod 0644 'php/8.0/fpm/pool.d/www.conf'
maybe chmod 0755 'php/8.0/mods-available'
+maybe chmod 0644 'php/8.0/mods-available/apcu.ini'
+maybe chmod 0644 'php/8.0/mods-available/bcmath.ini'
+maybe chmod 0644 'php/8.0/mods-available/calendar.ini'
+maybe chmod 0644 'php/8.0/mods-available/ctype.ini'
+maybe chmod 0644 'php/8.0/mods-available/curl.ini'
+maybe chmod 0644 'php/8.0/mods-available/dom.ini'
+maybe chmod 0644 'php/8.0/mods-available/exif.ini'
+maybe chmod 0644 'php/8.0/mods-available/ffi.ini'
+maybe chmod 0644 'php/8.0/mods-available/fileinfo.ini'
+maybe chmod 0644 'php/8.0/mods-available/ftp.ini'
+maybe chmod 0644 'php/8.0/mods-available/gd.ini'
+maybe chmod 0644 'php/8.0/mods-available/gettext.ini'
+maybe chmod 0644 'php/8.0/mods-available/gmp.ini'
+maybe chmod 0644 'php/8.0/mods-available/iconv.ini'
+maybe chmod 0644 'php/8.0/mods-available/igbinary.ini'
+maybe chmod 0644 'php/8.0/mods-available/imagick.ini'
+maybe chmod 0644 'php/8.0/mods-available/imap.ini'
+maybe chmod 0644 'php/8.0/mods-available/intl.ini'
+maybe chmod 0644 'php/8.0/mods-available/mbstring.ini'
+maybe chmod 0644 'php/8.0/mods-available/memcache.ini'
+maybe chmod 0644 'php/8.0/mods-available/memcached.ini'
+maybe chmod 0644 'php/8.0/mods-available/msgpack.ini'
+maybe chmod 0644 'php/8.0/mods-available/mysqli.ini'
+maybe chmod 0644 'php/8.0/mods-available/mysqlnd.ini'
+maybe chmod 0644 'php/8.0/mods-available/opcache.ini'
+maybe chmod 0644 'php/8.0/mods-available/pdo.ini'
+maybe chmod 0644 'php/8.0/mods-available/pdo_mysql.ini'
+maybe chmod 0644 'php/8.0/mods-available/phar.ini'
+maybe chmod 0644 'php/8.0/mods-available/posix.ini'
+maybe chmod 0644 'php/8.0/mods-available/readline.ini'
+maybe chmod 0644 'php/8.0/mods-available/redis.ini'
+maybe chmod 0644 'php/8.0/mods-available/shmop.ini'
+maybe chmod 0644 'php/8.0/mods-available/simplexml.ini'
+maybe chmod 0644 'php/8.0/mods-available/sockets.ini'
+maybe chmod 0644 'php/8.0/mods-available/sysvmsg.ini'
+maybe chmod 0644 'php/8.0/mods-available/sysvsem.ini'
+maybe chmod 0644 'php/8.0/mods-available/sysvshm.ini'
+maybe chmod 0644 'php/8.0/mods-available/tokenizer.ini'
+maybe chmod 0644 'php/8.0/mods-available/xml.ini'
+maybe chmod 0644 'php/8.0/mods-available/xmlreader.ini'
+maybe chmod 0644 'php/8.0/mods-available/xmlwriter.ini'
+maybe chmod 0644 'php/8.0/mods-available/xsl.ini'
+maybe chmod 0644 'php/8.0/mods-available/zip.ini'
maybe chmod 0755 'postfix'
maybe chmod 0644 'postfix/dh_1024.pem'
maybe chmod 0644 'postfix/dh_512.pem'
@@ -3706,7 +3845,11 @@ maybe chmod 0644 'postgrey/whitelist_clients'
maybe chmod 0644 'postgrey/whitelist_recipients'
maybe chmod 0755 'ppp'
maybe chmod 0755 'ppp/ip-down.d'
+maybe chmod 0755 'ppp/ip-down.d/clamav-freshclam-ifupdown'
+maybe chmod 0755 'ppp/ip-down.d/postfix'
maybe chmod 0755 'ppp/ip-up.d'
+maybe chmod 0755 'ppp/ip-up.d/clamav-freshclam-ifupdown'
+maybe chmod 0755 'ppp/ip-up.d/postfix'
maybe chmod 0644 'profile'
maybe chmod 0755 'profile.d'
maybe chmod 0644 'profile.d/Z99-cloud-locale-test.sh'
@@ -3762,6 +3905,7 @@ maybe chmod 0640 'redis/redis.conf'
maybe chmod 0644 'reportbug.conf'
maybe chmod 0755 'resolvconf'
maybe chmod 0755 'resolvconf/update-libc.d'
+maybe chmod 0755 'resolvconf/update-libc.d/postfix'
maybe chmod 0644 'rkhunter.conf'
maybe chmod 0644 'rkhunter.conf.local'
maybe chmod 0644 'rpc'
@@ -3804,6 +3948,8 @@ maybe chmod 0755 'rspamd/modules.d'
maybe chmod 0644 'rspamd/modules.d/antivirus.conf'
maybe chmod 0644 'rspamd/modules.d/arc.conf'
maybe chmod 0644 'rspamd/modules.d/asn.conf'
+maybe chmod 0644 'rspamd/modules.d/aws_s3.conf'
+maybe chmod 0644 'rspamd/modules.d/bimi.conf'
maybe chmod 0644 'rspamd/modules.d/chartable.conf'
maybe chmod 0644 'rspamd/modules.d/clickhouse.conf'
maybe chmod 0644 'rspamd/modules.d/dcc.conf'
@@ -3812,6 +3958,7 @@ maybe chmod 0644 'rspamd/modules.d/dkim_signing.conf'
maybe chmod 0644 'rspamd/modules.d/dmarc.conf'
maybe chmod 0644 'rspamd/modules.d/elastic.conf'
maybe chmod 0644 'rspamd/modules.d/emails.conf'
+maybe chmod 0644 'rspamd/modules.d/external_relay.conf'
maybe chmod 0644 'rspamd/modules.d/external_services.conf'
maybe chmod 0644 'rspamd/modules.d/force_actions.conf'
maybe chmod 0644 'rspamd/modules.d/forged_recipients.conf'
@@ -3875,9 +4022,11 @@ maybe chmod 0644 'rspamd/worker-proxy.inc'
maybe chmod 0644 'rsyslog.conf'
maybe chmod 0755 'rsyslog.d'
maybe chmod 0644 'rsyslog.d/21-cloudinit.conf'
+maybe chmod 0644 'rsyslog.d/postfix.conf'
maybe chmod 0755 'runit'
maybe chmod 0755 'runit/runsvdir'
maybe chmod 0755 'runit/runsvdir/default'
+maybe chmod 0644 'screenrc'
maybe chmod 0755 'security'
maybe chmod 0644 'security/access.conf'
maybe chmod 0644 'security/faillock.conf'
@@ -3911,6 +4060,7 @@ maybe chmod 0644 'skel/.bashrc'
maybe chmod 0644 'skel/.profile'
maybe chmod 0755 'spamassassin'
maybe chmod 0755 'spamassassin/sa-update-hooks.d'
+maybe chmod 0755 'spamassassin/sa-update-hooks.d/amavisd-new'
maybe chmod 0755 'ssh'
maybe chmod 0644 'ssh/moduli'
maybe chmod 0644 'ssh/ssh_config'
@@ -3928,8 +4078,12 @@ maybe chmod 0755 'ssh/sshd_config.d'
maybe chmod 0755 'ssl'
maybe chmod 0755 'ssl/certs'
maybe chmod 0644 'ssl/certs/ca-certificates.crt'
+maybe chmod 0644 'ssl/certs/ssl-cert-snakeoil.pem'
maybe chmod 0644 'ssl/openssl.cnf'
-maybe chmod 0700 'ssl/private'
+maybe chgrp 'ssl-cert' 'ssl/private'
+maybe chmod 0710 'ssl/private'
+maybe chgrp 'ssl-cert' 'ssl/private/ssl-cert-snakeoil.key'
+maybe chmod 0640 'ssl/private/ssl-cert-snakeoil.key'
maybe chmod 0644 'subgid'
maybe chmod 0644 'subgid-'
maybe chmod 0644 'subuid'
@@ -3993,6 +4147,8 @@ maybe chmod 0644 'systemd/resolved.conf'
maybe chmod 0644 'systemd/sleep.conf'
maybe chmod 0755 'systemd/system'
maybe chmod 0644 'systemd/system.conf'
+maybe chmod 0755 'systemd/system/clamav-daemon.service.d'
+maybe chmod 0644 'systemd/system/clamav-daemon.service.d/extend.conf'
maybe chmod 0755 'systemd/system/cloud-init.target.wants'
maybe chmod 0755 'systemd/system/default.target.wants'
maybe chmod 0755 'systemd/system/getty.target.wants'
@@ -4010,6 +4166,7 @@ maybe chmod 0755 'terminfo'
maybe chmod 0644 'terminfo/README'
maybe chmod 0644 'timezone'
maybe chmod 0755 'tmpfiles.d'
+maybe chmod 0644 'tmpfiles.d/screen-cleanup.conf'
maybe chmod 0644 'ucf.conf'
maybe chmod 0755 'udev'
maybe chmod 0755 'udev/hwdb.d'
@@ -4019,10 +4176,14 @@ maybe chmod 0644 'udev/rules.d/80-hotplug-cpu-mem.rules'
maybe chmod 0644 'udev/udev.conf'
maybe chmod 0755 'ufw'
maybe chmod 0755 'ufw/applications.d'
+maybe chmod 0644 'ufw/applications.d/dovecot-imapd'
+maybe chmod 0644 'ufw/applications.d/dovecot-pop3d'
maybe chmod 0644 'ufw/applications.d/nginx'
maybe chmod 0644 'ufw/applications.d/openssh-server'
+maybe chmod 0644 'ufw/applications.d/postfix'
maybe chmod 0755 'update-motd.d'
maybe chmod 0755 'update-motd.d/10-uname'
+maybe chmod 0644 'updatedb.conf'
maybe chmod 0644 'vconsole.conf'
maybe chmod 0755 'vim'
maybe chmod 0644 'vim/vimrc'
diff --git a/NetworkManager/dispatcher.d/ntp b/NetworkManager/dispatcher.d/ntp
new file mode 100755
index 00000000..1775eaf6
--- /dev/null
+++ b/NetworkManager/dispatcher.d/ntp
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+old_ntp_servers="unknown and invalid"
+new_ntp_servers=$DHCP4_NTP_SERVERS
+case "$2" in
+ up|vpn-up) reason=BOUND; ;;
+ down|vpn-down) reason=RELEASE; ;;
+ *) exit 0; ;;
+esac
+
+test -f /etc/dhcp/dhclient-exit-hooks.d/ntp || exit 0
+. /etc/dhcp/dhclient-exit-hooks.d/ntp
diff --git a/aliases b/aliases
new file mode 100644
index 00000000..1c94d8ce
--- /dev/null
+++ b/aliases
@@ -0,0 +1,3 @@
+# See man 5 aliases for format
+postmaster: root
+clamav: root
diff --git a/alternatives/animate b/alternatives/animate
new file mode 120000
index 00000000..457655e5
--- /dev/null
+++ b/alternatives/animate
@@ -0,0 +1 @@
+/usr/bin/animate-im6.q16
\ No newline at end of file
diff --git a/alternatives/animate-im6 b/alternatives/animate-im6
new file mode 120000
index 00000000..457655e5
--- /dev/null
+++ b/alternatives/animate-im6
@@ -0,0 +1 @@
+/usr/bin/animate-im6.q16
\ No newline at end of file
diff --git a/alternatives/animate-im6.1.gz b/alternatives/animate-im6.1.gz
new file mode 120000
index 00000000..580d7bff
--- /dev/null
+++ b/alternatives/animate-im6.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/animate-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/animate.1.gz b/alternatives/animate.1.gz
new file mode 120000
index 00000000..580d7bff
--- /dev/null
+++ b/alternatives/animate.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/animate-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/c++ b/alternatives/c++
new file mode 120000
index 00000000..e51afadf
--- /dev/null
+++ b/alternatives/c++
@@ -0,0 +1 @@
+/usr/bin/g++
\ No newline at end of file
diff --git a/alternatives/c89 b/alternatives/c89
new file mode 120000
index 00000000..9e67d743
--- /dev/null
+++ b/alternatives/c89
@@ -0,0 +1 @@
+/usr/bin/c89-gcc
\ No newline at end of file
diff --git a/alternatives/c89.1.gz b/alternatives/c89.1.gz
new file mode 120000
index 00000000..3a742380
--- /dev/null
+++ b/alternatives/c89.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/c89-gcc.1.gz
\ No newline at end of file
diff --git a/alternatives/c99 b/alternatives/c99
new file mode 120000
index 00000000..323b6db2
--- /dev/null
+++ b/alternatives/c99
@@ -0,0 +1 @@
+/usr/bin/c99-gcc
\ No newline at end of file
diff --git a/alternatives/c99.1.gz b/alternatives/c99.1.gz
new file mode 120000
index 00000000..e033f2d4
--- /dev/null
+++ b/alternatives/c99.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/c99-gcc.1.gz
\ No newline at end of file
diff --git a/alternatives/cc b/alternatives/cc
new file mode 120000
index 00000000..cd91449a
--- /dev/null
+++ b/alternatives/cc
@@ -0,0 +1 @@
+/usr/bin/gcc
\ No newline at end of file
diff --git a/alternatives/compare b/alternatives/compare
new file mode 120000
index 00000000..af8e4aec
--- /dev/null
+++ b/alternatives/compare
@@ -0,0 +1 @@
+/usr/bin/compare-im6.q16
\ No newline at end of file
diff --git a/alternatives/compare-im6 b/alternatives/compare-im6
new file mode 120000
index 00000000..af8e4aec
--- /dev/null
+++ b/alternatives/compare-im6
@@ -0,0 +1 @@
+/usr/bin/compare-im6.q16
\ No newline at end of file
diff --git a/alternatives/compare-im6.1.gz b/alternatives/compare-im6.1.gz
new file mode 120000
index 00000000..f7f90ed3
--- /dev/null
+++ b/alternatives/compare-im6.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/compare-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/compare.1.gz b/alternatives/compare.1.gz
new file mode 120000
index 00000000..f7f90ed3
--- /dev/null
+++ b/alternatives/compare.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/compare-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/composite b/alternatives/composite
new file mode 120000
index 00000000..c0c1b4a6
--- /dev/null
+++ b/alternatives/composite
@@ -0,0 +1 @@
+/usr/bin/composite-im6.q16
\ No newline at end of file
diff --git a/alternatives/composite-im6 b/alternatives/composite-im6
new file mode 120000
index 00000000..c0c1b4a6
--- /dev/null
+++ b/alternatives/composite-im6
@@ -0,0 +1 @@
+/usr/bin/composite-im6.q16
\ No newline at end of file
diff --git a/alternatives/composite-im6.1.gz b/alternatives/composite-im6.1.gz
new file mode 120000
index 00000000..0e6cc267
--- /dev/null
+++ b/alternatives/composite-im6.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/composite-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/composite.1.gz b/alternatives/composite.1.gz
new file mode 120000
index 00000000..0e6cc267
--- /dev/null
+++ b/alternatives/composite.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/composite-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/conjure b/alternatives/conjure
new file mode 120000
index 00000000..a4a6ff9b
--- /dev/null
+++ b/alternatives/conjure
@@ -0,0 +1 @@
+/usr/bin/conjure-im6.q16
\ No newline at end of file
diff --git a/alternatives/conjure-im6 b/alternatives/conjure-im6
new file mode 120000
index 00000000..a4a6ff9b
--- /dev/null
+++ b/alternatives/conjure-im6
@@ -0,0 +1 @@
+/usr/bin/conjure-im6.q16
\ No newline at end of file
diff --git a/alternatives/conjure-im6.1.gz b/alternatives/conjure-im6.1.gz
new file mode 120000
index 00000000..d1094efa
--- /dev/null
+++ b/alternatives/conjure-im6.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/conjure-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/conjure.1.gz b/alternatives/conjure.1.gz
new file mode 120000
index 00000000..d1094efa
--- /dev/null
+++ b/alternatives/conjure.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/conjure-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/convert b/alternatives/convert
new file mode 120000
index 00000000..ff471ac3
--- /dev/null
+++ b/alternatives/convert
@@ -0,0 +1 @@
+/usr/bin/convert-im6.q16
\ No newline at end of file
diff --git a/alternatives/convert-im6 b/alternatives/convert-im6
new file mode 120000
index 00000000..ff471ac3
--- /dev/null
+++ b/alternatives/convert-im6
@@ -0,0 +1 @@
+/usr/bin/convert-im6.q16
\ No newline at end of file
diff --git a/alternatives/convert-im6.1.gz b/alternatives/convert-im6.1.gz
new file mode 120000
index 00000000..1006aa7f
--- /dev/null
+++ b/alternatives/convert-im6.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/convert-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/convert.1.gz b/alternatives/convert.1.gz
new file mode 120000
index 00000000..1006aa7f
--- /dev/null
+++ b/alternatives/convert.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/convert-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/cpp b/alternatives/cpp
new file mode 120000
index 00000000..00fc3c4e
--- /dev/null
+++ b/alternatives/cpp
@@ -0,0 +1 @@
+/usr/bin/cpp
\ No newline at end of file
diff --git a/alternatives/display b/alternatives/display
new file mode 120000
index 00000000..a732ed0a
--- /dev/null
+++ b/alternatives/display
@@ -0,0 +1 @@
+/usr/bin/display-im6.q16
\ No newline at end of file
diff --git a/alternatives/display-im6 b/alternatives/display-im6
new file mode 120000
index 00000000..a732ed0a
--- /dev/null
+++ b/alternatives/display-im6
@@ -0,0 +1 @@
+/usr/bin/display-im6.q16
\ No newline at end of file
diff --git a/alternatives/display-im6.1.gz b/alternatives/display-im6.1.gz
new file mode 120000
index 00000000..7aa31fff
--- /dev/null
+++ b/alternatives/display-im6.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/display-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/display.1.gz b/alternatives/display.1.gz
new file mode 120000
index 00000000..7aa31fff
--- /dev/null
+++ b/alternatives/display.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/display-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/faked.1.gz b/alternatives/faked.1.gz
new file mode 120000
index 00000000..06829846
--- /dev/null
+++ b/alternatives/faked.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/faked-sysv.1.gz
\ No newline at end of file
diff --git a/alternatives/faked.es.1.gz b/alternatives/faked.es.1.gz
new file mode 120000
index 00000000..2a0233d4
--- /dev/null
+++ b/alternatives/faked.es.1.gz
@@ -0,0 +1 @@
+/usr/share/man/es/man1/faked-sysv.1.gz
\ No newline at end of file
diff --git a/alternatives/faked.fr.1.gz b/alternatives/faked.fr.1.gz
new file mode 120000
index 00000000..9950991d
--- /dev/null
+++ b/alternatives/faked.fr.1.gz
@@ -0,0 +1 @@
+/usr/share/man/fr/man1/faked-sysv.1.gz
\ No newline at end of file
diff --git a/alternatives/faked.sv.1.gz b/alternatives/faked.sv.1.gz
new file mode 120000
index 00000000..7d76ada7
--- /dev/null
+++ b/alternatives/faked.sv.1.gz
@@ -0,0 +1 @@
+/usr/share/man/sv/man1/faked-sysv.1.gz
\ No newline at end of file
diff --git a/alternatives/fakeroot b/alternatives/fakeroot
new file mode 120000
index 00000000..0b2f1ee9
--- /dev/null
+++ b/alternatives/fakeroot
@@ -0,0 +1 @@
+/usr/bin/fakeroot-sysv
\ No newline at end of file
diff --git a/alternatives/fakeroot.1.gz b/alternatives/fakeroot.1.gz
new file mode 120000
index 00000000..6abf7c35
--- /dev/null
+++ b/alternatives/fakeroot.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/fakeroot-sysv.1.gz
\ No newline at end of file
diff --git a/alternatives/fakeroot.es.1.gz b/alternatives/fakeroot.es.1.gz
new file mode 120000
index 00000000..6c5981a0
--- /dev/null
+++ b/alternatives/fakeroot.es.1.gz
@@ -0,0 +1 @@
+/usr/share/man/es/man1/fakeroot-sysv.1.gz
\ No newline at end of file
diff --git a/alternatives/fakeroot.fr.1.gz b/alternatives/fakeroot.fr.1.gz
new file mode 120000
index 00000000..ab31fe06
--- /dev/null
+++ b/alternatives/fakeroot.fr.1.gz
@@ -0,0 +1 @@
+/usr/share/man/fr/man1/fakeroot-sysv.1.gz
\ No newline at end of file
diff --git a/alternatives/fakeroot.sv.1.gz b/alternatives/fakeroot.sv.1.gz
new file mode 120000
index 00000000..73d056ff
--- /dev/null
+++ b/alternatives/fakeroot.sv.1.gz
@@ -0,0 +1 @@
+/usr/share/man/sv/man1/fakeroot-sysv.1.gz
\ No newline at end of file
diff --git a/alternatives/identify b/alternatives/identify
new file mode 120000
index 00000000..de4f5496
--- /dev/null
+++ b/alternatives/identify
@@ -0,0 +1 @@
+/usr/bin/identify-im6.q16
\ No newline at end of file
diff --git a/alternatives/identify-im6 b/alternatives/identify-im6
new file mode 120000
index 00000000..de4f5496
--- /dev/null
+++ b/alternatives/identify-im6
@@ -0,0 +1 @@
+/usr/bin/identify-im6.q16
\ No newline at end of file
diff --git a/alternatives/identify-im6.1.gz b/alternatives/identify-im6.1.gz
new file mode 120000
index 00000000..2b1df10b
--- /dev/null
+++ b/alternatives/identify-im6.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/identify-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/identify.1.gz b/alternatives/identify.1.gz
new file mode 120000
index 00000000..2b1df10b
--- /dev/null
+++ b/alternatives/identify.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/identify-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/import b/alternatives/import
new file mode 120000
index 00000000..4f16591f
--- /dev/null
+++ b/alternatives/import
@@ -0,0 +1 @@
+/usr/bin/import-im6.q16
\ No newline at end of file
diff --git a/alternatives/import-im6 b/alternatives/import-im6
new file mode 120000
index 00000000..4f16591f
--- /dev/null
+++ b/alternatives/import-im6
@@ -0,0 +1 @@
+/usr/bin/import-im6.q16
\ No newline at end of file
diff --git a/alternatives/import-im6.1.gz b/alternatives/import-im6.1.gz
new file mode 120000
index 00000000..b6e0e800
--- /dev/null
+++ b/alternatives/import-im6.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/import-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/import.1.gz b/alternatives/import.1.gz
new file mode 120000
index 00000000..b6e0e800
--- /dev/null
+++ b/alternatives/import.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/import-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/libblas.so.3-x86_64-linux-gnu b/alternatives/libblas.so.3-x86_64-linux-gnu
new file mode 120000
index 00000000..2a847f10
--- /dev/null
+++ b/alternatives/libblas.so.3-x86_64-linux-gnu
@@ -0,0 +1 @@
+/usr/lib/x86_64-linux-gnu/blas/libblas.so.3
\ No newline at end of file
diff --git a/alternatives/locate b/alternatives/locate
new file mode 120000
index 00000000..b33f6cf3
--- /dev/null
+++ b/alternatives/locate
@@ -0,0 +1 @@
+/usr/bin/mlocate
\ No newline at end of file
diff --git a/alternatives/locate.1.gz b/alternatives/locate.1.gz
new file mode 120000
index 00000000..8d4857d4
--- /dev/null
+++ b/alternatives/locate.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/mlocate.1.gz
\ No newline at end of file
diff --git a/alternatives/mogrify b/alternatives/mogrify
new file mode 120000
index 00000000..c9a19820
--- /dev/null
+++ b/alternatives/mogrify
@@ -0,0 +1 @@
+/usr/bin/mogrify-im6.q16
\ No newline at end of file
diff --git a/alternatives/mogrify-im6 b/alternatives/mogrify-im6
new file mode 120000
index 00000000..c9a19820
--- /dev/null
+++ b/alternatives/mogrify-im6
@@ -0,0 +1 @@
+/usr/bin/mogrify-im6.q16
\ No newline at end of file
diff --git a/alternatives/mogrify-im6.1.gz b/alternatives/mogrify-im6.1.gz
new file mode 120000
index 00000000..0b2b0bda
--- /dev/null
+++ b/alternatives/mogrify-im6.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/mogrify-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/mogrify.1.gz b/alternatives/mogrify.1.gz
new file mode 120000
index 00000000..0b2b0bda
--- /dev/null
+++ b/alternatives/mogrify.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/mogrify-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/montage b/alternatives/montage
new file mode 120000
index 00000000..a535b0a9
--- /dev/null
+++ b/alternatives/montage
@@ -0,0 +1 @@
+/usr/bin/montage-im6.q16
\ No newline at end of file
diff --git a/alternatives/montage-im6 b/alternatives/montage-im6
new file mode 120000
index 00000000..a535b0a9
--- /dev/null
+++ b/alternatives/montage-im6
@@ -0,0 +1 @@
+/usr/bin/montage-im6.q16
\ No newline at end of file
diff --git a/alternatives/montage-im6.1.gz b/alternatives/montage-im6.1.gz
new file mode 120000
index 00000000..96f020ab
--- /dev/null
+++ b/alternatives/montage-im6.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/montage-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/montage.1.gz b/alternatives/montage.1.gz
new file mode 120000
index 00000000..96f020ab
--- /dev/null
+++ b/alternatives/montage.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/montage-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/phar b/alternatives/phar
new file mode 120000
index 00000000..1de4cc17
--- /dev/null
+++ b/alternatives/phar
@@ -0,0 +1 @@
+/usr/bin/phar8.0
\ No newline at end of file
diff --git a/alternatives/phar.1.gz b/alternatives/phar.1.gz
new file mode 120000
index 00000000..6b2e7460
--- /dev/null
+++ b/alternatives/phar.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/phar8.0.1.gz
\ No newline at end of file
diff --git a/alternatives/phar.phar b/alternatives/phar.phar
new file mode 120000
index 00000000..a21b6b0f
--- /dev/null
+++ b/alternatives/phar.phar
@@ -0,0 +1 @@
+/usr/bin/phar.phar8.0
\ No newline at end of file
diff --git a/alternatives/phar.phar.1.gz b/alternatives/phar.phar.1.gz
new file mode 120000
index 00000000..b2c20f74
--- /dev/null
+++ b/alternatives/phar.phar.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/phar.phar8.0.1.gz
\ No newline at end of file
diff --git a/alternatives/php b/alternatives/php
new file mode 120000
index 00000000..4fe67965
--- /dev/null
+++ b/alternatives/php
@@ -0,0 +1 @@
+/usr/bin/php8.0
\ No newline at end of file
diff --git a/alternatives/php-cgi b/alternatives/php-cgi
new file mode 120000
index 00000000..b221523f
--- /dev/null
+++ b/alternatives/php-cgi
@@ -0,0 +1 @@
+/usr/bin/php-cgi8.0
\ No newline at end of file
diff --git a/alternatives/php-cgi-bin b/alternatives/php-cgi-bin
new file mode 120000
index 00000000..c80e4018
--- /dev/null
+++ b/alternatives/php-cgi-bin
@@ -0,0 +1 @@
+/usr/lib/cgi-bin/php8.0
\ No newline at end of file
diff --git a/alternatives/php-cgi.1.gz b/alternatives/php-cgi.1.gz
new file mode 120000
index 00000000..8c382abc
--- /dev/null
+++ b/alternatives/php-cgi.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/php-cgi8.0.1.gz
\ No newline at end of file
diff --git a/alternatives/php-fpm.sock b/alternatives/php-fpm.sock
new file mode 120000
index 00000000..2567e3b1
--- /dev/null
+++ b/alternatives/php-fpm.sock
@@ -0,0 +1 @@
+/run/php/php8.0-fpm.sock
\ No newline at end of file
diff --git a/alternatives/php.1.gz b/alternatives/php.1.gz
new file mode 120000
index 00000000..eef6f80f
--- /dev/null
+++ b/alternatives/php.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/php8.0.1.gz
\ No newline at end of file
diff --git a/alternatives/stream b/alternatives/stream
new file mode 120000
index 00000000..98a9056a
--- /dev/null
+++ b/alternatives/stream
@@ -0,0 +1 @@
+/usr/bin/stream-im6.q16
\ No newline at end of file
diff --git a/alternatives/stream-im6 b/alternatives/stream-im6
new file mode 120000
index 00000000..98a9056a
--- /dev/null
+++ b/alternatives/stream-im6
@@ -0,0 +1 @@
+/usr/bin/stream-im6.q16
\ No newline at end of file
diff --git a/alternatives/stream-im6.1.gz b/alternatives/stream-im6.1.gz
new file mode 120000
index 00000000..0bfe0a0a
--- /dev/null
+++ b/alternatives/stream-im6.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/stream-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/stream.1.gz b/alternatives/stream.1.gz
new file mode 120000
index 00000000..0bfe0a0a
--- /dev/null
+++ b/alternatives/stream.1.gz
@@ -0,0 +1 @@
+/usr/share/man/man1/stream-im6.q16.1.gz
\ No newline at end of file
diff --git a/alternatives/updatedb b/alternatives/updatedb
new file mode 120000
index 00000000..a7598ba3
--- /dev/null
+++ b/alternatives/updatedb
@@ -0,0 +1 @@
+/usr/bin/updatedb.mlocate
\ No newline at end of file
diff --git a/alternatives/updatedb.8.gz b/alternatives/updatedb.8.gz
new file mode 120000
index 00000000..d48060b4
--- /dev/null
+++ b/alternatives/updatedb.8.gz
@@ -0,0 +1 @@
+/usr/share/man/man8/updatedb.mlocate.8.gz
\ No newline at end of file
diff --git a/amavis/conf.d/05-node_id b/amavis/conf.d/05-node_id
index 4d2d37d1..95bc3395 100644
--- a/amavis/conf.d/05-node_id
+++ b/amavis/conf.d/05-node_id
@@ -8,6 +8,6 @@ chomp($myhostname = `hostname --fqdn`);
# To manually set $myhostname, edit the following line with the correct Fully
# Qualified Domain Name (FQDN) and remove the # at the beginning of the line.
#
-#$myhostname = "mail.example.com";
+$myhostname = "mail.solusar.de";
1; # ensure a defined return
diff --git a/amavis/conf.d/50-user b/amavis/conf.d/50-user
index 7ca6abf1..db5a5331 100644
--- a/amavis/conf.d/50-user
+++ b/amavis/conf.d/50-user
@@ -52,7 +52,7 @@ $enable_dkim_verification = 1;
###
### Spam-Checks aktivieren
-@bypass_spam_checks_maps = (\%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re);
+#@bypass_spam_checks_maps = (\%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re);
$sa_tag_level_deflt = -999; # Informationen zu Spam-Score ab diesem Level (hier: immer) in den Header schreiben
$sa_tag2_level_deflt = 5.0; # Ab diesem Level E-Mails als Spam markieren
$sa_kill_level_deflt = 5.9; # Ab diesem Level E-Mails nicht annehmen, sondern Aktion in "final_spam_destiny" auslösen (REJECT)
diff --git a/apache2/conf-available/php8.0-cgi.conf b/apache2/conf-available/php8.0-cgi.conf
new file mode 100644
index 00000000..68f3dee4
--- /dev/null
+++ b/apache2/conf-available/php8.0-cgi.conf
@@ -0,0 +1,32 @@
+# This file replaces old system MIME types and sets them only in the
+# Apache webserver
+
+# application/x-httpd-php phtml php
+
+ SetHandler application/x-httpd-php
+
+# application/x-httpd-php-source phps
+
+ SetHandler application/x-httpd-php-source
+ # Deny access to raw php sources by default
+ # To re-enable it's recommended to enable access to the files
+ # only in specific virtual host or directory
+ Require all denied
+
+# Deny access to files without filename (e.g. '.php')
+
+ Require all denied
+
+
+# To enable PHP CGI site-wide, just uncomment following lines, however
+# as a security measure, it's recommended to enable PHP just in the
+# specific virtual servers or just specific directories
+
+#ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
+#
+# AllowOverride None
+# Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
+# Order allow,deny
+# Allow from all
+#
+#Action application/x-httpd-php /cgi-bin/php8.0
diff --git a/apache2/conf-available/php8.0-fpm.conf b/apache2/conf-available/php8.0-fpm.conf
new file mode 100644
index 00000000..2f25bd46
--- /dev/null
+++ b/apache2/conf-available/php8.0-fpm.conf
@@ -0,0 +1,32 @@
+# Redirect to local php-fpm if mod_php is not available
+
+
+ # Enable http authorization headers
+
+ SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1
+
+
+
+ SetHandler "proxy:unix:/run/php/php8.0-fpm.sock|fcgi://localhost"
+
+# The default configuration works for most of the installation, however it could
+# be improved in various ways. One simple improvement is to not pass files that
+# doesn't exist to the handler as shown below, for more configuration examples
+# see https://wiki.apache.org/httpd/PHP-FPM
+#
+#
+# SetHandler "proxy:unix:/run/php/php8.0-fpm.sock|fcgi://localhost"
+#
+#
+
+ # Deny access to raw php sources by default
+ # To re-enable it's recommended to enable access to the files
+ # only in specific virtual host or directory
+ Require all denied
+
+ # Deny access to files without filename (e.g. '.php')
+
+ Require all denied
+
+
+
diff --git a/apparmor.d/local/usr.bin.freshclam b/apparmor.d/local/usr.bin.freshclam
new file mode 100644
index 00000000..e69de29b
diff --git a/apparmor.d/local/usr.sbin.clamd b/apparmor.d/local/usr.sbin.clamd
new file mode 100644
index 00000000..e69de29b
diff --git a/apparmor.d/local/usr.sbin.ntpd b/apparmor.d/local/usr.sbin.ntpd
new file mode 100644
index 00000000..e69de29b
diff --git a/apparmor.d/tunables/ntpd b/apparmor.d/tunables/ntpd
new file mode 100644
index 00000000..1fc2d8fa
--- /dev/null
+++ b/apparmor.d/tunables/ntpd
@@ -0,0 +1,15 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+# Copyright (C) 2002-2005 Novell/SUSE
+# Copyright (C) 2011 Canonical, Ltd.
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of version 2 of the GNU General Public
+# License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+#Add your ntpd devices here eg. if you have a DCF clock
+# @{NTPD_DEVICE}="/dev/ttyS1"
+@{NTPD_DEVICE}="/dev/null"
diff --git a/apparmor.d/usr.bin.freshclam b/apparmor.d/usr.bin.freshclam
new file mode 100644
index 00000000..a00317e4
--- /dev/null
+++ b/apparmor.d/usr.bin.freshclam
@@ -0,0 +1,47 @@
+# vim:syntax=apparmor
+# Author: Jamie Strandboge
+# Last Modified: Sun Aug 3 09:39:03 2008
+
+#include
+
+/usr/bin/freshclam flags=(attach_disconnected) {
+ #include
+ #include
+ #include
+ #include
+
+ capability dac_override,
+ capability chown,
+
+ capability setgid,
+ capability setuid,
+
+ @{PROC}/filesystems r,
+ owner @{PROC}/[0-9]*/status r,
+
+ /etc/clamav/clamd.conf r,
+ /etc/clamav/freshclam.conf r,
+ /etc/clamav/onerrorexecute.d/* mr,
+ /etc/clamav/onupdateexecute.d/* mr,
+ /etc/clamav/virusevent.d/* mr,
+
+ owner @{HOME}/.clamtk/db/ rw,
+ owner @{HOME}/.clamtk/db/** rwk,
+
+ owner @{HOME}/.klamav/database/ rw,
+ owner @{HOME}/.klamav/database/** rwk,
+
+ /usr/bin/freshclam mr,
+
+ /var/lib/clamav/ r,
+ /var/lib/clamav/** krw,
+
+ /var/log/clamav/* krw,
+ /{,var/}run/clamav/freshclam.pid w,
+ /{,var/}run/clamav/clamd.ctl rw,
+
+ deny /{,var/}run/samba/{gencache,unexpected}.tdb mrwkl,
+
+ # Site-specific additions and overrides. See local/README for details.
+ #include
+}
diff --git a/apparmor.d/usr.sbin.clamd b/apparmor.d/usr.sbin.clamd
new file mode 100644
index 00000000..da2bed00
--- /dev/null
+++ b/apparmor.d/usr.sbin.clamd
@@ -0,0 +1,61 @@
+# vim:syntax=apparmor
+# Author: Jamie Strandboge
+# Last Modified: Sun Aug 3 09:39:03 2008
+
+#include
+
+/usr/sbin/clamd {
+ #include
+ #include
+ #include
+
+ # LP: #433764:
+ capability dac_override,
+
+ # needed, when using systemd
+ capability setgid,
+ capability setuid,
+ capability chown,
+
+ @{PROC}/filesystems r,
+ @{PROC}/[0-9]*/status r,
+
+ /etc/clamav/clamd.conf r,
+
+ /usr/sbin/clamd mr,
+
+ /tmp/ rw,
+ /tmp/** krw,
+
+ /var/lib/clamav/ r,
+ /var/lib/clamav/** krw,
+ /var/log/clamav/* krw,
+
+ /{,var/}run/clamav/clamd.ctl w,
+ /{,var/}run/clamav/clamd.pid w,
+
+ /var/spool/clamsmtp/* r,
+
+ /var/spool/qpsmtpd/* r,
+
+ /var/spool/p3scan/children/** r,
+
+ /var/spool/havp/** r,
+
+ # For amavisd-new integration
+ /var/lib/amavis/tmp/** r,
+
+ # For mimedefang integration
+ /var/spool/MIMEDefang/mdefang-*/Work/ r,
+ /var/spool/MIMEDefang/mdefang-*/Work/** r,
+
+ # For use with exim
+ /var/spool/exim4/** r,
+
+ # Allow home dir to be scanned
+ @{HOME}/ r,
+ @{HOME}/** r,
+
+ # Site-specific additions and overrides. See local/README for details.
+ #include
+}
diff --git a/apparmor.d/usr.sbin.ntpd b/apparmor.d/usr.sbin.ntpd
new file mode 100644
index 00000000..0977d0d6
--- /dev/null
+++ b/apparmor.d/usr.sbin.ntpd
@@ -0,0 +1,86 @@
+# vim:syntax=apparmor
+# Updated for Ubuntu by: Jamie Strandboge
+# ------------------------------------------------------------------
+#
+# Copyright (C) 2002-2005 Novell/SUSE
+# Copyright (C) 2009-2012 Canonical Ltd.
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of version 2 of the GNU General Public
+# License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+#include
+#include
+/usr/sbin/ntpd flags=(attach_disconnected) {
+ #include
+ #include
+ #include
+
+ capability ipc_lock,
+ capability net_bind_service,
+ capability setgid,
+ capability setuid,
+ capability sys_chroot,
+ capability sys_resource,
+ capability sys_time,
+ capability sys_nice,
+
+ # ntp uses AF_INET, AF_INET6 and AF_UNSPEC
+ network dgram,
+ network stream,
+
+ @{PROC}/net/if_inet6 r,
+ @{PROC}/*/net/if_inet6 r,
+ @{NTPD_DEVICE} rw,
+ # pps devices are almost exclusively used with NTP
+ /dev/pps[0-9]* rw,
+
+ /{,s}bin/ r,
+ /usr/{,s}bin/ r,
+ /usr/local/{,s}bin/ r,
+ /usr/sbin/ntpd rmix,
+
+ /etc/ntp.conf r,
+ /etc/ntp.conf.dhcp r,
+ /etc/ntpd.conf r,
+ /etc/ntpd.conf.tmp r,
+ /run/ntp.conf.dhcp r,
+
+ /etc/ntp.keys r,
+ /etc/ntp/** r,
+
+ /etc/ntp.drift rwl,
+ /etc/ntp.drift.TEMP rwl,
+ /etc/ntp/drift* rwl,
+ /var/lib/ntp/*drift rw,
+ /var/lib/ntp/*drift.TEMP rw,
+
+ /var/log/ntp w,
+ /var/log/ntp.log w,
+ /var/log/ntpd w,
+ /var/log/ntpstats/clockstats* rwl,
+ /var/log/ntpstats/loopstats* rwl,
+ /var/log/ntpstats/peerstats* rwl,
+ /var/log/ntpstats/protostats* rwl,
+ /var/log/ntpstats/rawstats* rwl,
+ /var/log/ntpstats/sysstats* rwl,
+
+ /{,var/}run/ntpd.pid w,
+
+ # to be able to check for running ntpdate
+ /run/lock/ntpdate wk,
+
+ # To sign replies to MS-SNTP clients by the smbd daemon /var/lib/samba
+ /var/lib/samba/ntp_signd/socket rw,
+
+ # For use with clocks that report via shared memory (e.g. gpsd),
+ # you may need to give ntpd access to all of shared memory, though
+ # this can be considered dangerous. See https://launchpad.net/bugs/722815
+ # for details. To enable, add this to local/usr.sbin.ntpd:
+ # capability ipc_owner,
+
+ # Site-specific additions and overrides. See local/README for details.
+ #include
+}
diff --git a/apt/apt.conf.d/90rkhunter b/apt/apt.conf.d/90rkhunter
new file mode 100644
index 00000000..6835b037
--- /dev/null
+++ b/apt/apt.conf.d/90rkhunter
@@ -0,0 +1,2 @@
+// Makes sure that rkhunter file properties database is updated after each remove or install only APT_AUTOGEN is enabled
+DPkg::Post-Invoke { "if [ -x /usr/bin/rkhunter ] && grep -qiE '^APT_AUTOGEN=.?(true|yes)' /etc/default/rkhunter; then /usr/share/rkhunter/scripts/rkhupd.sh; fi"; };
diff --git a/chkrootkit.conf b/chkrootkit.conf
new file mode 100644
index 00000000..3d1b6ec8
--- /dev/null
+++ b/chkrootkit.conf
@@ -0,0 +1,3 @@
+RUN_DAILY="false"
+RUN_DAILY_OPTS="-q"
+DIFF_MODE="false"
diff --git a/clamav/freshclam.conf b/clamav/freshclam.conf
index 41fb5375..e39f4e03 100644
--- a/clamav/freshclam.conf
+++ b/clamav/freshclam.conf
@@ -7,20 +7,20 @@ LogVerbose false
LogSyslog false
LogFacility LOG_LOCAL6
LogFileMaxSize 0
+LogRotate true
LogTime true
Foreground false
Debug false
MaxAttempts 5
DatabaseDirectory /var/lib/clamav
DNSDatabaseInfo current.cvd.clamav.net
-#AllowSupplementaryGroups false
-PidFile /var/run/clamav/freshclam.pid
ConnectTimeout 30
ReceiveTimeout 30
TestDatabases yes
ScriptedUpdates yes
CompressLocalDatabase no
Bytecode true
+NotifyClamd /etc/clamav/clamd.conf
# Check for new database 24 times a day
Checks 24
DatabaseMirror db.local.clamav.net
@@ -28,3 +28,4 @@ DatabaseMirror database.clamav.net
DatabaseMirror clamav.ilisys.com.au
DatabaseMirror 193.27.50.222
DatabaseMirror clamav.inode.at
+PidFile /var/run/clamav/freshclam.pid
diff --git a/cron.d/amavisd-new b/cron.d/amavisd-new
new file mode 100644
index 00000000..84ec7615
--- /dev/null
+++ b/cron.d/amavisd-new
@@ -0,0 +1,6 @@
+#
+# SpamAssassin maintenance for amavisd-new
+#
+# m h dom mon dow user command
+18 */3 * * * amavis test -e /usr/sbin/amavisd-new-cronjob && /usr/sbin/amavisd-new-cronjob sa-sync
+24 1 * * * amavis test -e /usr/sbin/amavisd-new-cronjob && /usr/sbin/amavisd-new-cronjob sa-clean
diff --git a/cron.daily/chkrootkit b/cron.daily/chkrootkit
new file mode 100755
index 00000000..0ea42cc1
--- /dev/null
+++ b/cron.daily/chkrootkit
@@ -0,0 +1,51 @@
+#!/bin/sh
+
+set -e
+
+CHKROOTKIT=/usr/sbin/chkrootkit
+CF=/etc/chkrootkit.conf
+LOG_DIR=/var/log/chkrootkit
+IGNORE_FILE=/dev/null
+
+if [ ! -x $CHKROOTKIT ]; then
+ exit 0
+fi
+
+if [ -f $CF ]; then
+ . $CF
+fi
+
+if [ ! -r "${IGNORE_FILE}" ]; then
+ IGNORE_FILE=/dev/null
+fi
+
+
+if [ "$RUN_DAILY" = "true" ]; then
+ if [ "$DIFF_MODE" = "true" ]; then
+ eval $CHKROOTKIT $RUN_DAILY_OPTS 2>&1 | egrep -v -f "${IGNORE_FILE}" > $LOG_DIR/log.today || true
+ if [ ! -f $LOG_DIR/log.expected ]; then
+ echo "ERROR: No file $LOG_DIR/log.expected"
+ echo "This file should contain expected output from chkrootkit"
+ echo
+ echo "Today's run produced the following output:"
+ echo "--- [ BEGIN: cat $LOG_DIR/log.today ] ---"
+ cat $LOG_DIR/log.today
+ echo "--- [ END: cat $LOG_DIR/log.today ] ---"
+ echo
+ echo "To create this file containing all output from today's run, do (as root)"
+ echo "# cp -a $LOG_DIR/log.today $LOG_DIR/log.expected"
+ elif ! diff -q $LOG_DIR/log.expected $LOG_DIR/log.today > /dev/null 2>&1; then
+ echo "ERROR: chkrootkit output was not as expected."
+ echo
+ echo "The difference is:"
+ echo "---[ BEGIN: diff -u $LOG_DIR/log.expected $LOG_DIR/log.today ] ---"
+ diff -u $LOG_DIR/log.expected $LOG_DIR/log.today || true
+ echo "---[ END: diff -u $LOG_DIR/log.expected $LOG_DIR/log.today ] ---"
+ echo
+ echo "To update the expected output, run (as root)"
+ echo "# cp -a -f $LOG_DIR/log.today $LOG_DIR/log.expected"
+ fi
+ else
+ eval $CHKROOTKIT $RUN_DAILY_OPTS 2>&1 | (egrep -v -f "${IGNORE_FILE}") || true
+ fi
+fi
diff --git a/cron.daily/mlocate b/cron.daily/mlocate
new file mode 100755
index 00000000..9104f3bd
--- /dev/null
+++ b/cron.daily/mlocate
@@ -0,0 +1,32 @@
+#! /bin/bash
+
+set -e
+
+# skip in favour of systemd timer
+if [ -d /run/systemd/system ]; then
+ exit 0
+fi
+
+[ -x /usr/bin/updatedb.mlocate ] || exit 0
+
+if which on_ac_power >/dev/null 2>&1; then
+ ON_BATTERY=0
+ on_ac_power >/dev/null 2>&1 || ON_BATTERY=$?
+ if [ "$ON_BATTERY" -eq 1 ]; then
+ exit 0
+ fi
+fi
+
+# See ionice(1)
+if [ -x /usr/bin/ionice ] &&
+ /usr/bin/ionice -c3 true 2>/dev/null; then
+ IONICE="/usr/bin/ionice -c3"
+fi
+
+# See nocache(1)
+NOCACHE=
+if [ -x /usr/bin/nocache ]; then
+ NOCACHE="/usr/bin/nocache"
+fi
+
+flock --nonblock /run/mlocate.daily.lock $NOCACHE $IONICE nice /usr/bin/updatedb.mlocate
diff --git a/cron.daily/ntp b/cron.daily/ntp
new file mode 100755
index 00000000..1fe08153
--- /dev/null
+++ b/cron.daily/ntp
@@ -0,0 +1,39 @@
+#!/bin/sh
+
+# The default Debian ntp.conf enables logging of various statistics to
+# the /var/log/ntpstats directory. The daemon automatically changes
+# to a new datestamped set of files at midnight, so all we need to do
+# is delete old ones, and compress the ones we're keeping so disk
+# usage is controlled.
+
+statsdir=$(cat /etc/ntp.conf | grep -v '^#' | sed -nr 's/^statsdir[[:space:]]+([^[:space:]]+).*$/\1/p')
+
+if [ -n "$statsdir" ] && [ -d "$statsdir" ]; then
+ # only keep a week's depth of these. Delete only files exactly
+ # within the directory and do not descend into subdirectories
+ # to avoid security risks on platforms where find is not using
+ # fts-library.
+ find "$statsdir" -maxdepth 1 -type f -name "*stats*" -mtime +7 -delete
+
+ # compress whatever is left to save space but make sure to really
+ # do it only in the expected directory.
+ cd "$statsdir" || exit 1
+ ls -d -- *stats.???????? > /dev/null 2>&1
+ if [ $? -eq 0 ]; then
+ # Note that gzip won't compress the file names that
+ # are hard links to the live/current files, so this
+ # compresses yesterday and previous, leaving the live
+ # log alone. We suppress the warnings gzip issues
+ # about not compressing the linked file.
+ gzip --best --quiet -- *stats.????????
+ return=$?
+ case $return in
+ 2)
+ exit 0 # squash all warnings
+ ;;
+ *)
+ exit $return # but let real errors through
+ ;;
+ esac
+ fi
+fi
diff --git a/cron.daily/rkhunter b/cron.daily/rkhunter
new file mode 100755
index 00000000..2f694abc
--- /dev/null
+++ b/cron.daily/rkhunter
@@ -0,0 +1,45 @@
+#!/bin/sh
+
+RKHUNTER=/usr/bin/rkhunter
+
+test -x $RKHUNTER || exit 0
+
+# source our config
+. /etc/default/rkhunter
+
+if [ -z "$NICE" ]; then
+ NICE=0
+fi
+
+if [ -z "$RUN_CHECK_ON_BATTERY" ]; then
+ RUN_CHECK_ON_BATTERY="false"
+fi
+
+# Do not run daily check if running on battery except if explicitely allowed
+case "$RUN_CHECK_ON_BATTERY" in
+ [NnFf]*)
+ if [ -x /usr/bin/on_ac_power ]; then
+ on_ac_power >/dev/null 2>&1
+ [ $? -eq 1 ] && exit 0
+ fi
+esac
+
+case "$CRON_DAILY_RUN" in
+ [YyTt]*)
+ OUTFILE=`mktemp` || exit 1
+ /usr/bin/nice -n $NICE $RKHUNTER --cronjob --report-warnings-only --appendlog > $OUTFILE
+ if [ -s "$OUTFILE" -a -n "$REPORT_EMAIL" ]; then
+ (
+ echo "Subject: [rkhunter] $(hostname) - Daily report"
+ echo "To: $REPORT_EMAIL"
+ echo ""
+ cat $OUTFILE
+ ) | /usr/sbin/sendmail $REPORT_EMAIL
+ fi
+ rm -f $OUTFILE
+ ;;
+ *)
+ exit 0
+ ;;
+esac
+
diff --git a/cron.weekly/rkhunter b/cron.weekly/rkhunter
new file mode 100755
index 00000000..69769202
--- /dev/null
+++ b/cron.weekly/rkhunter
@@ -0,0 +1,51 @@
+#!/bin/sh
+
+RKHUNTER=/usr/bin/rkhunter
+
+test -x $RKHUNTER || exit 0
+
+# source our config
+. /etc/default/rkhunter
+
+case "$CRON_DB_UPDATE" in
+ [YyTt]*)
+
+ if [ ! -x /usr/bin/wget ] && [ ! -x /usr/bin/curl ] && [ ! -x /usr/bin/links ] && \
+ [ ! -x /usr/bin/elinks ] && [ ! -x /usr/bin/lynx ]; then
+ echo "No tool with which to download rkhunter updates was found on your system. Please install wget, curl, (e)links or lynx"
+ exit 1
+ fi
+
+ OUTFILE=`mktemp` || exit 1
+
+ case "$DB_UPDATE_EMAIL" in
+ [YyTt]*)
+ (
+ echo "Subject: [rkhunter] $(hostname) - Weekly database update"
+ echo "To: $REPORT_EMAIL"
+ echo ""
+ $RKHUNTER --versioncheck --nocolors --appendlog
+ $RKHUNTER --update --nocolors --appendlog
+ ) | /usr/sbin/sendmail $REPORT_EMAIL
+ ;;
+ *)
+ $RKHUNTER --versioncheck --appendlog 1>/dev/null 2>$OUTFILE
+ $RKHUNTER --update --appendlog 1>/dev/null 2>>$OUTFILE
+ ;;
+ esac
+
+ if [ -s "$OUTFILE" ]; then
+ (
+ echo "Subject: [rkhunter] $(hostname) - Weekly rkhunter database update"
+ echo "To: $REPORT_EMAIL"
+ echo ""
+ cat $OUTFILE
+ ) | /usr/sbin/sendmail $REPORT_EMAIL
+ fi
+ rm -f $OUTFILE
+ ;;
+
+ *)
+ exit 0
+ ;;
+esac
diff --git a/default/amavisd-snmp-subagent b/default/amavisd-snmp-subagent
new file mode 100644
index 00000000..beee3676
--- /dev/null
+++ b/default/amavisd-snmp-subagent
@@ -0,0 +1,12 @@
+# there are two implementations of the subagent daemon:
+# 1) the default bdb version
+# 2) a zero mq based version
+# if you want to use this agent you need at least
+# libnet-snmp-perl installed.
+# the zeromq version also needs libzeromq-perl.
+# You also have to enable zeromq
+# in amavis: $enable_zmq = 1;
+#
+# See RELEASE_NOTES for details.
+
+AGENT_BACKEND="bdb" # use zeromq for the zeromq version
diff --git a/default/dovecot b/default/dovecot
new file mode 100644
index 00000000..dee92399
--- /dev/null
+++ b/default/dovecot
@@ -0,0 +1,4 @@
+# /etc/default/dovecot
+
+# Set to '1' to allow Dovecot daemons to produce core dumps
+#ALLOW_COREDUMPS=1
diff --git a/default/ntp b/default/ntp
new file mode 100644
index 00000000..af78139b
--- /dev/null
+++ b/default/ntp
@@ -0,0 +1 @@
+NTPD_OPTS='-g'
diff --git a/default/ntpdate b/default/ntpdate
new file mode 100644
index 00000000..3241694e
--- /dev/null
+++ b/default/ntpdate
@@ -0,0 +1,13 @@
+# The settings in this file are used by the program ntpdate-debian, but not
+# by the upstream program ntpdate.
+
+# Set to "yes" to take the server list from /etc/ntp.conf, from package ntp,
+# so you only have to keep it in one place.
+NTPDATE_USE_NTP_CONF=yes
+
+# List of NTP servers to use (Separate multiple servers with spaces.)
+# Not used if NTPDATE_USE_NTP_CONF is yes.
+NTPSERVERS="0.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org 3.debian.pool.ntp.org"
+
+# Additional options to pass to ntpdate
+NTPOPTIONS=""
diff --git a/default/opendkim b/default/opendkim
new file mode 100644
index 00000000..51ae707d
--- /dev/null
+++ b/default/opendkim
@@ -0,0 +1,30 @@
+# NOTE: This is a legacy configuration file. It is not used by the opendkim
+# systemd service. Please use the corresponding configuration parameters in
+# /etc/opendkim.conf instead.
+#
+# Previously, one would edit the default settings here, and then execute
+# /lib/opendkim/opendkim.service.generate to generate systemd override files at
+# /etc/systemd/system/opendkim.service.d/override.conf and
+# /etc/tmpfiles.d/opendkim.conf. While this is still possible, it is now
+# recommended to adjust the settings directly in /etc/opendkim.conf.
+#
+#DAEMON_OPTS=""
+# Change to /var/spool/postfix/run/opendkim to use a Unix socket with
+# postfix in a chroot:
+#RUNDIR=/var/spool/postfix/run/opendkim
+RUNDIR=/run/opendkim
+#
+# Uncomment to specify an alternate socket
+# Note that setting this will override any Socket value in opendkim.conf
+# default:
+SOCKET=local:$RUNDIR/opendkim.sock
+# listen on all interfaces on port 54321:
+#SOCKET=inet:54321
+# listen on loopback on port 12345:
+#SOCKET=inet:12345@localhost
+# listen on 192.0.2.1 on port 12345:
+#SOCKET=inet:12345@192.0.2.1
+USER=opendkim
+GROUP=opendkim
+PIDFILE=$RUNDIR/$NAME.pid
+EXTRAAFTER=
diff --git a/default/postgrey b/default/postgrey
new file mode 100644
index 00000000..45bc032e
--- /dev/null
+++ b/default/postgrey
@@ -0,0 +1,12 @@
+# postgrey startup options, created for Debian
+
+# you may want to set
+# --delay=N how long to greylist, seconds (default: 300)
+# --max-age=N delete old entries after N days (default: 35)
+# see also the postgrey(8) manpage
+
+POSTGREY_OPTS="--inet=10023"
+
+# the --greylist-text commandline argument can not be easily passed through
+# POSTGREY_OPTS when it contains spaces. So, insert your text here:
+#POSTGREY_TEXT="Your customized rejection message here"
diff --git a/default/rkhunter b/default/rkhunter
new file mode 100644
index 00000000..78df2110
--- /dev/null
+++ b/default/rkhunter
@@ -0,0 +1,34 @@
+# Defaults for rkhunter automatic tasks
+# sourced by /etc/cron.*/rkhunter and /etc/apt/apt.conf.d/90rkhunter
+#
+# This is a POSIX shell fragment
+#
+
+# Set this to yes to enable rkhunter daily runs
+# (default: false)
+CRON_DAILY_RUN=""
+
+# Set this to yes to enable rkhunter weekly database updates
+# (default: false)
+CRON_DB_UPDATE=""
+
+# Set this to yes to enable reports of weekly database updates
+# (default: false)
+DB_UPDATE_EMAIL="false"
+
+# Set this to the email address where reports and run output should be sent
+# (default: root)
+REPORT_EMAIL="root"
+
+# Set this to yes to enable automatic database updates
+# (default: false)
+APT_AUTOGEN="false"
+
+# Nicenesses range from -20 (most favorable scheduling) to 19 (least favorable)
+# (default: 0)
+NICE="0"
+
+# Should daily check be run when running on battery
+# powermgmt-base is required to detect if running on battery or on AC power
+# (default: false)
+RUN_CHECK_ON_BATTERY="false"
diff --git a/dhcp/dhclient-exit-hooks.d/ntp b/dhcp/dhclient-exit-hooks.d/ntp
new file mode 100644
index 00000000..eedf6d92
--- /dev/null
+++ b/dhcp/dhclient-exit-hooks.d/ntp
@@ -0,0 +1,64 @@
+NTP_CONF=/etc/ntp.conf
+NTP_DHCP_CONF=/run/ntp.conf.dhcp
+
+
+ntp_server_restart() {
+ invoke-rc.d ntp try-restart
+}
+
+
+ntp_servers_setup_remove() {
+ if [ ! -e $NTP_DHCP_CONF ]; then
+ return
+ fi
+ rm -f $NTP_DHCP_CONF
+ ntp_server_restart
+}
+
+
+ntp_servers_setup_add() {
+ if [ -e $NTP_DHCP_CONF ] && [ "$new_ntp_servers" = "$old_ntp_servers" ]; then
+ return
+ fi
+
+ if [ -z "$new_ntp_servers" ]; then
+ ntp_servers_setup_remove
+ return
+ fi
+
+ tmp=$(mktemp "$NTP_DHCP_CONF.XXXXXX") || return
+ chmod --reference=$NTP_CONF $tmp
+ chown --reference=$NTP_CONF $tmp
+
+ (
+ echo "# This file was copied from $NTP_CONF with the server options changed"
+ echo "# to reflect the information sent by the DHCP server. Any changes made"
+ echo "# here will be lost at the next DHCP event. Edit $NTP_CONF instead."
+ echo
+ echo "# NTP server entries received from DHCP server"
+ for server in $new_ntp_servers; do
+ echo "server $server iburst"
+ done
+ echo
+ sed '/^[[:space:]]*\(server\|peer\|pool\)[[:space:]]/d' $NTP_CONF
+ ) >>$tmp
+
+ mv $tmp $NTP_DHCP_CONF
+
+ ntp_server_restart
+}
+
+
+ntp_servers_setup() {
+ case $reason in
+ BOUND|RENEW|REBIND|REBOOT)
+ ntp_servers_setup_add
+ ;;
+ EXPIRE|FAIL|RELEASE|STOP)
+ ntp_servers_setup_remove
+ ;;
+ esac
+}
+
+
+ntp_servers_setup
diff --git a/dhcp/dhclient-exit-hooks.d/ntpdate b/dhcp/dhclient-exit-hooks.d/ntpdate
new file mode 100644
index 00000000..09ab605c
--- /dev/null
+++ b/dhcp/dhclient-exit-hooks.d/ntpdate
@@ -0,0 +1,45 @@
+NTPDATE_CONF=/etc/default/ntpdate
+NTPDATE_DHCP_CONF=/run/ntpdate.dhcp
+
+
+ntp_servers_setup_remove() {
+ rm -f $NTPDATE_DHCP_CONF
+}
+
+
+ntp_servers_setup_add() {
+ if [ -e $NTPDATE_DHCP_CONF ] && [ "$new_ntp_servers" = "$old_ntp_servers" ]; then
+ return
+ fi
+
+ if [ -z "$new_ntp_servers" ]; then
+ ntp_servers_setup_remove
+ return
+ fi
+
+ tmp=$(mktemp "$NTPDATE_DHCP_CONF.XXXXXX") || return
+ chmod --reference=$NTPDATE_CONF $tmp
+ chown --reference=$NTPDATE_CONF $tmp
+
+ (
+ echo "# NTP server entries received from DHCP server"
+ echo "NTPSERVERS='$new_ntp_servers'"
+ ) >>$tmp
+
+ mv $tmp $NTPDATE_DHCP_CONF
+}
+
+
+ntp_servers_setup() {
+ case $reason in
+ BOUND|RENEW|REBIND|REBOOT)
+ ntp_servers_setup_add
+ ;;
+ EXPIRE|FAIL|RELEASE|STOP)
+ ntp_servers_setup_remove
+ ;;
+ esac
+}
+
+
+ntp_servers_setup
diff --git a/dkms/kernel_install.d_dkms b/dkms/kernel_install.d_dkms
new file mode 100755
index 00000000..c1d6df10
--- /dev/null
+++ b/dkms/kernel_install.d_dkms
@@ -0,0 +1,9 @@
+#!/usr/bin/bash
+
+if [[ "$1" == "add" ]]; then
+ /etc/kernel/postinst.d/dkms $2
+fi
+
+if [[ "$1" == "remove" ]]; then
+ /etc/kernel/prerm.d/dkms $2
+fi
diff --git a/dkms/sign_helper.sh b/dkms/sign_helper.sh
new file mode 100755
index 00000000..b491aade
--- /dev/null
+++ b/dkms/sign_helper.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+/lib/modules/"$1"/build/scripts/sign-file sha512 /root/mok.priv /root/mok.der "$2"
diff --git a/dovecot/conf.d/10-auth.conf b/dovecot/conf.d/10-auth.conf
new file mode 100644
index 00000000..3e9c4e4d
--- /dev/null
+++ b/dovecot/conf.d/10-auth.conf
@@ -0,0 +1,127 @@
+##
+## Authentication processes
+##
+
+# Disable LOGIN command and all other plaintext authentications unless
+# SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP
+# matches the local IP (ie. you're connecting from the same computer), the
+# connection is considered secure and plaintext authentication is allowed.
+# See also ssl=required setting.
+#disable_plaintext_auth = yes
+
+# Authentication cache size (e.g. 10M). 0 means it's disabled. Note that
+# bsdauth and PAM require cache_key to be set for caching to be used.
+#auth_cache_size = 0
+# Time to live for cached data. After TTL expires the cached record is no
+# longer used, *except* if the main database lookup returns internal failure.
+# We also try to handle password changes automatically: If user's previous
+# authentication was successful, but this one wasn't, the cache isn't used.
+# For now this works only with plaintext authentication.
+#auth_cache_ttl = 1 hour
+# TTL for negative hits (user not found, password mismatch).
+# 0 disables caching them completely.
+#auth_cache_negative_ttl = 1 hour
+
+# Space separated list of realms for SASL authentication mechanisms that need
+# them. You can leave it empty if you don't want to support multiple realms.
+# Many clients simply use the first one listed here, so keep the default realm
+# first.
+#auth_realms =
+
+# Default realm/domain to use if none was specified. This is used for both
+# SASL realms and appending @domain to username in plaintext logins.
+#auth_default_realm =
+
+# List of allowed characters in username. If the user-given username contains
+# a character not listed in here, the login automatically fails. This is just
+# an extra check to make sure user can't exploit any potential quote escaping
+# vulnerabilities with SQL/LDAP databases. If you want to allow all characters,
+# set this value to empty.
+#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@
+
+# Username character translations before it's looked up from databases. The
+# value contains series of from -> to characters. For example "#@/@" means
+# that '#' and '/' characters are translated to '@'.
+#auth_username_translation =
+
+# Username formatting before it's looked up from databases. You can use
+# the standard variables here, eg. %Lu would lowercase the username, %n would
+# drop away the domain if it was given, or "%n-AT-%d" would change the '@' into
+# "-AT-". This translation is done after auth_username_translation changes.
+#auth_username_format = %Lu
+
+# If you want to allow master users to log in by specifying the master
+# username within the normal username string (ie. not using SASL mechanism's
+# support for it), you can specify the separator character here. The format
+# is then . UW-IMAP uses "*" as the
+# separator, so that could be a good choice.
+#auth_master_user_separator =
+
+# Username to use for users logging in with ANONYMOUS SASL mechanism
+#auth_anonymous_username = anonymous
+
+# Maximum number of dovecot-auth worker processes. They're used to execute
+# blocking passdb and userdb queries (eg. MySQL and PAM). They're
+# automatically created and destroyed as needed.
+#auth_worker_max_count = 30
+
+# Host name to use in GSSAPI principal names. The default is to use the
+# name returned by gethostname(). Use "$ALL" (with quotes) to allow all keytab
+# entries.
+#auth_gssapi_hostname =
+
+# Kerberos keytab to use for the GSSAPI mechanism. Will use the system
+# default (usually /etc/krb5.keytab) if not specified. You may need to change
+# the auth service to run as root to be able to read this file.
+#auth_krb5_keytab =
+
+# Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and
+# ntlm_auth helper.
+#auth_use_winbind = no
+
+# Path for Samba's ntlm_auth helper binary.
+#auth_winbind_helper_path = /usr/bin/ntlm_auth
+
+# Time to delay before replying to failed authentications.
+#auth_failure_delay = 2 secs
+
+# Require a valid SSL client certificate or the authentication fails.
+#auth_ssl_require_client_cert = no
+
+# Take the username from client's SSL certificate, using
+# X509_NAME_get_text_by_NID() which returns the subject's DN's
+# CommonName.
+#auth_ssl_username_from_cert = no
+
+# Space separated list of wanted authentication mechanisms:
+# plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp
+# gss-spnego
+# NOTE: See also disable_plaintext_auth setting.
+auth_mechanisms = plain
+
+##
+## Password and user databases
+##
+
+#
+# Password database is used to verify user's password (and nothing more).
+# You can have multiple passdbs and userdbs. This is useful if you want to
+# allow both system users (/etc/passwd) and virtual users to login without
+# duplicating the system users into virtual database.
+#
+#
+#
+# User database specifies where mails are located and what user/group IDs
+# own them. For single-UID configuration use "static" userdb.
+#
+#
+
+#!include auth-deny.conf.ext
+#!include auth-master.conf.ext
+
+!include auth-system.conf.ext
+#!include auth-sql.conf.ext
+#!include auth-ldap.conf.ext
+#!include auth-passwdfile.conf.ext
+#!include auth-checkpassword.conf.ext
+#!include auth-static.conf.ext
diff --git a/dovecot/conf.d/10-director.conf b/dovecot/conf.d/10-director.conf
new file mode 100644
index 00000000..073d8a8d
--- /dev/null
+++ b/dovecot/conf.d/10-director.conf
@@ -0,0 +1,60 @@
+##
+## Director-specific settings.
+##
+
+# Director can be used by Dovecot proxy to keep a temporary user -> mail server
+# mapping. As long as user has simultaneous connections, the user is always
+# redirected to the same server. Each proxy server is running its own director
+# process, and the directors are communicating the state to each others.
+# Directors are mainly useful with NFS-like setups.
+
+# List of IPs or hostnames to all director servers, including ourself.
+# Ports can be specified as ip:port. The default port is the same as
+# what director service's inet_listener is using.
+#director_servers =
+
+# List of IPs or hostnames to all backend mail servers. Ranges are allowed
+# too, like 10.0.0.10-10.0.0.30.
+#director_mail_servers =
+
+# How long to redirect users to a specific server after it no longer has
+# any connections.
+#director_user_expire = 15 min
+
+# How the username is translated before being hashed. Useful values include
+# %Ln if user can log in with or without @domain, %Ld if mailboxes are shared
+# within domain.
+#director_username_hash = %Lu
+
+# To enable director service, uncomment the modes and assign a port.
+service director {
+ unix_listener login/director {
+ #mode = 0666
+ }
+ fifo_listener login/proxy-notify {
+ #mode = 0666
+ }
+ unix_listener director-userdb {
+ #mode = 0600
+ }
+ inet_listener {
+ #port =
+ }
+}
+
+# Enable director for the wanted login services by telling them to
+# connect to director socket instead of the default login socket:
+service imap-login {
+ #executable = imap-login director
+}
+service pop3-login {
+ #executable = pop3-login director
+}
+service submission-login {
+ #executable = submission-login director
+}
+
+# Enable director for LMTP proxying:
+protocol lmtp {
+ #auth_socket_path = director-userdb
+}
diff --git a/dovecot/conf.d/10-logging.conf b/dovecot/conf.d/10-logging.conf
new file mode 100644
index 00000000..bcd6dea3
--- /dev/null
+++ b/dovecot/conf.d/10-logging.conf
@@ -0,0 +1,109 @@
+##
+## Log destination.
+##
+
+# Log file to use for error messages. "syslog" logs to syslog,
+# /dev/stderr logs to stderr.
+#log_path = syslog
+
+# Log file to use for informational messages. Defaults to log_path.
+#info_log_path =
+# Log file to use for debug messages. Defaults to info_log_path.
+#debug_log_path =
+
+# Syslog facility to use if you're logging to syslog. Usually if you don't
+# want to use "mail", you'll use local0..local7. Also other standard
+# facilities are supported.
+#syslog_facility = mail
+
+##
+## Logging verbosity and debugging.
+##
+
+# Log filter is a space-separated list conditions. If any of the conditions
+# match, the log filter matches (i.e. they're ORed together). Parenthesis
+# are supported if multiple conditions need to be matched together.
+# Supported conditions are:
+# event: - Match event name. '*' and '?' wildcards supported.
+# source:[:] - Match source code filename [and line]
+# field:= - Match field key to a value. Can be specified
+# multiple times to match multiple keys.
+# cat[egory]: - Match a category. Can be specified multiple times to
+# match multiple categories.
+# For example: event:http_request_* (cat:error cat:storage)
+
+# Filter to specify what debug logging to enable. This will eventually replace
+# mail_debug and auth_debug settings.
+#log_debug =
+
+# Crash after logging a matching event. For example category:error will crash
+# any time an error is logged, which can be useful for debugging.
+#log_core_filter =
+
+# Log unsuccessful authentication attempts and the reasons why they failed.
+#auth_verbose = no
+
+# In case of password mismatches, log the attempted password. Valid values are
+# no, plain and sha1. sha1 can be useful for detecting brute force password
+# attempts vs. user simply trying the same password over and over again.
+# You can also truncate the value to n chars by appending ":n" (e.g. sha1:6).
+#auth_verbose_passwords = no
+
+# Even more verbose logging for debugging purposes. Shows for example SQL
+# queries.
+#auth_debug = no
+
+# In case of password mismatches, log the passwords and used scheme so the
+# problem can be debugged. Enabling this also enables auth_debug.
+#auth_debug_passwords = no
+
+# Enable mail process debugging. This can help you figure out why Dovecot
+# isn't finding your mails.
+#mail_debug = no
+
+# Show protocol level SSL errors.
+#verbose_ssl = no
+
+# mail_log plugin provides more event logging for mail processes.
+plugin {
+ # Events to log. Also available: flag_change append
+ #mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
+ # Available fields: uid, box, msgid, from, subject, size, vsize, flags
+ # size and vsize are available only for expunge and copy events.
+ #mail_log_fields = uid box msgid size
+}
+
+##
+## Log formatting.
+##
+
+# Prefix for each line written to log file. % codes are in strftime(3)
+# format.
+#log_timestamp = "%b %d %H:%M:%S "
+
+# Space-separated list of elements we want to log. The elements which have
+# a non-empty variable value are joined together to form a comma-separated
+# string.
+#login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c
+
+# Login log format. %s contains login_log_format_elements string, %$ contains
+# the data we want to log.
+#login_log_format = %$: %s
+
+# Log prefix for mail processes. See doc/wiki/Variables.txt for list of
+# possible variables you can use.
+#mail_log_prefix = "%s(%u)<%{pid}><%{session}>: "
+
+# Format to use for logging mail deliveries:
+# %$ - Delivery status message (e.g. "saved to INBOX")
+# %m / %{msgid} - Message-ID
+# %s / %{subject} - Subject
+# %f / %{from} - From address
+# %p / %{size} - Physical size
+# %w / %{vsize} - Virtual size
+# %e / %{from_envelope} - MAIL FROM envelope
+# %{to_envelope} - RCPT TO envelope
+# %{delivery_time} - How many milliseconds it took to deliver the mail
+# %{session_time} - How long LMTP session took, not including delivery_time
+# %{storage_id} - Backend-specific ID for mail, e.g. Maildir filename
+#deliver_log_format = msgid=%m: %$
diff --git a/dovecot/conf.d/10-mail.conf b/dovecot/conf.d/10-mail.conf
new file mode 100644
index 00000000..b47235fd
--- /dev/null
+++ b/dovecot/conf.d/10-mail.conf
@@ -0,0 +1,421 @@
+##
+## Mailbox locations and namespaces
+##
+
+# Location for users' mailboxes. The default is empty, which means that Dovecot
+# tries to find the mailboxes automatically. This won't work if the user
+# doesn't yet have any mail, so you should explicitly tell Dovecot the full
+# location.
+#
+# If you're using mbox, giving a path to the INBOX file (eg. /var/mail/%u)
+# isn't enough. You'll also need to tell Dovecot where the other mailboxes are
+# kept. This is called the "root mail directory", and it must be the first
+# path given in the mail_location setting.
+#
+# There are a few special variables you can use, eg.:
+#
+# %u - username
+# %n - user part in user@domain, same as %u if there's no domain
+# %d - domain part in user@domain, empty if there's no domain
+# %h - home directory
+#
+# See doc/wiki/Variables.txt for full list. Some examples:
+#
+# mail_location = maildir:~/Maildir
+# mail_location = mbox:~/mail:INBOX=/var/mail/%u
+# mail_location = mbox:/var/mail/%d/%1n/%n:INDEX=/var/indexes/%d/%1n/%n
+#
+#
+#
+mail_location = mbox:~/mail:INBOX=/var/mail/%u
+
+# If you need to set multiple mailbox locations or want to change default
+# namespace settings, you can do it by defining namespace sections.
+#
+# You can have private, shared and public namespaces. Private namespaces
+# are for user's personal mails. Shared namespaces are for accessing other
+# users' mailboxes that have been shared. Public namespaces are for shared
+# mailboxes that are managed by sysadmin. If you create any shared or public
+# namespaces you'll typically want to enable ACL plugin also, otherwise all
+# users can access all the shared mailboxes, assuming they have permissions
+# on filesystem level to do so.
+namespace inbox {
+ # Namespace type: private, shared or public
+ #type = private
+
+ # Hierarchy separator to use. You should use the same separator for all
+ # namespaces or some clients get confused. '/' is usually a good one.
+ # The default however depends on the underlying mail storage format.
+ #separator =
+
+ # Prefix required to access this namespace. This needs to be different for
+ # all namespaces. For example "Public/".
+ #prefix =
+
+ # Physical location of the mailbox. This is in same format as
+ # mail_location, which is also the default for it.
+ #location =
+
+ # There can be only one INBOX, and this setting defines which namespace
+ # has it.
+ inbox = yes
+
+ # If namespace is hidden, it's not advertised to clients via NAMESPACE
+ # extension. You'll most likely also want to set list=no. This is mostly
+ # useful when converting from another server with different namespaces which
+ # you want to deprecate but still keep working. For example you can create
+ # hidden namespaces with prefixes "~/mail/", "~%u/mail/" and "mail/".
+ #hidden = no
+
+ # Show the mailboxes under this namespace with LIST command. This makes the
+ # namespace visible for clients that don't support NAMESPACE extension.
+ # "children" value lists child mailboxes, but hides the namespace prefix.
+ #list = yes
+
+ # Namespace handles its own subscriptions. If set to "no", the parent
+ # namespace handles them (empty prefix should always have this as "yes")
+ #subscriptions = yes
+
+ # See 15-mailboxes.conf for definitions of special mailboxes.
+}
+
+# Example shared namespace configuration
+#namespace {
+ #type = shared
+ #separator = /
+
+ # Mailboxes are visible under "shared/user@domain/"
+ # %%n, %%d and %%u are expanded to the destination user.
+ #prefix = shared/%%u/
+
+ # Mail location for other users' mailboxes. Note that %variables and ~/
+ # expands to the logged in user's data. %%n, %%d, %%u and %%h expand to the
+ # destination user's data.
+ #location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u
+
+ # Use the default namespace for saving subscriptions.
+ #subscriptions = no
+
+ # List the shared/ namespace only if there are visible shared mailboxes.
+ #list = children
+#}
+# Should shared INBOX be visible as "shared/user" or "shared/user/INBOX"?
+#mail_shared_explicit_inbox = no
+
+# System user and group used to access mails. If you use multiple, userdb
+# can override these by returning uid or gid fields. You can use either numbers
+# or names.
+#mail_uid =
+#mail_gid =
+
+# Group to enable temporarily for privileged operations. Currently this is
+# used only with INBOX when either its initial creation or dotlocking fails.
+# Typically this is set to "mail" to give access to /var/mail.
+mail_privileged_group = mail
+
+# Grant access to these supplementary groups for mail processes. Typically
+# these are used to set up access to shared mailboxes. Note that it may be
+# dangerous to set these if users can create symlinks (e.g. if "mail" group is
+# set here, ln -s /var/mail ~/mail/var could allow a user to delete others'
+# mailboxes, or ln -s /secret/shared/box ~/mail/mybox would allow reading it).
+#mail_access_groups =
+
+# Allow full filesystem access to clients. There's no access checks other than
+# what the operating system does for the active UID/GID. It works with both
+# maildir and mboxes, allowing you to prefix mailboxes names with eg. /path/
+# or ~user/.
+#mail_full_filesystem_access = no
+
+# Dictionary for key=value mailbox attributes. This is used for example by
+# URLAUTH and METADATA extensions.
+#mail_attribute_dict =
+
+# A comment or note that is associated with the server. This value is
+# accessible for authenticated users through the IMAP METADATA server
+# entry "/shared/comment".
+#mail_server_comment = ""
+
+# Indicates a method for contacting the server administrator. According to
+# RFC 5464, this value MUST be a URI (e.g., a mailto: or tel: URL), but that
+# is currently not enforced. Use for example mailto:admin@example.com. This
+# value is accessible for authenticated users through the IMAP METADATA server
+# entry "/shared/admin".
+#mail_server_admin =
+
+##
+## Mail processes
+##
+
+# Don't use mmap() at all. This is required if you store indexes to shared
+# filesystems (NFS or clustered filesystem).
+#mmap_disable = no
+
+# Rely on O_EXCL to work when creating dotlock files. NFS supports O_EXCL
+# since version 3, so this should be safe to use nowadays by default.
+#dotlock_use_excl = yes
+
+# When to use fsync() or fdatasync() calls:
+# optimized (default): Whenever necessary to avoid losing important data
+# always: Useful with e.g. NFS when write()s are delayed
+# never: Never use it (best performance, but crashes can lose data)
+#mail_fsync = optimized
+
+# Locking method for index files. Alternatives are fcntl, flock and dotlock.
+# Dotlocking uses some tricks which may create more disk I/O than other locking
+# methods. NFS users: flock doesn't work, remember to change mmap_disable.
+#lock_method = fcntl
+
+# Directory where mails can be temporarily stored. Usually it's used only for
+# mails larger than >= 128 kB. It's used by various parts of Dovecot, for
+# example LDA/LMTP while delivering large mails or zlib plugin for keeping
+# uncompressed mails.
+#mail_temp_dir = /tmp
+
+# Valid UID range for users, defaults to 500 and above. This is mostly
+# to make sure that users can't log in as daemons or other system users.
+# Note that denying root logins is hardcoded to dovecot binary and can't
+# be done even if first_valid_uid is set to 0.
+#first_valid_uid = 500
+#last_valid_uid = 0
+
+# Valid GID range for users, defaults to non-root/wheel. Users having
+# non-valid GID as primary group ID aren't allowed to log in. If user
+# belongs to supplementary groups with non-valid GIDs, those groups are
+# not set.
+#first_valid_gid = 1
+#last_valid_gid = 0
+
+# Maximum allowed length for mail keyword name. It's only forced when trying
+# to create new keywords.
+#mail_max_keyword_length = 50
+
+# ':' separated list of directories under which chrooting is allowed for mail
+# processes (ie. /var/mail will allow chrooting to /var/mail/foo/bar too).
+# This setting doesn't affect login_chroot, mail_chroot or auth chroot
+# settings. If this setting is empty, "/./" in home dirs are ignored.
+# WARNING: Never add directories here which local users can modify, that
+# may lead to root exploit. Usually this should be done only if you don't
+# allow shell access for users.
+#valid_chroot_dirs =
+
+# Default chroot directory for mail processes. This can be overridden for
+# specific users in user database by giving /./ in user's home directory
+# (eg. /home/./user chroots into /home). Note that usually there is no real
+# need to do chrooting, Dovecot doesn't allow users to access files outside
+# their mail directory anyway. If your home directories are prefixed with
+# the chroot directory, append "/." to mail_chroot.
+#mail_chroot =
+
+# UNIX socket path to master authentication server to find users.
+# This is used by imap (for shared users) and lda.
+#auth_socket_path = /var/run/dovecot/auth-userdb
+
+# Directory where to look up mail plugins.
+#mail_plugin_dir = /usr/lib/dovecot/modules
+
+# Space separated list of plugins to load for all services. Plugins specific to
+# IMAP, LDA, etc. are added to this list in their own .conf files.
+#mail_plugins =
+
+##
+## Mailbox handling optimizations
+##
+
+# Mailbox list indexes can be used to optimize IMAP STATUS commands. They are
+# also required for IMAP NOTIFY extension to be enabled.
+#mailbox_list_index = yes
+
+# Trust mailbox list index to be up-to-date. This reduces disk I/O at the cost
+# of potentially returning out-of-date results after e.g. server crashes.
+# The results will be automatically fixed once the folders are opened.
+#mailbox_list_index_very_dirty_syncs = yes
+
+# Should INBOX be kept up-to-date in the mailbox list index? By default it's
+# not, because most of the mailbox accesses will open INBOX anyway.
+#mailbox_list_index_include_inbox = no
+
+# The minimum number of mails in a mailbox before updates are done to cache
+# file. This allows optimizing Dovecot's behavior to do less disk writes at
+# the cost of more disk reads.
+#mail_cache_min_mail_count = 0
+
+# When IDLE command is running, mailbox is checked once in a while to see if
+# there are any new mails or other changes. This setting defines the minimum
+# time to wait between those checks. Dovecot can also use inotify and
+# kqueue to find out immediately when changes occur.
+#mailbox_idle_check_interval = 30 secs
+
+# Save mails with CR+LF instead of plain LF. This makes sending those mails
+# take less CPU, especially with sendfile() syscall with Linux and FreeBSD.
+# But it also creates a bit more disk I/O which may just make it slower.
+# Also note that if other software reads the mboxes/maildirs, they may handle
+# the extra CRs wrong and cause problems.
+#mail_save_crlf = no
+
+# Max number of mails to keep open and prefetch to memory. This only works with
+# some mailbox formats and/or operating systems.
+#mail_prefetch_count = 0
+
+# How often to scan for stale temporary files and delete them (0 = never).
+# These should exist only after Dovecot dies in the middle of saving mails.
+#mail_temp_scan_interval = 1w
+
+# How many slow mail accesses sorting can perform before it returns failure.
+# With IMAP the reply is: NO [LIMIT] Requested sort would have taken too long.
+# The untagged SORT reply is still returned, but it's likely not correct.
+#mail_sort_max_read_count = 0
+
+protocol !indexer-worker {
+ # If folder vsize calculation requires opening more than this many mails from
+ # disk (i.e. mail sizes aren't in cache already), return failure and finish
+ # the calculation via indexer process. Disabled by default. This setting must
+ # be 0 for indexer-worker processes.
+ #mail_vsize_bg_after_count = 0
+}
+
+##
+## Maildir-specific settings
+##
+
+# By default LIST command returns all entries in maildir beginning with a dot.
+# Enabling this option makes Dovecot return only entries which are directories.
+# This is done by stat()ing each entry, so it causes more disk I/O.
+# (For systems setting struct dirent->d_type, this check is free and it's
+# done always regardless of this setting)
+#maildir_stat_dirs = no
+
+# When copying a message, do it with hard links whenever possible. This makes
+# the performance much better, and it's unlikely to have any side effects.
+#maildir_copy_with_hardlinks = yes
+
+# Assume Dovecot is the only MUA accessing Maildir: Scan cur/ directory only
+# when its mtime changes unexpectedly or when we can't find the mail otherwise.
+#maildir_very_dirty_syncs = no
+
+# If enabled, Dovecot doesn't use the S= in the Maildir filenames for
+# getting the mail's physical size, except when recalculating Maildir++ quota.
+# This can be useful in systems where a lot of the Maildir filenames have a
+# broken size. The performance hit for enabling this is very small.
+#maildir_broken_filename_sizes = no
+
+# Always move mails from new/ directory to cur/, even when the \Recent flags
+# aren't being reset.
+#maildir_empty_new = no
+
+##
+## mbox-specific settings
+##
+
+# Which locking methods to use for locking mbox. There are four available:
+# dotlock: Create .lock file. This is the oldest and most NFS-safe
+# solution. If you want to use /var/mail/ like directory, the users
+# will need write access to that directory.
+# dotlock_try: Same as dotlock, but if it fails because of permissions or
+# because there isn't enough disk space, just skip it.
+# fcntl : Use this if possible. Works with NFS too if lockd is used.
+# flock : May not exist in all systems. Doesn't work with NFS.
+# lockf : May not exist in all systems. Doesn't work with NFS.
+#
+# You can use multiple locking methods; if you do the order they're declared
+# in is important to avoid deadlocks if other MTAs/MUAs are using multiple
+# locking methods as well. Some operating systems don't allow using some of
+# them simultaneously.
+#
+# The Debian value for mbox_write_locks differs from upstream Dovecot. It is
+# changed to be compliant with Debian Policy (section 11.6) for NFS safety.
+# Dovecot: mbox_write_locks = dotlock fcntl
+# Debian: mbox_write_locks = fcntl dotlock
+#
+#mbox_read_locks = fcntl
+#mbox_write_locks = fcntl dotlock
+
+# Maximum time to wait for lock (all of them) before aborting.
+#mbox_lock_timeout = 5 mins
+
+# If dotlock exists but the mailbox isn't modified in any way, override the
+# lock file after this much time.
+#mbox_dotlock_change_timeout = 2 mins
+
+# When mbox changes unexpectedly we have to fully read it to find out what
+# changed. If the mbox is large this can take a long time. Since the change
+# is usually just a newly appended mail, it'd be faster to simply read the
+# new mails. If this setting is enabled, Dovecot does this but still safely
+# fallbacks to re-reading the whole mbox file whenever something in mbox isn't
+# how it's expected to be. The only real downside to this setting is that if
+# some other MUA changes message flags, Dovecot doesn't notice it immediately.
+# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK
+# commands.
+#mbox_dirty_syncs = yes
+
+# Like mbox_dirty_syncs, but don't do full syncs even with SELECT, EXAMINE,
+# EXPUNGE or CHECK commands. If this is set, mbox_dirty_syncs is ignored.
+#mbox_very_dirty_syncs = no
+
+# Delay writing mbox headers until doing a full write sync (EXPUNGE and CHECK
+# commands and when closing the mailbox). This is especially useful for POP3
+# where clients often delete all mails. The downside is that our changes
+# aren't immediately visible to other MUAs.
+#mbox_lazy_writes = yes
+
+# If mbox size is smaller than this (e.g. 100k), don't write index files.
+# If an index file already exists it's still read, just not updated.
+#mbox_min_index_size = 0
+
+# Mail header selection algorithm to use for MD5 POP3 UIDLs when
+# pop3_uidl_format=%m. For backwards compatibility we use apop3d inspired
+# algorithm, but it fails if the first Received: header isn't unique in all
+# mails. An alternative algorithm is "all" that selects all headers.
+#mbox_md5 = apop3d
+
+##
+## mdbox-specific settings
+##
+
+# Maximum dbox file size until it's rotated.
+#mdbox_rotate_size = 10M
+
+# Maximum dbox file age until it's rotated. Typically in days. Day begins
+# from midnight, so 1d = today, 2d = yesterday, etc. 0 = check disabled.
+#mdbox_rotate_interval = 0
+
+# When creating new mdbox files, immediately preallocate their size to
+# mdbox_rotate_size. This setting currently works only in Linux with some
+# filesystems (ext4, xfs).
+#mdbox_preallocate_space = no
+
+##
+## Mail attachments
+##
+
+# sdbox and mdbox support saving mail attachments to external files, which
+# also allows single instance storage for them. Other backends don't support
+# this for now.
+
+# Directory root where to store mail attachments. Disabled, if empty.
+#mail_attachment_dir =
+
+# Attachments smaller than this aren't saved externally. It's also possible to
+# write a plugin to disable saving specific attachments externally.
+#mail_attachment_min_size = 128k
+
+# Filesystem backend to use for saving attachments:
+# posix : No SiS done by Dovecot (but this might help FS's own deduplication)
+# sis posix : SiS with immediate byte-by-byte comparison during saving
+# sis-queue posix : SiS with delayed comparison and deduplication
+#mail_attachment_fs = sis posix
+
+# Hash format to use in attachment filenames. You can add any text and
+# variables: %{md4}, %{md5}, %{sha1}, %{sha256}, %{sha512}, %{size}.
+# Variables can be truncated, e.g. %{sha256:80} returns only first 80 bits
+#mail_attachment_hash = %{sha1}
+
+# Settings to control adding $HasAttachment or $HasNoAttachment keywords.
+# By default, all MIME parts with Content-Disposition=attachment, or inlines
+# with filename parameter are consired attachments.
+# add-flags - Add the keywords when saving new mails or when fetching can
+# do it efficiently.
+# content-type=type or !type - Include/exclude content type. Excluding will
+# never consider the matched MIME part as attachment. Including will only
+# negate an exclusion (e.g. content-type=!foo/* content-type=foo/bar).
+# exclude-inlined - Exclude any Content-Disposition=inline MIME part.
+#mail_attachment_detection_options =
diff --git a/dovecot/conf.d/10-master.conf b/dovecot/conf.d/10-master.conf
new file mode 100644
index 00000000..d52ce808
--- /dev/null
+++ b/dovecot/conf.d/10-master.conf
@@ -0,0 +1,130 @@
+#default_process_limit = 100
+#default_client_limit = 1000
+
+# Default VSZ (virtual memory size) limit for service processes. This is mainly
+# intended to catch and kill processes that leak memory before they eat up
+# everything.
+#default_vsz_limit = 256M
+
+# Login user is internally used by login processes. This is the most untrusted
+# user in Dovecot system. It shouldn't have access to anything at all.
+#default_login_user = dovenull
+
+# Internal user is used by unprivileged processes. It should be separate from
+# login user, so that login processes can't disturb other processes.
+#default_internal_user = dovecot
+
+service imap-login {
+ inet_listener imap {
+ #port = 143
+ }
+ inet_listener imaps {
+ #port = 993
+ #ssl = yes
+ }
+
+ # Number of connections to handle before starting a new process. Typically
+ # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
+ # is faster.
+ #service_count = 1
+
+ # Number of processes to always keep waiting for more connections.
+ #process_min_avail = 0
+
+ # If you set service_count=0, you probably need to grow this.
+ #vsz_limit = $default_vsz_limit
+}
+
+service pop3-login {
+ inet_listener pop3 {
+ #port = 110
+ }
+ inet_listener pop3s {
+ #port = 995
+ #ssl = yes
+ }
+}
+
+service submission-login {
+ inet_listener submission {
+ #port = 587
+ }
+}
+
+service lmtp {
+ unix_listener lmtp {
+ #mode = 0666
+ }
+
+ # Create inet listener only if you can't use the above UNIX socket
+ #inet_listener lmtp {
+ # Avoid making LMTP visible for the entire internet
+ #address =
+ #port =
+ #}
+}
+
+service imap {
+ # Most of the memory goes to mmap()ing files. You may need to increase this
+ # limit if you have huge mailboxes.
+ #vsz_limit = $default_vsz_limit
+
+ # Max. number of IMAP processes (connections)
+ #process_limit = 1024
+}
+
+service pop3 {
+ # Max. number of POP3 processes (connections)
+ #process_limit = 1024
+}
+
+service submission {
+ # Max. number of SMTP Submission processes (connections)
+ #process_limit = 1024
+}
+
+service auth {
+ # auth_socket_path points to this userdb socket by default. It's typically
+ # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have
+ # full permissions to this socket are able to get a list of all usernames and
+ # get the results of everyone's userdb lookups.
+ #
+ # The default 0666 mode allows anyone to connect to the socket, but the
+ # userdb lookups will succeed only if the userdb returns an "uid" field that
+ # matches the caller process's UID. Also if caller's uid or gid matches the
+ # socket's uid or gid the lookup succeeds. Anything else causes a failure.
+ #
+ # To give the caller full permissions to lookup all users, set the mode to
+ # something else than 0666 and Dovecot lets the kernel enforce the
+ # permissions (e.g. 0777 allows everyone full permissions).
+ unix_listener auth-userdb {
+ #mode = 0666
+ #user =
+ #group =
+ }
+
+ # Postfix smtp-auth
+ #unix_listener /var/spool/postfix/private/auth {
+ # mode = 0666
+ #}
+
+ # Auth process is run as this user.
+ #user = $default_internal_user
+}
+
+service auth-worker {
+ # Auth worker process is run as root by default, so that it can access
+ # /etc/shadow. If this isn't necessary, the user should be changed to
+ # $default_internal_user.
+ #user = root
+}
+
+service dict {
+ # If dict proxy is used, mail processes should have access to its socket.
+ # For example: mode=0660, group=vmail and global mail_access_groups=vmail
+ unix_listener dict {
+ #mode = 0600
+ #user =
+ #group =
+ }
+}
diff --git a/dovecot/conf.d/10-tcpwrapper.conf b/dovecot/conf.d/10-tcpwrapper.conf
new file mode 100644
index 00000000..b237d961
--- /dev/null
+++ b/dovecot/conf.d/10-tcpwrapper.conf
@@ -0,0 +1,14 @@
+# 10-tcpwrapper.conf
+#
+# service name for hosts.{allow|deny} are those defined as
+# inet_listener in master.conf
+#
+#login_access_sockets = tcpwrap
+#
+#service tcpwrap {
+# unix_listener login/tcpwrap {
+# group = $default_login_user
+# mode = 0600
+# user = $default_login_user
+# }
+#}
diff --git a/dovecot/conf.d/15-lda.conf b/dovecot/conf.d/15-lda.conf
new file mode 100644
index 00000000..e1d6fcd9
--- /dev/null
+++ b/dovecot/conf.d/15-lda.conf
@@ -0,0 +1,48 @@
+##
+## LDA specific settings (also used by LMTP)
+##
+
+# Address to use when sending rejection mails.
+# Default is postmaster@%d. %d expands to recipient domain.
+#postmaster_address =
+
+# Hostname to use in various parts of sent mails (e.g. in Message-Id) and
+# in LMTP replies. Default is the system's real hostname@domain.
+#hostname =
+
+# If user is over quota, return with temporary failure instead of
+# bouncing the mail.
+#quota_full_tempfail = no
+
+# Binary to use for sending mails.
+#sendmail_path = /usr/sbin/sendmail
+
+# If non-empty, send mails via this SMTP host[:port] instead of sendmail.
+#submission_host =
+
+# Subject: header to use for rejection mails. You can use the same variables
+# as for rejection_reason below.
+#rejection_subject = Rejected: %s
+
+# Human readable error message for rejection mails. You can use variables:
+# %n = CRLF, %r = reason, %s = original subject, %t = recipient
+#rejection_reason = Your message to <%t> was automatically rejected:%n%r
+
+# Delimiter character between local-part and detail in email address.
+#recipient_delimiter = +
+
+# Header where the original recipient address (SMTP's RCPT TO: address) is taken
+# from if not available elsewhere. With dovecot-lda -a parameter overrides this.
+# A commonly used header for this is X-Original-To.
+#lda_original_recipient_header =
+
+# Should saving a mail to a nonexistent mailbox automatically create it?
+#lda_mailbox_autocreate = no
+
+# Should automatically created mailboxes be also automatically subscribed?
+#lda_mailbox_autosubscribe = no
+
+protocol lda {
+ # Space separated list of plugins to load (default is global mail_plugins).
+ #mail_plugins = $mail_plugins
+}
diff --git a/dovecot/conf.d/15-mailboxes.conf b/dovecot/conf.d/15-mailboxes.conf
new file mode 100644
index 00000000..71076d48
--- /dev/null
+++ b/dovecot/conf.d/15-mailboxes.conf
@@ -0,0 +1,86 @@
+##
+## Mailbox definitions
+##
+
+# Each mailbox is specified in a separate mailbox section. The section name
+# specifies the mailbox name. If it has spaces, you can put the name
+# "in quotes". These sections can contain the following mailbox settings:
+#
+# auto:
+# Indicates whether the mailbox with this name is automatically created
+# implicitly when it is first accessed. The user can also be automatically
+# subscribed to the mailbox after creation. The following values are
+# defined for this setting:
+#
+# no - Never created automatically.
+# create - Automatically created, but no automatic subscription.
+# subscribe - Automatically created and subscribed.
+#
+# special_use:
+# A space-separated list of SPECIAL-USE flags (RFC 6154) to use for the
+# mailbox. There are no validity checks, so you could specify anything
+# you want in here, but it's not a good idea to use flags other than the
+# standard ones specified in the RFC:
+#
+# \All - This (virtual) mailbox presents all messages in the
+# user's message store.
+# \Archive - This mailbox is used to archive messages.
+# \Drafts - This mailbox is used to hold draft messages.
+# \Flagged - This (virtual) mailbox presents all messages in the
+# user's message store marked with the IMAP \Flagged flag.
+# \Important - This (virtual) mailbox presents all messages in the
+# user's message store deemed important to user.
+# \Junk - This mailbox is where messages deemed to be junk mail
+# are held.
+# \Sent - This mailbox is used to hold copies of messages that
+# have been sent.
+# \Trash - This mailbox is used to hold messages that have been
+# deleted.
+#
+# comment:
+# Defines a default comment or note associated with the mailbox. This
+# value is accessible through the IMAP METADATA mailbox entries
+# "/shared/comment" and "/private/comment". Users with sufficient
+# privileges can override the default value for entries with a custom
+# value.
+
+# NOTE: Assumes "namespace inbox" has been defined in 10-mail.conf.
+namespace inbox {
+ # These mailboxes are widely used and could perhaps be created automatically:
+ mailbox Drafts {
+ special_use = \Drafts
+ }
+ mailbox Junk {
+ special_use = \Junk
+ }
+ mailbox Trash {
+ special_use = \Trash
+ }
+
+ # For \Sent mailboxes there are two widely used names. We'll mark both of
+ # them as \Sent. User typically deletes one of them if duplicates are created.
+ mailbox Sent {
+ special_use = \Sent
+ }
+ mailbox "Sent Messages" {
+ special_use = \Sent
+ }
+
+ # If you have a virtual "All messages" mailbox:
+ #mailbox virtual/All {
+ # special_use = \All
+ # comment = All my messages
+ #}
+
+ # If you have a virtual "Flagged" mailbox:
+ #mailbox virtual/Flagged {
+ # special_use = \Flagged
+ # comment = All my flagged messages
+ #}
+
+ # If you have a virtual "Important" mailbox:
+ #mailbox virtual/Important {
+ # special_use = \Important
+ # comment = All my important messages
+ #}
+}
diff --git a/dovecot/conf.d/20-lmtp.conf b/dovecot/conf.d/20-lmtp.conf
new file mode 100644
index 00000000..0684e819
--- /dev/null
+++ b/dovecot/conf.d/20-lmtp.conf
@@ -0,0 +1,40 @@
+##
+## LMTP specific settings
+##
+
+# Support proxying to other LMTP/SMTP servers by performing passdb lookups.
+#lmtp_proxy = no
+
+# When recipient address includes the detail (e.g. user+detail), try to save
+# the mail to the detail mailbox. See also recipient_delimiter and
+# lda_mailbox_autocreate settings.
+#lmtp_save_to_detail_mailbox = no
+
+# Verify quota before replying to RCPT TO. This adds a small overhead.
+#lmtp_rcpt_check_quota = no
+
+# Add "Received:" header to mails delivered.
+#lmtp_add_received_header = yes
+
+# Which recipient address to use for Delivered-To: header and Received:
+# header. The default is "final", which is the same as the one given to
+# RCPT TO command. "original" uses the address given in RCPT TO's ORCPT
+# parameter, "none" uses nothing. Note that "none" is currently always used
+# when a mail has multiple recipients.
+#lmtp_hdr_delivery_address = final
+
+# Workarounds for various client bugs:
+# whitespace-before-path:
+# Allow one or more spaces or tabs between `MAIL FROM:' and path and between
+# `RCPT TO:' and path.
+# mailbox-for-path:
+# Allow using bare Mailbox syntax (i.e., without <...>) instead of full path
+# syntax.
+#
+# The list is space-separated.
+#lmtp_client_workarounds =
+
+protocol lmtp {
+ # Space separated list of plugins to load (default is global mail_plugins).
+ #mail_plugins = $mail_plugins
+}
diff --git a/dovecot/conf.d/20-managesieve.conf b/dovecot/conf.d/20-managesieve.conf
new file mode 100644
index 00000000..3f71b58d
--- /dev/null
+++ b/dovecot/conf.d/20-managesieve.conf
@@ -0,0 +1,84 @@
+##
+## ManageSieve specific settings
+##
+
+# Uncomment to enable managesieve protocol:
+#protocols = $protocols sieve
+
+# Service definitions
+
+#service managesieve-login {
+ #inet_listener sieve {
+ # port = 4190
+ #}
+
+ #inet_listener sieve_deprecated {
+ # port = 2000
+ #}
+
+ # Number of connections to handle before starting a new process. Typically
+ # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
+ # is faster.
+ #service_count = 1
+
+ # Number of processes to always keep waiting for more connections.
+ #process_min_avail = 0
+
+ # If you set service_count=0, you probably need to grow this.
+ #vsz_limit = 64M
+#}
+
+#service managesieve {
+ # Max. number of ManageSieve processes (connections)
+ #process_limit = 1024
+#}
+
+# Service configuration
+
+protocol sieve {
+ # Maximum ManageSieve command line length in bytes. ManageSieve usually does
+ # not involve overly long command lines, so this setting will not normally
+ # need adjustment
+ #managesieve_max_line_length = 65536
+
+ # Maximum number of ManageSieve connections allowed for a user from each IP
+ # address.
+ # NOTE: The username is compared case-sensitively.
+ #mail_max_userip_connections = 10
+
+ # Space separated list of plugins to load (none known to be useful so far).
+ # Do NOT try to load IMAP plugins here.
+ #mail_plugins =
+
+ # MANAGESIEVE logout format string:
+ # %i - total number of bytes read from client
+ # %o - total number of bytes sent to client
+ # %{put_bytes} - Number of bytes saved using PUTSCRIPT command
+ # %{put_count} - Number of scripts saved using PUTSCRIPT command
+ # %{get_bytes} - Number of bytes read using GETCRIPT command
+ # %{get_count} - Number of scripts read using GETSCRIPT command
+ # %{get_bytes} - Number of bytes processed using CHECKSCRIPT command
+ # %{get_count} - Number of scripts checked using CHECKSCRIPT command
+ # %{deleted_count} - Number of scripts deleted using DELETESCRIPT command
+ # %{renamed_count} - Number of scripts renamed using RENAMESCRIPT command
+ #managesieve_logout_format = bytes=%i/%o
+
+ # To fool ManageSieve clients that are focused on CMU's timesieved you can
+ # specify the IMPLEMENTATION capability that Dovecot reports to clients.
+ # For example: 'Cyrus timsieved v2.2.13'
+ #managesieve_implementation_string = Dovecot Pigeonhole
+
+ # Explicitly specify the SIEVE and NOTIFY capability reported by the server
+ # before login. If left unassigned these will be reported dynamically
+ # according to what the Sieve interpreter supports by default (after login
+ # this may differ depending on the user).
+ #managesieve_sieve_capability =
+ #managesieve_notify_capability =
+
+ # The maximum number of compile errors that are returned to the client upon
+ # script upload or script verification.
+ #managesieve_max_compile_errors = 5
+
+ # Refer to 90-sieve.conf for script quota configuration and configuration of
+ # Sieve execution limits.
+}
diff --git a/dovecot/conf.d/20-pop3.conf b/dovecot/conf.d/20-pop3.conf
new file mode 100644
index 00000000..7b310eaa
--- /dev/null
+++ b/dovecot/conf.d/20-pop3.conf
@@ -0,0 +1,99 @@
+##
+## POP3 specific settings
+##
+
+# Don't try to set mails non-recent or seen with POP3 sessions. This is
+# mostly intended to reduce disk I/O. With maildir it doesn't move files
+# from new/ to cur/, with mbox it doesn't write Status-header.
+#pop3_no_flag_updates = no
+
+# Support LAST command which exists in old POP3 specs, but has been removed
+# from new ones. Some clients still wish to use this though. Enabling this
+# makes RSET command clear all \Seen flags from messages.
+#pop3_enable_last = no
+
+# If mail has X-UIDL header, use it as the mail's UIDL.
+#pop3_reuse_xuidl = no
+
+# Allow only one POP3 session to run simultaneously for the same user.
+#pop3_lock_session = no
+
+# POP3 requires message sizes to be listed as if they had CR+LF linefeeds.
+# Many POP3 servers violate this by returning the sizes with LF linefeeds,
+# because it's faster to get. When this setting is enabled, Dovecot still
+# tries to do the right thing first, but if that requires opening the
+# message, it fallbacks to the easier (but incorrect) size.
+#pop3_fast_size_lookups = no
+
+# POP3 UIDL (unique mail identifier) format to use. You can use following
+# variables, along with the variable modifiers described in
+# doc/wiki/Variables.txt (e.g. %Uf for the filename in uppercase)
+#
+# %v - Mailbox's IMAP UIDVALIDITY
+# %u - Mail's IMAP UID
+# %m - MD5 sum of the mailbox headers in hex (mbox only)
+# %f - filename (maildir only)
+# %g - Mail's GUID
+#
+# If you want UIDL compatibility with other POP3 servers, use:
+# UW's ipop3d : %08Xv%08Xu
+# Courier : %f or %v-%u (both might be used simultaneously)
+# Cyrus (<= 2.1.3) : %u
+# Cyrus (>= 2.1.4) : %v.%u
+# Dovecot v0.99.x : %v.%u
+# tpop3d : %Mf
+#
+# Note that Outlook 2003 seems to have problems with %v.%u format which was
+# Dovecot's default, so if you're building a new server it would be a good
+# idea to change this. %08Xu%08Xv should be pretty fail-safe.
+#
+#pop3_uidl_format = %08Xu%08Xv
+
+# Permanently save UIDLs sent to POP3 clients, so pop3_uidl_format changes
+# won't change those UIDLs. Currently this works only with Maildir.
+#pop3_save_uidl = no
+
+# What to do about duplicate UIDLs if they exist?
+# allow: Show duplicates to clients.
+# rename: Append a temporary -2, -3, etc. counter after the UIDL.
+#pop3_uidl_duplicates = allow
+
+# This option changes POP3 behavior so that it's not possible to actually
+# delete mails via POP3, only hide them from future POP3 sessions. The mails
+# will still be counted towards user's quota until actually deleted via IMAP.
+# Use e.g. "$POP3Deleted" as the value (it will be visible as IMAP keyword).
+# Make sure you can legally archive mails before enabling this setting.
+#pop3_deleted_flag =
+
+# POP3 logout format string:
+# %i - total number of bytes read from client
+# %o - total number of bytes sent to client
+# %t - number of TOP commands
+# %p - number of bytes sent to client as a result of TOP command
+# %r - number of RETR commands
+# %b - number of bytes sent to client as a result of RETR command
+# %d - number of deleted messages
+# %{deleted_bytes} - number of bytes in deleted messages
+# %m - number of messages (before deletion)
+# %s - mailbox size in bytes (before deletion)
+# %u - old/new UIDL hash. may help finding out if UIDLs changed unexpectedly
+#pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s
+
+# Workarounds for various client bugs:
+# outlook-no-nuls:
+# Outlook and Outlook Express hang if mails contain NUL characters.
+# This setting replaces them with 0x80 character.
+# oe-ns-eoh:
+# Outlook Express and Netscape Mail breaks if end of headers-line is
+# missing. This option simply sends it if it's missing.
+# The list is space-separated.
+#pop3_client_workarounds =
+
+protocol pop3 {
+ # Space separated list of plugins to load (default is global mail_plugins).
+ #mail_plugins = $mail_plugins
+
+ # Maximum number of POP3 connections allowed for a user from each IP address.
+ # NOTE: The username is compared case-sensitively.
+ #mail_max_userip_connections = 10
+}
diff --git a/dovecot/conf.d/90-acl.conf b/dovecot/conf.d/90-acl.conf
new file mode 100644
index 00000000..f0c0e7a5
--- /dev/null
+++ b/dovecot/conf.d/90-acl.conf
@@ -0,0 +1,19 @@
+##
+## Mailbox access control lists.
+##
+
+# vfile backend reads ACLs from "dovecot-acl" file from mail directory.
+# You can also optionally give a global ACL directory path where ACLs are
+# applied to all users' mailboxes. The global ACL directory contains
+# one file for each mailbox, eg. INBOX or sub.mailbox. cache_secs parameter
+# specifies how many seconds to wait between stat()ing dovecot-acl file
+# to see if it changed.
+plugin {
+ #acl = vfile:/etc/dovecot/global-acls:cache_secs=300
+}
+
+# To let users LIST mailboxes shared by other users, Dovecot needs a
+# shared mailbox dictionary. For example:
+plugin {
+ #acl_shared_dict = file:/var/lib/dovecot/shared-mailboxes
+}
diff --git a/dovecot/conf.d/90-plugin.conf b/dovecot/conf.d/90-plugin.conf
new file mode 100644
index 00000000..8c8fccf4
--- /dev/null
+++ b/dovecot/conf.d/90-plugin.conf
@@ -0,0 +1,11 @@
+##
+## Plugin settings
+##
+
+# All wanted plugins must be listed in mail_plugins setting before any of the
+# settings take effect. See for list of plugins and
+# their configuration. Note that %variable expansion is done for all values.
+
+plugin {
+ #setting_name = value
+}
diff --git a/dovecot/conf.d/90-quota.conf b/dovecot/conf.d/90-quota.conf
new file mode 100644
index 00000000..3308c059
--- /dev/null
+++ b/dovecot/conf.d/90-quota.conf
@@ -0,0 +1,83 @@
+##
+## Quota configuration.
+##
+
+# Note that you also have to enable quota plugin in mail_plugins setting.
+#
+
+##
+## Quota limits
+##
+
+# Quota limits are set using "quota_rule" parameters. To get per-user quota
+# limits, you can set/override them by returning "quota_rule" extra field
+# from userdb. It's also possible to give mailbox-specific limits, for example
+# to give additional 100 MB when saving to Trash:
+
+plugin {
+ #quota_rule = *:storage=1G
+ #quota_rule2 = Trash:storage=+100M
+
+ # LDA/LMTP allows saving the last mail to bring user from under quota to
+ # over quota, if the quota doesn't grow too high. Default is to allow as
+ # long as quota will stay under 10% above the limit. Also allowed e.g. 10M.
+ #quota_grace = 10%%
+
+ # Quota plugin can also limit the maximum accepted mail size.
+ #quota_max_mail_size = 100M
+}
+
+##
+## Quota warnings
+##
+
+# You can execute a given command when user exceeds a specified quota limit.
+# Each quota root has separate limits. Only the command for the first
+# exceeded limit is executed, so put the highest limit first.
+# The commands are executed via script service by connecting to the named
+# UNIX socket (quota-warning below).
+# Note that % needs to be escaped as %%, otherwise "% " expands to empty.
+
+plugin {
+ #quota_warning = storage=95%% quota-warning 95 %u
+ #quota_warning2 = storage=80%% quota-warning 80 %u
+}
+
+# Example quota-warning service. The unix listener's permissions should be
+# set in a way that mail processes can connect to it. Below example assumes
+# that mail processes run as vmail user. If you use mode=0666, all system users
+# can generate quota warnings to anyone.
+#service quota-warning {
+# executable = script /usr/local/bin/quota-warning.sh
+# user = dovecot
+# unix_listener quota-warning {
+# user = vmail
+# }
+#}
+
+##
+## Quota backends
+##
+
+# Multiple backends are supported:
+# dirsize: Find and sum all the files found from mail directory.
+# Extremely SLOW with Maildir. It'll eat your CPU and disk I/O.
+# dict: Keep quota stored in dictionary (eg. SQL)
+# maildir: Maildir++ quota
+# fs: Read-only support for filesystem quota
+
+plugin {
+ #quota = dirsize:User quota
+ #quota = maildir:User quota
+ #quota = dict:User quota::proxy::quota
+ #quota = fs:User quota
+}
+
+# Multiple quota roots are also possible, for example this gives each user
+# their own 100MB quota and one shared 1GB quota within the domain:
+plugin {
+ #quota = dict:user::proxy::quota
+ #quota2 = dict:domain:%d:proxy::quota_domain
+ #quota_rule = *:storage=102400
+ #quota2_rule = *:storage=1048576
+}
diff --git a/dovecot/conf.d/90-sieve-extprograms.conf b/dovecot/conf.d/90-sieve-extprograms.conf
new file mode 100644
index 00000000..17dcb77d
--- /dev/null
+++ b/dovecot/conf.d/90-sieve-extprograms.conf
@@ -0,0 +1,44 @@
+# Sieve Extprograms plugin configuration
+
+# Don't forget to add the sieve_extprograms plugin to the sieve_plugins setting.
+# Also enable the extensions you need (one or more of vnd.dovecot.pipe,
+# vnd.dovecot.filter and vnd.dovecot.execute) by adding these to the
+# sieve_extensions or sieve_global_extensions settings. Restricting these
+# extensions to a global context using sieve_global_extensions is recommended.
+
+plugin {
+
+ # The directory where the program sockets are located for the
+ # vnd.dovecot.pipe, vnd.dovecot.filter and vnd.dovecot.execute extension
+ # respectively. The name of each unix socket contained in that directory
+ # directly maps to a program-name referenced from the Sieve script.
+ #sieve_pipe_socket_dir = sieve-pipe
+ #sieve_filter_socket_dir = sieve-filter
+ #sieve_execute_socket_dir = sieve-execute
+
+ # The directory where the scripts are located for direct execution by the
+ # vnd.dovecot.pipe, vnd.dovecot.filter and vnd.dovecot.execute extension
+ # respectively. The name of each script contained in that directory
+ # directly maps to a program-name referenced from the Sieve script.
+ #sieve_pipe_bin_dir = /usr/lib/dovecot/sieve-pipe
+ #sieve_filter_bin_dir = /usr/lib/dovecot/sieve-filter
+ #sieve_execute_bin_dir = /usr/lib/dovecot/sieve-execute
+}
+
+# An example program service called 'do-something' to pipe messages to
+#service do-something {
+ # Define the executed script as parameter to the sieve service
+ #executable = script /usr/lib/dovecot/sieve-pipe/do-something.sh
+
+ # Use some unprivileged user for executing the program
+ #user = dovenull
+
+ # The unix socket located in the sieve_pipe_socket_dir (as defined in the
+ # plugin {} section above)
+ #unix_listener sieve-pipe/do-something {
+ # LDA/LMTP must have access
+ # user = vmail
+ # mode = 0600
+ #}
+#}
+
diff --git a/dovecot/conf.d/auth-checkpassword.conf.ext b/dovecot/conf.d/auth-checkpassword.conf.ext
new file mode 100644
index 00000000..b2fb13a2
--- /dev/null
+++ b/dovecot/conf.d/auth-checkpassword.conf.ext
@@ -0,0 +1,21 @@
+# Authentication for checkpassword users. Included from 10-auth.conf.
+#
+#
+
+passdb {
+ driver = checkpassword
+ args = /usr/bin/checkpassword
+}
+
+# passdb lookup should return also userdb info
+userdb {
+ driver = prefetch
+}
+
+# Standard checkpassword doesn't support direct userdb lookups.
+# If you need checkpassword userdb, the checkpassword must support
+# Dovecot-specific extensions.
+#userdb {
+# driver = checkpassword
+# args = /usr/bin/checkpassword
+#}
diff --git a/dovecot/conf.d/auth-deny.conf.ext b/dovecot/conf.d/auth-deny.conf.ext
new file mode 100644
index 00000000..ce3f1cf1
--- /dev/null
+++ b/dovecot/conf.d/auth-deny.conf.ext
@@ -0,0 +1,15 @@
+# Deny access for users. Included from 10-auth.conf.
+
+# Users can be (temporarily) disabled by adding a passdb with deny=yes.
+# If the user is found from that database, authentication will fail.
+# The deny passdb should always be specified before others, so it gets
+# checked first.
+
+# Example deny passdb using passwd-file. You can use any passdb though.
+passdb {
+ driver = passwd-file
+ deny = yes
+
+ # File contains a list of usernames, one per line
+ args = /etc/dovecot/deny-users
+}
diff --git a/dovecot/conf.d/auth-dict.conf.ext b/dovecot/conf.d/auth-dict.conf.ext
new file mode 100644
index 00000000..0be4847d
--- /dev/null
+++ b/dovecot/conf.d/auth-dict.conf.ext
@@ -0,0 +1,16 @@
+# Authentication via dict backend. Included from 10-auth.conf.
+#
+#
+
+passdb {
+ driver = dict
+
+ # Path for dict configuration file, see
+ # example-config/dovecot-dict-auth.conf.ext
+ args = /etc/dovecot/dovecot-dict-auth.conf.ext
+}
+
+userdb {
+ driver = dict
+ args = /etc/dovecot/dovecot-dict-auth.conf.ext
+}
diff --git a/dovecot/conf.d/auth-master.conf.ext b/dovecot/conf.d/auth-master.conf.ext
new file mode 100644
index 00000000..2cf128f1
--- /dev/null
+++ b/dovecot/conf.d/auth-master.conf.ext
@@ -0,0 +1,16 @@
+# Authentication for master users. Included from 10-auth.conf.
+
+# By adding master=yes setting inside a passdb you make the passdb a list
+# of "master users", who can log in as anyone else.
+#
+
+# Example master user passdb using passwd-file. You can use any passdb though.
+passdb {
+ driver = passwd-file
+ master = yes
+ args = /etc/dovecot/master-users
+
+ # Unless you're using PAM, you probably still want the destination user to
+ # be looked up from passdb that it really exists. pass=yes does that.
+ pass = yes
+}
diff --git a/dovecot/conf.d/auth-passwdfile.conf.ext b/dovecot/conf.d/auth-passwdfile.conf.ext
new file mode 100644
index 00000000..c89d28c6
--- /dev/null
+++ b/dovecot/conf.d/auth-passwdfile.conf.ext
@@ -0,0 +1,20 @@
+# Authentication for passwd-file users. Included from 10-auth.conf.
+#
+# passwd-like file with specified location.
+#
+
+passdb {
+ driver = passwd-file
+ args = scheme=CRYPT username_format=%u /etc/dovecot/users
+}
+
+userdb {
+ driver = passwd-file
+ args = username_format=%u /etc/dovecot/users
+
+ # Default fields that can be overridden by passwd-file
+ #default_fields = quota_rule=*:storage=1G
+
+ # Override fields from passwd-file
+ #override_fields = home=/home/virtual/%u
+}
diff --git a/dovecot/conf.d/auth-sql.conf.ext b/dovecot/conf.d/auth-sql.conf.ext
new file mode 100644
index 00000000..ccbea864
--- /dev/null
+++ b/dovecot/conf.d/auth-sql.conf.ext
@@ -0,0 +1,30 @@
+# Authentication for SQL users. Included from 10-auth.conf.
+#
+#
+
+passdb {
+ driver = sql
+
+ # Path for SQL configuration file, see example-config/dovecot-sql.conf.ext
+ args = /etc/dovecot/dovecot-sql.conf.ext
+}
+
+# "prefetch" user database means that the passdb already provided the
+# needed information and there's no need to do a separate userdb lookup.
+#
+#userdb {
+# driver = prefetch
+#}
+
+userdb {
+ driver = sql
+ args = /etc/dovecot/dovecot-sql.conf.ext
+}
+
+# If you don't have any user-specific settings, you can avoid the user_query
+# by using userdb static instead of userdb sql, for example:
+#
+#userdb {
+ #driver = static
+ #args = uid=vmail gid=vmail home=/var/vmail/%u
+#}
diff --git a/dovecot/conf.d/auth-static.conf.ext b/dovecot/conf.d/auth-static.conf.ext
new file mode 100644
index 00000000..90890c59
--- /dev/null
+++ b/dovecot/conf.d/auth-static.conf.ext
@@ -0,0 +1,24 @@
+# Static passdb. Included from 10-auth.conf.
+
+# This can be used for situations where Dovecot doesn't need to verify the
+# username or the password, or if there is a single password for all users:
+#
+# - proxy frontend, where the backend verifies the password
+# - proxy backend, where the frontend already verified the password
+# - authentication with SSL certificates
+# - simple testing
+
+#passdb {
+# driver = static
+# args = proxy=y host=%1Mu.example.com nopassword=y
+#}
+
+#passdb {
+# driver = static
+# args = password=test
+#}
+
+#userdb {
+# driver = static
+# args = uid=vmail gid=vmail home=/home/%u
+#}
diff --git a/dovecot/conf.d/auth-system.conf.ext b/dovecot/conf.d/auth-system.conf.ext
new file mode 100644
index 00000000..dadb9f7c
--- /dev/null
+++ b/dovecot/conf.d/auth-system.conf.ext
@@ -0,0 +1,74 @@
+# Authentication for system users. Included from 10-auth.conf.
+#
+#
+#
+
+# PAM authentication. Preferred nowadays by most systems.
+# PAM is typically used with either userdb passwd or userdb static.
+# REMEMBER: You'll need /etc/pam.d/dovecot file created for PAM
+# authentication to actually work.
+passdb {
+ driver = pam
+ # [session=yes] [setcred=yes] [failure_show_msg=yes] [max_requests=]
+ # [cache_key=] []
+ #args = dovecot
+}
+
+# System users (NSS, /etc/passwd, or similar).
+# In many systems nowadays this uses Name Service Switch, which is
+# configured in /etc/nsswitch.conf.
+#passdb {
+ #driver = passwd
+ # [blocking=no]
+ #args =
+#}
+
+# Shadow passwords for system users (NSS, /etc/shadow or similar).
+# Deprecated by PAM nowadays.
+#
+#passdb {
+ #driver = shadow
+ # [blocking=no]
+ #args =
+#}
+
+# PAM-like authentication for OpenBSD.
+#
+#passdb {
+ #driver = bsdauth
+ # [blocking=no] [cache_key=]
+ #args =
+#}
+
+##
+## User databases
+##
+
+# System users (NSS, /etc/passwd, or similar). In many systems nowadays this
+# uses Name Service Switch, which is configured in /etc/nsswitch.conf.
+userdb {
+ #
+ driver = passwd
+ # [blocking=no]
+ #args =
+
+ # Override fields from passwd
+ #override_fields = home=/home/virtual/%u
+}
+
+# Static settings generated from template
+#userdb {
+ #driver = static
+ # Can return anything a userdb could normally return. For example:
+ #
+ # args = uid=500 gid=500 home=/var/mail/%u
+ #
+ # LDA and LMTP needs to look up users only from the userdb. This of course
+ # doesn't work with static userdb because there is no list of users.
+ # Normally static userdb handles this by doing a passdb lookup. This works
+ # with most passdbs, with PAM being the most notable exception. If you do
+ # the user verification another way, you can add allow_all_users=yes to
+ # the args in which case the passdb lookup is skipped.
+ #
+ #args =
+#}
diff --git a/dovecot/dovecot-dict-auth.conf.ext b/dovecot/dovecot-dict-auth.conf.ext
new file mode 100644
index 00000000..79f43de6
--- /dev/null
+++ b/dovecot/dovecot-dict-auth.conf.ext
@@ -0,0 +1,54 @@
+# This file is commonly accessed via passdb {} or userdb {} section in
+# conf.d/auth-dict.conf.ext
+
+# Dictionary URI
+#uri =
+
+# Default password scheme
+default_pass_scheme = MD5
+
+# Username iteration prefix. Keys under this are assumed to contain usernames.
+iterate_prefix = userdb/
+
+# Should iteration be disabled for this userdb? If this userdb acts only as a
+# cache there's no reason to try to iterate the (partial & duplicate) users.
+#iterate_disable = no
+
+# The example here shows how to do multiple dict lookups and merge the replies.
+# The "passdb" and "userdb" keys are JSON objects containing key/value pairs,
+# for example: { "uid": 1000, "gid": 1000, "home": "/home/user" }
+
+key passdb {
+ key = passdb/%u
+ format = json
+}
+key userdb {
+ key = userdb/%u
+ format = json
+}
+key quota {
+ key = userdb/%u/quota
+ #format = value
+ # The default_value is used if the key isn't found. If default_value setting
+ # isn't specified at all (even as empty), the passdb/userdb lookup fails with
+ # "user doesn't exist".
+ default_value = 100M
+}
+
+# Space separated list of keys whose values contain key/value paired objects.
+# All the key/value pairs inside the object are added as passdb fields.
+passdb_objects = passdb
+
+#passdb_fields {
+#}
+
+# Userdb key/value object list.
+userdb_objects = userdb
+
+userdb_fields {
+ # dict: refers to key names
+ quota_rule = *:storage=%{dict:quota}
+
+ # dict:. refers to the objkey inside (JSON) object
+ mail = maildir:%{dict:userdb.home}/Maildir
+}
diff --git a/dovecot/dovecot-dict-sql.conf.ext b/dovecot/dovecot-dict-sql.conf.ext
new file mode 100644
index 00000000..a9a903f1
--- /dev/null
+++ b/dovecot/dovecot-dict-sql.conf.ext
@@ -0,0 +1,41 @@
+# This file is commonly accessed via dict {} section in dovecot.conf
+
+#connect = host=localhost dbname=mails user=testuser password=pass
+
+# CREATE TABLE quota (
+# username varchar(100) not null,
+# bytes bigint not null default 0,
+# messages integer not null default 0,
+# primary key (username)
+# );
+
+map {
+ pattern = priv/quota/storage
+ table = quota
+ username_field = username
+ value_field = bytes
+}
+map {
+ pattern = priv/quota/messages
+ table = quota
+ username_field = username
+ value_field = messages
+}
+
+# CREATE TABLE expires (
+# username varchar(100) not null,
+# mailbox varchar(255) not null,
+# expire_stamp integer not null,
+# primary key (username, mailbox)
+# );
+
+map {
+ pattern = shared/expire/$user/$mailbox
+ table = expires
+ value_field = expire_stamp
+
+ fields {
+ username = $user
+ mailbox = $mailbox
+ }
+}
diff --git a/dovecot/dovecot-sql.conf.ext b/dovecot/dovecot-sql.conf.ext
new file mode 100644
index 00000000..8bbcbae6
--- /dev/null
+++ b/dovecot/dovecot-sql.conf.ext
@@ -0,0 +1,144 @@
+# This file is commonly accessed via passdb {} or userdb {} section in
+# conf.d/auth-sql.conf.ext
+
+# This file is opened as root, so it should be owned by root and mode 0600.
+#
+# http://wiki2.dovecot.org/AuthDatabase/SQL
+#
+# For the sql passdb module, you'll need a database with a table that
+# contains fields for at least the username and password. If you want to
+# use the user@domain syntax, you might want to have a separate domain
+# field as well.
+#
+# If your users all have the same uig/gid, and have predictable home
+# directories, you can use the static userdb module to generate the home
+# dir based on the username and domain. In this case, you won't need fields
+# for home, uid, or gid in the database.
+#
+# If you prefer to use the sql userdb module, you'll want to add fields
+# for home, uid, and gid. Here is an example table:
+#
+# CREATE TABLE users (
+# username VARCHAR(128) NOT NULL,
+# domain VARCHAR(128) NOT NULL,
+# password VARCHAR(64) NOT NULL,
+# home VARCHAR(255) NOT NULL,
+# uid INTEGER NOT NULL,
+# gid INTEGER NOT NULL,
+# active CHAR(1) DEFAULT 'Y' NOT NULL
+# );
+
+# Database driver: mysql, pgsql, sqlite
+#driver =
+
+# Database connection string. This is driver-specific setting.
+#
+# HA / round-robin load-balancing is supported by giving multiple host
+# settings, like: host=sql1.host.org host=sql2.host.org
+#
+# pgsql:
+# For available options, see the PostgreSQL documentation for the
+# PQconnectdb function of libpq.
+# Use maxconns=n (default 5) to change how many connections Dovecot can
+# create to pgsql.
+#
+# mysql:
+# Basic options emulate PostgreSQL option names:
+# host, port, user, password, dbname
+#
+# But also adds some new settings:
+# client_flags - See MySQL manual
+# connect_timeout - Connect timeout in seconds (default: 5)
+# read_timeout - Read timeout in seconds (default: 30)
+# write_timeout - Write timeout in seconds (default: 30)
+# ssl_ca, ssl_ca_path - Set either one or both to enable SSL
+# ssl_cert, ssl_key - For sending client-side certificates to server
+# ssl_cipher - Set minimum allowed cipher security (default: HIGH)
+# ssl_verify_server_cert - Verify that the name in the server SSL certificate
+# matches the host (default: no)
+# option_file - Read options from the given file instead of
+# the default my.cnf location
+# option_group - Read options from the given group (default: client)
+#
+# You can connect to UNIX sockets by using host: host=/var/run/mysql.sock
+# Note that currently you can't use spaces in parameters.
+#
+# sqlite:
+# The path to the database file.
+#
+# Examples:
+# connect = host=192.168.1.1 dbname=users
+# connect = host=sql.example.com dbname=virtual user=virtual password=blarg
+# connect = /etc/dovecot/authdb.sqlite
+#
+#connect =
+
+# Default password scheme.
+#
+# List of supported schemes is in
+# http://wiki2.dovecot.org/Authentication/PasswordSchemes
+#
+#default_pass_scheme = MD5
+
+# passdb query to retrieve the password. It can return fields:
+# password - The user's password. This field must be returned.
+# user - user@domain from the database. Needed with case-insensitive lookups.
+# username and domain - An alternative way to represent the "user" field.
+#
+# The "user" field is often necessary with case-insensitive lookups to avoid
+# e.g. "name" and "nAme" logins creating two different mail directories. If
+# your user and domain names are in separate fields, you can return "username"
+# and "domain" fields instead of "user".
+#
+# The query can also return other fields which have a special meaning, see
+# http://wiki2.dovecot.org/PasswordDatabase/ExtraFields
+#
+# Commonly used available substitutions (see http://wiki2.dovecot.org/Variables
+# for full list):
+# %u = entire user@domain
+# %n = user part of user@domain
+# %d = domain part of user@domain
+#
+# Note that these can be used only as input to SQL query. If the query outputs
+# any of these substitutions, they're not touched. Otherwise it would be
+# difficult to have eg. usernames containing '%' characters.
+#
+# Example:
+# password_query = SELECT userid AS user, pw AS password \
+# FROM users WHERE userid = '%u' AND active = 'Y'
+#
+#password_query = \
+# SELECT username, domain, password \
+# FROM users WHERE username = '%n' AND domain = '%d'
+
+# userdb query to retrieve the user information. It can return fields:
+# uid - System UID (overrides mail_uid setting)
+# gid - System GID (overrides mail_gid setting)
+# home - Home directory
+# mail - Mail location (overrides mail_location setting)
+#
+# None of these are strictly required. If you use a single UID and GID, and
+# home or mail directory fits to a template string, you could use userdb static
+# instead. For a list of all fields that can be returned, see
+# http://wiki2.dovecot.org/UserDatabase/ExtraFields
+#
+# Examples:
+# user_query = SELECT home, uid, gid FROM users WHERE userid = '%u'
+# user_query = SELECT dir AS home, user AS uid, group AS gid FROM users where userid = '%u'
+# user_query = SELECT home, 501 AS uid, 501 AS gid FROM users WHERE userid = '%u'
+#
+#user_query = \
+# SELECT home, uid, gid \
+# FROM users WHERE username = '%n' AND domain = '%d'
+
+# If you wish to avoid two SQL lookups (passdb + userdb), you can use
+# userdb prefetch instead of userdb sql in dovecot.conf. In that case you'll
+# also have to return userdb fields in password_query prefixed with "userdb_"
+# string. For example:
+#password_query = \
+# SELECT userid AS user, password, \
+# home AS userdb_home, uid AS userdb_uid, gid AS userdb_gid \
+# FROM users WHERE userid = '%u'
+
+# Query to get a list of all usernames.
+#iterate_query = SELECT username AS user FROM users
diff --git a/dovecot/private/dovecot.key b/dovecot/private/dovecot.key
new file mode 120000
index 00000000..8dd7db92
--- /dev/null
+++ b/dovecot/private/dovecot.key
@@ -0,0 +1 @@
+/etc/ssl/private/ssl-cert-snakeoil.key
\ No newline at end of file
diff --git a/dovecot/private/dovecot.pem b/dovecot/private/dovecot.pem
new file mode 120000
index 00000000..2d292e24
--- /dev/null
+++ b/dovecot/private/dovecot.pem
@@ -0,0 +1 @@
+/etc/ssl/certs/ssl-cert-snakeoil.pem
\ No newline at end of file
diff --git a/dpkg/shlibs.default b/dpkg/shlibs.default
new file mode 100644
index 00000000..661a889d
--- /dev/null
+++ b/dpkg/shlibs.default
@@ -0,0 +1,7 @@
+# dpkg shlibs defaults file
+#
+# This file contains shlibs entries that are used as a last resort when
+# no matching entries are found elsewhere. For more information see the
+# dpkg-shlibdeps(1) manual page.
+#
+#
diff --git a/dpkg/shlibs.override b/dpkg/shlibs.override
new file mode 100644
index 00000000..fbdb68d4
--- /dev/null
+++ b/dpkg/shlibs.override
@@ -0,0 +1,8 @@
+# dpkg shlibs override file
+#
+# Entries in this file will override all others, only use if you
+# are really sure that is what you want!
+#
+# For more information see the dpkg-shlibdeps(1) manual page.
+#
+#
diff --git a/fail2ban/ip.blacklist b/fail2ban/ip.blacklist
index 5cc813d2..5ebca17a 100644
--- a/fail2ban/ip.blacklist
+++ b/fail2ban/ip.blacklist
@@ -4446,3 +4446,4 @@
77.40.45.232,sasl
77.40.96.8,sasl
77.40.105.36,sasl
+188.68.220.121,sshd
diff --git a/group b/group
index 9603aad2..4d07ea14 100644
--- a/group
+++ b/group
@@ -52,3 +52,16 @@ systemd-coredump:x:999:
caelebfi:x:1000:
mysql:x:112:
redis:x:113:
+ssl-cert:x:114:
+ntp:x:115:
+postfix:x:116:
+postdrop:x:117:
+mlocate:x:118:
+_rspamd:x:119:
+clamav:x:120:
+dovecot:x:121:
+dovenull:x:122:
+opendkim:x:123:
+postgrey:x:124:
+amavis:x:125:
+vmail:x:5000:
diff --git a/group- b/group-
index f552f3b5..973e02e6 100644
--- a/group-
+++ b/group-
@@ -51,3 +51,15 @@ ssh:x:111:
systemd-coredump:x:999:
caelebfi:x:1000:
mysql:x:112:
+redis:x:113:
+ssl-cert:x:114:
+ntp:x:115:
+postfix:x:116:
+postdrop:x:117:
+mlocate:x:118:
+_rspamd:x:119:
+clamav:x:120:
+dovecot:x:121:
+dovenull:x:122:
+opendkim:x:123:
+postgrey:x:124:
diff --git a/gshadow b/gshadow
index 06dc0392..4c62b219 100644
--- a/gshadow
+++ b/gshadow
@@ -52,3 +52,15 @@ systemd-coredump:!!::
caelebfi:!::
mysql:!::
redis:!::
+ssl-cert:!::
+ntp:!::
+postfix:!::
+postdrop:!::
+mlocate:!::
+_rspamd:!::
+clamav:!::
+dovecot:!::
+dovenull:!::
+opendkim:!::
+postgrey:!::
+amavis:!::
diff --git a/gshadow- b/gshadow-
index dd79ae64..95a5d399 100644
--- a/gshadow-
+++ b/gshadow-
@@ -51,3 +51,15 @@ ssh:!::
systemd-coredump:!!::
caelebfi:!::
mysql:!::
+redis:!::
+ssl-cert:!::
+ntp:!::
+postfix:!::
+postdrop:!::
+mlocate:!::
+_rspamd:!::
+clamav:!::
+dovecot:!::
+dovenull:!::
+opendkim:!::
+postgrey:!::
diff --git a/init.d/amavis b/init.d/amavis
new file mode 100755
index 00000000..160fd8b8
--- /dev/null
+++ b/init.d/amavis
@@ -0,0 +1,147 @@
+#! /bin/sh
+#
+# amavisd /etc/init.d/ initscript for amavisd-new
+# $Id: amavisd-new.init 800 2006-01-31 00:07:45Z hmh $
+#
+# Copyright (c) 2003 by Brian May
+# and Henrique M. Holschuh
+# Distributed under the GPL version 2
+#
+#
+# How this thing works:
+# ${START} must be only what is needed for start-stop-daemon, DO NOT
+# ADD ANY PARAMETERS HERE! we might use it for --test, for example.
+# ${STOP} works just like ${START}, --signal is used with it.
+#
+# ${PARAMS} are the parameters to give the daemon when really starting
+# it.
+### BEGIN INIT INFO
+# Provides: amavisd-new
+# Required-Start: $syslog $network $local_fs $remote_fs
+# Required-Stop: $syslog $network $local_fs $remote_fs
+# Should-Start:
+# Should-Stop:
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: Starts amavisd-new mailfilter
+# Description: Launches the amavisd-new mailfilter
+### END INIT INFO
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin
+DAEMON=/usr/sbin/amavisd-new
+DAEMON2=/usr/bin/perl
+NAME=amavisd
+DAEMONNAME=amavisd-new
+DESC=amavisd
+PIDFILE=/var/run/amavis/${NAME}.pid
+
+. /lib/lsb/init-functions
+
+test -f ${DAEMON} || exit 0
+
+set -e
+
+START="--start --quiet --pidfile $PIDFILE --startas ${DAEMON} --user amavis"
+STOP="--stop --quiet --pidfile $PIDFILE --user amavis"
+PARAMS=
+
+check_noncompatible_upgrade() {
+ for i in /etc/amavisd.conf /etc/amavis/amavisd.conf ; do
+ if [ -e "${i}.disabled" ] ; then
+ echo "Found incompatible config file flag!" >&2
+ echo "Due to safety concerns, amavisd-new will not be started." >&2
+ echo "Refer to /usr/share/doc/amavisd-new/README.Debian for instructions." >&2
+ exit 1
+ fi
+ done
+}
+
+createdir() {
+# $1 = user
+# $2 = group
+# $3 = permissions (octal)
+# $4 = path to directory
+ [ -d "$4" ] || mkdir -p "$4"
+ chown -c -h "$1:$2" "$4"
+ chmod -c "$3" "$4"
+}
+
+fixdirs() {
+ dir=$(dpkg-statoverride --list /var/run/amavis) || {
+ echo "You are missing a dpkg-statoverride on /var/run/amavis. Fix it, otherwise you risk silent breakage on upgrades." >&2
+ exit 1
+ }
+ [ -z "$dir" ] || createdir $dir
+ :
+}
+
+cleanup() {
+ [ -d /var/lib/amavis ] &&
+ find /var/lib/amavis -maxdepth 1 -name 'amavis-*' -type d \
+ -exec rm -rf "{}" \; >/dev/null 2>&1 || true
+ [ -d /var/lib/amavis/tmp ] &&
+ find /var/lib/amavis/tmp -maxdepth 1 -name 'amavis-*' -type d \
+ -exec rm -rf "{}" \; >/dev/null 2>&1 || true
+ :
+}
+
+case "$1" in
+ start)
+ echo -n "Starting $DESC: "
+ fixdirs
+ check_noncompatible_upgrade
+ export LC_ALL; LC_ALL=C
+ if start-stop-daemon ${START} -- ${PARAMS} start >/dev/null ; then
+ echo "amavisd-new."
+ else
+ if start-stop-daemon --test ${START} >/dev/null 2>&1; then
+ echo "(failed)."
+ exit 1
+ else
+ echo "(already running)."
+ exit 0
+ fi
+ fi
+ ;;
+ stop)
+ echo -n "Stopping $DESC: "
+ if start-stop-daemon ${STOP} --retry 10 >/dev/null ; then
+ cleanup
+ echo "amavisd-new."
+ else
+ if start-stop-daemon --test ${START} >/dev/null 2>&1; then
+ echo "(not running)."
+ exit 0
+ else
+ echo "(failed)."
+ exit 1
+ fi
+ fi
+ ;;
+# reload)
+# echo "Reloading $DESC configuration files."
+# start-stop-daemon ${STOP} --signal 1
+# ;;
+ restart|force-reload)
+ $0 stop
+ exec $0 start
+ ;;
+ debug|debug-sa)
+ mode="$1"
+ echo "Trying to run amavisd-new in ${mode} mode..."
+ fixdirs
+ check_noncompatible_upgrade
+ exec ${DAEMON} ${PARAMS} "${mode}"
+ ;;
+ status)
+ status_of_proc -p $PIDFILE $DAEMON $NAME && exit 0 || exit $?
+ ;;
+ *)
+ N=/etc/init.d/amavis
+ #echo "Usage: $N {start|stop|restart|reload|force-reload|debug}" >&2
+ echo "Usage: $N {start|stop|restart|force-reload|status|debug}" >&2
+ exit 1
+ ;;
+esac
+
+exit 0
diff --git a/init.d/amavis-mc b/init.d/amavis-mc
new file mode 100755
index 00000000..18592c03
--- /dev/null
+++ b/init.d/amavis-mc
@@ -0,0 +1,164 @@
+#! /bin/sh
+### BEGIN INIT INFO
+# Provides: amavis-mc
+# Required-Start: $remote_fs $syslog amavisd-new
+# Should-Start:
+# Should-Stop:
+# Required-Stop: $remote_fs $syslog
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: Startup script for amavis master supervisor
+# Description: This script starts the amavis supervisor for amavis
+# service processes.
+### END INIT INFO
+
+# Do NOT "set -e"
+
+PATH=/sbin:/usr/sbin:/bin:/usr/bin
+DESC="amavis services supervisor"
+NAME=amavis-mc
+DAEMON=/usr/sbin/$NAME
+DAEMON_ARGS="-P /var/run/amavis/$NAME.pid"
+PIDFILE=/var/run/amavis/$NAME.pid
+SCRIPTNAME=/etc/init.d/$NAME
+
+# Exit if the package is not installed
+[ -x "$DAEMON" ] || exit 0
+
+# Read configuration variable file if it is present
+[ -r /etc/default/$NAME ] && . /etc/default/$NAME
+
+# Load the VERBOSE setting and other rcS variables
+. /lib/init/vars.sh
+
+# Define LSB log_* functions.
+# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
+# and status_of_proc is working.
+. /lib/lsb/init-functions
+
+#
+# Function that starts the daemon/service
+#
+do_start()
+{
+ # Return
+ # 0 if daemon has been started
+ # 1 if daemon was already running
+ # 2 if daemon could not be started
+ if [ -e $PIDFILE ]
+ then
+ if [ -d /proc/`cat $PIDFILE`/ ]
+ then
+ echo "$NAME (${AGENT_BACKEND} version) already running."
+ exit 0;
+ else
+ rm -f $PIDFILE
+ fi
+ fi
+ export LC_ALL; LC_ALL=C
+ start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --user amavis -- \
+ $DAEMON_ARGS \
+ || return 2
+ # Add code here, if necessary, that waits for the process to be ready
+ # to handle requests from services started subsequently which depend
+ # on this one. As a last resort, sleep for some time.
+}
+
+#
+# Function that stops the daemon/service
+#
+do_stop()
+{
+ # Return
+ # 0 if daemon has been stopped
+ # 1 if daemon was already stopped
+ # 2 if daemon could not be stopped
+ # other if a failure occurred
+ start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --user amavis
+ RETVAL="$?"
+ [ "$RETVAL" = 2 ] && return 2
+ # Wait for children to finish too if this is a daemon that forks
+ # and if the daemon is only ever run from this initscript.
+ # If the above conditions are not satisfied then add some other code
+ # that waits for the process to drop all resources that could be
+ # needed by services started subsequently. A last resort is to
+ # sleep for some time.
+ start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --pidfile $PIDFILE --user amavis
+ [ "$?" = 2 ] && return 2
+ # Many daemons don't delete their pidfiles when they exit.
+ rm -f $PIDFILE
+ return "$RETVAL"
+}
+
+#
+# Function that sends a SIGHUP to the daemon/service
+#
+do_reload() {
+ #
+ # If the daemon can reload its configuration without
+ # restarting (for example, when it is sent a SIGHUP),
+ # then implement that here.
+ #
+ start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME --user amavis
+ return 0
+}
+
+case "$1" in
+ start)
+ [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC ($AGENT_BACKEND version)" "$NAME"
+ do_start
+ case "$?" in
+ 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+ 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
+ ;;
+ stop)
+ [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC ($AGENT_BACKEND version)" "$NAME"
+ do_stop
+ case "$?" in
+ 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+ 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
+ ;;
+ status)
+ status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
+ ;;
+ #reload|force-reload)
+ #
+ # If do_reload() is not implemented then leave this commented out
+ # and leave 'force-reload' as an alias for 'restart'.
+ #
+ #log_daemon_msg "Reloading $DESC" "$NAME"
+ #do_reload
+ #log_end_msg $?
+ #;;
+ restart|force-reload)
+ #
+ # If the "reload" option is implemented then remove the
+ # 'force-reload' alias
+ #
+ log_daemon_msg "Restarting $DESC ($AGENT_BACKEND version)" "$NAME"
+ do_stop
+ case "$?" in
+ 0|1)
+ do_start
+ case "$?" in
+ 0) log_end_msg 0 ;;
+ 1) log_end_msg 1 ;; # Old process is still running
+ *) log_end_msg 1 ;; # Failed to start
+ esac
+ ;;
+ *)
+ # Failed to stop
+ log_end_msg 1
+ ;;
+ esac
+ ;;
+ *)
+ #echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
+ echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
+ exit 3
+ ;;
+esac
+
+:
diff --git a/init.d/amavisd-snmp-subagent b/init.d/amavisd-snmp-subagent
new file mode 100755
index 00000000..588655a2
--- /dev/null
+++ b/init.d/amavisd-snmp-subagent
@@ -0,0 +1,173 @@
+#! /bin/sh
+### BEGIN INIT INFO
+# Provides: amavis-snmp-subagent
+# Required-Start: $remote_fs $syslog amavisd-new
+# Should-Start: snmpd amavis-mc
+# Should-Stop: snmpd
+# Required-Stop: $remote_fs $syslog
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: Startup script for amavis snmp subagent
+# Description: This script starts the daemon used to connect amavis with the
+# snmpd daemon
+### END INIT INFO
+
+# Do NOT "set -e"
+
+PATH=/sbin:/usr/sbin:/bin:/usr/bin
+DESC="amavis snmp subagent"
+NAME=amavisd-snmp-subagent
+DAEMON=/usr/sbin/$NAME
+DAEMON_ARGS="-P /var/run/$NAME.pid"
+PIDFILE=/var/run/$NAME.pid
+SCRIPTNAME=/etc/init.d/$NAME
+AGENT_BACKEND="bdb"
+
+# Exit if the package is not installed
+[ -x "$DAEMON" ] || exit 0
+
+# Read configuration variable file if it is present
+[ -r /etc/default/$NAME ] && . /etc/default/$NAME
+
+case "$AGENT_BACKEND" in
+ bdb)
+ DAEMON=/usr/sbin/amavisd-snmp-subagent
+ ;;
+ zeromq)
+ DAEMON=/usr/sbin/amavisd-snmp-subagent-zmq
+ ;;
+esac
+
+# Load the VERBOSE setting and other rcS variables
+. /lib/init/vars.sh
+
+# Define LSB log_* functions.
+# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
+# and status_of_proc is working.
+. /lib/lsb/init-functions
+
+#
+# Function that starts the daemon/service
+#
+do_start()
+{
+ # Return
+ # 0 if daemon has been started
+ # 1 if daemon was already running
+ # 2 if daemon could not be started
+ if [ -e $PIDFILE ]
+ then
+ if [ -d /proc/`cat $PIDFILE`/ ]
+ then
+ echo "$NAME (${AGENT_BACKEND} version) already running."
+ exit 0;
+ else
+ rm -f $PIDFILE
+ fi
+ fi
+ start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --user amavis -- \
+ $DAEMON_ARGS \
+ || return 2
+ # Add code here, if necessary, that waits for the process to be ready
+ # to handle requests from services started subsequently which depend
+ # on this one. As a last resort, sleep for some time.
+}
+
+#
+# Function that stops the daemon/service
+#
+do_stop()
+{
+ # Return
+ # 0 if daemon has been stopped
+ # 1 if daemon was already stopped
+ # 2 if daemon could not be stopped
+ # other if a failure occurred
+ start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --user amavis
+ RETVAL="$?"
+ [ "$RETVAL" = 2 ] && return 2
+ # Wait for children to finish too if this is a daemon that forks
+ # and if the daemon is only ever run from this initscript.
+ # If the above conditions are not satisfied then add some other code
+ # that waits for the process to drop all resources that could be
+ # needed by services started subsequently. A last resort is to
+ # sleep for some time.
+ start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --pidfile $PIDFILE --user amavis
+ [ "$?" = 2 ] && return 2
+ # Many daemons don't delete their pidfiles when they exit.
+ rm -f $PIDFILE
+ return "$RETVAL"
+}
+
+#
+# Function that sends a SIGHUP to the daemon/service
+#
+do_reload() {
+ #
+ # If the daemon can reload its configuration without
+ # restarting (for example, when it is sent a SIGHUP),
+ # then implement that here.
+ #
+ start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME --user amavis
+ return 0
+}
+
+case "$1" in
+ start)
+ [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC ($AGENT_BACKEND version)" "$NAME"
+ do_start
+ case "$?" in
+ 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+ 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
+ ;;
+ stop)
+ [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC ($AGENT_BACKEND version)" "$NAME"
+ do_stop
+ case "$?" in
+ 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+ 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
+ ;;
+ status)
+ status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
+ ;;
+ #reload|force-reload)
+ #
+ # If do_reload() is not implemented then leave this commented out
+ # and leave 'force-reload' as an alias for 'restart'.
+ #
+ #log_daemon_msg "Reloading $DESC" "$NAME"
+ #do_reload
+ #log_end_msg $?
+ #;;
+ restart|force-reload)
+ #
+ # If the "reload" option is implemented then remove the
+ # 'force-reload' alias
+ #
+ log_daemon_msg "Restarting $DESC ($AGENT_BACKEND version)" "$NAME"
+ do_stop
+ case "$?" in
+ 0|1)
+ do_start
+ case "$?" in
+ 0) log_end_msg 0 ;;
+ 1) log_end_msg 1 ;; # Old process is still running
+ *) log_end_msg 1 ;; # Failed to start
+ esac
+ ;;
+ *)
+ # Failed to stop
+ log_end_msg 1
+ ;;
+ esac
+ ;;
+ *)
+ #echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
+ echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
+ exit 3
+ ;;
+esac
+
+:
diff --git a/init.d/clamav-daemon b/init.d/clamav-daemon
new file mode 100755
index 00000000..9d5d617c
--- /dev/null
+++ b/init.d/clamav-daemon
@@ -0,0 +1,415 @@
+#! /bin/sh
+# Written by Miquel van Smoorenburg .
+# Modified for Debian GNU/Linux
+# by Ian Murdock .
+# Clamav version by Magnus Ekdahl
+# Heavily reworked by Stephen Gran
+#
+### BEGIN INIT INFO
+# Provides: clamav-daemon
+# Required-Start: $remote_fs $syslog
+# Should-Start:
+# Required-Stop: $remote_fs $syslog
+# Should-Stop:
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: ClamAV daemon
+# Description: Clam AntiVirus userspace daemon
+### END INIT INFO
+
+# The exit status codes should comply with LSB.
+# https://refspecs.linuxfoundation.org/LSB_4.1.0/LSB-Core-generic/LSB-Core-generic/iniscrptact.html
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin
+DAEMON=/usr/sbin/clamd
+NAME="clamd"
+DESC="ClamAV daemon"
+CLAMAVCONF=/etc/clamav/clamd.conf
+SUPERVISOR=/usr/bin/daemon
+SUPERVISORNAME=daemon
+SUPERVISORPIDFILE="/var/run/clamav/daemon-clamd.pid"
+SUPERVISORARGS="--name=$NAME --respawn $DAEMON -F $SUPERVISORPIDFILE"
+DATABASEDIR="/var/lib/clamav"
+
+# required by Debian policy 9.3.2
+[ -x "$DAEMON" ] || exit 0
+[ -r /etc/default/clamav-daemon ] && . /etc/default/clamav-daemon
+
+to_lower()
+{
+ word="$1"
+ lcword=$(echo "$word" | tr A-Z a-z)
+ echo "$lcword"
+}
+
+is_true()
+{
+ var="$1"
+ lcvar=$(to_lower "$var")
+ [ 'true' = "$lcvar" ] || [ 'yes' = "$lcvar" ] || [ 1 = "$lcvar" ]
+ return $?
+}
+
+is_false()
+{
+ var="$1"
+ lcvar=$(to_lower "$var")
+ [ 'false' = "$lcvar" ] || [ 'no' = "$lcvar" ] || [ 0 = "$lcvar" ]
+ return $?
+}
+
+ucf_cleanup()
+{
+ # This only does something if I've fucked up before
+ # Not entirely impossible :(
+
+ configfile=$1
+
+ if [ `grep "$configfile" /var/lib/ucf/hashfile | wc -l` -gt 1 ]; then
+ grep -v "$configfile" /var/lib/ucf/hashfile > /var/lib/ucf/hashfile.tmp
+ grep "$configfile" /var/lib/ucf/hashfile | tail -n 1 >> /var/lib/ucf/hashfile.tmp
+ mv /var/lib/ucf/hashfile.tmp /var/lib/ucf/hashfile
+ fi
+}
+
+add_to_ucf()
+{
+ configfile=$1
+ ucffile=$2
+
+ if ! grep -q "$configfile" /var/lib/ucf/hashfile; then
+ md5sum $configfile >> /var/lib/ucf/hashfile
+ cp $configfile $ucffile
+ fi
+}
+
+ucf_upgrade_check()
+{
+ configfile=$1
+ sourcefile=$2
+ ucffile=$3
+
+ if [ -f "$configfile" ]; then
+ add_to_ucf $configfile $ucffile
+ ucf --three-way --debconf-ok "$sourcefile" "$configfile"
+ else
+ [ -d /var/lib/ucf/cache ] || mkdir -p /var/lib/ucf/cache
+ pathfind restorecon && restorecon /var/lib/ucf/cache
+ cp $sourcefile $configfile
+ add_to_ucf $configfile $ucffile
+ fi
+}
+
+slurp_config()
+{
+ CLAMAVCONF="$1"
+
+ if [ -e "$CLAMAVCONF" ]; then
+ for variable in `egrep -a -v '^[[:space:]]*(#|$)' "$CLAMAVCONF" | awk '{print $1}'`; do
+ case "$variable" in
+ DatabaseMirror)
+ if [ -z "$DatabaseMirror" ]; then
+ for i in `grep -a ^$variable $CLAMAVCONF | awk '{print $2}'`; do
+ value="$value $i"
+ done
+ else
+ continue
+ fi
+ ;;
+ DatabaseCustomURL)
+ if [ -z "$DatabaseCustomURL" ]; then
+ for i in `grep -a ^$variable $CLAMAVCONF | awk '{print $2}'`; do
+ value="$value $i"
+ done
+ else
+ continue
+ fi
+ ;;
+ IncludePUA)
+ if [ -z "$IncludePUA" ]; then
+ for i in `grep -a ^$variable $CLAMAVCONF | awk '{print $2}'`; do
+ value="$i $value"
+ done
+ else
+ continue
+ fi
+ ;;
+ ExcludePUA)
+ if [ -z "$ExcludePUA" ]; then
+ for i in `grep -a ^$variable $CLAMAVCONF | awk '{print $2}'`; do
+ value="$i $value"
+ done
+ else
+ continue
+ fi
+ ;;
+ ExtraDatabase)
+ if [ -z "$ExtraDatabase" ]; then
+ for i in `grep -a ^$variable $CLAMAVCONF | awk '{print $2}'`; do
+ value="$value $i"
+ done
+ else
+ continue
+ fi
+ ;;
+ VirusEvent|OnUpdateExecute|OnErrorExecute|RejectMsg)
+ value=`grep -a ^$variable $CLAMAVCONF | head -n1 | sed -e s/$variable\ //`
+ ;;
+ *)
+ value=`grep -a "^$variable[[:space:]]" $CLAMAVCONF | head -n1 | awk '{print $2}'`
+ ;;
+ esac
+ if [ -z "$value" ]; then
+ export "$variable"="true"
+ elif [ "$value" != "$variable" ]; then
+ export "$variable"="$value"
+ else
+ export "$variable"="true"
+ fi
+ unset value
+ done
+ fi
+}
+
+pathfind() {
+ OLDIFS="$IFS"
+ IFS=:
+ for p in $PATH; do
+ if [ -x "$p/$*" ]; then
+ IFS="$OLDIFS"
+ return 0
+ fi
+ done
+ IFS="$OLDIFS"
+ return 1
+}
+
+set_debconf_value()
+{
+prog=$1
+name=$2
+eval variable="\$${name}"
+if [ -n "$variable" ]; then
+ db_set clamav-$prog/$name "$variable" || true
+fi
+}
+
+make_dir()
+{
+ DIR=$1
+ if [ -d "$DIR" ]; then
+ return 0;
+ fi
+ [ -n "$User" ] || User=clamav
+ mkdir -p -m 0755 "$DIR"
+ chown "$User" "$DIR"
+ pathfind restorecon && restorecon "$DIR"
+}
+
+# Debconf Functions
+
+isdigit ()
+{
+ case $1 in
+ [[:digit:]]*)
+ ISDIGIT=1
+ ;;
+ *)
+ ISDIGIT=0
+ ;;
+ esac
+}
+
+inputdigit ()
+{
+ ISDIGIT=0
+ while [ "$ISDIGIT" = '0' ]; do
+ db_input "$1" "$2" || true
+ if ! db_go; then
+ return 30
+ fi
+ db_get $2 || true
+ isdigit $RET
+ if [ "$ISDIGIT" = '0' ]; then
+ db_input critical clamav-base/numinfo || true
+ db_go
+ fi
+ done
+ return 0
+}
+
+StateGeneric()
+{
+ PRIO=$1
+ QUESTION=$2
+ NEXT=$3
+ LAST=$4
+
+ db_input $PRIO $QUESTION || true
+ if db_go; then
+ STATE=$NEXT
+ else
+ STATE=$LAST
+ fi
+}
+
+StateGenericDigit()
+{
+ PRIO=$1
+ QUESTION=$2
+ NEXT=$3
+ LAST=$4
+
+ inputdigit $PRIO $QUESTION || true
+ if db_go; then
+ STATE=$NEXT
+ else
+ STATE=$LAST
+ fi
+}
+
+
+. /lib/lsb/init-functions
+
+if [ ! -f "$CLAMAVCONF" ]; then
+ log_failure_msg "There is no configuration file for Clamav."
+ log_failure_msg "Please either dpkg-reconfigure $DESC, or copy the example from"
+ log_failure_msg "/usr/share/doc/clamav-base/examples/ to $CLAMAVCONF and run"
+ log_failure_msg "'invoke-rc.d clamav-daemon start'"
+ if [ "$1" = "status" ]; then
+ # program or service status is unknown
+ exit 4;
+ else
+ # program is not configured
+ exit 6;
+ fi
+fi
+
+slurp_config "$CLAMAVCONF"
+
+if [ -n "$Example" ]; then
+ log_failure_msg "Clamav is not configured."
+ log_failure_msg "Please edit $CLAMAVCONF and run 'invoke-rc.d clamav-daemon start'"
+ if [ "$1" = "status" ]; then
+ # program or service status is unknown
+ exit 4;
+ else
+ # program is not configured
+ exit 6;
+ fi
+fi
+
+if is_true "$Foreground"; then
+ if [ ! -x "$SUPERVISOR" ] ; then
+ log_failure_msg "Foreground specified, but $SUPERVISORNAME not found"
+ if [ "$1" = "status" ]; then
+ # program or service status is unknown
+ exit 4;
+ else
+ # program is not configured correctly
+ exit 6;
+ fi
+ else
+ RUN_SUPERVISED=1
+ fi
+fi
+
+[ -n "$User" ] || User=clamav
+[ -n "$DataBaseDirectory" ] || DataBaseDirectory=/var/run/clamav
+
+make_dir "$DataBaseDirectory"
+make_dir $(dirname "$SUPERVISORPIDFILE")
+
+if [ -z "$RUN_SUPERVISED" ]; then
+ THEPIDFILE="$PidFile"
+ THEDAEMON="$NAME"
+ RELOAD="1"
+else
+ THEPIDFILE="$SUPERVISORPIDFILE"
+ THEDAEMON="$SUPERVISORNAME"
+ RELOAD="0"
+fi
+
+if [ -z "$THEPIDFILE" ]
+then
+ # Set the default PidFile.
+ THEPIDFILE='/run/clamav/clamd.pid'
+fi
+
+make_dir $(dirname "$THEPIDFILE")
+chown $User $(dirname "$THEPIDFILE")
+
+
+case "$1" in
+ start)
+ # Check for database existence (start will fail if it's missing)
+ for db in main daily; do
+ if [ ! -e "$DATABASEDIR"/"$db".cvd ] && [ ! -d "$DATABASEDIR"/"$db".inc ] && [ ! -e "$DATABASEDIR"/"$db".cld ]; then
+ log_failure_msg "Clamav signatures not found in $DATABASEDIR"
+ log_failure_msg "Please retrieve them using freshclam"
+ log_failure_msg "Then run 'invoke-rc.d clamav-daemon start'"
+ # this is expected on a fresh installation
+ exit 0
+ fi
+ done
+ if [ -z "$RUN_SUPERVISED" ] ; then
+ log_daemon_msg "Starting $DESC" "$NAME "
+ start-stop-daemon --start --oknodo -c $User --exec $DAEMON --pidfile $THEPIDFILE --quiet -- -c $CLAMAVCONF --pid=$THEPIDFILE
+ ret=$?
+ else
+ log_daemon_msg "Starting $DESC" "$NAME (supervised) "
+ $SUPERVISOR $SUPERVISORARGS
+ ret=$?
+ fi
+ log_end_msg $ret
+ ;;
+ stop)
+ log_daemon_msg "Stopping $DESC" "$NAME"
+ start-stop-daemon --stop --oknodo --name $THEDAEMON --pidfile $THEPIDFILE --quiet --retry TERM/30/KILL/5
+ log_end_msg $?
+ ;;
+ status)
+ start-stop-daemon --status --name $THEDAEMON --pidfile $THEPIDFILE
+ # start-stop-daemon returns LSB compliant exit status codes
+ ret=$?
+ if [ "$ret" = 0 ]; then
+ log_success_msg "$NAME is running"
+ else
+ log_failure_msg "$NAME is not running"
+ exit "$ret"
+ fi
+ ;;
+ restart|force-reload)
+ $0 stop
+ $0 start
+ ;;
+ reload-database)
+ if [ "$RELOAD" = "1" ]; then
+ log_daemon_msg "Reloading database for $DESC" "$NAME"
+ pkill -USR2 -F $THEPIDFILE $THEDAEMON 2>/dev/null
+ log_end_msg $?
+ else
+ log_failure_msg "reload-database does not work in supervised mode."
+ # unimplemented feature
+ exit 3
+ fi
+ ;;
+ reload-log)
+ if [ "$RELOAD" = "1" ]; then
+ log_daemon_msg "Reloading log file for $DESC" "$NAME"
+ pkill -HUP -F $THEPIDFILE $THEDAEMON 2>/dev/null
+ else
+ log_failure_msg "reload-log does not work in supervised mode."
+ # unimplemented feature
+ exit 3
+ fi
+ log_end_msg $?
+ ;;
+ *)
+ log_action_msg "Usage: $0 {start|stop|restart|force-reload|reload-log|reload-database|status}" >&2
+ # invalid arguments
+ exit 2
+ ;;
+esac
+
+exit 0
diff --git a/init.d/clamav-freshclam b/init.d/clamav-freshclam
new file mode 100755
index 00000000..4dcc4b34
--- /dev/null
+++ b/init.d/clamav-freshclam
@@ -0,0 +1,343 @@
+#!/bin/sh
+
+### BEGIN INIT INFO
+# Provides: clamav-freshclam
+# Required-Start: $remote_fs $syslog
+# Should-Start: clamav-daemon
+# Required-Stop: $remote_fs $syslog
+# Should-Stop:
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: ClamAV virus database updater
+# Description: Clam AntiVirus virus database updater
+### END INIT INFO
+
+# The exit status codes should comply with LSB.
+# https://refspecs.linuxfoundation.org/LSB_4.1.0/LSB-Core-generic/LSB-Core-generic/iniscrptact.html
+
+DAEMON=/usr/bin/freshclam
+NAME=freshclam
+DESC="ClamAV virus database updater"
+
+# required by Debian policy 9.3.2
+[ -x $DAEMON ] || exit 0
+
+CLAMAV_CONF_FILE=/etc/clamav/clamd.conf
+FRESHCLAM_CONF_FILE=/etc/clamav/freshclam.conf
+
+to_lower()
+{
+ word="$1"
+ lcword=$(echo "$word" | tr A-Z a-z)
+ echo "$lcword"
+}
+
+is_true()
+{
+ var="$1"
+ lcvar=$(to_lower "$var")
+ [ 'true' = "$lcvar" ] || [ 'yes' = "$lcvar" ] || [ 1 = "$lcvar" ]
+ return $?
+}
+
+is_false()
+{
+ var="$1"
+ lcvar=$(to_lower "$var")
+ [ 'false' = "$lcvar" ] || [ 'no' = "$lcvar" ] || [ 0 = "$lcvar" ]
+ return $?
+}
+
+ucf_cleanup()
+{
+ # This only does something if I've fucked up before
+ # Not entirely impossible :(
+
+ configfile=$1
+
+ if [ `grep "$configfile" /var/lib/ucf/hashfile | wc -l` -gt 1 ]; then
+ grep -v "$configfile" /var/lib/ucf/hashfile > /var/lib/ucf/hashfile.tmp
+ grep "$configfile" /var/lib/ucf/hashfile | tail -n 1 >> /var/lib/ucf/hashfile.tmp
+ mv /var/lib/ucf/hashfile.tmp /var/lib/ucf/hashfile
+ fi
+}
+
+add_to_ucf()
+{
+ configfile=$1
+ ucffile=$2
+
+ if ! grep -q "$configfile" /var/lib/ucf/hashfile; then
+ md5sum $configfile >> /var/lib/ucf/hashfile
+ cp $configfile $ucffile
+ fi
+}
+
+ucf_upgrade_check()
+{
+ configfile=$1
+ sourcefile=$2
+ ucffile=$3
+
+ if [ -f "$configfile" ]; then
+ add_to_ucf $configfile $ucffile
+ ucf --three-way --debconf-ok "$sourcefile" "$configfile"
+ else
+ [ -d /var/lib/ucf/cache ] || mkdir -p /var/lib/ucf/cache
+ pathfind restorecon && restorecon /var/lib/ucf/cache
+ cp $sourcefile $configfile
+ add_to_ucf $configfile $ucffile
+ fi
+}
+
+slurp_config()
+{
+ CLAMAVCONF="$1"
+
+ if [ -e "$CLAMAVCONF" ]; then
+ for variable in `egrep -a -v '^[[:space:]]*(#|$)' "$CLAMAVCONF" | awk '{print $1}'`; do
+ case "$variable" in
+ DatabaseMirror)
+ if [ -z "$DatabaseMirror" ]; then
+ for i in `grep -a ^$variable $CLAMAVCONF | awk '{print $2}'`; do
+ value="$value $i"
+ done
+ else
+ continue
+ fi
+ ;;
+ DatabaseCustomURL)
+ if [ -z "$DatabaseCustomURL" ]; then
+ for i in `grep -a ^$variable $CLAMAVCONF | awk '{print $2}'`; do
+ value="$value $i"
+ done
+ else
+ continue
+ fi
+ ;;
+ IncludePUA)
+ if [ -z "$IncludePUA" ]; then
+ for i in `grep -a ^$variable $CLAMAVCONF | awk '{print $2}'`; do
+ value="$i $value"
+ done
+ else
+ continue
+ fi
+ ;;
+ ExcludePUA)
+ if [ -z "$ExcludePUA" ]; then
+ for i in `grep -a ^$variable $CLAMAVCONF | awk '{print $2}'`; do
+ value="$i $value"
+ done
+ else
+ continue
+ fi
+ ;;
+ ExtraDatabase)
+ if [ -z "$ExtraDatabase" ]; then
+ for i in `grep -a ^$variable $CLAMAVCONF | awk '{print $2}'`; do
+ value="$value $i"
+ done
+ else
+ continue
+ fi
+ ;;
+ VirusEvent|OnUpdateExecute|OnErrorExecute|RejectMsg)
+ value=`grep -a ^$variable $CLAMAVCONF | head -n1 | sed -e s/$variable\ //`
+ ;;
+ *)
+ value=`grep -a "^$variable[[:space:]]" $CLAMAVCONF | head -n1 | awk '{print $2}'`
+ ;;
+ esac
+ if [ -z "$value" ]; then
+ export "$variable"="true"
+ elif [ "$value" != "$variable" ]; then
+ export "$variable"="$value"
+ else
+ export "$variable"="true"
+ fi
+ unset value
+ done
+ fi
+}
+
+pathfind() {
+ OLDIFS="$IFS"
+ IFS=:
+ for p in $PATH; do
+ if [ -x "$p/$*" ]; then
+ IFS="$OLDIFS"
+ return 0
+ fi
+ done
+ IFS="$OLDIFS"
+ return 1
+}
+
+set_debconf_value()
+{
+prog=$1
+name=$2
+eval variable="\$${name}"
+if [ -n "$variable" ]; then
+ db_set clamav-$prog/$name "$variable" || true
+fi
+}
+
+make_dir()
+{
+ DIR=$1
+ if [ -d "$DIR" ]; then
+ return 0;
+ fi
+ [ -n "$User" ] || User=clamav
+ mkdir -p -m 0755 "$DIR"
+ chown "$User" "$DIR"
+ pathfind restorecon && restorecon "$DIR"
+}
+
+# Debconf Functions
+
+isdigit ()
+{
+ case $1 in
+ [[:digit:]]*)
+ ISDIGIT=1
+ ;;
+ *)
+ ISDIGIT=0
+ ;;
+ esac
+}
+
+inputdigit ()
+{
+ ISDIGIT=0
+ while [ "$ISDIGIT" = '0' ]; do
+ db_input "$1" "$2" || true
+ if ! db_go; then
+ return 30
+ fi
+ db_get $2 || true
+ isdigit $RET
+ if [ "$ISDIGIT" = '0' ]; then
+ db_input critical clamav-base/numinfo || true
+ db_go
+ fi
+ done
+ return 0
+}
+
+StateGeneric()
+{
+ PRIO=$1
+ QUESTION=$2
+ NEXT=$3
+ LAST=$4
+
+ db_input $PRIO $QUESTION || true
+ if db_go; then
+ STATE=$NEXT
+ else
+ STATE=$LAST
+ fi
+}
+
+StateGenericDigit()
+{
+ PRIO=$1
+ QUESTION=$2
+ NEXT=$3
+ LAST=$4
+
+ inputdigit $PRIO $QUESTION || true
+ if db_go; then
+ STATE=$NEXT
+ else
+ STATE=$LAST
+ fi
+}
+
+
+. /lib/lsb/init-functions
+
+slurp_config "$FRESHCLAM_CONF_FILE"
+
+if [ -z "$PidFile" ]
+then
+ # Set the default PidFile.
+ PidFile='/run/clamav/freshclam.pid'
+fi
+[ -n "$DataBaseDirectory" ] || DataBaseDirectory=/var/run/clamav
+
+make_dir "$DataBaseDirectory"
+make_dir $(dirname "$PidFile")
+
+[ -z "$UpdateLogFile" ] && UpdateLogFile=/var/log/clamav/freshclam.log
+[ -z "$DatabaseDirectory" ] && DatabaseDirectory=/var/lib/clamav/
+[ -n "$DatabaseOwner" ] || DatabaseOwner=clamav
+
+case "$1" in
+ no-daemon)
+ su "$DatabaseOwner" -p -s /bin/sh -c "freshclam -l $UpdateLogFile --datadir $DatabaseDirectory"
+ ;;
+ start)
+ if [ ! -f "$PidFile" ]; then
+ # If clamd is run under a different UID than freshclam then we need
+ # to make sure the PidFile can be written or else we won't be able to
+ # kill it.
+ touch $PidFile
+ chown $DatabaseOwner $PidFile
+ fi
+ # If user wants it run from cron, we only accept no-daemon and stop
+ if [ -f /etc/cron.d/clamav-freshclam ]; then
+ log_warning_msg "Not starting $NAME - cron option selected"
+ log_warning_msg "Run the init script with the 'no-daemon' option"
+ # this is similar to the daemon already running
+ exit 0
+ fi
+ log_daemon_msg "Starting $DESC" "$NAME"
+ start-stop-daemon --start --oknodo -c "$DatabaseOwner" --exec $DAEMON --pidfile $PidFile --quiet -- -d --quiet --config-file=$FRESHCLAM_CONF_FILE --pid=$PidFile
+ log_end_msg $?
+ ;;
+ stop)
+ log_daemon_msg "Stopping $DESC" "$NAME"
+ start-stop-daemon --stop --oknodo --name $NAME --pidfile $PidFile --quiet --retry TERM/30/KILL/5
+ log_end_msg $?
+ ;;
+ restart|force-reload)
+ $0 stop
+ $0 start
+ ;;
+ reload-log)
+ # If user wants it run from cron, we only accept no-daemon and stop
+ if [ -f /etc/cron.d/clamav-freshclam ]; then
+ log_warning_msg "Not reloading log for $NAME - cron option selected"
+ # log-reloading is not needed, because freshclam is not run as daemon
+ exit 0
+ fi
+ log_daemon_msg "Reloading $DESC" "$NAME"
+ pkill -HUP -F $PidFile $NAME
+ log_end_msg $?
+ ;;
+ skip)
+ ;;
+ status)
+ start-stop-daemon --status --name $NAME --pidfile $PidFile
+ ret="$?"
+ if [ "$ret" = 0 ]; then
+ log_success_msg "$NAME is running"
+ exit 0
+ else
+ log_failure_msg "$NAME is not running"
+ exit "$ret"
+ fi
+ ;;
+ *)
+ log_action_msg "Usage: $0 {no-daemon|start|stop|restart|force-reload|reload-log|skip|status}" >&2
+ # invalid arguments
+ exit 2
+ ;;
+esac
+
+exit 0
diff --git a/init.d/dovecot b/init.d/dovecot
new file mode 100755
index 00000000..730c3235
--- /dev/null
+++ b/init.d/dovecot
@@ -0,0 +1,185 @@
+#! /bin/sh
+### BEGIN INIT INFO
+# Provides: dovecot
+# Required-Start: $local_fs $remote_fs $network $syslog $time
+# Required-Stop: $local_fs $remote_fs $network $syslog
+# Should-Start: postgresql mysql slapd winbind nslcd
+# Should-Stop: postgresql mysql slapd winbind nslcd
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: Dovecot init script
+# Description: Init script for dovecot services
+### END INIT INFO
+
+# Author: Miquel van Smoorenburg .
+# Modified for Debian GNU/Linux
+# by Ian Murdock .
+#
+
+# Do NOT "set -e"
+
+# PATH should only include /usr/* if it runs after the mountnfs.sh script
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+DESC="IMAP/POP3 mail server"
+NAME=dovecot
+DAEMON=/usr/sbin/dovecot
+DAEMON_ARGS=""
+SCRIPTNAME=/etc/init.d/$NAME
+CONF=/etc/dovecot/${NAME}.conf
+
+# Read configuration variable file if it is present
+[ -r /etc/default/$NAME ] && . /etc/default/$NAME
+
+# Exit if the package is not installed
+[ -x "$DAEMON" ] || exit 0
+
+# Exit if the configuration file doesn't exist
+[ -f "$CONF" ] || exit 0
+
+# Exit if explicitly told to
+[ "$ENABLED" != "0" ] || exit 0
+
+# Allow core dumps if requested
+[ "$ALLOW_COREDUMPS" != "1" ] || ulimit -c unlimited
+
+# Define LSB log_* functions.
+# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
+. /lib/lsb/init-functions
+
+# conf file readable?
+if [ ! -r ${CONF} ]; then
+ log_daemon_msg "${CONF}: not readable" "$NAME" && log_end_msg 1;
+ exit 1;
+fi
+
+# dont check for inetd.conf if its not installed
+if [ -f /etc/inetd.conf ]; then
+ # The init script should do nothing if dovecot or another imap/pop3 server
+ # is being run from inetd, and dovecot is configured to run as an imap or
+ # pop3 service
+ for p in `sed -r "s/^ *(([^:]+|\[[^]]+]|\*):)?(pop3s?|imaps?)[ \t].*/\3/;t;d" \
+ /etc/inetd.conf`
+ do
+ for q in `doveconf -n -h protocols`
+ do
+ if [ $p = $q ]; then
+ log_daemon_msg "protocol ${p} configured both in inetd and in dovecot" "$NAME" && log_end_msg 1
+ exit 0
+ fi
+ done
+ done
+fi
+
+# determine the location of the PID file
+# override by setting base_dir in conf file or PIDBASE in /etc/defaults/$NAME
+PIDBASE=${PIDBASE:-`doveconf -n -c ${CONF} -h base_dir`}
+PIDFILE=${PIDBASE:-/var/run/dovecot}/master.pid
+
+#
+# Function that starts the daemon/service
+#
+do_start()
+{
+ # Return
+ # 0 if daemon has been started
+ # 1 if daemon was already running
+ # 2 if daemon could not be started
+ start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test -- -c ${CONF} > /dev/null \
+ || return 1
+ start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- -c ${CONF} \
+ $DAEMON_ARGS \
+ || return 2
+}
+
+#
+# Function that stops the daemon/service
+#
+do_stop()
+{
+ # Return
+ # 0 if daemon has been stopped
+ # 1 if daemon was already stopped
+ # 2 if daemon could not be stopped
+ # other if a failure occurred
+ start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name ${DAEMON##*/}
+ RETVAL="$?"
+ [ "$RETVAL" = 2 ] && return 2
+ # Wait for children to finish too if this is a daemon that forks
+ # and if the daemon is only ever run from this initscript.
+ # If the above conditions are not satisfied then add some other code
+ # that waits for the process to drop all resources that could be
+ # needed by services started subsequently. A last resort is to
+ # sleep for some time.
+ start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --pidfile $PIDFILE --name ${DAEMON##*/}
+ [ "$?" = 2 ] && return 2
+ # Many daemons don't delete their pidfiles when they exit.
+ rm -f $PIDFILE
+ return "$RETVAL"
+}
+
+#
+# Function that sends a SIGHUP to the daemon/service
+#
+do_reload() {
+ #
+ # If the daemon can reload its configuration without
+ # restarting (for example, when it is sent a SIGHUP),
+ # then implement that here.
+ #
+ start-stop-daemon --stop --signal HUP --quiet --pidfile $PIDFILE --name $NAME
+ return 0
+}
+
+
+case "$1" in
+ start)
+ log_daemon_msg "Starting $DESC" "$NAME"
+ do_start
+ case "$?" in
+ 0|1) log_end_msg 0 ;;
+ 2) log_end_msg 1 ;;
+ esac
+ ;;
+ stop)
+ log_daemon_msg "Stopping $DESC" "$NAME"
+ do_stop
+ case "$?" in
+ 0|1) log_end_msg 0 ;;
+ 2) log_end_msg 1 ;;
+ esac
+ ;;
+ reload|force-reload)
+ log_daemon_msg "Reloading $DESC" "$NAME"
+ do_reload
+ log_end_msg $?
+ ;;
+ restart)
+ #
+ # If the "reload" option is implemented then remove the
+ # 'force-reload' alias
+ #
+ log_daemon_msg "Restarting $DESC" "$NAME"
+ do_stop
+ case "$?" in
+ 0|1)
+ do_start
+ case "$?" in
+ 0) log_end_msg 0 ;;
+ 1) log_end_msg 1 ;; # Old process is still running
+ *) log_end_msg 1 ;; # Failed to start
+ esac
+ ;;
+ *)
+ # Failed to stop
+ log_end_msg 1
+ ;;
+ esac
+ ;;
+ status)
+ status_of_proc -p $PIDFILE $DAEMON $NAME && exit 0 || exit $?
+ ;;
+ *)
+ echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload|status}" >&2
+ exit 3
+ ;;
+esac
diff --git a/init.d/ntp b/init.d/ntp
new file mode 100755
index 00000000..0e599ab2
--- /dev/null
+++ b/init.d/ntp
@@ -0,0 +1,72 @@
+#!/bin/sh
+
+### BEGIN INIT INFO
+# Provides: ntp
+# Required-Start: $network $remote_fs $syslog
+# Required-Stop: $network $remote_fs $syslog
+# Default-Start: 2 3 4 5
+# Default-Stop:
+# Short-Description: Start NTP daemon
+### END INIT INFO
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin
+
+. /lib/lsb/init-functions
+
+DAEMON=/usr/sbin/ntpd
+PIDFILE=/var/run/ntpd.pid
+
+test -x $DAEMON || exit 0
+
+if [ -r /etc/default/ntp ]; then
+ . /etc/default/ntp
+fi
+
+if [ -e /run/ntp.conf.dhcp ]; then
+ NTPD_OPTS="$NTPD_OPTS -c /run/ntp.conf.dhcp"
+fi
+
+
+RUNASUSER=ntp
+UGID=$(getent passwd $RUNASUSER | cut -f 3,4 -d:) || true
+if test "$(uname -s)" = "Linux"; then
+ NTPD_OPTS="$NTPD_OPTS -u $UGID"
+fi
+
+case $1 in
+ start)
+ log_daemon_msg "Starting NTP server" "ntpd"
+ if [ -z "$UGID" ]; then
+ log_failure_msg "user \"$RUNASUSER\" does not exist"
+ exit 1
+ fi
+ start-stop-daemon --start --quiet --oknodo --pidfile $PIDFILE --startas $DAEMON -- -p $PIDFILE $NTPD_OPTS
+ log_end_msg $?
+ ;;
+ stop)
+ log_daemon_msg "Stopping NTP server" "ntpd"
+ start-stop-daemon --stop --quiet --oknodo --pidfile $PIDFILE --retry=TERM/30/KILL/5 --exec $DAEMON
+ log_end_msg $?
+ rm -f $PIDFILE
+ ;;
+ restart|force-reload)
+ $0 stop && sleep 2 && $0 start
+ ;;
+ try-restart)
+ if $0 status >/dev/null; then
+ $0 restart
+ else
+ exit 0
+ fi
+ ;;
+ reload)
+ exit 3
+ ;;
+ status)
+ status_of_proc $DAEMON "NTP server"
+ ;;
+ *)
+ echo "Usage: $0 {start|stop|restart|try-restart|force-reload|status}"
+ exit 2
+ ;;
+esac
diff --git a/init.d/opendkim b/init.d/opendkim
new file mode 100755
index 00000000..729c97c4
--- /dev/null
+++ b/init.d/opendkim
@@ -0,0 +1,177 @@
+#! /bin/sh
+#
+### BEGIN INIT INFO
+# Provides: opendkim
+# Required-Start: $syslog $time $local_fs $remote_fs $named $network
+# Required-Stop: $syslog $time $local_fs $remote_fs
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: Start the OpenDKIM service
+# Description: Enable DKIM signing and verification provided by OpenDKIM
+### END INIT INFO
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin
+DAEMON=/usr/sbin/opendkim
+NAME=opendkim
+DESC="OpenDKIM"
+
+# How long to wait for the process to die on stop/restart
+stoptimeout=5
+
+test -x $DAEMON || exit 0
+
+# Include LSB provided init functions
+. /lib/lsb/init-functions
+
+
+
+# Include opendkim defaults if available
+if [ -f /etc/default/opendkim ] ; then
+ . /etc/default/opendkim
+fi
+
+pathfind() {
+ OLDIFS="$IFS"
+ IFS=:
+ for p in $PATH; do
+ if [ -x "$p/$*" ]; then
+ IFS="$OLDIFS"
+ return 0
+ fi
+ done
+ IFS="$OLDIFS"
+ return 1
+}
+
+USER=$USER
+GROUP=$GROUP
+PIDFILE=$RUNDIR/$NAME.pid
+
+if [ -f /etc/opendkim.conf ]; then
+ CONFIG_SOCKET=`awk '$1 == "Socket" { print $2 }' /etc/opendkim.conf`
+fi
+
+# This can be set via Socket option in config file, so it's not required
+if [ -n "$SOCKET" -a -z "$CONFIG_SOCKET" ]; then
+ DAEMON_OPTS="-p $SOCKET $DAEMON_OPTS"
+fi
+
+DAEMON_OPTS="-u $USER -P $PIDFILE $DAEMON_OPTS"
+
+start() {
+ # Create the run directory if it doesn't exist
+ if [ ! -d "$RUNDIR" ]; then
+ install -o "$USER" -g "$GROUP" -m 755 -d "$RUNDIR" || exit 2
+ if pathfind restorecon; then restorecon "$RUNDIR"
+ fi
+ fi
+ # Clean up stale sockets
+ if [ -f "$PIDFILE" ]; then
+ pid=`cat $PIDFILE`
+ if ! ps -C "$NAME" -s "$pid" >/dev/null; then
+ rm "$PIDFILE"
+ TMPSOCKET=""
+ if [ -n "$SOCKET" ]; then
+ TMPSOCKET="$SOCKET"
+ elif [ -n "$CONFIG_SOCKET" ]; then
+ TMPSOCKET="$CONFIG_SOCKET"
+ fi
+ if [ -n "$TMPSOCKET" ]; then
+ # UNIX sockets may be specified with or without the
+ # local: prefix; handle both
+ t=`echo $SOCKET | cut -d: -f1`
+ s=`echo $SOCKET | cut -d: -f2`
+ if [ -e "$s" -a -S "$s" ]; then
+ if [ "$t" = "$s" -o "$t" = "local" ]; then
+ rm "$s"
+ fi
+ fi
+ fi
+ fi
+ fi
+ start-stop-daemon --start --quiet --pidfile "$PIDFILE" --exec "$DAEMON" --test -- $DAEMON_OPTS || exit 1
+ start-stop-daemon --start --quiet --pidfile "$PIDFILE" --exec "$DAEMON" -- $DAEMON_OPTS || exit 2
+ # Detect exit status 78 (configuration error)
+ ret=$?
+ if [ $ret -eq 78 ]; then
+ echo "See /usr/share/doc/opendkim/README.Debian for help"
+ echo "Starting for DKIM verification only"
+ DAEMON_OPTS="-b v $DAEMON_OPTS"
+ start-stop-daemon --start --quiet --pidfile "$PIDFILE" --exec "$DAEMON" -- $DAEMON_OPTS
+ exit 0
+ elif [ $ret -ne 0 ]; then
+ exit $ret
+ fi
+}
+
+stop() {
+ start-stop-daemon --stop --retry "$stoptimeout" --exec "$DAEMON"
+ [ "$?" = 2 ] && exit 2
+}
+
+reload() {
+ start-stop-daemon --stop --signal USR1 --exec "$DAEMON"
+}
+
+status() {
+ local pidfile daemon name status
+
+ pidfile=
+ OPTIND=1
+ while getopts p: opt ; do
+ case "$opt" in
+ p) pidfile="$OPTARG";;
+ esac
+ done
+ shift $(($OPTIND - 1))
+
+ if [ -n "$pidfile" ]; then
+ pidfile="-p $pidfile"
+ fi
+ daemon="$1"
+ name="$2"
+
+ status="0"
+ pidofproc $pidfile $daemon >/dev/null || status="$?"
+ if [ "$status" = 0 ]; then
+ log_success_msg "$name is running"
+ return 0
+ else
+ log_failure_msg "$name is not running"
+ exit $status
+ fi
+}
+
+case "$1" in
+ start)
+ echo -n "Starting $DESC: "
+ start
+ echo "$NAME."
+ ;;
+ stop)
+ echo -n "Stopping $DESC: "
+ stop
+ echo "$NAME."
+ ;;
+ restart)
+ echo -n "Restarting $DESC: "
+ stop
+ start
+ echo "$NAME."
+ ;;
+ reload|force-reload)
+ echo -n "Restarting $DESC: "
+ reload
+ echo "$NAME."
+ ;;
+ status)
+ status $DAEMON $NAME
+ ;;
+ *)
+ N=/etc/init.d/$NAME
+ echo "Usage: $N {start|stop|restart|reload|force-reload|status}" >&2
+ exit 1
+ ;;
+esac
+
+exit 0
diff --git a/init.d/php8.0-fpm b/init.d/php8.0-fpm
new file mode 100755
index 00000000..6cd4cc30
--- /dev/null
+++ b/init.d/php8.0-fpm
@@ -0,0 +1,161 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides: php8.0-fpm
+# Required-Start: $remote_fs $network
+# Required-Stop: $remote_fs $network
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: starts php8.0-fpm
+# Description: Starts The PHP FastCGI Process Manager Daemon
+### END INIT INFO
+
+# Author: Ondrej Sury
+
+PATH=/sbin:/usr/sbin:/bin:/usr/bin
+DESC="PHP 8.0 FastCGI Process Manager"
+NAME=php-fpm8.0
+CONFFILE=/etc/php/8.0/fpm/php-fpm.conf
+DAEMON=/usr/sbin/$NAME
+DAEMON_ARGS="--daemonize --fpm-config $CONFFILE"
+CONF_PIDFILE=$(sed -n 's/^pid[ =]*//p' $CONFFILE)
+PIDFILE=${CONF_PIDFILE:-/run/php/php8.0-fpm.pid}
+TIMEOUT=30
+SCRIPTNAME=/etc/init.d/$NAME
+
+# Exit if the package is not installed
+[ -x "$DAEMON" ] || exit 0
+
+# Read configuration variable file if it is present
+[ -r /etc/default/$NAME ] && . /etc/default/$NAME
+
+# Load the VERBOSE setting and other rcS variables
+. /lib/init/vars.sh
+
+# Define LSB log_* functions.
+# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
+. /lib/lsb/init-functions
+
+#
+# Function that starts the daemon/service
+#
+do_start()
+{
+ # Return
+ # 0 if daemon has been started
+ # 1 if daemon was already running
+ # 2 if daemon could not be started
+ start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
+ || return 1
+ start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \
+ $DAEMON_ARGS 2>/dev/null \
+ || return 2
+ # Add code here, if necessary, that waits for the process to be ready
+ # to handle requests from services started subsequently which depend
+ # on this one. As a last resort, sleep for some time.
+}
+
+#
+# Function that stops the daemon/service
+#
+do_stop()
+{
+ # Return
+ # 0 if daemon has been stopped
+ # 1 if daemon was already stopped
+ # 2 if daemon could not be stopped
+ # other if a failure occurred
+ start-stop-daemon --stop --quiet --retry=QUIT/$TIMEOUT/TERM/5/KILL/5 --pidfile $PIDFILE --name $NAME
+ RETVAL="$?"
+ [ "$RETVAL" = 2 ] && return 2
+ # Wait for children to finish too if this is a daemon that forks
+ # and if the daemon is only ever run from this initscript.
+ # If the above conditions are not satisfied then add some other code
+ # that waits for the process to drop all resources that could be
+ # needed by services started subsequently. A last resort is to
+ # sleep for some time.
+ start-stop-daemon --stop --quiet --oknodo --retry=0/30/TERM/5/KILL/5 --exec $DAEMON
+ [ "$?" = 2 ] && return 2
+ # Many daemons don't delete their pidfiles when they exit.
+ rm -f $PIDFILE
+ return "$RETVAL"
+}
+
+#
+# Function that sends a SIGHUP to the daemon/service
+#
+do_reload() {
+ #
+ # If the daemon can reload its configuration without
+ # restarting (for example, when it is sent a SIGHUP),
+ # then implement that here.
+ #
+ start-stop-daemon --stop --signal USR2 --quiet --pidfile $PIDFILE --name $NAME
+ return 0
+}
+
+case "$1" in
+ start)
+ [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
+ systemd-tmpfiles --remove --create /usr/lib/tmpfiles.d/php8.0-fpm.conf
+ case "$?" in
+ 0)
+ do_start
+ case "$?" in
+ 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+ 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
+ ;;
+ 1) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
+ ;;
+ stop)
+ [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
+ do_stop
+ case "$?" in
+ 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+ 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
+ ;;
+ status)
+ status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
+ ;;
+ reload|force-reload)
+ log_daemon_msg "Reloading $DESC" "$NAME"
+ do_reload
+ log_end_msg $?
+ ;;
+ reopen-logs)
+ log_daemon_msg "Reopening $DESC logs" $NAME
+ if start-stop-daemon --stop --signal USR1 --oknodo --quiet \
+ --pidfile $PIDFILE --exec $DAEMON
+ then
+ log_end_msg 0
+ else
+ log_end_msg 1
+ fi
+ ;;
+ restart)
+ log_daemon_msg "Restarting $DESC" "$NAME"
+ do_stop
+ case "$?" in
+ 0|1)
+ do_start
+ case "$?" in
+ 0) log_end_msg 0 ;;
+ 1) log_end_msg 1 ;; # Old process is still running
+ *) log_end_msg 1 ;; # Failed to start
+ esac
+ ;;
+ *)
+ # Failed to stop
+ log_end_msg 1
+ ;;
+ esac
+ ;;
+ *)
+ echo "Usage: $SCRIPTNAME {start|stop|status|restart|reload|force-reload}" >&2
+ exit 1
+ ;;
+esac
+
+:
diff --git a/init.d/postfix b/init.d/postfix
new file mode 100755
index 00000000..d8da2825
--- /dev/null
+++ b/init.d/postfix
@@ -0,0 +1,136 @@
+#!/bin/sh -e
+
+# Start or stop Postfix
+#
+# LaMont Jones
+# based on sendmail's init.d script
+
+### BEGIN INIT INFO
+# Provides: postfix mail-transport-agent
+# Required-Start: $local_fs $remote_fs $syslog $named $network $time
+# Required-Stop: $local_fs $remote_fs $syslog $named $network
+# Should-Start: postgresql mysql clamav-daemon postgrey spamassassin saslauthd dovecot
+# Should-Stop: postgresql mysql clamav-daemon postgrey spamassassin saslauthd dovecot
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: Postfix Mail Transport Agent
+# Description: postfix is a Mail Transport agent
+### END INIT INFO
+
+PATH=/bin:/usr/bin:/sbin:/usr/sbin
+DAEMON=/usr/sbin/postfix
+NAME=Postfix
+TZ=
+unset TZ
+
+test -x $DAEMON && test -f /etc/postfix/main.cf || exit 0
+
+. /lib/lsb/init-functions
+#DISTRO=$(lsb_release -is 2>/dev/null || echo Debian)
+
+enabled_instances() {
+ postmulti -l -a | awk '($3=="y") { print $1}'
+}
+
+running() {
+ INSTANCE="$1"
+ if [ "X$INSTANCE" = X ]; then
+ POSTMULTI=""
+ else
+ POSTMULTI="postmulti -i $INSTANCE -x "
+ fi
+ POSTCONF="${POSTMULTI} postconf"
+
+ daemon_directory=$($POSTCONF -hx daemon_directory 2>/dev/null || echo /usr/lib/postfix/sbin)
+ if ! ${POSTMULTI} $daemon_directory/master -t 2>/dev/null ; then
+ echo y
+ fi
+}
+
+case "$1" in
+ start)
+ log_daemon_msg "Starting Postfix Mail Transport Agent" postfix
+ RET=0
+ # for all instances that are not already running, handle chroot setup if needed, and start
+ for INSTANCE in $(enabled_instances); do
+ RUNNING=$(running $INSTANCE)
+ if [ "X$RUNNING" = X ]; then
+ /usr/lib/postfix/configure-instance.sh $INSTANCE
+ CMD="/usr/sbin/postmulti -- -i $INSTANCE -x ${DAEMON}"
+ if ! start-stop-daemon --start --exec $CMD quiet-quick-start; then
+ RET=1
+ fi
+ fi
+ done
+ log_end_msg $RET
+ ;;
+
+ stop)
+ log_daemon_msg "Stopping Postfix Mail Transport Agent" postfix
+ RET=0
+ # for all instances that are not already running, handle chroot setup if needed, and start
+ for INSTANCE in $(enabled_instances); do
+ RUNNING=$(running $INSTANCE)
+ if [ "X$RUNNING" != X ]; then
+ CMD="/usr/sbin/postmulti -i $INSTANCE -x ${DAEMON}"
+ if ! ${CMD} quiet-stop; then
+ RET=1
+ fi
+ fi
+ done
+ log_end_msg $RET
+ ;;
+
+ restart)
+ $0 stop
+ $0 start
+ ;;
+
+ force-reload|reload)
+ log_action_begin_msg "Reloading Postfix configuration"
+ if ${DAEMON} quiet-reload; then
+ log_action_end_msg 0
+ else
+ log_action_end_msg 1
+ fi
+ ;;
+
+ status)
+ ALL=1
+ ANY=0
+ # for all instances that are not already running, handle chroot setup if needed, and start
+ for INSTANCE in $(enabled_instances); do
+ RUNNING=$(running $INSTANCE)
+ if [ "X$RUNNING" != X ]; then
+ ANY=1
+ else
+ ALL=0
+ fi
+ done
+ # handle the case when postmulti returns *no* configured instances
+ if [ $ANY = 0 ]; then
+ ALL=0
+ fi
+ if [ $ALL = 1 ]; then
+ log_success_msg "postfix is running"
+ exit 0
+ elif [ $ANY = 1 ]; then
+ log_success_msg "some postfix instances are running"
+ exit 0
+ else
+ log_success_msg "postfix is not running"
+ exit 3
+ fi
+ ;;
+
+ flush|check|abort)
+ ${DAEMON} $1
+ ;;
+
+ *)
+ log_action_msg "Usage: /etc/init.d/postfix {start|stop|restart|reload|flush|check|abort|force-reload|status}"
+ exit 1
+ ;;
+esac
+
+exit 0
diff --git a/init.d/postgrey b/init.d/postgrey
new file mode 100755
index 00000000..9e71f110
--- /dev/null
+++ b/init.d/postgrey
@@ -0,0 +1,141 @@
+#! /bin/sh
+#
+# postgrey start/stop the postgrey greylisting deamon for postfix
+# (priority should be smaller than that of postfix)
+#
+# Author: (c)2004-2006 Adrian von Bidder
+# Based on Debian sarge's 'skeleton' example
+# Distribute and/or modify at will.
+#
+# Version: $Id: postgrey.init 1436 2006-12-07 07:15:03Z avbidder $
+#
+### BEGIN INIT INFO
+# Provides: postgrey
+# Required-Start: $syslog $local_fs $remote_fs
+# Required-Stop: $syslog $local_fs $remote_fs
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: Start/stop the postgrey daemon
+### END INIT INFO
+
+set -e
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin
+DAEMON=/usr/sbin/postgrey
+DAEMON_NAME=postgrey
+DESC="postfix greylisting daemon"
+DAEMON_USER=postgrey
+
+PIDFILE=/var/run/$DAEMON_NAME.pid
+SCRIPTNAME=/etc/init.d/$DAEMON_NAME
+
+# Gracefully exit if the package has been removed.
+test -x $DAEMON || exit 0
+
+. /lib/lsb/init-functions
+
+# Read config file if it is present.
+if [ -r /etc/default/$DAEMON_NAME ]
+then
+ . /etc/default/$DAEMON_NAME
+fi
+
+POSTGREY_OPTS="--pidfile=$PIDFILE --daemonize $POSTGREY_OPTS"
+if [ -z "$POSTGREY_TEXT" ]; then
+ POSTGREY_TEXT_OPT=""
+else
+ POSTGREY_TEXT_OPT="--greylist-text=$POSTGREY_TEXT"
+fi
+
+ret=0
+
+do_start()
+{
+ # Return
+ # 0 if daemon has been started
+ # 1 if daemon was already running
+ # 2 if daemon could not be started
+ start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
+ || return 1
+ start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \
+ $POSTGREY_OPTS "$POSTGREY_TEXT_OPT" \
+ || return 2
+}
+
+do_stop()
+{
+ # Return
+ # 0 if daemon has been stopped
+ # 1 if daemon was already stopped
+ # 2 if daemon could not be stopped
+ # other if a failure occurred
+ start-stop-daemon --user $DAEMON_USER --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE
+ RETVAL="$?"
+ [ "$RETVAL" = 2 ] && return 2
+
+ # Wait for children to finish too if this is a daemon that forks
+ # and if the daemon is only ever run from this initscript.
+ # If the above conditions are not satisfied then add some other code
+ # that waits for the process to drop all resources that could be
+ # needed by services started subsequently. A last resort is to
+ # sleep for some time.
+ start-stop-daemon --user $DAEMON_USER --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
+ [ "$?" = 2 ] && return 2
+ # Many daemons don't delete their pidfiles when they exit.
+ rm -f $PIDFILE
+ return "$RETVAL"
+
+}
+
+do_reload()
+{
+ #
+ # If the daemon can reload its configuration without
+ # restarting (for example, when it is sent a SIGHUP),
+ # then implement that here.
+ #
+ start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE
+ return 0
+}
+
+case "$1" in
+ start)
+ [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$DAEMON_NAME"
+ do_start
+ case "$?" in
+ 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+ 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
+ ;;
+ stop)
+ [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$DAEMON_NAME"
+ do_stop
+ case "$?" in
+ 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+ 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
+ ;;
+ reload|force-reload)
+ [ "$VERBOSE" != no ] && log_daemon_msg "Reloading $DESC" "$DAEMON_NAME"
+ do_reload
+ case "$?" in
+ 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+ 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
+ ;;
+ restart)
+ do_stop
+ do_start
+ ;;
+ status)
+ status_of_proc -p $PIDFILE $DAEMON "$DAEMON_NAME" 2>/dev/null
+ ret=$?
+ ;;
+
+ *)
+ echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload|status}" >&2
+ exit 1
+ ;;
+esac
+
+exit $ret
diff --git a/init.d/rspamd b/init.d/rspamd
new file mode 100755
index 00000000..0cde6447
--- /dev/null
+++ b/init.d/rspamd
@@ -0,0 +1,141 @@
+#! /bin/bash
+### BEGIN INIT INFO
+# Provides: rspamd
+# Required-Start: $syslog $remote_fs
+# Required-Stop: $syslog $remote_fs
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: Rspamd spam filtering system
+# Description: Rspamd is fast and modular spam filtering system
+### END INIT INFO
+
+# Author: Vsevolod Stakhov
+
+# PATH should only include /usr/* if it runs after the mountnfs.sh script
+PATH=/sbin:/usr/sbin:/bin:/usr/bin
+DESC="Rspamd"
+NAME=rspamd
+DAEMON=/usr/bin/$NAME
+RSPAMADM=/usr/bin/rspamadm
+DAEMON_ARGS="-c /etc/rspamd/rspamd.conf"
+DESC="rapid spam filtering system"
+PIDFILE=/run/rspamd/$NAME.pid
+SCRIPTNAME=/etc/init.d/$NAME
+
+# Exit if the package is not installed
+[ -x "$DAEMON" ] || exit 0
+
+# Load the VERBOSE setting and other rcS variables
+. /lib/init/vars.sh
+
+# Define LSB log_* functions.
+# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
+. /lib/lsb/init-functions
+
+#
+# Function that starts the daemon/service
+#
+do_start()
+{
+ # Return
+ # 0 if daemon has been started
+ # 1 if daemon was already running
+ # 2 if daemon could not be started
+ mkdir -m 755 -p /run/rspamd
+ chown _rspamd:_rspamd /run/rspamd
+ $RSPAMADM configtest $DAEMON_ARGS > /dev/null \
+ || return 1
+ start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \
+ $DAEMON_ARGS -u _rspamd -g _rspamd \
+ || return 2
+}
+
+#
+# Function that stops the daemon/service
+#
+do_stop()
+{
+ # Return
+ # 0 if daemon has been stopped
+ # 1 if daemon was already stopped
+ # 2 if daemon could not be stopped
+ # other if a failure occurred
+ start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE
+ RETVAL="$?"
+ [ "$RETVAL" = 2 ] && return 2
+ # Many daemons don't delete their pidfiles when they exit.
+ rm -f $PIDFILE
+ return "$RETVAL"
+}
+
+#
+# Function that sends a SIGHUP to the daemon/service
+#
+do_reload() {
+ start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE
+ return 0
+}
+
+#
+# Function that sends a SIGUSR1 to the daemon/service
+#
+do_reopenlog() {
+ start-stop-daemon --stop --signal 10 --quiet --pidfile $PIDFILE
+ return 0
+}
+
+case "$1" in
+ start)
+ [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
+ do_start
+ case "$?" in
+ 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+ 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
+ ;;
+ stop)
+ [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
+ do_stop
+ case "$?" in
+ 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+ 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
+ ;;
+ status)
+ status_of_proc -p $PIDFILE "$DAEMON" "$NAME" || exit $?
+ ;;
+ reload|force-reload)
+ log_daemon_msg "Reloading $DESC" "$NAME"
+ do_reload
+ log_end_msg $?
+ ;;
+ reopenlog)
+ log_daemon_msg "Reopen logs for $DESC" "$NAME"
+ do_reopenlog
+ log_end_msg $?
+ ;;
+ restart)
+ log_daemon_msg "Restarting $DESC" "$NAME"
+ do_stop
+ case "$?" in
+ 0|1)
+ do_start
+ case "$?" in
+ 0) log_end_msg 0 ;;
+ 1) log_end_msg 1 ;; # Old process is still running
+ *) log_end_msg 1 ;; # Failed to start
+ esac
+ ;;
+ *)
+ # Failed to stop
+ log_end_msg 1
+ ;;
+ esac
+ ;;
+ *)
+ echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload|reopenlog}" >&2
+ exit 3
+ ;;
+esac
+
+exit 0
diff --git a/init.d/screen-cleanup b/init.d/screen-cleanup
new file mode 100755
index 00000000..3eb41855
--- /dev/null
+++ b/init.d/screen-cleanup
@@ -0,0 +1,49 @@
+#!/bin/sh
+# $Id: init,v 1.3 2004/03/16 01:43:45 zal Exp $
+#
+# Script to remove stale screen named pipes on bootup.
+#
+
+### BEGIN INIT INFO
+# Provides: screen-cleanup
+# Required-Start: $remote_fs
+# Required-Stop: $remote_fs
+# Default-Start: S
+# Default-Stop:
+# Short-Description: screen sessions cleaning
+# Description: Cleans up the screen session directory and fixes its
+# permissions if needed.
+### END INIT INFO
+
+set -e
+
+test -f /usr/bin/screen || exit 0
+
+SCREENDIR=/run/screen
+
+case "$1" in
+start)
+ if test -L $SCREENDIR || ! test -d $SCREENDIR; then
+ rm -f $SCREENDIR
+ mkdir $SCREENDIR
+ chown root:utmp $SCREENDIR
+ [ -x /sbin/restorecon ] && /sbin/restorecon $SCREENDIR
+ fi
+ find $SCREENDIR -type p -delete
+# If the local admin has used dpkg-statoverride to install the screen
+# binary with different set[ug]id bits, change the permissions of
+# $SCREENDIR accordingly
+ BINARYPERM=`stat -c%a /usr/bin/screen`
+ if [ "$BINARYPERM" -ge 4000 ]; then
+ chmod 0755 $SCREENDIR
+ elif [ "$BINARYPERM" -ge 2000 ]; then
+ chmod 0775 $SCREENDIR
+ else
+ chmod 1777 $SCREENDIR
+ fi
+ ;;
+stop|restart|reload|force-reload)
+ ;;
+esac
+
+exit 0
diff --git a/insserv.conf.d/postfix b/insserv.conf.d/postfix
new file mode 100644
index 00000000..ddd00348
--- /dev/null
+++ b/insserv.conf.d/postfix
@@ -0,0 +1 @@
+$mail-transport-agent postfix
diff --git a/kernel/header_postinst.d/dkms b/kernel/header_postinst.d/dkms
new file mode 100755
index 00000000..a95e6c8a
--- /dev/null
+++ b/kernel/header_postinst.d/dkms
@@ -0,0 +1,46 @@
+#!/bin/bash
+
+# We're passed the version of the kernel being installed
+inst_kern=$1
+
+uname_s=$(uname -s)
+
+_get_kernel_dir() {
+ KVER=$1
+ case ${uname_s} in
+ Linux) DIR="/lib/modules/$KVER/build" ;;
+ GNU/kFreeBSD) DIR="/usr/src/kfreebsd-headers-$KVER/sys" ;;
+ esac
+ echo $DIR
+}
+
+_check_kernel_dir() {
+ DIR=$(_get_kernel_dir $1)
+ case ${uname_s} in
+ Linux) test -e $DIR/include ;;
+ GNU/kFreeBSD) test -e $DIR/kern && test -e $DIR/conf/kmod.mk ;;
+ *) return 1 ;;
+ esac
+ return $?
+}
+
+case "${uname_s}" in
+ Linux)
+ header_pkg="linux-headers-$inst_kern"
+ kernel="Linux"
+ ;;
+ GNU/kFreeBSD)
+ header_pkg="kfreebsd-headers-$inst_kern"
+ kernel="kFreeBSD"
+ ;;
+esac
+
+if [ -x /usr/lib/dkms/dkms_autoinstaller ]; then
+ exec /usr/lib/dkms/dkms_autoinstaller start $inst_kern
+fi
+
+if ! _check_kernel_dir $inst_kern ; then
+ echo "dkms: WARNING: $kernel headers are missing, which may explain the above failures." >&2
+ echo " please install the $header_pkg package to fix this." >&2
+fi
+
diff --git a/kernel/postinst.d/dkms b/kernel/postinst.d/dkms
new file mode 100755
index 00000000..a95e6c8a
--- /dev/null
+++ b/kernel/postinst.d/dkms
@@ -0,0 +1,46 @@
+#!/bin/bash
+
+# We're passed the version of the kernel being installed
+inst_kern=$1
+
+uname_s=$(uname -s)
+
+_get_kernel_dir() {
+ KVER=$1
+ case ${uname_s} in
+ Linux) DIR="/lib/modules/$KVER/build" ;;
+ GNU/kFreeBSD) DIR="/usr/src/kfreebsd-headers-$KVER/sys" ;;
+ esac
+ echo $DIR
+}
+
+_check_kernel_dir() {
+ DIR=$(_get_kernel_dir $1)
+ case ${uname_s} in
+ Linux) test -e $DIR/include ;;
+ GNU/kFreeBSD) test -e $DIR/kern && test -e $DIR/conf/kmod.mk ;;
+ *) return 1 ;;
+ esac
+ return $?
+}
+
+case "${uname_s}" in
+ Linux)
+ header_pkg="linux-headers-$inst_kern"
+ kernel="Linux"
+ ;;
+ GNU/kFreeBSD)
+ header_pkg="kfreebsd-headers-$inst_kern"
+ kernel="kFreeBSD"
+ ;;
+esac
+
+if [ -x /usr/lib/dkms/dkms_autoinstaller ]; then
+ exec /usr/lib/dkms/dkms_autoinstaller start $inst_kern
+fi
+
+if ! _check_kernel_dir $inst_kern ; then
+ echo "dkms: WARNING: $kernel headers are missing, which may explain the above failures." >&2
+ echo " please install the $header_pkg package to fix this." >&2
+fi
+
diff --git a/kernel/prerm.d/dkms b/kernel/prerm.d/dkms
new file mode 100755
index 00000000..c8116a39
--- /dev/null
+++ b/kernel/prerm.d/dkms
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# We're passed the version of the kernel being removed
+inst_kern=$1
+
+# This is applied from make_initrd function in dkms command, which
+# creates the possible initrd backup file.
+remove_initrd_backup() {
+ for initrd in "initrd-$1.img" "initramfs-$1.img" "initrd.img-$1" "initrd-$1"; do
+ rm -fv /boot/"${initrd}".old-dkms >&2
+ done
+}
+
+if [ -x /usr/sbin/dkms ]; then
+while read line; do
+ name=`echo "$line" | awk '{print $1}' | sed 's/,$//'`
+ vers=`echo "$line" | awk '{print $2}' | sed 's/,$//'`
+ arch=`echo "$line" | awk '{print $4}' | sed 's/:$//'`
+ echo "dkms: removing: $name $vers ($inst_kern) ($arch)" >&2
+ dkms remove -m $name -v $vers -k $inst_kern -a $arch
+done < <(dkms status -k $inst_kern 2>/dev/null | grep ": installed")
+fi
+
+remove_initrd_backup "$inst_kern"
+
+rmdir --ignore-fail-on-non-empty \
+ "/lib/modules/$inst_kern/updates/dkms" \
+ "/lib/modules/$inst_kern/updates" 2>/dev/null
+
+exit 0
diff --git a/ld.so.conf.d/fakeroot-x86_64-linux-gnu.conf b/ld.so.conf.d/fakeroot-x86_64-linux-gnu.conf
new file mode 100644
index 00000000..bf033790
--- /dev/null
+++ b/ld.so.conf.d/fakeroot-x86_64-linux-gnu.conf
@@ -0,0 +1 @@
+/usr/lib/x86_64-linux-gnu/libfakeroot
diff --git a/ldap/schema/amavis.schema b/ldap/schema/amavis.schema
new file mode 100644
index 00000000..d34b1525
--- /dev/null
+++ b/ldap/schema/amavis.schema
@@ -0,0 +1,942 @@
+#--------------------------------------------------------------------------
+# LDAP Schema for amavisd-new Jacques Supcik, PhD
+#----------------------------- IP-Plus Internet Services
+# Release 1.2.2 Swisscom Enterprise Solutions Ltd
+# 30 May 2004 3050 Bern - Switzerland
+#--------------------------------------------------------------------------
+# Copyright (c) 2004 Jacques Supcik, Swisscom Enterprise Solutions Ltd.
+# Permission is granted to copy, distribute and/or modify this document
+# under the terms of the GNU Free Documentation License, Version 1.2
+# or any later version published by the Free Software Foundation;
+# with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
+# A copy of the license is included in the section entitled "GNU
+# Free Documentation License".
+#--------------------------------------------------------------------------
+# Changes made to LDAP Schema to make it import and play nicely with
+# Novell NDS - Michael Tracey, SONOPRESS USA, LLC April 07 2005
+# ( uncomment each dn:, changetype:, add:, add X-NDS-NAME attribute, replace
+# "attributetype" by "attributetypes:" and "objectclasse" by "objectclasses:"
+# (plural,colon), and unwrap each attributetypes: and objectclasses: )
+#--------------------------------------------------------------------------
+# 1.3.6.1.4.1.15312 Jozef Stefan Institute's OID
+# 1.3.6.1.4.1.15312.2 amavisd-new
+# 1.3.6.1.4.1.15312.2.2 amavisd-new LDAP Elements
+# 1.3.6.1.4.1.15312.2.2.1 AttributeTypes
+# 1.3.6.1.4.1.15312.2.2.2 ObjectClasses
+# 1.3.6.1.4.1.15312.2.2.3 Syntax Definitions
+#--------------------------------------------------------------------------
+
+# Attribute Types
+#-----------------
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.1
+ NAME 'amavisVirusLover'
+ DESC 'Virus Lover'
+ EQUALITY booleanMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.2
+ NAME 'amavisBannedFilesLover'
+ DESC 'Banned Files Lover'
+ EQUALITY booleanMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.3
+ NAME 'amavisBypassVirusChecks'
+ DESC 'Bypass Virus Check'
+ EQUALITY booleanMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.4
+ NAME 'amavisBypassSpamChecks'
+ DESC 'Bypass Spam Check'
+ EQUALITY booleanMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.5
+ NAME 'amavisSpamTagLevel'
+ DESC 'Spam Tag Level'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.6
+ NAME 'amavisSpamTag2Level'
+ DESC 'Spam Tag2 Level'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.7
+ NAME 'amavisSpamKillLevel'
+ DESC 'Spam Kill Level'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.8
+ NAME 'amavisSpamModifiesSubj'
+ DESC 'Modifies Subject on spam - no longer in use since 2.7.0'
+ EQUALITY booleanMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.9
+ NAME 'amavisWhitelistSender'
+ DESC 'White List Sender'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.10
+ NAME 'amavisBlacklistSender'
+ DESC 'Black List Sender'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.11
+ NAME 'amavisSpamQuarantineTo'
+ DESC 'Spam Quarantine to'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.12
+ NAME 'amavisSpamLover'
+ DESC 'Spam Lover'
+ EQUALITY booleanMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.13
+ NAME 'amavisBadHeaderLover'
+ DESC 'Bad Header Lover'
+ EQUALITY booleanMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.14
+ NAME 'amavisBypassBannedChecks'
+ DESC 'Bypass Banned Files Check'
+ EQUALITY booleanMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.15
+ NAME 'amavisBypassHeaderChecks'
+ DESC 'Bypass Header Check'
+ EQUALITY booleanMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.16
+ NAME 'amavisVirusQuarantineTo'
+ DESC 'Virus quarantine location'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.17
+ NAME 'amavisBannedQuarantineTo'
+ DESC 'Banned Files quarantine location'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.18
+ NAME 'amavisBadHeaderQuarantineTo'
+ DESC 'Bad Header quarantine location'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.19
+ NAME 'amavisLocal'
+ DESC 'Is user considered local'
+ EQUALITY booleanMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.20
+ NAME 'amavisMessageSizeLimit'
+ DESC 'Message size limit'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.21
+ NAME 'amavisWarnVirusRecip'
+ DESC 'Notify virus recipients'
+ EQUALITY booleanMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.22
+ NAME 'amavisWarnBannedRecip'
+ DESC 'Notify banned file recipients'
+ EQUALITY booleanMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.23
+ NAME 'amavisWarnBadHeaderRecip'
+ DESC 'Notify bad header recipients'
+ EQUALITY booleanMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.24
+ NAME 'amavisVirusAdmin'
+ DESC 'Virus admin'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.25
+ NAME 'amavisNewVirusAdmin'
+ DESC 'New virus admin'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.26
+ NAME 'amavisSpamAdmin'
+ DESC 'Spam admin'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.27
+ NAME 'amavisBannedAdmin'
+ DESC 'Banned file admin'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.28
+ NAME 'amavisBadHeaderAdmin'
+ DESC 'Bad header admin'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.29
+ NAME 'amavisBannedRuleNames'
+ DESC 'Banned rule names'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.30
+ NAME 'amavisSpamDsnCutoffLevel'
+ DESC 'Spam DSN Cutoff Level'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.31
+ NAME 'amavisSpamQuarantineCutoffLevel'
+ DESC 'Spam Quarantine Cutoff Level'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.32
+ NAME 'amavisSpamSubjectTag'
+ DESC 'Spam Subject Tag'
+ EQUALITY caseExactIA5Match
+ SUBSTR caseExactSubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.33
+ NAME 'amavisSpamSubjectTag2'
+ DESC 'Spam Subject Tag2'
+ EQUALITY caseExactIA5Match
+ SUBSTR caseExactSubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.34
+ NAME 'amavisArchiveQuarantineTo'
+ DESC 'Archive quarantine location'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.35
+ NAME 'amavisAddrExtensionVirus'
+ DESC 'Address Extension for Virus'
+ EQUALITY caseExactIA5Match
+ SUBSTR caseExactSubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.36
+ NAME 'amavisAddrExtensionSpam'
+ DESC 'Address Extension for Spam'
+ EQUALITY caseExactIA5Match
+ SUBSTR caseExactSubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.37
+ NAME 'amavisAddrExtensionBanned'
+ DESC 'Address Extension for Banned'
+ EQUALITY caseExactIA5Match
+ SUBSTR caseExactSubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.38
+ NAME 'amavisAddrExtensionBadHeader'
+ DESC 'Address Extension for Bad Header'
+ EQUALITY caseExactIA5Match
+ SUBSTR caseExactSubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+# NEW since 2.7.0:
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.39
+ NAME 'amavisSpamTag3Level'
+ DESC 'Spam Tag3 Level'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.40
+ NAME 'amavisSpamSubjectTag3'
+ DESC 'Spam Subject Tag3'
+ EQUALITY caseExactIA5Match
+ SUBSTR caseExactSubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.41
+ NAME 'amavisUncheckedQuarantineTo'
+ DESC 'Virus quarantine location'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.42
+ NAME 'amavisCleanQuarantineTo'
+ DESC 'Clean quarantine location'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.43
+ NAME 'amavisUncheckedLover'
+ DESC 'Unchecked Files Lover'
+ EQUALITY booleanMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.44
+ NAME 'amavisForwardMethod'
+ DESC 'Forward / next hop destination'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.45
+ NAME 'amavisSaUserConf'
+ DESC 'SpamAssassin user preferences configuration filename'
+ EQUALITY caseExactIA5Match
+ SUBSTR caseExactSubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.46
+ NAME 'amavisSaUserName'
+ DESC 'SpamAssassin username (for Bayes and AWL lookups)'
+ EQUALITY caseExactIA5Match
+ SUBSTR caseExactSubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+#dn: cn=schema
+#changetype: modify
+#add: attributetypes
+attributetype ( 1.3.6.1.4.1.15312.2.2.1.47
+ NAME 'amavisDisclaimerOptions'
+ DESC 'Altermime disclaimer map data'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
+ SINGLE-VALUE )
+
+
+# Classes
+#---------
+
+# amavisAccount
+# This class is an auxiliary class, this mean that the class will be added
+# to a structural class. Usually, the structural class is the class that
+# represent the mail account itself (e.g. an inetOrgPerson)
+
+#dn: cn=schema
+#changetype: modify
+#add: objectclasses
+objectclass ( 1.3.6.1.4.1.15312.2.2.2.1
+ NAME 'amavisAccount' AUXILIARY
+ DESC 'Amavisd Account'
+ SUP top
+ MAY ( amavisVirusLover $ amavisBypassVirusChecks $
+ amavisSpamLover $ amavisBypassSpamChecks $
+ amavisBannedFilesLover $ amavisBypassBannedChecks $
+ amavisBadHeaderLover $ amavisBypassHeaderChecks $
+ amavisSpamTagLevel $ amavisSpamTag2Level $ amavisSpamKillLevel $
+ amavisWhitelistSender $ amavisBlacklistSender $
+ amavisSpamQuarantineTo $ amavisVirusQuarantineTo $
+ amavisBannedQuarantineTo $ amavisBadHeaderQuarantineTo $
+ amavisArchiveQuarantineTo $
+ amavisSpamModifiesSubj $ amavisLocal $ amavisMessageSizeLimit $
+ amavisWarnVirusRecip $ amavisWarnBannedRecip $
+ amavisWarnBadHeaderRecip $ amavisVirusAdmin $ amavisNewVirusAdmin $
+ amavisSpamAdmin $ amavisBannedAdmin $ amavisBadHeaderAdmin $
+ amavisBannedRuleNames $
+ amavisSpamDsnCutoffLevel $ amavisSpamQuarantineCutoffLevel $
+ amavisSpamSubjectTag $ amavisSpamSubjectTag2 $
+ amavisAddrExtensionVirus $ amavisAddrExtensionSpam $
+ amavisAddrExtensionBanned $ amavisAddrExtensionBadHeader $
+ amavisSpamTag3Level $ amavisSpamSubjectTag3 $
+ amavisUncheckedQuarantineTo $ amavisCleanQuarantineTo $
+ amavisUncheckedLover $ amavisForwardMethod $
+ amavisSaUserConf $ amavisSaUserName $ amavisDisclaimerOptions $
+ cn $ description ) )
+
+#--------------------------------------------------------------------------
+#
+# GNU Free Documentation License
+# Version 1.2, November 2002
+#
+#
+# Copyright (C) 2000,2001,2002 Free Software Foundation, Inc.
+# 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+# Everyone is permitted to copy and distribute verbatim copies
+# of this license document, but changing it is not allowed.
+#
+#
+# 0. PREAMBLE
+#
+# The purpose of this License is to make a manual, textbook, or other
+# functional and useful document "free" in the sense of freedom: to
+# assure everyone the effective freedom to copy and redistribute it,
+# with or without modifying it, either commercially or noncommercially.
+# Secondarily, this License preserves for the author and publisher a way
+# to get credit for their work, while not being considered responsible
+# for modifications made by others.
+#
+# This License is a kind of "copyleft", which means that derivative
+# works of the document must themselves be free in the same sense. It
+# complements the GNU General Public License, which is a copyleft
+# license designed for free software.
+#
+# We have designed this License in order to use it for manuals for free
+# software, because free software needs free documentation: a free
+# program should come with manuals providing the same freedoms that the
+# software does. But this License is not limited to software manuals;
+# it can be used for any textual work, regardless of subject matter or
+# whether it is published as a printed book. We recommend this License
+# principally for works whose purpose is instruction or reference.
+#
+#
+# 1. APPLICABILITY AND DEFINITIONS
+#
+# This License applies to any manual or other work, in any medium, that
+# contains a notice placed by the copyright holder saying it can be
+# distributed under the terms of this License. Such a notice grants a
+# world-wide, royalty-free license, unlimited in duration, to use that
+# work under the conditions stated herein. The "Document", below,
+# refers to any such manual or work. Any member of the public is a
+# licensee, and is addressed as "you". You accept the license if you
+# copy, modify or distribute the work in a way requiring permission
+# under copyright law.
+#
+# A "Modified Version" of the Document means any work containing the
+# Document or a portion of it, either copied verbatim, or with
+# modifications and/or translated into another language.
+#
+# A "Secondary Section" is a named appendix or a front-matter section of
+# the Document that deals exclusively with the relationship of the
+# publishers or authors of the Document to the Document's overall subject
+# (or to related matters) and contains nothing that could fall directly
+# within that overall subject. (Thus, if the Document is in part a
+# textbook of mathematics, a Secondary Section may not explain any
+# mathematics.) The relationship could be a matter of historical
+# connection with the subject or with related matters, or of legal,
+# commercial, philosophical, ethical or political position regarding
+# them.
+#
+# The "Invariant Sections" are certain Secondary Sections whose titles
+# are designated, as being those of Invariant Sections, in the notice
+# that says that the Document is released under this License. If a
+# section does not fit the above definition of Secondary then it is not
+# allowed to be designated as Invariant. The Document may contain zero
+# Invariant Sections. If the Document does not identify any Invariant
+# Sections then there are none.
+#
+# The "Cover Texts" are certain short passages of text that are listed,
+# as Front-Cover Texts or Back-Cover Texts, in the notice that says that
+# the Document is released under this License. A Front-Cover Text may
+# be at most 5 words, and a Back-Cover Text may be at most 25 words.
+#
+# A "Transparent" copy of the Document means a machine-readable copy,
+# represented in a format whose specification is available to the
+# general public, that is suitable for revising the document
+# straightforwardly with generic text editors or (for images composed of
+# pixels) generic paint programs or (for drawings) some widely available
+# drawing editor, and that is suitable for input to text formatters or
+# for automatic translation to a variety of formats suitable for input
+# to text formatters. A copy made in an otherwise Transparent file
+# format whose markup, or absence of markup, has been arranged to thwart
+# or discourage subsequent modification by readers is not Transparent.
+# An image format is not Transparent if used for any substantial amount
+# of text. A copy that is not "Transparent" is called "Opaque".
+#
+# Examples of suitable formats for Transparent copies include plain
+# ASCII without markup, Texinfo input format, LaTeX input format, SGML
+# or XML using a publicly available DTD, and standard-conforming simple
+# HTML, PostScript or PDF designed for human modification. Examples of
+# transparent image formats include PNG, XCF and JPG. Opaque formats
+# include proprietary formats that can be read and edited only by
+# proprietary word processors, SGML or XML for which the DTD and/or
+# processing tools are not generally available, and the
+# machine-generated HTML, PostScript or PDF produced by some word
+# processors for output purposes only.
+#
+# The "Title Page" means, for a printed book, the title page itself,
+# plus such following pages as are needed to hold, legibly, the material
+# this License requires to appear in the title page. For works in
+# formats which do not have any title page as such, "Title Page" means
+# the text near the most prominent appearance of the work's title,
+# preceding the beginning of the body of the text.
+#
+# A section "Entitled XYZ" means a named subunit of the Document whose
+# title either is precisely XYZ or contains XYZ in parentheses following
+# text that translates XYZ in another language. (Here XYZ stands for a
+# specific section name mentioned below, such as "Acknowledgements",
+# "Dedications", "Endorsements", or "History".) To "Preserve the Title"
+# of such a section when you modify the Document means that it remains a
+# section "Entitled XYZ" according to this definition.
+#
+# The Document may include Warranty Disclaimers next to the notice which
+# states that this License applies to the Document. These Warranty
+# Disclaimers are considered to be included by reference in this
+# License, but only as regards disclaiming warranties: any other
+# implication that these Warranty Disclaimers may have is void and has
+# no effect on the meaning of this License.
+#
+#
+# 2. VERBATIM COPYING
+#
+# You may copy and distribute the Document in any medium, either
+# commercially or noncommercially, provided that this License, the
+# copyright notices, and the license notice saying this License applies
+# to the Document are reproduced in all copies, and that you add no other
+# conditions whatsoever to those of this License. You may not use
+# technical measures to obstruct or control the reading or further
+# copying of the copies you make or distribute. However, you may accept
+# compensation in exchange for copies. If you distribute a large enough
+# number of copies you must also follow the conditions in section 3.
+#
+# You may also lend copies, under the same conditions stated above, and
+# you may publicly display copies.
+#
+#
+# 3. COPYING IN QUANTITY
+#
+# If you publish printed copies (or copies in media that commonly have
+# printed covers) of the Document, numbering more than 100, and the
+# Document's license notice requires Cover Texts, you must enclose the
+# copies in covers that carry, clearly and legibly, all these Cover
+# Texts: Front-Cover Texts on the front cover, and Back-Cover Texts on
+# the back cover. Both covers must also clearly and legibly identify
+# you as the publisher of these copies. The front cover must present
+# the full title with all words of the title equally prominent and
+# visible. You may add other material on the covers in addition.
+# Copying with changes limited to the covers, as long as they preserve
+# the title of the Document and satisfy these conditions, can be treated
+# as verbatim copying in other respects.
+#
+# If the required texts for either cover are too voluminous to fit
+# legibly, you should put the first ones listed (as many as fit
+# reasonably) on the actual cover, and continue the rest onto adjacent
+# pages.
+#
+# If you publish or distribute Opaque copies of the Document numbering
+# more than 100, you must either include a machine-readable Transparent
+# copy along with each Opaque copy, or state in or with each Opaque copy
+# a computer-network location from which the general network-using
+# public has access to download using public-standard network protocols
+# a complete Transparent copy of the Document, free of added material.
+# If you use the latter option, you must take reasonably prudent steps,
+# when you begin distribution of Opaque copies in quantity, to ensure
+# that this Transparent copy will remain thus accessible at the stated
+# location until at least one year after the last time you distribute an
+# Opaque copy (directly or through your agents or retailers) of that
+# edition to the public.
+#
+# It is requested, but not required, that you contact the authors of the
+# Document well before redistributing any large number of copies, to give
+# them a chance to provide you with an updated version of the Document.
+#
+#
+# 4. MODIFICATIONS
+#
+# You may copy and distribute a Modified Version of the Document under
+# the conditions of sections 2 and 3 above, provided that you release
+# the Modified Version under precisely this License, with the Modified
+# Version filling the role of the Document, thus licensing distribution
+# and modification of the Modified Version to whoever possesses a copy
+# of it. In addition, you must do these things in the Modified Version:
+#
+# A. Use in the Title Page (and on the covers, if any) a title distinct
+# from that of the Document, and from those of previous versions
+# (which should, if there were any, be listed in the History section
+# of the Document). You may use the same title as a previous version
+# if the original publisher of that version gives permission.
+# B. List on the Title Page, as authors, one or more persons or entities
+# responsible for authorship of the modifications in the Modified
+# Version, together with at least five of the principal authors of the
+# Document (all of its principal authors, if it has fewer than five),
+# unless they release you from this requirement.
+# C. State on the Title page the name of the publisher of the
+# Modified Version, as the publisher.
+# D. Preserve all the copyright notices of the Document.
+# E. Add an appropriate copyright notice for your modifications
+# adjacent to the other copyright notices.
+# F. Include, immediately after the copyright notices, a license notice
+# giving the public permission to use the Modified Version under the
+# terms of this License, in the form shown in the Addendum below.
+# G. Preserve in that license notice the full lists of Invariant Sections
+# and required Cover Texts given in the Document's license notice.
+# H. Include an unaltered copy of this License.
+# I. Preserve the section Entitled "History", Preserve its Title, and add
+# to it an item stating at least the title, year, new authors, and
+# publisher of the Modified Version as given on the Title Page. If
+# there is no section Entitled "History" in the Document, create one
+# stating the title, year, authors, and publisher of the Document as
+# given on its Title Page, then add an item describing the Modified
+# Version as stated in the previous sentence.
+# J. Preserve the network location, if any, given in the Document for
+# public access to a Transparent copy of the Document, and likewise
+# the network locations given in the Document for previous versions
+# it was based on. These may be placed in the "History" section.
+# You may omit a network location for a work that was published at
+# least four years before the Document itself, or if the original
+# publisher of the version it refers to gives permission.
+# K. For any section Entitled "Acknowledgements" or "Dedications",
+# Preserve the Title of the section, and preserve in the section all
+# the substance and tone of each of the contributor acknowledgements
+# and/or dedications given therein.
+# L. Preserve all the Invariant Sections of the Document,
+# unaltered in their text and in their titles. Section numbers
+# or the equivalent are not considered part of the section titles.
+# M. Delete any section Entitled "Endorsements". Such a section
+# may not be included in the Modified Version.
+# N. Do not retitle any existing section to be Entitled "Endorsements"
+# or to conflict in title with any Invariant Section.
+# O. Preserve any Warranty Disclaimers.
+#
+# If the Modified Version includes new front-matter sections or
+# appendices that qualify as Secondary Sections and contain no material
+# copied from the Document, you may at your option designate some or all
+# of these sections as invariant. To do this, add their titles to the
+# list of Invariant Sections in the Modified Version's license notice.
+# These titles must be distinct from any other section titles.
+#
+# You may add a section Entitled "Endorsements", provided it contains
+# nothing but endorsements of your Modified Version by various
+# parties--for example, statements of peer review or that the text has
+# been approved by an organization as the authoritative definition of a
+# standard.
+#
+# You may add a passage of up to five words as a Front-Cover Text, and a
+# passage of up to 25 words as a Back-Cover Text, to the end of the list
+# of Cover Texts in the Modified Version. Only one passage of
+# Front-Cover Text and one of Back-Cover Text may be added by (or
+# through arrangements made by) any one entity. If the Document already
+# includes a cover text for the same cover, previously added by you or
+# by arrangement made by the same entity you are acting on behalf of,
+# you may not add another; but you may replace the old one, on explicit
+# permission from the previous publisher that added the old one.
+#
+# The author(s) and publisher(s) of the Document do not by this License
+# give permission to use their names for publicity for or to assert or
+# imply endorsement of any Modified Version.
+#
+#
+# 5. COMBINING DOCUMENTS
+#
+# You may combine the Document with other documents released under this
+# License, under the terms defined in section 4 above for modified
+# versions, provided that you include in the combination all of the
+# Invariant Sections of all of the original documents, unmodified, and
+# list them all as Invariant Sections of your combined work in its
+# license notice, and that you preserve all their Warranty Disclaimers.
+#
+# The combined work need only contain one copy of this License, and
+# multiple identical Invariant Sections may be replaced with a single
+# copy. If there are multiple Invariant Sections with the same name but
+# different contents, make the title of each such section unique by
+# adding at the end of it, in parentheses, the name of the original
+# author or publisher of that section if known, or else a unique number.
+# Make the same adjustment to the section titles in the list of
+# Invariant Sections in the license notice of the combined work.
+#
+# In the combination, you must combine any sections Entitled "History"
+# in the various original documents, forming one section Entitled
+# "History"; likewise combine any sections Entitled "Acknowledgements",
+# and any sections Entitled "Dedications". You must delete all sections
+# Entitled "Endorsements".
+#
+#
+# 6. COLLECTIONS OF DOCUMENTS
+#
+# You may make a collection consisting of the Document and other documents
+# released under this License, and replace the individual copies of this
+# License in the various documents with a single copy that is included in
+# the collection, provided that you follow the rules of this License for
+# verbatim copying of each of the documents in all other respects.
+#
+# You may extract a single document from such a collection, and distribute
+# it individually under this License, provided you insert a copy of this
+# License into the extracted document, and follow this License in all
+# other respects regarding verbatim copying of that document.
+#
+#
+# 7. AGGREGATION WITH INDEPENDENT WORKS
+#
+# A compilation of the Document or its derivatives with other separate
+# and independent documents or works, in or on a volume of a storage or
+# distribution medium, is called an "aggregate" if the copyright
+# resulting from the compilation is not used to limit the legal rights
+# of the compilation's users beyond what the individual works permit.
+# When the Document is included in an aggregate, this License does not
+# apply to the other works in the aggregate which are not themselves
+# derivative works of the Document.
+#
+# If the Cover Text requirement of section 3 is applicable to these
+# copies of the Document, then if the Document is less than one half of
+# the entire aggregate, the Document's Cover Texts may be placed on
+# covers that bracket the Document within the aggregate, or the
+# electronic equivalent of covers if the Document is in electronic form.
+# Otherwise they must appear on printed covers that bracket the whole
+# aggregate.
+#
+#
+# 8. TRANSLATION
+#
+# Translation is considered a kind of modification, so you may
+# distribute translations of the Document under the terms of section 4.
+# Replacing Invariant Sections with translations requires special
+# permission from their copyright holders, but you may include
+# translations of some or all Invariant Sections in addition to the
+# original versions of these Invariant Sections. You may include a
+# translation of this License, and all the license notices in the
+# Document, and any Warranty Disclaimers, provided that you also include
+# the original English version of this License and the original versions
+# of those notices and disclaimers. In case of a disagreement between
+# the translation and the original version of this License or a notice
+# or disclaimer, the original version will prevail.
+#
+# If a section in the Document is Entitled "Acknowledgements",
+# "Dedications", or "History", the requirement (section 4) to Preserve
+# its Title (section 1) will typically require changing the actual
+# title.
+#
+#
+# 9. TERMINATION
+#
+# You may not copy, modify, sublicense, or distribute the Document except
+# as expressly provided for under this License. Any other attempt to
+# copy, modify, sublicense or distribute the Document is void, and will
+# automatically terminate your rights under this License. However,
+# parties who have received copies, or rights, from you under this
+# License will not have their licenses terminated so long as such
+# parties remain in full compliance.
+#
+#
+# 10. FUTURE REVISIONS OF THIS LICENSE
+#
+# The Free Software Foundation may publish new, revised versions
+# of the GNU Free Documentation License from time to time. Such new
+# versions will be similar in spirit to the present version, but may
+# differ in detail to address new problems or concerns. See
+# http://www.gnu.org/copyleft/.
+#
+# Each version of the License is given a distinguishing version number.
+# If the Document specifies that a particular numbered version of this
+# License "or any later version" applies to it, you have the option of
+# following the terms and conditions either of that specified version or
+# of any later version that has been published (not as a draft) by the
+# Free Software Foundation. If the Document does not specify a version
+# number of this License, you may choose any version ever published (not
+# as a draft) by the Free Software Foundation.
diff --git a/logrotate.d/clamav-daemon b/logrotate.d/clamav-daemon
new file mode 100644
index 00000000..8c3c0459
--- /dev/null
+++ b/logrotate.d/clamav-daemon
@@ -0,0 +1,14 @@
+/var/log/clamav/clamav.log {
+ rotate 12
+ weekly
+ compress
+ delaycompress
+ create 640 clamav adm
+ postrotate
+ if [ -d /run/systemd/system ]; then
+ systemctl -q is-active clamav-daemon && systemctl kill --signal=SIGHUP clamav-daemon || true
+ else
+ invoke-rc.d clamav-daemon reload-log > /dev/null || true
+ fi
+ endscript
+ }
diff --git a/logrotate.d/clamav-freshclam b/logrotate.d/clamav-freshclam
new file mode 100644
index 00000000..9e0f2e01
--- /dev/null
+++ b/logrotate.d/clamav-freshclam
@@ -0,0 +1,15 @@
+/var/log/clamav/freshclam.log {
+ rotate 12
+ weekly
+ compress
+ delaycompress
+ missingok
+ create 640 clamav adm
+ postrotate
+ if [ -d /run/systemd/system ]; then
+ systemctl -q is-active clamav-freshclam && systemctl kill --signal=SIGHUP clamav-freshclam || true
+ else
+ invoke-rc.d clamav-freshclam reload-log > /dev/null || true
+ fi
+ endscript
+ }
diff --git a/logrotate.d/php8.0-fpm b/logrotate.d/php8.0-fpm
new file mode 100644
index 00000000..793a4b8d
--- /dev/null
+++ b/logrotate.d/php8.0-fpm
@@ -0,0 +1,13 @@
+/var/log/php8.0-fpm.log {
+ rotate 12
+ weekly
+ missingok
+ notifempty
+ compress
+ delaycompress
+ postrotate
+ if [ -x /usr/lib/php/php8.0-fpm-reopenlogs ]; then
+ /usr/lib/php/php8.0-fpm-reopenlogs;
+ fi
+ endscript
+}
diff --git a/logrotate.d/rkhunter b/logrotate.d/rkhunter
new file mode 100644
index 00000000..00ac5d64
--- /dev/null
+++ b/logrotate.d/rkhunter
@@ -0,0 +1,9 @@
+/var/log/rkhunter.log {
+ weekly
+ missingok
+ rotate 4
+ compress
+ delaycompress
+ notifempty
+ create 640 root adm
+}
diff --git a/logrotate.d/rspamd b/logrotate.d/rspamd
new file mode 100644
index 00000000..f486a473
--- /dev/null
+++ b/logrotate.d/rspamd
@@ -0,0 +1,12 @@
+/var/log/rspamd/rspamd.log{
+ daily
+ rotate 4
+ delaycompress
+ compress
+ notifempty
+ missingok
+ postrotate
+ if [ -f /bin/systemctl ] ; then systemctl --signal USR1 kill rspamd.service ; else service rspamd reopenlog >/dev/null 2>&1 ; fi || true
+ endscript
+}
+
diff --git a/mail/m4/opendkim.m4 b/mail/m4/opendkim.m4
new file mode 100644
index 00000000..f9f9bbf1
--- /dev/null
+++ b/mail/m4/opendkim.m4
@@ -0,0 +1,2 @@
+INPUT_MAIL_FILTER(`opendkim',
+ `S=local:/run/opendkim/opendkim.sock, F=, T=S:4m;R:4m;E:10m')dnl
diff --git a/modprobe.d/dkms.conf b/modprobe.d/dkms.conf
new file mode 100644
index 00000000..508b7f4c
--- /dev/null
+++ b/modprobe.d/dkms.conf
@@ -0,0 +1,4 @@
+# modprobe information used for DKMS modules
+#
+# This is a stub file, should be edited when needed,
+# used by default by DKMS.
diff --git a/network/if-down.d/clamav-freshclam-ifupdown b/network/if-down.d/clamav-freshclam-ifupdown
new file mode 100755
index 00000000..875c0cca
--- /dev/null
+++ b/network/if-down.d/clamav-freshclam-ifupdown
@@ -0,0 +1,78 @@
+#!/bin/sh
+# 2004-01-25, Thomas Lamy
+# From Magnus Ekdahl's clamav-freshclam-handledaemon(8)
+
+set -e
+
+[ -e /var/lib/clamav/interface ] || exit 0
+
+INIT=invoke-rc.d clamav-freshclam
+CLAMAV_CONF_FILE=/etc/clamav/clamd.conf
+FRESHCLAM_CONF_FILE=/etc/clamav/freshclam.conf
+
+INTERNETIFACE=`cat /var/lib/clamav/interface`
+
+if grep -q freshclam /proc/*/stat 2>/dev/null; then
+ IS_RUNNING=true
+else
+ IS_RUNNING=false
+fi
+
+# $IFACE is set by ifup/down, $PPP_IFACE by pppd
+[ -n "$PPP_IFACE" ] && IFACE=$PPP_IFACE
+
+# This is sloppy - woody's pppd exports variables, while sid's passes them as
+# arguments and exports them.
+
+if [ "$1" = "$IFACE" ]; then # We're called by sid's pppd
+ shift 6 # and we already know the interface
+fi # Dump the arguments passed.
+
+if [ -z "$1" ]; then
+ case $(dirname "$0") in
+ */if-up.d|*/ip-up.d)
+ # Short circuit and exit early if freshclam is already running
+ [ "$IS_RUNNING" = 'true' ] && exit 0
+ for interface in $INTERNETIFACE; do
+ if [ "$interface" = "$IFACE" ]; then
+ FMODE=start
+ break
+ else
+ FMODE=skip
+ fi
+ done
+ ;;
+ */if-down.d|*/ip-down.d)
+ # Short circuit and exit early if freshclam is not already running
+ [ "$IS_RUNNING" = 'false' ] && exit 0
+ for interface in $INTERNETIFACE; do
+ if [ "$interface" = "$IFACE" ]; then
+ FMODE=stop
+ break
+ else
+ FMODE=skip
+ fi
+ done
+ ;;
+ *)
+ FMODE=skip
+ ;;
+ esac
+else
+ FMODE="$1"
+fi
+
+case "$FMODE" in
+ start|stop)
+ IFACE="$IFACE" $INIT $FMODE
+ ;;
+ skip)
+ ;;
+ *)
+ echo "Usage: $0 {start|stop|skip}" >&2
+ exit 1
+ ;;
+esac
+
+exit 0
+
diff --git a/network/if-down.d/postfix b/network/if-down.d/postfix
new file mode 100755
index 00000000..41015548
--- /dev/null
+++ b/network/if-down.d/postfix
@@ -0,0 +1,34 @@
+#!/bin/sh -e
+
+# Called when an interface disconnects
+# Written by LaMont Jones
+
+# start or reload Postfix as needed
+
+# If /usr isn't mounted yet, silently bail.
+if [ ! -d /usr/lib/postfix ]; then
+ exit 0
+fi
+
+RUNNING=""
+# If master is running, force a queue run to unload any mail that is
+# hanging around. Yes, sendmail is a symlink...
+if [ -f /var/spool/postfix/pid/master.pid ]; then
+ pid=$(sed 's/ //g' /var/spool/postfix/pid/master.pid)
+ exe=$(ls -l /proc/$pid/exe 2>/dev/null | sed 's/.* //;s/.*\///')
+ if [ "X$exe" = "Xmaster" ]; then
+ RUNNING="y"
+ fi
+fi
+
+if [ ! -x /sbin/resolvconf ]; then
+ f=/etc/resolv.conf
+ if ! cp $f $(postconf -hx queue_directory)$f 2>/dev/null; then
+ exit 0
+ fi
+ if [ -n "$RUNNING" ]; then
+ service postfix reload >/dev/null 2>&1
+ fi
+fi
+
+exit 0
diff --git a/network/if-up.d/clamav-freshclam-ifupdown b/network/if-up.d/clamav-freshclam-ifupdown
new file mode 100755
index 00000000..875c0cca
--- /dev/null
+++ b/network/if-up.d/clamav-freshclam-ifupdown
@@ -0,0 +1,78 @@
+#!/bin/sh
+# 2004-01-25, Thomas Lamy
+# From Magnus Ekdahl's clamav-freshclam-handledaemon(8)
+
+set -e
+
+[ -e /var/lib/clamav/interface ] || exit 0
+
+INIT=invoke-rc.d clamav-freshclam
+CLAMAV_CONF_FILE=/etc/clamav/clamd.conf
+FRESHCLAM_CONF_FILE=/etc/clamav/freshclam.conf
+
+INTERNETIFACE=`cat /var/lib/clamav/interface`
+
+if grep -q freshclam /proc/*/stat 2>/dev/null; then
+ IS_RUNNING=true
+else
+ IS_RUNNING=false
+fi
+
+# $IFACE is set by ifup/down, $PPP_IFACE by pppd
+[ -n "$PPP_IFACE" ] && IFACE=$PPP_IFACE
+
+# This is sloppy - woody's pppd exports variables, while sid's passes them as
+# arguments and exports them.
+
+if [ "$1" = "$IFACE" ]; then # We're called by sid's pppd
+ shift 6 # and we already know the interface
+fi # Dump the arguments passed.
+
+if [ -z "$1" ]; then
+ case $(dirname "$0") in
+ */if-up.d|*/ip-up.d)
+ # Short circuit and exit early if freshclam is already running
+ [ "$IS_RUNNING" = 'true' ] && exit 0
+ for interface in $INTERNETIFACE; do
+ if [ "$interface" = "$IFACE" ]; then
+ FMODE=start
+ break
+ else
+ FMODE=skip
+ fi
+ done
+ ;;
+ */if-down.d|*/ip-down.d)
+ # Short circuit and exit early if freshclam is not already running
+ [ "$IS_RUNNING" = 'false' ] && exit 0
+ for interface in $INTERNETIFACE; do
+ if [ "$interface" = "$IFACE" ]; then
+ FMODE=stop
+ break
+ else
+ FMODE=skip
+ fi
+ done
+ ;;
+ *)
+ FMODE=skip
+ ;;
+ esac
+else
+ FMODE="$1"
+fi
+
+case "$FMODE" in
+ start|stop)
+ IFACE="$IFACE" $INIT $FMODE
+ ;;
+ skip)
+ ;;
+ *)
+ echo "Usage: $0 {start|stop|skip}" >&2
+ exit 1
+ ;;
+esac
+
+exit 0
+
diff --git a/network/if-up.d/postfix b/network/if-up.d/postfix
new file mode 100755
index 00000000..f1203ffa
--- /dev/null
+++ b/network/if-up.d/postfix
@@ -0,0 +1,43 @@
+#!/bin/sh -e
+# Called when a new interface comes up
+# Written by LaMont Jones
+
+# don't bother to restart postfix when lo is configured.
+if [ "$IFACE" = "lo" ]; then
+ exit 0
+fi
+
+# If /usr isn't mounted yet, silently bail.
+if [ ! -d /usr/lib/postfix ]; then
+ exit 0
+fi
+
+RUNNING=""
+# If master is running, force a queue run to unload any mail that is
+# hanging around. Yes, sendmail is a symlink...
+if [ -f /var/spool/postfix/pid/master.pid ]; then
+ pid=$(sed 's/ //g' /var/spool/postfix/pid/master.pid)
+ exe=$(ls -l /proc/$pid/exe 2>/dev/null | sed 's/.* //;s/.*\///')
+ if [ "X$exe" = "Xmaster" ]; then
+ RUNNING="y"
+ fi
+fi
+
+# start or reload Postfix as needed
+if [ ! -x /sbin/resolvconf ]; then
+ f=/etc/resolv.conf
+ if ! cp $f $(postconf -hx queue_directory)$f 2>/dev/null; then
+ exit 0
+ fi
+ if [ -n "$RUNNING" ]; then
+ service postfix reload >/dev/null 2>&1
+ fi
+fi
+
+# If master is running, force a queue run to unload any mail that is
+# hanging around. Yes, sendmail is a symlink...
+if [ -n "$RUNNING" ]; then
+ if [ -x /usr/sbin/sendmail ]; then
+ /usr/sbin/sendmail -q >/dev/null 2>&1
+ fi
+fi
diff --git a/ntp.conf b/ntp.conf
new file mode 100644
index 00000000..d473b432
--- /dev/null
+++ b/ntp.conf
@@ -0,0 +1,60 @@
+# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help
+
+driftfile /var/lib/ntp/ntp.drift
+
+# Leap seconds definition provided by tzdata
+leapfile /usr/share/zoneinfo/leap-seconds.list
+
+# Enable this if you want statistics to be logged.
+#statsdir /var/log/ntpstats/
+
+statistics loopstats peerstats clockstats
+filegen loopstats file loopstats type day enable
+filegen peerstats file peerstats type day enable
+filegen clockstats file clockstats type day enable
+
+
+# You do need to talk to an NTP server or two (or three).
+#server ntp.your-provider.example
+
+# pool.ntp.org maps to about 1000 low-stratum NTP servers. Your server will
+# pick a different set every time it starts up. Please consider joining the
+# pool:
+pool 0.debian.pool.ntp.org iburst
+pool 1.debian.pool.ntp.org iburst
+pool 2.debian.pool.ntp.org iburst
+pool 3.debian.pool.ntp.org iburst
+
+
+# Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for
+# details. The web page
+# might also be helpful.
+#
+# Note that "restrict" applies to both servers and clients, so a configuration
+# that might be intended to block requests from certain clients could also end
+# up blocking replies from your own upstream servers.
+
+# By default, exchange time with everybody, but don't allow configuration.
+restrict -4 default kod notrap nomodify nopeer noquery limited
+restrict -6 default kod notrap nomodify nopeer noquery limited
+
+# Local users may interrogate the ntp server more closely.
+restrict 127.0.0.1
+restrict ::1
+
+# Needed for adding pool entries
+restrict source notrap nomodify noquery
+
+# Clients from this (example!) subnet have unlimited access, but only if
+# cryptographically authenticated.
+#restrict 192.168.123.0 mask 255.255.255.0 notrust
+
+
+# If you want to provide time to your local subnet, change the next line.
+# (Again, the address is an example only.)
+#broadcast 192.168.123.255
+
+# If you want to listen to time broadcasts on your local subnet, de-comment the
+# next lines. Please do this only if you trust everybody on the network!
+#disable auth
+#broadcastclient
diff --git a/pam.d/dovecot b/pam.d/dovecot
new file mode 100644
index 00000000..34434343
--- /dev/null
+++ b/pam.d/dovecot
@@ -0,0 +1,6 @@
+#%PAM-1.0
+
+@include common-auth
+@include common-account
+@include common-session
+
diff --git a/passwd b/passwd
index b275c7d1..2484bcce 100644
--- a/passwd
+++ b/passwd
@@ -26,3 +26,13 @@ systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
caelebfi:x:1000:1000:Gorden Mende,,,:/home/caelebfi:/bin/bash
mysql:x:106:112:MySQL Server,,,:/nonexistent:/bin/false
redis:x:107:113::/var/lib/redis:/usr/sbin/nologin
+ntp:x:108:115::/nonexistent:/usr/sbin/nologin
+postfix:x:109:116::/var/spool/postfix:/usr/sbin/nologin
+_rspamd:x:110:119:rspamd spam filtering system,,,:/var/lib/rspamd:/usr/sbin/nologin
+clamav:x:111:120::/var/lib/clamav:/bin/false
+dovecot:x:112:121:Dovecot mail server,,,:/usr/lib/dovecot:/usr/sbin/nologin
+dovenull:x:113:122:Dovecot login user,,,:/nonexistent:/usr/sbin/nologin
+opendkim:x:114:123::/run/opendkim:/usr/sbin/nologin
+postgrey:x:115:124::/var/lib/postgrey:/usr/sbin/nologin
+amavis:x:116:125:AMaViS system user,,,:/var/lib/amavis:/bin/sh
+vmail:x:5000:5000::/var/opt/vmail:/bin/false
diff --git a/passwd- b/passwd-
index b275c7d1..9b94e455 100644
--- a/passwd-
+++ b/passwd-
@@ -26,3 +26,12 @@ systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
caelebfi:x:1000:1000:Gorden Mende,,,:/home/caelebfi:/bin/bash
mysql:x:106:112:MySQL Server,,,:/nonexistent:/bin/false
redis:x:107:113::/var/lib/redis:/usr/sbin/nologin
+ntp:x:108:115::/nonexistent:/usr/sbin/nologin
+postfix:x:109:116::/var/spool/postfix:/usr/sbin/nologin
+_rspamd:x:110:119:rspamd spam filtering system,,,:/var/lib/rspamd:/usr/sbin/nologin
+clamav:x:111:120::/var/lib/clamav:/bin/false
+dovecot:x:112:121:Dovecot mail server,,,:/usr/lib/dovecot:/usr/sbin/nologin
+dovenull:x:113:122:Dovecot login user,,,:/nonexistent:/usr/sbin/nologin
+opendkim:x:114:123::/run/opendkim:/usr/sbin/nologin
+postgrey:x:115:124::/var/lib/postgrey:/usr/sbin/nologin
+amavis:x:116:125::/var/lib/amavis:/bin/sh
diff --git a/php/8.0/cgi/conf.d/10-mysqlnd.ini b/php/8.0/cgi/conf.d/10-mysqlnd.ini
new file mode 120000
index 00000000..c6f288de
--- /dev/null
+++ b/php/8.0/cgi/conf.d/10-mysqlnd.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/mysqlnd.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/10-opcache.ini b/php/8.0/cgi/conf.d/10-opcache.ini
new file mode 120000
index 00000000..fecc3619
--- /dev/null
+++ b/php/8.0/cgi/conf.d/10-opcache.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/opcache.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/10-pdo.ini b/php/8.0/cgi/conf.d/10-pdo.ini
new file mode 120000
index 00000000..8fd9b449
--- /dev/null
+++ b/php/8.0/cgi/conf.d/10-pdo.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/pdo.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/15-xml.ini b/php/8.0/cgi/conf.d/15-xml.ini
new file mode 120000
index 00000000..f55c6223
--- /dev/null
+++ b/php/8.0/cgi/conf.d/15-xml.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/xml.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-apcu.ini b/php/8.0/cgi/conf.d/20-apcu.ini
new file mode 120000
index 00000000..e00466dd
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-apcu.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/apcu.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-bcmath.ini b/php/8.0/cgi/conf.d/20-bcmath.ini
new file mode 120000
index 00000000..e8d0c347
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-bcmath.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/bcmath.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-calendar.ini b/php/8.0/cgi/conf.d/20-calendar.ini
new file mode 120000
index 00000000..2e6b6d5c
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-calendar.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/calendar.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-ctype.ini b/php/8.0/cgi/conf.d/20-ctype.ini
new file mode 120000
index 00000000..dada7c5b
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-ctype.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/ctype.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-curl.ini b/php/8.0/cgi/conf.d/20-curl.ini
new file mode 120000
index 00000000..e3fc3f54
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-curl.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/curl.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-dom.ini b/php/8.0/cgi/conf.d/20-dom.ini
new file mode 120000
index 00000000..40774d9e
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-dom.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/dom.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-exif.ini b/php/8.0/cgi/conf.d/20-exif.ini
new file mode 120000
index 00000000..2eef9bcc
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-exif.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/exif.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-ffi.ini b/php/8.0/cgi/conf.d/20-ffi.ini
new file mode 120000
index 00000000..8411bf9e
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-ffi.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/ffi.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-fileinfo.ini b/php/8.0/cgi/conf.d/20-fileinfo.ini
new file mode 120000
index 00000000..622b85f0
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-fileinfo.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/fileinfo.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-ftp.ini b/php/8.0/cgi/conf.d/20-ftp.ini
new file mode 120000
index 00000000..f7d9df98
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-ftp.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/ftp.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-gd.ini b/php/8.0/cgi/conf.d/20-gd.ini
new file mode 120000
index 00000000..1cb1b152
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-gd.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/gd.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-gettext.ini b/php/8.0/cgi/conf.d/20-gettext.ini
new file mode 120000
index 00000000..23965654
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-gettext.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/gettext.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-gmp.ini b/php/8.0/cgi/conf.d/20-gmp.ini
new file mode 120000
index 00000000..a1db39b9
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-gmp.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/gmp.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-iconv.ini b/php/8.0/cgi/conf.d/20-iconv.ini
new file mode 120000
index 00000000..94936700
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-iconv.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/iconv.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-igbinary.ini b/php/8.0/cgi/conf.d/20-igbinary.ini
new file mode 120000
index 00000000..87ab2ad5
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-igbinary.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/igbinary.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-imagick.ini b/php/8.0/cgi/conf.d/20-imagick.ini
new file mode 120000
index 00000000..47df7c5c
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-imagick.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/imagick.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-imap.ini b/php/8.0/cgi/conf.d/20-imap.ini
new file mode 120000
index 00000000..660926c0
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-imap.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/imap.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-intl.ini b/php/8.0/cgi/conf.d/20-intl.ini
new file mode 120000
index 00000000..664616e7
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-intl.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/intl.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-mbstring.ini b/php/8.0/cgi/conf.d/20-mbstring.ini
new file mode 120000
index 00000000..0966516a
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-mbstring.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/mbstring.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-memcache.ini b/php/8.0/cgi/conf.d/20-memcache.ini
new file mode 120000
index 00000000..3bf8c63a
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-memcache.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/memcache.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-msgpack.ini b/php/8.0/cgi/conf.d/20-msgpack.ini
new file mode 120000
index 00000000..e8e9070d
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-msgpack.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/msgpack.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-mysqli.ini b/php/8.0/cgi/conf.d/20-mysqli.ini
new file mode 120000
index 00000000..c1d93077
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-mysqli.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/mysqli.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-pdo_mysql.ini b/php/8.0/cgi/conf.d/20-pdo_mysql.ini
new file mode 120000
index 00000000..158feec7
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-pdo_mysql.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/pdo_mysql.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-phar.ini b/php/8.0/cgi/conf.d/20-phar.ini
new file mode 120000
index 00000000..7e6b6445
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-phar.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/phar.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-posix.ini b/php/8.0/cgi/conf.d/20-posix.ini
new file mode 120000
index 00000000..07e0ec0f
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-posix.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/posix.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-readline.ini b/php/8.0/cgi/conf.d/20-readline.ini
new file mode 120000
index 00000000..64b2d668
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-readline.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/readline.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-redis.ini b/php/8.0/cgi/conf.d/20-redis.ini
new file mode 120000
index 00000000..254a1a85
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-redis.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/redis.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-shmop.ini b/php/8.0/cgi/conf.d/20-shmop.ini
new file mode 120000
index 00000000..596d4e46
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-shmop.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/shmop.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-simplexml.ini b/php/8.0/cgi/conf.d/20-simplexml.ini
new file mode 120000
index 00000000..673f042c
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-simplexml.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/simplexml.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-sockets.ini b/php/8.0/cgi/conf.d/20-sockets.ini
new file mode 120000
index 00000000..07e33d16
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-sockets.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/sockets.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-sysvmsg.ini b/php/8.0/cgi/conf.d/20-sysvmsg.ini
new file mode 120000
index 00000000..ad0e27ae
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-sysvmsg.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/sysvmsg.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-sysvsem.ini b/php/8.0/cgi/conf.d/20-sysvsem.ini
new file mode 120000
index 00000000..e685f60b
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-sysvsem.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/sysvsem.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-sysvshm.ini b/php/8.0/cgi/conf.d/20-sysvshm.ini
new file mode 120000
index 00000000..f6203f66
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-sysvshm.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/sysvshm.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-tokenizer.ini b/php/8.0/cgi/conf.d/20-tokenizer.ini
new file mode 120000
index 00000000..4716ffc0
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-tokenizer.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/tokenizer.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-xmlreader.ini b/php/8.0/cgi/conf.d/20-xmlreader.ini
new file mode 120000
index 00000000..4944a68b
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-xmlreader.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/xmlreader.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-xmlwriter.ini b/php/8.0/cgi/conf.d/20-xmlwriter.ini
new file mode 120000
index 00000000..eb9eeab7
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-xmlwriter.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/xmlwriter.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-xsl.ini b/php/8.0/cgi/conf.d/20-xsl.ini
new file mode 120000
index 00000000..97289413
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-xsl.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/xsl.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/20-zip.ini b/php/8.0/cgi/conf.d/20-zip.ini
new file mode 120000
index 00000000..0c5b7148
--- /dev/null
+++ b/php/8.0/cgi/conf.d/20-zip.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/zip.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/conf.d/25-memcached.ini b/php/8.0/cgi/conf.d/25-memcached.ini
new file mode 120000
index 00000000..f3d32df0
--- /dev/null
+++ b/php/8.0/cgi/conf.d/25-memcached.ini
@@ -0,0 +1 @@
+/etc/php/8.0/mods-available/memcached.ini
\ No newline at end of file
diff --git a/php/8.0/cgi/php.ini b/php/8.0/cgi/php.ini
new file mode 100644
index 00000000..65e2ab99
--- /dev/null
+++ b/php/8.0/cgi/php.ini
@@ -0,0 +1,1946 @@
+[PHP]
+
+;;;;;;;;;;;;;;;;;;;
+; About php.ini ;
+;;;;;;;;;;;;;;;;;;;
+; PHP's initialization file, generally called php.ini, is responsible for
+; configuring many of the aspects of PHP's behavior.
+
+; PHP attempts to find and load this configuration from a number of locations.
+; The following is a summary of its search order:
+; 1. SAPI module specific location.
+; 2. The PHPRC environment variable. (As of PHP 5.2.0)
+; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)
+; 4. Current working directory (except CLI)
+; 5. The web server's directory (for SAPI modules), or directory of PHP
+; (otherwise in Windows)
+; 6. The directory from the --with-config-file-path compile time option, or the
+; Windows directory (usually C:\windows)
+; See the PHP docs for more specific information.
+; http://php.net/configuration.file
+
+; The syntax of the file is extremely simple. Whitespace and lines
+; beginning with a semicolon are silently ignored (as you probably guessed).
+; Section headers (e.g. [Foo]) are also silently ignored, even though
+; they might mean something in the future.
+
+; Directives following the section heading [PATH=/www/mysite] only
+; apply to PHP files in the /www/mysite directory. Directives
+; following the section heading [HOST=www.example.com] only apply to
+; PHP files served from www.example.com. Directives set in these
+; special sections cannot be overridden by user-defined INI files or
+; at runtime. Currently, [PATH=] and [HOST=] sections only work under
+; CGI/FastCGI.
+; http://php.net/ini.sections
+
+; Directives are specified using the following syntax:
+; directive = value
+; Directive names are *case sensitive* - foo=bar is different from FOO=bar.
+; Directives are variables used to configure PHP or PHP extensions.
+; There is no name validation. If PHP can't find an expected
+; directive because it is not set or is mistyped, a default value will be used.
+
+; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one
+; of the INI constants (On, Off, True, False, Yes, No and None) or an expression
+; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a
+; previously set variable or directive (e.g. ${foo})
+
+; Expressions in the INI file are limited to bitwise operators and parentheses:
+; | bitwise OR
+; ^ bitwise XOR
+; & bitwise AND
+; ~ bitwise NOT
+; ! boolean NOT
+
+; Boolean flags can be turned on using the values 1, On, True or Yes.
+; They can be turned off using the values 0, Off, False or No.
+
+; An empty string can be denoted by simply not writing anything after the equal
+; sign, or by using the None keyword:
+
+; foo = ; sets foo to an empty string
+; foo = None ; sets foo to an empty string
+; foo = "None" ; sets foo to the string 'None'
+
+; If you use constants in your value, and these constants belong to a
+; dynamically loaded extension (either a PHP extension or a Zend extension),
+; you may only use these constants *after* the line that loads the extension.
+
+;;;;;;;;;;;;;;;;;;;
+; About this file ;
+;;;;;;;;;;;;;;;;;;;
+; PHP comes packaged with two INI files. One that is recommended to be used
+; in production environments and one that is recommended to be used in
+; development environments.
+
+; php.ini-production contains settings which hold security, performance and
+; best practices at its core. But please be aware, these settings may break
+; compatibility with older or less security conscience applications. We
+; recommending using the production ini in production and testing environments.
+
+; php.ini-development is very similar to its production variant, except it is
+; much more verbose when it comes to errors. We recommend using the
+; development version only in development environments, as errors shown to
+; application users can inadvertently leak otherwise secure information.
+
+; This is the php.ini-production INI file.
+
+;;;;;;;;;;;;;;;;;;;
+; Quick Reference ;
+;;;;;;;;;;;;;;;;;;;
+
+; The following are all the settings which are different in either the production
+; or development versions of the INIs with respect to PHP's default behavior.
+; Please see the actual settings later in the document for more details as to why
+; we recommend these changes in PHP's behavior.
+
+; display_errors
+; Default Value: On
+; Development Value: On
+; Production Value: Off
+
+; display_startup_errors
+; Default Value: On
+; Development Value: On
+; Production Value: Off
+
+; error_reporting
+; Default Value: E_ALL
+; Development Value: E_ALL
+; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT
+
+; log_errors
+; Default Value: Off
+; Development Value: On
+; Production Value: On
+
+; max_input_time
+; Default Value: -1 (Unlimited)
+; Development Value: 60 (60 seconds)
+; Production Value: 60 (60 seconds)
+
+; output_buffering
+; Default Value: Off
+; Development Value: 4096
+; Production Value: 4096
+
+; register_argc_argv
+; Default Value: On
+; Development Value: Off
+; Production Value: Off
+
+; request_order
+; Default Value: None
+; Development Value: "GP"
+; Production Value: "GP"
+
+; session.gc_divisor
+; Default Value: 100
+; Development Value: 1000
+; Production Value: 1000
+
+; session.sid_bits_per_character
+; Default Value: 4
+; Development Value: 5
+; Production Value: 5
+
+; short_open_tag
+; Default Value: On
+; Development Value: Off
+; Production Value: Off
+
+; variables_order
+; Default Value: "EGPCS"
+; Development Value: "GPCS"
+; Production Value: "GPCS"
+
+; zend.exception_ignore_args
+; Default Value: Off
+; Development Value: Off
+; Production Value: On
+
+; zend.exception_string_param_max_len
+; Default Value: 15
+; Development Value: 15
+; Production Value: 0
+
+;;;;;;;;;;;;;;;;;;;;
+; php.ini Options ;
+;;;;;;;;;;;;;;;;;;;;
+; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini"
+;user_ini.filename = ".user.ini"
+
+; To disable this feature set this option to an empty value
+;user_ini.filename =
+
+; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)
+;user_ini.cache_ttl = 300
+
+;;;;;;;;;;;;;;;;;;;;
+; Language Options ;
+;;;;;;;;;;;;;;;;;;;;
+
+; Enable the PHP scripting language engine under Apache.
+; http://php.net/engine
+engine = On
+
+; This directive determines whether or not PHP will recognize code between
+; tags as PHP source which should be processed as such. It is
+; generally recommended that should be used and that this feature
+; should be disabled, as enabling it may result in issues when generating XML
+; documents, however this remains supported for backward compatibility reasons.
+; Note that this directive does not control the would work.
+; http://php.net/syntax-highlighting
+;highlight.string = #DD0000
+;highlight.comment = #FF9900
+;highlight.keyword = #007700
+;highlight.default = #0000BB
+;highlight.html = #000000
+
+; If enabled, the request will be allowed to complete even if the user aborts
+; the request. Consider enabling it if executing long requests, which may end up
+; being interrupted by the user or a browser timing out. PHP's default behavior
+; is to disable this feature.
+; http://php.net/ignore-user-abort
+;ignore_user_abort = On
+
+; Determines the size of the realpath cache to be used by PHP. This value should
+; be increased on systems where PHP opens many files to reflect the quantity of
+; the file operations performed.
+; Note: if open_basedir is set, the cache is disabled
+; http://php.net/realpath-cache-size
+;realpath_cache_size = 4096k
+
+; Duration of time, in seconds for which to cache realpath information for a given
+; file or directory. For systems with rarely changing files, consider increasing this
+; value.
+; http://php.net/realpath-cache-ttl
+;realpath_cache_ttl = 120
+
+; Enables or disables the circular reference collector.
+; http://php.net/zend.enable-gc
+zend.enable_gc = On
+
+; If enabled, scripts may be written in encodings that are incompatible with
+; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such
+; encodings. To use this feature, mbstring extension must be enabled.
+;zend.multibyte = Off
+
+; Allows to set the default encoding for the scripts. This value will be used
+; unless "declare(encoding=...)" directive appears at the top of the script.
+; Only affects if zend.multibyte is set.
+;zend.script_encoding =
+
+; Allows to include or exclude arguments from stack traces generated for exceptions.
+; In production, it is recommended to turn this setting on to prohibit the output
+; of sensitive information in stack traces
+; Default Value: Off
+; Development Value: Off
+; Production Value: On
+zend.exception_ignore_args = On
+
+; Allows setting the maximum string length in an argument of a stringified stack trace
+; to a value between 0 and 1000000.
+; This has no effect when zend.exception_ignore_args is enabled.
+; Default Value: 15
+; Development Value: 15
+; Production Value: 0
+; In production, it is recommended to set this to 0 to reduce the output
+; of sensitive information in stack traces.
+zend.exception_string_param_max_len = 0
+
+;;;;;;;;;;;;;;;;;
+; Miscellaneous ;
+;;;;;;;;;;;;;;;;;
+
+; Decides whether PHP may expose the fact that it is installed on the server
+; (e.g. by adding its signature to the Web server header). It is no security
+; threat in any way, but it makes it possible to determine whether you use PHP
+; on your server or not.
+; http://php.net/expose-php
+expose_php = Off
+
+;;;;;;;;;;;;;;;;;;;
+; Resource Limits ;
+;;;;;;;;;;;;;;;;;;;
+
+; Maximum execution time of each script, in seconds
+; http://php.net/max-execution-time
+; Note: This directive is hardcoded to 0 for the CLI SAPI
+max_execution_time = 30
+
+; Maximum amount of time each script may spend parsing request data. It's a good
+; idea to limit this time on productions servers in order to eliminate unexpectedly
+; long running scripts.
+; Note: This directive is hardcoded to -1 for the CLI SAPI
+; Default Value: -1 (Unlimited)
+; Development Value: 60 (60 seconds)
+; Production Value: 60 (60 seconds)
+; http://php.net/max-input-time
+max_input_time = 60
+
+; Maximum input variable nesting level
+; http://php.net/max-input-nesting-level
+;max_input_nesting_level = 64
+
+; How many GET/POST/COOKIE input variables may be accepted
+;max_input_vars = 1000
+
+; Maximum amount of memory a script may consume
+; http://php.net/memory-limit
+memory_limit = 128M
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+; Error handling and logging ;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+; This directive informs PHP of which errors, warnings and notices you would like
+; it to take action for. The recommended way of setting values for this
+; directive is through the use of the error level constants and bitwise
+; operators. The error level constants are below here for convenience as well as
+; some common settings and their meanings.
+; By default, PHP is set to take action on all errors, notices and warnings EXCEPT
+; those related to E_NOTICE and E_STRICT, which together cover best practices and
+; recommended coding standards in PHP. For performance reasons, this is the
+; recommend error reporting setting. Your production server shouldn't be wasting
+; resources complaining about best practices and coding standards. That's what
+; development servers and development settings are for.
+; Note: The php.ini-development file has this setting as E_ALL. This
+; means it pretty much reports everything which is exactly what you want during
+; development and early testing.
+;
+; Error Level Constants:
+; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)
+; E_ERROR - fatal run-time errors
+; E_RECOVERABLE_ERROR - almost fatal run-time errors
+; E_WARNING - run-time warnings (non-fatal errors)
+; E_PARSE - compile-time parse errors
+; E_NOTICE - run-time notices (these are warnings which often result
+; from a bug in your code, but it's possible that it was
+; intentional (e.g., using an uninitialized variable and
+; relying on the fact it is automatically initialized to an
+; empty string)
+; E_STRICT - run-time notices, enable to have PHP suggest changes
+; to your code which will ensure the best interoperability
+; and forward compatibility of your code
+; E_CORE_ERROR - fatal errors that occur during PHP's initial startup
+; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's
+; initial startup
+; E_COMPILE_ERROR - fatal compile-time errors
+; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)
+; E_USER_ERROR - user-generated error message
+; E_USER_WARNING - user-generated warning message
+; E_USER_NOTICE - user-generated notice message
+; E_DEPRECATED - warn about code that will not work in future versions
+; of PHP
+; E_USER_DEPRECATED - user-generated deprecation warnings
+;
+; Common Values:
+; E_ALL (Show all errors, warnings and notices including coding standards.)
+; E_ALL & ~E_NOTICE (Show all errors, except for notices)
+; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)
+; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)
+; Default Value: E_ALL
+; Development Value: E_ALL
+; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT
+; http://php.net/error-reporting
+error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
+
+; This directive controls whether or not and where PHP will output errors,
+; notices and warnings too. Error output is very useful during development, but
+; it could be very dangerous in production environments. Depending on the code
+; which is triggering the error, sensitive information could potentially leak
+; out of your application such as database usernames and passwords or worse.
+; For production environments, we recommend logging errors rather than
+; sending them to STDOUT.
+; Possible Values:
+; Off = Do not display any errors
+; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)
+; On or stdout = Display errors to STDOUT
+; Default Value: On
+; Development Value: On
+; Production Value: Off
+; http://php.net/display-errors
+display_errors = Off
+
+; The display of errors which occur during PHP's startup sequence are handled
+; separately from display_errors. We strongly recommend you set this to 'off'
+; for production servers to avoid leaking configuration details.
+; Default Value: On
+; Development Value: On
+; Production Value: Off
+; http://php.net/display-startup-errors
+display_startup_errors = Off
+
+; Besides displaying errors, PHP can also log errors to locations such as a
+; server-specific log, STDERR, or a location specified by the error_log
+; directive found below. While errors should not be displayed on productions
+; servers they should still be monitored and logging is a great way to do that.
+; Default Value: Off
+; Development Value: On
+; Production Value: On
+; http://php.net/log-errors
+log_errors = On
+
+; Set maximum length of log_errors. In error_log information about the source is
+; added. The default is 1024 and 0 allows to not apply any maximum length at all.
+; http://php.net/log-errors-max-len
+log_errors_max_len = 1024
+
+; Do not log repeated messages. Repeated errors must occur in same file on same
+; line unless ignore_repeated_source is set true.
+; http://php.net/ignore-repeated-errors
+ignore_repeated_errors = Off
+
+; Ignore source of message when ignoring repeated messages. When this setting
+; is On you will not log errors with repeated messages from different files or
+; source lines.
+; http://php.net/ignore-repeated-source
+ignore_repeated_source = Off
+
+; If this parameter is set to Off, then memory leaks will not be shown (on
+; stdout or in the log). This is only effective in a debug compile, and if
+; error reporting includes E_WARNING in the allowed list
+; http://php.net/report-memleaks
+report_memleaks = On
+
+; This setting is off by default.
+;report_zend_debug = 0
+
+; Turn off normal error reporting and emit XML-RPC error XML
+; http://php.net/xmlrpc-errors
+;xmlrpc_errors = 0
+
+; An XML-RPC faultCode
+;xmlrpc_error_number = 0
+
+; When PHP displays or logs an error, it has the capability of formatting the
+; error message as HTML for easier reading. This directive controls whether
+; the error message is formatted as HTML or not.
+; Note: This directive is hardcoded to Off for the CLI SAPI
+; http://php.net/html-errors
+;html_errors = On
+
+; If html_errors is set to On *and* docref_root is not empty, then PHP
+; produces clickable error messages that direct to a page describing the error
+; or function causing the error in detail.
+; You can download a copy of the PHP manual from http://php.net/docs
+; and change docref_root to the base URL of your local copy including the
+; leading '/'. You must also specify the file extension being used including
+; the dot. PHP's default behavior is to leave these settings empty, in which
+; case no links to documentation are generated.
+; Note: Never use this feature for production boxes.
+; http://php.net/docref-root
+; Examples
+;docref_root = "/phpmanual/"
+
+; http://php.net/docref-ext
+;docref_ext = .html
+
+; String to output before an error message. PHP's default behavior is to leave
+; this setting blank.
+; http://php.net/error-prepend-string
+; Example:
+;error_prepend_string = ""
+
+; String to output after an error message. PHP's default behavior is to leave
+; this setting blank.
+; http://php.net/error-append-string
+; Example:
+;error_append_string = ""
+
+; Log errors to specified file. PHP's default behavior is to leave this value
+; empty.
+; http://php.net/error-log
+; Example:
+;error_log = php_errors.log
+; Log errors to syslog (Event Log on Windows).
+;error_log = syslog
+
+; The syslog ident is a string which is prepended to every message logged
+; to syslog. Only used when error_log is set to syslog.
+;syslog.ident = php
+
+; The syslog facility is used to specify what type of program is logging
+; the message. Only used when error_log is set to syslog.
+;syslog.facility = user
+
+; Set this to disable filtering control characters (the default).
+; Some loggers only accept NVT-ASCII, others accept anything that's not
+; control characters. If your logger accepts everything, then no filtering
+; is needed at all.
+; Allowed values are:
+; ascii (all printable ASCII characters and NL)
+; no-ctrl (all characters except control characters)
+; all (all characters)
+; raw (like "all", but messages are not split at newlines)
+; http://php.net/syslog.filter
+;syslog.filter = ascii
+
+;windows.show_crt_warning
+; Default value: 0
+; Development value: 0
+; Production value: 0
+
+;;;;;;;;;;;;;;;;;
+; Data Handling ;
+;;;;;;;;;;;;;;;;;
+
+; The separator used in PHP generated URLs to separate arguments.
+; PHP's default setting is "&".
+; http://php.net/arg-separator.output
+; Example:
+;arg_separator.output = "&"
+
+; List of separator(s) used by PHP to parse input URLs into variables.
+; PHP's default setting is "&".
+; NOTE: Every character in this directive is considered as separator!
+; http://php.net/arg-separator.input
+; Example:
+;arg_separator.input = ";&"
+
+; This directive determines which super global arrays are registered when PHP
+; starts up. G,P,C,E & S are abbreviations for the following respective super
+; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty
+; paid for the registration of these arrays and because ENV is not as commonly
+; used as the others, ENV is not recommended on productions servers. You
+; can still get access to the environment variables through getenv() should you
+; need to.
+; Default Value: "EGPCS"
+; Development Value: "GPCS"
+; Production Value: "GPCS";
+; http://php.net/variables-order
+variables_order = "GPCS"
+
+; This directive determines which super global data (G,P & C) should be
+; registered into the super global array REQUEST. If so, it also determines
+; the order in which that data is registered. The values for this directive
+; are specified in the same manner as the variables_order directive,
+; EXCEPT one. Leaving this value empty will cause PHP to use the value set
+; in the variables_order directive. It does not mean it will leave the super
+; globals array REQUEST empty.
+; Default Value: None
+; Development Value: "GP"
+; Production Value: "GP"
+; http://php.net/request-order
+request_order = "GP"
+
+; This directive determines whether PHP registers $argv & $argc each time it
+; runs. $argv contains an array of all the arguments passed to PHP when a script
+; is invoked. $argc contains an integer representing the number of arguments
+; that were passed when the script was invoked. These arrays are extremely
+; useful when running scripts from the command line. When this directive is
+; enabled, registering these variables consumes CPU cycles and memory each time
+; a script is executed. For performance reasons, this feature should be disabled
+; on production servers.
+; Note: This directive is hardcoded to On for the CLI SAPI
+; Default Value: On
+; Development Value: Off
+; Production Value: Off
+; http://php.net/register-argc-argv
+register_argc_argv = Off
+
+; When enabled, the ENV, REQUEST and SERVER variables are created when they're
+; first used (Just In Time) instead of when the script starts. If these
+; variables are not used within a script, having this directive on will result
+; in a performance gain. The PHP directive register_argc_argv must be disabled
+; for this directive to have any effect.
+; http://php.net/auto-globals-jit
+auto_globals_jit = On
+
+; Whether PHP will read the POST data.
+; This option is enabled by default.
+; Most likely, you won't want to disable this option globally. It causes $_POST
+; and $_FILES to always be empty; the only way you will be able to read the
+; POST data will be through the php://input stream wrapper. This can be useful
+; to proxy requests or to process the POST data in a memory efficient fashion.
+; http://php.net/enable-post-data-reading
+;enable_post_data_reading = Off
+
+; Maximum size of POST data that PHP will accept.
+; Its value may be 0 to disable the limit. It is ignored if POST data reading
+; is disabled through enable_post_data_reading.
+; http://php.net/post-max-size
+post_max_size = 8M
+
+; Automatically add files before PHP document.
+; http://php.net/auto-prepend-file
+auto_prepend_file =
+
+; Automatically add files after PHP document.
+; http://php.net/auto-append-file
+auto_append_file =
+
+; By default, PHP will output a media type using the Content-Type header. To
+; disable this, simply set it to be empty.
+;
+; PHP's built-in default media type is set to text/html.
+; http://php.net/default-mimetype
+default_mimetype = "text/html"
+
+; PHP's default character set is set to UTF-8.
+; http://php.net/default-charset
+default_charset = "UTF-8"
+
+; PHP internal character encoding is set to empty.
+; If empty, default_charset is used.
+; http://php.net/internal-encoding
+;internal_encoding =
+
+; PHP input character encoding is set to empty.
+; If empty, default_charset is used.
+; http://php.net/input-encoding
+;input_encoding =
+
+; PHP output character encoding is set to empty.
+; If empty, default_charset is used.
+; See also output_buffer.
+; http://php.net/output-encoding
+;output_encoding =
+
+;;;;;;;;;;;;;;;;;;;;;;;;;
+; Paths and Directories ;
+;;;;;;;;;;;;;;;;;;;;;;;;;
+
+; UNIX: "/path1:/path2"
+;include_path = ".:/usr/share/php"
+;
+; Windows: "\path1;\path2"
+;include_path = ".;c:\php\includes"
+;
+; PHP's default setting for include_path is ".;/path/to/php/pear"
+; http://php.net/include-path
+
+; The root of the PHP pages, used only if nonempty.
+; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root
+; if you are running php as a CGI under any web server (other than IIS)
+; see documentation for security issues. The alternate is to use the
+; cgi.force_redirect configuration below
+; http://php.net/doc-root
+doc_root =
+
+; The directory under which PHP opens the script using /~username used only
+; if nonempty.
+; http://php.net/user-dir
+user_dir =
+
+; Directory in which the loadable extensions (modules) reside.
+; http://php.net/extension-dir
+;extension_dir = "./"
+; On windows:
+;extension_dir = "ext"
+
+; Directory where the temporary files should be placed.
+; Defaults to the system default (see sys_get_temp_dir)
+;sys_temp_dir = "/tmp"
+
+; Whether or not to enable the dl() function. The dl() function does NOT work
+; properly in multithreaded servers, such as IIS or Zeus, and is automatically
+; disabled on them.
+; http://php.net/enable-dl
+enable_dl = Off
+
+; cgi.force_redirect is necessary to provide security running PHP as a CGI under
+; most web servers. Left undefined, PHP turns this on by default. You can
+; turn it off here AT YOUR OWN RISK
+; **You CAN safely turn this off for IIS, in fact, you MUST.**
+; http://php.net/cgi.force-redirect
+;cgi.force_redirect = 1
+
+; if cgi.nph is enabled it will force cgi to always sent Status: 200 with
+; every request. PHP's default behavior is to disable this feature.
+;cgi.nph = 1
+
+; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape
+; (iPlanet) web servers, you MAY need to set an environment variable name that PHP
+; will look for to know it is OK to continue execution. Setting this variable MAY
+; cause security issues, KNOW WHAT YOU ARE DOING FIRST.
+; http://php.net/cgi.redirect-status-env
+;cgi.redirect_status_env =
+
+; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's
+; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
+; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting
+; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting
+; of zero causes PHP to behave as before. Default is 1. You should fix your scripts
+; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
+; http://php.net/cgi.fix-pathinfo
+;cgi.fix_pathinfo=1
+
+; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside
+; of the web tree and people will not be able to circumvent .htaccess security.
+;cgi.discard_path=1
+
+; FastCGI under IIS supports the ability to impersonate
+; security tokens of the calling client. This allows IIS to define the
+; security context that the request runs under. mod_fastcgi under Apache
+; does not currently support this feature (03/17/2002)
+; Set to 1 if running under IIS. Default is zero.
+; http://php.net/fastcgi.impersonate
+;fastcgi.impersonate = 1
+
+; Disable logging through FastCGI connection. PHP's default behavior is to enable
+; this feature.
+;fastcgi.logging = 0
+
+; cgi.rfc2616_headers configuration option tells PHP what type of headers to
+; use when sending HTTP response code. If set to 0, PHP sends Status: header that
+; is supported by Apache. When this option is set to 1, PHP will send
+; RFC2616 compliant header.
+; Default is zero.
+; http://php.net/cgi.rfc2616-headers
+;cgi.rfc2616_headers = 0
+
+; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!
+; (shebang) at the top of the running script. This line might be needed if the
+; script support running both as stand-alone script and via PHP CGI<. PHP in CGI
+; mode skips this line and ignores its content if this directive is turned on.
+; http://php.net/cgi.check-shebang-line
+;cgi.check_shebang_line=1
+
+;;;;;;;;;;;;;;;;
+; File Uploads ;
+;;;;;;;;;;;;;;;;
+
+; Whether to allow HTTP file uploads.
+; http://php.net/file-uploads
+file_uploads = On
+
+; Temporary directory for HTTP uploaded files (will use system default if not
+; specified).
+; http://php.net/upload-tmp-dir
+;upload_tmp_dir =
+
+; Maximum allowed size for uploaded files.
+; http://php.net/upload-max-filesize
+upload_max_filesize = 2M
+
+; Maximum number of files that can be uploaded via a single request
+max_file_uploads = 20
+
+;;;;;;;;;;;;;;;;;;
+; Fopen wrappers ;
+;;;;;;;;;;;;;;;;;;
+
+; Whether to allow the treatment of URLs (like http:// or ftp://) as files.
+; http://php.net/allow-url-fopen
+allow_url_fopen = On
+
+; Whether to allow include/require to open URLs (like http:// or ftp://) as files.
+; http://php.net/allow-url-include
+allow_url_include = Off
+
+; Define the anonymous ftp password (your email address). PHP's default setting
+; for this is empty.
+; http://php.net/from
+;from="john@doe.com"
+
+; Define the User-Agent string. PHP's default setting for this is empty.
+; http://php.net/user-agent
+;user_agent="PHP"
+
+; Default timeout for socket based streams (seconds)
+; http://php.net/default-socket-timeout
+default_socket_timeout = 60
+
+; If your scripts have to deal with files from Macintosh systems,
+; or you are running on a Mac and need to deal with files from
+; unix or win32 systems, setting this flag will cause PHP to
+; automatically detect the EOL character in those files so that
+; fgets() and file() will work regardless of the source of the file.
+; http://php.net/auto-detect-line-endings
+;auto_detect_line_endings = Off
+
+;;;;;;;;;;;;;;;;;;;;;;
+; Dynamic Extensions ;
+;;;;;;;;;;;;;;;;;;;;;;
+
+; If you wish to have an extension loaded automatically, use the following
+; syntax:
+;
+; extension=modulename
+;
+; For example:
+;
+; extension=mysqli
+;
+; When the extension library to load is not located in the default extension
+; directory, You may specify an absolute path to the library file:
+;
+; extension=/path/to/extension/mysqli.so
+;
+; Note : The syntax used in previous PHP versions ('extension=.so' and
+; 'extension='php_.dll') is supported for legacy reasons and may be
+; deprecated in a future PHP major version. So, when it is possible, please
+; move to the new ('extension=) syntax.
+;
+; Notes for Windows environments :
+;
+; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+)
+; extension folders as well as the separate PECL DLL download (PHP 5+).
+; Be sure to appropriately set the extension_dir directive.
+;
+;extension=bz2
+;extension=curl
+;extension=ffi
+;extension=ftp
+;extension=fileinfo
+;extension=gd
+;extension=gettext
+;extension=gmp
+;extension=intl
+;extension=imap
+;extension=ldap
+;extension=mbstring
+;extension=exif ; Must be after mbstring as it depends on it
+;extension=mysqli
+;extension=oci8_12c ; Use with Oracle Database 12c Instant Client
+;extension=oci8_19 ; Use with Oracle Database 19 Instant Client
+;extension=odbc
+;extension=openssl
+;extension=pdo_firebird
+;extension=pdo_mysql
+;extension=pdo_oci
+;extension=pdo_odbc
+;extension=pdo_pgsql
+;extension=pdo_sqlite
+;extension=pgsql
+;extension=shmop
+
+; The MIBS data available in the PHP distribution must be installed.
+; See http://www.php.net/manual/en/snmp.installation.php
+;extension=snmp
+
+;extension=soap
+;extension=sockets
+;extension=sodium
+;extension=sqlite3
+;extension=tidy
+;extension=xsl
+
+;zend_extension=opcache
+
+;;;;;;;;;;;;;;;;;;;
+; Module Settings ;
+;;;;;;;;;;;;;;;;;;;
+
+[CLI Server]
+; Whether the CLI web server uses ANSI color coding in its terminal output.
+cli_server.color = On
+
+[Date]
+; Defines the default timezone used by the date functions
+; http://php.net/date.timezone
+;date.timezone =
+
+; http://php.net/date.default-latitude
+;date.default_latitude = 31.7667
+
+; http://php.net/date.default-longitude
+;date.default_longitude = 35.2333
+
+; http://php.net/date.sunrise-zenith
+;date.sunrise_zenith = 90.833333
+
+; http://php.net/date.sunset-zenith
+;date.sunset_zenith = 90.833333
+
+[filter]
+; http://php.net/filter.default
+;filter.default = unsafe_raw
+
+; http://php.net/filter.default-flags
+;filter.default_flags =
+
+[iconv]
+; Use of this INI entry is deprecated, use global input_encoding instead.
+; If empty, default_charset or input_encoding or iconv.input_encoding is used.
+; The precedence is: default_charset < input_encoding < iconv.input_encoding
+;iconv.input_encoding =
+
+; Use of this INI entry is deprecated, use global internal_encoding instead.
+; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.
+; The precedence is: default_charset < internal_encoding < iconv.internal_encoding
+;iconv.internal_encoding =
+
+; Use of this INI entry is deprecated, use global output_encoding instead.
+; If empty, default_charset or output_encoding or iconv.output_encoding is used.
+; The precedence is: default_charset < output_encoding < iconv.output_encoding
+; To use an output encoding conversion, iconv's output handler must be set
+; otherwise output encoding conversion cannot be performed.
+;iconv.output_encoding =
+
+[imap]
+; rsh/ssh logins are disabled by default. Use this INI entry if you want to
+; enable them. Note that the IMAP library does not filter mailbox names before
+; passing them to rsh/ssh command, thus passing untrusted data to this function
+; with rsh/ssh enabled is insecure.
+;imap.enable_insecure_rsh=0
+
+[intl]
+;intl.default_locale =
+; This directive allows you to produce PHP errors when some error
+; happens within intl functions. The value is the level of the error produced.
+; Default is 0, which does not produce any errors.
+;intl.error_level = E_WARNING
+;intl.use_exceptions = 0
+
+[sqlite3]
+; Directory pointing to SQLite3 extensions
+; http://php.net/sqlite3.extension-dir
+;sqlite3.extension_dir =
+
+; SQLite defensive mode flag (only available from SQLite 3.26+)
+; When the defensive flag is enabled, language features that allow ordinary
+; SQL to deliberately corrupt the database file are disabled. This forbids
+; writing directly to the schema, shadow tables (eg. FTS data tables), or
+; the sqlite_dbpage virtual table.
+; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html
+; (for older SQLite versions, this flag has no use)
+;sqlite3.defensive = 1
+
+[Pcre]
+; PCRE library backtracking limit.
+; http://php.net/pcre.backtrack-limit
+;pcre.backtrack_limit=100000
+
+; PCRE library recursion limit.
+; Please note that if you set this value to a high number you may consume all
+; the available process stack and eventually crash PHP (due to reaching the
+; stack size limit imposed by the Operating System).
+; http://php.net/pcre.recursion-limit
+;pcre.recursion_limit=100000
+
+; Enables or disables JIT compilation of patterns. This requires the PCRE
+; library to be compiled with JIT support.
+;pcre.jit=1
+
+[Pdo]
+; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off"
+; http://php.net/pdo-odbc.connection-pooling
+;pdo_odbc.connection_pooling=strict
+
+[Pdo_mysql]
+; Default socket name for local MySQL connects. If empty, uses the built-in
+; MySQL defaults.
+pdo_mysql.default_socket=
+
+[Phar]
+; http://php.net/phar.readonly
+;phar.readonly = On
+
+; http://php.net/phar.require-hash
+;phar.require_hash = On
+
+;phar.cache_list =
+
+[mail function]
+; For Win32 only.
+; http://php.net/smtp
+SMTP = localhost
+; http://php.net/smtp-port
+smtp_port = 25
+
+; For Win32 only.
+; http://php.net/sendmail-from
+;sendmail_from = me@example.com
+
+; For Unix only. You may supply arguments as well (default: "sendmail -t -i").
+; http://php.net/sendmail-path
+;sendmail_path =
+
+; Force the addition of the specified parameters to be passed as extra parameters
+; to the sendmail binary. These parameters will always replace the value of
+; the 5th parameter to mail().
+;mail.force_extra_parameters =
+
+; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename
+mail.add_x_header = Off
+
+; The path to a log file that will log all mail() calls. Log entries include
+; the full path of the script, line number, To address and headers.
+;mail.log =
+; Log mail to syslog (Event Log on Windows).
+;mail.log = syslog
+
+[ODBC]
+; http://php.net/odbc.default-db
+;odbc.default_db = Not yet implemented
+
+; http://php.net/odbc.default-user
+;odbc.default_user = Not yet implemented
+
+; http://php.net/odbc.default-pw
+;odbc.default_pw = Not yet implemented
+
+; Controls the ODBC cursor model.
+; Default: SQL_CURSOR_STATIC (default).
+;odbc.default_cursortype
+
+; Allow or prevent persistent links.
+; http://php.net/odbc.allow-persistent
+odbc.allow_persistent = On
+
+; Check that a connection is still valid before reuse.
+; http://php.net/odbc.check-persistent
+odbc.check_persistent = On
+
+; Maximum number of persistent links. -1 means no limit.
+; http://php.net/odbc.max-persistent
+odbc.max_persistent = -1
+
+; Maximum number of links (persistent + non-persistent). -1 means no limit.
+; http://php.net/odbc.max-links
+odbc.max_links = -1
+
+; Handling of LONG fields. Returns number of bytes to variables. 0 means
+; passthru.
+; http://php.net/odbc.defaultlrl
+odbc.defaultlrl = 4096
+
+; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.
+; See the documentation on odbc_binmode and odbc_longreadlen for an explanation
+; of odbc.defaultlrl and odbc.defaultbinmode
+; http://php.net/odbc.defaultbinmode
+odbc.defaultbinmode = 1
+
+[MySQLi]
+
+; Maximum number of persistent links. -1 means no limit.
+; http://php.net/mysqli.max-persistent
+mysqli.max_persistent = -1
+
+; Allow accessing, from PHP's perspective, local files with LOAD DATA statements
+; http://php.net/mysqli.allow_local_infile
+;mysqli.allow_local_infile = On
+
+; Allow or prevent persistent links.
+; http://php.net/mysqli.allow-persistent
+mysqli.allow_persistent = On
+
+; Maximum number of links. -1 means no limit.
+; http://php.net/mysqli.max-links
+mysqli.max_links = -1
+
+; Default port number for mysqli_connect(). If unset, mysqli_connect() will use
+; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the
+; compile-time value defined MYSQL_PORT (in that order). Win32 will only look
+; at MYSQL_PORT.
+; http://php.net/mysqli.default-port
+mysqli.default_port = 3306
+
+; Default socket name for local MySQL connects. If empty, uses the built-in
+; MySQL defaults.
+; http://php.net/mysqli.default-socket
+mysqli.default_socket =
+
+; Default host for mysqli_connect() (doesn't apply in safe mode).
+; http://php.net/mysqli.default-host
+mysqli.default_host =
+
+; Default user for mysqli_connect() (doesn't apply in safe mode).
+; http://php.net/mysqli.default-user
+mysqli.default_user =
+
+; Default password for mysqli_connect() (doesn't apply in safe mode).
+; Note that this is generally a *bad* idea to store passwords in this file.
+; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw")
+; and reveal this password! And of course, any users with read access to this
+; file will be able to reveal the password as well.
+; http://php.net/mysqli.default-pw
+mysqli.default_pw =
+
+; Allow or prevent reconnect
+mysqli.reconnect = Off
+
+[mysqlnd]
+; Enable / Disable collection of general statistics by mysqlnd which can be
+; used to tune and monitor MySQL operations.
+mysqlnd.collect_statistics = On
+
+; Enable / Disable collection of memory usage statistics by mysqlnd which can be
+; used to tune and monitor MySQL operations.
+mysqlnd.collect_memory_statistics = Off
+
+; Records communication from all extensions using mysqlnd to the specified log
+; file.
+; http://php.net/mysqlnd.debug
+;mysqlnd.debug =
+
+; Defines which queries will be logged.
+;mysqlnd.log_mask = 0
+
+; Default size of the mysqlnd memory pool, which is used by result sets.
+;mysqlnd.mempool_default_size = 16000
+
+; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.
+;mysqlnd.net_cmd_buffer_size = 2048
+
+; Size of a pre-allocated buffer used for reading data sent by the server in
+; bytes.
+;mysqlnd.net_read_buffer_size = 32768
+
+; Timeout for network requests in seconds.
+;mysqlnd.net_read_timeout = 31536000
+
+; SHA-256 Authentication Plugin related. File with the MySQL server public RSA
+; key.
+;mysqlnd.sha256_server_public_key =
+
+[OCI8]
+
+; Connection: Enables privileged connections using external
+; credentials (OCI_SYSOPER, OCI_SYSDBA)
+; http://php.net/oci8.privileged-connect
+;oci8.privileged_connect = Off
+
+; Connection: The maximum number of persistent OCI8 connections per
+; process. Using -1 means no limit.
+; http://php.net/oci8.max-persistent
+;oci8.max_persistent = -1
+
+; Connection: The maximum number of seconds a process is allowed to
+; maintain an idle persistent connection. Using -1 means idle
+; persistent connections will be maintained forever.
+; http://php.net/oci8.persistent-timeout
+;oci8.persistent_timeout = -1
+
+; Connection: The number of seconds that must pass before issuing a
+; ping during oci_pconnect() to check the connection validity. When
+; set to 0, each oci_pconnect() will cause a ping. Using -1 disables
+; pings completely.
+; http://php.net/oci8.ping-interval
+;oci8.ping_interval = 60
+
+; Connection: Set this to a user chosen connection class to be used
+; for all pooled server requests with Oracle 11g Database Resident
+; Connection Pooling (DRCP). To use DRCP, this value should be set to
+; the same string for all web servers running the same application,
+; the database pool must be configured, and the connection string must
+; specify to use a pooled server.
+;oci8.connection_class =
+
+; High Availability: Using On lets PHP receive Fast Application
+; Notification (FAN) events generated when a database node fails. The
+; database must also be configured to post FAN events.
+;oci8.events = Off
+
+; Tuning: This option enables statement caching, and specifies how
+; many statements to cache. Using 0 disables statement caching.
+; http://php.net/oci8.statement-cache-size
+;oci8.statement_cache_size = 20
+
+; Tuning: Enables statement prefetching and sets the default number of
+; rows that will be fetched automatically after statement execution.
+; http://php.net/oci8.default-prefetch
+;oci8.default_prefetch = 100
+
+; Compatibility. Using On means oci_close() will not close
+; oci_connect() and oci_new_connect() connections.
+; http://php.net/oci8.old-oci-close-semantics
+;oci8.old_oci_close_semantics = Off
+
+[PostgreSQL]
+; Allow or prevent persistent links.
+; http://php.net/pgsql.allow-persistent
+pgsql.allow_persistent = On
+
+; Detect broken persistent links always with pg_pconnect().
+; Auto reset feature requires a little overheads.
+; http://php.net/pgsql.auto-reset-persistent
+pgsql.auto_reset_persistent = Off
+
+; Maximum number of persistent links. -1 means no limit.
+; http://php.net/pgsql.max-persistent
+pgsql.max_persistent = -1
+
+; Maximum number of links (persistent+non persistent). -1 means no limit.
+; http://php.net/pgsql.max-links
+pgsql.max_links = -1
+
+; Ignore PostgreSQL backends Notice message or not.
+; Notice message logging require a little overheads.
+; http://php.net/pgsql.ignore-notice
+pgsql.ignore_notice = 0
+
+; Log PostgreSQL backends Notice message or not.
+; Unless pgsql.ignore_notice=0, module cannot log notice message.
+; http://php.net/pgsql.log-notice
+pgsql.log_notice = 0
+
+[bcmath]
+; Number of decimal digits for all bcmath functions.
+; http://php.net/bcmath.scale
+bcmath.scale = 0
+
+[browscap]
+; http://php.net/browscap
+;browscap = extra/browscap.ini
+
+[Session]
+; Handler used to store/retrieve data.
+; http://php.net/session.save-handler
+session.save_handler = files
+
+; Argument passed to save_handler. In the case of files, this is the path
+; where data files are stored. Note: Windows users have to change this
+; variable in order to use PHP's session functions.
+;
+; The path can be defined as:
+;
+; session.save_path = "N;/path"
+;
+; where N is an integer. Instead of storing all the session files in
+; /path, what this will do is use subdirectories N-levels deep, and
+; store the session data in those directories. This is useful if
+; your OS has problems with many files in one directory, and is
+; a more efficient layout for servers that handle many sessions.
+;
+; NOTE 1: PHP will not create this directory structure automatically.
+; You can use the script in the ext/session dir for that purpose.
+; NOTE 2: See the section on garbage collection below if you choose to
+; use subdirectories for session storage
+;
+; The file storage module creates files using mode 600 by default.
+; You can change that by using
+;
+; session.save_path = "N;MODE;/path"
+;
+; where MODE is the octal representation of the mode. Note that this
+; does not overwrite the process's umask.
+; http://php.net/session.save-path
+;session.save_path = "/var/lib/php/sessions"
+
+; Whether to use strict session mode.
+; Strict session mode does not accept an uninitialized session ID, and
+; regenerates the session ID if the browser sends an uninitialized session ID.
+; Strict mode protects applications from session fixation via a session adoption
+; vulnerability. It is disabled by default for maximum compatibility, but
+; enabling it is encouraged.
+; https://wiki.php.net/rfc/strict_sessions
+session.use_strict_mode = 0
+
+; Whether to use cookies.
+; http://php.net/session.use-cookies
+session.use_cookies = 1
+
+; http://php.net/session.cookie-secure
+;session.cookie_secure =
+
+; This option forces PHP to fetch and use a cookie for storing and maintaining
+; the session id. We encourage this operation as it's very helpful in combating
+; session hijacking when not specifying and managing your own session id. It is
+; not the be-all and end-all of session hijacking defense, but it's a good start.
+; http://php.net/session.use-only-cookies
+session.use_only_cookies = 1
+
+; Name of the session (used as cookie name).
+; http://php.net/session.name
+session.name = PHPSESSID
+
+; Initialize session on request startup.
+; http://php.net/session.auto-start
+session.auto_start = 0
+
+; Lifetime in seconds of cookie or, if 0, until browser is restarted.
+; http://php.net/session.cookie-lifetime
+session.cookie_lifetime = 0
+
+; The path for which the cookie is valid.
+; http://php.net/session.cookie-path
+session.cookie_path = /
+
+; The domain for which the cookie is valid.
+; http://php.net/session.cookie-domain
+session.cookie_domain =
+
+; Whether or not to add the httpOnly flag to the cookie, which makes it
+; inaccessible to browser scripting languages such as JavaScript.
+; http://php.net/session.cookie-httponly
+session.cookie_httponly =
+
+; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)
+; Current valid values are "Strict", "Lax" or "None". When using "None",
+; make sure to include the quotes, as `none` is interpreted like `false` in ini files.
+; https://tools.ietf.org/html/draft-west-first-party-cookies-07
+session.cookie_samesite =
+
+; Handler used to serialize data. php is the standard serializer of PHP.
+; http://php.net/session.serialize-handler
+session.serialize_handler = php
+
+; Defines the probability that the 'garbage collection' process is started on every
+; session initialization. The probability is calculated by using gc_probability/gc_divisor,
+; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.
+; Default Value: 1
+; Development Value: 1
+; Production Value: 1
+; http://php.net/session.gc-probability
+session.gc_probability = 0
+
+; Defines the probability that the 'garbage collection' process is started on every
+; session initialization. The probability is calculated by using gc_probability/gc_divisor,
+; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.
+; For high volume production servers, using a value of 1000 is a more efficient approach.
+; Default Value: 100
+; Development Value: 1000
+; Production Value: 1000
+; http://php.net/session.gc-divisor
+session.gc_divisor = 1000
+
+; After this number of seconds, stored data will be seen as 'garbage' and
+; cleaned up by the garbage collection process.
+; http://php.net/session.gc-maxlifetime
+session.gc_maxlifetime = 1440
+
+; NOTE: If you are using the subdirectory option for storing session files
+; (see session.save_path above), then garbage collection does *not*
+; happen automatically. You will need to do your own garbage
+; collection through a shell script, cron entry, or some other method.
+; For example, the following script is the equivalent of setting
+; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):
+; find /path/to/sessions -cmin +24 -type f | xargs rm
+
+; Check HTTP Referer to invalidate externally stored URLs containing ids.
+; HTTP_REFERER has to contain this substring for the session to be
+; considered as valid.
+; http://php.net/session.referer-check
+session.referer_check =
+
+; Set to {nocache,private,public,} to determine HTTP caching aspects
+; or leave this empty to avoid sending anti-caching headers.
+; http://php.net/session.cache-limiter
+session.cache_limiter = nocache
+
+; Document expires after n minutes.
+; http://php.net/session.cache-expire
+session.cache_expire = 180
+
+; trans sid support is disabled by default.
+; Use of trans sid may risk your users' security.
+; Use this option with caution.
+; - User may send URL contains active session ID
+; to other person via. email/irc/etc.
+; - URL that contains active session ID may be stored
+; in publicly accessible computer.
+; - User may access your site with the same session ID
+; always using URL stored in browser's history or bookmarks.
+; http://php.net/session.use-trans-sid
+session.use_trans_sid = 0
+
+; Set session ID character length. This value could be between 22 to 256.
+; Shorter length than default is supported only for compatibility reason.
+; Users should use 32 or more chars.
+; http://php.net/session.sid-length
+; Default Value: 32
+; Development Value: 26
+; Production Value: 26
+session.sid_length = 26
+
+; The URL rewriter will look for URLs in a defined set of HTML tags.
+;