From ad4018eca3ff7b6f6be6a5f17e954e3673fa6c44 Mon Sep 17 00:00:00 2001 From: Christoph Date: Sun, 8 Nov 2026 12:26:44 +0100 Subject: [PATCH] install_opendmarc.sh: set PublicSuffixList/UserID, drop HistoryFile, SPFIgnoreResults true - Set PublicSuffixList and UserID explicitly instead of relying on the package config. - Do not use HistoryFile (no aggregate reports); comment out an active setting. - Set SPFIgnoreResults to true. - Update comment in ignore.hosts to reflect the current milter setup. Co-Authored-By: Claude Opus 5.5 --- install_opendmarc.sh | 113 ++++++++++++++++++++++++++++++------------- 1 file changed, 80 insertions(+), 33 deletions(-) diff --git a/install_opendmarc.sh b/install_opendmarc.sh index b59bc45..dbd7e79 100755 --- a/install_opendmarc.sh +++ b/install_opendmarc.sh @@ -23,9 +23,17 @@ postfix_spool_dir="/var/spool/postfix" opendmarc_socket_dir="${postfix_spool_dir}/opendmarc" opendmarc_socket_file="${opendmarc_socket_dir}/opendmarc.sock" +# - HistoryFile is intentionally NOT set: it is only useful if the records are +# - imported regularly with opendmarc-importstats(8) to generate DMARC aggregate +# - reports. We do not generate such reports, so the file would only grow and, +# - located in /run, be lost at every reboot. An active setting is commented out +# - further below. +# - config_file_name_value_parameters=" AuthservID|HOSTNAME TrustedAuthservIDs|HOSTNAME + PublicSuffixList|/usr/share/publicsuffix/public_suffix_list.dat + UserID|opendmarc PidFile|/run/opendmarc/opendmarc.pid" if which sympa ; then config_file_name_value_parameters="$config_file_name_value_parameters @@ -44,8 +52,7 @@ config_file_name_value_parameters="$config_file_name_value_parameters UMask|002 FailureReports|false AutoRestart|true - HistoryFile|/run/opendmarc/opendmarc.dat - SPFIgnoreResults|false + SPFIgnoreResults|true SPFSelfValidate|true Socket|${opendmarc_socket_file} " @@ -468,27 +475,17 @@ else fi -# - Add 'HistoryFile' with default value to the original opendmarc.conf file +# - Do not use 'HistoryFile': see the note at the parameter list on top of this +# - script. Comment out an active setting, e.g. left over from a previous version +# - of this script. # _param="HistoryFile" -echononl " Add '${_param}' with default value to the opendmarc.conf file.." -if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then - cat << EOF >> ${opendmarc_conf_file} - -## HistoryFile (string) -## -## If set, specifies the location of a text file to which records are written -## that can be used to generate DMARC aggregate reports. Records are batches of -## rows containing information about a single received message, and include all -## relevant information needed to generate a DMARC aggregate report. It is -## expected that this will not be used in its raw form, but rather periodically -## imported into a relational database from which the aggregate reports can be -## extracted using opendmarc-importstats(8). -# -#HistoryFile /run/opendmarc/opendmarc.dat -EOF +echononl " Deactivate '${_param}' in the opendmarc.conf file.." +if grep -q -E "^\s*${_param}\s+" ${opendmarc_conf_file} 2> /dev/null ; then + perl -i -p -e 's/^(\s*HistoryFile\s)/#$1/' ${opendmarc_conf_file} > "$log_file" 2>&1 if [[ $? -eq 0 ]] ; then echo_ok + opendmarc_needs_restart=true else echo_failed error "$(cat $log_file)" @@ -509,7 +506,7 @@ if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then ## is useful if you want the filter to perform SPF checks itself, or because you ## don't trust the arriving header. The default is "false". # -SPFIgnoreResults false +SPFIgnoreResults true EOF if [[ $? -eq 0 ]] ; then echo_ok @@ -547,6 +544,60 @@ else fi +# - Add 'PublicSuffixList' with default value to the original opendmarc.conf file +# +_param="PublicSuffixList" +echononl " Add '${_param}' with default value to the opendmarc.conf file.." +if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then + cat << EOF >> ${opendmarc_conf_file} + +## PublicSuffixList (string) +## +## Specifies the path to a file that contains top-level domains (TLDs) that +## will be used to compute the Organizational Domain for a given domain name, +## as described in the DMARC specification. If not provided, the filter will +## not be able to determine the Organizational Domain and only the presented +## domain will be evaluated. +# +PublicSuffixList /usr/share/publicsuffix/public_suffix_list.dat +EOF + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi +else + echo_skipped +fi + + +# - Add 'UserID' with default value to the original opendmarc.conf file +# +_param="UserID" +echononl " Add '${_param}' with default value to the opendmarc.conf file.." +if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then + cat << EOF >> ${opendmarc_conf_file} + +## UserID (string) +## +## Attempts to become the specified userid before starting operations. +## The process will be assigned all of the groups and primary group ID of +## the named userid unless an alternate group is specified. +# +UserID opendmarc +EOF + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi +else + echo_skipped +fi + + # - Save configuration file from distribution # - echononl " Save configuration file from distribution" @@ -746,22 +797,18 @@ else cat < ${opendmarc_base_dir}/ignore.hosts 2> $log_file # /etc/opendmarc/ignore.hosts # -# Aktuell hat OpenDMARC seinen Milter nur am Dienst -# 'localhost:10025' hängen. Dort ist der Client -# immer 127.0.0.1, nicht die externe Gegenstelle. +# OpenDMARC haengt als Milter an den SMTP-Diensten von Postfix +# (smtpd_milters in main.cf), also vor Amavis. Er sieht dort die +# echte Client-IP. An 'localhost:10025' laeuft kein Milter. # -# Deshalb macht es in diesem Setup keinen Sinn, -# hier IP-Adressen von externen Diensten (CRSend etc.) -# einzutragen – sie würden nie matchen. +# Eingetragene Hostnamen, IP-Adressen oder CIDR-Netze werden von +# OpenDMARC nicht geprueft. Ein Eintrag wirkt also tatsaechlich: +# fuer solche Clients werden DMARC-Richtlinien nicht durchgesetzt. # -# WICHTIG: -# - KEIN 127.0.0.1 -# - KEIN localhost -# - KEIN ::1 +# Eigene Listen- und Relay-Server gehoeren nicht hierher: sie werden +# mit /etc/postfix/smtpd_milter_map von allen Miltern ausgenommen. # -# Eintrag dieser Adressen würde DMARC komplett deaktivieren. -# -# ==> Datei bleibt absichtlich leer. +# ==> Datei bleibt absichtlich leer, solange keine Ausnahme noetig ist. EOF opendmarc_needs_restart=true if [[ $? -eq 0 ]] ; then