diff --git a/README.install b/README.install index 00c1276..2056616 100644 --- a/README.install +++ b/README.install @@ -73,3 +73,7 @@ 6.) Install OpenDKIM - run script 'install_opendkim.sh'. + + +7.) Install OpenDMARC + - run script 'install_opendmarc.sh'. diff --git a/install_opendmarc.sh b/install_opendmarc.sh new file mode 100755 index 0000000..97ff2ac --- /dev/null +++ b/install_opendmarc.sh @@ -0,0 +1,504 @@ +#!/usr/bin/env bash + +clear +echo -e "\n \033[32mStart Installation of OpenDMARC..\033[m" + + + +# ------------- +# - Settings +# ------------- + +#_src_base_dir="$(realpath $(dirname $0))" +#conf_file="${_src_base_dir}/conf/install_opendmarc.conf" + +config_file_name_value_parameters=" + AuthservID:OpenDMARC + PidFile:/var/run/opendmarc/opendmarc.pid + RejectFailures:true + Syslog:true + SyslogFacility:mail + TrustedAuthservIDs:localhost,$(hostname -f) + IgnoreHosts:/etc/opendmarc/ignore.hosts + IgnoreAuthenticatedClients:true + RequiredHeaders:true + UMask:002 + FailureReports:false + AutoRestart:true + HistoryFile:/var/log/opendmarc.log + SPFSelfValidate:true +" +declare -a config_file_name_value_parameter_arr=() +for _conf in $config_file_name_value_parameters ; do + config_file_name_value_parameter_arr+=("$_conf") +done + +log_file="$(mktemp)" + +_opendmarc_packages="opendmarc" + +opendmarc_base_dir="/etc/opendmarc" +opendmarc_conf_file="/etc/opendmarc.conf" + +postfix_spool_dir="/var/spool/postfix" + +opendmarc_socket_dir="${postfix_spool_dir}/opendmarc" +opendmarc_socket_file="${opendmarc_socket_dir}/opendmarc.sock" + +postfix_needs_restart=false +opendmarc_needs_restart=false + +# ------------- +# --- Some functions +# ------------- +echononl(){ + echo X\\c > /tmp/shprompt$$ + if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then + echo -e -n "$*\\c" 1>&2 + else + echo -e -n "$*" 1>&2 + fi + rm /tmp/shprompt$$ +} + +fatal(){ + echo "" + echo -e "fatal error: $*" + echo "" + echo -e "\t\033[31m\033[1mInstalllation will be interrupted\033[m\033[m" + echo "" + exit 1 +} + +error(){ + echo "" + echo -e "\t[ \033[31m\033[1mFehler\033[m ]: $*" + echo "" +} + +warn (){ + echo "" + echo -e "\t[ \033[33m\033[1mWarning\033[m ]: $*" + echo "" +} + +info (){ + echo "" + echo -e "\t[ \033[32m\033[1mInfo\033[m ]: $*" + echo "" +} + +echo_done() { + echo -e "\033[80G[ \033[32mdone\033[m ]" +} +echo_ok() { + echo -e "\033[80G[ \033[32mok\033[m ]" +} +echo_warning() { + echo -e "\033[80G[ \033[33m\033[1mwarn\033[m ]" +} +echo_failed(){ + echo -e "\033[80G[ \033[1;31mfailed\033[m ]" +} +echo_skipped() { + echo -e "\033[80G[ \033[37mskipped\033[m ]" +} + + +# ------------- +# - Some pre-installation tasks +# ------------- + +# - Is 'systemd' supported on this system +# - +if [ "X`which systemd`" = "X" ]; then + SYSTEMD_EXISTS=false +else + SYSTEMD_EXISTS=true +fi + + + +# ============= +# - Start Installation +# ============= + +echo "" + +# - Synchronise package index files with the repository +# - +echononl " Synchronise package index files with the repository.." +apt-get update > "$log_file" 2>&1 +if [[ $? -eq 0 ]] ; then + echo_ok +else + echo_failed + error "$(cat $log_file)" +fi + + +# - Install opendmarc +# - +echononl " Install needed debian packages.." +opendmarc_packages="" +packages_installed=false +for _pkg in $_opendmarc_packages ; do + if aptitude search "$_pkg" | grep " $_pkg " | grep -e "^i" > /dev/null 2>&1 ; then + continue + else + opendmarc_packages="$opendmarc_packages $_pkg" + fi +done +if [[ -n "$opendmarc_packages" ]]; then + DEBIAN_FRONTEND=noninteractive apt-get -y install $opendmarc_packages > /dev/null 2> "$log_file" + packages_installed=true + opendmarc_needs_restart=true + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi +else + echo_skipped +fi + + +# - Add user 'postfix' to group 'opendmarc' +# - +echononl " Add user 'postfix' to group 'opendmarc'.." +if grep -E "^opendmarc" /etc/group | grep -q postfix 2> /dev/null ; then + echo_skipped +else + usermod -a -G opendmarc postfix > "$log_file" 2>&1 + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi +fi + + +# - Save configuration file from distribution +# - +echononl " Save configuration file from distribution" +if [[ -f "${opendmarc_conf_file}.ORIG" ]] ; then + echo_skipped +else + cp -a $opendmarc_conf_file $opendmarc_conf_file.ORIG 2> "$log_file" + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi +fi + +for _val in "${config_file_name_value_parameter_arr[@]}" ; do + IFS=':' read -a _val_arr <<< "${_val}" + + echononl " $opendmarc_conf_file: ${_val_arr[0]} -> ${_val_arr[1]}.." + if $(grep -E -q "^\s*${_val_arr[0]}\s+${_val_arr[1]}\s*$" $opendmarc_conf_file 2> /dev/null) ; then + echo_skipped + elif $(grep -E -q "^\s*#\s*${_val_arr[0]}\s+" $opendmarc_conf_file 2> /dev/null); then + perl -i -n -p -e "s&^(\s*#\s*${_val_arr[0]}.*)&\1\n${_val_arr[0]} ${_val_arr[1]}&" $opendmarc_conf_file > "$log_file" 2>&1 + if [[ $? -eq 0 ]] ; then + echo_ok + opendmarc_needs_restart=true + else + echo_failed + error "$(cat $log_file)" + fi + elif $(grep -E -q "^\s*${_val_arr[0]}\s+" $opendmarc_conf_file 2> /dev/null) ; then + perl -i -n -p -e "s#^(\s*${_val_arr[0]}.*)#\#\1\n${_val_arr[0]} ${_val_arr[1]}#" $opendmarc_conf_file > "$log_file" 2>&1 + if [[ $? -eq 0 ]] ; then + echo_ok + opendmarc_needs_restart=true + else + echo_failed + error "$(cat $log_file)" + fi + else + cat <> $opendmarc_conf_file 2> "$log_file" + +${_val_arr[0]} ${_val_arr[1]} +EOF + if [[ $? -eq 0 ]] ; then + echo_ok + opendmarc_needs_restart=true + else + echo_failed + error "$(cat $log_file)" + fi + fi +done + + +# - Assign ownership to the opendmarc user and restrict tthe +# - file permissions: +# - +echononl " Assign file permissions to '$opendmarc_conf_file'.." +chmod u=rw,go=r $opendmarc_conf_file 2> $log_file +if [[ $? -eq 0 ]] ; then + echo_ok +else + echo_failed + error "$(cat $log_file)" +fi + + +# - Create the directories to hold opendmarc's data files, assign +# - ownership to the opendmarc user, and restrict the file +# - permissions: +# - +echononl " Create directory '$opendmarc_base_dir'" +if [[ -d "$opendmarc_base_dir" ]] ; then + echo_skipped +else + opendmarc_needs_restart=true + mkdir ${opendmarc_base_dir} 2> $log_file + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi +fi +echononl " Set ownership on directory '${opendmarc_base_dir}' (recursive).." +chown -R opendmarc:opendmarc ${opendmarc_base_dir} 2> $log_file +if [[ $? -eq 0 ]] ; then + echo_ok +else + echo_failed + error "$(cat $log_file)" +fi + + + +# - Create the file ${opendmarc_base_dir}/ignore.hosts +# - +echononl " Create file '${opendmarc_base_dir}/ignore.hosts'.." +if [[ -f "${opendmarc_base_dir}/ignore.hosts" ]] ; then + echo_skipped +else + cat < ${opendmarc_base_dir}/ignore.hosts 2> $log_file +127.0.0.1 +::1 +localhost +$(hostname -f) +EOF + opendmarc_needs_restart=true + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi +fi + + +# - Edit /etc/default/opendmarc +# - +# - Set: +# - SOCKET="local:${postfix_spool_dir}/opendmarc/opendmarc.sock" +# - +echononl " Set 'SOCKET' at file /etc/default/opendmarc.." +if grep -q -E "^\s*SOCKET" /etc/default/opendmarc 2>/dev/null ; then + if grep -q -E "^\s*SOCKET\s*=\s*\"*local:$opendmarc_socket_file" /etc/default/opendmarc 2>/dev/null ; then + echo_skipped + else + perl -i -n -p -e "s#^\s*SOCKET=.*#SOCKET=\"local:$opendmarc_socket_file\"#" /etc/default/opendmarc 2> $log_file + opendmarc_needs_restart=true + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi + fi +else + cat <>/etc/default/opendmarc 2> $log_file +SOCKET="local:$opendmarc_socket_file" +EOF + opendmarc_needs_restart=true + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi +fi + + +# - Create the opendmarc socket directory in Postfix’s work area +# - and make sure it has the correct ownership: +# - +echononl " Create the opendmarc socket directory in Postfix's work area.." +if [[ -d "${postfix_spool_dir}/opendmarc" ]] ; then + echo_skipped +else + mkdir ${postfix_spool_dir}/opendmarc 2> $log_file + opendmarc_needs_restart=true + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi + echononl " Set ownership on directory '${postfix_spool_dir}/opendmarc'.." + chown opendmarc:postfix ${postfix_spool_dir}/opendmarc 2> $log_file + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi +fi + + +# - Edit /etc/postfix/main.cf and add a section to activate +# - processing of e-mail through the opendmarc daemon: +# - +backup_date="$(date +%Y-%m-%d-%H%M)" +echononl " Backup existing postfix configuration (main.cf).." +cp -a /etc/postfix/main.cf /etc/postfix/main.cf.$backup_date 2> $log_file +if [[ $? -eq 0 ]] ; then + echo_ok +else + echo_failed + error "$(cat $log_file)" +fi + +echononl " Set Variable non_smtpd_milters at '/etc/postfix/main.cf'.." +if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*opendkim.sock" /etc/postfix/main.cf 2> /dev/null) ; then + if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*${opendmarc_socket_file}" /etc/postfix/main.cf); then + echo_skipped + else + perl -i -n -p -e "s&^\s*(non_smtpd_milters\s*=.*opendkim.sock)&\1,local:/$(basename "${opendmarc_socket_dir}")/$(basename "${opendmarc_socket_file}")&" \ + /etc/postfix/main.cf > $log_file 2>&1 + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi + fi +else + echo_skipped + warn "Postfix is not adjusted. Complete Postfix configuration (main.cf) manually\!" +fi + + +# - Prevent Postfix from setting the DMARC Header twice (one befor +# - and one after processing amavis +# - +# - To disable milter processing after amavis, add to your master.cf in +# - the after-amavis section: +# - 127.0.0.1:10025 inet n - - - - smtpd +# - [...] +# - -o smtpd_milters= +# - +# - If you want to run the milter after amavis, set in main.cf +# - smtpd_milters= +# - to an empty string and add the smtpd_milters configuration to master.cf +# - (after-section amavis) instead: +# - -o smtpd_milters=local:/opendmarc/opendmarc.sock +# - +echononl " Backup file '/etc/postfix/master.cf'.." +cp -a /etc/postfix/master.cf /etc/postfix/master.cf.$backup_date 2> $log_file +if [[ $? -eq 0 ]] ; then + echo_ok +else + echo_failed + error "$(cat $log_file)" +fi + +echononl " Adjust /etc/postfix/master.cf. Set DMARC after sending throuh AmaVIS.." +if $(grep -q -E "^\s*-o\s+smtpd_milters\s*=\s*.*opendkim.sock" /etc/postfix/master.cf 2> /dev/null) ; then + if $(grep -q -E "^\s*-o\s+smtpd_milters\s*=\s*.*$(basename ${opendmarc_socket_file})" /etc/postfix/master.cf); then + echo_skipped + else + perl -i -n -p -e "s&(^\s*-o\s+smtpd_milters\s*=.*)&\1,local:/$(basename "${opendmarc_socket_dir}")/$(basename "${opendmarc_socket_file}")&" \ + /etc/postfix/master.cf > $log_file 2>&1 + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi + fi +else + echo_skipped + warn "Postfix is not adjusted. Complete Postfix configuration (master.cf) manually\!" +fi + +echo "" + +echononl " Enable OpenDMARC Service" +if $SYSTEMD_EXISTS ; then + systemctl enable opendmarc > $log_file 2>&1 + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi +else + warn "Maybe OpenDMARC Service is not enabled, because its an old non-systemd os.." +fi + +# - Restart opendmarc +# - +echononl " Restart opendmarc.." +if $opendmarc_needs_restart ; then + if $SYSTEMD_EXISTS ; then + systemctl restart opendmarc > $log_file 2>&1 + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi + else + /etc/init.d/opendmarc restart > $log_file 2>&1 + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi + fi +else + echo_skipped +fi + + +# - Restart Postfix so it starts using opendmarc when processing mail: +# - +echononl " Restart Postfix.." +if $postfix_needs_restart ; then + if $SYSTEMD_EXISTS ; then + systemctl restart postfix > $log_file 2>&1 + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi + else + /etc/init.d/postfix restart > $log_file 2>&1 + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi + fi +else + echo_skipped +fi + +echo "" +rm -f "$log_file" +exit 0