From ee1e2d0b7e8a3a8cf374dc074494a567a564581c Mon Sep 17 00:00:00 2001 From: Christoph Date: Tue, 10 Feb 2026 00:35:10 +0100 Subject: [PATCH 1/7] install_amavis.sh: add spamassassin rule for Null sender ( (Return-Path: <>). --- install_amavis.sh | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/install_amavis.sh b/install_amavis.sh index 276b2d1..2252922 100755 --- a/install_amavis.sh +++ b/install_amavis.sh @@ -2257,6 +2257,45 @@ if ! $installation_failed ; then fi fi +# Create /etc/spamassassin/99_nullsender.cf +# +# Spamassassin Regeln für Nullsender (Return-Path: <>) +# +# Problem: +# echte DSNs haben ebenfalls Return-Path: <> +# +# Aber: +# Echte DSNs sind i.d.R. multipart/report (delivery-status) +# +echononl " Create file \"/etc/spamassassin/99_nullsender.cf\".." +cat <<'EOF' > /etc/spamassassin/99_nullsender.cf 2> $tmp_err_msg +######################################################################## +# Null-sender (Return-Path: <>) Behandlung +# Ziel: Fake-Bounces markieren, echte DSNs nicht treffen +######################################################################## + +# 1) Null-Envelope-From erkannt +header LOCAL_NULL_SENDER Return-Path =~ /^<>$/i +describe LOCAL_NULL_SENDER Null envelope-from (Return-Path <>) +score LOCAL_NULL_SENDER 0.1 + +# 2) Echte DSNs sind i.d.R. multipart/report (delivery-status) +header LOCAL_DSN_MULTIPART Content-Type =~ /^multipart\/report\b/i +describe LOCAL_DSN_MULTIPART Looks like a real DSN (multipart/report) +score LOCAL_DSN_MULTIPART -3.0 + +# 3) Fake-Bounce: Null-sender, aber NICHT multipart/report +meta LOCAL_NULL_NOT_DSN LOCAL_NULL_SENDER && !LOCAL_DSN_MULTIPART +describe LOCAL_NULL_NOT_DSN Null-sender but not a DSN (likely fake bounce spam) +score LOCAL_NULL_NOT_DSN 6.0 +EOF +if [[ $? -eq 0 ]] ; then + echo_ok +else + echo_failed + error "$(cat $tmp_err_msg)" +fi + # - Enable nightly cronjob for spamassassin # - From d1694bf3a47209eae65eed5d1eb55e497b85da97 Mon Sep 17 00:00:00 2001 From: Christoph Date: Tue, 10 Feb 2026 00:37:03 +0100 Subject: [PATCH 2/7] install_postfix_advanced.sh: adjust '/etc/postfix/header_checks'. --- install_postfix_advanced.sh | 61 ++++++++++++++++++++++++------------- 1 file changed, 39 insertions(+), 22 deletions(-) diff --git a/install_postfix_advanced.sh b/install_postfix_advanced.sh index a4ba981..8745065 100755 --- a/install_postfix_advanced.sh +++ b/install_postfix_advanced.sh @@ -3616,41 +3616,58 @@ fi _file="/etc/postfix/header_checks.pcre" echononl " Create file '$_file' used for header replacing" if [[ ! -f "$_file" ]]; then - cat << EOF > "$_file" + cat << 'EOF' > "$_file" # --- -# - Replace headers +# - Header Checks - /etc/postfix/header_checks # --- +# +# Ziel: offensichtlich kaputte RFC-Header ablehnen (wenig False Positives) -# - Replace recieved from -#/^Received: from (.* \\([-._[:alnum:]]+ \\[[.[:digit:]]{7,15}\\]\\)).*?([[:space:]]+).*\\(Authenticated sender: ([^)]+)\\)(.*)/ REPLACE Received: from [127.0.0.1] (localhost [127.0.0.1])\$2(Authenticated sender: \$3)\$4 +######################################## +# A) Kaputter From:-Header +######################################## + +# 1) From: ist leer +/^From:\s*$/ REJECT Invalid From header (empty) - Spamschutzregel FROM-1001 + +# 2) Mehr als ein '@' im From:-Header -> syntaktisch kaputt +/^From:.*@.*@/ REJECT Invalid From header (multiple @) - Spamschutzregel FROM-1002 -# --- -# - Ignore Headers -# --- +# 3) Mehrere Mailboxen durch Komma getrennt (wie: Die@..., Lions@..., ...) +# (Legitime Fälle nutzen i.d.R. Display-Namen/Group-Syntax; dieses Muster ist in Spam sehr häufig) +/^From:\s*[^<>,]+@[^,]+,\s*[^<>,]+@/ REJECT Invalid From header (multiple mailboxes) - Spamschutzregel FROM-1003 -#/^\s*User-Agent/ IGNORE -#/^\s*X-Enigmail/ IGNORE -#/^\s*X-Mailer/ IGNORE -#/^\s*X-Originating-IP/ IGNORE +# 4) Typische kaputte UTF-8-Fragmente +/^From:.*\xC3\xA2/ REJECT Invalid UTF-8 in From header - Spamschutzregel FROM-1004 -# --- -# - Reject / Discard headers -# --- +######################################## +# B) Optional: sehr spezifische lokale Blacklist +######################################## -/^To:.*<>/ REJECT Possible SPAM Blank email address To: header - Header-Spamschutzregel T0-1001 +#/^Reply-To: .+\@inx1and1\..+/ REJECT Possible spam (local pattern) -/\(envelope-from <>\)/ REJECT Possible SPAM - Header-Spamschutzregel RECIEV-1001 -/^Reply-To: .+\@inx1and1\..+/ REJECT Possible SPAM - Header-Spamschutzregel REPLY-1001 +######################################## +# C) Warn +######################################## -/^From:.*<>/ REJECT Possible SPAM - Header-Spamschutzregel FROM-1001 +# Date-Rejects sind oft zu aggressiv -> wenn nötig: lieber taggen oder loggen statt reject +/^Date: .* 19[0-9][0-9]/ WARN Date far in the past Header-Spamschutzregel DATE-1001 +/^Date: .* 200[0-9]/ WARN Date far in the past Header-Spamschutzregel DATE-1002 +/^Date: .* 201[0-9]/ WARN Date far in the past Header-Spamschutzregel DATE-1003 + + + +######################################## +# Bemerkungen +######################################## + +# (envelope-from <>) nicht pauschal rejecten: +# echte DSNs/Bounces haben legitimerweise MAIL FROM: <> +#/\(envelope-from <>\)/ REJECT Null envelope-from -/^Date: .* 19[0-9][0-9]/ REJECT Date from the past. Fix your system clock. - Header-Spamschutzregel DATE-1001 -/^Date: .* 200[0-9]/ REJECT Date from the past. Fix your system clock. - Header-Spamschutzregel DATE-1002 -/^Date: .* 201[0-9]/ REJECT Date from the past. Fix your system clock. - Header-Spamschutzregel DATE-1003 -/^Date: .* 2020/ REJECT Date from the past. Fix your system clock. - Header-Spamschutzregel DATE-1004 EOF if [[ $? -eq 0 ]] ; then echo_ok From b4b47d5a792a21df76b88ba2e06e793a19344abc Mon Sep 17 00:00:00 2001 From: Christoph Date: Tue, 10 Feb 2026 14:14:53 +0100 Subject: [PATCH 3/7] =?UTF-8?q?install=5Famavis.sh:=20keine=20milters=20au?= =?UTF-8?q?f=20localhost:10025.=20install=5Fpostfix=5Fadvanced.sh:=20kein?= =?UTF-8?q?=20OpenDmarc=20bei=20non=5Fsmtpd=5Fmilters.=20(DMARC=20ist=20ei?= =?UTF-8?q?ne=20Inbound-Policy-Pr=C3=BCfung,=20nicht=20sinnvoll=20f=C3=BCr?= =?UTF-8?q?=20lokal/originating.)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- install_amavis.sh | 9 +++++++++ install_postfix_advanced.sh | 12 +++++------- 2 files changed, 14 insertions(+), 7 deletions(-) diff --git a/install_amavis.sh b/install_amavis.sh index 2252922..c46178d 100755 --- a/install_amavis.sh +++ b/install_amavis.sh @@ -4996,6 +4996,7 @@ fi ## - localhost:10025 inet n - y - - smtpd ## - -o content_filter= ## - -o smtpd_proxy_filter= +## - -o smtpd_milters= ## - -o smtpd_authorized_xforward_hosts=127.0.0.0/8,[::1]/128 ## - -o smtpd_client_restrictions= ## - -o smtpd_helo_restrictions= @@ -5070,6 +5071,8 @@ EOF localhost:10025 inet n - y - - smtpd -o content_filter= -o smtpd_proxy_filter= + -o smtpd_milters= + -o milter_macro_daemon_name=ORIGINATING -o smtpd_authorized_xforward_hosts=127.0.0.0/8,[::1]/128 -o smtpd_client_restrictions= -o smtpd_helo_restrictions= @@ -5132,6 +5135,8 @@ EOF localhost:10025 inet n - y - - smtpd -o content_filter= -o smtpd_proxy_filter= + -o smtpd_milters= + -o milter_macro_daemon_name=ORIGINATING -o smtpd_authorized_xforward_hosts=127.0.0.0/8,[::1]/128 -o smtpd_client_restrictions= -o smtpd_helo_restrictions= @@ -5184,6 +5189,8 @@ EOF localhost:10025 inet n - y - - smtpd -o content_filter= -o smtpd_proxy_filter= + -o smtpd_milters= + -o milter_macro_daemon_name=ORIGINATING -o smtpd_authorized_xforward_hosts=127.0.0.0/8,[::1]/128 -o smtpd_client_restrictions= -o smtpd_helo_restrictions= @@ -5220,6 +5227,8 @@ EOF localhost:10025 inet n - y - - smtpd -o content_filter= -o smtpd_proxy_filter= + -o smtpd_milters= + -o milter_macro_daemon_name=ORIGINATING -o smtpd_authorized_xforward_hosts=127.0.0.0/8,[::1]/128 -o smtpd_client_restrictions= -o smtpd_helo_restrictions= diff --git a/install_postfix_advanced.sh b/install_postfix_advanced.sh index 8745065..2be6542 100755 --- a/install_postfix_advanced.sh +++ b/install_postfix_advanced.sh @@ -3058,20 +3058,18 @@ EOF # EOF - if [[ -n "$(which opendkim)" ]] && [[ -n "$(which opendmarc)" ]] ; then + if [[ -n "$(which opendkim)" ]] ; then cat <> /etc/postfix/main.cf -non_smtpd_milters = local:/opendkim/opendkim.sock,local:/opendmarc/opendmarc.sock -EOF - elif [[ -n "$(which opendkim)" ]] ; then - cat <> /etc/postfix/main.cf -non_smtpd_milters = local:/opendkim/opendkim.sock +non_smtpd_milters = local:/opendkim/opendkim.sock EOF else cat <> /etc/postfix/main.cf -non_smtpd_milters = local:/opendmarc/opendmarc.sock +non_smtpd_milters = EOF fi + else + cat <> /etc/postfix/main.cf From 16618f9949b79bc3b30d8efbb0f30e63a3d2e939 Mon Sep 17 00:00:00 2001 From: Christoph Kuchenbuch Date: Tue, 10 Feb 2026 15:02:05 +0100 Subject: [PATCH 4/7] install_opendmarc.sh: no opendmarc check on non_smtpd connections. --- install_opendmarc.sh | 126 +++++++++++++++++++++---------------------- 1 file changed, 63 insertions(+), 63 deletions(-) diff --git a/install_opendmarc.sh b/install_opendmarc.sh index e08b116..06eb347 100755 --- a/install_opendmarc.sh +++ b/install_opendmarc.sh @@ -881,26 +881,26 @@ else error "$(cat $log_file)" fi -echononl " Set Variable non_smtpd_milters at '/etc/postfix/main.cf'.." -if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*opendkim.sock" /etc/postfix/main.cf 2> /dev/null) ; then - if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*$(basename "${opendmarc_socket_file}")" /etc/postfix/main.cf); then - echo_skipped - else - perl -i -n -p -e "s&^\s*(non_smtpd_milters\s*=.*opendkim.sock)&\1,local:/$(basename "${opendmarc_socket_dir}")/$(basename "${opendmarc_socket_file}")&" \ - /etc/postfix/main.cf > $log_file 2>&1 - if [[ $? -eq 0 ]] ; then - echo_ok - postfix_needs_restart=true - else - echo_failed - error "$(cat $log_file)" - fi - fi -else - - echo_skipped - warn "non_smtpd_milters is not adjusted. Complete Postfix configuration (main.cf) manually\!" -fi +#echononl " Set Variable non_smtpd_milters at '/etc/postfix/main.cf'.." +#if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*opendkim.sock" /etc/postfix/main.cf 2> /dev/null) ; then +# if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*$(basename "${opendmarc_socket_file}")" /etc/postfix/main.cf); then +# echo_skipped +# else +# perl -i -n -p -e "s&^\s*(non_smtpd_milters\s*=.*opendkim.sock)&\1,local:/$(basename "${opendmarc_socket_dir}")/$(basename "${opendmarc_socket_file}")&" \ +# /etc/postfix/main.cf > $log_file 2>&1 +# if [[ $? -eq 0 ]] ; then +# echo_ok +# postfix_needs_restart=true +# else +# echo_failed +# error "$(cat $log_file)" +# fi +# fi +#else +# +# echo_skipped +# warn "non_smtpd_milters is not adjusted. Complete Postfix configuration (main.cf) manually\!" +#fi echononl " Set Variable smtpd_milters at '/etc/postfix/main.cf'.." @@ -975,53 +975,53 @@ EOF fi -if grep -q -E "^\s*#?\s*non_smtpd_milters\s*=" ${main_cf_file} ; then - - ensure_dmarc_var "non_smtpd_milters" > "${tmp_main_cf_file}" - cp "${tmp_main_cf_file}" "${main_cf_file}" - -else - - cat <> /etc/postfix/main.cf 2> $log_file - -# Was sind non_smtpd_milters? +#if grep -q -E "^\s*#?\s*non_smtpd_milters\s*=" ${main_cf_file} ; then # -# non_smtpd_milters gilt für alle Postfix-Prozesse, die Mails verarbeiten, aber NICHT -# der smtpd-Daemon sind. +# ensure_dmarc_var "non_smtpd_milters" > "${tmp_main_cf_file}" +# cp "${tmp_main_cf_file}" "${main_cf_file}" # -# Das betrifft z. B.: +#else # -# cleanup Header/Content-Bereinigung -# qmgr Queue-Manager -# lmtp / smtp Auslieferung nach extern -# local lokale Zustellung +# cat <> /etc/postfix/main.cf 2> $log_file # -# Das sind z. B.: -# -# - interne Bounces (MAILER-DAEMON) -# -# - Cron-Mails vom Server -# -# - Weiterleitungen, die Postfix selbst generiert -# -# - Mails, die über sendmail CLI gesendet werden -# -# - Mails, die Amavis über LMTP zurückgibt -# -# - etc. -# -# -# DKIM soll auch die ausgehenden Mails signieren, die nicht über smtpd daemon versendet werden. -non_smtpd_milters = $opendmarc_socket_string -EOF -fi -postfix_needs_restart=true -if [[ $? -eq 0 ]] ; then - echo_ok -else - echo_failed - error "$(cat $log_file)" -fi +## Was sind non_smtpd_milters? +## +## non_smtpd_milters gilt für alle Postfix-Prozesse, die Mails verarbeiten, aber NICHT +## der smtpd-Daemon sind. +## +## Das betrifft z. B.: +## +## cleanup Header/Content-Bereinigung +## qmgr Queue-Manager +## lmtp / smtp Auslieferung nach extern +## local lokale Zustellung +## +## Das sind z. B.: +## +## - interne Bounces (MAILER-DAEMON) +## +## - Cron-Mails vom Server +## +## - Weiterleitungen, die Postfix selbst generiert +## +## - Mails, die über sendmail CLI gesendet werden +## +## - Mails, die Amavis über LMTP zurückgibt +## +## - etc. +## +## +## DKIM soll auch die ausgehenden Mails signieren, die nicht über smtpd daemon versendet werden. +#non_smtpd_milters = $opendmarc_socket_string +#EOF +#fi +#postfix_needs_restart=true +#if [[ $? -eq 0 ]] ; then +# echo_ok +#else +# echo_failed +# error "$(cat $log_file)" +#fi echo "" From 0a51e44b93a4afed5c4f91624abc1e3243173cc9 Mon Sep 17 00:00:00 2001 From: Christoph Date: Tue, 10 Feb 2026 15:27:39 +0100 Subject: [PATCH 5/7] install_amavis.sh: some minor changes.. --- install_amavis.sh | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/install_amavis.sh b/install_amavis.sh index c46178d..65f45d0 100755 --- a/install_amavis.sh +++ b/install_amavis.sh @@ -3299,6 +3299,18 @@ if $INSTALL_CLAMAV_UNOFFICIAL_SIGS ; then if [[ "$?" -ne 0 ]] ; then installation_failed=true error "$(cat $tmp_err_msg)" + + warn "command was: + + git clone https://github.com/extremeshok/clamav-unofficial-sigs.git /tmp/clamav-unofficial-sigs" + echononl "continue anyway [yes/no]: " + read OK + OK="$(echo "$OK" | tr '[:upper:]' '[:lower:]')" + while [[ "$OK" != "yes" ]] && [[ "$OK" != "no" ]] ; do + echononl "Wrong entry! - repeat [yes/nno]: " + read OK + done + [[ $OK = "yes" ]] || fatal "Abbruch durch User" fi if ! $installation_failed ; then echo_ok From 849cbfa2e4911bd27dee3ed7a1fcb41d6f340236 Mon Sep 17 00:00:00 2001 From: Christoph Date: Tue, 10 Feb 2026 23:58:58 +0100 Subject: [PATCH 6/7] install_postfixadmin.sh: some minor changes. --- install_postfixadmin.sh | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/install_postfixadmin.sh b/install_postfixadmin.sh index 8c693d6..827ee21 100755 --- a/install_postfixadmin.sh +++ b/install_postfixadmin.sh @@ -938,6 +938,16 @@ done if $_failed ; then echo_failed error "$(cat $log_file)" + + echononl "\tcontinue anyway [yes/no]: " + read OK + OK="$(echo "$OK" | tr '[:upper:]' '[:lower:]')" + while [[ "$OK" != "yes" ]] && [[ "$OK" != "no" ]] ; do + echononl "Wrong entry! - repeat [yes/nno]: " + read OK + done + [[ $OK = "yes" ]] || fatal "Script terminated by user input.." + else echo_ok fi From 9c52e54182d87145f2f47706d5465aaf04d71d8a Mon Sep 17 00:00:00 2001 From: Christoph Date: Wed, 11 Feb 2026 00:47:05 +0100 Subject: [PATCH 7/7] install_postfixadmin.sh: configuration file at version 4.x is 'config.local.php'. --- install_postfixadmin.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/install_postfixadmin.sh b/install_postfixadmin.sh index 827ee21..1fd7781 100755 --- a/install_postfixadmin.sh +++ b/install_postfixadmin.sh @@ -2208,7 +2208,7 @@ fi echo -e "\n\n\t\033[37m\033[1mConfigure Postfix Admin\033[m\n" -if [[ $MAJOR_VERSION -eq 3 ]] && [[ $MINOR_VERSION -gt 0 ]]; then +if [[ $MAJOR_VERSION -gt 3 ]] || [[ $MAJOR_VERSION -eq 3 ]] && [[ $MINOR_VERSION -gt 0 ]]; then pfa_conf_file="${WEBSITE_BASEDIR}/postfixadmin-${PF_ADMIN_VERSION}/config.local.php" cp -a "${WEBSITE_BASEDIR}/postfixadmin-${PF_ADMIN_VERSION}/config.inc.php" "$pfa_conf_file" else