install/mailsystem
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

install_opendmarc.sh: adjust konfiguration.

Browse Source
This commit is contained in:
Christoph
2026-01-06 23:21:58 +01:00
parent 4bb27992d8
commit e91c9f1b04
1 changed files with 146 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

199
install_opendmarc.sh
View File

@@ -24,8 +24,8 @@ opendmarc_socket_dir="${postfix_spool_dir}/opendmarc"
opendmarc_socket_file="${opendmarc_socket_dir}/opendmarc.sock"
config_file_name_value_parameters="
AuthservID|$(hostname -f)
TrustedAuthservIDs|$(hostname -f)
AuthservID|HOSTNAME
TrustedAuthservIDs|HOSTNAME
PidFile|/run/opendmarc/opendmarc.pid
RejectFailures|true
Syslog|true
@@ -37,11 +37,13 @@ config_file_name_value_parameters="
UMask|002
FailureReports|false
AutoRestart|true
HistoryFile|/run/opendmarc/opendmarc.dat
HistoryFile|/run/opendmarc/opendmarc.dat
SPFIgnoreResults|false
SPFSelfValidate|true
Socket|${opendmarc_socket_file}
"
declare -a config_file_name_value_parameter_arr=()
for _conf in $config_file_name_value_parameters ; do
config_file_name_value_parameter_arr+=("$_conf")
@@ -193,14 +195,39 @@ echononl " Add 'IgnoreHosts' with default value to the opendmarc.conf file.."
if ! $(grep -q -E "^IgnoreHosts\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
cat << EOF >> ${opendmarc_conf_file}
## IgnoreHosts (string)
##
## Specifies the path to a file that contains a list of hostnames, IP addresses,
## and/or CIDR expressions identifying hosts whose SMTP connections are to be
## ignored by the filter. If not specified, defaults to "127.0.0.1" only.
#
IgnoreHosts 127.0.0.1
IgnoreHosts /etc/opendmarc/ignore.hosts
EOF
if [[ $? -eq 0 ]] ; then
echo_ok
else
echo_failed
error "$(cat $log_file)"
fi
else
echo_skipped
fi
# Optional - auch nach Absender-Domain ignorieren:
IgnoreMailFrom ${opendmarc_base_dir}/ignore.mailfrom
# - Add 'IgnoreMailFrom' with default value to the original opendmarc.conf file
#
echononl " Add 'IgnoreMailFrom' with default value to the opendmarc.conf file.."
if ! $(grep -q -E "^IgnoreMailFrom\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
cat << EOF >> ${opendmarc_conf_file}
## IgnoreMailFrom (string)
##
## Gives a list of domain names whose mail (based on the From: domain)
## is to be ignored by the filter. The list should be comma-separated.
## Matching against this list is case-insensitive. The default is an
## empty list, meaning no mail is ignored.
#
IgnoreMailFrom /etc/opendmarc/ignore.mailfrom
EOF
if [[ $? -eq 0 ]] ; then
echo_ok
@@ -220,10 +247,12 @@ echononl " Add '${_param}' with default value to the opendmarc.conf file.."
if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
cat << EOF >> ${opendmarc_conf_file}
## IgnoreAuthenticatedClients (Boolean)
##
## If set, causes mail from authenticated clients (i.e., those that used
## SMTP AUTH) to be ignored by the filter. The default is "false".
#
IgnoreAuthenticatedClients false
IgnoreAuthenticatedClients true
EOF
if [[ $? -eq 0 ]] ; then
echo_ok
@@ -250,30 +279,7 @@ if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
# will be used. Matching against this list is case-insensitive. The default is to use the
# value of AuthservID.
#
TrustedAuthservIDs OpenDMARC
EOF
if [[ $? -eq 0 ]] ; then
echo_ok
else
echo_failed
error "$(cat $log_file)"
fi
else
echo_skipped
fi
# - Add 'RequiredHeaders' with default value to the original opendmarc.conf file
#
_param="IgnoreAuthenticatedClients"
echononl " Add '${_param}' with default value to the opendmarc.conf file.."
if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
cat << EOF >> ${opendmarc_conf_file}
## If set, causes mail from authenticated clients (i.e., those that used
## SMTP AUTH) to be ignored by the filter. The default is "false".
#
IgnoreAuthenticatedClients false
TrustedAuthservIDs HOSTNAME
EOF
if [[ $? -eq 0 ]] ; then
echo_ok
@@ -293,6 +299,8 @@ echononl " Add '${_param}' with default value to the opendmarc.conf file.."
if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
cat << EOF >> ${opendmarc_conf_file}
## RequiredHeaders (Boolean)
##
## If set, the filter will ensure the header of the message conforms to the basic
## header field count restrictions laid out in RFC5322, Section 3.6. Messages
## failing this test are rejected without further processing. A From: field from
@@ -318,10 +326,12 @@ echononl " Add '${_param}' with default value to the opendmarc.conf file.."
if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
cat << EOF >> ${opendmarc_conf_file}
## AutoRestart (Boolean)
##
## Automatically re-start on failures. Use with caution; if the filter fails
## instantly after it starts, this can cause a tight fork(2) loop.
#
AutoRestart false
AutoRestart true
EOF
if [[ $? -eq 0 ]] ; then
echo_ok
@@ -341,6 +351,8 @@ echononl " Add '${_param}' with default value to the opendmarc.conf file.."
if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
cat << EOF >> ${opendmarc_conf_file}
## HistoryFile (string)
##
## If set, specifies the location of a text file to which records are written
## that can be used to generate DMARC aggregate reports. Records are batches of
## rows containing information about a single received message, and include all
@@ -349,7 +361,7 @@ if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
## imported into a relational database from which the aggregate reports can be
## extracted using opendmarc-importstats(8).
#
HistoryFile /run/opendmarc/opendmarc.dat
#HistoryFile /run/opendmarc/opendmarc.dat
EOF
if [[ $? -eq 0 ]] ; then
echo_ok
@@ -398,7 +410,7 @@ if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
## looks for SPF results in headers and always performs the SPF check itself when
## this is set. The default is "false".
#
SPFSelfValidate false
SPFSelfValidate true
EOF
if [[ $? -eq 0 ]] ; then
echo_ok
@@ -432,15 +444,6 @@ for _val in "${config_file_name_value_parameter_arr[@]}" ; do
echononl " $opendmarc_conf_file: ${_val_arr[0]} -> ${_val_arr[1]}.."
if $(grep -E -q "^\s*${_val_arr[0]}\s+${_val_arr[1]}\s*$" $opendmarc_conf_file 2> /dev/null) ; then
echo_skipped
elif $(grep -E -q "^\s*#\s*${_val_arr[0]}\s+" $opendmarc_conf_file 2> /dev/null); then
perl -i -n -p -e "s&^(\s*#\s*${_val_arr[0]}.*)&\1\n${_val_arr[0]} ${_val_arr[1]}&" $opendmarc_conf_file > "$log_file" 2>&1
if [[ $? -eq 0 ]] ; then
echo_ok
opendmarc_needs_restart=true
else
echo_failed
error "$(cat $log_file)"
fi
elif $(grep -E -q "^\s*${_val_arr[0]}\s+" $opendmarc_conf_file 2> /dev/null) ; then
perl -i -n -p -e "s#^(\s*${_val_arr[0]}.*)#\#\1\n${_val_arr[0]} ${_val_arr[1]}#" $opendmarc_conf_file > "$log_file" 2>&1
if [[ $? -eq 0 ]] ; then
@@ -450,11 +453,8 @@ for _val in "${config_file_name_value_parameter_arr[@]}" ; do
echo_failed
error "$(cat $log_file)"
fi
else
cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
${_val_arr[0]} ${_val_arr[1]}
EOF
elif $(grep -E -q "^\s*#\s*${_val_arr[0]}\s+" $opendmarc_conf_file 2> /dev/null); then
perl -i -n -p -e "s&^(\s*#\s*${_val_arr[0]}.*)&\1\n${_val_arr[0]} ${_val_arr[1]}&" $opendmarc_conf_file > "$log_file" 2>&1
if [[ $? -eq 0 ]] ; then
echo_ok
opendmarc_needs_restart=true
@@ -462,6 +462,100 @@ EOF
echo_failed
error "$(cat $log_file)"
fi
else
if [[ "${_val_arr[0]}" == "IgnoreHosts" ]]; then
cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
## IgnoreHosts (string)
##
## Specifies the path to a file that contains a list of hostnames, IP
## addresses, and/or CIDR expressions identifying hosts whose SMTP
## connections are to be ignored by the filter. If not specified,
## defaults to "127.0.0.1" only.
#
${_val_arr[0]} ${_val_arr[1]}
EOF
elif [[ "${_val_arr[0]}" == "IgnoreMailFrom" ]]; then
cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
## IgnoreMailFrom (string)
##
## Gives a list of domain names whose mail (based on the From: domain)
## is to be ignored by the filter. The list should be comma-separated.
## Matching against this list is case-insensitive. The default is an
## empty list, meaning no mail is ignored.
#
${_val_arr[0]} ${_val_arr[1]}
EOF
elif [[ "${_val_arr[0]}" == "IgnoreAuthenticatedClients" ]]; then
cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
## IgnoreAuthenticatedClients (Boolean)
##
## If set, causes mail from authenticated clients (i.e., those that used
## SMTP AUTH) to be ignored by the filter. The default is "false".
#
${_val_arr[0]} ${_val_arr[1]}
EOF
elif [[ "${_val_arr[0]}" == "AutoRestart" ]]; then
cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
## AutoRestart (Boolean)
##
## Automatically re-start on failures. Use with caution; if the filter
## fails instantly after it starts, this can cause a tight fork(2)
## loop.
#
${_val_arr[0]} ${_val_arr[1]}
EOF
elif [[ "${_val_arr[0]}" == "RequiredHeaders" ]]; then
cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
## RequiredHeaders (Boolean)
##
## If set, the filter will ensure the header of the message conforms to
## the basic header field count restrictions laid out in RFC5322,
## Section 3.6. Messages failing this test are rejected without further
## processing. A From: field from which no domain name could be
## extracted will also be rejected.
#
${_val_arr[0]} ${_val_arr[1]}
EOF
elif [[ "${_val_arr[0]}" == "SPFSelfValidate" ]]; then
cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
## SPFSelfValidate (Boolean)
##
## Causes the filter to perform a fallback SPF check itself when it can
## find no SPF results in the message header. If SPFIgnoreResults is
## also set, it never looks for SPF results in headers and always
## performs the SPF check itself when this is set. The default is
## "false".
#
${_val_arr[0]} ${_val_arr[1]}
EOF
elif [[ "${_val_arr[0]}" == "SPFIgnoreResults" ]]; then
cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
## SPFIgnoreResults (Boolean)
##
## Causes the filter to ignore any SPF results in the header of the
## message. This is useful if you want the filter to perform SPF checks
## itself, or because you don't trust the arriving header. The default
## is "false".
#
${_val_arr[0]} ${_val_arr[1]}
EOF
else
cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
${_val_arr[0]} ${_val_arr[1]}
EOF
if [[ $? -eq 0 ]] ; then
echo_ok
opendmarc_needs_restart=true
else
echo_failed
error "$(cat $log_file)"
fi
fi
fi
done
@@ -694,7 +788,7 @@ fi
echo ""
# - Edit /etc/postfix/main.cf and add a section to activate
# - Edit /etc/postfix/main.cf and add a section to activate
# - processing of e-mail through the OpenDKIM daemon:
# -
backup_date="$(date +%Y-%m-%d-%H%M)"
@@ -740,8 +834,7 @@ milter_protocol = 6
# 'smtpd_milters = local:/opendkim/opendkim.sock' here and add to
# localhost:10025 section in master.cf: 'smtpd_milters='
#
#smtpd_milters = local:/opendkim/opendkim.sock
smtpd_milters =
smtpd_milters = local:/opendkim/opendkim.sock, local:/opendmarc/opendmarc.sock
# Was sind non_smtpd_milters?
#
@@ -771,7 +864,7 @@ smtpd_milters =
#
#
# DKIM soll auch die ausgehenden Mails signieren, die nicht über smtpd daemon versendet werden.
non_smtpd_milters = local:/opendkim/opendkim.sock
non_smtpd_milters = local:/opendkim/opendkim.sock, local:/opendmarc/opendmarc.sock
EOF
postfix_needs_restart=true
if [[ $? -eq 0 ]] ; then
@@ -830,7 +923,7 @@ while IFS='' read -r _line || [[ -n $_line ]] ; do
_changed=true
continue
fi
fi
if echo "$_line" | grep -i -q -E "^\s*(localhost|127.0.0.1):10025\s+inet\s+" 2> /dev/null ; then