From e91c9f1b041fb09e3cb86f2d9da60cc647119d3c Mon Sep 17 00:00:00 2001 From: Christoph Date: Tue, 6 Jan 2026 23:21:58 +0100 Subject: [PATCH] install_opendmarc.sh: adjust konfiguration. --- install_opendmarc.sh | 199 +++++++++++++++++++++++++++++++------------ 1 file changed, 146 insertions(+), 53 deletions(-) diff --git a/install_opendmarc.sh b/install_opendmarc.sh index c33c530..43a9142 100755 --- a/install_opendmarc.sh +++ b/install_opendmarc.sh @@ -24,8 +24,8 @@ opendmarc_socket_dir="${postfix_spool_dir}/opendmarc" opendmarc_socket_file="${opendmarc_socket_dir}/opendmarc.sock" config_file_name_value_parameters=" - AuthservID|$(hostname -f) - TrustedAuthservIDs|$(hostname -f) + AuthservID|HOSTNAME + TrustedAuthservIDs|HOSTNAME PidFile|/run/opendmarc/opendmarc.pid RejectFailures|true Syslog|true @@ -37,11 +37,13 @@ config_file_name_value_parameters=" UMask|002 FailureReports|false AutoRestart|true - HistoryFile|/run/opendmarc/opendmarc.dat + HistoryFile|/run/opendmarc/opendmarc.dat SPFIgnoreResults|false SPFSelfValidate|true Socket|${opendmarc_socket_file} " + + declare -a config_file_name_value_parameter_arr=() for _conf in $config_file_name_value_parameters ; do config_file_name_value_parameter_arr+=("$_conf") @@ -193,14 +195,39 @@ echononl " Add 'IgnoreHosts' with default value to the opendmarc.conf file.." if ! $(grep -q -E "^IgnoreHosts\s+" ${opendmarc_conf_file} 2> /dev/null) ; then cat << EOF >> ${opendmarc_conf_file} +## IgnoreHosts (string) +## ## Specifies the path to a file that contains a list of hostnames, IP addresses, ## and/or CIDR expressions identifying hosts whose SMTP connections are to be ## ignored by the filter. If not specified, defaults to "127.0.0.1" only. # -IgnoreHosts 127.0.0.1 +IgnoreHosts /etc/opendmarc/ignore.hosts +EOF + if [[ $? -eq 0 ]] ; then + echo_ok + else + echo_failed + error "$(cat $log_file)" + fi +else + echo_skipped +fi -# Optional - auch nach Absender-Domain ignorieren: -IgnoreMailFrom ${opendmarc_base_dir}/ignore.mailfrom + +# - Add 'IgnoreMailFrom' with default value to the original opendmarc.conf file +# +echononl " Add 'IgnoreMailFrom' with default value to the opendmarc.conf file.." +if ! $(grep -q -E "^IgnoreMailFrom\s+" ${opendmarc_conf_file} 2> /dev/null) ; then + cat << EOF >> ${opendmarc_conf_file} + +## IgnoreMailFrom (string) +## +## Gives a list of domain names whose mail (based on the From: domain) +## is to be ignored by the filter. The list should be comma-separated. +## Matching against this list is case-insensitive. The default is an +## empty list, meaning no mail is ignored. +# +IgnoreMailFrom /etc/opendmarc/ignore.mailfrom EOF if [[ $? -eq 0 ]] ; then echo_ok @@ -220,10 +247,12 @@ echononl " Add '${_param}' with default value to the opendmarc.conf file.." if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then cat << EOF >> ${opendmarc_conf_file} +## IgnoreAuthenticatedClients (Boolean) +## ## If set, causes mail from authenticated clients (i.e., those that used ## SMTP AUTH) to be ignored by the filter. The default is "false". # -IgnoreAuthenticatedClients false +IgnoreAuthenticatedClients true EOF if [[ $? -eq 0 ]] ; then echo_ok @@ -250,30 +279,7 @@ if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then # will be used. Matching against this list is case-insensitive. The default is to use the # value of AuthservID. # -TrustedAuthservIDs OpenDMARC -EOF - if [[ $? -eq 0 ]] ; then - echo_ok - else - echo_failed - error "$(cat $log_file)" - fi -else - echo_skipped -fi - - -# - Add 'RequiredHeaders' with default value to the original opendmarc.conf file -# -_param="IgnoreAuthenticatedClients" -echononl " Add '${_param}' with default value to the opendmarc.conf file.." -if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then - cat << EOF >> ${opendmarc_conf_file} - -## If set, causes mail from authenticated clients (i.e., those that used -## SMTP AUTH) to be ignored by the filter. The default is "false". -# -IgnoreAuthenticatedClients false +TrustedAuthservIDs HOSTNAME EOF if [[ $? -eq 0 ]] ; then echo_ok @@ -293,6 +299,8 @@ echononl " Add '${_param}' with default value to the opendmarc.conf file.." if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then cat << EOF >> ${opendmarc_conf_file} +## RequiredHeaders (Boolean) +## ## If set, the filter will ensure the header of the message conforms to the basic ## header field count restrictions laid out in RFC5322, Section 3.6. Messages ## failing this test are rejected without further processing. A From: field from @@ -318,10 +326,12 @@ echononl " Add '${_param}' with default value to the opendmarc.conf file.." if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then cat << EOF >> ${opendmarc_conf_file} +## AutoRestart (Boolean) +## ## Automatically re-start on failures. Use with caution; if the filter fails ## instantly after it starts, this can cause a tight fork(2) loop. # -AutoRestart false +AutoRestart true EOF if [[ $? -eq 0 ]] ; then echo_ok @@ -341,6 +351,8 @@ echononl " Add '${_param}' with default value to the opendmarc.conf file.." if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then cat << EOF >> ${opendmarc_conf_file} +## HistoryFile (string) +## ## If set, specifies the location of a text file to which records are written ## that can be used to generate DMARC aggregate reports. Records are batches of ## rows containing information about a single received message, and include all @@ -349,7 +361,7 @@ if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then ## imported into a relational database from which the aggregate reports can be ## extracted using opendmarc-importstats(8). # -HistoryFile /run/opendmarc/opendmarc.dat +#HistoryFile /run/opendmarc/opendmarc.dat EOF if [[ $? -eq 0 ]] ; then echo_ok @@ -398,7 +410,7 @@ if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then ## looks for SPF results in headers and always performs the SPF check itself when ## this is set. The default is "false". # -SPFSelfValidate false +SPFSelfValidate true EOF if [[ $? -eq 0 ]] ; then echo_ok @@ -432,15 +444,6 @@ for _val in "${config_file_name_value_parameter_arr[@]}" ; do echononl " $opendmarc_conf_file: ${_val_arr[0]} -> ${_val_arr[1]}.." if $(grep -E -q "^\s*${_val_arr[0]}\s+${_val_arr[1]}\s*$" $opendmarc_conf_file 2> /dev/null) ; then echo_skipped - elif $(grep -E -q "^\s*#\s*${_val_arr[0]}\s+" $opendmarc_conf_file 2> /dev/null); then - perl -i -n -p -e "s&^(\s*#\s*${_val_arr[0]}.*)&\1\n${_val_arr[0]} ${_val_arr[1]}&" $opendmarc_conf_file > "$log_file" 2>&1 - if [[ $? -eq 0 ]] ; then - echo_ok - opendmarc_needs_restart=true - else - echo_failed - error "$(cat $log_file)" - fi elif $(grep -E -q "^\s*${_val_arr[0]}\s+" $opendmarc_conf_file 2> /dev/null) ; then perl -i -n -p -e "s#^(\s*${_val_arr[0]}.*)#\#\1\n${_val_arr[0]} ${_val_arr[1]}#" $opendmarc_conf_file > "$log_file" 2>&1 if [[ $? -eq 0 ]] ; then @@ -450,11 +453,8 @@ for _val in "${config_file_name_value_parameter_arr[@]}" ; do echo_failed error "$(cat $log_file)" fi - else - cat <> $opendmarc_conf_file 2> "$log_file" - -${_val_arr[0]} ${_val_arr[1]} -EOF + elif $(grep -E -q "^\s*#\s*${_val_arr[0]}\s+" $opendmarc_conf_file 2> /dev/null); then + perl -i -n -p -e "s&^(\s*#\s*${_val_arr[0]}.*)&\1\n${_val_arr[0]} ${_val_arr[1]}&" $opendmarc_conf_file > "$log_file" 2>&1 if [[ $? -eq 0 ]] ; then echo_ok opendmarc_needs_restart=true @@ -462,6 +462,100 @@ EOF echo_failed error "$(cat $log_file)" fi + else + if [[ "${_val_arr[0]}" == "IgnoreHosts" ]]; then + cat <> $opendmarc_conf_file 2> "$log_file" + +## IgnoreHosts (string) +## +## Specifies the path to a file that contains a list of hostnames, IP +## addresses, and/or CIDR expressions identifying hosts whose SMTP +## connections are to be ignored by the filter. If not specified, +## defaults to "127.0.0.1" only. +# +${_val_arr[0]} ${_val_arr[1]} +EOF + elif [[ "${_val_arr[0]}" == "IgnoreMailFrom" ]]; then + cat <> $opendmarc_conf_file 2> "$log_file" + +## IgnoreMailFrom (string) +## +## Gives a list of domain names whose mail (based on the From: domain) +## is to be ignored by the filter. The list should be comma-separated. +## Matching against this list is case-insensitive. The default is an +## empty list, meaning no mail is ignored. +# +${_val_arr[0]} ${_val_arr[1]} +EOF + elif [[ "${_val_arr[0]}" == "IgnoreAuthenticatedClients" ]]; then + cat <> $opendmarc_conf_file 2> "$log_file" + +## IgnoreAuthenticatedClients (Boolean) +## +## If set, causes mail from authenticated clients (i.e., those that used +## SMTP AUTH) to be ignored by the filter. The default is "false". +# +${_val_arr[0]} ${_val_arr[1]} +EOF + elif [[ "${_val_arr[0]}" == "AutoRestart" ]]; then + cat <> $opendmarc_conf_file 2> "$log_file" +## AutoRestart (Boolean) +## +## Automatically re-start on failures. Use with caution; if the filter +## fails instantly after it starts, this can cause a tight fork(2) +## loop. +# +${_val_arr[0]} ${_val_arr[1]} +EOF + elif [[ "${_val_arr[0]}" == "RequiredHeaders" ]]; then + cat <> $opendmarc_conf_file 2> "$log_file" + +## RequiredHeaders (Boolean) +## +## If set, the filter will ensure the header of the message conforms to +## the basic header field count restrictions laid out in RFC5322, +## Section 3.6. Messages failing this test are rejected without further +## processing. A From: field from which no domain name could be +## extracted will also be rejected. +# +${_val_arr[0]} ${_val_arr[1]} +EOF + elif [[ "${_val_arr[0]}" == "SPFSelfValidate" ]]; then + cat <> $opendmarc_conf_file 2> "$log_file" +## SPFSelfValidate (Boolean) +## +## Causes the filter to perform a fallback SPF check itself when it can +## find no SPF results in the message header. If SPFIgnoreResults is +## also set, it never looks for SPF results in headers and always +## performs the SPF check itself when this is set. The default is +## "false". +# +${_val_arr[0]} ${_val_arr[1]} +EOF + elif [[ "${_val_arr[0]}" == "SPFIgnoreResults" ]]; then + cat <> $opendmarc_conf_file 2> "$log_file" +## SPFIgnoreResults (Boolean) +## +## Causes the filter to ignore any SPF results in the header of the +## message. This is useful if you want the filter to perform SPF checks +## itself, or because you don't trust the arriving header. The default +## is "false". +# +${_val_arr[0]} ${_val_arr[1]} +EOF + else + cat <> $opendmarc_conf_file 2> "$log_file" + +${_val_arr[0]} ${_val_arr[1]} +EOF + if [[ $? -eq 0 ]] ; then + echo_ok + opendmarc_needs_restart=true + else + echo_failed + error "$(cat $log_file)" + fi + fi fi done @@ -694,7 +788,7 @@ fi echo "" -# - Edit /etc/postfix/main.cf and add a section to activate +# - Edit /etc/postfix/main.cf and add a section to activate # - processing of e-mail through the OpenDKIM daemon: # - backup_date="$(date +%Y-%m-%d-%H%M)" @@ -740,8 +834,7 @@ milter_protocol = 6 # 'smtpd_milters = local:/opendkim/opendkim.sock' here and add to # localhost:10025 section in master.cf: 'smtpd_milters=' # -#smtpd_milters = local:/opendkim/opendkim.sock -smtpd_milters = +smtpd_milters = local:/opendkim/opendkim.sock, local:/opendmarc/opendmarc.sock # Was sind non_smtpd_milters? # @@ -771,7 +864,7 @@ smtpd_milters = # # # DKIM soll auch die ausgehenden Mails signieren, die nicht über smtpd daemon versendet werden. -non_smtpd_milters = local:/opendkim/opendkim.sock +non_smtpd_milters = local:/opendkim/opendkim.sock, local:/opendmarc/opendmarc.sock EOF postfix_needs_restart=true if [[ $? -eq 0 ]] ; then @@ -830,7 +923,7 @@ while IFS='' read -r _line || [[ -n $_line ]] ; do _changed=true continue fi - + fi if echo "$_line" | grep -i -q -E "^\s*(localhost|127.0.0.1):10025\s+inet\s+" 2> /dev/null ; then