install_postfix_advanced.sh: remove depredated parameter 'permit_mx_backup'.

BAK/install_opendkim.sh.Pre-Queue.00

@@ -0,0 +1,684 @@
+#!/usr/bin/env bash
+
+clear
+echo -e "\n   \033[32mStart Installation of OpenDKIM..\033[m"
+
+
+
+# -------------
+# - Settings
+# -------------
+
+#_src_base_dir="$(realpath $(dirname $0))"
+#conf_file="${_src_base_dir}/conf/install_opendkim.conf"
+
+log_file="$(mktemp)"
+
+backup_date="$(date +%Y-%m-%d-%H%M)"
+
+_opendkim_packages="opendkim opendkim-tools"
+
+opendkim_base_dir="/etc/opendkim"
+opendkim_key_dir="${opendkim_base_dir}/keys"
+opendkim_conf_file="/etc/opendkim.conf"
+
+postfix_spool_dir="/var/spool/postfix"
+
+opendkim_socket_dir="${postfix_spool_dir}/opendkim"
+opendkim_socket_file="${opendkim_socket_dir}/opendkim.sock"
+
+postfix_needs_restart=false
+opendkim_needs_restart=false
+
+
+# -------------
+# --- Some functions
+# -------------
+echononl(){
+   echo X\\c > /tmp/shprompt$$
+   if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
+      echo -e -n "$*\\c" 1>&2
+   else
+       echo -e -n "$*" 1>&2
+   fi
+   rm /tmp/shprompt$$
+}
+
+fatal(){
+   echo ""
+   echo -e "fatal error: $*"
+   echo ""
+   echo -e "\t\033[31m\033[1mInstalllation will be interrupted\033[m\033[m"
+   echo ""
+   exit 1
+}
+
+error(){
+   echo ""
+   echo -e "\t[ \033[31m\033[1mFehler\033[m ]: $*"
+   echo ""
+}
+
+warn (){
+   echo ""
+   echo -e "\t[ \033[33m\033[1mWarning\033[m ]: $*"
+   echo ""
+}
+
+info (){
+   echo ""
+   echo -e "\t[ \033[32m\033[1mInfo\033[m ]: $*"
+   echo ""
+}
+
+echo_done() {
+   echo -e "\033[80G[ \033[32mdone\033[m ]"
+}
+echo_ok() {
+   echo -e "\033[80G[ \033[32mok\033[m ]"
+}
+echo_warning() {
+   echo -e "\033[80G[ \033[33m\033[1mwarn\033[m ]"
+}
+echo_failed(){
+   echo -e "\033[80G[ \033[1;31mfailed\033[m ]"
+}
+echo_skipped() {
+   echo -e "\033[80G[ \033[37mskipped\033[m ]"
+}
+
+
+# -------------
+# - Some pre-installation tasks
+# -------------
+
+# - Is 'systemd' supported on this system
+# -
+SYSTEMD_EXISTS=false
+systemd=$(which systemd)
+systemctl=$(which systemctl)
+
+if [[ -n "$systemd" ]] || [[ -n "$systemctl" ]] ; then
+   SYSTEMD_EXISTS=true
+fi
+
+
+
+# =============
+# - Start Installation
+# =============
+
+echo ""
+
+# - Synchronise package index files with the repository
+# -
+echononl "   Synchronise package index files with the repository.."
+apt-get update > "$log_file" 2>&1
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+
+
+# - Install OpenDKIM
+# -
+echononl "   Install needed debian packages.."
+opendkim_packages=""
+packages_installed=false
+for _pkg in $_opendkim_packages ; do
+   if aptitude search "$_pkg" | grep " $_pkg " | grep -e "^i" > /dev/null 2>&1 ; then
+      continue
+   else
+      opendkim_packages="$opendkim_packages $_pkg"
+   fi
+done
+if [[ -n "$opendkim_packages" ]]; then
+   DEBIAN_FRONTEND=noninteractive apt-get -y install $opendkim_packages > /dev/null 2> "$log_file"
+   packages_installed=true
+   opendkim_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+
+# - Add user 'postfix' to group 'opendkim'
+# -
+echononl "   Add user 'postfix' to group 'opendkim'.."
+if grep opendkim /etc/group | grep -q postfix 2> /dev/null ; then
+   echo_skipped
+else
+   adduser postfix opendkim > "$log_file" 2>&1
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Save configuration file from distribution
+# -
+echononl "   Save configuration file from distribution"
+if $packages_installed ; then
+   cp -a $opendkim_conf_file $opendkim_conf_file.ORIG 2> "$log_file"
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+echononl "   Backup existing file '${opendkim_conf_file}'.."
+if [[ -f "${opendkim_conf_file}" ]] ; then
+   mv "${opendkim_conf_file}" "${opendkim_conf_file}.${backup_date}"
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+# - Create OpenDKIM configuration
+# -
+echononl "   Create OpenDKIM configuration"
+if [[ -f "$opendkim_conf_file" ]] \
+      && grep -i -q -E "^\s*Socket\s+local:$opendkim_socket_file" "$opendkim_conf_file" \
+      && grep -i -q -E "^\s*SigningTable.*${opendkim_base_dir}/signing.table" "$opendkim_conf_file" \
+      && grep -i -q -E "^\s*KeyTable.*${opendkim_base_dir}/key.table" "$opendkim_conf_file" ; then
+   echo_skipped
+   warn "OpenDKIM seems already be configured."
+else
+   cat <<EOF > $opendkim_conf_file 2> $log_file
+# Datei $opendkim_conf_file
+
+# Sets the "authserv-id" to use when generating the Authentication-Results:
+# header field after verifying a message. The default is to use the name of
+# the MTA processing the message. If the string "HOSTNAME" is provided, the
+# name of the host running the filter (as returned by the gethostname(3)
+# function) will be used.
+AuthservID              "DKIM check $(hostname -f)"
+
+# OpenDKIM agiert als Mail Filter (= Milter) in den
+# Modi signer (s) und verifier (v) und verwendet eine
+# Socket-Datei zur Kommunikation (alternativ: lokaler Port)
+Mode                    sv
+
+# Socket                local:/var/run/opendkim/opendkim.sock
+# Socket                local:$opendkim_socket_file
+# Socket                inet:12345@localhost
+Socket                  local:$opendkim_socket_file
+
+# OpenDKIM verwendet diesen Benutzer bzw.
+# diese Gruppe
+UserID                  opendkim:opendkim
+UMask                   002
+PidFile                 /var/run/opendkim/opendkim.pid
+
+# OpenDKIM bei Problemen neustarten,
+# aber max. 10 mal pro Stunde
+AutoRestart             yes
+AutoRestartRate         10/1h
+
+# Logging (wenn alles funktioniert eventuell reduzieren)
+Syslog                  yes
+SyslogSuccess           yes
+LogWhy                  yes
+
+# Verfahren, wie Header und Body durch
+# OpenDKIM verarbeitet werden sollen.
+Canonicalization        relaxed/simple
+
+# interne Mails nicht mit OpenDKIM verarbeiten
+ExternalIgnoreList      refile:${opendkim_base_dir}/trusted
+InternalHosts           refile:${opendkim_base_dir}/trusted
+
+# welche Verschlüsselungs-Keys sollen für welche
+# Domains verwendet werden
+# (refile: für Dateien mit regulären Ausdrücke)
+SigningTable            refile:${opendkim_base_dir}/signing.table
+KeyTable                ${opendkim_base_dir}/key.table
+
+# diesen Signatur-Algorithmus verwenden
+SignatureAlgorithm      rsa-sha256
+
+# Always oversign From (sign using actual From and a null From to prevent
+# malicious signatures header fields (From and/or others) between the signer
+# and the verifier.  From is oversigned by default in the Debian pacakge
+# because it is often the identity key used by reputation systems and thus
+# somewhat security sensitive.
+OversignHeaders         From
+
+# Add an "Authentication-Results:" header field even to unsigned messages
+# from domains with no "signs all" policy. The reported DKIM result will be
+# "none" in such cases. Normally unsigned mail from non-strict domains does
+# not cause the results header field to be added.
+AlwaysAddARHeader       yes
+
+# Causes opendkim to fork and exits immediately, leaving the service running
+# in the background. The default is "true".
+Background              yes
+
+# Sets the DNS timeout in seconds. A value of 0 causes an infinite wait. The
+# default is 5. Ignored if not using an asynchronous resolver package. See
+# also the NOTES section below.
+DNSTimeout              5
+EOF
+   opendkim_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Assign ownership to the opendkim user and restrict tthe
+# - file permissions:
+# -
+echononl "   Assign ownership and file permissions.."
+chmod u=rw,go=r $opendkim_conf_file 2> $log_file
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+
+
+# - Create the directories to hold OpenDKIM’s data files, assign 
+# - ownership to the opendkim user, and restrict the file 
+# - permissions:
+# -
+echononl "   Create directory '$opendkim_base_dir'"
+if [[ -d "$opendkim_base_dir" ]] ; then
+   echo_skipped
+else
+   opendkim_needs_restart=true
+   mkdir ${opendkim_base_dir} 2> $log_file
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+echononl "   Create directory '$opendkim_key_dir'"
+if [[ -d "$opendkim_key_dir" ]] ; then
+   echo_skipped
+else
+   opendkim_needs_restart=true
+   mkdir $opendkim_key_dir 2> $log_file
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+echononl "   Set ownership on directory '${opendkim_base_dir}' (recursive).."
+chown -R opendkim:opendkim ${opendkim_base_dir} 2> $log_file
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+echononl "   Set file-permission on $opendkim_key_dir"
+chmod go-rw $opendkim_key_dir 2> $log_file
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+
+
+# - Create empty files
+# -    ${opendkim_base_dir}/signing.table
+# -    ${opendkim_base_dir}/key.table
+# -
+echononl "   Create empty file '${opendkim_base_dir}/signing.table'.."
+if [[ -f "${opendkim_base_dir}/signing.table" ]] ; then
+   echo_skipped
+else
+   touch ${opendkim_base_dir}/signing.table 2> $log_file
+   opendkim_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+echononl "   Create empty file '${opendkim_base_dir}/key.table'.."
+if [[ -f "${opendkim_base_dir}/key.table" ]] ; then
+   echo_skipped
+else
+   touch ${opendkim_base_dir}/key.table 2> $log_file
+   opendkim_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Create the trusted hosts file ${opendkim_base_dir}/trusted.hosts.
+# -
+echononl "   Create trusted hosts file '${opendkim_base_dir}/trusted'.."
+if [[ -f "${opendkim_base_dir}/trusted" ]] ; then
+   echo_skipped
+else
+   cat <<EOF > ${opendkim_base_dir}/trusted 2> $log_file
+127.0.0.1
+::1
+localhost
+$(hostname -f)
+EOF
+   opendkim_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Create the OpenDKIM socket directory in Postfix’s work area 
+# - and make sure it has the correct ownership:
+# -
+echononl "   Create the OpenDKIM socket directory in Postfix’s work area.."
+if [[ -d "${postfix_spool_dir}/opendkim" ]] ; then
+   echo_skipped
+else
+   mkdir ${postfix_spool_dir}/opendkim 2> $log_file
+   opendkim_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+   echononl "   Set ownership on directory '${postfix_spool_dir}/opendkim'.."
+   chown opendkim:postfix ${postfix_spool_dir}/opendkim 2> $log_file
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Edit /etc/default/opendkim
+# -
+# - Set:
+# -    SOCKET="local:${postfix_spool_dir}/opendkim/opendkim.sock"
+# -
+echononl "   Set 'SOCKET' at file /etc/default/opendkim.."
+if grep -q -E "^\s*SOCKET" /etc/default/opendkim 2>/dev/null ; then
+   if grep -q -E "^\s*SOCKET.*local:$opendkim_socket_file" /etc/default/opendkim  2>/dev/null ; then
+      echo_skipped
+   else
+      perl -i -n -p -e "s#^\s*SOCKET=.*#SOCKET=\"local:$opendkim_socket_file\"#" /etc/default/opendkim 2> $log_file
+      opendkim_needs_restart=true
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   fi
+else
+   cat <<EOF >>/etc/default/opendkim 2> $log_file
+SOCKET="local:$opendkim_socket_file"
+EOF
+   opendkim_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Edit /etc/postfix/main.cf and add a section to activate 
+# - processing of e-mail through the OpenDKIM daemon:
+# -
+backup_date="$(date +%Y-%m-%d-%H%M)"
+echononl "   Backup existing postfix configuration (main.cf).."
+cp -a /etc/postfix/main.cf /etc/postfix/main.cf.$backup_date 2> $log_file
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+
+echononl "   Activate processing of e-mail through the OpenDKIM daemon.."
+if grep -q -E "milter_default_action\s*=\s*accept" /etc/postfix/main.cf ; then
+   echo_skipped
+   warn "Postfix (main.cf) seems already be configured for milters"
+   echononl "   Delete previosly saved Postfix configuration.."
+   rm /etc/postfix/main.cf.$backup_date 2> $log_file
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   cat <<EOF >> /etc/postfix/main.cf 2> $log_file
+
+# ======= Milter configuration =======
+
+# OpenDKIM
+
+milter_default_action = accept
+
+# Postfix ≥ 2.6 milter_protocol = 6, Postfix ≤ 2.5 milter_protocol = 2
+milter_protocol = 6
+
+# Note:
+#    We will sign AFTER sending through AmaVIS, just befor sending out. So
+#    set 'smtpd_milters =' to an emty string here and add to localhost:10025
+#    section in master.cf: 'smtpd_milters=local:/opendkim/opendkim.sock'
+#
+#    If you want sign mails before sending through AmaVIS, set
+#    'smtpd_milters = local:/opendkim/opendkim.sock' here and add to
+#    localhost:10025 section in master.cf: 'smtpd_milters='
+#
+#smtpd_milters = local:/opendkim/opendkim.sock
+smtpd_milters =
+
+# Was sind non_smtpd_milters?
+#
+# non_smtpd_milters gilt für alle Postfix-Prozesse, die Mails verarbeiten, aber NICHT
+# der smtpd-Daemon sind.
+#
+# Das betrifft z. B.:
+#
+#     cleanup        Header/Content-Bereinigung
+#     qmgr           Queue-Manager
+#     lmtp / smtp    Auslieferung nach extern
+#     local          lokale Zustellung
+#
+# Das sind z. B.:
+#
+#     -  interne Bounces (MAILER-DAEMON)
+#
+#     -  Cron-Mails vom Server
+#
+#     -  Weiterleitungen, die Postfix selbst generiert
+#
+#     -  Mails, die über sendmail CLI gesendet werden
+#
+#     -  Mails, die Amavis über LMTP zurückgibt
+#
+#     -  etc.
+#
+#
+# DKIM soll auch die ausgehenden Mails signieren, die nicht über smtpd daemon versendet werden.
+non_smtpd_milters = local:/opendkim/opendkim.sock
+EOF
+   postfix_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Prevent Postfix from setting the DKIM Header twice (one befor
+# - and one after processing amavis
+# -
+# - To disable milter processing after amavis, add to your master.cf in 
+# - the after-amavis section:
+# -    127.0.0.1:10025 inet    n       -       -       -       -       smtpd
+# -       [...]
+# -       -o smtpd_milters=
+# -
+# - If you want to run the milter after amavis, set in main.cf
+# -    smtpd_milters= 
+# - to an empty string and add the smtpd_milters configuration to master.cf 
+# - (after-section amavis) instead:
+# -    -o smtpd_milters=local:/opendkim/opendkim.sock
+# -
+echononl "   Backup file '/etc/postfix/master.cf'.."
+cp -a /etc/postfix/master.cf /etc/postfix/master.cf.$backup_date 2> $log_file
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+echononl "   Adjust /etc/postfix/master.cf. Set DKIM after sending throuh AmaVIS.."
+_found=false
+_changed=false
+tmp_master_file="/tmp/postfix_master.cf"
+> $tmp_master_file
+while IFS='' read -r _line || [[ -n $_line ]] ; do
+
+   if $_found && ! echo "$_line" | grep -i -q -E "^\s*-o" 2> /dev/null ; then
+      echo "   -o smtpd_milters=local:/opendkim/opendkim.sock" >> "$tmp_master_file"
+      _changed=true
+      _found=false
+   fi
+
+   if $_found && echo "$_line" | grep -i -q -E "^\s*-o\s+smtpd_milters=\s*" ; then
+      _found=false
+      if ! echo "$_line" | grep -i -q -E "^\s*-o\s+smtpd_milters=\s*local:/opendkim/opendkim.sock\s*$" ; then
+         echo "   -o smtpd_milters=local:/opendkim/opendkim.sock" >> "$tmp_master_file"
+         _changed=true
+         continue
+      fi
+   fi
+
+   if echo "$_line" | grep -i -q -E "^\s*(submission|smtps)\s+inet\s+" 2> /dev/null ; then
+      _found=true
+   fi
+
+   echo "$_line" >> "$tmp_master_file"
+
+done < "/etc/postfix/master.cf"
+if $_changed ; then
+   cp $tmp_master_file /etc/postfix/master.cf 2> $log_file
+   postfix_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+   info "Postfix (master.cf) was not changed - seems already be configured right."
+   echononl "   Delete previosly saved file '/etc/postfix/master.cf'.."
+   rm /etc/postfix/master.cf.$backup_date 2> $log_file
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+rm -f $tmp_master_file
+
+echo ""
+
+# - Restart OpenDKIM
+# - 
+echononl "   Restart OpenDKIM.."
+if $opendkim_needs_restart ; then
+   if $SYSTEMD_EXISTS ; then
+      systemctl restart opendkim > $log_file 2>&1
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   else
+      /etc/init.d/opendkim restart > $log_file 2>&1
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   fi
+else
+   echo_skipped
+fi
+
+
+# - Restart Postfix so it starts using OpenDKIM when processing mail:
+# -
+echononl "   Restart Postfix.."
+if $postfix_needs_restart ; then
+   if $SYSTEMD_EXISTS ; then
+      systemctl restart postfix > $log_file 2>&1
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   else
+      /etc/init.d/postfix restart > $log_file 2>&1
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   fi
+else
+   echo_skipped
+fi
+
+echo ""
+rm -f "$log_file"
+exit 0

BAK/install_opendmarc.sh.Pre-Queue.00

@@ -0,0 +1,936 @@
+#!/usr/bin/env bash
+
+clear
+echo -e "\n   \033[32mStart Installation of OpenDMARC..\033[m"
+
+overwrite_config_files=true
+
+
+# -------------
+# - Settings
+# -------------
+
+#_src_base_dir="$(realpath $(dirname $0))"
+#conf_file="${_src_base_dir}/conf/install_opendmarc.conf"
+
+_opendmarc_packages="opendmarc"
+
+opendmarc_base_dir="/etc/opendmarc"
+opendmarc_conf_file="/etc/opendmarc.conf"
+
+postfix_spool_dir="/var/spool/postfix"
+
+opendmarc_socket_dir="${postfix_spool_dir}/opendmarc"
+opendmarc_socket_file="${opendmarc_socket_dir}/opendmarc.sock"
+
+config_file_name_value_parameters="
+   AuthservID|$(hostname -f)
+   TrustedAuthservIDs|$(hostname -f)
+   PidFile|/run/opendmarc/opendmarc.pid
+   RejectFailures|true
+   Syslog|true
+   SyslogFacility|mail
+   IgnoreHosts|${opendmarc_base_dir}/ignore.hosts
+   IgnoreMailFrom|${opendmarc_base_dir}/ignore.mailfrom
+   IgnoreAuthenticatedClients|true
+   RequiredHeaders|false
+   UMask|002
+   FailureReports|false
+   AutoRestart|true
+   HistoryFile|/run/opendmarc/opendmarc.dat
+   SPFIgnoreResults|false
+   SPFSelfValidate|true
+   Socket|${opendmarc_socket_file}
+"
+declare -a  config_file_name_value_parameter_arr=()
+for _conf in $config_file_name_value_parameters ; do
+   config_file_name_value_parameter_arr+=("$_conf")
+done
+
+postfix_needs_restart=false
+opendmarc_needs_restart=false
+
+backup_date="$(date +%Y-%m-%d-%H%M)"
+log_file="$(mktemp)"
+
+# -------------
+# --- Some functions
+# -------------
+echononl(){
+   echo X\\c > /tmp/shprompt$$
+   if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
+      echo -e -n "$*\\c" 1>&2
+   else
+       echo -e -n "$*" 1>&2
+   fi
+   rm /tmp/shprompt$$
+}
+
+fatal(){
+   echo ""
+   echo -e "fatal error: $*"
+   echo ""
+   echo -e "\t\033[31m\033[1mInstalllation will be interrupted\033[m\033[m"
+   echo ""
+   exit 1
+}
+
+error(){
+   echo ""
+   echo -e "\t[ \033[31m\033[1mFehler\033[m ]: $*"
+   echo ""
+}
+
+warn (){
+   echo ""
+   echo -e "\t[ \033[33m\033[1mWarning\033[m ]: $*"
+   echo ""
+}
+
+info (){
+   echo ""
+   echo -e "\t[ \033[32m\033[1mInfo\033[m ]: $*"
+   echo ""
+}
+
+echo_done() {
+   echo -e "\033[80G[ \033[32mdone\033[m ]"
+}
+echo_ok() {
+   echo -e "\033[80G[ \033[32mok\033[m ]"
+}
+echo_warning() {
+   echo -e "\033[80G[ \033[33m\033[1mwarn\033[m ]"
+}
+echo_failed(){
+   echo -e "\033[80G[ \033[1;31mfailed\033[m ]"
+}
+echo_skipped() {
+   echo -e "\033[80G[ \033[37mskipped\033[m ]"
+}
+
+
+# -------------
+# - Some pre-installation tasks
+# -------------
+
+# - Is 'systemd' supported on this system
+# -
+SYSTEMD_EXISTS=false
+systemd=$(which systemd)
+systemctl=$(which systemctl)
+
+if [[ -n "$systemd" ]] || [[ -n "$systemctl" ]] ; then
+   SYSTEMD_EXISTS=true
+fi
+
+
+
+# =============
+# - Start Installation
+# =============
+
+echo ""
+
+# - Synchronise package index files with the repository
+# -
+echononl "   Synchronise package index files with the repository.."
+apt-get update > "$log_file" 2>&1
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+
+
+# - Install opendmarc
+# -
+echononl "   Install needed debian packages.."
+opendmarc_packages=""
+packages_installed=false
+for _pkg in $_opendmarc_packages ; do
+   if aptitude search "$_pkg" | grep " $_pkg " | grep -e "^i" > /dev/null 2>&1 ; then
+      continue
+   else
+      opendmarc_packages="$opendmarc_packages $_pkg"
+   fi
+done
+if [[ -n "$opendmarc_packages" ]]; then
+   DEBIAN_FRONTEND=noninteractive apt-get -y install $opendmarc_packages > /dev/null 2> "$log_file"
+   packages_installed=true
+   opendmarc_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+
+# - Add user 'postfix' to group 'opendmarc'
+# -
+echononl "   Add user 'postfix' to group 'opendmarc'.."
+if grep -E "^opendmarc" /etc/group | grep -q postfix 2> /dev/null ; then
+   echo_skipped
+else
+   usermod -a -G opendmarc postfix > "$log_file" 2>&1
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Add 'IgnoreHosts' with default value to the original opendmarc.conf file
+#
+echononl " Add 'IgnoreHosts' with default value to the opendmarc.conf file.."
+if ! $(grep -q -E "^IgnoreHosts\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
+   cat << EOF >> ${opendmarc_conf_file}
+
+## Specifies the path to a file that contains a list of hostnames, IP addresses,
+## and/or CIDR expressions identifying hosts whose SMTP connections are to be
+## ignored by the filter. If not specified, defaults to "127.0.0.1" only.
+#
+IgnoreHosts 127.0.0.1
+
+# Optional - auch nach Absender-Domain ignorieren:
+IgnoreMailFrom ${opendmarc_base_dir}/ignore.mailfrom
+EOF
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+
+# - Add 'IgnoreAuthenticatedClients' with default value to the original opendmarc.conf file
+#
+_param="IgnoreAuthenticatedClients"
+echononl " Add '${_param}' with default value to the opendmarc.conf file.."
+if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
+   cat << EOF >> ${opendmarc_conf_file}
+
+## If set, causes mail from authenticated clients (i.e., those that used
+## SMTP AUTH) to be ignored by the filter. The default is "false".
+#
+IgnoreAuthenticatedClients false
+EOF
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+
+# - Add 'TrustedAuthservIDs' with default value to the original opendmarc.conf file
+#
+_param="TrustedAuthservIDs"
+echononl " Add '${_param}' with default value to the opendmarc.conf file.."
+if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
+   cat << EOF >> ${opendmarc_conf_file}
+
+# Provides a list of authserv-ids that are to be used to identify Authentication-Results
+# header fields whose contents are to be assumed as valid input for the DMARC assessment.
+# To provide a list, separate values by commas. If the string "HOSTNAME" is provided,
+# the name of the host running the filter (as returned by the gethostname(3) function)
+# will be used. Matching against this list is case-insensitive. The default is to use the
+# value of AuthservID.
+#
+TrustedAuthservIDs OpenDMARC
+EOF
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+
+# - Add 'RequiredHeaders' with default value to the original opendmarc.conf file
+#
+_param="IgnoreAuthenticatedClients"
+echononl " Add '${_param}' with default value to the opendmarc.conf file.."
+if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
+   cat << EOF >> ${opendmarc_conf_file}
+
+## If set, causes mail from authenticated clients (i.e., those that used
+## SMTP AUTH) to be ignored by the filter. The default is "false".
+#
+IgnoreAuthenticatedClients false
+EOF
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+
+# - Add 'RequiredHeaders' with default value to the original opendmarc.conf file
+#
+_param="RequiredHeaders"
+echononl " Add '${_param}' with default value to the opendmarc.conf file.."
+if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
+   cat << EOF >> ${opendmarc_conf_file}
+
+## If set, the filter will ensure the header of the message conforms to the basic
+## header field count restrictions laid out in RFC5322, Section 3.6. Messages
+## failing this test are rejected without further processing. A From: field from
+## which no domain name could be extracted will also be rejected.
+#
+RequiredHeaders false
+EOF
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+
+# - Add 'AutoRestart' with default value to the original opendmarc.conf file
+#
+_param="AutoRestart"
+echononl " Add '${_param}' with default value to the opendmarc.conf file.."
+if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
+   cat << EOF >> ${opendmarc_conf_file}
+
+## Automatically re-start on failures. Use with caution; if the filter fails
+## instantly after it starts, this can cause a tight fork(2) loop.
+#
+AutoRestart false
+EOF
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+
+# - Add 'HistoryFile' with default value to the original opendmarc.conf file
+#
+_param="HistoryFile"
+echononl " Add '${_param}' with default value to the opendmarc.conf file.."
+if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
+   cat << EOF >> ${opendmarc_conf_file}
+
+## If set, specifies the location of a text file to which records are written
+## that can be used to generate DMARC aggregate reports. Records are batches of
+## rows containing information about a single received message, and include all
+## relevant information needed to generate a DMARC aggregate report. It is
+## expected that this will not be used in its raw form, but rather periodically
+## imported into a relational database from which the aggregate reports can be
+## extracted using opendmarc-importstats(8).
+#
+HistoryFile /run/opendmarc/opendmarc.dat
+EOF
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+
+# - Add 'SPFIgnoreResults' with default value to the original opendmarc.conf file
+#
+_param="SPFIgnoreResults"
+echononl " Add '${_param}' with default value to the opendmarc.conf file.."
+if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
+   cat << EOF >> ${opendmarc_conf_file}
+
+## Causes the filter to ignore any SPF results in the header of the message. This
+## is useful if you want the filter to perform SPF checks itself, or because you
+## don't trust the arriving header. The default is "false".
+#
+SPFIgnoreResults false
+EOF
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+
+# - Add 'SPFSelfValidate' with default value to the original opendmarc.conf file
+#
+_param="SPFSelfValidate"
+echononl " Add '${_param}' with default value to the opendmarc.conf file.."
+if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
+   cat << EOF >> ${opendmarc_conf_file}
+
+## Causes the filter to perform a fallback SPF check itself when it can find no
+## SPF results in the message header. If SPFIgnoreResults is also set, it never
+## looks for SPF results in headers and always performs the SPF check itself when
+## this is set. The default is "false".
+#
+SPFSelfValidate false
+EOF
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+
+# - Save configuration file from distribution
+# -
+echononl "   Save configuration file from distribution"
+if [[ -f "${opendmarc_conf_file}.ORIG" ]] ; then
+   echo_skipped
+else
+   cp -a $opendmarc_conf_file $opendmarc_conf_file.ORIG 2> "$log_file"
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+for _val in "${config_file_name_value_parameter_arr[@]}" ; do
+   IFS='|' read -a _val_arr <<< "${_val}"
+
+   echononl "   $opendmarc_conf_file: ${_val_arr[0]} -> ${_val_arr[1]}.."
+   if $(grep -E -q "^\s*${_val_arr[0]}\s+${_val_arr[1]}\s*$" $opendmarc_conf_file 2> /dev/null) ; then
+      echo_skipped
+   elif $(grep -E -q "^\s*#\s*${_val_arr[0]}\s+" $opendmarc_conf_file 2> /dev/null); then
+      perl -i -n -p -e "s&^(\s*#\s*${_val_arr[0]}.*)&\1\n${_val_arr[0]} ${_val_arr[1]}&" $opendmarc_conf_file > "$log_file" 2>&1
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+         opendmarc_needs_restart=true
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   elif $(grep -E -q "^\s*${_val_arr[0]}\s+" $opendmarc_conf_file 2> /dev/null) ; then
+      perl -i -n -p -e "s#^(\s*${_val_arr[0]}.*)#\#\1\n${_val_arr[0]} ${_val_arr[1]}#" $opendmarc_conf_file > "$log_file" 2>&1
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+         opendmarc_needs_restart=true
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   else
+      cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
+
+${_val_arr[0]} ${_val_arr[1]}
+EOF
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+         opendmarc_needs_restart=true
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   fi
+done
+
+
+# - Assign ownership to the opendmarc user and restrict tthe
+# - file permissions:
+# -
+echononl "   Assign file permissions to '$opendmarc_conf_file'.."
+chmod u=rw,go=r $opendmarc_conf_file 2> $log_file
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+
+
+# - Create the directories to hold opendmarc's data files, assign
+# - ownership to the opendmarc user, and restrict the file
+# - permissions:
+# -
+echononl "   Create directory '$opendmarc_base_dir'"
+if [[ -d "$opendmarc_base_dir" ]] ; then
+   echo_skipped
+else
+   opendmarc_needs_restart=true
+   mkdir ${opendmarc_base_dir} 2> $log_file
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+echononl "   Set ownership on directory '${opendmarc_base_dir}' (recursive).."
+chown -R opendmarc:opendmarc ${opendmarc_base_dir} 2> $log_file
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+
+
+echononl "   Backup existing file '${opendmarc_base_dir}/ignore.hosts'.."
+if [[ -f "${opendmarc_base_dir}/ignore.hosts" ]] ; then
+   mv "${opendmarc_base_dir}/ignore.hosts" "${opendmarc_base_dir}/ignore.hosts.${backup_date}"
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+# - Create the file ${opendmarc_base_dir}/ignore.hosts
+# -
+echononl "   Create file '${opendmarc_base_dir}/ignore.hosts'.."
+if [[ -f "${opendmarc_base_dir}/ignore.hosts" ]] ; then
+   echo_skipped
+else
+   cat <<EOF > ${opendmarc_base_dir}/ignore.hosts 2> $log_file
+# /etc/opendmarc/ignore.hosts
+#
+# Aktuell hat OpenDMARC seinen Milter nur am Dienst
+# 'localhost:10025' hängen. Dort ist der Client
+# immer 127.0.0.1, nicht die externe Gegenstelle.
+#
+# Deshalb macht es in diesem Setup keinen Sinn,
+# hier IP-Adressen von externen Diensten (CRSend etc.)
+# einzutragen – sie würden nie matchen.
+#
+# WICHTIG:
+#  - KEIN 127.0.0.1
+#  - KEIN localhost
+#  - KEIN ::1
+#
+# Eintrag dieser Adressen würde DMARC komplett deaktivieren.
+#
+# ==> Datei bleibt absichtlich leer.
+EOF
+   opendmarc_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Create the file ${opendmarc_base_dir}/ignore.hosts
+# -
+
+echononl "   Backup existing file '${opendmarc_base_dir}/ignore.mailfrom'.."
+if [[ -f "${opendmarc_base_dir}/ignore.mailfrom" ]] ; then
+   mv "${opendmarc_base_dir}/ignore.mailfrom" "${opendmarc_base_dir}/ignore.mailfrom.${backup_date}"
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+echononl "   Create file '${opendmarc_base_dir}/ignore.mailfrom'.."
+if [[ -f "${opendmarc_base_dir}/ignore.mailfrom" ]] ; then
+   echo_skipped
+else
+   cat <<EOF > ${opendmarc_base_dir}/ignore.mailfrom 2> $log_file
+# /etc/opendmarc/ignore.mailfrom
+#
+# Hier könnte man Absender-Domains von der DMARC-Prüfung
+# ausnehmen (z. B. problematische Partner-Domains).
+#
+# Aktuell ist das für dein Setup nicht notwendig.
+#
+# Beispiele (NICHT aktiv!):
+#   @example.org
+#   example.org
+#
+# ==> Datei bleibt absichtlich leer.
+EOF
+   opendmarc_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Edit /etc/default/opendmarc
+# -
+# - Set:
+# -    SOCKET="local:${postfix_spool_dir}/opendmarc/opendmarc.sock"
+# -
+echononl "   Set 'SOCKET' at file /etc/default/opendmarc.."
+if grep -q -E "^\s*SOCKET" /etc/default/opendmarc 2>/dev/null ; then
+   if grep -q -E "^\s*SOCKET\s*=\s*\"*local:$opendmarc_socket_file" /etc/default/opendmarc  2>/dev/null ; then
+      echo_skipped
+   else
+      perl -i -n -p -e "s#^\s*SOCKET=.*#SOCKET=\"local:$opendmarc_socket_file\"#" /etc/default/opendmarc 2> $log_file
+      opendmarc_needs_restart=true
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   fi
+else
+   cat <<EOF >>/etc/default/opendmarc 2> $log_file
+SOCKET="local:$opendmarc_socket_file"
+EOF
+   opendmarc_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Create the opendmarc socket directory in Postfix’s work area
+# - and make sure it has the correct ownership:
+# -
+echononl "   Create the opendmarc socket directory in Postfix's work area.."
+if [[ -d "${postfix_spool_dir}/opendmarc" ]] ; then
+   echo_skipped
+else
+   mkdir ${postfix_spool_dir}/opendmarc 2> $log_file
+   opendmarc_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+   echononl "   Set ownership on directory '${postfix_spool_dir}/opendmarc'.."
+   chown opendmarc:postfix ${postfix_spool_dir}/opendmarc 2> $log_file
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Edit /etc/postfix/main.cf and add a section to activate
+# - processing of e-mail through the opendmarc daemon:
+# -
+echononl "   Backup existing postfix configuration (main.cf).."
+cp -a /etc/postfix/main.cf /etc/postfix/main.cf.$backup_date 2> $log_file
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+
+echononl "   Set Variable non_smtpd_milters at '/etc/postfix/main.cf'.."
+if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*opendkim.sock" /etc/postfix/main.cf 2> /dev/null) ; then
+   if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*$(basename "${opendmarc_socket_file}")" /etc/postfix/main.cf); then
+      echo_skipped
+   else
+      perl -i -n -p -e "s&^\s*(non_smtpd_milters\s*=.*opendkim.sock)&\1,local:/$(basename "${opendmarc_socket_dir}")/$(basename "${opendmarc_socket_file}")&" \
+         /etc/postfix/main.cf > $log_file 2>&1
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+         postfix_needs_restart=true
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   fi
+else
+   echo_skipped
+   warn "Postfix is not adjusted. Complete Postfix configuration (main.cf) manually\!"
+fi
+
+
+echo ""
+
+
+# - Edit /etc/postfix/main.cf and add a section to activate 
+# - processing of e-mail through the OpenDKIM daemon:
+# -
+backup_date="$(date +%Y-%m-%d-%H%M)"
+echononl "   Backup existing postfix configuration (main.cf).."
+cp -a /etc/postfix/main.cf /etc/postfix/main.cf.$backup_date 2> $log_file
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+
+echononl "   Activate processing of e-mail through the OpenDKIM daemon.."
+if grep -q -E "milter_default_action\s*=\s*accept" /etc/postfix/main.cf ; then
+   echo_skipped
+   info "Postfix (main.cf) was not changed - seems already be configured right."
+   echononl "   Delete previosly saved Postfix configuration.."
+   rm /etc/postfix/main.cf.$backup_date 2> $log_file
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   cat <<EOF >> /etc/postfix/main.cf 2> $log_file
+
+# ======= Milter configuration =======
+
+# OpenDKIM
+
+milter_default_action = accept
+
+# Postfix ≥ 2.6 milter_protocol = 6, Postfix ≤ 2.5 milter_protocol = 2
+milter_protocol = 6
+
+# Note:
+#    We will sign AFTER sending through AmaVIS, just befor sending out. So
+#    set 'smtpd_milters =' to an emty string here and add to localhost:10025
+#    section in master.cf: 'smtpd_milters=local:/opendkim/opendkim.sock'
+#
+#    If you want sign mails before sending through AmaVIS, set
+#    'smtpd_milters = local:/opendkim/opendkim.sock' here and add to
+#    localhost:10025 section in master.cf: 'smtpd_milters='
+#
+#smtpd_milters = local:/opendkim/opendkim.sock
+smtpd_milters =
+
+# Was sind non_smtpd_milters?
+#
+# non_smtpd_milters gilt für alle Postfix-Prozesse, die Mails verarbeiten, aber NICHT
+# der smtpd-Daemon sind.
+#
+# Das betrifft z. B.:
+#
+#     cleanup        Header/Content-Bereinigung
+#     qmgr           Queue-Manager
+#     lmtp / smtp    Auslieferung nach extern
+#     local          lokale Zustellung
+#
+# Das sind z. B.:
+#
+#     -  interne Bounces (MAILER-DAEMON)
+#
+#     -  Cron-Mails vom Server
+#
+#     -  Weiterleitungen, die Postfix selbst generiert
+#
+#     -  Mails, die über sendmail CLI gesendet werden
+#
+#     -  Mails, die Amavis über LMTP zurückgibt
+#
+#     -  etc.
+#
+#
+# DKIM soll auch die ausgehenden Mails signieren, die nicht über smtpd daemon versendet werden.
+non_smtpd_milters = local:/opendkim/opendkim.sock
+EOF
+   postfix_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+echo ""
+
+
+# - Prevent Postfix from setting the DMARC Header twice (one befor
+# - and one after processing amavis
+# -
+# - To disable milter processing after amavis, add to your master.cf in
+# - the after-amavis section:
+# -    127.0.0.1:10025 inet    n       -       -       -       -       smtpd
+# -       [...]
+# -       -o smtpd_milters=
+# -
+# - If you want to run the milter after amavis, set in main.cf
+# -    smtpd_milters=
+# - to an empty string and add the smtpd_milters configuration to master.cf
+# - (after-section amavis) instead:
+# -    -o smtpd_milters=local:/opendmarc/opendmarc.sock
+# -
+echononl "   Backup file '/etc/postfix/master.cf'.."
+cp -a /etc/postfix/master.cf /etc/postfix/master.cf.${backup_date} 2> $log_file
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+
+echononl "   Adjust /etc/postfix/master.cf. Set DMARC after sending throuh AmaVIS.."
+_found=false
+_changed=false
+tmp_master_file="/tmp/postfix_master.cf"
+> $tmp_master_file
+while IFS='' read -r _line || [[ -n $_line ]] ; do
+
+   if $_found && ! echo "$_line" | grep -i -q -E "^\s*-o" 2> /dev/null ; then
+      echo "   -o smtpd_milters=local:/opendmarc/opendmarc.sock" >> "$tmp_master_file"
+      _changed=true
+      _found=false
+   fi
+
+   if $_found && echo "$_line" | grep -i -q -E "^\s*-o\s+smtpd_milters=\s*" ; then
+      _found=false
+      if ! echo "$_line" | grep -i -q -E "^\s*-o\s+smtpd_milters=\s*local:/opendmarc/opendmarc.sock\s*$" ; then
+         echo "   -o smtpd_milters=local:/opendmarc/opendmarc.sock" >> "$tmp_master_file"
+         _changed=true
+         continue
+      fi
+         
+   fi
+
+   if echo "$_line" | grep -i -q -E "^\s*(localhost|127.0.0.1):10025\s+inet\s+" 2> /dev/null ; then
+      _found=true
+   fi
+
+   echo "$_line" >> "$tmp_master_file"
+
+done < "/etc/postfix/master.cf"
+
+if $_changed ; then
+   cp $tmp_master_file /etc/postfix/master.cf 2> $log_file
+   postfix_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+   info "Postfix (master.cf) was not changed - seems already be configured right."
+   echononl "   Delete previosly saved file '/etc/postfix/master.cf'.."
+   rm /etc/postfix/master.cf.$backup_date 2> $log_file
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+rm -f $tmp_master_file
+
+echo ""
+
+echononl "   Enable OpenDMARC Service"
+if $SYSTEMD_EXISTS ; then
+   systemctl enable opendmarc > $log_file 2>&1
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   warn "Maybe OpenDMARC Service is not enabled, because its an old non-systemd os.."
+fi
+
+# - Restart opendmarc
+# -
+echononl "   Restart opendmarc.."
+if $opendmarc_needs_restart ; then
+   if $SYSTEMD_EXISTS ; then
+      systemctl restart opendmarc > $log_file 2>&1
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   else
+      /etc/init.d/opendmarc restart > $log_file 2>&1
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   fi
+else
+   echo_skipped
+fi
+
+
+# - Restart Postfix so it starts using opendmarc when processing mail:
+# -
+echononl "   Restart Postfix.."
+if $postfix_needs_restart ; then
+   if $SYSTEMD_EXISTS ; then
+      systemctl restart postfix > $log_file 2>&1
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   else
+      /etc/init.d/postfix restart > $log_file 2>&1
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   fi
+else
+   echo_skipped
+fi
+
+
+echo ""
+rm -f "$log_file"
+exit 0

DOC/DMARC_Rejections_SOP.md

@@ -0,0 +1,36 @@
+# Analyse und Begründung von DMARC-Rejects
+## (Postfix + OpenDMARC 1.4.2)
+
+### 1. Zweck
+Diese SOP beschreibt, wie DMARC-Rejects auf dem Mailserver revisionssicher analysiert und begründet werden, ohne die betroffene E-Mail anzunehmen oder erneut senden zu lassen.
+
+### 2. Systemkontext
+- MTA: Postfix
+- DMARC-Filter: OpenDMARC 1.4.2
+- SPF-Prüfung: policyd-spf
+- DKIM-Prüfung: OpenDKIM
+- Entscheidungspunkt: SMTP END-OF-MESSAGE
+
+### 3. Grundprinzip
+OpenDMARC loggt nur das Endergebnis der DMARC-Evaluation, nicht die Detailursachen. Die Ursache eines Rejects wird durch Log-Korrelation ermittelt.
+
+### 4. Relevante Logquellen
+- Postfix (SMTP-Rejects)
+- policyd-spf (SPF-Ergebnis, identity)
+- OpenDMARC (pass/fail/none pro Domain)
+
+### 5. Entscheidungslogik
+DMARC besteht nur, wenn mindestens ein Mechanismus DMARC-konform erfolgreich ist:
+- SPF(mailfrom) aligned
+- DKIM valid + aligned
+
+SPF über HELO ist für DMARC nicht verwertbar.
+
+### 6. Ableitungsregel
+Wenn SPF nur über HELO erfolgreich war und DMARC fail meldet, muss DKIM fehlgeschlagen sein.
+
+### 7. Revisionssichere Begründung
+Die E-Mail wurde gemäß der DMARC-Policy der Absenderdomain abgelehnt, da keine DMARC-konforme Authentifizierung vorlag.
+
+### 8. Referenzen
+RFC 7489 (DMARC), RFC 7208 (SPF), RFC 6376 (DKIM)

README.install

@@ -58,7 +58,7 @@
    -  create configuration file 'install_update_dovecot.conf'
          cp -a conf install_update_dovecot.conf.sample install_update_dovecot.conf
    - adjust configuration file 'install_update_dovecot.conf' to your needs
-   - run script 'install_update_dovecot.sh'
+   - run script 'install_update_dovecot-2.4.sh' # the old one was: 'install_update_dovecot.sh'
 
    Note:
       Maybe you have to finish installing postfixadmin, i.e creating admin account(s).

conf/install_update_dovecot.conf.sample

@@ -145,7 +145,7 @@ dbhost=""
 # - Cert/Key configurations
 # ---
 
-cert_base_dir="/etc/postfix/ssl"
+cert_base_dir="/etc/dovecot/ssl"
 server_cert=${cert_base_dir}/mailserver.crt
 server_key=${cert_base_dir}/mailserver.key
 dh_pem_file="${cert_base_dir}/dh_4096.pem"

install_amavis.sh

@@ -2257,6 +2257,45 @@ if ! $installation_failed ; then
    fi
 fi
 
+# Create /etc/spamassassin/99_nullsender.cf
+#
+# Spamassassin Regeln für Nullsender (Return-Path: <>)
+#
+# Problem:
+#     echte DSNs haben ebenfalls Return-Path: <>
+#
+# Aber:
+#     Echte DSNs sind i.d.R. multipart/report (delivery-status)
+#
+echononl "   Create file \"/etc/spamassassin/99_nullsender.cf\".."
+cat <<'EOF' > /etc/spamassassin/99_nullsender.cf 2> $tmp_err_msg
+########################################################################
+# Null-sender (Return-Path: <>) Behandlung
+# Ziel: Fake-Bounces markieren, echte DSNs nicht treffen
+########################################################################
+
+# 1) Null-Envelope-From erkannt
+header  LOCAL_NULL_SENDER      Return-Path =~ /^<>$/i
+describe LOCAL_NULL_SENDER     Null envelope-from (Return-Path <>)
+score   LOCAL_NULL_SENDER      0.1
+
+# 2) Echte DSNs sind i.d.R. multipart/report (delivery-status)
+header  LOCAL_DSN_MULTIPART    Content-Type =~ /^multipart\/report\b/i
+describe LOCAL_DSN_MULTIPART   Looks like a real DSN (multipart/report)
+score   LOCAL_DSN_MULTIPART    -3.0
+
+# 3) Fake-Bounce: Null-sender, aber NICHT multipart/report
+meta    LOCAL_NULL_NOT_DSN     LOCAL_NULL_SENDER && !LOCAL_DSN_MULTIPART
+describe LOCAL_NULL_NOT_DSN    Null-sender but not a DSN (likely fake bounce spam)
+score   LOCAL_NULL_NOT_DSN     6.0
+EOF
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $tmp_err_msg)"
+fi
+
 
 # - Enable nightly cronjob for spamassassin
 # -
@@ -3260,6 +3299,18 @@ if $INSTALL_CLAMAV_UNOFFICIAL_SIGS ; then
    if [[ "$?" -ne 0 ]] ; then
       installation_failed=true
       error "$(cat $tmp_err_msg)"
+
+      warn "command was:
+
+                     git clone https://github.com/extremeshok/clamav-unofficial-sigs.git /tmp/clamav-unofficial-sigs"
+		echononl "continue anyway [yes/no]: "
+		read OK
+		OK="$(echo "$OK" | tr '[:upper:]' '[:lower:]')"
+		while [[ "$OK" != "yes" ]] && [[  "$OK" != "no" ]] ; do
+			echononl "Wrong entry! - repeat [yes/nno]: "
+			read OK
+		done
+		[[ $OK = "yes" ]] || fatal "Abbruch durch User"
    fi
    if ! $installation_failed ; then
       echo_ok
@@ -4957,6 +5008,7 @@ fi
 ## -  localhost:10025  inet  n       -       y       -       -       smtpd
 ## -     -o content_filter=
 ## -     -o smtpd_proxy_filter=
+## -     -o smtpd_milters=
 ## -     -o smtpd_authorized_xforward_hosts=127.0.0.0/8,[::1]/128
 ## -     -o smtpd_client_restrictions=
 ## -     -o smtpd_helo_restrictions=
@@ -5031,6 +5083,8 @@ EOF
 localhost:10025  inet  n       -       y       -       -       smtpd
    -o content_filter=
    -o smtpd_proxy_filter=
+   -o smtpd_milters=
+   -o milter_macro_daemon_name=ORIGINATING
    -o smtpd_authorized_xforward_hosts=127.0.0.0/8,[::1]/128
    -o smtpd_client_restrictions=
    -o smtpd_helo_restrictions=
@@ -5093,6 +5147,8 @@ EOF
 localhost:10025  inet  n       -       y       -       -       smtpd
    -o content_filter=
    -o smtpd_proxy_filter=
+   -o smtpd_milters=
+   -o milter_macro_daemon_name=ORIGINATING
    -o smtpd_authorized_xforward_hosts=127.0.0.0/8,[::1]/128
    -o smtpd_client_restrictions=
    -o smtpd_helo_restrictions=
@@ -5115,7 +5171,6 @@ EOF
 amavisfeed unix -       -       n       -       20       lmtp
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
-   -o disable_dns_lookups=yes
 EOF
 			fi
 		fi # if ! $smtps_present
@@ -5146,6 +5201,8 @@ EOF
 localhost:10025  inet  n       -       y       -       -       smtpd
    -o content_filter=
    -o smtpd_proxy_filter=
+   -o smtpd_milters=
+   -o milter_macro_daemon_name=ORIGINATING
    -o smtpd_authorized_xforward_hosts=127.0.0.0/8,[::1]/128
    -o smtpd_client_restrictions=
    -o smtpd_helo_restrictions=
@@ -5168,7 +5225,6 @@ EOF
 amavisfeed unix -       -       n       -       20       lmtp
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
-   -o disable_dns_lookups=yes
 EOF
 		fi
 
@@ -5183,6 +5239,8 @@ EOF
 localhost:10025  inet  n       -       y       -       -       smtpd
    -o content_filter=
    -o smtpd_proxy_filter=
+   -o smtpd_milters=
+   -o milter_macro_daemon_name=ORIGINATING
    -o smtpd_authorized_xforward_hosts=127.0.0.0/8,[::1]/128
    -o smtpd_client_restrictions=
    -o smtpd_helo_restrictions=
@@ -5207,7 +5265,6 @@ EOF
 amavisfeed unix -       -       n       -       20       lmtp
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
-   -o disable_dns_lookups=yes
 EOF
       continue
    fi

install_opendkim.sh

@@ -13,6 +13,9 @@ echo -e "\n   \033[32mStart Installation of OpenDKIM..\033[m"
 #conf_file="${_src_base_dir}/conf/install_opendkim.conf"
 
 log_file="$(mktemp)"
+tmp_main_cf_file="$(mktemp)"
+
+main_cf_file="/etc/postfix/main.cf"
 
 backup_date="$(date +%Y-%m-%d-%H%M)"
 
@@ -27,6 +30,8 @@ postfix_spool_dir="/var/spool/postfix"
 opendkim_socket_dir="${postfix_spool_dir}/opendkim"
 opendkim_socket_file="${opendkim_socket_dir}/opendkim.sock"
 
+opendkim_socket_string="local:/opendkim/opendkim.sock"
+
 postfix_needs_restart=false
 opendkim_needs_restart=false
 
@@ -87,6 +92,82 @@ echo_skipped() {
    echo -e "\033[80G[ \033[37mskipped\033[m ]"
 }
 
+# Funktion stellt sicher, dass in /etc/postfix/main.cf
+# - smtpd_milters
+# - non_smtpd_milters
+# den Wert "local:/opendkim/opendkim.sock" enthalten.
+#
+# Logik:
+# 1) Existiert eine aktive Zeile (nicht auskommentiert)? → anpassen
+# 2) Sonst: existiert eine auskommentierte Zeile? → ersetzen (entkommentieren)
+# 3) Sonst: Variable am Ende der Datei hinzufügen
+#
+
+ensure_dkim_var() {
+  local var="$1"
+
+  awk -v var="$var" -v dkim="$opendkim_socket_string" '
+    # trim helper
+    function trim(s) {
+      sub("^[[:space:]]+", "", s)
+      sub("[[:space:]]+$", "", s)
+      return s
+    }
+
+    # Normalisiert aktive Werte:
+    # - wenn leer -> nur dkim
+    # - wenn dkim schon enthalten -> unverändert
+    # - sonst -> dkim vorne dran
+    function normalize_active_value(v) {
+      v = trim(v)
+      if (v == "") return dkim
+      if (index(v, dkim) > 0) return v
+      return dkim "," v
+    }
+
+    BEGIN { found_active=0; replaced_commented=0 }
+
+    #################################################################
+    # FALL 1: Aktive Zeile (nicht auskommentiert): var =
+    #################################################################
+    $0 ~ "^[[:space:]]*"var"[[:space:]]*=" && $0 !~ "^[[:space:]]*#" {
+      found_active=1
+
+      # rechten Teil extrahieren (nach "=")
+      v=$0
+      sub("^[[:space:]]*"var"[[:space:]]*=[[:space:]]*", "", v)
+
+      print var" = " normalize_active_value(v)
+      next
+    }
+
+    #################################################################
+    # FALL 2: Auskommentierte Zeile: # var =
+    # Sonderregel: ersetzen mit NUR DKIM, unabhängig vom Kommentarinhalt
+    #################################################################
+    $0 ~ "^[[:space:]]*#[[:space:]]*"var"[[:space:]]*=" \
+       && found_active==0 && replaced_commented==0 {
+      replaced_commented=1
+      print var" = " dkim
+      next
+    }
+
+    #################################################################
+    # Sonst: Zeile unverändert ausgeben
+    #################################################################
+    { print }
+
+    #################################################################
+    # FALL 3: Variable nicht vorhanden → am Ende hinzufügen
+    #################################################################
+    END {
+      if (found_active==0 && replaced_commented==0) {
+        print var" = " dkim
+      }
+    }
+  ' "$main_cf_file"
+}
+
 
 # -------------
 # - Some pre-installation tasks
@@ -526,7 +607,6 @@ else
 127.0.0.1
 ::1
 localhost
-$(hostname -f)
 EOF
    opendkim_needs_restart=true
    if [[ $? -eq 0 ]] ; then
@@ -611,19 +691,15 @@ else
 fi
 
 echononl "   Activate processing of e-mail through the OpenDKIM daemon.."
-if grep -q -E "milter_default_action\s*=\s*accept" /etc/postfix/main.cf ; then
+if grep -q -E "^\s*#?\s*smtpd_milters\s*=" ${main_cf_file} ; then
-   echo_skipped
+
-   warn "Postfix (main.cf) seems already be configured for milters"
+   ensure_dkim_var "smtpd_milters"     > "${tmp_main_cf_file}"
-   echononl "   Delete previosly saved Postfix configuration.."
+   cp "${tmp_main_cf_file}" "${main_cf_file}"
-   rm /etc/postfix/main.cf.$backup_date 2> $log_file
+
-   if [[ $? -eq 0 ]] ; then
-      echo_ok
-   else
-      echo_failed
-      error "$(cat $log_file)"
-   fi
 else
-   cat <<EOF >> /etc/postfix/main.cf 2> $log_file
+
+      cat <<EOF >> /etc/postfix/main.cf 2> $log_file
+
 
 # ======= Milter configuration =======
 
@@ -643,8 +719,19 @@ milter_protocol = 6
 #    'smtpd_milters = local:/opendkim/opendkim.sock' here and add to
 #    localhost:10025 section in master.cf: 'smtpd_milters='
 #
-#smtpd_milters = local:/opendkim/opendkim.sock
+smtpd_milters = $opendkim_socket_string
-smtpd_milters =
+EOF
+
+fi
+
+if grep -q -E "^\s*#?\s*non_smtpd_milters\s*=" ${main_cf_file} ; then
+
+   ensure_dkim_var "non_smtpd_milters"     > "${tmp_main_cf_file}"
+   cp "${tmp_main_cf_file}" "${main_cf_file}"
+
+else
+
+      cat <<EOF >> /etc/postfix/main.cf 2> $log_file
 
 # Was sind non_smtpd_milters?
 #
@@ -674,15 +761,15 @@ smtpd_milters =
 #
 #
 # DKIM soll auch die ausgehenden Mails signieren, die nicht über smtpd daemon versendet werden.
-non_smtpd_milters = local:/opendkim/opendkim.sock
+non_smtpd_milters = $opendkim_socket_string
 EOF
-   postfix_needs_restart=true
+fi
-   if [[ $? -eq 0 ]] ; then
+postfix_needs_restart=true
-      echo_ok
+if [[ $? -eq 0 ]] ; then
-   else
+   echo_ok
-      echo_failed
+else
-      error "$(cat $log_file)"
+   echo_failed
-   fi
+   error "$(cat $log_file)"
 fi
 
 
@@ -817,4 +904,5 @@ fi
 
 echo ""
 rm -f "$log_file"
+rm -f "$tmp_main_cf_file"
 exit 0

install_opendmarc.sh

@@ -52,8 +52,15 @@ done
 postfix_needs_restart=false
 opendmarc_needs_restart=false
 
-backup_date="$(date +%Y-%m-%d-%H%M)"
 log_file="$(mktemp)"
+tmp_main_cf_file="$(mktemp)"
+
+main_cf_file="/etc/postfix/main.cf"
+
+backup_date="$(date +%Y-%m-%d-%H%M)"
+
+opendkim_socket_string="local:/opendkim/opendkim.sock"
+opendmarc_socket_string="local:/opendmarc/opendmarc.sock"
 
 # -------------
 # --- Some functions
@@ -111,6 +118,116 @@ echo_skipped() {
    echo -e "\033[80G[ \033[37mskipped\033[m ]"
 }
 
+# iFubction stellt sicher, dass OpenDMARC milter in main.cf gesetzt ist
+# und (falls OpenDKIM vorhanden ist) OpenDMARC direkt nach OpenDKIM folgt.
+#
+# Ziel:
+# - smtpd_milters und non_smtpd_milters enthalten: local:/opendmarc/opendmarc.sock
+# - Falls local:/opendkim/opendkim.sock vorhanden ist:
+#     ...opendkim...,local:/opendmarc/opendmarc.sock,...
+#
+# Logik:
+# 1) Aktive Zeile existiert? → anpassen
+# 2) Sonst kommentierte Zeile existiert? → ersetzen (entkommentieren) an derselben Stelle
+# 3) Sonst am Ende hinzufügen
+ensure_dmarc_var() {
+  local var="$1"
+
+  awk -v var="$var" -v dmarc="$opendmarc_socket_string" -v dkim="$opendkim_socket_string" '
+    function trim(s) {
+      sub("^[[:space:]]+", "", s)
+      sub("[[:space:]]+$", "", s)
+      return s
+    }
+
+    # Normalisiert aktive Werte:
+    # - Entfernt vorhandenes dmarc (um Duplikate zu verhindern)
+    # - Fügt dmarc wieder ein:
+    #     - direkt nach dkim, falls dkim vorhanden
+    #     - sonst ans Ende (oder allein, wenn leer)
+    function normalize_active_value(v,    n,i,t,has_dkim,out,newn) {
+      v = trim(v)
+      if (v == "") return dmarc
+
+      # split an Komma, trimmen, DMARC entfernen
+      n = split(v, a, ",")
+      has_dkim = 0
+      newn = 0
+
+      for (i=1; i<=n; i++) {
+        t = trim(a[i])
+        if (t == "") continue
+        if (t == dmarc) continue              # Duplikate vermeiden
+        a[++newn] = t
+        if (t == dkim) has_dkim = 1
+      }
+      n = newn
+
+      out = ""
+
+      if (has_dkim) {
+        # Ausgabe bauen und DMARC direkt nach DKIM einfügen
+        for (i=1; i<=n; i++) {
+          if (out != "") out = out ","
+          out = out a[i]
+          if (a[i] == dkim) {
+            out = out "," dmarc
+          }
+        }
+        return out
+      }
+
+      # kein DKIM: DMARC ans Ende anhängen
+      for (i=1; i<=n; i++) {
+        if (out != "") out = out ","
+        out = out a[i]
+      }
+      if (out == "") return dmarc
+      return out "," dmarc
+    }
+
+    BEGIN { found_active=0; replaced_commented=0 }
+
+    #################################################################
+    # FALL 1: Aktive Zeile (nicht auskommentiert): var =
+    #################################################################
+    $0 ~ "^[[:space:]]*"var"[[:space:]]*=" && $0 !~ "^[[:space:]]*#" {
+      found_active=1
+
+      v=$0
+      sub("^[[:space:]]*"var"[[:space:]]*=[[:space:]]*", "", v)
+
+      print var" = " normalize_active_value(v)
+      next
+    }
+
+    #################################################################
+    # FALL 2: Auskommentierte Zeile: # var =
+    # Sonderregel: ersetzen mit NUR DMARC, unabhängig vom Kommentarinhalt
+    #################################################################
+    $0 ~ "^[[:space:]]*#[[:space:]]*"var"[[:space:]]*=" \
+       && found_active==0 && replaced_commented==0 {
+      replaced_commented=1
+      print var" = " dmarc
+      next
+    }
+
+    #################################################################
+    # Sonst: Zeile unverändert ausgeben
+    #################################################################
+    { print }
+
+    #################################################################
+    # FALL 3: Variable nicht vorhanden → am Ende hinzufügen
+    #################################################################
+    END {
+      if (found_active==0 && replaced_commented==0) {
+        print var" = " dmarc
+      }
+    }
+  ' "$main_cf_file"
+}
+
 
 # -------------
 # - Some pre-installation tasks
@@ -764,12 +881,34 @@ else
    error "$(cat $log_file)"
 fi
 
-echononl "   Set Variable non_smtpd_milters at '/etc/postfix/main.cf'.."
+#echononl "   Set Variable non_smtpd_milters at '/etc/postfix/main.cf'.."
-if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*opendkim.sock" /etc/postfix/main.cf 2> /dev/null) ; then
+#if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*opendkim.sock" /etc/postfix/main.cf 2> /dev/null) ; then
-   if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*$(basename "${opendmarc_socket_file}")" /etc/postfix/main.cf); then
+#   if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*$(basename "${opendmarc_socket_file}")" /etc/postfix/main.cf); then
+#      echo_skipped
+#   else
+#      perl -i -n -p -e "s&^\s*(non_smtpd_milters\s*=.*opendkim.sock)&\1,local:/$(basename "${opendmarc_socket_dir}")/$(basename "${opendmarc_socket_file}")&" \
+#         /etc/postfix/main.cf > $log_file 2>&1
+#      if [[ $? -eq 0 ]] ; then
+#         echo_ok
+#         postfix_needs_restart=true
+#      else
+#         echo_failed
+#         error "$(cat $log_file)"
+#      fi
+#   fi
+#else
+#
+#   echo_skipped
+#   warn "non_smtpd_milters is not adjusted. Complete Postfix configuration (main.cf) manually\!"
+#fi
+
+
+echononl "   Set Variable smtpd_milters at '/etc/postfix/main.cf'.."
+if $(grep -q -E "^\s*smtpd_milters\s*=\s*.*opendkim.sock" /etc/postfix/main.cf 2> /dev/null) ; then
+   if $(grep -q -E "^\s*smtpd_milters\s*=\s*.*$(basename "${opendmarc_socket_file}")" /etc/postfix/main.cf); then
       echo_skipped
    else
-      perl -i -n -p -e "s&^\s*(non_smtpd_milters\s*=.*opendkim.sock)&\1,local:/$(basename "${opendmarc_socket_dir}")/$(basename "${opendmarc_socket_file}")&" \
+      perl -i -n -p -e "s&^\s*(smtpd_milters\s*=.*opendkim.sock)&\1,local:/$(basename "${opendmarc_socket_dir}")/$(basename "${opendmarc_socket_file}")&" \
          /etc/postfix/main.cf > $log_file 2>&1
       if [[ $? -eq 0 ]] ; then
          echo_ok
@@ -781,7 +920,7 @@ if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*opendkim.sock" /etc/postfix/main.
    fi
 else
    echo_skipped
-   warn "Postfix is not adjusted. Complete Postfix configuration (main.cf) manually\!"
+   warn "smtpd_milters was not adjusted. Complete Postfix configuration (main.cf) manually\!"
 fi
 
 
@@ -801,20 +940,16 @@ else
    error "$(cat $log_file)"
 fi
 
-echononl "   Activate processing of e-mail through the OpenDKIM daemon.."
+echononl "   Activate processing of e-mail through the OpenDMARC daemon.."
-if grep -q -E "milter_default_action\s*=\s*accept" /etc/postfix/main.cf ; then
+if grep -q -E "^\s*#?\s*smtpd_milters\s*=" ${main_cf_file} ; then
-   echo_skipped
+
-   info "Postfix (main.cf) was not changed - seems already be configured right."
+   ensure_dmarc_var "smtpd_milters"     > "${tmp_main_cf_file}"
-   echononl "   Delete previosly saved Postfix configuration.."
+   cp "${tmp_main_cf_file}" "${main_cf_file}"
-   rm /etc/postfix/main.cf.$backup_date 2> $log_file
+
-   if [[ $? -eq 0 ]] ; then
-      echo_ok
-   else
-      echo_failed
-      error "$(cat $log_file)"
-   fi
 else
-   cat <<EOF >> /etc/postfix/main.cf 2> $log_file
+
+      cat <<EOF >> /etc/postfix/main.cf 2> $log_file
+
 
 # ======= Milter configuration =======
 
@@ -834,48 +969,61 @@ milter_protocol = 6
 #    'smtpd_milters = local:/opendkim/opendkim.sock' here and add to
 #    localhost:10025 section in master.cf: 'smtpd_milters='
 # 
-smtpd_milters = local:/opendkim/opendkim.sock, local:/opendmarc/opendmarc.sock
+smtpd_milters = $opendmarc_socket_string
-
-# Was sind non_smtpd_milters?
-#
-# non_smtpd_milters gilt für alle Postfix-Prozesse, die Mails verarbeiten, aber NICHT
-# der smtpd-Daemon sind.
-#
-# Das betrifft z. B.:
-#
-#     cleanup        Header/Content-Bereinigung
-#     qmgr           Queue-Manager
-#     lmtp / smtp    Auslieferung nach extern
-#     local          lokale Zustellung
-#
-# Das sind z. B.:
-#
-#     -  interne Bounces (MAILER-DAEMON)
-#
-#     -  Cron-Mails vom Server
-#
-#     -  Weiterleitungen, die Postfix selbst generiert
-#
-#     -  Mails, die über sendmail CLI gesendet werden
-#
-#     -  Mails, die Amavis über LMTP zurückgibt
-#
-#     -  etc.
-#
-#
-# DKIM soll auch die ausgehenden Mails signieren, die nicht über smtpd daemon versendet werden.
-non_smtpd_milters = local:/opendkim/opendkim.sock, local:/opendmarc/opendmarc.sock
 EOF
-   postfix_needs_restart=true
+
-   if [[ $? -eq 0 ]] ; then
-      echo_ok
-   else
-      echo_failed
-      error "$(cat $log_file)"
-   fi
 fi
 
 
+#if grep -q -E "^\s*#?\s*non_smtpd_milters\s*=" ${main_cf_file} ; then
+#
+#   ensure_dmarc_var "non_smtpd_milters"     > "${tmp_main_cf_file}"
+#   cp "${tmp_main_cf_file}" "${main_cf_file}"
+#
+#else
+#
+#      cat <<EOF >> /etc/postfix/main.cf 2> $log_file
+#
+## Was sind non_smtpd_milters?
+##
+## non_smtpd_milters gilt für alle Postfix-Prozesse, die Mails verarbeiten, aber NICHT
+## der smtpd-Daemon sind.
+##
+## Das betrifft z. B.:
+##
+##     cleanup        Header/Content-Bereinigung
+##     qmgr           Queue-Manager
+##     lmtp / smtp    Auslieferung nach extern
+##     local          lokale Zustellung
+##
+## Das sind z. B.:
+##
+##     -  interne Bounces (MAILER-DAEMON)
+##
+##     -  Cron-Mails vom Server
+##
+##     -  Weiterleitungen, die Postfix selbst generiert
+##
+##     -  Mails, die über sendmail CLI gesendet werden
+##
+##     -  Mails, die Amavis über LMTP zurückgibt
+##
+##     -  etc.
+##
+##
+## DKIM soll auch die ausgehenden Mails signieren, die nicht über smtpd daemon versendet werden.
+#non_smtpd_milters = $opendmarc_socket_string
+#EOF
+#fi
+#postfix_needs_restart=true
+#if [[ $? -eq 0 ]] ; then
+#   echo_ok
+#else
+#   echo_failed
+#   error "$(cat $log_file)"
+#fi
+
+
 echo ""
 
 echononl "   Enable OpenDMARC Service"

install_postfix_advanced.sh

@@ -2123,7 +2123,9 @@ smtpd_tls_key_file = $_TLS_KEY_FILE
 #smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_1024.pem
 ## - also possible to use 2048 key with that parameter
 ## -
-smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_2048.pem
+## - DEPRECATED parameter-
+## -
+#smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_2048.pem
 
 ## - File with DH parameters that the Postfix SMTP server should use with EDH ciphers.
 ## -
@@ -2909,8 +2911,13 @@ fi
 cat <<EOF >> /etc/postfix/main.cf
 # Policyd-Weight
    #check_policy_service inet:127.0.0.1:12525,
+# ---------------------------------------------------------------------------------
+# DEPRECATED permit_mx_backup
+#
+# warning: support for restriction "permit_mx_backup" will be removed from Postfix;
 # permit Backup MX
-   permit_mx_backup,
+#   permit_mx_backup,
+# ---------------------------------------------------------------------------------
 # permit, if all restrictions so far passed
    permit
 
@@ -2951,8 +2958,13 @@ smtpd_relay_restrictions =
 # managed by the verify(8) server; see http://www.postfix.org/ADDRESS_VERIFICATION_README.html
 # for more details
    reject_unverified_recipient,
+# ---------------------------------------------------------------------------------
+# DEPRECATED permit_mx_backup
+#
+# warning: support for restriction "permit_mx_backup" will be removed from Postfix;
 # permit Backup MX
-   permit_mx_backup,
+#   permit_mx_backup,
+# ---------------------------------------------------------------------------------
 # permit, if all restrictions so far passed
    permit
 
@@ -2992,7 +3004,7 @@ if [[ -n "$(which opendkim)" ]]  || [[ -n "$(which opendmarc)" ]] ; then
 
 # ======= Milter configuration =======
 
-# OpenDKIM
+# OpenDKIM / OpenDMARC
 
 milter_default_action = accept
 
@@ -3009,7 +3021,23 @@ milter_protocol = 6
 #    localhost:10025 section in master.cf: 'smtpd_milters='
 #
 smtpd_milter_maps = cidr:/etc/postfix/smtpd_milter_map
-smtpd_milters =
+EOF
+   if [[ -n "$(which opendkim)" ]]  && [[ -n "$(which opendmarc)" ]] ; then
+      cat <<EOF >> /etc/postfix/main.cf
+smtpd_milters =  local:/opendkim/opendkim.sock,local:/opendmarc/opendmarc.sock
+EOF
+   elif [[ -n "$(which opendkim)" ]] ; then
+      cat <<EOF >> /etc/postfix/main.cf
+smtpd_milters = local:/opendkim/opendkim.sock
+EOF
+   else
+      cat <<EOF >> /etc/postfix/main.cf
+smtpd_milters = local:/opendmarc/opendmarc.sock
+EOF
+   fi
+
+   cat <<EOF >> /etc/postfix/main.cf
+
 # Was sind non_smtpd_milters?
 #
 # non_smtpd_milters gilt für alle Postfix-Prozesse, die Mails verarbeiten, aber NICHT 
@@ -3036,19 +3064,76 @@ smtpd_milters =
 #
 #     -  etc.
 #
-#
-EOF
-fi
-
-if [[ -n "$(which opendkim)" ]] ; then
-   cat <<EOF >> /etc/postfix/main.cf
 # DKIM soll auch die ausgehenden Mails signieren, die nicht über smtpd daemon versendet werden.
 #
-non_smtpd_milters = local:/opendkim/opendkim.sock
 EOF
-else
+
-   cat <<EOF >> /etc/postfix/main.cf
+   if [[ -n "$(which opendkim)" ]]  ; then
+      cat <<EOF >> /etc/postfix/main.cf
+non_smtpd_milters =  local:/opendkim/opendkim.sock
+EOF
+   else
+      cat <<EOF >> /etc/postfix/main.cf
 non_smtpd_milters =
+EOF
+   fi
+
+else
+
+   cat <<EOF >> /etc/postfix/main.cf
+
+
+# ======= Milter configuration =======
+
+# OpenDKIM / OpenDMARC
+
+milter_default_action = accept
+
+# Postfix ≥ 2.6 milter_protocol = 6, Postfix ≤ 2.5 milter_protocol = 2
+milter_protocol = 6
+
+# Note:
+#    We will sign AFTER sending through AmaVIS, just befor sending out. So
+#    set 'smtpd_milters =' to an emty string here and add to localhost:10025
+#    section in master.cf: 'smtpd_milters=local:/opendkim/opendkim.sock'
+#
+#    If you want sign mails before sending through AmaVIS, set
+#    'smtpd_milters = local:/opendkim/opendkim.sock' here and add to
+#    localhost:10025 section in master.cf: 'smtpd_milters='
+#
+smtpd_milter_maps = cidr:/etc/postfix/smtpd_milter_map
+#smtpd_milters =
+
+# Was sind non_smtpd_milters?
+#
+# non_smtpd_milters gilt für alle Postfix-Prozesse, die Mails verarbeiten, aber NICHT
+# der smtpd-Daemon sind.
+#
+# Das betrifft z. B.:
+#
+#     cleanup        Header/Content-Bereinigung
+#     qmgr           Queue-Manager
+#     lmtp / smtp    Auslieferung nach extern
+#     local          lokale Zustellung
+#
+# Das sind z. B.:
+#
+#     -  interne Bounces (MAILER-DAEMON)
+#
+#     -  Cron-Mails vom Server
+#
+#     -  Weiterleitungen, die Postfix selbst generiert
+#
+#     -  Mails, die über sendmail CLI gesendet werden
+#
+#     -  Mails, die Amavis über LMTP zurückgibt
+#
+#     -  etc.
+#
+# DKIM soll auch die ausgehenden Mails signieren, die nicht über smtpd daemon versendet werden.
+#
+#non_smtpd_milters =
+
 EOF
 fi
 
@@ -3539,41 +3624,58 @@ fi
 _file="/etc/postfix/header_checks.pcre"
 echononl "   Create file '$_file' used for header replacing"
 if [[ ! -f "$_file" ]]; then
-	cat << EOF > "$_file"
+	cat << 'EOF' > "$_file"
 # ---
-# - Replace headers
+# - Header Checks - /etc/postfix/header_checks
 # ---
+#
+#     Ziel: offensichtlich kaputte RFC-Header ablehnen (wenig False Positives)
 
-# - Replace recieved from
+########################################
-#/^Received: from (.* \\([-._[:alnum:]]+ \\[[.[:digit:]]{7,15}\\]\\)).*?([[:space:]]+).*\\(Authenticated sender: ([^)]+)\\)(.*)/ REPLACE Received: from [127.0.0.1] (localhost [127.0.0.1])\$2(Authenticated sender: \$3)\$4
+# A) Kaputter From:-Header
+########################################
+
+# 1) From: ist leer
+/^From:\s*$/                           REJECT Invalid From header (empty) - Spamschutzregel FROM-1001
+
+# 2) Mehr als ein '@' im From:-Header -> syntaktisch kaputt
+/^From:.*@.*@/                         REJECT Invalid From header (multiple @) - Spamschutzregel FROM-1002
 
 
-# ---
+# 3) Mehrere Mailboxen durch Komma getrennt (wie: Die@..., Lions@..., ...)
-# - Ignore Headers
+#    (Legitime Fälle nutzen i.d.R. Display-Namen/Group-Syntax; dieses Muster ist in Spam sehr häufig)
-# ---
+/^From:\s*[^<>,]+@[^,]+,\s*[^<>,]+@/   REJECT Invalid From header (multiple mailboxes) - Spamschutzregel FROM-1003
 
-#/^\s*User-Agent/        IGNORE
+# 4) Typische kaputte UTF-8-Fragmente
-#/^\s*X-Enigmail/        IGNORE
+/^From:.*\xC3\xA2/                     REJECT Invalid UTF-8 in From header - Spamschutzregel FROM-1004
-#/^\s*X-Mailer/          IGNORE
-#/^\s*X-Originating-IP/  IGNORE
 
 
-# ---
+########################################
-# - Reject / Discard headers
+# B) Optional: sehr spezifische lokale Blacklist
-# ---
+########################################
 
-/^To:.*<>/                    REJECT Possible SPAM Blank email address To: header - Header-Spamschutzregel T0-1001
+#/^Reply-To: .+\@inx1and1\..+/         REJECT Possible spam (local pattern)
 
-/\(envelope-from <>\)/        REJECT Possible SPAM - Header-Spamschutzregel RECIEV-1001
 
-/^Reply-To: .+\@inx1and1\..+/                REJECT Possible SPAM - Header-Spamschutzregel REPLY-1001
+########################################
+# C) Warn
+########################################
 
-/^From:.*<>/                             REJECT Possible SPAM - Header-Spamschutzregel FROM-1001
+# Date-Rejects sind oft zu aggressiv -> wenn nötig: lieber taggen oder loggen statt reject
+/^Date: .* 19[0-9][0-9]/               WARN Date far in the past Header-Spamschutzregel DATE-1001
+/^Date: .* 200[0-9]/                   WARN Date far in the past Header-Spamschutzregel DATE-1002
+/^Date: .* 201[0-9]/                   WARN Date far in the past Header-Spamschutzregel DATE-1003
+
+
+
+########################################
+# Bemerkungen
+########################################
+
+# (envelope-from <>) nicht pauschal rejecten:
+# echte DSNs/Bounces haben legitimerweise MAIL FROM: <>
+#/\(envelope-from <>\)/                REJECT Null envelope-from
 
-/^Date: .* 19[0-9][0-9]/      REJECT Date from the past. Fix your system clock. - Header-Spamschutzregel DATE-1001
-/^Date: .* 200[0-9]/          REJECT Date from the past. Fix your system clock. - Header-Spamschutzregel DATE-1002
-/^Date: .* 201[0-9]/          REJECT Date from the past. Fix your system clock. - Header-Spamschutzregel DATE-1003
-/^Date: .* 2020/              REJECT Date from the past. Fix your system clock. - Header-Spamschutzregel DATE-1004
 EOF
 	if [[ $? -eq 0 ]] ; then
 		echo_ok

install_postfix_base.sh

@@ -929,7 +929,9 @@ smtpd_tls_key_file = $_TLS_KEY_FILE
 #smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_1024.pem
 ## - also possible to use 2048 key with that parameter
 ## -
-smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_2048.pem
+## - DEPRECATED parameter-
+## -
+#smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_2048.pem
 
 ## - File with DH parameters that the Postfix SMTP server should use with EDH ciphers.
 ## -

install_postfixadmin.sh

@@ -187,10 +187,9 @@ detect_mysql_version () {
 # -
 systemd_supported=false
 
-systemd=$(which systemd)
 systemctl=$(which systemctl)
 
-if [[ -n "$systemd" ]] && [[ -n "$systemctl" ]] ; then
+if [[ -n "$systemctl" ]] ; then
    systemd_supported=true
 fi
 
@@ -256,6 +255,14 @@ do
       echo -e "\n\t\033[33m\033[1mA version number is required!\033[m\n"
    fi
 done
+
+IFS='.' read -r PF_ADMIN_MAJOR_VERSION PF_ADMIN_MINOR_VERSION  PF_ADMIN_PATCH_LEVEL <<< "$PF_ADMIN_VERSION"
+#echo ""
+#echo "PF_ADMIN_MAJOR_VERSION: $PF_ADMIN_MAJOR_VERSION"
+#echo "PF_ADMIN_MINOR_VERSION: $PF_ADMIN_MINOR_VERSION"
+#echo "PF_ADMIN_PATCH_LEVEL:   $PF_ADMIN_PATCH_LEVEL"
+#exit
+
 echo ""
 echo -e "\033[32m--\033[m"
 echo ""
@@ -275,6 +282,9 @@ DEFAULT_APACHE_SERVER_CERT="server-bundle.crt"
 DEFAULT_APACHE_SERVER_KEY="server.key"
 DEFAULT_DEBIAN_APACHE_VHOST_DIR="/etc/apache2/sites-available"
 DEFAULT_APACHE_VHOST_DIR="/usr/local/apache2/conf/vhosts"
+
+DEFAULT_COMPOSER="/usr/local/bin/composer"
+
 DEFAULT_POSTFIX_DB_HOST_PGSQL="/run/postgresql"
 if [[ -S "/tmp/mysql.sock" ]] ; then
    DEFAULT_POSTFIX_DB_HOST_MYSQL="unix:/tmp/mysql.sock"
@@ -379,6 +389,8 @@ if [[ -z "$APACHE_VHOST_DIR" ]] ; then
    fi
 fi
 
+[[ -n "${COMPOSER}" ]] || COMPOSER=${DEFAULT_COMPOSER} 
+
 [[ -n "$POSTFIX_DB_TYPE" ]] || fatal "Database Type of Postfix Database (POSTFIX_DB_TYPE) not present!"
 [[ -n "$POSTFIX_DB_HOST_MYSQL" ]] || POSTFIX_DB_HOST_MYSQL="$DEFAULT_POSTFIX_DB_HOST_MYSQL"
 [[ -n "$POSTFIX_DB_HOST_PGSQL" ]] ||POSTFIX_DB_HOST_PGSQL="$DEFAULT_POSTFIX_DB_HOST_PGSQL"
@@ -926,11 +938,79 @@ done
 if $_failed ; then
    echo_failed
    error "$(cat $log_file)"
+
+   echononl "\tcontinue anyway [yes/no]: "
+   read OK
+   OK="$(echo "$OK" | tr '[:upper:]' '[:lower:]')"
+   while [[ "$OK" != "yes" ]] && [[  "$OK" != "no" ]] ; do
+      echononl "Wrong entry! - repeat [yes/nno]: "
+      read OK
+   done
+   [[ $OK = "yes" ]] || fatal "Script terminated by user input.."
+
 else
    echo_ok
 fi
 
 
+echo -e "\n\n\t\033[37m\033[1mInstall (global) composer..\033[m\n"
+
+echononl "\tDownload composer from 'getcomposer.org'.."
+php -r "copy('https://getcomposer.org/installer', '${_src_base_dir}/composer-setup.php');" > $log_file 2>&1
+if [[ "$?" = "0" ]]; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+
+   echononl "\tcontinue anyway [yes/no]: "
+   read OK
+   OK="$(echo "$OK" | tr '[:upper:]' '[:lower:]')"
+   while [[ "$OK" != "yes" ]] && [[  "$OK" != "no" ]] ; do
+      echononl "Wrong entry! - repeat [yes/nno]: "
+      read OK
+   done
+   [[ $OK = "yes" ]] || fatal "Script terminated by user input.."
+fi
+
+echononl "\tInstall composer to ${COMPOSER}"
+php ${_src_base_dir}/composer-setup.php --install-dir=$(dirname ${COMPOSER}) \
+   --filename=$(basename ${COMPOSER}) > $log_file 2>&1
+if [[ "$?" = "0" ]]; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+
+   echononl "\tcontinue anyway [yes/no]: "
+   read OK
+   OK="$(echo "$OK" | tr '[:upper:]' '[:lower:]')"
+   while [[ "$OK" != "yes" ]] && [[  "$OK" != "no" ]] ; do
+      echononl "Wrong entry! - repeat [yes/nno]: "
+      read OK
+   done
+   [[ $OK = "yes" ]] || fatal "Script terminated by user input.."
+fi
+
+echononl "\tRemove the installer"
+php -r "unlink('${_src_base_dir}/composer-setup.php');" > $log_file 2>&1
+if [[ "$?" = "0" ]]; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+
+   echononl "\tcontinue anyway [yes/no]: "
+   read OK
+   OK="$(echo "$OK" | tr '[:upper:]' '[:lower:]')"
+   while [[ "$OK" != "yes" ]] && [[  "$OK" != "no" ]] ; do
+      echononl "Wrong entry! - repeat [yes/nno]: "
+      read OK
+   done
+   [[ $OK = "yes" ]] || fatal "Script terminated by user input.."
+fi
+
+
    
 echo -e "\n\n\t\033[37m\033[1mBase install Postfixadmin..\033[m\n"
 
@@ -1102,6 +1182,37 @@ else
    echo_ok
 fi
 
+echononl "\tInstall PHP dependencies ( composer install --no-dev ... ).."
+if [[ ${PF_ADMIN_MAJOR_VERSION} -gt 3 ]] ; then
+   if $PHP_DEBIAN_INSTALLATION ; then
+      su ${HTTP_USER} -c"cd ${WEBSITE_BASEDIR}/postfixadmin-${PF_ADMIN_VERSION}
+         php /usr/local/bin/composer install --prefer-dist --no-interaction --no-dev" -s /bin/bash \
+         > $log_file 2>&1
+   else
+      su ${HTTP_USER} -c"cd ${WEBSITE_BASEDIR}/postfixadmin-${PF_ADMIN_VERSION}
+         /usr/local/php-${php_latest_ver}/bin/php /usr/local/bin/composer --prefer-dist \
+            --no-interaction install --no-dev" -s /bin/bash > $log_file 2>&1
+   fi
+   if [[ $? -eq 0 ]]; then
+         echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+
+      echononl "\tcontinue anyway [yes/no]: "
+      read OK
+      OK="$(echo "$OK" | tr '[:upper:]' '[:lower:]')"
+      while [[ "$OK" != "yes" ]] && [[  "$OK" != "no" ]] ; do
+         echononl "Wrong entry! - repeat [yes/nno]: "
+         read OK
+      done
+      [[ $OK = "yes" ]] || fatal "Script terminated by user input.."
+   fi
+else
+   echo_skipped
+fi
+
+
 
 echononl "\tRemove existing symlink '${WEBSITE_BASEDIR}/htdocs'"
 if [[ -h "${WEBSITE_BASEDIR}/htdocs" ]]; then
@@ -2097,7 +2208,7 @@ fi
 
 echo -e "\n\n\t\033[37m\033[1mConfigure Postfix Admin\033[m\n"
 
-if [[ $MAJOR_VERSION -eq 3 ]] && [[ $MINOR_VERSION -gt 0 ]]; then
+if [[ $MAJOR_VERSION -gt 3 ]] || [[ $MAJOR_VERSION -eq 3 ]] && [[ $MINOR_VERSION -gt 0 ]]; then
    pfa_conf_file="${WEBSITE_BASEDIR}/postfixadmin-${PF_ADMIN_VERSION}/config.local.php"
    cp -a "${WEBSITE_BASEDIR}/postfixadmin-${PF_ADMIN_VERSION}/config.inc.php"  "$pfa_conf_file"
 else
@@ -2496,7 +2607,7 @@ fi
 ## -    $CONF['show_undeliverable']='NO';
 ## -    $CONF['show_popimap']='NO';
 ## -
-## -    $CONF['used_quotas'] = 'YES';
+## -    $CONF['used_quotas'] = 'NO';
 ## -    $CONF['new_quota_table'] = 'YES';
 ## -
 echononl "\tAdjust Postfix Admin's Configuration - Part 5"
@@ -2528,7 +2639,7 @@ perl -i -n -p -e "s#^(\s*\\\$CONF\['show_undeliverable'\]\s*=.*)#//!\1\n\\\$CONF
   $pfa_conf_file >> $log_file 2>&1 || _failed=true 
 perl -i -n -p -e "s#^(\s*\\\$CONF\['show_popimap'\]\s*=.*)#//!\1\n\\\$CONF['show_popimap'] = 'NO';#" \
   $pfa_conf_file >> $log_file 2>&1 || _failed=true 
-perl -i -n -p -e "s#^(\s*\\\$CONF\['used_quotas'\]\s*=.*)#//!\1\n\\\$CONF['used_quotas'] = 'YES';#" \
+perl -i -n -p -e "s#^(\s*\\\$CONF\['used_quotas'\]\s*=.*)#//!\1\n\\\$CONF['used_quotas'] = 'NO';#" \
   $pfa_conf_file >> $log_file 2>&1 || _failed=true 
 perl -i -n -p -e "s#^(\s*\\\$CONF\['new_quota_table'\]\s*=.*)#//!\1\n\\\$CONF['new_quota_table'] = 'YES';#" \
   $pfa_conf_file >> $log_file 2>&1 || _failed=true 
@@ -3496,6 +3607,26 @@ else
    error "$(cat $log_file)"
 fi
 
+
+
+echononl "\tRestart Apache Webservice.."
+if [[ -n "$APACHE_SERVICE_FILE" ]] ||  [[ -n "$APACHE_INIT_SCRIPT" ]] ; then
+	if [[ -n "$APACHE_SERVICE_FILE" ]] ; then
+		systemctl restart $APACHE_SERVICE_FILE > $log_file 2>&1
+	else
+		$APACHE_INIT_SCRIPT restart > $log_file 2>&1
+	fi
+	if [[ $? -eq 0 ]]; then
+		echo_ok
+	else
+		echo_failed
+		error "$(cat $log_file)"
+	fi
+else
+	echo_skipped
+	warn "Neither an init-script nor a service file for 'apache2' webservice  found!"
+fi
+
 # - Start all PHP FPM engines
 # -
 if [[  -n "$php_major_versions" ]]; then
@@ -3543,7 +3674,7 @@ fi
 
 
 echo ""
-info "Browse to \033[1mhttp://${WEBSITE_NAME}/setup.php\033[m to create a 'setup password'\n$(cat <<EOF
+info "Browse to \033[1mhttps://${WEBSITE_NAME}/setup.php\033[m to create a 'setup password'\n$(cat <<EOF
 
 \t          \033[33mIn caes of updating postfix.admin browse this URL and \033[1mlogin with your
 \t          setup_password\033[m\033[33m, because only after that the database '${POSTFIX_DB_NAME}'

install_update_dovecot-2.4.sh

@@ -2361,7 +2361,13 @@ done
 
 ## - Let make use multiple cores (-j<number of cores +1>)
 ## -
-export MAKEFLAGS=-j$(expr `grep  "^processor" /proc/cpuinfo | sort -u | wc -l` - 1)
+#export MAKEFLAGS=-j$(expr `grep  "^processor" /proc/cpuinfo | sort -u | wc -l` - 1)
+CPUS=$(nproc)
+if (( CPUS > 1 )); then
+    export MAKEFLAGS="-j$((CPUS - 1))"
+else
+    export MAKEFLAGS="-j1"
+fi
 
 
 # -------------
@@ -2639,6 +2645,58 @@ if $_new ; then
 fi
 
 
+# Dovecot's configure script queries pkg-config for "systemd" and expects
+# the variable "systemdsystemunitdir" to be defined.
+# On minimal Debian(13)-based systems, only libsystemd.pc is provided and
+# no systemd.pc (and often no systemd binary) exists.
+# This pkg-config wrapper provides the missing metadata so configure
+# can auto-detect the correct systemd unit installation directory.
+#
+if [[ "${os_dist,,}" = "debian" ]] && [[ "$os_version" -ge 13 ]] ; then
+   echononl "   Create '/usr/lib/x86_64-linux-gnu/pkgconfig/systemd.pc'."
+   if [[ ! -f "/usr/lib/x86_64-linux-gnu/pkgconfig/systemd.pc" ]] ; then
+      cat <<'EOF' > /usr/lib/x86_64-linux-gnu/pkgconfig/systemd.pc 2>>${_log_dir}/debian-install.log 
+prefix=/usr
+exec_prefix=${prefix}
+libdir=/usr/lib/x86_64-linux-gnu
+includedir=/usr/include
+
+# Some build systems (incl. Dovecot's configure) query this to decide where
+# to install systemd service/unit files:
+systemdsystemunitdir=/usr/lib/systemd/system
+
+Name: systemd
+Description: systemd (pkg-config compatibility wrapper)
+Version: 0
+Requires: libsystemd
+EOF
+
+      if [[ $? -gt 0 ]] ; then
+         echo -e "$rc_failed"
+         error "$(cat $log_file)"
+
+         echo ""
+         echo "   command was:"
+         echo "      ln -s  libsystemd.pc /usr/lib/x86_64-linux-gnu/pkgconfig/systemd.pc"
+         echo ""
+
+         echononl "   continue anyway [yes/no]: "
+         read OK
+         OK="$(echo "$OK" | tr '[:upper:]' '[:lower:]')"
+         while [[ "$OK" != "yes" ]] && [[  "$OK" != "no" ]] ; do
+            echononl "Wrong entry! - repeat [yes/no]: "
+            read OK
+         done
+         [[ $OK = "yes" ]] || fatal "Abbruch durch User"
+      else
+         echo -e "$rc_done"
+      fi
+   else
+      echo -e "$rc_skipped"
+   fi
+fi
+
+
 ## -----------------
 ## - Create Users/groups needed for dovecot
 
@@ -2778,6 +2836,11 @@ if $systemd_support ; then
 fi
    #--with-systemdsystemunitdir=/etc/systemd/system/"
 
+#if [[ "${os_dist,,}" = "debian" ]] && [[ "$os_version" -ge 13 ]] ; then
+#   config_params="$config_params systemdsystemunitdir=/lib/systemd/system"
+#fi
+
+
 echononl "   Configure Dovecot.."
 #./configure \
 #   --prefix=/usr/local/dovecot-${_version} \
@@ -3151,12 +3214,12 @@ EOF
    echononl "   Create empty file '$(basename "${_conf_file}")'.."
    if [[ ! -f "${_conf_file}" ]] ; then
       _failed=false
-      cat <<'EOF' > "${_conf_file}" 2> "${log_file}"
+      cat <<EOF > "${_conf_file}" 2> "${log_file}"
 ##
 ## Settings for the Sieve interpreter
 ##
 
-# see also:  https://doc.dovecot.org/2.4.1/core/plugins/sieve.html
+# see also:  https://doc.dovecot.org/${_version}/core/plugins/sieve.html
 
 # To use Sieve, you will first need to make sure you are using Dovecot LDA or LMTP Server
 # for delivering incoming mail to users' mailboxes.
@@ -3221,12 +3284,12 @@ EOF
    echononl "   Create empty file '$(basename "${_conf_file}")'.."
    if [[ ! -f "${_conf_file}" ]] ; then
       _failed=false
-      cat <<'EOF' > "${_conf_file}" 2> "${log_file}"
+      cat <<EOF > "${_conf_file}" 2> "${log_file}"
 ##
 ## Settings for the Sieve Vacation Extension
 ##
 
-# see also:  https://doc.dovecot.org/2.4.1/core/config/sieve/extensions/vacation.html
+# see also:  https://doc.dovecot.org/${_version}/core/config/sieve/extensions/vacation.html
 
 # The Sieve vacation extension (RFC 5230) defines a mechanism to generate automatic
 # replies to incoming email messages. It takes various precautions to make sure replies
@@ -6291,7 +6354,7 @@ EOF
 # same as IMAP's LOGIN command. The LOGIN command is internally handled using PLAIN
 # mechanism.
 #
-# see https://doc.dovecot.org/2.4.1/core/config/auth/mechanisms/overview.html for
+# see https://doc.dovecot.org/${_version}/core/config/auth/mechanisms/overview.html for
 # further (non-rcCleartext) Authentication.
 auth_mechanisms = ${auth_mechanisms}
 EOF
@@ -6417,11 +6480,11 @@ if [[ $dovecot_major_version -gt 2 ]] \
 
    if [[ "$db_driver" = "pgsql" ]]; then
 
-      read -r -d '' NEW_BLOCK <<'EOF'
+      read -r -d '' NEW_BLOCK <<EOF
 passdb sql {
 
    # Load SQL connection data
-   !include /usr/local/dovecot-2.4.1-4/etc/dovecot/sql-connect.conf.ext
+   !include /usr/local/dovecot-${_version}/etc/dovecot/sql-connect.conf.ext
 
    query = SELECT username AS user, password \\
       FROM mailbox \\
@@ -6449,18 +6512,18 @@ EOF
 # LMTP mail delivery	   YES	            YES
 # doveadm commands	   YES	            YES
 #
-# see also: https://doc.dovecot.org/2.4.1/core/config/auth/passdb.html
+# see also: https://doc.dovecot.org/${_version}/core/config/auth/passdb.html
 #
 $(echo -e "${NEW_BLOCK}")
 EOF
       fi
 
 
-      read -r -d '' NEW_BLOCK <<'EOF'
+      read -r -d '' NEW_BLOCK <<EOF
 userdb sql {
 
    # Load SQL connection data
-   !include /usr/local/dovecot-2.4.1-4/etc/dovecot/sql-connect.conf.ext
+   !include /usr/local/dovecot-${_version}/etc/dovecot/sql-connect.conf.ext
 
    query = SELECT '/var/vmail/' || maildir AS home, \\
       '5000' AS uid, '5000' AS gid \\
@@ -6497,7 +6560,7 @@ EOF
 # The userdb and passdb may be the same or they may be different depending on your needs.
 # You can also have multiple authentication databases.
 #
-# see: https://doc.dovecot.org/2.4.1/core/config/auth/userdb.html
+# see: https://doc.dovecot.org/${_version}/core/config/auth/userdb.html
 #
 $(echo -e "${NEW_BLOCK}")
 EOF
@@ -6505,11 +6568,11 @@ EOF
 
    elif [[ "$db_driver" = "mysql" ]]; then
 
-      read -r -d '' NEW_BLOCK <<'EOF'
+      read -r -d '' NEW_BLOCK <<EOF
 passdb sql {
 
    # Load SQL connection data
-   !include /usr/local/dovecot-2.4.1-4/etc/dovecot/sql-connect.conf.ext
+   !include /usr/local/dovecot-${_version}/etc/dovecot/sql-connect.conf.ext
 
    query = SELECT username AS user, password \\
       FROM mailbox \\
@@ -6537,17 +6600,17 @@ EOF
 # LMTP mail delivery	   YES	            YES
 # doveadm commands	   YES	            YES
 #
-# see also: https://doc.dovecot.org/2.4.1/core/config/auth/passdb.html
+# see also: https://doc.dovecot.org/${_version}/core/config/auth/passdb.html
 #
 $(echo -e "${NEW_BLOCK}")
 EOF
       fi
 
-      read -r -d '' NEW_BLOCK <<'EOF'
+      read -r -d '' NEW_BLOCK <<EOF
 userdb sql {
 
    # Load SQL connection data
-   !include /usr/local/dovecot-2.4.1-4/etc/dovecot/sql-connect.conf.ext
+   !include /usr/local/dovecot-${_version}/etc/dovecot/sql-connect.conf.ext
 
    query = SELECT CONCAT('/var/vmail/',maildir) AS home, \\
       '5000' AS uid, '5000' AS gid \\
@@ -6584,7 +6647,7 @@ EOF
 # The userdb and passdb may be the same or they may be different depending on your needs.
 # You can also have multiple authentication databases.
 #
-# see: https://doc.dovecot.org/2.4.1/core/config/auth/userdb.html
+# see: https://doc.dovecot.org/${_version}/core/config/auth/userdb.html
 #
 $(echo -e "${NEW_BLOCK}")
 EOF
@@ -7081,7 +7144,7 @@ if [[ $dovecot_major_version -gt 2 ]] \
 #
 # As used here, %{user | domain} expands to the domain of the local user.  Other Mail user
 # variables can be used as well.
-#     see: https://doc.dovecot.org/2.4.1/core/settings/variables.html#mail-user-variables
+#     see: https://doc.dovecot.org/${_version}/core/settings/variables.html#mail-user-variables
 postmaster_address = ${postmaster_address}
 EOF
    fi
@@ -7231,7 +7294,7 @@ protocol lmtp {
    #
    # As used here, %{user | domain} expands to the domain of the local user.  Other Mail user
    # variables can be used as well.
-   #     see: https://doc.dovecot.org/2.4.1/core/settings/variables.html#mail-user-variables
+   #     see: https://doc.dovecot.org/${_version}/core/settings/variables.html#mail-user-variables
    postmaster_address = ${postmaster_address}
 
    mail_plugins {
@@ -9180,11 +9243,11 @@ if [[ $dovecot_major_version -gt 2 ]] \
 
    if [[ "$db_driver" = "pgsql" ]]; then
 
-      read -r -d '' NEW_BLOCK <<'EOF'
+      read -r -d '' NEW_BLOCK <<EOF
 userdb sql {
 
    # Load SQL connection data
-   !include /usr/local/dovecot-2.4.1-4/etc/dovecot/sql-connect.conf.ext
+   !include /usr/local/dovecot-${_version}/etc/dovecot/sql-connect.conf.ext
 
    query = SELECT '/var/vmail/' || maildir AS home, \\
       '5000' AS uid, '5000' AS gid, \\
@@ -9222,7 +9285,7 @@ EOF
 # The userdb and passdb may be the same or they may be different depending on your needs.
 # You can also have multiple authentication databases.
 #
-# see: https://doc.dovecot.org/2.4.1/core/config/auth/userdb.html
+# see: https://doc.dovecot.org/${_version}/core/config/auth/userdb.html
 #
 ${NEW_BLOCK}
 EOF
@@ -9234,11 +9297,11 @@ EOF
 
    elif [[ "$db_driver" = "mysql" ]]; then
 
-      read -r -d '' NEW_BLOCK <<'EOF'
+      read -r -d '' NEW_BLOCK <<EOF
 userdb sql {
 
    # Load SQL connection data
-   !include /usr/local/dovecot-2.4.1-4/etc/dovecot/sql-connect.conf.ext
+   !include /usr/local/dovecot-${_version}/etc/dovecot/sql-connect.conf.ext
 
    query = SELECT CONCAT('/var/vmail/',maildir) AS home, \
       '5000' AS uid, '5000' AS gid, \
@@ -9276,7 +9339,7 @@ EOF
 # The userdb and passdb may be the same or they may be different depending on your needs.
 # You can also have multiple authentication databases.
 #
-# see: https://doc.dovecot.org/2.4.1/core/config/auth/userdb.html
+# see: https://doc.dovecot.org/${_version}/core/config/auth/userdb.html
 #
 $(echo -e "${NEW_BLOCK}")
 EOF

install_update_dovecot.sh

@@ -2597,6 +2597,8 @@ chown -R vmail:vmail /usr/local/dovecot-${_version}/etc/dovecot/sieve
 
 if $systemd_support; then
 
+   _folder_created=false
+
    ## - # - At time, we don't use private tmp directory for divecot.
    ## - # -
    ## - echononl "\tAdjust Systemd service file, set PrivateTmp=false.."
@@ -2621,8 +2623,15 @@ if $systemd_support; then
    ## - here:
    ## -    LimitNOFILE=32768
    ## -
-   if [[ -f "/lib/systemd/system/dovecot.service" ]] \
+   ## - zwei Bemerkungen:
-      && $(grep -q -E "^LimitNOFILE=" /lib/systemd/system/dovecot.service) ; then 
+   ## -     - keine runden Klammern notwendig, da die bash '&&' vor '||' auswertet
+   ## -     - hier auch keine backslah '\' am ende der zeile notwendig, da statement
+   ## -       offensichtlich noch nichzt abgeschlossen ist (die bash erkennt das)
+   ## -
+   if [[ -f /lib/systemd/system/dovecot.service ]] &&
+      grep -qE '^[[:space:]]*LimitNOFILE=' /lib/systemd/system/dovecot.service ||
+      [[ -f /etc/systemd/system/dovecot.service ]] &&
+      grep -qE '^[[:space:]]*LimitNOFILE=' /etc/systemd/system/dovecot.service ; then
 
       _LimitNOFILE="$(grep -E "^LimitNOFILE=[[:digit:]]+" /lib/systemd/system/dovecot.service | cut -d'=' -f2)"
 
@@ -2638,6 +2647,7 @@ if $systemd_support; then
             mkdir "/etc/systemd/system/dovecot.service.d" > /dev/null 2>&1
             if [[ $? -eq 0 ]]; then
                echo -e "$rc_done"
+               _folder_created=true
             else
                echo -e "$rc_failed"
                adjust_limit_nofile=false
@@ -2656,8 +2666,54 @@ LimitNOFILE=$service_limit_nofile
 EOF
          echo -e "$rc_done"
       fi
+
    fi
 
+   ## - Adjust systemd hardening:
+   ## -
+   ## - Options such as ProtectSystem=full/strict make the service's mount namespace,
+   ## - including /usr (and thus /usr/local/dovecote/..), read-only, even though it is w
+   ## - ritable outside the service.
+   ## -
+   ## - However, we would like to allow dovecot to write to the directory
+   ## - /usr/local/dovecot/etc/dovecot/sieve/.
+   ## -
+   ## -    ProtectSystem=off
+   ## -
+   ## - zwei Bemerkungen:
+   ## -     - keine runden Klammern notwendig, da die bash '&&' vor '||' auswertet
+   ## -     - hier auch keine backslah '\' am ende der zeile notwendig, da statement
+   ## -       offensichtlich noch nichzt abgeschlossen ist (die bash erkennt das)
+   ## -
+   if [[ -f /lib/systemd/system/dovecot.service ]] &&
+      grep -qE '^[[:space:]]*ProtectSystem=' /lib/systemd/system/dovecot.service ||
+      [[ -f /etc/systemd/system/dovecot.service ]] &&
+      grep -qE '^[[:space:]]*ProtectSystem=' /etc/systemd/system/dovecot.service ; then
+
+      if ! ${_folder_created} ; then
+
+         echononl "\tCreate Directory '/etc/systemd/system/dovecot.service.d'.."
+         if [[ -d "/etc/systemd/system/dovecot.service.d" ]] ; then
+            echo -e "$rc_skipped"
+         else
+            mkdir "/etc/systemd/system/dovecot.service.d" > /dev/null 2>&1
+            if [[ $? -eq 0 ]]; then
+               echo -e "$rc_done"
+            else
+               echo -e "$rc_failed"
+            fi
+         fi
+
+      fi
+
+      echononl "\tSet 'ProtectSystem=off' for 'dovecot.service'.."
+      cat <<EOF > /etc/systemd/system/dovecot.service.d/systemd-hardening.conf
+[Service]
+ProtectSystem=off
+EOF
+         echo -e "$rc_done"
+
+   fi
 
    echononl "\tReload systemd .."
    systemctl daemon-reload > /dev/null 2>&1