#!/usr/bin/env bash _TLS_CERT_DIR=/etc/postfix/ssl _TLS_CERT_FILE="${_TLS_CERT_DIR}/mailserver.crt" _TLS_KEY_FILE="${_TLS_CERT_DIR}/mailserver.key" _TLS_CA_FILE=/etc/ssl/certs/ca-certificates.crt _HOSTNAME=o15.oopen.de _IPV4=83.223.86.96 _EXT_IF_IP=83.223.86.96 ## - Leave empty, if no IPv6 should be supported ## - _IPV6=2a01:30:0:13:5054:ff:fe09:2318 #_IPV6= _ADMIN_EMAIL=admin@oopen.de _SASL_AUTH=false _RELAY_HOST=b.mx.oopen.de _SASL_USER=anw-urb _SASL_PASS='OhPie2aethei' # ------------- # --- Some functions # ------------- echononl(){ echo X\\c > /tmp/shprompt$$ if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then echo -e -n "$*\\c" 1>&2 else echo -e -n "$*" 1>&2 fi rm /tmp/shprompt$$ } fatal(){ echo "" echo -e "fataler Fehler: $*" echo "" echo -e "\t\033[31m\033[1mInstalllation wird abgebrochen\033[m\033[m" echo "" exit 1 } error(){ echo "" echo -e "\t[ \033[31m\033[1mFehler\033[m ]: $*" echo "" } warn (){ echo "" echo -e "\t[ \033[33m\033[1mWarning\033[m ]: $*" echo "" } info (){ echo "" echo -e "\t[ \033[32m\033[1mInfo\033[m ]: $*" echo "" } echo_done() { echo -e "\033[80G[ \033[32mdone\033[m ]" } echo_ok() { echo -e "\033[80G[ \033[32mok\033[m ]" } echo_warning() { echo -e "\033[80G[ \033[33m\033[1mwarn\033[m ]" } echo_failed(){ echo -e "\033[80G[ \033[1;31mfailed\033[m ]" } echo_skipped() { echo -e "\033[80G[ \033[33m\033[1mskipped\033[m ]" } # - Is this a systemd system? # - if [[ "X`which systemd`" = "X" ]]; then systemd_exists=false else systemd_exists=true fi echo "" # - Deinstall debian exim4 packages # - echononl " Deinstall debian exim4 packages" _installed_exim_packages=`dpkg -l | grep exim4 | grep -e "^i" | awk '{print$2}'` for _pkg in $_installed_exim_packages ; do installed_exim_packages="$installed_exim_packages $_pkg" done if [[ -n "$installed_exim_packages" ]] ; then if `dpkg -l | grep bsd-mailx | grep -e "^i" > /dev/null 2>&1` ; then installed_exim_packages="$installed_exim_packages bsd-mailx" fi apt-get remove --purge -qq -y $installed_exim_packages > /dev/null 2>&1 if [[ $? -eq 0 ]] ; then echo_ok else echo_failed fi else echo_skipped fi # - Install Postfix from debian packages system # - echononl " Install Postfix from debian packages system" _needed_packages="postfix postfix-pcre libsasl2-modules bsd-mailx haveged" for _pkg in $_needed_packages ; do if `dpkg -l | grep $_pkg | grep -e "^i" > /dev/null 2>&1` ; then continue else needed_packages="$needed_packages $_pkg" fi done if [[ -n "$needed_packages" ]]; then DEBIAN_FRONTEND=noninteractive apt-get -y install $needed_packages > /dev/null 2>&1 if [[ $? -eq 0 ]] ; then echo_ok else echo_failed fi else echo_skipped fi # - Backup existing postfix configuration file # - echononl " Backup existing postfix configuration file" if [[ -f "/etc/postfix/main.cf" ]]; then cp -a /etc/postfix/main.cf /etc/postfix/main.cf.`date +%Y%m%d-%H%M` if [[ $? -eq 0 ]] ; then echo_ok else echo_failed fi else echo_skipped fi # - Creeate new postfix configuration file # - echononl " Creeate new postfix configuration file" cat < /etc/postfix/main.cf # ============ Basic settings ============ # Debian specific: Specifying a file name will cause the first # line of that file to be used as the name. The Debian default # is /etc/mailname. #myorigin = /etc/mailname myorigin = /etc/mailname smtpd_banner = \$myhostname ESMTP \$mail_name (Debian/GNU) biff = no # appending .domain is the MUA's job. append_dot_mydomain = no # Uncomment the next line to generate "delayed mail" warnings #delay_warning_time = 4h readme_directory = /usr/share/doc/postfix html_directory = /usr/share/doc/postfix/html ## - The Internet protocols Postfix will attempt to use when making ## - or accepting connections. ## - DEFAULT: ipv4 EOF if [ -n "$_IPV6" ]; then cat <> /etc/postfix/main.cf inet_protocols = ipv4, ipv6 #inet_interfaces = all inet_interfaces = 127.0.0.1 $_IPV4 $_IPV6 myhostname = $_HOSTNAME mydestination = $_HOSTNAME localhost ## - The list of "trusted" SMTP clients that have more ## - privileges than "strangers" ## - mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 ${_IPV4}/32 [${_IPV6}]/128 smtp_bind_address = $_IPV4 smtp_bind_address6 = $_IPV6 EOF else cat <> /etc/postfix/main.cf inet_protocols = ipv4 #inet_interfaces = all inet_interfaces = 127.0.0.1 $_IPV4 myhostname = $_HOSTNAME mydestination = $_HOSTNAME localhost ## - The list of "trusted" SMTP clients that have more ## - privileges than "strangers" ## - mynetworks = 127.0.0.0/8 ${_IPV4}/32 smtp_bind_address = $_IPV4 #smtp_bind_address6 = $_IPV6 EOF fi cat <> /etc/postfix/main.cf ## - The method to generate the default value for the mynetworks parameter. ## - ## - mynetworks_style = host" when Postfix should "trust" only the local machine ## - mynetworks_style = subnet (default value) "when Postfix should "trust" SMTP ## - clients in the same IP subnetworks as the local machine. ## - mynetworks_style = class" when Postfix should "trust" SMTP clients in the same ## - IP class A/B/C networks as the local machine. ## - #mynetworks_style = host ## - The maximal size of any local(8) individual mailbox or maildir file, ## - or zero (no limit). In fact, this limits the size of any file that is ## - written to upon local delivery, including files written by external ## - commands that are executed by the local(8) delivery agent. ## - mailbox_size_limit = 0 ## - The maximal size in bytes of a message, including envelope information. ## - ## - we user 50MB ## - message_size_limit = 52480000 ## - The system-wide recipient address extension delimiter ## - recipient_delimiter = + ## - The alias databases that are used for local(8) delivery. ## - alias_maps = hash:/etc/aliases ## - The alias databases for local(8) delivery that are updated ## - with "newaliases" or with "sendmail -bi". ## - alias_database = hash:/etc/aliases ## - The maximal time a message is queued before it is sent back as ## - undeliverable. Defaults to 5d (5 days) ## - Specify 0 when mail delivery should be tried only once. ## - maximal_queue_lifetime = 3d bounce_queue_lifetime = \$maximal_queue_lifetime ## - delay_warning_time (default: 0h) ## - ## - The time after which the sender receives a copy of the message ## - headers of mail that is still queued. To enable this feature, ## - specify a non-zero time value (an integral value plus an optional ## - one-letter suffix that specifies the time unit). ## - Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). ## - The default time unit is h (hours). delay_warning_time = 1d EOF if $_SASL_AUTH ; then cat <> /etc/postfix/main.cf # ============ Relay parameters ============ #relayhost = # ============ SASL authentication ============ # Enable SASL authentication smtp_sasl_auth_enable = yes # Forwarding to the ip-adress of host b.mx.oopen.de relayhost = [b.mx.oopen.de] # File including login data smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd # Force using a (TLS) security connection # obsulete - use smtp_tls_security_level instead #smtp_use_tls = yes #smtp_tls_enforce_peername = no smtp_tls_security_level = encrypt # Disallow methods that allow anonymous authentication. smtp_sasl_security_options = noanonymous # ============ TLS parameters ============ ## - Aktiviert TLS für den Mailempfang ## - ## - may: ## - Opportunistic TLS. Use TLS if this is supported by the remote ## - SMTP server, otherwise use plaintext ## - ## - This overrides the obsolete parameters smtpd_use_tls and ## - smtpd_enforce_tls. This parameter is ignored with ## - "smtpd_tls_wrappermode = yes". #smtpd_use_tls=yes smtp_tls_security_level=encrypt EOF else cat <> /etc/postfix/main.cf # ============ Relay parameters ============ relayhost = # ============ TLS parameters ============ ## - Aktiviert TLS für den Mailempfang ## - ## - may: ## - Opportunistic TLS. Use TLS if this is supported by the remote ## - SMTP server, otherwise use plaintext ## - ## - This overrides the obsolete parameters smtpd_use_tls and ## - smtpd_enforce_tls. This parameter is ignored with ## - "smtpd_tls_wrappermode = yes". #smtpd_use_tls=yes smtp_tls_security_level=may EOF fi cat <> /etc/postfix/main.cf ## - Aktiviert TLS für den Mailversand ## - ## - may: ## - Opportunistic TLS: announce STARTTLS support to SMTP clients, ## - but do not require that clients use TLS encryption. # smtp_use_tls=yes smtpd_tls_security_level=may ## - 0 Disable logging of TLS activity. ## - 1 Log TLS handshake and certificate information. ## - 2 Log levels during TLS negotiation. ## - 3 Log hexadecimal and ASCII dump of TLS negotiation process. ## - 4 Also log hexadecimal and ASCII dump of complete transmission after STARTTLS. ## - smtpd_tls_loglevel = 1 smtp_tls_loglevel = 1 smtpd_tls_cert_file = $_TLS_CERT_FILE smtpd_tls_key_file = $_TLS_KEY_FILE ## - File with DH parameters that the Postfix SMTP server should use with EDH ciphers. ## - ## - Dont't forget to create it, e.g with openssl: ## - openssl gendh -out /etc/postfix/ssl/dh_1024.pem -2 1024 ## - #smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_1024.pem ## - also possible to use 2048 key with that parameter ## - smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_2048.pem ## - File with DH parameters that the Postfix SMTP server should use with EDH ciphers. ## - ## - Dont't forget to create it, e.g with openssl: ## - openssl gendh -out /etc/postfix/ssl/dh_512.pem -2 512 ## - smtpd_tls_dh512_param_file = /etc/postfix/ssl/dh_512.pem ## - File containing CA certificates of root CAs trusted to sign either remote SMTP ## - server certificates or intermediate CA certificates. These are loaded into ## - memory !! BEFORE !! the smtp(8) client enters the chroot jail. ## - smtp_tls_CAfile = $_TLS_CA_FILE ## - Directory with PEM format certificate authority certificates that the Postfix SMTP ## - client uses to verify a remote SMTP server certificate. Don't forget to create the ## - necessary "hash" links with, for example, " ## - $OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". ## - ## - !! Note !! ## - To use this option in chroot mode, this directory (or a copy) must be inside ## - the chroot jail. ## - ## - Note that a chrooted daemon resolves all filenames relative to the Postfix ## - queue directory (/var/spool/postfix) ## - #smtpd_tls_CApath = /etc/postfix/certs # Disable SSLv2 SSLv3 - Postfix SMTP server # # List of TLS protocols that the Postfix SMTP server will exclude or # include with opportunistic TLS encryption. smtpd_tls_protocols = !SSLv2, !SSLv3 # # The SSL/TLS protocols accepted by the Postfix SMTP server # with mandatory TLS encryption. smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 # Disable SSLv2 SSLv3 - Postfix SMTP client # # List of TLS protocols that the Postfix SMTP client will exclude or # include with opportunistic TLS encryption. smtp_tls_protocols = !SSLv2, !SSLv3 # # List of SSL/TLS protocols that the Postfix SMTP client will use # with mandatory TLS encryption smtp_tls_mandatory_protocols = !SSLv2, !SSLv3 ## - Activate des "Ephemeral Elliptic Curve Diffie-Hellman" (EECDH) key exchange ## - openssl > 1.0 ## - smtpd_tls_eecdh_grade = strong # standard list cryptographic algorithm tls_preempt_cipherlist = yes # Disable ciphers which are less than 256-bit: # #smtpd_tls_mandatory_ciphers = high # # opportunistic smtpd_tls_ciphers = high # Exclude ciphers #smtpd_tls_exclude_ciphers = # RC4 # aNULL # SEED-SHA # EXP # MD5 smtpd_tls_exclude_ciphers = aNULL eNULL EXPORT DES RC4 MD5 PSK aECDH EDH-DSS-DES-CBC3-SHA EDH-RSA-DES-CDC3-SHA KRB5-DE5, CBC3-SHA smtpd_tls_session_cache_database = btree:\${data_directory}/smtpd_scache smtp_tls_session_cache_database = btree:\${data_directory}/smtp_scache EOF echo_ok echononl " Configure SASL authentification" if $_SASL_AUTH ; then _failed=false echo "[$_RELAY_HOST] ${_SASL_USER}@${_RELAY_HOST}:$_SASL_PASS" > /etc/postfix/sasl_passwd if [[ "$?" != "0" ]]; then error "Setting \"/etc/postfix/sasl_passwd\" failed! " _failed=true fi chown root:root /etc/postfix/sasl_passwd if [[ "$?" != "0" ]]; then error "Setting ownership of \"/etc/postfix/sasl_passwd\" failed! " _failed=true fi chmod 600 /etc/postfix/sasl_passwd if [[ "$?" != "0" ]]; then error "Setting permissions on \"/etc/postfix/sasl_passwd\" failed! " _failed=true fi postmap /etc/postfix/sasl_passwd chown root:root /etc/postfix/sasl_passwd.db if [[ "$?" != "0" ]]; then error "Creating \"/etc/postfix/sasl_passwd\" failed! " _failed=true fi chown root:root /etc/postfix/sasl_passwd.db if [[ "$?" != "0" ]]; then error "Setting ownership of \"/etc/postfix/sasl_passwd.db\" failed! " _failed=true fi if $_failed ; then echo_failed else echo_ok fi else echo_skipped fi ## - /etc/mailname ## - echononl " Set \"/etc/mailname\"" echo $_HOSTNAME > /etc/mailname if [[ $? -eq 0 ]] ; then echo_ok else echo_failed fi ## - /etc/aliases ## - echononl " Adjust \"/etc/aliases\"" cat << EOF > /etc/aliases # See man 5 aliases for format mailer-daemon: postmaster postmaster: root nobody: root hostmaster: root usenet: root news: root webmaster: root www: root ftp: root abuse: root noc: root security: root root: $_ADMIN_EMAIL EOF if [[ $? -eq 0 ]] ; then echo_ok else echo_failed fi ## - create directory for certificates and copy certificates ## - and coresponding keys to /etc/postfix/ssl/ ## - echononl " Create directory for certificates \"/etc/postfix/ssl\"" if [[ -d "/etc/postfix/ssl" ]] ; then echo_skipped else mkdir -p /etc/postfix/ssl if [[ $? -eq 0 ]] ; then echo_ok else echo_failed fi fi ## - generate DH parameters that the Postfix SMTP server should use ## - with EDH ciphers (length 512 and 1024 ## - echononl " Generate DH key length=512 \"/etc/postfix/ssl/dh_512.pem\"" if [ ! -f /etc/postfix/ssl/dh_512.pem ]; then openssl gendh -out /etc/postfix/ssl/dh_512.pem -2 512 > /dev/null 2>&1 if [[ $? -eq 0 ]] ; then echo_ok else echo_failed fi else echo_skipped fi echononl " Generate DH key length=1024 \"/etc/postfix/ssl/dh_1024.pem\"" if [ ! -f /etc/postfix/ssl/dh_1024.pem ]; then openssl gendh -out /etc/postfix/ssl/dh_1024.pem -2 1024 > /dev/null 2>&1 if [[ $? -eq 0 ]] ; then echo_ok else echo_failed fi else echo_skipped fi echononl " Generate DH key length=2048 \"/etc/postfix/ssl/dh_2048.pem\"" if [ ! -f /etc/postfix/ssl/dh_2048.pem ]; then openssl gendh -out /etc/postfix/ssl/dh_2048.pem -2 2048 > /dev/null 2>&1 if [[ $? -eq 0 ]] ; then echo_ok else echo_failed fi else echo_skipped fi echononl " Create Symlink \"$_TLS_CERT_FILE\"" if [ ! -h "$_TLS_CERT_FILE" ]; then ln -s /etc/ssl/certs/ssl-cert-snakeoil.pem $_TLS_CERT_FILE if [[ $? -eq 0 ]] ; then echo_ok else echo_failed fi else echo_skipped fi echononl " Create Symlink \"$_TLS_KEY_FILE\"" if [ ! -h "$_TLS_KEY_FILE" ]; then ln -s /etc/ssl/private/ssl-cert-snakeoil.key $_TLS_KEY_FILE if [[ $? -eq 0 ]] ; then echo_ok else echo_failed fi else echo_skipped fi ## - rebuld alias database ## - echononl " Rebuld alias database" newaliases > /dev/null 2>&1 if [[ $? -eq 0 ]] ; then echo_ok else echo_failed fi ## - restart postfix ## - echononl " Restart postfix" if $systemd_exists ; then systemctl restart postfix > /dev/null 2>&1 if [[ $? -eq 0 ]] ; then echo_ok else echo_failed fi else /etc/init.d/postfix restart > /dev/null 2>&1 if [[ $? -eq 0 ]] ; then echo_ok else echo_failed fi fi ## - Omitt logging into system.log ## - echononl " Create \"/etc/rsyslog.d/postfix.conf\"" cat << EOF >> /etc/rsyslog.d/postfix.conf # # Logging for the mail system. Split it up so that # it is easy to write scripts to parse these files. # mail.info -/var/log/mail.info mail.warn -/var/log/mail.warn mail.err /var/log/mail.err mail.* -/var/log/mail.log & ~ EOF if [[ $? -eq 0 ]] ; then echo_ok else echo_failed fi echononl " Restart rsyslog daemon" if $systemd_exists ; then systemctl restart rsyslog > /dev/null 2>&1 if [[ $? -eq 0 ]] ; then echo_ok else echo_failed fi else /etc/init.d/rsyslog restart > /dev/null 2>&1 if [[ $? -eq 0 ]] ; then echo_ok else echo_failed fi fi echo "" exit