#!/usr/bin/env bash clear echo -e "\n \033[32mStart Installation of OpenDMARC..\033[m" # ------------- # - Settings # ------------- #_src_base_dir="$(realpath $(dirname $0))" #conf_file="${_src_base_dir}/conf/install_opendmarc.conf" _opendmarc_packages="opendmarc" opendmarc_base_dir="/etc/opendmarc" opendmarc_conf_file="/etc/opendmarc.conf" postfix_spool_dir="/var/spool/postfix" opendmarc_socket_dir="${postfix_spool_dir}/opendmarc" opendmarc_socket_file="${opendmarc_socket_dir}/opendmarc.sock" config_file_name_value_parameters=" AuthservID|DMARC check $(hostname -f) PidFile|/run/opendmarc/opendmarc.pid RejectFailures|true Syslog|true SyslogFacility|mail TrustedAuthservIDs|$(hostname -f) IgnoreHosts|/etc/opendmarc/ignore.hosts IgnoreAuthenticatedClients|true RequiredHeaders|false UMask|002 FailureReports|false AutoRestart|true HistoryFile|/run/opendmarc/opendmarc.dat SPFIgnoreResults|false SPFSelfValidate|true Socket|${opendmarc_socket_file} " declare -a config_file_name_value_parameter_arr=() for _conf in $config_file_name_value_parameters ; do config_file_name_value_parameter_arr+=("$_conf") done postfix_needs_restart=false opendmarc_needs_restart=false backup_date="$(date +%Y-%m-%d-%H%M)" log_file="$(mktemp)" # ------------- # --- Some functions # ------------- echononl(){ echo X\\c > /tmp/shprompt$$ if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then echo -e -n "$*\\c" 1>&2 else echo -e -n "$*" 1>&2 fi rm /tmp/shprompt$$ } fatal(){ echo "" echo -e "fatal error: $*" echo "" echo -e "\t\033[31m\033[1mInstalllation will be interrupted\033[m\033[m" echo "" exit 1 } error(){ echo "" echo -e "\t[ \033[31m\033[1mFehler\033[m ]: $*" echo "" } warn (){ echo "" echo -e "\t[ \033[33m\033[1mWarning\033[m ]: $*" echo "" } info (){ echo "" echo -e "\t[ \033[32m\033[1mInfo\033[m ]: $*" echo "" } echo_done() { echo -e "\033[80G[ \033[32mdone\033[m ]" } echo_ok() { echo -e "\033[80G[ \033[32mok\033[m ]" } echo_warning() { echo -e "\033[80G[ \033[33m\033[1mwarn\033[m ]" } echo_failed(){ echo -e "\033[80G[ \033[1;31mfailed\033[m ]" } echo_skipped() { echo -e "\033[80G[ \033[37mskipped\033[m ]" } # ------------- # - Some pre-installation tasks # ------------- # - Is 'systemd' supported on this system # - if [ "X`which systemd`" = "X" ]; then SYSTEMD_EXISTS=false else SYSTEMD_EXISTS=true fi # ============= # - Start Installation # ============= echo "" # - Synchronise package index files with the repository # - echononl " Synchronise package index files with the repository.." apt-get update > "$log_file" 2>&1 if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi # - Install opendmarc # - echononl " Install needed debian packages.." opendmarc_packages="" packages_installed=false for _pkg in $_opendmarc_packages ; do if aptitude search "$_pkg" | grep " $_pkg " | grep -e "^i" > /dev/null 2>&1 ; then continue else opendmarc_packages="$opendmarc_packages $_pkg" fi done if [[ -n "$opendmarc_packages" ]]; then DEBIAN_FRONTEND=noninteractive apt-get -y install $opendmarc_packages > /dev/null 2> "$log_file" packages_installed=true opendmarc_needs_restart=true if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi else echo_skipped fi # - Add user 'postfix' to group 'opendmarc' # - echononl " Add user 'postfix' to group 'opendmarc'.." if grep -E "^opendmarc" /etc/group | grep -q postfix 2> /dev/null ; then echo_skipped else usermod -a -G opendmarc postfix > "$log_file" 2>&1 if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi fi # - Add 'IgnoreHosts' with default value to the original opendmarc.conf file # echononl " Add 'IgnoreHosts' with default value to the opendmarc.conf file.." if ! $(grep -q -E "^IgnoreHosts\s+" ${opendmarc_conf_file} 2> /dev/null) ; then cat << EOF >> ${opendmarc_conf_file} ## Specifies the path to a file that contains a list of hostnames, IP addresses, ## and/or CIDR expressions identifying hosts whose SMTP connections are to be ## ignored by the filter. If not specified, defaults to "127.0.0.1" only. # IgnoreHosts 127.0.0.1 EOF if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi else echo_skipped fi # - Add 'IgnoreAuthenticatedClients' with default value to the original opendmarc.conf file # _param="IgnoreAuthenticatedClients" echononl " Add '${_param}' with default value to the opendmarc.conf file.." if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then cat << EOF >> ${opendmarc_conf_file} ## If set, causes mail from authenticated clients (i.e., those that used ## SMTP AUTH) to be ignored by the filter. The default is "false". # IgnoreAuthenticatedClients false EOF if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi else echo_skipped fi # - Add 'RequiredHeaders' with default value to the original opendmarc.conf file # _param="IgnoreAuthenticatedClients" echononl " Add '${_param}' with default value to the opendmarc.conf file.." if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then cat << EOF >> ${opendmarc_conf_file} ## If set, causes mail from authenticated clients (i.e., those that used ## SMTP AUTH) to be ignored by the filter. The default is "false". # IgnoreAuthenticatedClients false EOF if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi else echo_skipped fi # - Add 'RequiredHeaders' with default value to the original opendmarc.conf file # _param="RequiredHeaders" echononl " Add '${_param}' with default value to the opendmarc.conf file.." if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then cat << EOF >> ${opendmarc_conf_file} ## If set, the filter will ensure the header of the message conforms to the basic ## header field count restrictions laid out in RFC5322, Section 3.6. Messages ## failing this test are rejected without further processing. A From: field from ## which no domain name could be extracted will also be rejected. # RequiredHeaders false EOF if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi else echo_skipped fi # - Add 'AutoRestart' with default value to the original opendmarc.conf file # _param="AutoRestart" echononl " Add '${_param}' with default value to the opendmarc.conf file.." if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then cat << EOF >> ${opendmarc_conf_file} ## Automatically re-start on failures. Use with caution; if the filter fails ## instantly after it starts, this can cause a tight fork(2) loop. # AutoRestart false EOF if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi else echo_skipped fi # - Add 'HistoryFile' with default value to the original opendmarc.conf file # _param="HistoryFile" echononl " Add '${_param}' with default value to the opendmarc.conf file.." if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then cat << EOF >> ${opendmarc_conf_file} ## If set, specifies the location of a text file to which records are written ## that can be used to generate DMARC aggregate reports. Records are batches of ## rows containing information about a single received message, and include all ## relevant information needed to generate a DMARC aggregate report. It is ## expected that this will not be used in its raw form, but rather periodically ## imported into a relational database from which the aggregate reports can be ## extracted using opendmarc-importstats(8). # HistoryFile /run/opendmarc/opendmarc.dat EOF if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi else echo_skipped fi # - Add 'SPFIgnoreResults' with default value to the original opendmarc.conf file # _param="SPFIgnoreResults" echononl " Add '${_param}' with default value to the opendmarc.conf file.." if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then cat << EOF >> ${opendmarc_conf_file} ## Causes the filter to ignore any SPF results in the header of the message. This ## is useful if you want the filter to perform SPF checks itself, or because you ## don't trust the arriving header. The default is "false". # SPFIgnoreResults false EOF if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi else echo_skipped fi # - Add 'SPFSelfValidate' with default value to the original opendmarc.conf file # _param="SPFSelfValidate" echononl " Add '${_param}' with default value to the opendmarc.conf file.." if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then cat << EOF >> ${opendmarc_conf_file} ## Causes the filter to perform a fallback SPF check itself when it can find no ## SPF results in the message header. If SPFIgnoreResults is also set, it never ## looks for SPF results in headers and always performs the SPF check itself when ## this is set. The default is "false". # SPFSelfValidate false EOF if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi else echo_skipped fi # - Save configuration file from distribution # - echononl " Save configuration file from distribution" if [[ -f "${opendmarc_conf_file}.ORIG" ]] ; then echo_skipped else cp -a $opendmarc_conf_file $opendmarc_conf_file.ORIG 2> "$log_file" if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi fi for _val in "${config_file_name_value_parameter_arr[@]}" ; do IFS='|' read -a _val_arr <<< "${_val}" echononl " $opendmarc_conf_file: ${_val_arr[0]} -> ${_val_arr[1]}.." if $(grep -E -q "^\s*${_val_arr[0]}\s+${_val_arr[1]}\s*$" $opendmarc_conf_file 2> /dev/null) ; then echo_skipped elif $(grep -E -q "^\s*#\s*${_val_arr[0]}\s+" $opendmarc_conf_file 2> /dev/null); then perl -i -n -p -e "s&^(\s*#\s*${_val_arr[0]}.*)&\1\n${_val_arr[0]} ${_val_arr[1]}&" $opendmarc_conf_file > "$log_file" 2>&1 if [[ $? -eq 0 ]] ; then echo_ok opendmarc_needs_restart=true else echo_failed error "$(cat $log_file)" fi elif $(grep -E -q "^\s*${_val_arr[0]}\s+" $opendmarc_conf_file 2> /dev/null) ; then perl -i -n -p -e "s#^(\s*${_val_arr[0]}.*)#\#\1\n${_val_arr[0]} ${_val_arr[1]}#" $opendmarc_conf_file > "$log_file" 2>&1 if [[ $? -eq 0 ]] ; then echo_ok opendmarc_needs_restart=true else echo_failed error "$(cat $log_file)" fi else cat <> $opendmarc_conf_file 2> "$log_file" ${_val_arr[0]} ${_val_arr[1]} EOF if [[ $? -eq 0 ]] ; then echo_ok opendmarc_needs_restart=true else echo_failed error "$(cat $log_file)" fi fi done # - Assign ownership to the opendmarc user and restrict tthe # - file permissions: # - echononl " Assign file permissions to '$opendmarc_conf_file'.." chmod u=rw,go=r $opendmarc_conf_file 2> $log_file if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi # - Create the directories to hold opendmarc's data files, assign # - ownership to the opendmarc user, and restrict the file # - permissions: # - echononl " Create directory '$opendmarc_base_dir'" if [[ -d "$opendmarc_base_dir" ]] ; then echo_skipped else opendmarc_needs_restart=true mkdir ${opendmarc_base_dir} 2> $log_file if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi fi echononl " Set ownership on directory '${opendmarc_base_dir}' (recursive).." chown -R opendmarc:opendmarc ${opendmarc_base_dir} 2> $log_file if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi # - Create the file ${opendmarc_base_dir}/ignore.hosts # - echononl " Create file '${opendmarc_base_dir}/ignore.hosts'.." if [[ -f "${opendmarc_base_dir}/ignore.hosts" ]] ; then echo_skipped else cat < ${opendmarc_base_dir}/ignore.hosts 2> $log_file # We are using AmaViS at 'localhost 127.0.0.1 . So we cannot bypass them # # 127.0.0.1 # localhost $(hostname -f) EOF opendmarc_needs_restart=true if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi fi # - Edit /etc/default/opendmarc # - # - Set: # - SOCKET="local:${postfix_spool_dir}/opendmarc/opendmarc.sock" # - echononl " Set 'SOCKET' at file /etc/default/opendmarc.." if grep -q -E "^\s*SOCKET" /etc/default/opendmarc 2>/dev/null ; then if grep -q -E "^\s*SOCKET\s*=\s*\"*local:$opendmarc_socket_file" /etc/default/opendmarc 2>/dev/null ; then echo_skipped else perl -i -n -p -e "s#^\s*SOCKET=.*#SOCKET=\"local:$opendmarc_socket_file\"#" /etc/default/opendmarc 2> $log_file opendmarc_needs_restart=true if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi fi else cat <>/etc/default/opendmarc 2> $log_file SOCKET="local:$opendmarc_socket_file" EOF opendmarc_needs_restart=true if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi fi # - Create the opendmarc socket directory in Postfix’s work area # - and make sure it has the correct ownership: # - echononl " Create the opendmarc socket directory in Postfix's work area.." if [[ -d "${postfix_spool_dir}/opendmarc" ]] ; then echo_skipped else mkdir ${postfix_spool_dir}/opendmarc 2> $log_file opendmarc_needs_restart=true if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi echononl " Set ownership on directory '${postfix_spool_dir}/opendmarc'.." chown opendmarc:postfix ${postfix_spool_dir}/opendmarc 2> $log_file if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi fi # - Edit /etc/postfix/main.cf and add a section to activate # - processing of e-mail through the opendmarc daemon: # - echononl " Backup existing postfix configuration (main.cf).." cp -a /etc/postfix/main.cf /etc/postfix/main.cf.$backup_date 2> $log_file if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi echononl " Set Variable non_smtpd_milters at '/etc/postfix/main.cf'.." if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*opendkim.sock" /etc/postfix/main.cf 2> /dev/null) ; then if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*$(basename "${opendmarc_socket_file}")" /etc/postfix/main.cf); then echo_skipped else perl -i -n -p -e "s&^\s*(non_smtpd_milters\s*=.*opendkim.sock)&\1,local:/$(basename "${opendmarc_socket_dir}")/$(basename "${opendmarc_socket_file}")&" \ /etc/postfix/main.cf > $log_file 2>&1 if [[ $? -eq 0 ]] ; then echo_ok postfix_needs_restart=true else echo_failed error "$(cat $log_file)" fi fi else echo_skipped warn "Postfix is not adjusted. Complete Postfix configuration (main.cf) manually\!" fi # - Prevent Postfix from setting the DMARC Header twice (one befor # - and one after processing amavis # - # - To disable milter processing after amavis, add to your master.cf in # - the after-amavis section: # - 127.0.0.1:10025 inet n - - - - smtpd # - [...] # - -o smtpd_milters= # - # - If you want to run the milter after amavis, set in main.cf # - smtpd_milters= # - to an empty string and add the smtpd_milters configuration to master.cf # - (after-section amavis) instead: # - -o smtpd_milters=local:/opendmarc/opendmarc.sock # - echononl " Backup file '/etc/postfix/master.cf'.." cp -a /etc/postfix/master.cf /etc/postfix/master.cf.${backup_date} 2> $log_file if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi echononl " Adjust /etc/postfix/master.cf. Set DMARC after sending throuh AmaVIS.." if $(grep -q -E "^\s*-o\s+smtpd_milters\s*=\s*.*opendkim.sock" /etc/postfix/master.cf 2> /dev/null) ; then if $(grep -q -E "^\s*-o\s+smtpd_milters\s*=\s*.*$(basename ${opendmarc_socket_file})" /etc/postfix/master.cf); then echo_skipped else perl -i -n -p -e "s&(^\s*-o\s+smtpd_milters\s*=.*)&\1,local:/$(basename "${opendmarc_socket_dir}")/$(basename "${opendmarc_socket_file}")&" \ /etc/postfix/master.cf > $log_file 2>&1 if [[ $? -eq 0 ]] ; then echo_ok postfix_needs_restart=true else echo_failed error "$(cat $log_file)" fi fi else echo_skipped warn "Postfix is not adjusted. Complete Postfix configuration (master.cf) manually\!" fi echo "" echononl " Enable OpenDMARC Service" if $SYSTEMD_EXISTS ; then systemctl enable opendmarc > $log_file 2>&1 if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi else warn "Maybe OpenDMARC Service is not enabled, because its an old non-systemd os.." fi # - Restart opendmarc # - echononl " Restart opendmarc.." if $opendmarc_needs_restart ; then if $SYSTEMD_EXISTS ; then systemctl restart opendmarc > $log_file 2>&1 if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi else /etc/init.d/opendmarc restart > $log_file 2>&1 if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi fi else echo_skipped fi # - Restart Postfix so it starts using opendmarc when processing mail: # - echononl " Restart Postfix.." if $postfix_needs_restart ; then if $SYSTEMD_EXISTS ; then systemctl restart postfix > $log_file 2>&1 if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi else /etc/init.d/postfix restart > $log_file 2>&1 if [[ $? -eq 0 ]] ; then echo_ok else echo_failed error "$(cat $log_file)" fi fi else echo_skipped fi echo "" if [[ -f "/etc/postfix/master.cf.${backup_date}" ]] ; then if $(diff "/etc/postfix/master.cf" "/etc/postfix/master.cf.${backup_date}"> /dev/null 2>&1) ; then info "File \033[1m/etc/postfix/master.cf\033[m has not changed.\n\t Removing previos created backup.." rm "/etc/postfix/master.cf.${backup_date}" fi fi if [[ -f "/etc/postfix/main.cf.${backup_date}" ]] ; then if $(diff "/etc/postfix/main.cf" "/etc/postfix/main.cf.${backup_date}"> /dev/null 2>&1) ; then info "File \033[1m/etc/postfix/main.cf\033[m has not changed.\n\t Removing previos created backup.." rm "/etc/postfix/main.cf.${backup_date}" fi fi echo "" rm -f "$log_file" exit 0