chrisandClaude Opus 5.5
ad4018eca3
- Set PublicSuffixList and UserID explicitly instead of relying on the package config. - Do not use HistoryFile (no aggregate reports); comment out an active setting. - Set SPFIgnoreResults to true. - Update comment in ignore.hosts to reflect the current milter setup. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1151 lines
31 KiB
Bash
Executable File
1151 lines
31 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
|
||
clear
|
||
echo -e "\n \033[32mStart Installation of OpenDMARC..\033[m"
|
||
|
||
overwrite_config_files=true
|
||
|
||
|
||
# -------------
|
||
# - Settings
|
||
# -------------
|
||
|
||
#_src_base_dir="$(realpath $(dirname $0))"
|
||
#conf_file="${_src_base_dir}/conf/install_opendmarc.conf"
|
||
|
||
_opendmarc_packages="opendmarc"
|
||
|
||
opendmarc_base_dir="/etc/opendmarc"
|
||
opendmarc_conf_file="/etc/opendmarc.conf"
|
||
|
||
postfix_spool_dir="/var/spool/postfix"
|
||
|
||
opendmarc_socket_dir="${postfix_spool_dir}/opendmarc"
|
||
opendmarc_socket_file="${opendmarc_socket_dir}/opendmarc.sock"
|
||
|
||
# - HistoryFile is intentionally NOT set: it is only useful if the records are
|
||
# - imported regularly with opendmarc-importstats(8) to generate DMARC aggregate
|
||
# - reports. We do not generate such reports, so the file would only grow and,
|
||
# - located in /run, be lost at every reboot. An active setting is commented out
|
||
# - further below.
|
||
# -
|
||
config_file_name_value_parameters="
|
||
AuthservID|HOSTNAME
|
||
TrustedAuthservIDs|HOSTNAME
|
||
PublicSuffixList|/usr/share/publicsuffix/public_suffix_list.dat
|
||
UserID|opendmarc
|
||
PidFile|/run/opendmarc/opendmarc.pid"
|
||
if which sympa ; then
|
||
config_file_name_value_parameters="$config_file_name_value_parameters
|
||
RejectFailures|false"
|
||
else
|
||
config_file_name_value_parameters="$config_file_name_value_parameters
|
||
RejectFailures|true"
|
||
fi
|
||
config_file_name_value_parameters="$config_file_name_value_parameters
|
||
Syslog|true
|
||
SyslogFacility|mail
|
||
IgnoreHosts|${opendmarc_base_dir}/ignore.hosts
|
||
IgnoreMailFrom|${opendmarc_base_dir}/ignore.mailfrom
|
||
IgnoreAuthenticatedClients|true
|
||
RequiredHeaders|false
|
||
UMask|002
|
||
FailureReports|false
|
||
AutoRestart|true
|
||
SPFIgnoreResults|true
|
||
SPFSelfValidate|true
|
||
Socket|${opendmarc_socket_file}
|
||
"
|
||
|
||
|
||
declare -a config_file_name_value_parameter_arr=()
|
||
for _conf in $config_file_name_value_parameters ; do
|
||
config_file_name_value_parameter_arr+=("$_conf")
|
||
done
|
||
|
||
postfix_needs_restart=false
|
||
opendmarc_needs_restart=false
|
||
|
||
log_file="$(mktemp)"
|
||
tmp_main_cf_file="$(mktemp)"
|
||
|
||
main_cf_file="/etc/postfix/main.cf"
|
||
|
||
backup_date="$(date +%Y-%m-%d-%H%M)"
|
||
|
||
opendkim_socket_string="local:/opendkim/opendkim.sock"
|
||
opendmarc_socket_string="local:/opendmarc/opendmarc.sock"
|
||
|
||
# -------------
|
||
# --- Some functions
|
||
# -------------
|
||
echononl(){
|
||
echo X\\c > /tmp/shprompt$$
|
||
if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
|
||
echo -e -n "$*\\c" 1>&2
|
||
else
|
||
echo -e -n "$*" 1>&2
|
||
fi
|
||
rm /tmp/shprompt$$
|
||
}
|
||
|
||
fatal(){
|
||
echo ""
|
||
echo -e "fatal error: $*"
|
||
echo ""
|
||
echo -e "\t\033[31m\033[1mInstalllation will be interrupted\033[m\033[m"
|
||
echo ""
|
||
exit 1
|
||
}
|
||
|
||
error(){
|
||
echo ""
|
||
echo -e "\t[ \033[31m\033[1mFehler\033[m ]: $*"
|
||
echo ""
|
||
}
|
||
|
||
warn (){
|
||
echo ""
|
||
echo -e "\t[ \033[33m\033[1mWarning\033[m ]: $*"
|
||
echo ""
|
||
}
|
||
|
||
info (){
|
||
echo ""
|
||
echo -e "\t[ \033[32m\033[1mInfo\033[m ]: $*"
|
||
echo ""
|
||
}
|
||
|
||
echo_done() {
|
||
echo -e "\033[80G[ \033[32mdone\033[m ]"
|
||
}
|
||
echo_ok() {
|
||
echo -e "\033[80G[ \033[32mok\033[m ]"
|
||
}
|
||
echo_warning() {
|
||
echo -e "\033[80G[ \033[33m\033[1mwarn\033[m ]"
|
||
}
|
||
echo_failed(){
|
||
echo -e "\033[80G[ \033[1;31mfailed\033[m ]"
|
||
}
|
||
echo_skipped() {
|
||
echo -e "\033[80G[ \033[37mskipped\033[m ]"
|
||
}
|
||
|
||
# iFubction stellt sicher, dass OpenDMARC milter in main.cf gesetzt ist
|
||
# und (falls OpenDKIM vorhanden ist) OpenDMARC direkt nach OpenDKIM folgt.
|
||
#
|
||
# Ziel:
|
||
# - smtpd_milters und non_smtpd_milters enthalten: local:/opendmarc/opendmarc.sock
|
||
# - Falls local:/opendkim/opendkim.sock vorhanden ist:
|
||
# ...opendkim...,local:/opendmarc/opendmarc.sock,...
|
||
#
|
||
# Logik:
|
||
# 1) Aktive Zeile existiert? → anpassen
|
||
# 2) Sonst kommentierte Zeile existiert? → ersetzen (entkommentieren) an derselben Stelle
|
||
# 3) Sonst am Ende hinzufügen
|
||
ensure_dmarc_var() {
|
||
local var="$1"
|
||
|
||
awk -v var="$var" -v dmarc="$opendmarc_socket_string" -v dkim="$opendkim_socket_string" '
|
||
function trim(s) {
|
||
sub("^[[:space:]]+", "", s)
|
||
sub("[[:space:]]+$", "", s)
|
||
return s
|
||
}
|
||
|
||
# Normalisiert aktive Werte:
|
||
# - Entfernt vorhandenes dmarc (um Duplikate zu verhindern)
|
||
# - Fügt dmarc wieder ein:
|
||
# - direkt nach dkim, falls dkim vorhanden
|
||
# - sonst ans Ende (oder allein, wenn leer)
|
||
function normalize_active_value(v, n,i,t,has_dkim,out,newn) {
|
||
v = trim(v)
|
||
if (v == "") return dmarc
|
||
|
||
# split an Komma, trimmen, DMARC entfernen
|
||
n = split(v, a, ",")
|
||
has_dkim = 0
|
||
newn = 0
|
||
|
||
for (i=1; i<=n; i++) {
|
||
t = trim(a[i])
|
||
if (t == "") continue
|
||
if (t == dmarc) continue # Duplikate vermeiden
|
||
a[++newn] = t
|
||
if (t == dkim) has_dkim = 1
|
||
}
|
||
n = newn
|
||
|
||
out = ""
|
||
|
||
if (has_dkim) {
|
||
# Ausgabe bauen und DMARC direkt nach DKIM einfügen
|
||
for (i=1; i<=n; i++) {
|
||
if (out != "") out = out ","
|
||
out = out a[i]
|
||
if (a[i] == dkim) {
|
||
out = out "," dmarc
|
||
}
|
||
}
|
||
return out
|
||
}
|
||
|
||
# kein DKIM: DMARC ans Ende anhängen
|
||
for (i=1; i<=n; i++) {
|
||
if (out != "") out = out ","
|
||
out = out a[i]
|
||
}
|
||
if (out == "") return dmarc
|
||
return out "," dmarc
|
||
}
|
||
|
||
BEGIN { found_active=0; replaced_commented=0 }
|
||
|
||
#################################################################
|
||
# FALL 1: Aktive Zeile (nicht auskommentiert): var =
|
||
#################################################################
|
||
$0 ~ "^[[:space:]]*"var"[[:space:]]*=" && $0 !~ "^[[:space:]]*#" {
|
||
found_active=1
|
||
|
||
v=$0
|
||
sub("^[[:space:]]*"var"[[:space:]]*=[[:space:]]*", "", v)
|
||
|
||
print var" = " normalize_active_value(v)
|
||
next
|
||
}
|
||
|
||
#################################################################
|
||
# FALL 2: Auskommentierte Zeile: # var =
|
||
# Sonderregel: ersetzen mit NUR DMARC, unabhängig vom Kommentarinhalt
|
||
#################################################################
|
||
$0 ~ "^[[:space:]]*#[[:space:]]*"var"[[:space:]]*=" \
|
||
&& found_active==0 && replaced_commented==0 {
|
||
replaced_commented=1
|
||
print var" = " dmarc
|
||
next
|
||
}
|
||
|
||
#################################################################
|
||
# Sonst: Zeile unverändert ausgeben
|
||
#################################################################
|
||
{ print }
|
||
|
||
#################################################################
|
||
# FALL 3: Variable nicht vorhanden → am Ende hinzufügen
|
||
#################################################################
|
||
END {
|
||
if (found_active==0 && replaced_commented==0) {
|
||
print var" = " dmarc
|
||
}
|
||
}
|
||
' "$main_cf_file"
|
||
}
|
||
|
||
|
||
# -------------
|
||
# - Some pre-installation tasks
|
||
# -------------
|
||
|
||
# - Is 'systemd' supported on this system
|
||
# -
|
||
SYSTEMD_EXISTS=false
|
||
systemd=$(which systemd)
|
||
systemctl=$(which systemctl)
|
||
|
||
if [[ -n "$systemd" ]] || [[ -n "$systemctl" ]] ; then
|
||
SYSTEMD_EXISTS=true
|
||
fi
|
||
|
||
|
||
|
||
# =============
|
||
# - Start Installation
|
||
# =============
|
||
|
||
echo ""
|
||
|
||
# - Synchronise package index files with the repository
|
||
# -
|
||
echononl " Synchronise package index files with the repository.."
|
||
apt-get update > "$log_file" 2>&1
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
|
||
|
||
# - Install opendmarc
|
||
# -
|
||
echononl " Install needed debian packages.."
|
||
opendmarc_packages=""
|
||
packages_installed=false
|
||
for _pkg in $_opendmarc_packages ; do
|
||
if aptitude search "$_pkg" | grep " $_pkg " | grep -e "^i" > /dev/null 2>&1 ; then
|
||
continue
|
||
else
|
||
opendmarc_packages="$opendmarc_packages $_pkg"
|
||
fi
|
||
done
|
||
if [[ -n "$opendmarc_packages" ]]; then
|
||
DEBIAN_FRONTEND=noninteractive apt-get -y install $opendmarc_packages > /dev/null 2> "$log_file"
|
||
packages_installed=true
|
||
opendmarc_needs_restart=true
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
echo_skipped
|
||
fi
|
||
|
||
|
||
# - Add user 'postfix' to group 'opendmarc'
|
||
# -
|
||
echononl " Add user 'postfix' to group 'opendmarc'.."
|
||
if grep -E "^opendmarc" /etc/group | grep -q postfix 2> /dev/null ; then
|
||
echo_skipped
|
||
else
|
||
usermod -a -G opendmarc postfix > "$log_file" 2>&1
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
fi
|
||
|
||
|
||
# - Add 'IgnoreHosts' with default value to the original opendmarc.conf file
|
||
#
|
||
echononl " Add 'IgnoreHosts' with default value to the opendmarc.conf file.."
|
||
if ! $(grep -q -E "^IgnoreHosts\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
|
||
cat << EOF >> ${opendmarc_conf_file}
|
||
|
||
## IgnoreHosts (string)
|
||
##
|
||
## Specifies the path to a file that contains a list of hostnames, IP addresses,
|
||
## and/or CIDR expressions identifying hosts whose SMTP connections are to be
|
||
## ignored by the filter. If not specified, defaults to "127.0.0.1" only.
|
||
#
|
||
IgnoreHosts /etc/opendmarc/ignore.hosts
|
||
EOF
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
echo_skipped
|
||
fi
|
||
|
||
|
||
# - Add 'IgnoreMailFrom' with default value to the original opendmarc.conf file
|
||
#
|
||
echononl " Add 'IgnoreMailFrom' with default value to the opendmarc.conf file.."
|
||
if ! $(grep -q -E "^IgnoreMailFrom\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
|
||
cat << EOF >> ${opendmarc_conf_file}
|
||
|
||
## IgnoreMailFrom (string)
|
||
##
|
||
## Gives a list of domain names whose mail (based on the From: domain)
|
||
## is to be ignored by the filter. The list should be comma-separated.
|
||
## Matching against this list is case-insensitive. The default is an
|
||
## empty list, meaning no mail is ignored.
|
||
#
|
||
IgnoreMailFrom /etc/opendmarc/ignore.mailfrom
|
||
EOF
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
echo_skipped
|
||
fi
|
||
|
||
|
||
# - Add 'IgnoreAuthenticatedClients' with default value to the original opendmarc.conf file
|
||
#
|
||
_param="IgnoreAuthenticatedClients"
|
||
echononl " Add '${_param}' with default value to the opendmarc.conf file.."
|
||
if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
|
||
cat << EOF >> ${opendmarc_conf_file}
|
||
|
||
## IgnoreAuthenticatedClients (Boolean)
|
||
##
|
||
## If set, causes mail from authenticated clients (i.e., those that used
|
||
## SMTP AUTH) to be ignored by the filter. The default is "false".
|
||
#
|
||
IgnoreAuthenticatedClients true
|
||
EOF
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
echo_skipped
|
||
fi
|
||
|
||
|
||
# - Add 'TrustedAuthservIDs' with default value to the original opendmarc.conf file
|
||
#
|
||
_param="TrustedAuthservIDs"
|
||
echononl " Add '${_param}' with default value to the opendmarc.conf file.."
|
||
if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
|
||
cat << EOF >> ${opendmarc_conf_file}
|
||
|
||
# Provides a list of authserv-ids that are to be used to identify Authentication-Results
|
||
# header fields whose contents are to be assumed as valid input for the DMARC assessment.
|
||
# To provide a list, separate values by commas. If the string "HOSTNAME" is provided,
|
||
# the name of the host running the filter (as returned by the gethostname(3) function)
|
||
# will be used. Matching against this list is case-insensitive. The default is to use the
|
||
# value of AuthservID.
|
||
#
|
||
TrustedAuthservIDs HOSTNAME
|
||
EOF
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
echo_skipped
|
||
fi
|
||
|
||
|
||
# - Add 'RequiredHeaders' with default value to the original opendmarc.conf file
|
||
#
|
||
_param="RequiredHeaders"
|
||
echononl " Add '${_param}' with default value to the opendmarc.conf file.."
|
||
if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
|
||
cat << EOF >> ${opendmarc_conf_file}
|
||
|
||
## RequiredHeaders (Boolean)
|
||
##
|
||
## If set, the filter will ensure the header of the message conforms to the basic
|
||
## header field count restrictions laid out in RFC5322, Section 3.6. Messages
|
||
## failing this test are rejected without further processing. A From: field from
|
||
## which no domain name could be extracted will also be rejected.
|
||
#
|
||
RequiredHeaders false
|
||
EOF
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
echo_skipped
|
||
fi
|
||
|
||
|
||
# - Add 'AutoRestart' with default value to the original opendmarc.conf file
|
||
#
|
||
_param="AutoRestart"
|
||
echononl " Add '${_param}' with default value to the opendmarc.conf file.."
|
||
if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
|
||
cat << EOF >> ${opendmarc_conf_file}
|
||
|
||
## AutoRestart (Boolean)
|
||
##
|
||
## Automatically re-start on failures. Use with caution; if the filter fails
|
||
## instantly after it starts, this can cause a tight fork(2) loop.
|
||
#
|
||
AutoRestart true
|
||
EOF
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
echo_skipped
|
||
fi
|
||
|
||
|
||
# - Do not use 'HistoryFile': see the note at the parameter list on top of this
|
||
# - script. Comment out an active setting, e.g. left over from a previous version
|
||
# - of this script.
|
||
#
|
||
_param="HistoryFile"
|
||
echononl " Deactivate '${_param}' in the opendmarc.conf file.."
|
||
if grep -q -E "^\s*${_param}\s+" ${opendmarc_conf_file} 2> /dev/null ; then
|
||
perl -i -p -e 's/^(\s*HistoryFile\s)/#$1/' ${opendmarc_conf_file} > "$log_file" 2>&1
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
opendmarc_needs_restart=true
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
echo_skipped
|
||
fi
|
||
|
||
|
||
# - Add 'SPFIgnoreResults' with default value to the original opendmarc.conf file
|
||
#
|
||
_param="SPFIgnoreResults"
|
||
echononl " Add '${_param}' with default value to the opendmarc.conf file.."
|
||
if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
|
||
cat << EOF >> ${opendmarc_conf_file}
|
||
|
||
## Causes the filter to ignore any SPF results in the header of the message. This
|
||
## is useful if you want the filter to perform SPF checks itself, or because you
|
||
## don't trust the arriving header. The default is "false".
|
||
#
|
||
SPFIgnoreResults true
|
||
EOF
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
echo_skipped
|
||
fi
|
||
|
||
|
||
# - Add 'SPFSelfValidate' with default value to the original opendmarc.conf file
|
||
#
|
||
_param="SPFSelfValidate"
|
||
echononl " Add '${_param}' with default value to the opendmarc.conf file.."
|
||
if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
|
||
cat << EOF >> ${opendmarc_conf_file}
|
||
|
||
## Causes the filter to perform a fallback SPF check itself when it can find no
|
||
## SPF results in the message header. If SPFIgnoreResults is also set, it never
|
||
## looks for SPF results in headers and always performs the SPF check itself when
|
||
## this is set. The default is "false".
|
||
#
|
||
SPFSelfValidate true
|
||
EOF
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
echo_skipped
|
||
fi
|
||
|
||
|
||
# - Add 'PublicSuffixList' with default value to the original opendmarc.conf file
|
||
#
|
||
_param="PublicSuffixList"
|
||
echononl " Add '${_param}' with default value to the opendmarc.conf file.."
|
||
if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
|
||
cat << EOF >> ${opendmarc_conf_file}
|
||
|
||
## PublicSuffixList (string)
|
||
##
|
||
## Specifies the path to a file that contains top-level domains (TLDs) that
|
||
## will be used to compute the Organizational Domain for a given domain name,
|
||
## as described in the DMARC specification. If not provided, the filter will
|
||
## not be able to determine the Organizational Domain and only the presented
|
||
## domain will be evaluated.
|
||
#
|
||
PublicSuffixList /usr/share/publicsuffix/public_suffix_list.dat
|
||
EOF
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
echo_skipped
|
||
fi
|
||
|
||
|
||
# - Add 'UserID' with default value to the original opendmarc.conf file
|
||
#
|
||
_param="UserID"
|
||
echononl " Add '${_param}' with default value to the opendmarc.conf file.."
|
||
if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
|
||
cat << EOF >> ${opendmarc_conf_file}
|
||
|
||
## UserID (string)
|
||
##
|
||
## Attempts to become the specified userid before starting operations.
|
||
## The process will be assigned all of the groups and primary group ID of
|
||
## the named userid unless an alternate group is specified.
|
||
#
|
||
UserID opendmarc
|
||
EOF
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
echo_skipped
|
||
fi
|
||
|
||
|
||
# - Save configuration file from distribution
|
||
# -
|
||
echononl " Save configuration file from distribution"
|
||
if [[ -f "${opendmarc_conf_file}.ORIG" ]] ; then
|
||
echo_skipped
|
||
else
|
||
cp -a $opendmarc_conf_file $opendmarc_conf_file.ORIG 2> "$log_file"
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
fi
|
||
|
||
for _val in "${config_file_name_value_parameter_arr[@]}" ; do
|
||
IFS='|' read -a _val_arr <<< "${_val}"
|
||
|
||
echononl " $opendmarc_conf_file: ${_val_arr[0]} -> ${_val_arr[1]}.."
|
||
if $(grep -E -q "^\s*${_val_arr[0]}\s+${_val_arr[1]}\s*$" $opendmarc_conf_file 2> /dev/null) ; then
|
||
echo_skipped
|
||
elif $(grep -E -q "^\s*${_val_arr[0]}\s+" $opendmarc_conf_file 2> /dev/null) ; then
|
||
perl -i -n -p -e "s#^(\s*${_val_arr[0]}.*)#\#\1\n${_val_arr[0]} ${_val_arr[1]}#" $opendmarc_conf_file > "$log_file" 2>&1
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
opendmarc_needs_restart=true
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
elif $(grep -E -q "^\s*#\s*${_val_arr[0]}\s+" $opendmarc_conf_file 2> /dev/null); then
|
||
perl -i -n -p -e "s&^(\s*#\s*${_val_arr[0]}.*)&\1\n${_val_arr[0]} ${_val_arr[1]}&" $opendmarc_conf_file > "$log_file" 2>&1
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
opendmarc_needs_restart=true
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
if [[ "${_val_arr[0]}" == "IgnoreHosts" ]]; then
|
||
cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
|
||
|
||
## IgnoreHosts (string)
|
||
##
|
||
## Specifies the path to a file that contains a list of hostnames, IP
|
||
## addresses, and/or CIDR expressions identifying hosts whose SMTP
|
||
## connections are to be ignored by the filter. If not specified,
|
||
## defaults to "127.0.0.1" only.
|
||
#
|
||
${_val_arr[0]} ${_val_arr[1]}
|
||
EOF
|
||
elif [[ "${_val_arr[0]}" == "IgnoreMailFrom" ]]; then
|
||
cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
|
||
|
||
## IgnoreMailFrom (string)
|
||
##
|
||
## Gives a list of domain names whose mail (based on the From: domain)
|
||
## is to be ignored by the filter. The list should be comma-separated.
|
||
## Matching against this list is case-insensitive. The default is an
|
||
## empty list, meaning no mail is ignored.
|
||
#
|
||
${_val_arr[0]} ${_val_arr[1]}
|
||
EOF
|
||
elif [[ "${_val_arr[0]}" == "IgnoreAuthenticatedClients" ]]; then
|
||
cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
|
||
|
||
## IgnoreAuthenticatedClients (Boolean)
|
||
##
|
||
## If set, causes mail from authenticated clients (i.e., those that used
|
||
## SMTP AUTH) to be ignored by the filter. The default is "false".
|
||
#
|
||
${_val_arr[0]} ${_val_arr[1]}
|
||
EOF
|
||
elif [[ "${_val_arr[0]}" == "AutoRestart" ]]; then
|
||
cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
|
||
## AutoRestart (Boolean)
|
||
##
|
||
## Automatically re-start on failures. Use with caution; if the filter
|
||
## fails instantly after it starts, this can cause a tight fork(2)
|
||
## loop.
|
||
#
|
||
${_val_arr[0]} ${_val_arr[1]}
|
||
EOF
|
||
elif [[ "${_val_arr[0]}" == "RequiredHeaders" ]]; then
|
||
cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
|
||
|
||
## RequiredHeaders (Boolean)
|
||
##
|
||
## If set, the filter will ensure the header of the message conforms to
|
||
## the basic header field count restrictions laid out in RFC5322,
|
||
## Section 3.6. Messages failing this test are rejected without further
|
||
## processing. A From: field from which no domain name could be
|
||
## extracted will also be rejected.
|
||
#
|
||
${_val_arr[0]} ${_val_arr[1]}
|
||
EOF
|
||
elif [[ "${_val_arr[0]}" == "SPFSelfValidate" ]]; then
|
||
cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
|
||
## SPFSelfValidate (Boolean)
|
||
##
|
||
## Causes the filter to perform a fallback SPF check itself when it can
|
||
## find no SPF results in the message header. If SPFIgnoreResults is
|
||
## also set, it never looks for SPF results in headers and always
|
||
## performs the SPF check itself when this is set. The default is
|
||
## "false".
|
||
#
|
||
${_val_arr[0]} ${_val_arr[1]}
|
||
EOF
|
||
elif [[ "${_val_arr[0]}" == "SPFIgnoreResults" ]]; then
|
||
cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
|
||
## SPFIgnoreResults (Boolean)
|
||
##
|
||
## Causes the filter to ignore any SPF results in the header of the
|
||
## message. This is useful if you want the filter to perform SPF checks
|
||
## itself, or because you don't trust the arriving header. The default
|
||
## is "false".
|
||
#
|
||
${_val_arr[0]} ${_val_arr[1]}
|
||
EOF
|
||
else
|
||
cat <<EOF >> $opendmarc_conf_file 2> "$log_file"
|
||
|
||
${_val_arr[0]} ${_val_arr[1]}
|
||
EOF
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
opendmarc_needs_restart=true
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
fi
|
||
fi
|
||
done
|
||
|
||
|
||
# - Assign ownership to the opendmarc user and restrict tthe
|
||
# - file permissions:
|
||
# -
|
||
echononl " Assign file permissions to '$opendmarc_conf_file'.."
|
||
chmod u=rw,go=r $opendmarc_conf_file 2> $log_file
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
|
||
|
||
# - Create the directories to hold opendmarc's data files, assign
|
||
# - ownership to the opendmarc user, and restrict the file
|
||
# - permissions:
|
||
# -
|
||
echononl " Create directory '$opendmarc_base_dir'"
|
||
if [[ -d "$opendmarc_base_dir" ]] ; then
|
||
echo_skipped
|
||
else
|
||
opendmarc_needs_restart=true
|
||
mkdir ${opendmarc_base_dir} 2> $log_file
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
fi
|
||
echononl " Set ownership on directory '${opendmarc_base_dir}' (recursive).."
|
||
chown -R opendmarc:opendmarc ${opendmarc_base_dir} 2> $log_file
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
|
||
|
||
echononl " Backup existing file '${opendmarc_base_dir}/ignore.hosts'.."
|
||
if [[ -f "${opendmarc_base_dir}/ignore.hosts" ]] ; then
|
||
mv "${opendmarc_base_dir}/ignore.hosts" "${opendmarc_base_dir}/ignore.hosts.${backup_date}"
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
echo_skipped
|
||
fi
|
||
|
||
# - Create the file ${opendmarc_base_dir}/ignore.hosts
|
||
# -
|
||
echononl " Create file '${opendmarc_base_dir}/ignore.hosts'.."
|
||
if [[ -f "${opendmarc_base_dir}/ignore.hosts" ]] ; then
|
||
echo_skipped
|
||
else
|
||
cat <<EOF > ${opendmarc_base_dir}/ignore.hosts 2> $log_file
|
||
# /etc/opendmarc/ignore.hosts
|
||
#
|
||
# OpenDMARC haengt als Milter an den SMTP-Diensten von Postfix
|
||
# (smtpd_milters in main.cf), also vor Amavis. Er sieht dort die
|
||
# echte Client-IP. An 'localhost:10025' laeuft kein Milter.
|
||
#
|
||
# Eingetragene Hostnamen, IP-Adressen oder CIDR-Netze werden von
|
||
# OpenDMARC nicht geprueft. Ein Eintrag wirkt also tatsaechlich:
|
||
# fuer solche Clients werden DMARC-Richtlinien nicht durchgesetzt.
|
||
#
|
||
# Eigene Listen- und Relay-Server gehoeren nicht hierher: sie werden
|
||
# mit /etc/postfix/smtpd_milter_map von allen Miltern ausgenommen.
|
||
#
|
||
# ==> Datei bleibt absichtlich leer, solange keine Ausnahme noetig ist.
|
||
EOF
|
||
opendmarc_needs_restart=true
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
fi
|
||
|
||
|
||
# - Create the file ${opendmarc_base_dir}/ignore.hosts
|
||
# -
|
||
|
||
echononl " Backup existing file '${opendmarc_base_dir}/ignore.mailfrom'.."
|
||
if [[ -f "${opendmarc_base_dir}/ignore.mailfrom" ]] ; then
|
||
mv "${opendmarc_base_dir}/ignore.mailfrom" "${opendmarc_base_dir}/ignore.mailfrom.${backup_date}"
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
echo_skipped
|
||
fi
|
||
|
||
echononl " Create file '${opendmarc_base_dir}/ignore.mailfrom'.."
|
||
if [[ -f "${opendmarc_base_dir}/ignore.mailfrom" ]] ; then
|
||
echo_skipped
|
||
else
|
||
cat <<EOF > ${opendmarc_base_dir}/ignore.mailfrom 2> $log_file
|
||
# /etc/opendmarc/ignore.mailfrom
|
||
#
|
||
# Hier könnte man Absender-Domains von der DMARC-Prüfung
|
||
# ausnehmen (z. B. problematische Partner-Domains).
|
||
#
|
||
# Aktuell ist das für dein Setup nicht notwendig.
|
||
#
|
||
# Beispiele (NICHT aktiv!):
|
||
# @example.org
|
||
# example.org
|
||
#
|
||
# ==> Datei bleibt absichtlich leer.
|
||
EOF
|
||
opendmarc_needs_restart=true
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
fi
|
||
|
||
|
||
# - Edit /etc/default/opendmarc
|
||
# -
|
||
# - Set:
|
||
# - SOCKET="local:${postfix_spool_dir}/opendmarc/opendmarc.sock"
|
||
# -
|
||
echononl " Set 'SOCKET' at file /etc/default/opendmarc.."
|
||
if grep -q -E "^\s*SOCKET" /etc/default/opendmarc 2>/dev/null ; then
|
||
if grep -q -E "^\s*SOCKET\s*=\s*\"*local:$opendmarc_socket_file" /etc/default/opendmarc 2>/dev/null ; then
|
||
echo_skipped
|
||
else
|
||
perl -i -n -p -e "s#^\s*SOCKET=.*#SOCKET=\"local:$opendmarc_socket_file\"#" /etc/default/opendmarc 2> $log_file
|
||
opendmarc_needs_restart=true
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
fi
|
||
else
|
||
cat <<EOF >>/etc/default/opendmarc 2> $log_file
|
||
SOCKET="local:$opendmarc_socket_file"
|
||
EOF
|
||
opendmarc_needs_restart=true
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
fi
|
||
|
||
|
||
# - Create the opendmarc socket directory in Postfix’s work area
|
||
# - and make sure it has the correct ownership:
|
||
# -
|
||
echononl " Create the opendmarc socket directory in Postfix's work area.."
|
||
if [[ -d "${postfix_spool_dir}/opendmarc" ]] ; then
|
||
echo_skipped
|
||
else
|
||
mkdir ${postfix_spool_dir}/opendmarc 2> $log_file
|
||
opendmarc_needs_restart=true
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
echononl " Set ownership on directory '${postfix_spool_dir}/opendmarc'.."
|
||
chown opendmarc:postfix ${postfix_spool_dir}/opendmarc 2> $log_file
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
fi
|
||
|
||
|
||
# - Edit /etc/postfix/main.cf and add a section to activate
|
||
# - processing of e-mail through the opendmarc daemon:
|
||
# -
|
||
echononl " Backup existing postfix configuration (main.cf).."
|
||
cp -a /etc/postfix/main.cf /etc/postfix/main.cf.$backup_date 2> $log_file
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
|
||
#echononl " Set Variable non_smtpd_milters at '/etc/postfix/main.cf'.."
|
||
#if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*opendkim.sock" /etc/postfix/main.cf 2> /dev/null) ; then
|
||
# if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*$(basename "${opendmarc_socket_file}")" /etc/postfix/main.cf); then
|
||
# echo_skipped
|
||
# else
|
||
# perl -i -n -p -e "s&^\s*(non_smtpd_milters\s*=.*opendkim.sock)&\1,local:/$(basename "${opendmarc_socket_dir}")/$(basename "${opendmarc_socket_file}")&" \
|
||
# /etc/postfix/main.cf > $log_file 2>&1
|
||
# if [[ $? -eq 0 ]] ; then
|
||
# echo_ok
|
||
# postfix_needs_restart=true
|
||
# else
|
||
# echo_failed
|
||
# error "$(cat $log_file)"
|
||
# fi
|
||
# fi
|
||
#else
|
||
#
|
||
# echo_skipped
|
||
# warn "non_smtpd_milters is not adjusted. Complete Postfix configuration (main.cf) manually\!"
|
||
#fi
|
||
|
||
|
||
echononl " Set Variable smtpd_milters at '/etc/postfix/main.cf'.."
|
||
if $(grep -q -E "^\s*smtpd_milters\s*=\s*.*opendkim.sock" /etc/postfix/main.cf 2> /dev/null) ; then
|
||
if $(grep -q -E "^\s*smtpd_milters\s*=\s*.*$(basename "${opendmarc_socket_file}")" /etc/postfix/main.cf); then
|
||
echo_skipped
|
||
else
|
||
perl -i -n -p -e "s&^\s*(smtpd_milters\s*=.*opendkim.sock)&\1,local:/$(basename "${opendmarc_socket_dir}")/$(basename "${opendmarc_socket_file}")&" \
|
||
/etc/postfix/main.cf > $log_file 2>&1
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
postfix_needs_restart=true
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
fi
|
||
else
|
||
echo_skipped
|
||
warn "smtpd_milters was not adjusted. Complete Postfix configuration (main.cf) manually\!"
|
||
fi
|
||
|
||
|
||
echo ""
|
||
|
||
|
||
# - Edit /etc/postfix/main.cf and add a section to activate
|
||
# - processing of e-mail through the OpenDKIM daemon:
|
||
# -
|
||
backup_date="$(date +%Y-%m-%d-%H%M)"
|
||
echononl " Backup existing postfix configuration (main.cf).."
|
||
cp -a /etc/postfix/main.cf /etc/postfix/main.cf.$backup_date 2> $log_file
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
|
||
echononl " Activate processing of e-mail through the OpenDMARC daemon.."
|
||
if grep -q -E "^\s*#?\s*smtpd_milters\s*=" ${main_cf_file} ; then
|
||
|
||
ensure_dmarc_var "smtpd_milters" > "${tmp_main_cf_file}"
|
||
cp "${tmp_main_cf_file}" "${main_cf_file}"
|
||
|
||
else
|
||
|
||
cat <<EOF >> /etc/postfix/main.cf 2> $log_file
|
||
|
||
|
||
# ======= Milter configuration =======
|
||
|
||
# OpenDKIM
|
||
|
||
milter_default_action = accept
|
||
|
||
# Postfix ≥ 2.6 milter_protocol = 6, Postfix ≤ 2.5 milter_protocol = 2
|
||
milter_protocol = 6
|
||
|
||
# Note:
|
||
# We will sign AFTER sending through AmaVIS, just befor sending out. So
|
||
# set 'smtpd_milters =' to an emty string here and add to localhost:10025
|
||
# section in master.cf: 'smtpd_milters=local:/opendkim/opendkim.sock'
|
||
#
|
||
# If you want sign mails before sending through AmaVIS, set
|
||
# 'smtpd_milters = local:/opendkim/opendkim.sock' here and add to
|
||
# localhost:10025 section in master.cf: 'smtpd_milters='
|
||
#
|
||
smtpd_milters = $opendmarc_socket_string
|
||
EOF
|
||
|
||
fi
|
||
|
||
|
||
#if grep -q -E "^\s*#?\s*non_smtpd_milters\s*=" ${main_cf_file} ; then
|
||
#
|
||
# ensure_dmarc_var "non_smtpd_milters" > "${tmp_main_cf_file}"
|
||
# cp "${tmp_main_cf_file}" "${main_cf_file}"
|
||
#
|
||
#else
|
||
#
|
||
# cat <<EOF >> /etc/postfix/main.cf 2> $log_file
|
||
#
|
||
## Was sind non_smtpd_milters?
|
||
##
|
||
## non_smtpd_milters gilt für alle Postfix-Prozesse, die Mails verarbeiten, aber NICHT
|
||
## der smtpd-Daemon sind.
|
||
##
|
||
## Das betrifft z. B.:
|
||
##
|
||
## cleanup Header/Content-Bereinigung
|
||
## qmgr Queue-Manager
|
||
## lmtp / smtp Auslieferung nach extern
|
||
## local lokale Zustellung
|
||
##
|
||
## Das sind z. B.:
|
||
##
|
||
## - interne Bounces (MAILER-DAEMON)
|
||
##
|
||
## - Cron-Mails vom Server
|
||
##
|
||
## - Weiterleitungen, die Postfix selbst generiert
|
||
##
|
||
## - Mails, die über sendmail CLI gesendet werden
|
||
##
|
||
## - Mails, die Amavis über LMTP zurückgibt
|
||
##
|
||
## - etc.
|
||
##
|
||
##
|
||
## DKIM soll auch die ausgehenden Mails signieren, die nicht über smtpd daemon versendet werden.
|
||
#non_smtpd_milters = $opendmarc_socket_string
|
||
#EOF
|
||
#fi
|
||
#postfix_needs_restart=true
|
||
#if [[ $? -eq 0 ]] ; then
|
||
# echo_ok
|
||
#else
|
||
# echo_failed
|
||
# error "$(cat $log_file)"
|
||
#fi
|
||
|
||
|
||
echo ""
|
||
|
||
echononl " Enable OpenDMARC Service"
|
||
if $SYSTEMD_EXISTS ; then
|
||
systemctl enable opendmarc > $log_file 2>&1
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
warn "Maybe OpenDMARC Service is not enabled, because its an old non-systemd os.."
|
||
fi
|
||
|
||
# - Restart opendmarc
|
||
# -
|
||
echononl " Restart opendmarc.."
|
||
if $opendmarc_needs_restart ; then
|
||
if $SYSTEMD_EXISTS ; then
|
||
systemctl restart opendmarc > $log_file 2>&1
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
/etc/init.d/opendmarc restart > $log_file 2>&1
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
fi
|
||
else
|
||
echo_skipped
|
||
fi
|
||
|
||
|
||
# - Restart Postfix so it starts using opendmarc when processing mail:
|
||
# -
|
||
echononl " Restart Postfix.."
|
||
if $postfix_needs_restart ; then
|
||
if $SYSTEMD_EXISTS ; then
|
||
systemctl restart postfix > $log_file 2>&1
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
else
|
||
/etc/init.d/postfix restart > $log_file 2>&1
|
||
if [[ $? -eq 0 ]] ; then
|
||
echo_ok
|
||
else
|
||
echo_failed
|
||
error "$(cat $log_file)"
|
||
fi
|
||
fi
|
||
else
|
||
echo_skipped
|
||
fi
|
||
|
||
|
||
echo ""
|
||
rm -f "$log_file"
|
||
exit 0
|