mailsystem/install_postfix_base.sh

#!/usr/bin/env bash

_TLS_CERT_DIR=/etc/postfix/ssl
_TLS_CERT_FILE="${_TLS_CERT_DIR}/mailserver.crt"
_TLS_KEY_FILE="${_TLS_CERT_DIR}/mailserver.key"
#
_TLS_CA_FILE=/etc/ssl/certs/ca-certificates.crt
#
#
#_HOSTNAME=o15.oopen.de
#_IPV4=83.223.86.96
#_EXT_IF_IP=83.223.86.96
#
### - Leave empty, if no IPv6 should be supported
### -
#_IPV6=2a01:30:0:13:5054:ff:fe09:2318
##_IPV6=
#
#_ADMIN_EMAIL=admin@oopen.de
#
#_SASL_AUTH=false
#_RELAY_HOST=b.mx.oopen.de
#_SASL_USER=anw-urb
#_SASL_PASS='OhPie2aethei'


# -------------
# --- Some functions
# -------------
echononl(){
   echo X\\c > /tmp/shprompt$$
   if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
      echo -e -n "$*\\c" 1>&2
   else
       echo -e -n "$*" 1>&2
   fi
   rm /tmp/shprompt$$
}

fatal(){
   echo ""
   echo -e "fatal error: $*"
   echo ""
   echo -e "\t\033[31m\033[1mInstalllation will be interrupted\033[m\033[m"
   echo ""
   exit 1
}

error(){
   echo ""
   echo -e "\t[ \033[31m\033[1mFehler\033[m ]: $*"
   echo ""
}

warn (){
   echo ""
   echo -e "\t[ \033[33m\033[1mWarning\033[m ]: $*"
   echo ""
}

info (){
   echo ""
   echo -e "\t[ \033[32m\033[1mInfo\033[m ]: $*"
   echo ""
}

echo_done() {
   echo -e "\033[80G[ \033[32mdone\033[m ]"
}
echo_ok() {
   echo -e "\033[80G[ \033[32mok\033[m ]"
}
echo_warning() {
   echo -e "\033[80G[ \033[33m\033[1mwarn\033[m ]"
}
echo_failed(){
   echo -e "\033[80G[ \033[1;31mfailed\033[m ]"
}
echo_skipped() {
   echo -e "\033[80G[ \033[33m\033[1mskipped\033[m ]"
}


# - Is this a systemd system?
# -
if [[ "X`which systemd`" = "X" ]]; then
   systemd_exists=false
else
   systemd_exists=true
fi

echo ""

conf_dir=$(dirname $0)/conf
conf_file="${conf_dir}/install_postfix_base.conf"

if [[ -f "$conf_file" ]]; then
   source $conf_file
fi

clear
echo -e "\033[21G\033[32mInstallation script for Postfix basic mailsystem \033[m"
echo

HOSTNAME=
echo ""
echo -e "\033[32m--\033[m"
echo ""
echo "Insert hostname"
echo ""
if [[ -n "$_HOSTNAME" ]]; then
   echononl "hostname [${_HOSTNAME}]: "
   read HOSTNAME
   if [[ "X${HOSTNAME}" = "X" ]]; then
      HOSTNAME=$_HOSTNAME
   fi
else
   while [[ "X${HOSTNAME}" = "X" ]]; do
      echononl "hostname: "
      read HOSTNAME
      if [[ "X${HOSTNAME}" = "X" ]]; then
         echo -e "\n\t\033[33m\033[1mHostname is reqired\033[m\n"
      fi
   done
fi

IPV4=
echo ""
echo -e "\033[32m--\033[m"
echo ""
echo "Insert IPv4 address"
echo ""
if [[ -n "$_IPV4" ]]; then
   echononl "IPv4 address [${_IPV4}]: "
   read IPV4
   if [[ "X${IPV4}" = "X" ]]; then
      IPV4=$_IPV4
   fi
else
   while [[ "X${IPV4}" = "X" ]]; do
      echononl "IPv4 address: "
      read IPV4
      if [[ "X${IPV4}" = "X" ]]; then
         echo -e "\n\t\033[33m\033[1mIPv4 address is reqired\033[m\n"
      fi
   done
fi
IPV6=
echo ""
echo -e "\033[32m--\033[m"
echo ""
echo "Insert IPv6 address"
echo "Type:"
echo -e "\t\033[33mNone\033[m   if IPv6 is not suppoerted"
echo ""
if [[ -n "$_IPV6" ]]; then
   [[ "X$_IPV6" = "Xdisabled" ]] && _IPV6=None
   echononl "IPv6 address [${_IPV6}]: "
   read IPV6
   if [[ "X${IPV6}" = "X" ]]; then
      IPV6=$_IPV6
   fi
else
   while [[ "X${IPV6}" = "X" ]]; do
      echononl "IPv6 address: "
      read IPV6
      if [[ "X${IPV6}" = "X" ]]; then
         echo -e "\n\t\033[33m\033[1mIPv4 address is reqired\033[m\n"
      fi
   done
fi
if [ "X$IPV6" = "Xnone" -o "X$IPV6" = "XNone" ]; then 
   IPV6=disabled
fi

ADMIN_EMAIL=
echo ""
echo ""
echo -e "\033[32m--\033[m"
echo ""
echo "Insert e-mail address where messages to local root should be forwarded"
echo ""
echo ""
if [[ -n "$_ADMIN_EMAIL" ]]; then
   echononl "Admin e-mail address [$_ADMIN_EMAIL]: "  
   read ADMIN_EMAIL
   if [[ "X${ADMIN_EMAIL}" = "X" ]]; then
      ADMIN_EMAIL=$_ADMIN_EMAIL
   fi
else
   while [[ "X${ADMIN_EMAIL}" = "X" ]]; do
   echononl "Admin e-mail address: "
   read ADMIN_EMAIL
   if [[ "X${ADMIN_EMAIL}" = "X" ]]; then
       echo -e "\n\t\033[33m\033[1mAdmin e-mail address is reqired\033[m\n"
      fi
   done
fi

SASL_AUTH=
echo ""
echo ""
echo -e "\033[32m--\033[m"
echo ""
echo "Should this System relay mails through another host using sasl auth?"
echo ""
if [[ -n "$_SASL_AUTH" ]]; then
   if $_SASL_AUTH ; then
      echononl "Relay mails using sasl auth? [yes]; "
      read SASL_AUTH
      if [[ "X${SASL_AUTH}" = "X" ]]; then
         SASL_AUTH=true
      else
         SASL_AUTH=${SASL_AUTH,,}
         if [ "X$SASL_AUTH" != "Xyes" -a "X$SASL_AUTH" != "Xno" ]; then
            echononl "Wrong entry {yes/no]: "
         fi
      fi
   else
      echononl "Relay mails using sasl auth? [no]; "
      read SASL_AUTH
      if [[ "X${SASL_AUTH}" = "X" ]]; then
         SASL_AUTH=false
      else
         SASL_AUTH=${SASL_AUTH,,}
         if [ "X$SASL_AUTH" != "Xyes" -a "X$SASL_AUTH" != "Xno" ]; then
            echononl "Wrong entry [yes/no]: "
         fi
      fi
   fi
else
   echononl "Relay mails using sasl auth? (yes/no); "
   while [[ "X${SASL_AUTH}" = "X" ]] ; do
      read SASL_AUTH
      SASL_AUTH=${SASL_AUTH,,}
      if [ "X$SASL_AUTH" != "Xyes" -a "X$SASL_AUTH" != "Xno" ]; then
         SASL_AUTH=
         echononl "Wrong entry [yes/no]: "
      fi
   done
fi
if [[ "$SASL_AUTH" = "yes" ]] || $SASL_AUTH ; then
   SASL_AUTH=true

   SASL_USER=
   echo ""
   echo "Insert SASL user"
   echo ""
   if [[ -n "$_SASL_USER" ]];then
      echononl "SASL user [$_SASL_USER]: "
      read SASL_USER
      if [[ "X${SASL_USER}" = "X" ]]; then
         SASL_USER=$_SASL_USER
      fi
   else
      while [[ "X${SASL_USER}" = "X" ]]; do
         echononl "SASL user: "
         read SASL_USER
         if [[ "X${SASL_USER}" = "X" ]]; then
            echo -e "\n\t\033[33m\033[1mSASL user is reqired\033[m\n"
         fi
      done
   fi

   SASL_PASS=
   echo ""
   echo "Insert SASL pasword"
   echo ""
   if [[ -n "$_SASL_PASS" ]];then
      echononl "SASL password [$_SASL_PASS]: "
      read SASL_PASS
      if [[ "X${SASL_PASS}" = "X" ]]; then
         SASL_PASS=$_SASL_PASS
      fi
   else
      while [[ "X${SASL_PASS}" = "X" ]]; do
         echononl "SASL password: "
         read SASL_PASS
         if [[ "X${SASL_PASS}" = "X" ]]; then
            echo -e "\n\t\033[33m\033[1mSASL password is reqired\033[m\n"
         fi
      done
   fi

   RELAY_HOST=
   echo ""
   echo "Insert Relayhost"
   echo ""
   if [[ -n "$_RELAY_HOST" ]];then
      echononl "Relayhost [$_RELAY_HOST]: "
      read RELAY_HOST
      if [[ "X${RELAY_HOST}" = "X" ]]; then
         RELAY_HOST=$_RELAY_HOST
      fi
   else
      while [[ "X${RELAY_HOST}" = "X" ]]; do
         echononl "Relayhost: "
         read RELAY_HOST
         if [[ "X${RELAY_HOST}" = "X" ]]; then
            echo -e "\n\t\033[33m\033[1mRelayhost is reqired\033[m\n"
         fi
      done
   fi



else
   SASL_AUTH=false
fi


echo ""
echo ""
echo -e "\033[21G\033[32mStart installation/configuration with the following parameters\033[m"
echo ""
echo -e "\tHostname.................: $HOSTNAME"
echo -e "\tIPv4 address.............: $IPV4"
echo -e "\tIPv6 address.............: $IPV6"
echo -e "\tAdmin e-mail.............: $ADMIN_EMAIL"
echo ""
echo -e "\tRelay using sasl auth....: $SASL_AUTH"
if $SASL_AUTH ; then
   echo -e "\t   sasl user.............: $SASL_USER"
   echo -e "\t   sasl password.........: $SASL_PASS"
   echo -e "\t   Relayhost.............: $RELAY_HOST"
fi
echo ""
echononl "einverstanden (yes/no): "
read OK
OK=${OK,,}
while [ "X$OK" != "Xyes" -a "X$OK" != "Xno" ]; do
   echononl "Wrong entry! [yes/no]: "
   read OK
   OK=${OK,,}
done
[ $OK = "yes" ] || fatal Repeat with other settings..

echo ""
echo ""

echononl "   Save Configuration"
cat << EOF > $conf_file
# ---
# - Parameter Settings Postfix Bases System
# -
# -    - automated generated config file - 
# ---

_HOSTNAME=$HOSTNAME
_IPV4=$IPV4
_IPV6=$IPV6
_ADMIN_EMAIL=$ADMIN_EMAIL
_SASL_AUTH=$SASL_AUTH
_SASL_USER=$SASL_USER
_SASL_PASS=$SASL_PASS
_RELAY_HOST=$RELAY_HOST
EOF
if [[ $? -eq 0 ]] ; then
   echo_ok
else
   echo_failed
fi

[[ "$IPV6" = "disabled" ]] && IPV6="" 


# - Synchronise package index files with the repository
# -
echononl "   Synchronise package index files with the repository.."
apt-get update > /dev/null 2>&1
if [[ $? -eq 0 ]] ; then
   echo_ok
else
   echo_failed
fi


# - Deinstall debian exim4 packages
# -
echononl "   Deinstall debian exim4 packages"
_installed_exim_packages=`dpkg -l | grep exim4 | grep -e "^i" | awk '{print$2}'`
for _pkg in $_installed_exim_packages ; do
   installed_exim_packages="$installed_exim_packages $_pkg"
done
if [[ -n "$installed_exim_packages" ]] ; then

   if `dpkg -l | grep bsd-mailx | grep -e "^i" > /dev/null 2>&1` ; then
      installed_exim_packages="$installed_exim_packages bsd-mailx"
   fi

   apt-get remove --purge -qq -y $installed_exim_packages > /dev/null 2>&1
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
   fi
else
   echo_skipped
fi



# - Install Postfix from debian packages system
# -
echononl "   Install Postfix from debian packages system"
_needed_packages="postfix postfix-pcre libsasl2-modules bsd-mailx haveged"
for _pkg in $_needed_packages ; do
   if `dpkg -l | grep $_pkg | grep -e "^i" > /dev/null 2>&1` ; then
      continue
   else
      needed_packages="$needed_packages $_pkg"
   fi
done
if [[ -n "$needed_packages" ]]; then
   DEBIAN_FRONTEND=noninteractive apt-get -y install $needed_packages > /dev/null 2>&1
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
   fi
else
   echo_skipped
fi


# - Backup existing postfix configuration file
# -
echononl "   Backup existing postfix configuration file"
if [[ -f "/etc/postfix/main.cf" ]]; then
   cp -a /etc/postfix/main.cf /etc/postfix/main.cf.`date +%Y%m%d-%H%M`
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
   fi
else
   echo_skipped
fi


# - Creeate new postfix configuration file
# -
echononl "   Creeate new postfix configuration file"
cat <<EOF > /etc/postfix/main.cf
# ============ Basic settings ============

# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname
myorigin = /etc/mailname

smtpd_banner = \$myhostname ESMTP \$mail_name (Debian/GNU)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = /usr/share/doc/postfix
html_directory = /usr/share/doc/postfix/html

## - The Internet protocols Postfix will attempt to use when making 
## - or accepting connections.
## - DEFAULT: ipv4
EOF

if [ -n "$IPV6" ]; then
   cat <<EOF >> /etc/postfix/main.cf
inet_protocols = ipv4, ipv6

#inet_interfaces = all

inet_interfaces = 
   127.0.0.1
   ::1
   #$IPV4
   #$IPV6

myhostname = $HOSTNAME

mydestination = 
   $HOSTNAME
   localhost

## - The list of "trusted" SMTP clients that have more 
## - privileges than "strangers"
## -
mynetworks = 
   127.0.0.0/8
   [::ffff:127.0.0.0]/104
   [::1]/128
   ${IPV4}/32
   [${IPV6}]/128

#smtp_bind_address = $IPV4
#smtp_bind_address6 = $IPV6

EOF
else
   cat <<EOF >> /etc/postfix/main.cf
inet_protocols = ipv4

#inet_interfaces = all
inet_interfaces =
   127.0.0.1
   #$IPV4

myhostname = $HOSTNAME

mydestination = 
   $HOSTNAME
   localhost

## - The list of "trusted" SMTP clients that have more 
## - privileges than "strangers"
## -
mynetworks = 
   127.0.0.0/8
   ${IPV4}/32

smtp_bind_address = $IPV4
smtp_bind_address6 = $IPV6

EOF
fi

cat <<EOF >> /etc/postfix/main.cf

## - The method to generate the default value for the mynetworks parameter.
## -
## -   mynetworks_style = host" when Postfix should "trust" only the local machine
## -   mynetworks_style = subnet (default value) "when Postfix should "trust" SMTP 
## -                       clients in the same IP subnetworks as the local machine.
## -   mynetworks_style = class" when Postfix should "trust" SMTP clients in the same 
## -                      IP class A/B/C networks as the local machine.
## -
#mynetworks_style = host


## - The maximal size of any local(8) individual mailbox or maildir file, 
## - or zero (no limit). In fact, this limits the size of any file that is 
## - written to upon local delivery, including files written by external 
## - commands that are executed by the local(8) delivery agent. 
## -
mailbox_size_limit = 0

## - The maximal size in bytes of a message, including envelope information.
## -
## - we user 50MB
## -
message_size_limit = 52480000

## - The system-wide recipient address extension delimiter
## -
recipient_delimiter = +

## - The alias databases that are used for local(8) delivery.
## -
alias_maps =
   hash:/etc/aliases

## - The alias databases for local(8) delivery that are updated 
## - with "newaliases" or with "sendmail -bi". 
## -
alias_database =
   hash:/etc/aliases

## - Optional address mapping lookup tables for envelope and header sender 
## - addresses. The table format and lookups are documented in canonical(5).
## -
## - Example: you want to rewrite the SENDER address "user@ugly.domain" 
## - to "user@pretty.domain", while still being able to send mail to the 
## - RECIPIENT address "user@ugly.domain".
## -
## - Note: \$sender_canonical_maps is processed before \$canonical_maps.
## -
sender_canonical_maps = btree:/etc/postfix/sender_canonical


## - The maximal time a message is queued before it is sent back as 
## - undeliverable. Defaults to 5d (5 days)
## - Specify 0 when mail delivery should be tried only once.
## - 
maximal_queue_lifetime = 3d
bounce_queue_lifetime = \$maximal_queue_lifetime

## - delay_warning_time (default: 0h)
## -
## - The time after which the sender receives a copy of the message 
## - headers of mail that is still queued. To enable this feature, 
## - specify a non-zero time value (an integral value plus an optional 
## - one-letter suffix that specifies the time unit). 
## - Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). 
## - The default time unit is h (hours). 
delay_warning_time = 1d


EOF

if $SASL_AUTH ; then
   cat <<EOF >> /etc/postfix/main.cf

# ============ Relay parameters ============

#relayhost =


# ============ SASL authentication ============

# Enable SASL authentication
smtp_sasl_auth_enable = yes

# Only offer SMTP AUTH when talking over an encrypted connection
smtpd_tls_auth_only = yes

# Forwarding to the ip-adress of host b.mx.oopen.de
relayhost = [${RELAY_HOST}]

# File including login data
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd

# Disallow methods that allow anonymous authentication.
smtp_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = \$smtpd_sasl_security_options

# Report the SASL authenticated user name in the smtpd(8) Received message header. 
smtpd_sasl_authenticated_header = no



# ============ TLS parameters ============

## - Aktiviert TLS für den Mailempfang
## -
## - may:
## - Opportunistic TLS. Use TLS if this is supported by the remote 
## - SMTP server, otherwise use plaintext
## -
## - This overrides the obsolete parameters smtpd_use_tls and 
## - smtpd_enforce_tls. This parameter is ignored with 
## - "smtpd_tls_wrappermode = yes".
#smtpd_use_tls=yes
smtp_tls_security_level=encrypt

EOF

else
   cat <<EOF >> /etc/postfix/main.cf

# ============ Relay parameters ============

relayhost =


# ============ TLS parameters ============

## - Aktiviert TLS für den Mailempfang
## -
## - may:
## - Opportunistic TLS. Use TLS if this is supported by the remote 
## - SMTP server, otherwise use plaintext
## -
## - This overrides the obsolete parameters smtpd_use_tls and 
## - smtpd_enforce_tls. This parameter is ignored with 
## - "smtpd_tls_wrappermode = yes".
#smtpd_use_tls=yes
smtp_tls_security_level=may

EOF
fi

cat <<EOF >> /etc/postfix/main.cf
## - Aktiviert TLS für den Mailversand
## -
## - may:
## - Opportunistic TLS: announce STARTTLS support to SMTP clients, 
## - but do not require that clients use TLS encryption.
# smtp_use_tls=yes
smtpd_tls_security_level=may

## -    0 Disable logging of TLS activity. 
## -    1 Log TLS handshake and certificate information. 
## -    2 Log levels during TLS negotiation. 
## -    3 Log hexadecimal and ASCII dump of TLS negotiation process. 
## -    4 Also log hexadecimal and ASCII dump of complete transmission after STARTTLS. 
## -
smtpd_tls_loglevel = 1
smtp_tls_loglevel = 1

smtpd_tls_cert_file = $_TLS_CERT_FILE
smtpd_tls_key_file = $_TLS_KEY_FILE

## - File with DH parameters that the Postfix SMTP server should use with EDH ciphers.
## - 
## - Dont't forget to create it, e.g with openssl:
## -    openssl dhparam -out /etc/postfix/ssl/dh_1024.pem -2 1024
## -
#smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_1024.pem
## - also possible to use 2048 key with that parameter
## -
smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_2048.pem

## - File with DH parameters that the Postfix SMTP server should use with EDH ciphers. 
## - 
## - Dont't forget to create it, e.g with openssl:
## -    openssl dhparam -out /etc/postfix/ssl/dh_512.pem -2 512
## -
smtpd_tls_dh512_param_file = /etc/postfix/ssl/dh_512.pem


## - File containing CA certificates of root CAs trusted to sign either remote SMTP 
## - server certificates or intermediate CA certificates. These are loaded into 
## - memory !! BEFORE !! the smtp(8) client enters the chroot jail.
## - 
smtp_tls_CAfile = $_TLS_CA_FILE

## - Directory with PEM format certificate authority certificates that the Postfix SMTP 
## - client uses to verify a remote SMTP server certificate. Don't forget to create the 
## - necessary "hash" links with, for example, "
## - $OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". 
## -
## - !! Note !!
## - To use this option in chroot mode, this directory (or a copy) must be inside 
## - the chroot jail. 
## -
## - Note that a chrooted daemon resolves all filenames relative to the Postfix 
## - queue directory (/var/spool/postfix)
## -
#smtpd_tls_CApath = /etc/postfix/certs


# Disable SSLv2 SSLv3 - Postfix SMTP server 
# 
# List of TLS protocols that the Postfix SMTP server will exclude or  
# include with opportunistic TLS encryption.  
smtpd_tls_protocols = !SSLv2, !SSLv3
# 
# The SSL/TLS protocols accepted by the Postfix SMTP server  
# with mandatory TLS encryption. 
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3


# Disable SSLv2 SSLv3 - Postfix SMTP client 
#  
# List of TLS protocols that the Postfix SMTP client will exclude or  
# include with opportunistic TLS encryption.  
smtp_tls_protocols = !SSLv2, !SSLv3
# 
# List of SSL/TLS protocols that the Postfix SMTP client will use  
# with mandatory TLS encryption 
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3


## - Activate des "Ephemeral Elliptic Curve Diffie-Hellman" (EECDH) key exchange 
## -    openssl > 1.0
## -
smtpd_tls_eecdh_grade = strong

# standard list cryptographic algorithm
tls_preempt_cipherlist = yes

# Disable ciphers which are less than 256-bit:
#
#smtpd_tls_mandatory_ciphers = high
#
# opportunistic
smtpd_tls_ciphers = high


# Exclude ciphers
#smtpd_tls_exclude_ciphers =
#   RC4
#   aNULL
#   SEED-SHA
#   EXP
#   MD5
smtpd_tls_exclude_ciphers =
   aNULL
   eNULL
   EXPORT
   DES
   RC4
   MD5
   PSK
   aECDH
   EDH-DSS-DES-CBC3-SHA
   EDH-RSA-DES-CDC3-SHA
   KRB5-DE5, CBC3-SHA


smtpd_tls_session_cache_database = btree:\${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:\${data_directory}/smtp_scache

EOF
echo_ok

echononl "   Configure SASL authentification"
if $SASL_AUTH ; then

   _failed=false
   echo "[$RELAY_HOST] ${SASL_USER}@${RELAY_HOST}:$SASL_PASS" > /etc/postfix/sasl_passwd
   if [[ "$?" != "0" ]]; then
      error "Setting \"/etc/postfix/sasl_passwd\" failed! "
      _failed=true
   fi
   chown root:root /etc/postfix/sasl_passwd
   if [[ "$?" != "0" ]]; then
      error "Setting ownership of \"/etc/postfix/sasl_passwd\" failed! "
      _failed=true
   fi
   chmod 600 /etc/postfix/sasl_passwd
   if [[ "$?" != "0" ]]; then
      error "Setting permissions on \"/etc/postfix/sasl_passwd\" failed! "
      _failed=true
   fi
   postmap /etc/postfix/sasl_passwd
   chown root:root /etc/postfix/sasl_passwd.db
   if [[ "$?" != "0" ]]; then
      error "Creating \"/etc/postfix/sasl_passwd\" failed! "
      _failed=true
   fi
   chown root:root /etc/postfix/sasl_passwd.db
   if [[ "$?" != "0" ]]; then
      error "Setting ownership of \"/etc/postfix/sasl_passwd.db\" failed! "
      _failed=true
   fi
   if $_failed ; then
      echo_failed
   else
      echo_ok
   fi
else
   echo_skipped
fi

## - /etc/mailname
## -
echononl "   Set \"/etc/mailname\""
echo $HOSTNAME > /etc/mailname
if [[ $? -eq 0 ]] ; then
   echo_ok
else
   echo_failed
fi

## - /etc/aliases
## -
echononl "   Adjust \"/etc/aliases\""
cat << EOF > /etc/aliases
# See man 5 aliases for format
mailer-daemon: postmaster
postmaster: root
nobody: root
hostmaster: root
usenet: root
news: root
webmaster: root
www: root
ftp: root
abuse: root
noc: root
security: root

do-not-reply: /dev/null

root: $ADMIN_EMAIL
EOF
if [[ $? -eq 0 ]] ; then
   echo_ok
else
   echo_failed
fi


## - create directory for certificates and copy certificates 
## - and coresponding keys to /etc/postfix/ssl/
## -
echononl "   Create directory for certificates \"/etc/postfix/ssl\""
if [[ -d "/etc/postfix/ssl" ]] ; then
   echo_skipped
else
   mkdir -p /etc/postfix/ssl
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
   fi
fi


## - generate DH parameters that the Postfix SMTP server should use 
## - with EDH ciphers (length 512 and 1024
## -
echononl "   Generate DH key length=512 \"/etc/postfix/ssl/dh_512.pem\""
if [ ! -f /etc/postfix/ssl/dh_512.pem ]; then
   openssl dhparam -out /etc/postfix/ssl/dh_512.pem -2 512 > /dev/null 2>&1
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
   fi
else
   echo_skipped
fi
echononl "   Generate DH key length=1024 \"/etc/postfix/ssl/dh_1024.pem\""
if [ ! -f /etc/postfix/ssl/dh_1024.pem ]; then
   openssl dhparam -out /etc/postfix/ssl/dh_1024.pem -2 1024 > /dev/null 2>&1
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
   fi
else
   echo_skipped
fi
echononl "   Generate DH key length=2048 \"/etc/postfix/ssl/dh_2048.pem\""
if [ ! -f /etc/postfix/ssl/dh_2048.pem ]; then
   openssl dhparam -out /etc/postfix/ssl/dh_2048.pem -2 2048 > /dev/null 2>&1
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
   fi
else
   echo_skipped
fi
echononl "   Create Symlink \"$_TLS_CERT_FILE\""
if [ ! -h "$_TLS_CERT_FILE" ]; then
   ln -s /etc/ssl/certs/ssl-cert-snakeoil.pem  $_TLS_CERT_FILE
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
   fi
else
   echo_skipped
fi
echononl "   Create Symlink \"$_TLS_KEY_FILE\""
if [ ! -h "$_TLS_KEY_FILE" ]; then
   ln -s /etc/ssl/private/ssl-cert-snakeoil.key $_TLS_KEY_FILE
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
   fi
else
   echo_skipped
fi

## - rebuld alias database
## -
echononl "   Rebuld alias database"
newaliases > /dev/null 2>&1
if [[ $? -eq 0 ]] ; then
   echo_ok
else
   echo_failed
fi

echononl "   Create file \"sender_canonical\""
if [[ ! -f /etc/postfix/sender_canonical ]]; then
   cat <<EOF > /etc/postfix/sender_canonical
@localhost  @$(hostname -f)
EOF
fi
postmap btree:/etc/postfix/sender_canonical
if [[ $? -eq 0 ]] ; then
   echo_ok
else
   echo_failed
fi


## - restart postfix
## -
echononl "   Restart postfix"
if $systemd_exists ; then
   systemctl restart postfix > /dev/null 2>&1
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
   fi
else
   /etc/init.d/postfix restart > /dev/null 2>&1
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
   fi
fi


## - Omitt logging into system.log
## -
echononl "   Create \"/etc/rsyslog.d/postfix.conf\""
cat << EOF >> /etc/rsyslog.d/postfix.conf

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err

mail.*                          -/var/log/mail.log
& ~
EOF
if [[ $? -eq 0 ]] ; then
   echo_ok
else
   echo_failed
fi

echononl "   Restart rsyslog daemon"
if $systemd_exists ; then
   systemctl restart rsyslog > /dev/null 2>&1
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
   fi
else
   /etc/init.d/rsyslog restart > /dev/null 2>&1
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
   fi
fi


echo ""
exit