Add install script fpr opendkim (via postfix milter)
This commit is contained in:
parent
15df203d5f
commit
0ac398c92a
582
install_opendkim.sh
Executable file
582
install_opendkim.sh
Executable file
@ -0,0 +1,582 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
clear
|
||||
echo -e "\n \033[32mStart Installation of OpenDKIM..\033[m"
|
||||
|
||||
|
||||
|
||||
# -------------
|
||||
# - Settings
|
||||
# -------------
|
||||
|
||||
#_src_base_dir="$(realpath $(dirname $0))"
|
||||
#conf_file="${_src_base_dir}/conf/install_opendkim.conf"
|
||||
|
||||
log_file="$(mktemp)"
|
||||
|
||||
_opendkim_packages="opendkim opendkim-tools"
|
||||
|
||||
opendkim_base_dir="/etc/opendkim"
|
||||
opendkim_key_dir="${opendkim_base_dir}/keys"
|
||||
opendkim_conf_file="/etc/opendkim.conf"
|
||||
|
||||
postfix_spool_dir="/var/spool/postfix"
|
||||
|
||||
opendkim_socket_dir="${postfix_spool_dir}/opendkim"
|
||||
opendkim_socket_file="${opendkim_socket_dir}/opendkim.sock"
|
||||
|
||||
postfix_needs_restart=false
|
||||
opendkim_needs_restart=false
|
||||
|
||||
# -------------
|
||||
# --- Some functions
|
||||
# -------------
|
||||
echononl(){
|
||||
echo X\\c > /tmp/shprompt$$
|
||||
if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
|
||||
echo -e -n "$*\\c" 1>&2
|
||||
else
|
||||
echo -e -n "$*" 1>&2
|
||||
fi
|
||||
rm /tmp/shprompt$$
|
||||
}
|
||||
|
||||
fatal(){
|
||||
echo ""
|
||||
echo -e "fatal error: $*"
|
||||
echo ""
|
||||
echo -e "\t\033[31m\033[1mInstalllation will be interrupted\033[m\033[m"
|
||||
echo ""
|
||||
exit 1
|
||||
}
|
||||
|
||||
error(){
|
||||
echo ""
|
||||
echo -e "\t[ \033[31m\033[1mFehler\033[m ]: $*"
|
||||
echo ""
|
||||
}
|
||||
|
||||
warn (){
|
||||
echo ""
|
||||
echo -e "\t[ \033[33m\033[1mWarning\033[m ]: $*"
|
||||
echo ""
|
||||
}
|
||||
|
||||
info (){
|
||||
echo ""
|
||||
echo -e "\t[ \033[32m\033[1mInfo\033[m ]: $*"
|
||||
echo ""
|
||||
}
|
||||
|
||||
echo_done() {
|
||||
echo -e "\033[80G[ \033[32mdone\033[m ]"
|
||||
}
|
||||
echo_ok() {
|
||||
echo -e "\033[80G[ \033[32mok\033[m ]"
|
||||
}
|
||||
echo_warning() {
|
||||
echo -e "\033[80G[ \033[33m\033[1mwarn\033[m ]"
|
||||
}
|
||||
echo_failed(){
|
||||
echo -e "\033[80G[ \033[1;31mfailed\033[m ]"
|
||||
}
|
||||
echo_skipped() {
|
||||
echo -e "\033[80G[ \033[37mskipped\033[m ]"
|
||||
}
|
||||
|
||||
|
||||
# -------------
|
||||
# - Some pre-installation tasks
|
||||
# -------------
|
||||
|
||||
# - Is 'systemd' supported on this system
|
||||
# -
|
||||
if [ "X`which systemd`" = "X" ]; then
|
||||
SYSTEMD_EXISTS=false
|
||||
else
|
||||
SYSTEMD_EXISTS=true
|
||||
fi
|
||||
|
||||
|
||||
|
||||
# =============
|
||||
# - Start Installation
|
||||
# =============
|
||||
|
||||
echo ""
|
||||
|
||||
# - Install OpenDKIM
|
||||
# -
|
||||
echononl " Install needed debian packages.."
|
||||
opendkim_packages=""
|
||||
packages_installed=false
|
||||
for _pkg in $_opendkim_packages ; do
|
||||
if aptitude search "$_pkg" | grep " $_pkg " | grep -e "^i" > /dev/null 2>&1 ; then
|
||||
continue
|
||||
else
|
||||
opendkim_packages="$opendkim_packages $_pkg"
|
||||
fi
|
||||
done
|
||||
if [[ -n "$opendkim_packages" ]]; then
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y install $opendkim_packages > /dev/null 2> "$log_file"
|
||||
packages_installed=true
|
||||
opendkim_needs_restart=true
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
# - Add user 'postfix' to group 'opendkim'
|
||||
# -
|
||||
echononl " Add user 'postfix' to group 'opendkim'.."
|
||||
if grep opendkim /etc/group | grep -q postfix 2> /dev/null ; then
|
||||
echo_skipped
|
||||
else
|
||||
adduser postfix opendkim 2> "$log_file"
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
# - Save configuration file from distribution
|
||||
# -
|
||||
echononl " Save configuration file from distribution"
|
||||
if $packages_installed ; then
|
||||
cp -a $opendkim_conf_file $opendkim_conf_file.ORIG 2> "$log_file"
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
# - Create OpenDKIM configuration
|
||||
# -
|
||||
echononl " Create OpenDKIM configuration"
|
||||
if [[ -f "$opendkim_conf_file" ]] \
|
||||
&& grep -i -q -E "Socket\s+local:$opendkim_socket_file" "$opendkim_conf_file" \
|
||||
&& grep -i -q -E "SigningTable.*${opendkim_base_dir}/signing.table" "$opendkim_conf_file" \
|
||||
&& grep -i -q -E "KeyTable.*${opendkim_base_dir}/key.table" "$opendkim_conf_file" ; then
|
||||
echo_skipped
|
||||
warn "OpenDKIM seems already be configured."
|
||||
else
|
||||
cat <<EOF > $opendkim_conf_file 2> $log_file
|
||||
# Datei $opendkim_conf_file
|
||||
|
||||
# OpenDKIM agiert als Mail Filter (= Milter) in den
|
||||
# Modi signer (s) und verifier (v) und verwendet eine
|
||||
# Socket-Datei zur Kommunikation (alternativ: lokaler Port)
|
||||
Mode sv
|
||||
# Socket local:/var/run/opendkim/opendkim.sock
|
||||
# Socket local:$opendkim_socket_file
|
||||
# Socket inet:12345@localhost
|
||||
|
||||
# OpenDKIM verwendet diesen Benutzer bzw.
|
||||
# diese Gruppe
|
||||
UserID opendkim:opendkim
|
||||
UMask 002
|
||||
PidFile /var/run/opendkim/opendkim.pid
|
||||
|
||||
# OpenDKIM bei Problemen neustarten,
|
||||
# aber max. 10 mal pro Stunde
|
||||
AutoRestart yes
|
||||
AutoRestartRate 10/1h
|
||||
|
||||
# Logging (wenn alles funktioniert eventuell reduzieren)
|
||||
Syslog yes
|
||||
SyslogSuccess yes
|
||||
LogWhy yes
|
||||
|
||||
# Verfahren, wie Header und Body durch
|
||||
# OpenDKIM verarbeitet werden sollen.
|
||||
Canonicalization relaxed/simple
|
||||
|
||||
# interne Mails nicht mit OpenDKIM verarbeiten
|
||||
ExternalIgnoreList refile:${opendkim_base_dir}/trusted
|
||||
InternalHosts refile:${opendkim_base_dir}/trusted
|
||||
|
||||
# welche Verschlüsselungs-Keys sollen für welche
|
||||
# Domains verwendet werden
|
||||
# (refile: für Dateien mit regulären Ausdrücke)
|
||||
SigningTable refile:${opendkim_base_dir}/signing.table
|
||||
KeyTable ${opendkim_base_dir}/key.table
|
||||
|
||||
# diesen Signatur-Algorithmus verwenden
|
||||
SignatureAlgorithm rsa-sha256
|
||||
|
||||
# Always oversign From (sign using actual From and a null From to prevent
|
||||
# malicious signatures header fields (From and/or others) between the signer
|
||||
# and the verifier. From is oversigned by default in the Debian pacakge
|
||||
# because it is often the identity key used by reputation systems and thus
|
||||
# somewhat security sensitive.
|
||||
OversignHeaders From
|
||||
EOF
|
||||
opendkim_needs_restart=true
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
# - Assign ownership to the opendkim user and restrict tthe
|
||||
# - file permissions:
|
||||
# -
|
||||
echononl " Assign ownership and file permissions.."
|
||||
chmod u=rw,go=r $opendkim_conf_file 2> $log_file
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
|
||||
|
||||
# - Create the directories to hold OpenDKIM’s data files, assign
|
||||
# - ownership to the opendkim user, and restrict the file
|
||||
# - permissions:
|
||||
# -
|
||||
echononl " Create directory '$opendkim_base_dir'"
|
||||
if [[ -d "$opendkim_base_dir" ]] ; then
|
||||
echo_skipped
|
||||
else
|
||||
opendkim_needs_restart=true
|
||||
mkdir ${opendkim_base_dir} 2> $log_file
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
fi
|
||||
echononl " Create directory '$opendkim_key_dir'"
|
||||
if [[ -d "$opendkim_key_dir" ]] ; then
|
||||
echo_skipped
|
||||
else
|
||||
opendkim_needs_restart=true
|
||||
mkdir $opendkim_key_dir 2> $log_file
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
fi
|
||||
echononl " Set ownership on directory '${opendkim_base_dir}' (recursive).."
|
||||
chown -R opendkim:opendkim ${opendkim_base_dir} 2> $log_file
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
echononl " Set file-permission on $opendkim_key_dir"
|
||||
chmod go-rw $opendkim_key_dir 2> $log_file
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
|
||||
|
||||
# - Create empty files
|
||||
# - ${opendkim_base_dir}/signing.table
|
||||
# - ${opendkim_base_dir}/key.table
|
||||
# -
|
||||
echononl " Create empty file '${opendkim_base_dir}/signing.table'.."
|
||||
if [[ -f "${opendkim_base_dir}/signing.table" ]] ; then
|
||||
echo_skipped
|
||||
else
|
||||
touch ${opendkim_base_dir}/signing.table 2> $log_file
|
||||
opendkim_needs_restart=true
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
fi
|
||||
echononl " Create empty file '${opendkim_base_dir}/key.table'.."
|
||||
if [[ -f "${opendkim_base_dir}/key.table" ]] ; then
|
||||
echo_skipped
|
||||
else
|
||||
touch ${opendkim_base_dir}/key.table 2> $log_file
|
||||
opendkim_needs_restart=true
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
# - Create the trusted hosts file ${opendkim_base_dir}/trusted.hosts.
|
||||
# -
|
||||
echononl " Create trusted hosts file '${opendkim_base_dir}/trusted'.."
|
||||
if [[ -f "${opendkim_base_dir}/trusted" ]] ; then
|
||||
echo_skipped
|
||||
else
|
||||
cat <<EOF > ${opendkim_base_dir}/trusted 2> $log_file
|
||||
127.0.0.1
|
||||
::1
|
||||
localhost
|
||||
$(hostname -f)
|
||||
EOF
|
||||
opendkim_needs_restart=true
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
# - Create the OpenDKIM socket directory in Postfix’s work area
|
||||
# - and make sure it has the correct ownership:
|
||||
# -
|
||||
echononl " Create the OpenDKIM socket directory in Postfix’s work area.."
|
||||
if [[ -d "${postfix_spool_dir}/opendkim" ]] ; then
|
||||
echo_skipped
|
||||
else
|
||||
mkdir ${postfix_spool_dir}/opendkim 2> $log_file
|
||||
opendkim_needs_restart=true
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
echononl " Set ownership on directory '${postfix_spool_dir}/opendkim'.."
|
||||
chown opendkim:postfix ${postfix_spool_dir}/opendkim 2> $log_file
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
# - Edit /etc/default/opendkim
|
||||
# -
|
||||
# - Set:
|
||||
# - SOCKET="local:${postfix_spool_dir}/opendkim/opendkim.sock"
|
||||
# -
|
||||
echononl " Set 'SOCKET' at file /etc/default/opendkim.."
|
||||
if grep -q -E "^\s*SOCKET" /etc/default/opendkim 2>/dev/null ; then
|
||||
if grep -q -E "^\s*SOCKET.*local:$opendkim_socket_file" /etc/default/opendkim 2>/dev/null ; then
|
||||
echo_skipped
|
||||
else
|
||||
perl -i -n -p -e "s#^\s*SOCKET=.*#SOCKET=\"local:$opendkim_socket_file\"#" /etc/default/opendkim 2> $log_file
|
||||
opendkim_needs_restart=true
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
cat <<EOF >>/etc/default/opendkim 2> $log_file
|
||||
SOCKET=.*$/SOCKET="local:$opendkim_socket_file"
|
||||
EOF
|
||||
opendkim_needs_restart=true
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
# - Edit /etc/postfix/main.cf and add a section to activate
|
||||
# - processing of e-mail through the OpenDKIM daemon:
|
||||
# -
|
||||
backup_date="$(date +%Y-%m-%d-%H%M)"
|
||||
echononl " Backup existing postfix configuration (main.cf).."
|
||||
cp -a /etc/postfix/main.cf /etc/postfix/main.cf.$backup_date 2> $log_file
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
|
||||
echononl " Activate processing of e-mail through the OpenDKIM daemon.."
|
||||
if grep -q -E "milter_default_action\s*=\s*accept" /etc/postfix/main.cf ; then
|
||||
echo_skipped
|
||||
warn "Postfix (main.cf) seems already be configured for milters"
|
||||
echononl " Delete previosly saved Postfix configuration.."
|
||||
rm /etc/postfix/main.cf.$backup_date 2> $log_file
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
else
|
||||
cat <<EOF >> /etc/postfix/main.cf 2> $log_file
|
||||
|
||||
# Milter configuration
|
||||
# OpenDKIM
|
||||
milter_default_action = accept
|
||||
# Postfix ≥ 2.6 milter_protocol = 6, Postfix ≤ 2.5 milter_protocol = 2
|
||||
milter_protocol = 6
|
||||
smtpd_milters = local:/opendkim/opendkim.sock
|
||||
non_smtpd_milters = local:/opendkim/opendkim.sock
|
||||
EOF
|
||||
postfix_needs_restart=true
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
# - Prevent Postfix from setting the DKIM Header twice (one befor
|
||||
# - and one after processing amavis
|
||||
# -
|
||||
# - To disable milter processing after amavis, add to your master.cf in
|
||||
# - the after-amavis section:
|
||||
# - 127.0.0.1:10025 inet n - - - - smtpd
|
||||
# - [...]
|
||||
# - -o smtpd_milters=
|
||||
# -
|
||||
# - If you want to run the milter after amavis, set in main.cf
|
||||
# - smtpd_milters=
|
||||
# - to an empty string and add the smtpd_milters configuration to master.cf
|
||||
# - (after-section amavis) instead:
|
||||
# - -o smtpd_milters=local:/opendkim/opendkim.sock
|
||||
# -
|
||||
echononl " Backup file '/etc/postfix/master.cf'.."
|
||||
cp -a /etc/postfix/master.cf /etc/postfix/master.cf.$backup_date 2> $log_file
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
echononl " Adjust /etc/postfix/master.cf to prevent setting DKIM Header twice.."
|
||||
_found=false
|
||||
_changed=false
|
||||
tmp_master_file="/tmp/postfix_master.cf"
|
||||
> $tmp_master_file
|
||||
while IFS='' read -r _line || [[ -n $_line ]] ; do
|
||||
|
||||
if $_found && ! echo "$_line" | grep -i -q -E "^\s*-o" 2> /dev/null ; then
|
||||
echo " -o smtpd_milters=" >> "$tmp_master_file"
|
||||
changed=true
|
||||
fi
|
||||
|
||||
if $_found && echo "$_line" | grep -i -q -E "^\s*-o\s+smtpd_milters=\s*" ; then
|
||||
_found=false
|
||||
fi
|
||||
|
||||
if echo "$_line" | grep -i -q -E "^\s*127.0.0.1:10025\s+inet\s+" 2> /dev/null ; then
|
||||
_found=true
|
||||
fi
|
||||
|
||||
echo "$_line" >> "$tmp_master_file"
|
||||
|
||||
done < "/etc/postfix/master.cf"
|
||||
if $_changed ; then
|
||||
cp $tmp_master_file /etc/postfix/master.cf 2> $log_file
|
||||
postfix_needs_restart=true
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
else
|
||||
echo_skipped
|
||||
warn "Postfix (master.cf) seems already be configured."
|
||||
echononl " Delete previosly saved file '/etc/postfix/master.cf'.."
|
||||
rm /etc/postfix/master.cf.$backup_date 2> $log_file
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
fi
|
||||
rm -f $tmp_master_file
|
||||
|
||||
echo ""
|
||||
|
||||
# - Restart OpenDKIM
|
||||
# -
|
||||
echononl " Restart OpenDKIM.."
|
||||
if $opendkim_needs_restart ; then
|
||||
if $SYSTEMD_EXISTS ; then
|
||||
systemctl restart opendkim > $log_file 2>&1
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
else
|
||||
/etc/init.d/opendkim restart > $log_file 2>&1
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
# - Restart Postfix so it starts using OpenDKIM when processing mail:
|
||||
# -
|
||||
echononl " Restart Postfix.."
|
||||
if $postfix_needs_restart ; then
|
||||
if $SYSTEMD_EXISTS ; then
|
||||
systemctl restart postfix > $log_file 2>&1
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
else
|
||||
/etc/init.d/postfix restart > $log_file 2>&1
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "$(cat $log_file)"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
echo ""
|
||||
rm -f "$log_file"
|
||||
exit 0
|
||||
Loading…
Reference in New Issue
Block a user