From 0ac398c92a3abda27be32dd5fd641c918ed49e4a Mon Sep 17 00:00:00 2001
From: Christoph <ckubu@oopen.de>
Date: Thu, 1 Jun 2017 16:12:27 +0200
Subject: [PATCH] Add install script fpr opendkim (via postfix milter)

---
 install_opendkim.sh | 582 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 582 insertions(+)
 create mode 100755 install_opendkim.sh

diff --git a/install_opendkim.sh b/install_opendkim.sh
new file mode 100755
index 0000000..e902b5e
--- /dev/null
+++ b/install_opendkim.sh
@@ -0,0 +1,582 @@
+#!/usr/bin/env bash
+
+clear
+echo -e "\n   \033[32mStart Installation of OpenDKIM..\033[m"
+
+
+
+# -------------
+# - Settings
+# -------------
+
+#_src_base_dir="$(realpath $(dirname $0))"
+#conf_file="${_src_base_dir}/conf/install_opendkim.conf"
+
+log_file="$(mktemp)"
+
+_opendkim_packages="opendkim opendkim-tools"
+
+opendkim_base_dir="/etc/opendkim"
+opendkim_key_dir="${opendkim_base_dir}/keys"
+opendkim_conf_file="/etc/opendkim.conf"
+
+postfix_spool_dir="/var/spool/postfix"
+
+opendkim_socket_dir="${postfix_spool_dir}/opendkim"
+opendkim_socket_file="${opendkim_socket_dir}/opendkim.sock"
+
+postfix_needs_restart=false
+opendkim_needs_restart=false
+
+# -------------
+# --- Some functions
+# -------------
+echononl(){
+   echo X\\c > /tmp/shprompt$$
+   if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
+      echo -e -n "$*\\c" 1>&2
+   else
+       echo -e -n "$*" 1>&2
+   fi
+   rm /tmp/shprompt$$
+}
+
+fatal(){
+   echo ""
+   echo -e "fatal error: $*"
+   echo ""
+   echo -e "\t\033[31m\033[1mInstalllation will be interrupted\033[m\033[m"
+   echo ""
+   exit 1
+}
+
+error(){
+   echo ""
+   echo -e "\t[ \033[31m\033[1mFehler\033[m ]: $*"
+   echo ""
+}
+
+warn (){
+   echo ""
+   echo -e "\t[ \033[33m\033[1mWarning\033[m ]: $*"
+   echo ""
+}
+
+info (){
+   echo ""
+   echo -e "\t[ \033[32m\033[1mInfo\033[m ]: $*"
+   echo ""
+}
+
+echo_done() {
+   echo -e "\033[80G[ \033[32mdone\033[m ]"
+}
+echo_ok() {
+   echo -e "\033[80G[ \033[32mok\033[m ]"
+}
+echo_warning() {
+   echo -e "\033[80G[ \033[33m\033[1mwarn\033[m ]"
+}
+echo_failed(){
+   echo -e "\033[80G[ \033[1;31mfailed\033[m ]"
+}
+echo_skipped() {
+   echo -e "\033[80G[ \033[37mskipped\033[m ]"
+}
+
+
+# -------------
+# - Some pre-installation tasks
+# -------------
+
+# - Is 'systemd' supported on this system
+# -
+if [ "X`which systemd`" = "X" ]; then
+   SYSTEMD_EXISTS=false
+else
+   SYSTEMD_EXISTS=true
+fi
+
+
+
+# =============
+# - Start Installation
+# =============
+
+echo ""
+
+# - Install OpenDKIM
+# -
+echononl "   Install needed debian packages.."
+opendkim_packages=""
+packages_installed=false
+for _pkg in $_opendkim_packages ; do
+   if aptitude search "$_pkg" | grep " $_pkg " | grep -e "^i" > /dev/null 2>&1 ; then
+      continue
+   else
+      opendkim_packages="$opendkim_packages $_pkg"
+   fi
+done
+if [[ -n "$opendkim_packages" ]]; then
+   DEBIAN_FRONTEND=noninteractive apt-get -y install $opendkim_packages > /dev/null 2> "$log_file"
+   packages_installed=true
+   opendkim_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+
+# - Add user 'postfix' to group 'opendkim'
+# -
+echononl "   Add user 'postfix' to group 'opendkim'.."
+if grep opendkim /etc/group | grep -q postfix 2> /dev/null ; then
+   echo_skipped
+else
+   adduser postfix opendkim 2> "$log_file"
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Save configuration file from distribution
+# -
+echononl "   Save configuration file from distribution"
+if $packages_installed ; then
+   cp -a $opendkim_conf_file $opendkim_conf_file.ORIG 2> "$log_file"
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+
+# - Create OpenDKIM configuration
+# -
+echononl "   Create OpenDKIM configuration"
+if [[ -f "$opendkim_conf_file" ]] \
+      && grep -i -q -E "Socket\s+local:$opendkim_socket_file" "$opendkim_conf_file" \
+      && grep -i -q -E "SigningTable.*${opendkim_base_dir}/signing.table" "$opendkim_conf_file" \
+      && grep -i -q -E "KeyTable.*${opendkim_base_dir}/key.table" "$opendkim_conf_file" ; then
+   echo_skipped
+   warn "OpenDKIM seems already be configured."
+else
+   cat <<EOF > $opendkim_conf_file 2> $log_file
+# Datei $opendkim_conf_file
+
+# OpenDKIM agiert als Mail Filter (= Milter) in den
+# Modi signer (s) und verifier (v) und verwendet eine
+# Socket-Datei zur Kommunikation (alternativ: lokaler Port)
+Mode                    sv
+# Socket                local:/var/run/opendkim/opendkim.sock
+# Socket                local:$opendkim_socket_file
+# Socket                inet:12345@localhost
+
+# OpenDKIM verwendet diesen Benutzer bzw.
+# diese Gruppe
+UserID                  opendkim:opendkim
+UMask                   002
+PidFile                 /var/run/opendkim/opendkim.pid
+
+# OpenDKIM bei Problemen neustarten,
+# aber max. 10 mal pro Stunde
+AutoRestart             yes
+AutoRestartRate         10/1h
+
+# Logging (wenn alles funktioniert eventuell reduzieren)
+Syslog                  yes
+SyslogSuccess           yes
+LogWhy                  yes
+
+# Verfahren, wie Header und Body durch
+# OpenDKIM verarbeitet werden sollen.
+Canonicalization        relaxed/simple
+
+# interne Mails nicht mit OpenDKIM verarbeiten
+ExternalIgnoreList      refile:${opendkim_base_dir}/trusted
+InternalHosts           refile:${opendkim_base_dir}/trusted
+
+# welche Verschlüsselungs-Keys sollen für welche
+# Domains verwendet werden
+# (refile: für Dateien mit regulären Ausdrücke)
+SigningTable            refile:${opendkim_base_dir}/signing.table
+KeyTable                ${opendkim_base_dir}/key.table
+
+# diesen Signatur-Algorithmus verwenden
+SignatureAlgorithm      rsa-sha256
+
+# Always oversign From (sign using actual From and a null From to prevent
+# malicious signatures header fields (From and/or others) between the signer
+# and the verifier.  From is oversigned by default in the Debian pacakge
+# because it is often the identity key used by reputation systems and thus
+# somewhat security sensitive.
+OversignHeaders         From
+EOF
+   opendkim_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Assign ownership to the opendkim user and restrict tthe
+# - file permissions:
+# -
+echononl "   Assign ownership and file permissions.."
+chmod u=rw,go=r $opendkim_conf_file 2> $log_file
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+
+
+# - Create the directories to hold OpenDKIM’s data files, assign 
+# - ownership to the opendkim user, and restrict the file 
+# - permissions:
+# -
+echononl "   Create directory '$opendkim_base_dir'"
+if [[ -d "$opendkim_base_dir" ]] ; then
+   echo_skipped
+else
+   opendkim_needs_restart=true
+   mkdir ${opendkim_base_dir} 2> $log_file
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+echononl "   Create directory '$opendkim_key_dir'"
+if [[ -d "$opendkim_key_dir" ]] ; then
+   echo_skipped
+else
+   opendkim_needs_restart=true
+   mkdir $opendkim_key_dir 2> $log_file
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+echononl "   Set ownership on directory '${opendkim_base_dir}' (recursive).."
+chown -R opendkim:opendkim ${opendkim_base_dir} 2> $log_file
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+echononl "   Set file-permission on $opendkim_key_dir"
+chmod go-rw $opendkim_key_dir 2> $log_file
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+
+
+# - Create empty files
+# -    ${opendkim_base_dir}/signing.table
+# -    ${opendkim_base_dir}/key.table
+# -
+echononl "   Create empty file '${opendkim_base_dir}/signing.table'.."
+if [[ -f "${opendkim_base_dir}/signing.table" ]] ; then
+   echo_skipped
+else
+   touch ${opendkim_base_dir}/signing.table 2> $log_file
+   opendkim_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+echononl "   Create empty file '${opendkim_base_dir}/key.table'.."
+if [[ -f "${opendkim_base_dir}/key.table" ]] ; then
+   echo_skipped
+else
+   touch ${opendkim_base_dir}/key.table 2> $log_file
+   opendkim_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Create the trusted hosts file ${opendkim_base_dir}/trusted.hosts.
+# -
+echononl "   Create trusted hosts file '${opendkim_base_dir}/trusted'.."
+if [[ -f "${opendkim_base_dir}/trusted" ]] ; then
+   echo_skipped
+else
+   cat <<EOF > ${opendkim_base_dir}/trusted 2> $log_file
+127.0.0.1
+::1
+localhost
+$(hostname -f)
+EOF
+   opendkim_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Create the OpenDKIM socket directory in Postfix’s work area 
+# - and make sure it has the correct ownership:
+# -
+echononl "   Create the OpenDKIM socket directory in Postfix’s work area.."
+if [[ -d "${postfix_spool_dir}/opendkim" ]] ; then
+   echo_skipped
+else
+   mkdir ${postfix_spool_dir}/opendkim 2> $log_file
+   opendkim_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+   echononl "   Set ownership on directory '${postfix_spool_dir}/opendkim'.."
+   chown opendkim:postfix ${postfix_spool_dir}/opendkim 2> $log_file
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Edit /etc/default/opendkim
+# -
+# - Set:
+# -    SOCKET="local:${postfix_spool_dir}/opendkim/opendkim.sock"
+# -
+echononl "   Set 'SOCKET' at file /etc/default/opendkim.."
+if grep -q -E "^\s*SOCKET" /etc/default/opendkim 2>/dev/null ; then
+   if grep -q -E "^\s*SOCKET.*local:$opendkim_socket_file" /etc/default/opendkim  2>/dev/null ; then
+      echo_skipped
+   else
+      perl -i -n -p -e "s#^\s*SOCKET=.*#SOCKET=\"local:$opendkim_socket_file\"#" /etc/default/opendkim 2> $log_file
+      opendkim_needs_restart=true
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   fi
+else
+   cat <<EOF >>/etc/default/opendkim 2> $log_file
+SOCKET=.*$/SOCKET="local:$opendkim_socket_file"
+EOF
+   opendkim_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Edit /etc/postfix/main.cf and add a section to activate 
+# - processing of e-mail through the OpenDKIM daemon:
+# -
+backup_date="$(date +%Y-%m-%d-%H%M)"
+echononl "   Backup existing postfix configuration (main.cf).."
+cp -a /etc/postfix/main.cf /etc/postfix/main.cf.$backup_date 2> $log_file
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+
+echononl "   Activate processing of e-mail through the OpenDKIM daemon.."
+if grep -q -E "milter_default_action\s*=\s*accept" /etc/postfix/main.cf ; then
+   echo_skipped
+   warn "Postfix (main.cf) seems already be configured for milters"
+   echononl "   Delete previosly saved Postfix configuration.."
+   rm /etc/postfix/main.cf.$backup_date 2> $log_file
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   cat <<EOF >> /etc/postfix/main.cf 2> $log_file
+
+# Milter configuration
+# OpenDKIM
+milter_default_action = accept
+# Postfix ≥ 2.6 milter_protocol = 6, Postfix ≤ 2.5 milter_protocol = 2
+milter_protocol = 6
+smtpd_milters = local:/opendkim/opendkim.sock
+non_smtpd_milters = local:/opendkim/opendkim.sock
+EOF
+   postfix_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Prevent Postfix from setting the DKIM Header twice (one befor
+# - and one after processing amavis
+# -
+# - To disable milter processing after amavis, add to your master.cf in 
+# - the after-amavis section:
+# -    127.0.0.1:10025 inet    n       -       -       -       -       smtpd
+# -       [...]
+# -       -o smtpd_milters=
+# -
+# - If you want to run the milter after amavis, set in main.cf
+# -    smtpd_milters= 
+# - to an empty string and add the smtpd_milters configuration to master.cf 
+# - (after-section amavis) instead:
+# -    -o smtpd_milters=local:/opendkim/opendkim.sock
+# -
+echononl "   Backup file '/etc/postfix/master.cf'.."
+cp -a /etc/postfix/master.cf /etc/postfix/master.cf.$backup_date 2> $log_file
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+echononl "   Adjust /etc/postfix/master.cf to prevent setting DKIM Header twice.."
+_found=false
+_changed=false
+tmp_master_file="/tmp/postfix_master.cf"
+> $tmp_master_file
+while IFS='' read -r _line || [[ -n $_line ]] ; do
+
+   if $_found && ! echo "$_line" | grep -i -q -E "^\s*-o" 2> /dev/null ; then
+      echo "   -o smtpd_milters=" >> "$tmp_master_file"
+      changed=true
+   fi
+
+   if $_found && echo "$_line" | grep -i -q -E "^\s*-o\s+smtpd_milters=\s*" ; then
+      _found=false
+   fi
+
+   if echo "$_line" | grep -i -q -E "^\s*127.0.0.1:10025\s+inet\s+" 2> /dev/null ; then
+      _found=true
+   fi
+
+   echo "$_line" >> "$tmp_master_file"
+
+done < "/etc/postfix/master.cf"
+if $_changed ; then
+   cp $tmp_master_file /etc/postfix/master.cf 2> $log_file
+   postfix_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+   warn "Postfix (master.cf) seems already be configured."
+   echononl "   Delete previosly saved file '/etc/postfix/master.cf'.."
+   rm /etc/postfix/master.cf.$backup_date 2> $log_file
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+rm -f $tmp_master_file
+
+echo ""
+
+# - Restart OpenDKIM
+# - 
+echononl "   Restart OpenDKIM.."
+if $opendkim_needs_restart ; then
+   if $SYSTEMD_EXISTS ; then
+      systemctl restart opendkim > $log_file 2>&1
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   else
+      /etc/init.d/opendkim restart > $log_file 2>&1
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   fi
+else
+   echo_skipped
+fi
+
+
+# - Restart Postfix so it starts using OpenDKIM when processing mail:
+# -
+echononl "   Restart Postfix.."
+if $postfix_needs_restart ; then
+   if $SYSTEMD_EXISTS ; then
+      systemctl restart postfix > $log_file 2>&1
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   else
+      /etc/init.d/postfix restart > $log_file 2>&1
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   fi
+else
+   echo_skipped
+fi
+
+echo ""
+rm -f "$log_file"
+exit 0