Laudende Default seite entfernen
parent
19a68404ad
commit
38f8eaf18c
|
|
@ -4,10 +4,9 @@ source ./lib.sh
|
|||
|
||||
log "Rspamd + OpenDKIM einrichten …"
|
||||
|
||||
# ---------------------------
|
||||
# ──────────────────────────────────────────────────────────────────────────────
|
||||
# Variablen / Defaults
|
||||
# ---------------------------
|
||||
# Installer-Variablen laden, falls vorhanden
|
||||
# ──────────────────────────────────────────────────────────────────────────────
|
||||
set +u
|
||||
[ -r /etc/mailwolt/installer.env ] && . /etc/mailwolt/installer.env
|
||||
set -u
|
||||
|
|
@ -17,17 +16,15 @@ DKIM_SELECTOR="${DKIM_SELECTOR:-mwl1}"
|
|||
DKIM_GENERATE="${DKIM_GENERATE:-0}" # 1 = Key erzeugen, falls fehlt
|
||||
RSPAMD_CONTROLLER_PASSWORD="${RSPAMD_CONTROLLER_PASSWORD:-admin}"
|
||||
|
||||
# ---------------------------
|
||||
# ──────────────────────────────────────────────────────────────────────────────
|
||||
# Rspamd: Controller + Milter
|
||||
# ---------------------------
|
||||
# ──────────────────────────────────────────────────────────────────────────────
|
||||
install -d -m 0755 /etc/rspamd/local.d
|
||||
|
||||
# Controller-Passwort gehasht schreiben
|
||||
# Controller-Passwort (gehasht, sonst Klartext als Fallback)
|
||||
if command -v rspamadm >/dev/null 2>&1; then
|
||||
RSPAMD_HASH="$(rspamadm pw -p "${RSPAMD_CONTROLLER_PASSWORD}")"
|
||||
else
|
||||
# Fallback: falls rspamadm noch nicht verfügbar ist (sollte selten sein)
|
||||
# schreibe Klartext, damit Rspamd danach startbar ist; Hashen kann im nächsten Lauf erfolgen.
|
||||
RSPAMD_HASH="${RSPAMD_CONTROLLER_PASSWORD}"
|
||||
fi
|
||||
|
||||
|
|
@ -41,7 +38,7 @@ cat >/etc/rspamd/local.d/worker-normal.inc <<'CONF'
|
|||
bind_socket = "127.0.0.1:11332";
|
||||
CONF
|
||||
|
||||
# Authentication-Results Header schreiben (praktisch zum Debuggen)
|
||||
# Authentication-Results Header (hilfreich zum Debuggen)
|
||||
cat >/etc/rspamd/local.d/milter_headers.conf <<'CONF'
|
||||
use = ["authentication-results"];
|
||||
header = "Authentication-Results";
|
||||
|
|
@ -49,15 +46,15 @@ CONF
|
|||
|
||||
systemctl enable --now rspamd || true
|
||||
|
||||
# ---------------------------
|
||||
# ──────────────────────────────────────────────────────────────────────────────
|
||||
# OpenDKIM Grund-Setup
|
||||
# ---------------------------
|
||||
# ──────────────────────────────────────────────────────────────────────────────
|
||||
install -d -m 0755 /etc/opendkim
|
||||
install -d -m 0750 /etc/opendkim/keys
|
||||
chown -R opendkim:opendkim /etc/opendkim
|
||||
chmod 750 /etc/opendkim/keys
|
||||
|
||||
# TrustedHosts (wer signieren darf)
|
||||
# Trusted Hosts (wer signieren darf)
|
||||
cat >/etc/opendkim/TrustedHosts <<'CONF'
|
||||
127.0.0.1
|
||||
::1
|
||||
|
|
@ -66,30 +63,28 @@ CONF
|
|||
chown opendkim:opendkim /etc/opendkim/TrustedHosts
|
||||
chmod 640 /etc/opendkim/TrustedHosts
|
||||
|
||||
# Key-/Signing-Tabellen vorbereiten
|
||||
# Key-/Signing-Tabellen
|
||||
KEY_DIR="/etc/opendkim/keys/${BASE_DOMAIN}"
|
||||
KEY_PRIV="${KEY_DIR}/${DKIM_SELECTOR}.private"
|
||||
|
||||
install -d -m 0750 -o opendkim -g opendkim "${KEY_DIR}"
|
||||
|
||||
# Falls gewünscht: fehlenden Key erzeugen
|
||||
# Optional: Key erzeugen, falls gewünscht und nicht vorhanden
|
||||
if [[ "${DKIM_GENERATE}" = "1" && ! -s "${KEY_PRIV}" ]]; then
|
||||
if command -v opendkim-genkey >/dev/null 2>&1; then
|
||||
opendkim-genkey -b 2048 -s "${DKIM_SELECTOR}" -d "${BASE_DOMAIN}" -D "${KEY_DIR}"
|
||||
# opendkim legt .private und .txt an (Selector.*)
|
||||
chown opendkim:opendkim "${KEY_DIR}/${DKIM_SELECTOR}.private" || true
|
||||
chmod 600 "${KEY_DIR}/${DKIM_SELECTOR}.private" || true
|
||||
fi
|
||||
fi
|
||||
|
||||
# KeyTable (Selector → Keydatei)
|
||||
# KeyTable
|
||||
cat >/etc/opendkim/KeyTable <<CONF
|
||||
${DKIM_SELECTOR}._domainkey.${BASE_DOMAIN} ${BASE_DOMAIN}:${DKIM_SELECTOR}:${KEY_PRIV}
|
||||
CONF
|
||||
chown opendkim:opendkim /etc/opendkim/KeyTable
|
||||
chmod 640 /etc/opendkim/KeyTable
|
||||
|
||||
# SigningTable (welche From:-Domains werden womit signiert)
|
||||
# SigningTable
|
||||
cat >/etc/opendkim/SigningTable <<CONF
|
||||
*@${BASE_DOMAIN} ${DKIM_SELECTOR}._domainkey.${BASE_DOMAIN}
|
||||
CONF
|
||||
|
|
@ -104,7 +99,6 @@ Mode sv
|
|||
Socket inet:8891@127.0.0.1
|
||||
Canonicalization relaxed/simple
|
||||
|
||||
# Nicht blockieren, wenn mal was fehlt
|
||||
On-BadSignature accept
|
||||
On-Default accept
|
||||
On-KeyNotFound accept
|
||||
|
|
@ -113,7 +107,6 @@ On-NoSignature accept
|
|||
LogWhy yes
|
||||
OversignHeaders From
|
||||
|
||||
# Tabellen/Listen
|
||||
KeyTable /etc/opendkim/KeyTable
|
||||
SigningTable refile:/etc/opendkim/SigningTable
|
||||
ExternalIgnoreList /etc/opendkim/TrustedHosts
|
||||
|
|
@ -131,11 +124,9 @@ systemctl enable --now opendkim || true
|
|||
systemctl restart opendkim || true
|
||||
systemctl restart rspamd || true
|
||||
|
||||
# ---------------------------
|
||||
# Postfix: Milter-Anbindung prüfen/setzen (nur ergänzen, nicht zerstören)
|
||||
# ---------------------------
|
||||
# Diese Werte setzt dein Postfix-Skript normalerweise bereits.
|
||||
# Hier nur als Absicherung, falls noch leer.
|
||||
# ──────────────────────────────────────────────────────────────────────────────
|
||||
# Postfix: Milter-Anbindung (nur setzen, wenn leer)
|
||||
# ──────────────────────────────────────────────────────────────────────────────
|
||||
need_set() {
|
||||
local key="$1"
|
||||
local cur
|
||||
|
|
@ -152,14 +143,13 @@ fi
|
|||
|
||||
systemctl reload postfix || true
|
||||
|
||||
# ---------------------------
|
||||
# Hinweise (einmalig, nicht kritisch)
|
||||
# ---------------------------
|
||||
# ──────────────────────────────────────────────────────────────────────────────
|
||||
# Hinweis
|
||||
# ──────────────────────────────────────────────────────────────────────────────
|
||||
if [[ ! -s "${KEY_PRIV}" ]]; then
|
||||
echo "[!] OpenDKIM: Kein Private Key gefunden unter: ${KEY_PRIV}"
|
||||
echo " - Wenn deine App die Keys verwaltet, lege die Private-Key-Datei genau dort ab"
|
||||
echo " (Owner: opendkim:opendkim, Mode: 600) und passe ggf. DKIM_SELECTOR/BASIS_DOMAIN an."
|
||||
echo " - Oder setze DKIM_GENERATE=1 und starte dieses Skript erneut, um einen Key zu erzeugen."
|
||||
echo " - Lege dort den Private Key ab (opendkim:opendkim, 600) ODER"
|
||||
echo " - setze DKIM_GENERATE=1 und starte dieses Skript erneut."
|
||||
fi
|
||||
|
||||
echo "[✓] Rspamd + OpenDKIM fertig. Postfix ist an Rspamd (11332) und OpenDKIM (8891) angebunden."
|
||||
|
|
@ -168,25 +158,191 @@ echo "[✓] Rspamd + OpenDKIM fertig. Postfix ist an Rspamd (11332) und OpenDKIM
|
|||
#set -euo pipefail
|
||||
#source ./lib.sh
|
||||
#
|
||||
#log "Rspamd + OpenDKIM …"
|
||||
#log "Rspamd + OpenDKIM einrichten …"
|
||||
#
|
||||
#cat > /etc/rspamd/local.d/worker-controller.inc <<'CONF'
|
||||
#password = "admin";
|
||||
## ---------------------------
|
||||
## Variablen / Defaults
|
||||
## ---------------------------
|
||||
## Installer-Variablen laden, falls vorhanden
|
||||
#set +u
|
||||
#[ -r /etc/mailwolt/installer.env ] && . /etc/mailwolt/installer.env
|
||||
#set -u
|
||||
#
|
||||
#BASE_DOMAIN="${BASE_DOMAIN:-example.com}"
|
||||
#DKIM_SELECTOR="${DKIM_SELECTOR:-mwl1}"
|
||||
#DKIM_GENERATE="${DKIM_GENERATE:-0}" # 1 = Key erzeugen, falls fehlt
|
||||
#RSPAMD_CONTROLLER_PASSWORD="${RSPAMD_CONTROLLER_PASSWORD:-admin}"
|
||||
#
|
||||
## ---------------------------
|
||||
## Rspamd: Controller + Milter
|
||||
## ---------------------------
|
||||
#install -d -m 0755 /etc/rspamd/local.d
|
||||
#
|
||||
## Controller-Passwort gehasht schreiben
|
||||
#if command -v rspamadm >/dev/null 2>&1; then
|
||||
# RSPAMD_HASH="$(rspamadm pw -p "${RSPAMD_CONTROLLER_PASSWORD}")"
|
||||
#else
|
||||
# # Fallback: falls rspamadm noch nicht verfügbar ist (sollte selten sein)
|
||||
# # schreibe Klartext, damit Rspamd danach startbar ist; Hashen kann im nächsten Lauf erfolgen.
|
||||
# RSPAMD_HASH="${RSPAMD_CONTROLLER_PASSWORD}"
|
||||
#fi
|
||||
#
|
||||
#cat >/etc/rspamd/local.d/worker-controller.inc <<CONF
|
||||
#password = "${RSPAMD_HASH}";
|
||||
#bind_socket = "127.0.0.1:11334";
|
||||
#CONF
|
||||
#
|
||||
## Normal-Worker (Milter-Port für Postfix)
|
||||
#cat >/etc/rspamd/local.d/worker-normal.inc <<'CONF'
|
||||
#bind_socket = "127.0.0.1:11332";
|
||||
#CONF
|
||||
#
|
||||
## Authentication-Results Header schreiben (praktisch zum Debuggen)
|
||||
#cat >/etc/rspamd/local.d/milter_headers.conf <<'CONF'
|
||||
#use = ["authentication-results"];
|
||||
#header = "Authentication-Results";
|
||||
#CONF
|
||||
#
|
||||
#systemctl enable --now rspamd || true
|
||||
#
|
||||
#cat > /etc/opendkim.conf <<'CONF'
|
||||
#Syslog yes
|
||||
#UMask 002
|
||||
#Mode sv
|
||||
#Socket inet:8891@127.0.0.1
|
||||
#Canonicalization relaxed/simple
|
||||
#On-BadSignature accept
|
||||
#On-Default accept
|
||||
#On-KeyNotFound accept
|
||||
#On-NoSignature accept
|
||||
#LogWhy yes
|
||||
#OversignHeaders From
|
||||
## ---------------------------
|
||||
## OpenDKIM Grund-Setup
|
||||
## ---------------------------
|
||||
#install -d -m 0755 /etc/opendkim
|
||||
#install -d -m 0750 /etc/opendkim/keys
|
||||
#chown -R opendkim:opendkim /etc/opendkim
|
||||
#chmod 750 /etc/opendkim/keys
|
||||
#
|
||||
## TrustedHosts (wer signieren darf)
|
||||
#cat >/etc/opendkim/TrustedHosts <<'CONF'
|
||||
#127.0.0.1
|
||||
#::1
|
||||
#localhost
|
||||
#CONF
|
||||
#chown opendkim:opendkim /etc/opendkim/TrustedHosts
|
||||
#chmod 640 /etc/opendkim/TrustedHosts
|
||||
#
|
||||
## Key-/Signing-Tabellen vorbereiten
|
||||
#KEY_DIR="/etc/opendkim/keys/${BASE_DOMAIN}"
|
||||
#KEY_PRIV="${KEY_DIR}/${DKIM_SELECTOR}.private"
|
||||
#
|
||||
#install -d -m 0750 -o opendkim -g opendkim "${KEY_DIR}"
|
||||
#
|
||||
## Falls gewünscht: fehlenden Key erzeugen
|
||||
#if [[ "${DKIM_GENERATE}" = "1" && ! -s "${KEY_PRIV}" ]]; then
|
||||
# if command -v opendkim-genkey >/dev/null 2>&1; then
|
||||
# opendkim-genkey -b 2048 -s "${DKIM_SELECTOR}" -d "${BASE_DOMAIN}" -D "${KEY_DIR}"
|
||||
# # opendkim legt .private und .txt an (Selector.*)
|
||||
# chown opendkim:opendkim "${KEY_DIR}/${DKIM_SELECTOR}.private" || true
|
||||
# chmod 600 "${KEY_DIR}/${DKIM_SELECTOR}.private" || true
|
||||
# fi
|
||||
#fi
|
||||
#
|
||||
## KeyTable (Selector → Keydatei)
|
||||
#cat >/etc/opendkim/KeyTable <<CONF
|
||||
#${DKIM_SELECTOR}._domainkey.${BASE_DOMAIN} ${BASE_DOMAIN}:${DKIM_SELECTOR}:${KEY_PRIV}
|
||||
#CONF
|
||||
#chown opendkim:opendkim /etc/opendkim/KeyTable
|
||||
#chmod 640 /etc/opendkim/KeyTable
|
||||
#
|
||||
## SigningTable (welche From:-Domains werden womit signiert)
|
||||
#cat >/etc/opendkim/SigningTable <<CONF
|
||||
#*@${BASE_DOMAIN} ${DKIM_SELECTOR}._domainkey.${BASE_DOMAIN}
|
||||
#CONF
|
||||
#chown opendkim:opendkim /etc/opendkim/SigningTable
|
||||
#chmod 640 /etc/opendkim/SigningTable
|
||||
#
|
||||
## Hauptkonfiguration
|
||||
#cat >/etc/opendkim.conf <<'CONF'
|
||||
#Syslog yes
|
||||
#UMask 002
|
||||
#Mode sv
|
||||
#Socket inet:8891@127.0.0.1
|
||||
#Canonicalization relaxed/simple
|
||||
#
|
||||
## Nicht blockieren, wenn mal was fehlt
|
||||
#On-BadSignature accept
|
||||
#On-Default accept
|
||||
#On-KeyNotFound accept
|
||||
#On-NoSignature accept
|
||||
#
|
||||
#LogWhy yes
|
||||
#OversignHeaders From
|
||||
#
|
||||
## Tabellen/Listen
|
||||
#KeyTable /etc/opendkim/KeyTable
|
||||
#SigningTable refile:/etc/opendkim/SigningTable
|
||||
#ExternalIgnoreList /etc/opendkim/TrustedHosts
|
||||
#InternalHosts /etc/opendkim/TrustedHosts
|
||||
#
|
||||
#UserID opendkim:opendkim
|
||||
#AutoRestart yes
|
||||
#AutoRestartRate 10/1h
|
||||
#Background yes
|
||||
#DNSTimeout 5
|
||||
#SignatureAlgorithm rsa-sha256
|
||||
#CONF
|
||||
#
|
||||
#systemctl enable --now opendkim || true
|
||||
#systemctl restart opendkim || true
|
||||
#systemctl restart rspamd || true
|
||||
#
|
||||
## ---------------------------
|
||||
## Postfix: Milter-Anbindung prüfen/setzen (nur ergänzen, nicht zerstören)
|
||||
## ---------------------------
|
||||
## Diese Werte setzt dein Postfix-Skript normalerweise bereits.
|
||||
## Hier nur als Absicherung, falls noch leer.
|
||||
#need_set() {
|
||||
# local key="$1"
|
||||
# local cur
|
||||
# cur="$(postconf -h "$key" 2>/dev/null || true)"
|
||||
# [[ -z "$cur" ]]
|
||||
#}
|
||||
#
|
||||
#if need_set smtpd_milters; then
|
||||
# /usr/sbin/postconf -e "smtpd_milters = inet:127.0.0.1:11332, inet:127.0.0.1:8891"
|
||||
#fi
|
||||
#if need_set non_smtpd_milters; then
|
||||
# /usr/sbin/postconf -e "non_smtpd_milters = inet:127.0.0.1:11332, inet:127.0.0.1:8891"
|
||||
#fi
|
||||
#
|
||||
#systemctl reload postfix || true
|
||||
#
|
||||
## ---------------------------
|
||||
## Hinweise (einmalig, nicht kritisch)
|
||||
## ---------------------------
|
||||
#if [[ ! -s "${KEY_PRIV}" ]]; then
|
||||
# echo "[!] OpenDKIM: Kein Private Key gefunden unter: ${KEY_PRIV}"
|
||||
# echo " - Wenn deine App die Keys verwaltet, lege die Private-Key-Datei genau dort ab"
|
||||
# echo " (Owner: opendkim:opendkim, Mode: 600) und passe ggf. DKIM_SELECTOR/BASIS_DOMAIN an."
|
||||
# echo " - Oder setze DKIM_GENERATE=1 und starte dieses Skript erneut, um einen Key zu erzeugen."
|
||||
#fi
|
||||
#
|
||||
#echo "[✓] Rspamd + OpenDKIM fertig. Postfix ist an Rspamd (11332) und OpenDKIM (8891) angebunden."
|
||||
#
|
||||
###!/usr/bin/env bash
|
||||
##set -euo pipefail
|
||||
##source ./lib.sh
|
||||
##
|
||||
##log "Rspamd + OpenDKIM …"
|
||||
##
|
||||
##cat > /etc/rspamd/local.d/worker-controller.inc <<'CONF'
|
||||
##password = "admin";
|
||||
##bind_socket = "127.0.0.1:11334";
|
||||
##CONF
|
||||
##systemctl enable --now rspamd || true
|
||||
##
|
||||
##cat > /etc/opendkim.conf <<'CONF'
|
||||
##Syslog yes
|
||||
##UMask 002
|
||||
##Mode sv
|
||||
##Socket inet:8891@127.0.0.1
|
||||
##Canonicalization relaxed/simple
|
||||
##On-BadSignature accept
|
||||
##On-Default accept
|
||||
##On-KeyNotFound accept
|
||||
##On-NoSignature accept
|
||||
##LogWhy yes
|
||||
##OversignHeaders From
|
||||
##CONF
|
||||
##systemctl enable --now opendkim || true
|
||||
|
|
|
|||
Loading…
Reference in New Issue