選択できるのは25トピックまでです。 トピックは、先頭が英数字で、英数字とダッシュ('-')を使用した35文字以内のものにしてください。

emailwiz.sh 11 KiB

5年前
5年前
5年前
5年前
5年前
5年前
5年前
4年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
5年前
4年前
4年前
4年前
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323
  1. #!/bin/sh
  2. # THE SETUP
  3. # Mail will be stored in non-retarded Maildirs because it's $currentyear. This
  4. # makes it easier for use with isync, which is what I care about so I can have
  5. # an offline repo of mail.
  6. # The mailbox names are: Inbox, Sent, Drafts, Archive, Junk, Trash
  7. # Use the typical unix login system for mail users. Users will log into their
  8. # email with their passnames on the server. No usage of a redundant mySQL
  9. # database to do this.
  10. # DEPENDENCIES BEFORE RUNNING
  11. # 1. Have a Debian system with a static IP and all that. Pretty much any
  12. # default VPS offered by a company will have all the basic stuff you need. This
  13. # script might run on Ubuntu as well. Haven't tried it. If you have, tell me
  14. # what happens.
  15. # 2. Have a Let's Encrypt SSL certificate for $maildomain. You might need one
  16. # for $domain as well, but they're free with Let's Encypt so you should have
  17. # them anyway.
  18. # 3. If you've been toying around with your server settings trying to get
  19. # postfix/dovecot/etc. working before running this, I recommend you `apt purge`
  20. # everything first because this script is build on top of only the defaults.
  21. # Clear out /etc/postfix and /etc/dovecot yourself if needbe.
  22. # NOTE WHILE INSTALLING
  23. # On installation of Postfix, select "Internet Site" and put in TLD (without
  24. # `mail.` before it).
  25. echo "Installing programs..."
  26. apt install postfix dovecot-imapd dovecot-sieve opendkim spamassassin spamc
  27. # Check if OpenDKIM is installed and install it if not.
  28. which opendkim-genkey >/dev/null 2>&1 || apt install opendkim-tools
  29. domain="$(cat /etc/mailname)"
  30. subdom=${MAIL_SUBDOM:-mail}
  31. maildomain="$subdom.$domain"
  32. certdir="/etc/letsencrypt/live/$maildomain"
  33. [ ! -d "$certdir" ] && certdir="$(dirname "$(certbot certificates 2>/dev/null | grep "$maildomain\|*.$domain" -A 2 | awk '/Certificate Path/ {print $3}' | head -n1)")"
  34. [ ! -d "$certdir" ] && echo "Note! You must first have a Let's Encrypt Certbot HTTPS/SSL Certificate for $maildomain.
  35. Use Let's Encrypt's Certbot to get that and then rerun this script.
  36. You may need to set up a dummy $maildomain site in nginx or Apache for that to work." && exit
  37. # NOTE ON POSTCONF COMMANDS
  38. # The `postconf` command literally just adds the line in question to
  39. # /etc/postfix/main.cf so if you need to debug something, go there. It replaces
  40. # any other line that sets the same setting, otherwise it is appended to the
  41. # end of the file.
  42. echo "Configuring Postfix's main.cf..."
  43. # Change the cert/key files to the default locations of the Let's Encrypt cert/key
  44. postconf -e "smtpd_tls_key_file=$certdir/privkey.pem"
  45. postconf -e "smtpd_tls_cert_file=$certdir/fullchain.pem"
  46. postconf -e "smtpd_use_tls = yes"
  47. postconf -e "smtpd_tls_auth_only = yes"
  48. postconf -e "smtp_tls_security_level = may"
  49. postconf -e "smtp_tls_loglevel = 1"
  50. postconf -e "smtp_tls_CAfile=$certdir/cert.pem"
  51. postconf -e "smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1"
  52. postconf -e "smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1"
  53. postconf -e "smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1"
  54. postconf -e "smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1"
  55. postconf -e "tls_preempt_cipherlist = yes"
  56. postconf -e "smtpd_tls_exclude_ciphers = aNULL, LOW, EXP, MEDIUM, ADH, AECDH, MD5,
  57. DSS, ECDSA, CAMELLIA128, 3DES, CAMELLIA256,
  58. RSA+AES, eNULL"
  59. # Here we tell Postfix to look to Dovecot for authenticating users/passwords.
  60. # Dovecot will be putting an authentication socket in /var/spool/postfix/private/auth
  61. postconf -e "smtpd_sasl_auth_enable = yes"
  62. postconf -e "smtpd_sasl_type = dovecot"
  63. postconf -e "smtpd_sasl_path = private/auth"
  64. #postconf -e "smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination"
  65. # NOTE: the trailing slash here, or for any directory name in the home_mailbox
  66. # command, is necessary as it distinguishes a maildir (which is the actual
  67. # directories that what we want) from a spoolfile (which is what old unix
  68. # boomers want and no one else).
  69. postconf -e "home_mailbox = Mail/Inbox/"
  70. # Research this one:
  71. #postconf -e "mailbox_command ="
  72. # master.cf
  73. echo "Configuring Postfix's master.cf..."
  74. sed -i "/^\s*-o/d;/^\s*submission/d;/^\s*smtp/d" /etc/postfix/master.cf
  75. echo "smtp unix - - n - - smtp
  76. smtp inet n - y - - smtpd
  77. -o content_filter=spamassassin
  78. submission inet n - y - - smtpd
  79. -o syslog_name=postfix/submission
  80. -o smtpd_tls_security_level=encrypt
  81. -o smtpd_sasl_auth_enable=yes
  82. -o smtpd_tls_auth_only=yes
  83. smtps inet n - y - - smtpd
  84. -o syslog_name=postfix/smtps
  85. -o smtpd_tls_wrappermode=yes
  86. -o smtpd_sasl_auth_enable=yes
  87. spamassassin unix - n n - - pipe
  88. user=debian-spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f \${sender} \${recipient}" >> /etc/postfix/master.cf
  89. # By default, dovecot has a bunch of configs in /etc/dovecot/conf.d/ These
  90. # files have nice documentation if you want to read it, but it's a huge pain to
  91. # go through them to organize. Instead, we simply overwrite
  92. # /etc/dovecot/dovecot.conf because it's easier to manage. You can get a backup
  93. # of the original in /usr/share/dovecot if you want.
  94. echo "Creating Dovecot config..."
  95. echo "# Dovecot config
  96. # Note that in the dovecot conf, you can use:
  97. # %u for username
  98. # %n for the name in name@domain.tld
  99. # %d for the domain
  100. # %h the user's home directory
  101. # If you're not a brainlet, SSL must be set to required.
  102. ssl = required
  103. ssl_cert = <$certdir/fullchain.pem
  104. ssl_key = <$certdir/privkey.pem
  105. ssl_min_protocol = TLSv1.2
  106. ssl_cipher_list = ALL:!RSA:!CAMELLIA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SHA1:!SHA256:!SHA384:!LOW@STRENGTH
  107. ssl_prefer_server_ciphers = yes
  108. ssl_dh = </usr/share/dovecot/dh.pem
  109. # Plaintext login. This is safe and easy thanks to SSL.
  110. auth_mechanisms = plain login
  111. auth_username_format = %n
  112. protocols = \$protocols imap
  113. # Search for valid users in /etc/passwd
  114. userdb {
  115. driver = passwd
  116. }
  117. #Fallback: Use plain old PAM to find user passwords
  118. passdb {
  119. driver = pam
  120. }
  121. # Our mail for each user will be in ~/Mail, and the inbox will be ~/Mail/Inbox
  122. # The LAYOUT option is also important because otherwise, the boxes will be \`.Sent\` instead of \`Sent\`.
  123. mail_location = maildir:~/Mail:INBOX=~/Mail/Inbox:LAYOUT=fs
  124. namespace inbox {
  125. inbox = yes
  126. mailbox Drafts {
  127. special_use = \\Drafts
  128. auto = subscribe
  129. }
  130. mailbox Junk {
  131. special_use = \\Junk
  132. auto = subscribe
  133. autoexpunge = 30d
  134. }
  135. mailbox Sent {
  136. special_use = \\Sent
  137. auto = subscribe
  138. }
  139. mailbox Trash {
  140. special_use = \\Trash
  141. }
  142. mailbox Archive {
  143. special_use = \\Archive
  144. }
  145. }
  146. # Here we let Postfix use Dovecot's authetication system.
  147. service auth {
  148. unix_listener /var/spool/postfix/private/auth {
  149. mode = 0660
  150. user = postfix
  151. group = postfix
  152. }
  153. }
  154. protocol lda {
  155. mail_plugins = \$mail_plugins sieve
  156. }
  157. protocol lmtp {
  158. mail_plugins = \$mail_plugins sieve
  159. }
  160. plugin {
  161. sieve = ~/.dovecot.sieve
  162. sieve_default = /var/lib/dovecot/sieve/default.sieve
  163. #sieve_global_path = /var/lib/dovecot/sieve/default.sieve
  164. sieve_dir = ~/.sieve
  165. sieve_global_dir = /var/lib/dovecot/sieve/
  166. }
  167. " > /etc/dovecot/dovecot.conf
  168. mkdir /var/lib/dovecot/sieve/
  169. echo "require [\"fileinto\", \"mailbox\"];
  170. if header :contains \"X-Spam-Flag\" \"YES\"
  171. {
  172. fileinto \"Junk\";
  173. }" > /var/lib/dovecot/sieve/default.sieve
  174. cut -d: -f1 /etc/passwd | grep -q "^vmail" || useradd vmail
  175. chown -R vmail:vmail /var/lib/dovecot
  176. sievec /var/lib/dovecot/sieve/default.sieve
  177. echo "Preparing user authentication..."
  178. grep -q nullok /etc/pam.d/dovecot ||
  179. echo "auth required pam_unix.so nullok
  180. account required pam_unix.so" >> /etc/pam.d/dovecot
  181. # OpenDKIM
  182. # A lot of the big name email services, like Google, will automatically reject
  183. # as spam unfamiliar and unauthenticated email addresses. As in, the server
  184. # will flatly reject the email, not even delivering it to someone's Spam
  185. # folder.
  186. # OpenDKIM is a way to authenticate your email so you can send to such services
  187. # without a problem.
  188. # TODO: add opendkim-tools ?
  189. # Create an OpenDKIM key in the proper place with proper permissions.
  190. echo "Generating OpenDKIM keys..."
  191. mkdir -p /etc/postfix/dkim
  192. opendkim-genkey -D /etc/postfix/dkim/ -d "$domain" -s "$subdom"
  193. chgrp opendkim /etc/postfix/dkim/*
  194. chmod g+r /etc/postfix/dkim/*
  195. # Generate the OpenDKIM info:
  196. echo "Configuring OpenDKIM..."
  197. grep -q "$domain" /etc/postfix/dkim/keytable 2>/dev/null ||
  198. echo "$subdom._domainkey.$domain $domain:$subdom:/etc/postfix/dkim/$subdom.private" >> /etc/postfix/dkim/keytable
  199. grep -q "$domain" /etc/postfix/dkim/signingtable 2>/dev/null ||
  200. echo "*@$domain $subdom._domainkey.$domain" >> /etc/postfix/dkim/signingtable
  201. grep -q "127.0.0.1" /etc/postfix/dkim/trustedhosts 2>/dev/null ||
  202. echo "127.0.0.1
  203. 10.1.0.0/16
  204. 1.2.3.4/24" >> /etc/postfix/dkim/trustedhosts
  205. # ...and source it from opendkim.conf
  206. grep -q "^KeyTable" /etc/opendkim.conf 2>/dev/null || echo "KeyTable file:/etc/postfix/dkim/keytable
  207. SigningTable refile:/etc/postfix/dkim/signingtable
  208. InternalHosts refile:/etc/postfix/dkim/trustedhosts" >> /etc/opendkim.conf
  209. sed -i '/^#Canonicalization/s/simple/relaxed\/simple/' /etc/opendkim.conf
  210. sed -i '/^#Canonicalization/s/^#//' /etc/opendkim.conf
  211. sed -e '/Socket/s/^#*/#/' -i /etc/opendkim.conf
  212. grep -q "^Socket\s*inet:12301@localhost" /etc/opendkim.conf || echo "Socket inet:12301@localhost" >> /etc/opendkim.conf
  213. # OpenDKIM daemon settings, removing previously activated socket.
  214. sed -i "/^SOCKET/d" /etc/default/opendkim && echo "SOCKET=\"inet:12301@localhost\"" >> /etc/default/opendkim
  215. # Here we add to postconf the needed settings for working with OpenDKIM
  216. echo "Configuring Postfix with OpenDKIM settings..."
  217. postconf -e "smtpd_sasl_security_options = noanonymous, noplaintext"
  218. postconf -e "smtpd_sasl_tls_security_options = noanonymous"
  219. postconf -e "myhostname = $maildomain"
  220. postconf -e "milter_default_action = accept"
  221. postconf -e "milter_protocol = 6"
  222. postconf -e "smtpd_milters = inet:localhost:12301"
  223. postconf -e "non_smtpd_milters = inet:localhost:12301"
  224. postconf -e "mailbox_command = /usr/lib/dovecot/deliver"
  225. for x in dovecot postfix opendkim spamassassin; do
  226. printf "Restarting %s..." "$x"
  227. service "$x" restart && printf " ...done\\n"
  228. done
  229. pval="$(tr -d "\n" </etc/postfix/dkim/$subdom.txt | sed "s/k=rsa.* \"p=/k=rsa; p=/;s/\"\s*\"//;s/\"\s*).*//" | grep -o "p=.*")"
  230. dkimentry="$subdom._domainkey.$domain TXT v=DKIM1; k=rsa; $pval"
  231. dmarcentry="_dmarc.$domain TXT v=DMARC1; p=none; rua=mailto:dmarc@$domain; fo=1"
  232. spfentry="@ TXT v=spf1 mx a:$maildomain -all"
  233. useradd -m -G mail dmarc
  234. echo "$dkimentry
  235. $dmarcentry
  236. $spfentry" > "$HOME/dns_emailwizard"
  237. echo "
  238. _ _
  239. | \ | | _____ ___
  240. | \| |/ _ \ \ /\ / (_)
  241. | |\ | (_) \ V V / _
  242. |_| \_|\___/ \_/\_/ (_)
  243. Add these three records to your DNS TXT records on either your registrar's site
  244. or your DNS server:
  245. $dkimentry
  246. $dmarcentry
  247. $spfentry
  248. NOTE: You may need to omit the \`.$domain\` portion at the beginning if
  249. inputting them in a registrar's web interface.
  250. Also saving these to ~/dns_emailwizard in case you want them in a file.
  251. Once you do that, you're done! Check the README for how to add users/accounts
  252. and how to log in."