From b657e768c9f9a9773b7767b286d1b16603ecd4ae Mon Sep 17 00:00:00 2001 From: Luke Smith Date: Wed, 28 Sep 2022 09:36:26 -0400 Subject: [PATCH 1/4] some anti-spam measures --- emailwiz.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/emailwiz.sh b/emailwiz.sh index 0fdd8a4..375131d 100755 --- a/emailwiz.sh +++ b/emailwiz.sh @@ -299,6 +299,10 @@ postconf -e 'milter_protocol = 6' postconf -e 'smtpd_milters = inet:localhost:12301' postconf -e 'non_smtpd_milters = inet:localhost:12301' postconf -e 'mailbox_command = /usr/lib/dovecot/deliver' +postconf -e 'smtpd_helo_required = yes' +postconf -e 'smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname' +postconf -e 'smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_sender_login_mismatch, reject_unknown_reverse_client_hostname, reject_unknown_sender_domain' + # A fix for "Opendkim won't start: can't open PID file?", as specified here: https://serverfault.com/a/847442 /lib/opendkim/opendkim.service.generate From 860185e557ed06e5e87003efbfdb9c8736846500 Mon Sep 17 00:00:00 2001 From: Luke Smith Date: Wed, 28 Sep 2022 11:18:05 -0400 Subject: [PATCH 2/4] store dkim keys in subdir for multiple domains --- emailwiz.sh | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/emailwiz.sh b/emailwiz.sh index 375131d..818cb3d 100755 --- a/emailwiz.sh +++ b/emailwiz.sh @@ -258,10 +258,10 @@ account required pam_unix.so' >> /etc/pam.d/dovecot # Create an OpenDKIM key in the proper place with proper permissions. echo 'Generating OpenDKIM keys...' -mkdir -p /etc/postfix/dkim -opendkim-genkey -D /etc/postfix/dkim/ -d "$domain" -s "$subdom" -chgrp opendkim /etc/postfix/dkim/* -chmod g+r /etc/postfix/dkim/* +mkdir -p "/etc/postfix/dkim/$domain" +opendkim-genkey -D "/etc/postfix/dkim/$domain" -d "$domain" -s "$subdom" +chgrp -R opendkim /etc/postfix/dkim/* +chmod -R g+r /etc/postfix/dkim/* # Generate the OpenDKIM info: echo 'Configuring OpenDKIM...' @@ -316,7 +316,7 @@ done # If ufw is used, enable the mail ports. pgrep ufw >/dev/null && { ufw allow 993; ufw allow 465 ; ufw allow 587; ufw allow 25 ;} -pval="$(tr -d '\n' Date: Sat, 1 Oct 2022 11:40:47 -0400 Subject: [PATCH 3/4] reject_unknown_recipient_domain --- emailwiz.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/emailwiz.sh b/emailwiz.sh index faa1a6d..e9fb562 100755 --- a/emailwiz.sh +++ b/emailwiz.sh @@ -94,7 +94,7 @@ postconf -e 'smtpd_sasl_type = dovecot' postconf -e 'smtpd_sasl_path = private/auth' # Sender and recipient restrictions -postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination' +postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_unknown_recipient_domain' # NOTE: the trailing slash here, or for any directory name in the home_mailbox # command, is necessary as it distinguishes a maildir (which is the actual From e8f52cebf81d7f1e4202111efd95f74d4b4c088d Mon Sep 17 00:00:00 2001 From: Luke Smith Date: Sun, 9 Oct 2022 15:28:43 -0400 Subject: [PATCH 4/4] dkim location fixed, close #240 --- emailwiz.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/emailwiz.sh b/emailwiz.sh index e9fb562..afb5c24 100755 --- a/emailwiz.sh +++ b/emailwiz.sh @@ -266,7 +266,7 @@ chmod -R g+r /etc/postfix/dkim/* # Generate the OpenDKIM info: echo 'Configuring OpenDKIM...' grep -q "$domain" /etc/postfix/dkim/keytable 2>/dev/null || -echo "$subdom._domainkey.$domain $domain:$subdom:/etc/postfix/dkim/$subdom.private" >> /etc/postfix/dkim/keytable +echo "$subdom._domainkey.$domain $domain:$subdom:/etc/postfix/dkim/$domain/$subdom.private" >> /etc/postfix/dkim/keytable grep -q "$domain" /etc/postfix/dkim/signingtable 2>/dev/null || echo "*@$domain $subdom._domainkey.$domain" >> /etc/postfix/dkim/signingtable