選択できるのは25トピックまでです。 トピックは、先頭が英数字で、英数字とダッシュ('-')を使用した35文字以内のものにしてください。

312 行
10 KiB

  1. #!/bin/sh
  2. # THE SETUP
  3. # Mail will be stored in non-retarded Maildirs because it's $currentyear. This
  4. # makes it easier for use with isync, which is what I care about so I can have
  5. # an offline repo of mail.
  6. # The mailbox names are: Inbox, Sent, Drafts, Archive, Junk, Trash
  7. # Use the typical unix login system for mail users. Users will log into their
  8. # email with their passnames on the server. No usage of a redundant mySQL
  9. # database to do this.
  10. # DEPENDENCIES BEFORE RUNNING
  11. # 1. Have a Debian system with a static IP and all that. Pretty much any
  12. # default VPS offered by a company will have all the basic stuff you need. This
  13. # script might run on Ubuntu as well. Haven't tried it. If you have, tell me
  14. # what happens.
  15. # 2. Have a Let's Encrypt SSL certificate for $maildomain. You might need one
  16. # for $domain as well, but they're free with Let's Encypt so you should have
  17. # them anyway.
  18. # 3. If you've been toying around with your server settings trying to get
  19. # postfix/dovecot/etc. working before running this, I recommend you `apt purge`
  20. # everything first because this script is build on top of only the defaults.
  21. # Clear out /etc/postfix and /etc/dovecot yourself if needbe.
  22. # NOTE WHILE INSTALLING
  23. # On installation of Postfix, select "Internet Site" and put in TLD (without
  24. # `mail.` before it).
  25. echo "Installing programs..."
  26. apt install postfix dovecot-imapd dovecot-sieve opendkim spamassassin spamc
  27. # Check if OpenDKIM is installed and install it if not.
  28. which opendkim-genkey >/dev/null 2>&1 || apt install opendkim-tools
  29. domain="$(cat /etc/mailname)"
  30. subdom="mail"
  31. maildomain="$subdom.$domain"
  32. certdir="/etc/letsencrypt/live/$maildomain"
  33. [ ! -d "$certdir" ] && certdir="$(dirname "$(certbot certificates 2>/dev/null | grep "$maildomain" -A 2 | awk '/Certificate Path/ {print $3}')")"
  34. [ ! -d "$certdir" ] && echo "Note! You must first have a Let's Encrypt Certbot HTTPS/SSL Certificate for $maildomain.
  35. Use Let's Encrypt's Certbot to get that and then rerun this script.
  36. You may need to set up a dummy $maildomain site in nginx or Apache for that to work." && exit
  37. # NOTE ON POSTCONF COMMANDS
  38. # The `postconf` command literally just adds the line in question to
  39. # /etc/postfix/main.cf so if you need to debug something, go there. It replaces
  40. # any other line that sets the same setting, otherwise it is appended to the
  41. # end of the file.
  42. echo "Configuring Postfix's main.cf..."
  43. # Change the cert/key files to the default locations of the Let's Encrypt cert/key
  44. postconf -e "smtpd_tls_key_file=$certdir/privkey.pem"
  45. postconf -e "smtpd_tls_cert_file=$certdir/fullchain.pem"
  46. postconf -e "smtpd_use_tls = yes"
  47. postconf -e "smtpd_tls_auth_only = yes"
  48. postconf -e "smtp_tls_security_level = may"
  49. postconf -e "smtp_tls_loglevel = 1"
  50. # Here we tell Postfix to look to Dovecot for authenticating users/passwords.
  51. # Dovecot will be putting an authentication socket in /var/spool/postfix/private/auth
  52. postconf -e "smtpd_sasl_auth_enable = yes"
  53. postconf -e "smtpd_sasl_type = dovecot"
  54. postconf -e "smtpd_sasl_path = private/auth"
  55. #postconf -e "smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination"
  56. # NOTE: the trailing slash here, or for any directory name in the home_mailbox
  57. # command, is necessary as it distinguishes a maildir (which is the actual
  58. # directories that what we want) from a spoolfile (which is what old unix
  59. # boomers want and no one else).
  60. postconf -e "home_mailbox = Mail/Inbox/"
  61. # Research this one:
  62. #postconf -e "mailbox_command ="
  63. # master.cf
  64. echo "Configuring Postfix's master.cf..."
  65. sed -i "/^\s*-o/d;/^\s*submission/d;/^\s*smtp/d" /etc/postfix/master.cf
  66. echo "smtp unix - - n - - smtp
  67. smtp inet n - y - - smtpd
  68. -o content_filter=spamassassin
  69. submission inet n - y - - smtpd
  70. -o syslog_name=postfix/submission
  71. -o smtpd_tls_security_level=encrypt
  72. -o smtpd_sasl_auth_enable=yes
  73. -o smtpd_tls_auth_only=yes
  74. smtps inet n - y - - smtpd
  75. -o syslog_name=postfix/smtps
  76. -o smtpd_tls_wrappermode=yes
  77. -o smtpd_sasl_auth_enable=yes
  78. spamassassin unix - n n - - pipe
  79. user=debian-spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f \${sender} \${recipient}" >> /etc/postfix/master.cf
  80. # By default, dovecot has a bunch of configs in /etc/dovecot/conf.d/ These
  81. # files have nice documentation if you want to read it, but it's a huge pain to
  82. # go through them to organize. Instead, we simply overwrite
  83. # /etc/dovecot/dovecot.conf because it's easier to manage. You can get a backup
  84. # of the original in /usr/share/dovecot if you want.
  85. echo "Creating Dovecot config..."
  86. echo "# Dovecot config
  87. # Note that in the dovecot conf, you can use:
  88. # %u for username
  89. # %n for the name in name@domain.tld
  90. # %d for the domain
  91. # %h the user's home directory
  92. # If you're not a brainlet, SSL must be set to required.
  93. ssl = required
  94. ssl_cert = <$certdir/fullchain.pem
  95. ssl_key = <$certdir/privkey.pem
  96. ssl_dh = </usr/share/dovecot/dh.pem
  97. # Plaintext login. This is safe and easy thanks to SSL.
  98. auth_mechanisms = plain login
  99. protocols = \$protocols imap
  100. # Search for valid users in /etc/passwd
  101. userdb {
  102. driver = passwd
  103. }
  104. #Fallback: Use plain old PAM to find user passwords
  105. passdb {
  106. driver = pam
  107. }
  108. # Our mail for each user will be in ~/Mail, and the inbox will be ~/Mail/Inbox
  109. # The LAYOUT option is also important because otherwise, the boxes will be \`.Sent\` instead of \`Sent\`.
  110. mail_location = maildir:~/Mail:INBOX=~/Mail/Inbox:LAYOUT=fs
  111. namespace inbox {
  112. inbox = yes
  113. mailbox Drafts {
  114. special_use = \\Drafts
  115. auto = subscribe
  116. }
  117. mailbox Junk {
  118. special_use = \\Junk
  119. auto = subscribe
  120. autoexpunge = 30d
  121. }
  122. mailbox Sent {
  123. special_use = \\Sent
  124. auto = subscribe
  125. }
  126. mailbox Trash {
  127. special_use = \\Trash
  128. }
  129. mailbox Archive {
  130. special_use = \\Archive
  131. }
  132. }
  133. # Here we let Postfix use Dovecot's authetication system.
  134. service auth {
  135. unix_listener /var/spool/postfix/private/auth {
  136. mode = 0660
  137. user = postfix
  138. group = postfix
  139. }
  140. }
  141. protocol lda {
  142. mail_plugins = \$mail_plugins sieve
  143. }
  144. protocol lmtp {
  145. mail_plugins = \$mail_plugins sieve
  146. }
  147. plugin {
  148. sieve = ~/.dovecot.sieve
  149. sieve_default = /var/lib/dovecot/sieve/default.sieve
  150. #sieve_global_path = /var/lib/dovecot/sieve/default.sieve
  151. sieve_dir = ~/.sieve
  152. sieve_global_dir = /var/lib/dovecot/sieve/
  153. }
  154. " > /etc/dovecot/dovecot.conf
  155. mkdir /var/lib/dovecot/sieve/
  156. echo "require [\"fileinto\", \"mailbox\"];
  157. if header :contains \"X-Spam-Flag\" \"YES\"
  158. {
  159. fileinto \"Junk\";
  160. }" > /var/lib/dovecot/sieve/default.sieve
  161. cut -d: -f1 /etc/passwd | grep -q "^vmail" || useradd vmail
  162. chown -R vmail:vmail /var/lib/dovecot
  163. sievec /var/lib/dovecot/sieve/default.sieve
  164. echo "Preparing user authetication..."
  165. grep -q nullok /etc/pam.d/dovecot ||
  166. echo "auth required pam_unix.so nullok
  167. account required pam_unix.so" >> /etc/pam.d/dovecot
  168. # OpenDKIM
  169. # A lot of the big name email services, like Google, will automatically
  170. # rejectmark as spam unfamiliar and unauthenticated email addresses. As in, the
  171. # server will flattly reject the email, not even deliverring it to someone's
  172. # Spam folder.
  173. # OpenDKIM is a way to authenticate your email so you can send to such services
  174. # without a problem.
  175. # TODO: add opendkim-tools ?
  176. # Create an OpenDKIM key in the proper place with proper permissions.
  177. echo "Generating OpenDKIM keys..."
  178. mkdir -p /etc/postfix/dkim
  179. opendkim-genkey -D /etc/postfix/dkim/ -d "$domain" -s "$subdom"
  180. chgrp opendkim /etc/postfix/dkim/*
  181. chmod g+r /etc/postfix/dkim/*
  182. # Generate the OpenDKIM info:
  183. echo "Configuring OpenDKIM..."
  184. grep -q "$domain" /etc/postfix/dkim/keytable 2>/dev/null ||
  185. echo "$subdom._domainkey.$domain $domain:mail:/etc/postfix/dkim/mail.private" >> /etc/postfix/dkim/keytable
  186. grep -q "$domain" /etc/postfix/dkim/signingtable 2>/dev/null ||
  187. echo "*@$domain $subdom._domainkey.$domain" >> /etc/postfix/dkim/signingtable
  188. grep -q "127.0.0.1" /etc/postfix/dkim/trustedhosts 2>/dev/null ||
  189. echo "127.0.0.1
  190. 10.1.0.0/16
  191. 1.2.3.4/24" >> /etc/postfix/dkim/trustedhosts
  192. # ...and source it from opendkim.conf
  193. grep -q "^KeyTable" /etc/opendkim.conf 2>/dev/null || echo "KeyTable file:/etc/postfix/dkim/keytable
  194. SigningTable refile:/etc/postfix/dkim/signingtable
  195. InternalHosts refile:/etc/postfix/dkim/trustedhosts" >> /etc/opendkim.conf
  196. sed -i '/^#Canonicalization/s/simple/relaxed\/simple/' /etc/opendkim.conf
  197. sed -i '/^#Canonicalization/s/^#//' /etc/opendkim.conf
  198. sed -e '/Socket/s/^#*/#/' -i /etc/opendkim.conf
  199. grep -q "^Socket\s*inet:12301@localhost" /etc/opendkim.conf || echo "Socket inet:12301@localhost" >> /etc/opendkim.conf
  200. # OpenDKIM daemon settings, removing previously activated socket.
  201. sed -i "/^SOCKET/d" /etc/default/opendkim && echo "SOCKET=\"inet:12301@localhost\"" >> /etc/default/opendkim
  202. # Here we add to postconf the needed settings for working with OpenDKIM
  203. echo "Configuring Postfix with OpenDKIM settings..."
  204. postconf -e "smtpd_sasl_security_options = noanonymous, noplaintext"
  205. postconf -e "smtpd_sasl_tls_security_options = noanonymous"
  206. postconf -e "myhostname = $maildomain"
  207. postconf -e "milter_default_action = accept"
  208. postconf -e "milter_protocol = 6"
  209. postconf -e "smtpd_milters = inet:localhost:12301"
  210. postconf -e "non_smtpd_milters = inet:localhost:12301"
  211. postconf -e "mailbox_command = /usr/lib/dovecot/deliver"
  212. for x in dovecot postfix opendkim spamassassin; do
  213. printf "Restarting %s..." "$x"
  214. service "$x" restart && printf " ...done\\n"
  215. done
  216. pval="$(tr -d "\n" </etc/postfix/dkim/$subdom.txt | sed "s/k=rsa.* \"p=/k=rsa; p=/;s/\"\s*\"//;s/\"\s*).*//" | grep -o "p=.*")"
  217. dkimentry="$subdom._domainkey.$domain TXT v=DKIM1; k=rsa; $pval"
  218. dmarcentry="_dmarc.$domain TXT v=DMARC1; p=none; rua=mailto:dmarc@$domain; fo=1"
  219. spfentry="@ TXT v=spf1 mx a:$maildomain -all"
  220. useradd -m -G mail dmarc
  221. echo "$dkimentry
  222. $dmarcentry
  223. $spfentry" > "$HOME/dns_emailwizard"
  224. echo "
  225. _ _
  226. | \ | | _____ ___
  227. | \| |/ _ \ \ /\ / (_)
  228. | |\ | (_) \ V V / _
  229. |_| \_|\___/ \_/\_/ (_)
  230. Add these three records to your DNS TXT records on either your registrar's site
  231. or your DNS server:
  232. $dkimentry
  233. $dmarcentry
  234. $spfentry
  235. NOTE: You may need to omit the \`.$domain\` portion at the beginning if
  236. inputting them in a registrar's web interface.
  237. Also saving these to ~/dns_emailwizard in case you want them in a file.
  238. Once you do that, you're done! Check the README for how to add users/accounts
  239. and how to log in."