diff options
Diffstat (limited to 'email-wizard.sh')
| -rwxr-xr-x | email-wizard.sh | 472 |
1 files changed, 472 insertions, 0 deletions
diff --git a/email-wizard.sh b/email-wizard.sh new file mode 100755 index 0000000..e099dd9 --- /dev/null +++ b/email-wizard.sh @@ -0,0 +1,472 @@ +#!/bin/sh + +# BEFORE INSTALLING + +# Have a Debian or Ubuntu server with a static IP and DNS records (usually +# A/AAAA) that point your domain name to it. + +# NOTE WHILE INSTALLING + +# On installation of Postfix, select "Internet Site" and put in TLD (without +# `mail.` before it). + +# AFTER INSTALLING + +# More DNS records will be given to you to install. One of them will be +# different for every installation and is uniquely generated on your machine. + +umask 0022 + +install_packages="postfix postfix-pcre dovecot-imapd dovecot-pop3d dovecot-sieve opendkim opendkim-tools spamassassin spamc net-tools fail2ban bind9-host" + +systemctl -q stop dovecot +systemctl -q stop postfix +apt-get purge ?config-files -y $install_packages +apt-get install -y $install_packages + +domain="$(cat /etc/mailname)" +subdom=${MAIL_SUBDOM:-mail} +maildomain="$subdom.$domain" +certdir="/etc/letsencrypt/live/$maildomain" + +selfsigned="no" # yes no +allow_suboptimal_ciphers="yes" #yes no +mailbox_format="maildir" # maildir sdbox +allowed_protocols=" imap pop3 " #imap pop3 + +use_cert_config="no" +country_name="" # IT US UK IN etc etc +state_or_province_name="" +organization_name="" +common_name="$(hostname -f)" + +if [ "$use_cert_config" = "yes" ]; then + echo "[req] + default_bit = 4096 + distinguished_name = req_distinguished_name + prompt = no + + [req_distinguished_name] + countryName = $country_name + stateOrProvinceName = $state_or_province_name + organizationName = $organization_name + commonName = $common_name " >$certdir/certconfig.conf + +fi + +# Preliminary record checks +ipv4=$(host "$domain" | grep -m1 -Eo '([0-9]+\.){3}[0-9]+') +[ -z "$ipv4" ] && echo "\033[0;31mPlease point your domain ("$domain") to your server's ipv4 address." && exit 1 +ipv6=$(host "$domain" | grep "IPv6" | awk '{print $NF}') +[ -z "$ipv6" ] && echo "\033[0;31mPlease point your domain ("$domain") to your server's ipv6 address." && exit 1 + +# Open required mail ports +for port in 80 993 465 25 587 110 995; do + ufw allow "$port" 2>/dev/null +done + +if [ "$selfsigned" = "yes" ]; then + rm -f $certdir/privkey.pem + rm -f $certdir/csr.pem + rm -f $certdir/fullchain.pem + + echo "Generating a 4096 rsa key and a self-signed certificate that lasts 100 years" + mkdir -p $certdir + openssl genrsa -out $certdir/privkey.pem 4096 + + if [ "$use_cert_config" = "yes" ]; then + openssl req -new -key $certdir/privkey.pem -out $certdir/csr.pem -config $certdir/certconfig.conf + else + openssl req -new -key $certdir/privkey.pem -out $certdir/csr.pem + fi + openssl req -x509 -days 36500 -key $certdir/privkey.pem -in $certdir/csr.pem -out $certdir/fullchain.pem +else + + # Open port 80 for Certbot. + ufw allow 80 2>/dev/null + + [ ! -d "$certdir" ] && + possiblecert="$(certbot certificates 2>/dev/null | grep "Domains:\.* \(\*\.$domain\|$maildomain\)\(\s\|$\)" -A 2 | awk '/Certificate Path/ {print $3}' | head -n1)" && + certdir="${possiblecert%/*}" + + [ ! -d "$certdir" ] && + certdir="/etc/letsencrypt/live/$maildomain" && + case "$(netstat -tulpn | grep ":80\s")" in + *nginx*) + apt install -y python3-certbot-nginx + certbot -d "$maildomain" certonly --nginx --register-unsafely-without-email --agree-tos + ;; + *apache*) + apt install -y python3-certbot-apache + certbot -d "$maildomain" certonly --apache --register-unsafely-without-email --agree-tos + ;; + *) + apt install -y python3-certbot + certbot -d "$maildomain" certonly --standalone --register-unsafely-without-email --agree-tos + ;; + esac + +fi + +[ ! -f "$certdir/fullchain.pem" ] && echo "Error locating or installing SSL certificate." && exit 1 +[ ! -f "$certdir/privkey.pem" ] && echo "Error locating or installing SSL certificate." && exit 1 +if [ "$selfsigned" != "yes" ]; then + [ ! -f "$certdir/cert.pem" ] && echo "Error locating or installing SSL certificate." && exit 1 +fi + +[ ! -d "$certdir" ] && echo "Error locating or installing SSL certificate." && exit 1 + +echo "Configuring Postfix's main.cf..." + +# Adding additional vars to fix an issue with receiving emails (relay access denied) and adding it to mydestination. +postconf -e "myhostname = $maildomain" +postconf -e "mail_name = $domain" #This is for the smtpd_banner +postconf -e "mydomain = $domain" +postconf -e 'mydestination = $myhostname, $mydomain, mail, localhost.localdomain, localhost, localhost.$mydomain' + +# Change the cert/key files to the default locations of the Let's Encrypt cert/key +postconf -e "smtpd_tls_key_file=$certdir/privkey.pem" +postconf -e "smtpd_tls_cert_file=$certdir/fullchain.pem" +if [ "$selfsigned" != "yes" ]; then + postconf -e "smtp_tls_CAfile=$certdir/cert.pem" +fi + +# Enable, but do not require TLS. Requiring it with other servers would cause +# mail delivery problems and requiring it locally would cause many other +# issues. +postconf -e 'smtpd_tls_security_level = may' +postconf -e 'smtp_tls_security_level = may' + +# TLS required for authentication. +postconf -e 'smtpd_tls_auth_only = yes' + +# Exclude insecure and obsolete encryption protocols. +postconf -e 'smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1' +postconf -e 'smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1' +postconf -e 'smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1' +postconf -e 'smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1' + +# Exclude suboptimal ciphers. +if [ "$allow_suboptimal_ciphers" = "no" ]; then + postconf -e 'tls_preempt_cipherlist = yes' + postconf -e 'smtpd_tls_exclude_ciphers = aNULL, LOW, EXP, MEDIUM, ADH, AECDH, MD5, DSS, ECDSA, CAMELLIA128, 3DES, CAMELLIA256, RSA+AES, eNULL' +fi + +# Here we tell Postfix to look to Dovecot for authenticating users/passwords. +# Dovecot will be putting an authentication socket in /var/spool/postfix/private/auth +postconf -e 'smtpd_sasl_auth_enable = yes' +postconf -e 'smtpd_sasl_type = dovecot' +postconf -e 'smtpd_sasl_path = private/auth' + +# helo, sender, relay and recipient restrictions +postconf -e "smtpd_sender_login_maps = pcre:/etc/postfix/login_maps.pcre" +postconf -e 'smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_sender_login_mismatch, reject_unknown_reverse_client_hostname, reject_unknown_sender_domain' +postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_unknown_recipient_domain' +postconf -e 'smtpd_relay_restrictions = permit_sasl_authenticated, reject_unauth_destination' +postconf -e 'smtpd_helo_required = yes' +postconf -e 'smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname' + +# NOTE: the trailing slash here, or for any directory name in the home_mailbox +# command, is necessary as it distinguishes a maildir (which is the actual +# directory that we want) from a spoolfile (which is what old unix boomers want +# and no one else). +postconf -e 'home_mailbox = Mail/Inbox/' + +# Prevent "Received From:" header in sent emails in order to prevent leakage of public ip addresses +postconf -e "header_checks = regexp:/etc/postfix/header_checks" + +# strips "Received From:" in sent emails +echo "/^Received:.*/ IGNORE +/^X-Originating-IP:/ IGNORE" >>/etc/postfix/header_checks + +# Create a login map file that ensures that if a sender wants to send a mail from a user at our local +# domain, they must be authenticated as that user +echo "/^(.*)@$(sh -c "echo $domain | sed 's/\./\\\./'")$/ \${1}" >/etc/postfix/login_maps.pcre + +# master.cf +echo "Configuring Postfix's master.cf..." + +sed -i '/^\s*-o/d;/^\s*submission/d;/^\s*smtp/d' /etc/postfix/master.cf + +echo "smtp unix - - n - - smtp +smtp inet n - y - - smtpd + -o content_filter=spamassassin +submission inet n - y - - smtpd + -o syslog_name=postfix/submission + -o smtpd_tls_security_level=encrypt + -o smtpd_tls_auth_only=yes + -o smtpd_enforce_tls=yes + -o smtpd_client_restrictions=permit_sasl_authenticated,reject + -o smtpd_sender_restrictions=reject_sender_login_mismatch + -o smtpd_sender_login_maps=pcre:/etc/postfix/login_maps.pcre + -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject_unauth_destination +smtps inet n - y - - smtpd + -o syslog_name=postfix/smtps + -o smtpd_tls_wrappermode=yes + -o smtpd_sasl_auth_enable=yes +spamassassin unix - n n - - pipe + user=debian-spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f \${sender} \${recipient}" >>/etc/postfix/master.cf + +# By default, dovecot has a bunch of configs in /etc/dovecot/conf.d/ These +# files have nice documentation if you want to read it, but it's a huge pain to +# go through them to organize. Instead, we simply overwrite +# /etc/dovecot/dovecot.conf because it's easier to manage. You can get a backup +# of the original in /usr/share/dovecot if you want. +mv /etc/dovecot/dovecot.conf /etc/dovecot/dovecot.backup.conf + +echo "Creating Dovecot config..." + +echo "# Dovecot config +# Note that in the dovecot conf, you can use: +# %u for username +# %n for the name in name@domain.tld +# %d for the domain +# %h the user's home directory + +ssl = required +ssl_cert = <$certdir/fullchain.pem +ssl_key = <$certdir/privkey.pem +ssl_min_protocol = TLSv1.2 +ssl_cipher_list = "'EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA256:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EDH+aRSA+AESGCM:EDH+aRSA+SHA256:EDH+aRSA:EECDH:!aNULL:!eNULL:!MEDIUM:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SEED'" +ssl_prefer_server_ciphers = yes +ssl_dh = </usr/share/dovecot/dh.pem +auth_mechanisms = plain login +auth_username_format = %n + +protocols = \$protocols $allowed_protocols + +# Search for valid users in /etc/passwd +userdb { + driver = passwd +} + +#Fallback: Use plain old PAM to find user passwords +passdb { + driver = pam +} + +# Our mail for each user will be in ~/Mail, and the inbox will be ~/Mail/Inbox +# The LAYOUT option is also important because otherwise, the boxes will be \`.Sent\` instead of \`Sent\`. +mail_location = $mailbox_format:~/Mail:INBOX=~/Mail/Inbox:LAYOUT=fs +namespace inbox { + inbox = yes + mailbox Drafts { + special_use = \\Drafts + auto = subscribe + } + mailbox Junk { + special_use = \\Junk + auto = subscribe + autoexpunge = 30d + } + mailbox Sent { + special_use = \\Sent + auto = subscribe + } + mailbox Trash { + special_use = \\Trash + } + mailbox Archive { + special_use = \\Archive + } +} + +# Here we let Postfix use Dovecot's authentication system. +service auth { + unix_listener /var/spool/postfix/private/auth { + mode = 0660 + user = postfix + group = postfix + } +} + +protocol lda { + mail_plugins = \$mail_plugins sieve +} + +protocol lmtp { + mail_plugins = \$mail_plugins sieve +} + +protocol pop3 { + pop3_uidl_format = %08Xu%08Xv + pop3_no_flag_updates = yes +} + +plugin { + sieve = ~/.dovecot.sieve + sieve_default = /var/lib/dovecot/sieve/default.sieve + #sieve_global_path = /var/lib/dovecot/sieve/default.sieve + sieve_dir = ~/.sieve + sieve_global_dir = /var/lib/dovecot/sieve/ +} +" >/etc/dovecot/dovecot.conf + +# If using an old version of Dovecot, remove the ssl_dl line. +case "$(dovecot --version)" in +1 | 2.1* | 2.2*) sed -i '/^ssl_dh/d' /etc/dovecot/dovecot.conf ;; +esac + +mkdir /var/lib/dovecot/sieve/ + +echo "require [\"fileinto\", \"mailbox\"]; +if header :contains \"X-Spam-Flag\" \"YES\" { + fileinto \"Junk\"; +}" >/var/lib/dovecot/sieve/default.sieve + +grep -q '^vmail:' /etc/passwd || useradd vmail +chown -R vmail:vmail /var/lib/dovecot +sievec /var/lib/dovecot/sieve/default.sieve + +echo 'Preparing user authentication...' +grep -q nullok /etc/pam.d/dovecot || + echo 'auth required pam_unix.so nullok +account required pam_unix.so' >>/etc/pam.d/dovecot + +# OpenDKIM + +# A lot of the big name email services, like Google, will automatically reject +# as spam unfamiliar and unauthenticated email addresses. As in, the server +# will flatly reject the email, not even delivering it to someone's Spam +# folder. + +# OpenDKIM is a way to authenticate your email so you can send to such services +# without a problem. + +# Create an OpenDKIM key in the proper place with proper permissions. +echo 'Generating OpenDKIM keys...' +mkdir -p "/etc/postfix/dkim/$domain" +opendkim-genkey -D "/etc/postfix/dkim/$domain" -d "$domain" -s "$subdom" +chgrp -R opendkim /etc/postfix/dkim/* +chmod -R g+r /etc/postfix/dkim/* + +# Generate the OpenDKIM info: +echo 'Configuring OpenDKIM...' +grep -q "$domain" /etc/postfix/dkim/keytable 2>/dev/null || + echo "$subdom._domainkey.$domain $domain:$subdom:/etc/postfix/dkim/$domain/$subdom.private" >>/etc/postfix/dkim/keytable + +grep -q "$domain" /etc/postfix/dkim/signingtable 2>/dev/null || + echo "*@$domain $subdom._domainkey.$domain" >>/etc/postfix/dkim/signingtable + +grep -q '127.0.0.1' /etc/postfix/dkim/trustedhosts 2>/dev/null || + echo '127.0.0.1 +10.1.0.0/16' >>/etc/postfix/dkim/trustedhosts + +# ...and source it from opendkim.conf +grep -q '^KeyTable' /etc/opendkim.conf 2>/dev/null || echo 'KeyTable file:/etc/postfix/dkim/keytable +SigningTable refile:/etc/postfix/dkim/signingtable +InternalHosts refile:/etc/postfix/dkim/trustedhosts' >>/etc/opendkim.conf + +sed -i '/^#Canonicalization/s/simple/relaxed\/simple/' /etc/opendkim.conf +sed -i '/^#Canonicalization/s/^#//' /etc/opendkim.conf + +sed -i '/Socket/s/^#*/#/' /etc/opendkim.conf +grep -q '^Socket\s*inet:12301@localhost' /etc/opendkim.conf || echo 'Socket inet:12301@localhost' >>/etc/opendkim.conf + +# OpenDKIM daemon settings, removing previously activated socket. +sed -i '/^SOCKET/d' /etc/default/opendkim && echo "SOCKET=\"inet:12301@localhost\"" >>/etc/default/opendkim + +# Here we add to postconf the needed settings for working with OpenDKIM +echo 'Configuring Postfix with OpenDKIM settings...' +postconf -e 'smtpd_sasl_security_options = noanonymous, noplaintext' +postconf -e 'smtpd_sasl_tls_security_options = noanonymous' +postconf -e "myhostname = $maildomain" +postconf -e 'milter_default_action = accept' +postconf -e 'milter_protocol = 6' +postconf -e 'smtpd_milters = inet:localhost:12301' +postconf -e 'non_smtpd_milters = inet:localhost:12301' +postconf -e 'mailbox_command = /usr/lib/dovecot/deliver' + +# Long-term fix to prevent SMTP smuggling +postconf -e 'smtpd_forbid_bare_newline = normalize' +postconf -e 'smtpd_forbid_bare_newline_exclusions = $mynetworks' + +# A fix for "Opendkim won't start: can't open PID file?", as specified here: https://serverfault.com/a/847442 +/lib/opendkim/opendkim.service.generate +systemctl daemon-reload + +# Enable fail2ban security for dovecot and postfix. +[ ! -f /etc/fail2ban/jail.d/email-wizard.local ] && echo "[postfix] +enabled = true +[postfix-sasl] +enabled = true +[sieve] +enabled = true +[dovecot] +enabled = true" >/etc/fail2ban/jail.d/email-wizard.local + +sed -i "s|^backend = auto$|backend = systemd|" /etc/fail2ban/jail.conf + +# Enable SpamAssassin update cronjob. +if [ -f /etc/default/spamassassin ]; then + sed -i "s|^CRON=0|CRON=1|" /etc/default/spamassassin + printf "Restarting spamassassin..." + service spamassassin restart && printf " ...done\\n" + systemctl enable spamassassin +elif [ -f /etc/default/spamd ]; then + sed -i "s|^CRON=0|CRON=1|" /etc/default/spamd + printf "Restarting spamd..." + service spamd restart && printf " ...done\\n" + systemctl enable spamd +else + printf "!!! Neither /etc/default/spamassassin or /etc/default/spamd exists, this is unexpected and needs to be investigated" +fi + +for x in opendkim dovecot postfix fail2ban; do + printf "Restarting %s..." "$x" + service "$x" restart && printf " ...done\\n" + systemctl enable "$x" +done + +pval="$(tr -d '\n' <"/etc/postfix/dkim/$domain/$subdom.txt" | sed "s/k=rsa.* \"p=/k=rsa; p=/;s/\"\s*\"//;s/\"\s*).*//" | grep -o 'p=.*')" +dkimentry="$subdom._domainkey.$domain TXT v=DKIM1; k=rsa; $pval" +dmarcentry="_dmarc.$domain TXT v=DMARC1; p=reject; rua=mailto:postmaster@$domain; fo=1" +spfentry="$domain TXT v=spf1 mx a:$maildomain ip4:$ipv4 ip6:$ipv6 -all" +mxentry="$domain MX 10 $maildomain 300" + +useradd -m -G mail postmaster + +# Create a cronjob that deletes month-old postmaster mails: +cat <<EOF >/etc/cron.weekly/postmaster-clean +#!/bin/sh + +find /home/postmaster/Mail -type f -mtime +30 -name '*.mail*' -delete >/dev/null 2>&1 +exit 0 +EOF +chmod 755 /etc/cron.weekly/postmaster-clean + +grep -q '^deploy-hook = echo "$RENEWED_DOMAINS" | grep -q' /etc/letsencrypt/cli.ini || + echo " +deploy-hook = echo \"\$RENEWED_DOMAINS\" | grep -q '$maildomain' && service postfix reload && service dovecot reload" >>/etc/letsencrypt/cli.ini + +echo "NOTE: Elements in the entries might appear in a different order in your registrar's DNS settings. +$dkimentry +$dmarcentry +$spfentry +$mxentry" >"$HOME/dns_email_wizard" + +printf "\033[31m + _ _ +| \ | | _____ ___ +| \| |/ _ \ \ /\ / (_) +| |\ | (_) \ V V / _ +|_| \_|\___/ \_/\_/ (_)\033[0m + +Add these three records to your DNS TXT records on either your registrar's site +or your DNS server: +\033[32m +$dkimentry + +$dmarcentry + +$spfentry + +$mxentry +\033[0m +NOTE: You may need to omit the \`.$domain\` portion at the beginning if +inputting them in a registrar's web interface. + +Also, these are now saved to \033[34m~/dns_email_wizard\033[0m in case you want them in a file. + +Once you do that, you're done! Check the README for how to add users/accounts +and how to log in.\n" |