From 69fdb5244dc30285c3724b348fe34a4f54fb8f7f Mon Sep 17 00:00:00 2001 From: TheSiahxyz <164138827+TheSiahxyz@users.noreply.github.com> Date: Fri, 31 Jan 2025 21:39:01 +0900 Subject: modified README.md, deleted adddomain.sh, deleted emailwiz.sh, created add-domain.sh, created email-wizard.sh --- README.md | 6 +- add-domain.sh | 43 ++++++ adddomain.sh | 43 ------ email-wizard.sh | 472 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ emailwiz.sh | 472 -------------------------------------------------------- 5 files changed, 518 insertions(+), 518 deletions(-) create mode 100755 add-domain.sh delete mode 100755 adddomain.sh create mode 100755 email-wizard.sh delete mode 100755 emailwiz.sh diff --git a/README.md b/README.md index 8f3fe0d..3ec563c 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ I've linked this file on Github to a shorter, more memorable address on my website so you can get it on your machine with this short command: ```sh -curl -LO thesiah.xyz/emailwiz.sh +curl -LO thesiah.xyz/email-wizard.sh ``` When prompted by a dialog menu at the beginning, select "Internet Site", then @@ -65,7 +65,7 @@ non-spam. The 4 records are: 2. A TXT record for SPF (to reduce mail spoofing). 3. A TXT record for DMARC policies. 4. A TXT record with your public DKIM key. This record is long and **uniquely - generated** while running `emailwiz.sh` and thus must be added after + generated** while running `email-wizad.sh` and thus must be added after installation. They will look something like this: @@ -77,7 +77,7 @@ _dmarc.example.org TXT v=DMARC1; p=reject; rua=mailto:dmarc@example.org; example.org TXT v=spf1 mx a: -all ``` -The script will create a file, `~/dns_emailwiz` that will list our the records +The script will create a file, `~/dns_email_wizard` that will list our the records for your convenience, and also prints them at the end of the script. ### Add a rDNS/PTR record as well! diff --git a/add-domain.sh b/add-domain.sh new file mode 100755 index 0000000..e50c7b7 --- /dev/null +++ b/add-domain.sh @@ -0,0 +1,43 @@ +#!/bin/sh + +domain="$1" +[ -z "$1" ] && exit + +domain="$1" +subdom="mail" + +# Add the domain to the valid postfix addresses. +grep -q "^mydestination.*$domain" /etc/postfix/main.cf || + sed -i "s/^mydestination.*/&, $domain/" /etc/postfix/main.cf + +# Create DKIM for new domain. +mkdir -p "/etc/postfix/dkim/$domain" +opendkim-genkey -D "/etc/postfix/dkim/$domain" -d "$domain" -s "$subdom" +chgrp -R opendkim /etc/postfix/dkim/* +chmod -R g+r /etc/postfix/dkim/* + +# Add entries to keytable and signing table. +echo "$subdom._domainkey.$domain $domain:$subdom:/etc/postfix/dkim/$domain/$subdom.private" >>/etc/postfix/dkim/keytable +echo "*@$domain $subdom._domainkey.$domain" >>/etc/postfix/dkim/signingtable + +systemctl reload opendkim postfix + +# Print out DKIM TXT entry. +pval="$(tr -d '\n' <"/etc/postfix/dkim/$domain/$subdom.txt" | sed "s/k=rsa.* \"p=/k=rsa; p=/;s/\"\s*\"//;s/\"\s*).*//" | grep -o 'p=.*')" + +dkimentry="$subdom._domainkey.$domain TXT v=DKIM1; k=rsa; $pval" +dmarcentry="_dmarc.$domain TXT v=DMARC1; p=reject; rua=mailto:dmarc@$domain; fo=1" +spfentry="$domain TXT v=spf1 mx a:$maildomain -all" +mxentry="$domain MX 10 $maildomain 300" + +echo "$dkimentry +$dmarcentry +$spfentry +$mxentry" >>"$HOME/dns_email_wizard_added" + +echo "=== ADD THE FOLLOWING TO YOUR DNS TXT RECORDS ===" +echo "$dkimentry +$dmarcentry +$spfentry +$mxentry" +echo "They have also been stored in ~/dns_email_wizard_added" diff --git a/adddomain.sh b/adddomain.sh deleted file mode 100755 index d44b567..0000000 --- a/adddomain.sh +++ /dev/null @@ -1,43 +0,0 @@ -#!/bin/sh - -domain="$1" -[ -z "$1" ] && exit - -domain="$1" -subdom="mail" - -# Add the domain to the valid postfix addresses. -grep -q "^mydestination.*$domain" /etc/postfix/main.cf || - sed -i "s/^mydestination.*/&, $domain/" /etc/postfix/main.cf - -# Create DKIM for new domain. -mkdir -p "/etc/postfix/dkim/$domain" -opendkim-genkey -D "/etc/postfix/dkim/$domain" -d "$domain" -s "$subdom" -chgrp -R opendkim /etc/postfix/dkim/* -chmod -R g+r /etc/postfix/dkim/* - -# Add entries to keytable and signing table. -echo "$subdom._domainkey.$domain $domain:$subdom:/etc/postfix/dkim/$domain/$subdom.private" >> /etc/postfix/dkim/keytable -echo "*@$domain $subdom._domainkey.$domain" >> /etc/postfix/dkim/signingtable - -systemctl reload opendkim postfix - -# Print out DKIM TXT entry. -pval="$(tr -d '\n' <"/etc/postfix/dkim/$domain/$subdom.txt" | sed "s/k=rsa.* \"p=/k=rsa; p=/;s/\"\s*\"//;s/\"\s*).*//" | grep -o 'p=.*')" - -dkimentry="$subdom._domainkey.$domain TXT v=DKIM1; k=rsa; $pval" -dmarcentry="_dmarc.$domain TXT v=DMARC1; p=reject; rua=mailto:dmarc@$domain; fo=1" -spfentry="$domain TXT v=spf1 mx a:$maildomain -all" -mxentry="$domain MX 10 $maildomain 300" - -echo "$dkimentry -$dmarcentry -$spfentry -$mxentry" >> "$HOME/dns_emailwizard_added" - -echo "=== ADD THE FOLLOWING TO YOUR DNS TXT RECORDS ===" -echo "$dkimentry -$dmarcentry -$spfentry -$mxentry" -echo "They have also been stored in ~/dns_emailwizard_added" diff --git a/email-wizard.sh b/email-wizard.sh new file mode 100755 index 0000000..e099dd9 --- /dev/null +++ b/email-wizard.sh @@ -0,0 +1,472 @@ +#!/bin/sh + +# BEFORE INSTALLING + +# Have a Debian or Ubuntu server with a static IP and DNS records (usually +# A/AAAA) that point your domain name to it. + +# NOTE WHILE INSTALLING + +# On installation of Postfix, select "Internet Site" and put in TLD (without +# `mail.` before it). + +# AFTER INSTALLING + +# More DNS records will be given to you to install. One of them will be +# different for every installation and is uniquely generated on your machine. + +umask 0022 + +install_packages="postfix postfix-pcre dovecot-imapd dovecot-pop3d dovecot-sieve opendkim opendkim-tools spamassassin spamc net-tools fail2ban bind9-host" + +systemctl -q stop dovecot +systemctl -q stop postfix +apt-get purge ?config-files -y $install_packages +apt-get install -y $install_packages + +domain="$(cat /etc/mailname)" +subdom=${MAIL_SUBDOM:-mail} +maildomain="$subdom.$domain" +certdir="/etc/letsencrypt/live/$maildomain" + +selfsigned="no" # yes no +allow_suboptimal_ciphers="yes" #yes no +mailbox_format="maildir" # maildir sdbox +allowed_protocols=" imap pop3 " #imap pop3 + +use_cert_config="no" +country_name="" # IT US UK IN etc etc +state_or_province_name="" +organization_name="" +common_name="$(hostname -f)" + +if [ "$use_cert_config" = "yes" ]; then + echo "[req] + default_bit = 4096 + distinguished_name = req_distinguished_name + prompt = no + + [req_distinguished_name] + countryName = $country_name + stateOrProvinceName = $state_or_province_name + organizationName = $organization_name + commonName = $common_name " >$certdir/certconfig.conf + +fi + +# Preliminary record checks +ipv4=$(host "$domain" | grep -m1 -Eo '([0-9]+\.){3}[0-9]+') +[ -z "$ipv4" ] && echo "\033[0;31mPlease point your domain ("$domain") to your server's ipv4 address." && exit 1 +ipv6=$(host "$domain" | grep "IPv6" | awk '{print $NF}') +[ -z "$ipv6" ] && echo "\033[0;31mPlease point your domain ("$domain") to your server's ipv6 address." && exit 1 + +# Open required mail ports +for port in 80 993 465 25 587 110 995; do + ufw allow "$port" 2>/dev/null +done + +if [ "$selfsigned" = "yes" ]; then + rm -f $certdir/privkey.pem + rm -f $certdir/csr.pem + rm -f $certdir/fullchain.pem + + echo "Generating a 4096 rsa key and a self-signed certificate that lasts 100 years" + mkdir -p $certdir + openssl genrsa -out $certdir/privkey.pem 4096 + + if [ "$use_cert_config" = "yes" ]; then + openssl req -new -key $certdir/privkey.pem -out $certdir/csr.pem -config $certdir/certconfig.conf + else + openssl req -new -key $certdir/privkey.pem -out $certdir/csr.pem + fi + openssl req -x509 -days 36500 -key $certdir/privkey.pem -in $certdir/csr.pem -out $certdir/fullchain.pem +else + + # Open port 80 for Certbot. + ufw allow 80 2>/dev/null + + [ ! -d "$certdir" ] && + possiblecert="$(certbot certificates 2>/dev/null | grep "Domains:\.* \(\*\.$domain\|$maildomain\)\(\s\|$\)" -A 2 | awk '/Certificate Path/ {print $3}' | head -n1)" && + certdir="${possiblecert%/*}" + + [ ! -d "$certdir" ] && + certdir="/etc/letsencrypt/live/$maildomain" && + case "$(netstat -tulpn | grep ":80\s")" in + *nginx*) + apt install -y python3-certbot-nginx + certbot -d "$maildomain" certonly --nginx --register-unsafely-without-email --agree-tos + ;; + *apache*) + apt install -y python3-certbot-apache + certbot -d "$maildomain" certonly --apache --register-unsafely-without-email --agree-tos + ;; + *) + apt install -y python3-certbot + certbot -d "$maildomain" certonly --standalone --register-unsafely-without-email --agree-tos + ;; + esac + +fi + +[ ! -f "$certdir/fullchain.pem" ] && echo "Error locating or installing SSL certificate." && exit 1 +[ ! -f "$certdir/privkey.pem" ] && echo "Error locating or installing SSL certificate." && exit 1 +if [ "$selfsigned" != "yes" ]; then + [ ! -f "$certdir/cert.pem" ] && echo "Error locating or installing SSL certificate." && exit 1 +fi + +[ ! -d "$certdir" ] && echo "Error locating or installing SSL certificate." && exit 1 + +echo "Configuring Postfix's main.cf..." + +# Adding additional vars to fix an issue with receiving emails (relay access denied) and adding it to mydestination. +postconf -e "myhostname = $maildomain" +postconf -e "mail_name = $domain" #This is for the smtpd_banner +postconf -e "mydomain = $domain" +postconf -e 'mydestination = $myhostname, $mydomain, mail, localhost.localdomain, localhost, localhost.$mydomain' + +# Change the cert/key files to the default locations of the Let's Encrypt cert/key +postconf -e "smtpd_tls_key_file=$certdir/privkey.pem" +postconf -e "smtpd_tls_cert_file=$certdir/fullchain.pem" +if [ "$selfsigned" != "yes" ]; then + postconf -e "smtp_tls_CAfile=$certdir/cert.pem" +fi + +# Enable, but do not require TLS. Requiring it with other servers would cause +# mail delivery problems and requiring it locally would cause many other +# issues. +postconf -e 'smtpd_tls_security_level = may' +postconf -e 'smtp_tls_security_level = may' + +# TLS required for authentication. +postconf -e 'smtpd_tls_auth_only = yes' + +# Exclude insecure and obsolete encryption protocols. +postconf -e 'smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1' +postconf -e 'smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1' +postconf -e 'smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1' +postconf -e 'smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1' + +# Exclude suboptimal ciphers. +if [ "$allow_suboptimal_ciphers" = "no" ]; then + postconf -e 'tls_preempt_cipherlist = yes' + postconf -e 'smtpd_tls_exclude_ciphers = aNULL, LOW, EXP, MEDIUM, ADH, AECDH, MD5, DSS, ECDSA, CAMELLIA128, 3DES, CAMELLIA256, RSA+AES, eNULL' +fi + +# Here we tell Postfix to look to Dovecot for authenticating users/passwords. +# Dovecot will be putting an authentication socket in /var/spool/postfix/private/auth +postconf -e 'smtpd_sasl_auth_enable = yes' +postconf -e 'smtpd_sasl_type = dovecot' +postconf -e 'smtpd_sasl_path = private/auth' + +# helo, sender, relay and recipient restrictions +postconf -e "smtpd_sender_login_maps = pcre:/etc/postfix/login_maps.pcre" +postconf -e 'smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_sender_login_mismatch, reject_unknown_reverse_client_hostname, reject_unknown_sender_domain' +postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_unknown_recipient_domain' +postconf -e 'smtpd_relay_restrictions = permit_sasl_authenticated, reject_unauth_destination' +postconf -e 'smtpd_helo_required = yes' +postconf -e 'smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname' + +# NOTE: the trailing slash here, or for any directory name in the home_mailbox +# command, is necessary as it distinguishes a maildir (which is the actual +# directory that we want) from a spoolfile (which is what old unix boomers want +# and no one else). +postconf -e 'home_mailbox = Mail/Inbox/' + +# Prevent "Received From:" header in sent emails in order to prevent leakage of public ip addresses +postconf -e "header_checks = regexp:/etc/postfix/header_checks" + +# strips "Received From:" in sent emails +echo "/^Received:.*/ IGNORE +/^X-Originating-IP:/ IGNORE" >>/etc/postfix/header_checks + +# Create a login map file that ensures that if a sender wants to send a mail from a user at our local +# domain, they must be authenticated as that user +echo "/^(.*)@$(sh -c "echo $domain | sed 's/\./\\\./'")$/ \${1}" >/etc/postfix/login_maps.pcre + +# master.cf +echo "Configuring Postfix's master.cf..." + +sed -i '/^\s*-o/d;/^\s*submission/d;/^\s*smtp/d' /etc/postfix/master.cf + +echo "smtp unix - - n - - smtp +smtp inet n - y - - smtpd + -o content_filter=spamassassin +submission inet n - y - - smtpd + -o syslog_name=postfix/submission + -o smtpd_tls_security_level=encrypt + -o smtpd_tls_auth_only=yes + -o smtpd_enforce_tls=yes + -o smtpd_client_restrictions=permit_sasl_authenticated,reject + -o smtpd_sender_restrictions=reject_sender_login_mismatch + -o smtpd_sender_login_maps=pcre:/etc/postfix/login_maps.pcre + -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject_unauth_destination +smtps inet n - y - - smtpd + -o syslog_name=postfix/smtps + -o smtpd_tls_wrappermode=yes + -o smtpd_sasl_auth_enable=yes +spamassassin unix - n n - - pipe + user=debian-spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f \${sender} \${recipient}" >>/etc/postfix/master.cf + +# By default, dovecot has a bunch of configs in /etc/dovecot/conf.d/ These +# files have nice documentation if you want to read it, but it's a huge pain to +# go through them to organize. Instead, we simply overwrite +# /etc/dovecot/dovecot.conf because it's easier to manage. You can get a backup +# of the original in /usr/share/dovecot if you want. +mv /etc/dovecot/dovecot.conf /etc/dovecot/dovecot.backup.conf + +echo "Creating Dovecot config..." + +echo "# Dovecot config +# Note that in the dovecot conf, you can use: +# %u for username +# %n for the name in name@domain.tld +# %d for the domain +# %h the user's home directory + +ssl = required +ssl_cert = <$certdir/fullchain.pem +ssl_key = <$certdir/privkey.pem +ssl_min_protocol = TLSv1.2 +ssl_cipher_list = "'EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA256:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EDH+aRSA+AESGCM:EDH+aRSA+SHA256:EDH+aRSA:EECDH:!aNULL:!eNULL:!MEDIUM:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SEED'" +ssl_prefer_server_ciphers = yes +ssl_dh = /etc/dovecot/dovecot.conf + +# If using an old version of Dovecot, remove the ssl_dl line. +case "$(dovecot --version)" in +1 | 2.1* | 2.2*) sed -i '/^ssl_dh/d' /etc/dovecot/dovecot.conf ;; +esac + +mkdir /var/lib/dovecot/sieve/ + +echo "require [\"fileinto\", \"mailbox\"]; +if header :contains \"X-Spam-Flag\" \"YES\" { + fileinto \"Junk\"; +}" >/var/lib/dovecot/sieve/default.sieve + +grep -q '^vmail:' /etc/passwd || useradd vmail +chown -R vmail:vmail /var/lib/dovecot +sievec /var/lib/dovecot/sieve/default.sieve + +echo 'Preparing user authentication...' +grep -q nullok /etc/pam.d/dovecot || + echo 'auth required pam_unix.so nullok +account required pam_unix.so' >>/etc/pam.d/dovecot + +# OpenDKIM + +# A lot of the big name email services, like Google, will automatically reject +# as spam unfamiliar and unauthenticated email addresses. As in, the server +# will flatly reject the email, not even delivering it to someone's Spam +# folder. + +# OpenDKIM is a way to authenticate your email so you can send to such services +# without a problem. + +# Create an OpenDKIM key in the proper place with proper permissions. +echo 'Generating OpenDKIM keys...' +mkdir -p "/etc/postfix/dkim/$domain" +opendkim-genkey -D "/etc/postfix/dkim/$domain" -d "$domain" -s "$subdom" +chgrp -R opendkim /etc/postfix/dkim/* +chmod -R g+r /etc/postfix/dkim/* + +# Generate the OpenDKIM info: +echo 'Configuring OpenDKIM...' +grep -q "$domain" /etc/postfix/dkim/keytable 2>/dev/null || + echo "$subdom._domainkey.$domain $domain:$subdom:/etc/postfix/dkim/$domain/$subdom.private" >>/etc/postfix/dkim/keytable + +grep -q "$domain" /etc/postfix/dkim/signingtable 2>/dev/null || + echo "*@$domain $subdom._domainkey.$domain" >>/etc/postfix/dkim/signingtable + +grep -q '127.0.0.1' /etc/postfix/dkim/trustedhosts 2>/dev/null || + echo '127.0.0.1 +10.1.0.0/16' >>/etc/postfix/dkim/trustedhosts + +# ...and source it from opendkim.conf +grep -q '^KeyTable' /etc/opendkim.conf 2>/dev/null || echo 'KeyTable file:/etc/postfix/dkim/keytable +SigningTable refile:/etc/postfix/dkim/signingtable +InternalHosts refile:/etc/postfix/dkim/trustedhosts' >>/etc/opendkim.conf + +sed -i '/^#Canonicalization/s/simple/relaxed\/simple/' /etc/opendkim.conf +sed -i '/^#Canonicalization/s/^#//' /etc/opendkim.conf + +sed -i '/Socket/s/^#*/#/' /etc/opendkim.conf +grep -q '^Socket\s*inet:12301@localhost' /etc/opendkim.conf || echo 'Socket inet:12301@localhost' >>/etc/opendkim.conf + +# OpenDKIM daemon settings, removing previously activated socket. +sed -i '/^SOCKET/d' /etc/default/opendkim && echo "SOCKET=\"inet:12301@localhost\"" >>/etc/default/opendkim + +# Here we add to postconf the needed settings for working with OpenDKIM +echo 'Configuring Postfix with OpenDKIM settings...' +postconf -e 'smtpd_sasl_security_options = noanonymous, noplaintext' +postconf -e 'smtpd_sasl_tls_security_options = noanonymous' +postconf -e "myhostname = $maildomain" +postconf -e 'milter_default_action = accept' +postconf -e 'milter_protocol = 6' +postconf -e 'smtpd_milters = inet:localhost:12301' +postconf -e 'non_smtpd_milters = inet:localhost:12301' +postconf -e 'mailbox_command = /usr/lib/dovecot/deliver' + +# Long-term fix to prevent SMTP smuggling +postconf -e 'smtpd_forbid_bare_newline = normalize' +postconf -e 'smtpd_forbid_bare_newline_exclusions = $mynetworks' + +# A fix for "Opendkim won't start: can't open PID file?", as specified here: https://serverfault.com/a/847442 +/lib/opendkim/opendkim.service.generate +systemctl daemon-reload + +# Enable fail2ban security for dovecot and postfix. +[ ! -f /etc/fail2ban/jail.d/email-wizard.local ] && echo "[postfix] +enabled = true +[postfix-sasl] +enabled = true +[sieve] +enabled = true +[dovecot] +enabled = true" >/etc/fail2ban/jail.d/email-wizard.local + +sed -i "s|^backend = auto$|backend = systemd|" /etc/fail2ban/jail.conf + +# Enable SpamAssassin update cronjob. +if [ -f /etc/default/spamassassin ]; then + sed -i "s|^CRON=0|CRON=1|" /etc/default/spamassassin + printf "Restarting spamassassin..." + service spamassassin restart && printf " ...done\\n" + systemctl enable spamassassin +elif [ -f /etc/default/spamd ]; then + sed -i "s|^CRON=0|CRON=1|" /etc/default/spamd + printf "Restarting spamd..." + service spamd restart && printf " ...done\\n" + systemctl enable spamd +else + printf "!!! Neither /etc/default/spamassassin or /etc/default/spamd exists, this is unexpected and needs to be investigated" +fi + +for x in opendkim dovecot postfix fail2ban; do + printf "Restarting %s..." "$x" + service "$x" restart && printf " ...done\\n" + systemctl enable "$x" +done + +pval="$(tr -d '\n' <"/etc/postfix/dkim/$domain/$subdom.txt" | sed "s/k=rsa.* \"p=/k=rsa; p=/;s/\"\s*\"//;s/\"\s*).*//" | grep -o 'p=.*')" +dkimentry="$subdom._domainkey.$domain TXT v=DKIM1; k=rsa; $pval" +dmarcentry="_dmarc.$domain TXT v=DMARC1; p=reject; rua=mailto:postmaster@$domain; fo=1" +spfentry="$domain TXT v=spf1 mx a:$maildomain ip4:$ipv4 ip6:$ipv6 -all" +mxentry="$domain MX 10 $maildomain 300" + +useradd -m -G mail postmaster + +# Create a cronjob that deletes month-old postmaster mails: +cat </etc/cron.weekly/postmaster-clean +#!/bin/sh + +find /home/postmaster/Mail -type f -mtime +30 -name '*.mail*' -delete >/dev/null 2>&1 +exit 0 +EOF +chmod 755 /etc/cron.weekly/postmaster-clean + +grep -q '^deploy-hook = echo "$RENEWED_DOMAINS" | grep -q' /etc/letsencrypt/cli.ini || + echo " +deploy-hook = echo \"\$RENEWED_DOMAINS\" | grep -q '$maildomain' && service postfix reload && service dovecot reload" >>/etc/letsencrypt/cli.ini + +echo "NOTE: Elements in the entries might appear in a different order in your registrar's DNS settings. +$dkimentry +$dmarcentry +$spfentry +$mxentry" >"$HOME/dns_email_wizard" + +printf "\033[31m + _ _ +| \ | | _____ ___ +| \| |/ _ \ \ /\ / (_) +| |\ | (_) \ V V / _ +|_| \_|\___/ \_/\_/ (_)\033[0m + +Add these three records to your DNS TXT records on either your registrar's site +or your DNS server: +\033[32m +$dkimentry + +$dmarcentry + +$spfentry + +$mxentry +\033[0m +NOTE: You may need to omit the \`.$domain\` portion at the beginning if +inputting them in a registrar's web interface. + +Also, these are now saved to \033[34m~/dns_email_wizard\033[0m in case you want them in a file. + +Once you do that, you're done! Check the README for how to add users/accounts +and how to log in.\n" diff --git a/emailwiz.sh b/emailwiz.sh deleted file mode 100755 index 5c5bd03..0000000 --- a/emailwiz.sh +++ /dev/null @@ -1,472 +0,0 @@ -#!/bin/sh - -# BEFORE INSTALLING - -# Have a Debian or Ubuntu server with a static IP and DNS records (usually -# A/AAAA) that point your domain name to it. - -# NOTE WHILE INSTALLING - -# On installation of Postfix, select "Internet Site" and put in TLD (without -# `mail.` before it). - -# AFTER INSTALLING - -# More DNS records will be given to you to install. One of them will be -# different for every installation and is uniquely generated on your machine. - -umask 0022 - -install_packages="postfix postfix-pcre dovecot-imapd dovecot-pop3d dovecot-sieve opendkim opendkim-tools spamassassin spamc net-tools fail2ban bind9-host" - -systemctl -q stop dovecot -systemctl -q stop postfix -apt-get purge ?config-files -y $install_packages -apt-get install -y $install_packages - -domain="$(cat /etc/mailname)" -subdom=${MAIL_SUBDOM:-mail} -maildomain="$subdom.$domain" -certdir="/etc/letsencrypt/live/$maildomain" - -selfsigned="no" # yes no -allow_suboptimal_ciphers="yes" #yes no -mailbox_format="maildir" # maildir sdbox -allowed_protocols=" imap pop3 " #imap pop3 - -use_cert_config="no" -country_name="" # IT US UK IN etc etc -state_or_province_name="" -organization_name="" -common_name="$(hostname -f)" - -if [ "$use_cert_config" = "yes" ]; then - echo "[req] - default_bit = 4096 - distinguished_name = req_distinguished_name - prompt = no - - [req_distinguished_name] - countryName = $country_name - stateOrProvinceName = $state_or_province_name - organizationName = $organization_name - commonName = $common_name " >$certdir/certconfig.conf - -fi - -# Preliminary record checks -ipv4=$(host "$domain" | grep -m1 -Eo '([0-9]+\.){3}[0-9]+') -[ -z "$ipv4" ] && echo "\033[0;31mPlease point your domain ("$domain") to your server's ipv4 address." && exit 1 -ipv6=$(host "$domain" | grep "IPv6" | awk '{print $NF}') -[ -z "$ipv6" ] && echo "\033[0;31mPlease point your domain ("$domain") to your server's ipv6 address." && exit 1 - -# Open required mail ports -for port in 80 993 465 25 587 110 995; do - ufw allow "$port" 2>/dev/null -done - -if [ "$selfsigned" = "yes" ]; then - rm -f $certdir/privkey.pem - rm -f $certdir/csr.pem - rm -f $certdir/fullchain.pem - - echo "Generating a 4096 rsa key and a self-signed certificate that lasts 100 years" - mkdir -p $certdir - openssl genrsa -out $certdir/privkey.pem 4096 - - if [ "$use_cert_config" = "yes" ]; then - openssl req -new -key $certdir/privkey.pem -out $certdir/csr.pem -config $certdir/certconfig.conf - else - openssl req -new -key $certdir/privkey.pem -out $certdir/csr.pem - fi - openssl req -x509 -days 36500 -key $certdir/privkey.pem -in $certdir/csr.pem -out $certdir/fullchain.pem -else - - # Open port 80 for Certbot. - ufw allow 80 2>/dev/null - - [ ! -d "$certdir" ] && - possiblecert="$(certbot certificates 2>/dev/null | grep "Domains:\.* \(\*\.$domain\|$maildomain\)\(\s\|$\)" -A 2 | awk '/Certificate Path/ {print $3}' | head -n1)" && - certdir="${possiblecert%/*}" - - [ ! -d "$certdir" ] && - certdir="/etc/letsencrypt/live/$maildomain" && - case "$(netstat -tulpn | grep ":80\s")" in - *nginx*) - apt install -y python3-certbot-nginx - certbot -d "$maildomain" certonly --nginx --register-unsafely-without-email --agree-tos - ;; - *apache*) - apt install -y python3-certbot-apache - certbot -d "$maildomain" certonly --apache --register-unsafely-without-email --agree-tos - ;; - *) - apt install -y python3-certbot - certbot -d "$maildomain" certonly --standalone --register-unsafely-without-email --agree-tos - ;; - esac - -fi - -[ ! -f "$certdir/fullchain.pem" ] && echo "Error locating or installing SSL certificate." && exit 1 -[ ! -f "$certdir/privkey.pem" ] && echo "Error locating or installing SSL certificate." && exit 1 -if [ "$selfsigned" != "yes" ]; then - [ ! -f "$certdir/cert.pem" ] && echo "Error locating or installing SSL certificate." && exit 1 -fi - -[ ! -d "$certdir" ] && echo "Error locating or installing SSL certificate." && exit 1 - -echo "Configuring Postfix's main.cf..." - -# Adding additional vars to fix an issue with receiving emails (relay access denied) and adding it to mydestination. -postconf -e "myhostname = $maildomain" -postconf -e "mail_name = $domain" #This is for the smtpd_banner -postconf -e "mydomain = $domain" -postconf -e 'mydestination = $myhostname, $mydomain, mail, localhost.localdomain, localhost, localhost.$mydomain' - -# Change the cert/key files to the default locations of the Let's Encrypt cert/key -postconf -e "smtpd_tls_key_file=$certdir/privkey.pem" -postconf -e "smtpd_tls_cert_file=$certdir/fullchain.pem" -if [ "$selfsigned" != "yes" ]; then - postconf -e "smtp_tls_CAfile=$certdir/cert.pem" -fi - -# Enable, but do not require TLS. Requiring it with other servers would cause -# mail delivery problems and requiring it locally would cause many other -# issues. -postconf -e 'smtpd_tls_security_level = may' -postconf -e 'smtp_tls_security_level = may' - -# TLS required for authentication. -postconf -e 'smtpd_tls_auth_only = yes' - -# Exclude insecure and obsolete encryption protocols. -postconf -e 'smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1' -postconf -e 'smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1' -postconf -e 'smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1' -postconf -e 'smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1' - -# Exclude suboptimal ciphers. -if [ "$allow_suboptimal_ciphers" = "no" ]; then - postconf -e 'tls_preempt_cipherlist = yes' - postconf -e 'smtpd_tls_exclude_ciphers = aNULL, LOW, EXP, MEDIUM, ADH, AECDH, MD5, DSS, ECDSA, CAMELLIA128, 3DES, CAMELLIA256, RSA+AES, eNULL' -fi - -# Here we tell Postfix to look to Dovecot for authenticating users/passwords. -# Dovecot will be putting an authentication socket in /var/spool/postfix/private/auth -postconf -e 'smtpd_sasl_auth_enable = yes' -postconf -e 'smtpd_sasl_type = dovecot' -postconf -e 'smtpd_sasl_path = private/auth' - -# helo, sender, relay and recipient restrictions -postconf -e "smtpd_sender_login_maps = pcre:/etc/postfix/login_maps.pcre" -postconf -e 'smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_sender_login_mismatch, reject_unknown_reverse_client_hostname, reject_unknown_sender_domain' -postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_unknown_recipient_domain' -postconf -e 'smtpd_relay_restrictions = permit_sasl_authenticated, reject_unauth_destination' -postconf -e 'smtpd_helo_required = yes' -postconf -e 'smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname' - -# NOTE: the trailing slash here, or for any directory name in the home_mailbox -# command, is necessary as it distinguishes a maildir (which is the actual -# directory that we want) from a spoolfile (which is what old unix boomers want -# and no one else). -postconf -e 'home_mailbox = Mail/Inbox/' - -# Prevent "Received From:" header in sent emails in order to prevent leakage of public ip addresses -postconf -e "header_checks = regexp:/etc/postfix/header_checks" - -# strips "Received From:" in sent emails -echo "/^Received:.*/ IGNORE -/^X-Originating-IP:/ IGNORE" >>/etc/postfix/header_checks - -# Create a login map file that ensures that if a sender wants to send a mail from a user at our local -# domain, they must be authenticated as that user -echo "/^(.*)@$(sh -c "echo $domain | sed 's/\./\\\./'")$/ \${1}" >/etc/postfix/login_maps.pcre - -# master.cf -echo "Configuring Postfix's master.cf..." - -sed -i '/^\s*-o/d;/^\s*submission/d;/^\s*smtp/d' /etc/postfix/master.cf - -echo "smtp unix - - n - - smtp -smtp inet n - y - - smtpd - -o content_filter=spamassassin -submission inet n - y - - smtpd - -o syslog_name=postfix/submission - -o smtpd_tls_security_level=encrypt - -o smtpd_tls_auth_only=yes - -o smtpd_enforce_tls=yes - -o smtpd_client_restrictions=permit_sasl_authenticated,reject - -o smtpd_sender_restrictions=reject_sender_login_mismatch - -o smtpd_sender_login_maps=pcre:/etc/postfix/login_maps.pcre - -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject_unauth_destination -smtps inet n - y - - smtpd - -o syslog_name=postfix/smtps - -o smtpd_tls_wrappermode=yes - -o smtpd_sasl_auth_enable=yes -spamassassin unix - n n - - pipe - user=debian-spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f \${sender} \${recipient}" >>/etc/postfix/master.cf - -# By default, dovecot has a bunch of configs in /etc/dovecot/conf.d/ These -# files have nice documentation if you want to read it, but it's a huge pain to -# go through them to organize. Instead, we simply overwrite -# /etc/dovecot/dovecot.conf because it's easier to manage. You can get a backup -# of the original in /usr/share/dovecot if you want. -mv /etc/dovecot/dovecot.conf /etc/dovecot/dovecot.backup.conf - -echo "Creating Dovecot config..." - -echo "# Dovecot config -# Note that in the dovecot conf, you can use: -# %u for username -# %n for the name in name@domain.tld -# %d for the domain -# %h the user's home directory - -ssl = required -ssl_cert = <$certdir/fullchain.pem -ssl_key = <$certdir/privkey.pem -ssl_min_protocol = TLSv1.2 -ssl_cipher_list = "'EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA256:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EDH+aRSA+AESGCM:EDH+aRSA+SHA256:EDH+aRSA:EECDH:!aNULL:!eNULL:!MEDIUM:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SEED'" -ssl_prefer_server_ciphers = yes -ssl_dh = /etc/dovecot/dovecot.conf - -# If using an old version of Dovecot, remove the ssl_dl line. -case "$(dovecot --version)" in -1 | 2.1* | 2.2*) sed -i '/^ssl_dh/d' /etc/dovecot/dovecot.conf ;; -esac - -mkdir /var/lib/dovecot/sieve/ - -echo "require [\"fileinto\", \"mailbox\"]; -if header :contains \"X-Spam-Flag\" \"YES\" { - fileinto \"Junk\"; -}" >/var/lib/dovecot/sieve/default.sieve - -grep -q '^vmail:' /etc/passwd || useradd vmail -chown -R vmail:vmail /var/lib/dovecot -sievec /var/lib/dovecot/sieve/default.sieve - -echo 'Preparing user authentication...' -grep -q nullok /etc/pam.d/dovecot || - echo 'auth required pam_unix.so nullok -account required pam_unix.so' >>/etc/pam.d/dovecot - -# OpenDKIM - -# A lot of the big name email services, like Google, will automatically reject -# as spam unfamiliar and unauthenticated email addresses. As in, the server -# will flatly reject the email, not even delivering it to someone's Spam -# folder. - -# OpenDKIM is a way to authenticate your email so you can send to such services -# without a problem. - -# Create an OpenDKIM key in the proper place with proper permissions. -echo 'Generating OpenDKIM keys...' -mkdir -p "/etc/postfix/dkim/$domain" -opendkim-genkey -D "/etc/postfix/dkim/$domain" -d "$domain" -s "$subdom" -chgrp -R opendkim /etc/postfix/dkim/* -chmod -R g+r /etc/postfix/dkim/* - -# Generate the OpenDKIM info: -echo 'Configuring OpenDKIM...' -grep -q "$domain" /etc/postfix/dkim/keytable 2>/dev/null || - echo "$subdom._domainkey.$domain $domain:$subdom:/etc/postfix/dkim/$domain/$subdom.private" >>/etc/postfix/dkim/keytable - -grep -q "$domain" /etc/postfix/dkim/signingtable 2>/dev/null || - echo "*@$domain $subdom._domainkey.$domain" >>/etc/postfix/dkim/signingtable - -grep -q '127.0.0.1' /etc/postfix/dkim/trustedhosts 2>/dev/null || - echo '127.0.0.1 -10.1.0.0/16' >>/etc/postfix/dkim/trustedhosts - -# ...and source it from opendkim.conf -grep -q '^KeyTable' /etc/opendkim.conf 2>/dev/null || echo 'KeyTable file:/etc/postfix/dkim/keytable -SigningTable refile:/etc/postfix/dkim/signingtable -InternalHosts refile:/etc/postfix/dkim/trustedhosts' >>/etc/opendkim.conf - -sed -i '/^#Canonicalization/s/simple/relaxed\/simple/' /etc/opendkim.conf -sed -i '/^#Canonicalization/s/^#//' /etc/opendkim.conf - -sed -i '/Socket/s/^#*/#/' /etc/opendkim.conf -grep -q '^Socket\s*inet:12301@localhost' /etc/opendkim.conf || echo 'Socket inet:12301@localhost' >>/etc/opendkim.conf - -# OpenDKIM daemon settings, removing previously activated socket. -sed -i '/^SOCKET/d' /etc/default/opendkim && echo "SOCKET=\"inet:12301@localhost\"" >>/etc/default/opendkim - -# Here we add to postconf the needed settings for working with OpenDKIM -echo 'Configuring Postfix with OpenDKIM settings...' -postconf -e 'smtpd_sasl_security_options = noanonymous, noplaintext' -postconf -e 'smtpd_sasl_tls_security_options = noanonymous' -postconf -e "myhostname = $maildomain" -postconf -e 'milter_default_action = accept' -postconf -e 'milter_protocol = 6' -postconf -e 'smtpd_milters = inet:localhost:12301' -postconf -e 'non_smtpd_milters = inet:localhost:12301' -postconf -e 'mailbox_command = /usr/lib/dovecot/deliver' - -# Long-term fix to prevent SMTP smuggling -postconf -e 'smtpd_forbid_bare_newline = normalize' -postconf -e 'smtpd_forbid_bare_newline_exclusions = $mynetworks' - -# A fix for "Opendkim won't start: can't open PID file?", as specified here: https://serverfault.com/a/847442 -/lib/opendkim/opendkim.service.generate -systemctl daemon-reload - -# Enable fail2ban security for dovecot and postfix. -[ ! -f /etc/fail2ban/jail.d/emailwiz.local ] && echo "[postfix] -enabled = true -[postfix-sasl] -enabled = true -[sieve] -enabled = true -[dovecot] -enabled = true" >/etc/fail2ban/jail.d/emailwiz.local - -sed -i "s|^backend = auto$|backend = systemd|" /etc/fail2ban/jail.conf - -# Enable SpamAssassin update cronjob. -if [ -f /etc/default/spamassassin ]; then - sed -i "s|^CRON=0|CRON=1|" /etc/default/spamassassin - printf "Restarting spamassassin..." - service spamassassin restart && printf " ...done\\n" - systemctl enable spamassassin -elif [ -f /etc/default/spamd ]; then - sed -i "s|^CRON=0|CRON=1|" /etc/default/spamd - printf "Restarting spamd..." - service spamd restart && printf " ...done\\n" - systemctl enable spamd -else - printf "!!! Neither /etc/default/spamassassin or /etc/default/spamd exists, this is unexpected and needs to be investigated" -fi - -for x in opendkim dovecot postfix fail2ban; do - printf "Restarting %s..." "$x" - service "$x" restart && printf " ...done\\n" - systemctl enable "$x" -done - -pval="$(tr -d '\n' <"/etc/postfix/dkim/$domain/$subdom.txt" | sed "s/k=rsa.* \"p=/k=rsa; p=/;s/\"\s*\"//;s/\"\s*).*//" | grep -o 'p=.*')" -dkimentry="$subdom._domainkey.$domain TXT v=DKIM1; k=rsa; $pval" -dmarcentry="_dmarc.$domain TXT v=DMARC1; p=reject; rua=mailto:postmaster@$domain; fo=1" -spfentry="$domain TXT v=spf1 mx a:$maildomain ip4:$ipv4 ip6:$ipv6 -all" -mxentry="$domain MX 10 $maildomain 300" - -useradd -m -G mail postmaster - -# Create a cronjob that deletes month-old postmaster mails: -cat </etc/cron.weekly/postmaster-clean -#!/bin/sh - -find /home/postmaster/Mail -type f -mtime +30 -name '*.mail*' -delete >/dev/null 2>&1 -exit 0 -EOF -chmod 755 /etc/cron.weekly/postmaster-clean - -grep -q '^deploy-hook = echo "$RENEWED_DOMAINS" | grep -q' /etc/letsencrypt/cli.ini || - echo " -deploy-hook = echo \"\$RENEWED_DOMAINS\" | grep -q '$maildomain' && service postfix reload && service dovecot reload" >>/etc/letsencrypt/cli.ini - -echo "NOTE: Elements in the entries might appear in a different order in your registrar's DNS settings. -$dkimentry -$dmarcentry -$spfentry -$mxentry" >"$HOME/dns_emailwizard" - -printf "\033[31m - _ _ -| \ | | _____ ___ -| \| |/ _ \ \ /\ / (_) -| |\ | (_) \ V V / _ -|_| \_|\___/ \_/\_/ (_)\033[0m - -Add these three records to your DNS TXT records on either your registrar's site -or your DNS server: -\033[32m -$dkimentry - -$dmarcentry - -$spfentry - -$mxentry -\033[0m -NOTE: You may need to omit the \`.$domain\` portion at the beginning if -inputting them in a registrar's web interface. - -Also, these are now saved to \033[34m~/dns_emailwizard\033[0m in case you want them in a file. - -Once you do that, you're done! Check the README for how to add users/accounts -and how to log in.\n" -- cgit v1.2.3