2014-10-20 20:20:24 +00:00
|
|
|
#!/bin/bash
|
2014-10-04 21:57:26 +00:00
|
|
|
# OpenDKIM
|
2014-10-13 14:00:26 +00:00
|
|
|
# --------
|
2014-10-04 21:57:26 +00:00
|
|
|
#
|
|
|
|
# OpenDKIM provides a service that puts a DKIM signature on outbound mail.
|
|
|
|
#
|
|
|
|
# The DNS configuration for DKIM is done in the management daemon.
|
2013-08-21 20:53:22 +00:00
|
|
|
|
2014-06-03 11:12:38 +00:00
|
|
|
source setup/functions.sh # load our functions
|
2014-10-20 20:33:20 +00:00
|
|
|
source /etc/mailinabox.conf # load global vars
|
2014-05-01 19:13:00 +00:00
|
|
|
|
2014-10-04 21:57:26 +00:00
|
|
|
# Install DKIM...
|
2015-08-19 19:58:35 +00:00
|
|
|
echo Installing OpenDKIM/OpenDMARC...
|
2015-02-16 23:16:09 +00:00
|
|
|
apt_install opendkim opendkim-tools opendmarc
|
2013-08-21 20:53:22 +00:00
|
|
|
|
2013-09-01 14:13:51 +00:00
|
|
|
# Make sure configuration directories exist.
|
2013-08-21 20:53:22 +00:00
|
|
|
mkdir -p /etc/opendkim;
|
|
|
|
mkdir -p $STORAGE_ROOT/mail/dkim
|
|
|
|
|
2013-09-01 14:13:51 +00:00
|
|
|
# Used in InternalHosts and ExternalIgnoreList configuration directives.
|
|
|
|
# Not quite sure why.
|
2013-08-21 20:53:22 +00:00
|
|
|
echo "127.0.0.1" > /etc/opendkim/TrustedHosts
|
|
|
|
|
2018-07-07 18:41:41 +00:00
|
|
|
# We need to at least create these files, since we reference them later.
|
|
|
|
# Otherwise, opendkim startup will fail
|
|
|
|
touch /etc/opendkim/KeyTable
|
|
|
|
touch /etc/opendkim/SigningTable
|
|
|
|
|
2013-08-21 20:53:22 +00:00
|
|
|
if grep -q "ExternalIgnoreList" /etc/opendkim.conf; then
|
2014-10-04 21:57:26 +00:00
|
|
|
true # already done #NODOC
|
2013-08-21 20:53:22 +00:00
|
|
|
else
|
2014-10-04 21:57:26 +00:00
|
|
|
# Add various configuration options to the end of `opendkim.conf`.
|
2013-08-21 20:53:22 +00:00
|
|
|
cat >> /etc/opendkim.conf << EOF;
|
2019-12-01 21:24:38 +00:00
|
|
|
Canonicalization relaxed/simple
|
2013-08-21 20:53:22 +00:00
|
|
|
MinimumKeyBits 1024
|
|
|
|
ExternalIgnoreList refile:/etc/opendkim/TrustedHosts
|
|
|
|
InternalHosts refile:/etc/opendkim/TrustedHosts
|
|
|
|
KeyTable refile:/etc/opendkim/KeyTable
|
|
|
|
SigningTable refile:/etc/opendkim/SigningTable
|
2016-05-06 13:06:52 +00:00
|
|
|
Socket inet:8891@127.0.0.1
|
2013-08-21 20:53:22 +00:00
|
|
|
RequireSafeKeys false
|
|
|
|
EOF
|
|
|
|
fi
|
|
|
|
|
2015-06-25 13:02:40 +00:00
|
|
|
# Create a new DKIM key. This creates mail.private and mail.txt
|
|
|
|
# in $STORAGE_ROOT/mail/dkim. The former is the private key and
|
|
|
|
# the latter is the suggested DNS TXT entry which we'll include
|
2016-02-18 14:38:33 +00:00
|
|
|
# in our DNS setup. Note that the files are named after the
|
2015-06-25 13:02:40 +00:00
|
|
|
# 'selector' of the key, which we can change later on to support
|
|
|
|
# key rotation.
|
|
|
|
#
|
|
|
|
# A 1024-bit key is seen as a minimum standard by several providers
|
|
|
|
# such as Google. But they and others use a 2048 bit key, so we'll
|
|
|
|
# do the same. Keys beyond 2048 bits may exceed DNS record limits.
|
2014-06-03 21:42:33 +00:00
|
|
|
if [ ! -f "$STORAGE_ROOT/mail/dkim/mail.private" ]; then
|
2015-06-24 22:49:19 +00:00
|
|
|
opendkim-genkey -b 2048 -r -s mail -D $STORAGE_ROOT/mail/dkim
|
2013-08-21 20:53:22 +00:00
|
|
|
fi
|
|
|
|
|
2013-09-01 14:13:51 +00:00
|
|
|
# Ensure files are owned by the opendkim user and are private otherwise.
|
2013-08-21 20:53:22 +00:00
|
|
|
chown -R opendkim:opendkim $STORAGE_ROOT/mail/dkim
|
|
|
|
chmod go-rwx $STORAGE_ROOT/mail/dkim
|
|
|
|
|
2021-03-11 22:25:58 +00:00
|
|
|
tools/editconf.py /etc/opendmarc.conf -s \
|
2015-02-16 23:16:09 +00:00
|
|
|
"Syslog=true" \
|
2021-04-13 07:50:23 +00:00
|
|
|
"Socket=inet:8893@[127.0.0.1]" \
|
|
|
|
"FailureReports=true"
|
2015-02-16 23:16:09 +00:00
|
|
|
|
2020-12-25 22:22:24 +00:00
|
|
|
# SPFIgnoreResults causes the filter to ignore any SPF results in the header
|
|
|
|
# of the message. This is useful if you want the filter to perfrom SPF checks
|
|
|
|
# itself, or because you don't trust the arriving header. This added header is
|
|
|
|
# used by spamassassin to evaluate the mail for spamminess.
|
|
|
|
|
2021-03-11 22:25:58 +00:00
|
|
|
tools/editconf.py /etc/opendmarc.conf -s \
|
2020-12-25 22:22:24 +00:00
|
|
|
"SPFIgnoreResults=true"
|
|
|
|
|
|
|
|
# SPFSelfValidate causes the filter to perform a fallback SPF check itself
|
|
|
|
# when it can find no SPF results in the message header. If SPFIgnoreResults
|
|
|
|
# is also set, it never looks for SPF results in headers and always performs
|
|
|
|
# the SPF check itself when this is set. This added header is used by
|
|
|
|
# spamassassin to evaluate the mail for spamminess.
|
|
|
|
|
2021-03-11 22:25:58 +00:00
|
|
|
tools/editconf.py /etc/opendmarc.conf -s \
|
2020-12-25 22:22:24 +00:00
|
|
|
"SPFSelfValidate=true"
|
|
|
|
|
2021-04-13 07:50:23 +00:00
|
|
|
# Enables generation of failure reports for sending domains that publish a
|
|
|
|
# "none" policy.
|
|
|
|
|
|
|
|
tools/editconf.py /etc/opendmarc.conf -s \
|
|
|
|
"FailureReportsOnNone=true"
|
|
|
|
|
2020-12-25 22:22:24 +00:00
|
|
|
# AlwaysAddARHeader Adds an "Authentication-Results:" header field even to
|
|
|
|
# unsigned messages from domains with no "signs all" policy. The reported DKIM
|
|
|
|
# result will be "none" in such cases. Normally unsigned mail from non-strict
|
|
|
|
# domains does not cause the results header field to be added. This added header
|
|
|
|
# is used by spamassassin to evaluate the mail for spamminess.
|
|
|
|
|
2021-03-11 22:25:58 +00:00
|
|
|
tools/editconf.py /etc/opendkim.conf -s \
|
2020-12-25 22:22:24 +00:00
|
|
|
"AlwaysAddARHeader=true"
|
|
|
|
|
2015-02-16 23:16:09 +00:00
|
|
|
# Add OpenDKIM and OpenDMARC as milters to postfix, which is how OpenDKIM
|
|
|
|
# intercepts outgoing mail to perform the signing (by adding a mail header)
|
|
|
|
# and how they both intercept incoming mail to add Authentication-Results
|
|
|
|
# headers. The order possibly/probably matters: OpenDMARC relies on the
|
|
|
|
# OpenDKIM Authentication-Results header already being present.
|
|
|
|
#
|
|
|
|
# Be careful. If we add other milters later, this needs to be concatenated
|
|
|
|
# on the smtpd_milters line.
|
2015-03-21 16:14:01 +00:00
|
|
|
#
|
|
|
|
# The OpenDMARC milter is skipped in the SMTP submission listener by
|
|
|
|
# configuring smtpd_milters there to only list the OpenDKIM milter
|
|
|
|
# (see mail-postfix.sh).
|
2021-03-11 22:25:58 +00:00
|
|
|
tools/editconf.py /etc/postfix/main.cf \
|
2015-02-16 23:16:09 +00:00
|
|
|
"smtpd_milters=inet:127.0.0.1:8891 inet:127.0.0.1:8893"\
|
2013-08-21 20:53:22 +00:00
|
|
|
non_smtpd_milters=\$smtpd_milters \
|
|
|
|
milter_default_action=accept
|
|
|
|
|
2018-07-07 18:41:41 +00:00
|
|
|
# We need to explicitly enable the opendmarc service, or it will not start
|
|
|
|
hide_output systemctl enable opendmarc
|
|
|
|
|
2013-09-01 14:13:51 +00:00
|
|
|
# Restart services.
|
2014-07-16 13:06:45 +00:00
|
|
|
restart_service opendkim
|
2015-02-16 23:16:09 +00:00
|
|
|
restart_service opendmarc
|
2014-07-16 13:06:45 +00:00
|
|
|
restart_service postfix
|
2013-08-21 20:53:22 +00:00
|
|
|
|