diff options
| -rw-r--r-- | emailwiz.sh | 32 |
1 files changed, 13 insertions, 19 deletions
diff --git a/emailwiz.sh b/emailwiz.sh index 4167f88..ef8d283 100644 --- a/emailwiz.sh +++ b/emailwiz.sh @@ -1,17 +1,5 @@ #!/bin/sh -# THE SETUP - -# Mail will be stored in non-retarded Maildirs because it's $currentyear. This -# makes it easier for use with isync, which is what I care about so I can have -# an offline repo of mail. - -# The mailbox names are: Inbox, Sent, Drafts, Archive, Junk, Trash - -# Use the typical unix login system for mail users. Users will log into their -# email with their passnames on the server. No usage of a redundant mySQL -# database to do this. - # BEFORE INSTALLING # Have a Debian or Ubuntu server with a static IP and DNS records (usually @@ -29,9 +17,7 @@ umask 0022 -apt-get install -y postfix postfix-pcre dovecot-imapd dovecot-sieve opendkim spamassassin spamc net-tools fail2ban -# Check if OpenDKIM is installed and install it if not. -which opendkim-genkey >/dev/null 2>&1 || apt-get install opendkim-tools +apt-get install -y postfix postfix-pcre dovecot-imapd dovecot-sieve opendkim opendkim-tools spamassassin spamc net-tools fail2ban domain="$(cat /etc/mailname)" subdom=${MAIL_SUBDOM:-mail} maildomain="$subdom.$domain" @@ -97,10 +83,13 @@ postconf -e 'smtpd_sasl_auth_enable = yes' postconf -e 'smtpd_sasl_type = dovecot' postconf -e 'smtpd_sasl_path = private/auth' -# Sender, relay and recipient restrictions +# helo, sender, relay and recipient restrictions postconf -e "smtpd_sender_login_maps = pcre:/etc/postfix/login_maps.pcre" +postconf -e 'smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_sender_login_mismatch, reject_unknown_reverse_client_hostname, reject_unknown_sender_domain' postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_unknown_recipient_domain' postconf -e 'smtpd_relay_restrictions = permit_sasl_authenticated, reject_unauth_destination' +postconf -e 'smtpd_helo_required = yes' +postconf -e 'smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname' # NOTE: the trailing slash here, or for any directory name in the home_mailbox # command, is necessary as it distinguishes a maildir (which is the actual @@ -303,9 +292,6 @@ postconf -e 'milter_protocol = 6' postconf -e 'smtpd_milters = inet:localhost:12301' postconf -e 'non_smtpd_milters = inet:localhost:12301' postconf -e 'mailbox_command = /usr/lib/dovecot/deliver' -postconf -e 'smtpd_helo_required = yes' -postconf -e 'smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname' -postconf -e 'smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_sender_login_mismatch, reject_unknown_reverse_client_hostname, reject_unknown_sender_domain' # A fix for "Opendkim won't start: can't open PID file?", as specified here: https://serverfault.com/a/847442 /lib/opendkim/opendkim.service.generate @@ -335,6 +321,14 @@ mxentry="$domain MX 10 $maildomain 300" useradd -m -G mail dmarc +# Create a cronjob that deletes month-old dmarc feedback: +cat <<EOF > /etc/cron.weekly/dmarc-clean +#!/bin/sh + +find /home/dmarc/Mail -type f -mtime +30 -name '*.mail*' -delete +EOF +chmod 755 /etc/cron.weekly/dmarc-clean + grep -q '^deploy-hook = echo "$RENEWED_DOMAINS" | grep -q' /etc/letsencrypt/cli.ini || echo " deploy-hook = echo \"\$RENEWED_DOMAINS\" | grep -q '$maildomain' && service postfix reload && service dovecot reload" >> /etc/letsencrypt/cli.ini |