· 10 years ago · Sep 08, 2016, 08:08 AM
1#!/bin/bash
2#Created by Magical Unicorns
3#For Mail
4
5export LC_ALL=C
6
7#Enter variables
8echo -n "Enter hostname (ex. host89): "
9read HOST
10echo -n "Enter domain (ex. sander89.yks): "
11read DOMEEN
12echo -n "Enter IP (ex. 10.10.10.81): "
13read IPADDR
14
15echo -e "\e[92mNOTE:\e[39m Checking if POSTFIX, DOVECOT, PROCMAIL, SPAMASSASSIN and ALPINE are installed"
16apt-get update > /dev/null 2>&1
17apt-get install postfix dovecot-imapd dovecot-common procmail spamassassin alpine -y
18echo -e "\e[95mALERT:\e[39m Script adds procmail under 'mailuser'. Please check if this user exists!"
19#Entered correct variables?
20echo -n "Is it correct? FQDN [$HOST.$DOMEEN] and IP [$IPADDR]? If not then enter [n]| "
21read answer
22if echo "$answer" | grep -iq "^n" ;
23then
24 echo "Bye!"
25 exit 1
26fi
27
28#hostname -f needs to return FQDN
29FQDN1="$HOST.$DOMEEN"
30FQDN2=$(hostname -f)
31if [[ $FQDN2 == $FQDN1 ]]; then
32 echo -e "\e[92mSUCCESS:\e[39m FQDN correct"
33else
34 #Add hostname
35cat > /etc/hostname << EOF
36$HOST
37EOF
38 echo -e "\e[95mALERT:\e[39m Reboot your machine! And start program again. Changed your /etc/hostname to $HOST"
39 exit 1
40fi
41
42#Backup old files
43cp -r /etc/postfix /etc/backup_postfix
44cp -r /etc/dovecot /etc/backup_dovecot
45cp /home/mailuser/.procmailrc /home/mailuser/.backup_procmailrc
46
47echo -e "\e[92mNOTE:\e[39m Backup of old files completed"
48
49#Write text what is in EOF
50#NB! Writes over files!
51#Setting up NTP
52type ntpd > /dev/null 2>&1
53
54if [ $? -ne 0 ]
55then
56 echo -e "\e[92mNOTE:\e[39m /etc/postfix/main.cf Starting to update and install ntp"
57 apt-get install ntp -y
58fi
59cat >> /etc/ntp.conf << "EOF"
60server ntp.ut.ee
61EOF
62service ntp restart
63
64#Check if certificates exist, if not create them
65POSTFIXKEY=$(openssl rsa -noout -modulus -in /etc/ssl/private/postfix.key | openssl md5 | cut -d' ' -f2)
66POSTFIXPEM=$(openssl x509 -noout -modulus -in /etc/ssl/certs/postfix.pem | openssl md5 | cut -d' ' -f2)
67DOVECOTKEY=$(openssl rsa -noout -modulus -in /etc/ssl/private/dovecot.key | openssl md5 | cut -d' ' -f2)
68DOVECOTPEM=$(openssl x509 -noout -modulus -in /etc/ssl/certs/dovecot.pem | openssl md5 | cut -d' ' -f2)
69if [ -e /etc/ssl/certs/dovecot.pem ] && [ -e /etc/ssl/private/dovecot.key ] && [ -e /etc/ssl/certs/postfix.pem ] && [ -e /etc/ssl/private/postfix.key ]; then
70 echo -e "\e[92mSUCCESS:\e[39m Certs Exist"
71
72 #Check if the checksums match, if not recreate them
73 if [ $POSTFIXKEY == $POSTFIXPEM ] && [ $DOVECOTKEY == $DOVECOTPEM ]; then
74 echo -e "\e[92mSUCCESS:\e[39m Checksums Match"
75 else
76 openssl req -new -x509 -days 3650 -nodes -out /etc/ssl/certs/dovecot.pem -keyout /etc/ssl/private/dovecot.key -subj "/C=EE/ST=Tartumaa/L=Tartu/O=Lab/CN=$HOST.$DOMEEN" > /dev/null 2>&1
77 cp /etc/ssl/certs/dovecot.pem /etc/ssl/certs/postfix.pem
78 cp /etc/ssl/private/dovecot.key /etc/ssl/private/postfix.key
79 chmod 640 /etc/ssl/private/dovecot.key
80 chmod 640 /etc/ssl/private/postfix.key
81 chgrp ssl-cert /etc/ssl/private/dovecot.key
82 chgrp ssl-cert /etc/ssl/private/postfix.key
83 echo -e "\e[95mALERT:\e[39m Cert checksums didn't mach, created new ones"
84 fi
85else
86 openssl req -new -x509 -days 3650 -nodes -out /etc/ssl/certs/dovecot.pem -keyout /etc/ssl/private/dovecot.key -subj "/C=EE/ST=Tartumaa/L=Tartu/O=Lab/CN=$HOST.$DOMEEN" > /dev/null 2>&1
87 cp /etc/ssl/certs/dovecot.pem /etc/ssl/certs/postfix.pem
88 cp /etc/ssl/private/dovecot.key /etc/ssl/private/postfix.key
89 chmod 640 /etc/ssl/private/dovecot.key
90 chmod 640 /etc/ssl/private/postfix.key
91 chgrp ssl-cert /etc/ssl/private/dovecot.key
92 chgrp ssl-cert /etc/ssl/private/postfix.key
93 echo -e "\e[95mALERT:\e[39m One or more certs didn't exist, created them"
94fi
95
96
97cat > /etc/postfix/main.cf << EOF
98# See /usr/share/postfix/main.cf.dist for a commented, more complete version
99
100#Procmail as default mail delivery routine
101mailbox_command = /usr/bin/procmail
102
103# Debian specific: Specifying a file name will cause the first
104# line of that file to be used as the name. The Debian default
105# is /etc/mailname.
106#myorigin = /etc/mailname
107
108smtpd_banner = \$myhostname ESMTP \$mail_name (Debian/GNU)
109biff = no
110
111# appending .domain is the MUA's job.
112append_dot_mydomain = no
113
114# Uncomment the next line to generate "delayed mail" warnings
115#delay_warning_time = 4h
116
117readme_directory = no
118
119# TLS parameters
120smtpd_use_tls=yes
121smtpd_tls_session_cache_database = btree:\${data_directory}/smtpd_scache
122smtp_tls_session_cache_database = btree:\${data_directory}/smtp_scache
123smtpd_tls_security_level = may
124smtpd_tls_cert_file=/etc/ssl/certs/postfix.pem
125smtpd_tls_key_file=/etc/ssl/private/postfix.key
126smtpd_tls_loglevel = 1
127smtp_tls_loglevel = 1
128inet_protocols = ipv4
129
130#Enabling SASL, to send messages outside our domain
131smtpd_sasl_type = dovecot
132smtpd_sasl_path = private/auth
133smtpd_sasl_auth_enable = yes
134
135# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
136# information on enabling SSL in the smtp client.
137
138smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
139
140myhostname = mail.$DOMEEN
141mydomain = $DOMEEN
142
143#Canonical sender aliases
144sender_canonical_maps = hash:/etc/postfix/canonical
145alias_maps = hash:/etc/aliases
146alias_database = hash:/etc/aliases
147#What domains to use in outbound mail:
148myorigin = /etc/mailname
149#What domains to receive mail for:
150mydestination = \$mydomain, $HOST.\$mydomain, mail.\$mydomain, localhost.\$mydomain, , localhost
151#relayhost =
152#mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
153mynetworks_style = host
154mailbox_size_limit = 0
155recipient_delimiter = +
156inet_interfaces = all
157EOF
158echo -e "\e[92mNOTE:\e[39m /etc/postfix/main.cf is overwritten"
159
160cat > /etc/postfix/master.cf << "EOF"
161# ==========================================================================
162# service type private unpriv chroot wakeup maxproc command + args
163# (yes) (yes) (yes) (never) (100)
164# ==========================================================================
165smtp inet n - - - - smtpd
166#SASL authentication over STARTTLS, over submission port tcp/587
167submission inet n - - - - smtpd
168 -o syslog_name=postfix/submission
169 -o smtpd_tls_security_level=encrypt
170 -o smtpd_sasl_auth_enable=yes
171 -o smtpd_sasl_path=private/auth
172#Restrict anonymous submission
173 -o smtpd_sasl_security_options=noanonymous
174#Only allow SASL authenticated clients
175 -o smtpd_client_restrictions=permit_sasl_authenticated,reject
176#Only allow SASL authenticated relaying
177 -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
178 -o milter_macro_daemon_name=ORIGINATING
179#explicit TLS (SMTPS)
180smtps inet n - - - - smtpd
181 -o syslog_name=postfix/smtps
182 -o smtpd_tls_wrappermode=yes
183 -o smtpd_sasl_auth_enable=yes
184 -o smtpd_sasl_path=private/auth
185 -o smtpd_sasl_security_options=noanonymous
186 -o smtpd_client_restrictions=permit_sasl_authenticated,reject
187 -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
188 -o milter_macro_daemon_name=ORIGINATING
189pickup unix n - - 60 1 pickup
190cleanup unix n - - - 0 cleanup
191qmgr unix n - n 300 1 qmgr
192tlsmgr unix - - - 1000? 1 tlsmgr
193rewrite unix - - - - - trivial-rewrite
194bounce unix - - - - 0 bounce
195defer unix - - - - 0 bounce
196trace unix - - - - 0 bounce
197verify unix - - - - 1 verify
198flush unix n - - 1000? 0 flush
199proxymap unix - - n - - proxymap
200proxywrite unix - - n - 1 proxymap
201smtp unix - - - - - smtp
202relay unix - - - - - smtp
203showq unix n - - - - showq
204error unix - - - - - error
205retry unix - - - - - error
206discard unix - - - - - discard
207local unix - n n - - local
208virtual unix - n n - - virtual
209lmtp unix - - - - - lmtp
210anvil unix - - - - 1 anvil
211scache unix - - - - 1 scache
212maildrop unix - n n - - pipe
213 flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
214uucp unix - n n - - pipe
215 flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
216ifmail unix - n n - - pipe
217 flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
218bsmtp unix - n n - - pipe
219 flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
220scalemail-backend unix - n n - 2 pipe
221 flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
222mailman unix - n n - - pipe
223 flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
224 ${nexthop} ${user}
225EOF
226echo -e "\e[92mNOTE:\e[39m /etc/postfix/master.cf is overwritten"
227
228#Create file canonical
229
230touch /etc/postfix/canonical
231
232cat > /etc/postfix/canonical << EOF
233@$HOST.$DOMEEN @$DOMEEN
234@mail.$DOMEEN @$DOMEEN
235EOF
236
237echo -e "\e[92mNOTE:\e[39m /etc/postfix/canonical is overwritten"
238
239cat > /etc/mailname << EOF
240$HOST.$DOMEEN
241EOF
242
243echo -e "\e[92mNOTE:\e[39m /etc/postfix/canonical is overwritten"
244
245#Compile the canonical file into binary hash table: -> creates /etc/postfix/canonical.db
246postmap /etc/postfix/canonical
247
248#Dovecot
249if [ ! -d /var/log/dovecot ]
250then
251 mkdir /var/log/dovecot
252 chown dovecot:dovecot /var/log/dovecot
253 chmod 640 /var/log/dovecot
254 echo -e "\e[92mNOTE:\e[39m /var/log/dovecot is created"
255fi
256echo -e "\e[92mNOTE:\e[39m /var/log/dovecot exists"
257
258#Create conf.d folder if it does not exist
259if [ ! -d /etc/dovecot/conf.d ]
260then
261 mkdir -p /etc/dovecot/conf.d
262fi
263
264cat > /etc/dovecot/conf.d/10-logging.conf << "EOF"
265log_path = /var/log/dovecot/dovecot.log
266mail_debug = yes
267EOF
268echo -e "\e[92mNOTE:\e[39m /etc/dovecot/conf.d/10-logging.conf is overwritten"
269
270cat > /etc/dovecot/conf.d/10-ssl.conf << "EOF"
271ssl = yes
272ssl_cert = </etc/ssl/certs/dovecot.pem
273ssl_key = </etc/ssl/private/dovecot.key
274EOF
275echo -e "\e[92mNOTE:\e[39m /etc/dovecot/conf.d/10-ssl.conf is overwritten"
276
277cat > /etc/dovecot/conf.d/10-auth.conf << "EOF"
278#Allows login over SSL/TLS only
279disable_plaintext_auth = yes
280#LOGIN is typically used only by SMTP servers to let Outlook clients perform SMTP authentication
281auth_mechanisms = plain login
282!include auth-system.conf.ext
283EOF
284echo -e "\e[92mNOTE:\e[39m /etc/dovecot/conf.d/10-auth.conf is overwritten"
285
286cat > /etc/dovecot/conf.d/10-mail.conf << "EOF"
287mail_location = mbox:~/Mail:INBOX=/var/mail/%u
288namespace inbox {
289 inbox = yes
290}
291EOF
292echo -e "\e[92mNOTE:\e[39m /etc/dovecot/conf.d/10-mail.conf is overwritten"
293
294cat > /etc/dovecot/conf.d/10-master.conf << "EOF"
295service auth {
296#Postfix smtp-auth
297 unix_listener /var/spool/postfix/private/auth {
298 mode = 0666
299 user = postfix
300 group = postfix
301 }
302}
303EOF
304echo -e "\e[92mNOTE:\e[39m /etc/dovecot/conf.d/10-master.conf is overwritten"
305
306cat > /etc/dovecot/dovecot.conf << "EOF"
307!include_try /usr/share/dovecot/protocols.d/*.protocol
308dict {
309 #quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext
310 #expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext
311}
312!include conf.d/*.conf
313!include_try local.conf
314EOF
315echo -e "\e[92mNOTE:\e[39m /etc/dovecot/dovecot.conf is overwritten"
316
317#Procmail ja Spamassassin
318touch /home/mailuser/.procmailrc
319chown mailuser:mailuser /home/mailuser/.procmailrc
320chmod 644 /home/mailuser/.procmailrc
321cat > /home/mailuser/.procmailrc << "EOF"
322# SpamAssassin sample procmailrc
323#
324# Pipe the mail through spamassassin (replace 'spamassassin' with 'spamc'
325# if you use the spamc/spamd combination)
326#
327# The condition line ensures that only messages smaller than 250 kB
328# (250 * 1024 = 256000 bytes) are processed by SpamAssassin. Most spam
329# isn't bigger than a few k and working with big messages can bring
330# SpamAssassin to its knees.
331#
332# The lock file ensures that only 1 spamassassin invocation happens
333# at 1 time, to keep the load down.
334#
335:0fw: spamassassin.lock
336* < 256000
337| spamc
338
339# Mails with a score of 15 or higher are almost certainly spam (with 0.05%
340# false positives according to rules/STATISTICS.txt). Let's put them in a
341# different mbox. (This one is optional.)
342:0:
343* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
344mail/almost-certainly-spam
345
346# All mail tagged as spam (eg. with a score higher than the set threshold)
347# is moved to "probably-spam".
348:0:
349* ^X-Spam-Status: Yes
350mail/probably-spam
351
352# Work around procmail bug: any output on stderr will cause the "F" in "From"
353# to be dropped. This will re-add it.
354:0
355* ^^rom[ ]
356{
357 LOG="*** Dropped F off From_ header! Fixing up. "
358
359 :0 fhw
360 | sed -e '1s/^/F/'
361}
362EOF
363echo -e "\e[92mNOTE:\e[39m /home/mailuser/.procmailrc is overwritten"
364
365#Creating Mail aliases to forward mail to mailuser
366cat > /etc/aliases << EOF
367postmaster: root
368root: mailuser
369user: mailuser
370EOF
371#Regenerate alias database
372newaliases
373
374echo -e "\e[92mNOTE:\e[39m Created aliases for 'mailuser'"
375
376#Restart postfix and set to start postfix after reboot
377service postfix restart
378update-rc.d postfix enable
379service postfix status
380
381#Restart dovecot and set to start dovecot after reboot
382service dovecot restart
383update-rc.d dovecot enable
384service dovecot status
385
386##Restart spamassassin and set to start spamassassin after reboot
387service spamassassin restart
388update-rc.d spamassassin enable
389service spamassassin status
390
391#Show recent logs
392tail /var/log/dovecot/dovecot.log
393tail /var/log/mail.log
394#Test sending and receiving mail to mailuser and user
395
396echo -e "\e[92mDONE\e[39m...Check if there are any errors. Have a nice day"