Tweaks and fixes

README.md

@@ -1,3 +1,10 @@
 # emailwiz-arch
 
-Same as emailwiz but for Arch Linux.
+Same as [emailwiz](https://github.com/LukeSmithxyz/emailwiz) but for Arch Linux.
+
+# NOTE
+
+You need to fill the value of **$domain** as outlined in the script.  
+For questions or bug reports email me at <mgislv@ceppo.xyz>  
+  
+For more info read https://github.com/LukeSmithxyz/emailwiz/blob/master/README.md

emailwiz.sh

@@ -15,9 +15,7 @@
 # DEPENDENCIES BEFORE RUNNING
 
 # 1. Have a Arch system with a static IP and all that. Pretty much any
-# default VPS offered by a company will have all the basic stuff you need. This
-# script might run on Artix as well. Haven't tried it. If you have, tell me
-# what happens.
+# default VPS offered by a company will have all the basic stuff you need.
 
 # 2. Have a Let's Encrypt SSL certificate for $maildomain. You might need one
 # for $domain as well, but they're free with Let's Encypt so you should have
@@ -29,14 +27,17 @@
 # Clear out /etc/postfix and /etc/dovecot yourself if needbe.
 
 echo 'Installing programs...'
-pacman -Syu --needed postfix dovecot opendkim spamassassin pigeonhole
+pacman -Syu --needed postfix dovecot opendkim spamassassin pigeonhole certbot
 # Put your domain.tld here (not your subdomain)
 domain='domain.tld'
+
+[ "$domain" = "domain.tld" ] && echo 'Fill in your domain name!' && exit 1
+
 subdom=${MAIL_SUBDOM:-mail}
 maildomain="$subdom.$domain"
 certdir="/etc/letsencrypt/live/$maildomain"
 
-[ ! -d "$certdir" ] && certdir="$(dirname "$(certbot certificates 2>/dev/null | grep "$maildomain\|*.$domain" -A 2 | awk '/Certificate Path/ {print $3}' | head -n1)")"
+[ ! -d "$certdir" ] && certdir="$(dirname "$(certbot certificates 2>/dev/null | grep -A 2 "$maildomain\|*.$domain" | awk '/Certificate Path/ {print $3}' | head -n1)")"
 
 [ ! -d "$certdir" ] && echo "Note! You must first have a Let's Encrypt Certbot HTTPS/SSL Certificate for $maildomain.
 
@@ -56,11 +57,17 @@ echo "Configuring Postfix's main.cf..."
 # Necessary to later start Postfix
 postalias /etc/postfix/aliases
 
+# List of domains that this machine considers itself the final destination for
+postconf -e 'mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain'
+
 # Change the cert/key files to the default locations of the Let's Encrypt cert/key
 postconf -e "smtpd_tls_key_file=$certdir/privkey.pem"
 postconf -e "smtpd_tls_cert_file=$certdir/fullchain.pem"
 postconf -e "smtp_tls_CAfile=$certdir/cert.pem"
 
+# DH parameters
+postconf -e 'smtpd_tls_dh1024_param_file = /etc/dovecot/dh.pem'
+
 # Enable, but do not require TLS. Requiring it with other server would cause
 # mail delivery problems and requiring it locally would cause many other
 # issues.
@@ -79,7 +86,9 @@ postconf -e 'smtp_tls_protocols = >=TLSv1.2, <=TLSv1.3'
 # Exclude suboptimal ciphers.
 postconf -e 'tls_preempt_cipherlist = yes'
 postconf -e 'smtpd_tls_ciphers = high'
-postconf -e 'smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, LOW, EXP, MEDIUM, ADH, AECDH, DSS, ECDSA, CAMELLIA128, 3DES, CAMELLIA256, RSA+AES, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, KRB5-DES, CBC3-SHA'
+postconf -e 'smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, LOW, EXP, MEDIUM, ADH, AECDH, DSS, ECDSA, CAMELLIA128, 3DES, CAMELLIA256, RSA+AES, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, KRB5-DES, CBC3-SHA, SHA1, SHA256, SHA384'
+# Disable insecure renegotiation
+postconf -e 'tls_ssl_options = NO_RENEGOTIATION'
 
 # Here we tell Postfix to look to Dovecot for authenticating users/passwords.
 # Dovecot will be putting an authentication socket in /var/spool/postfix/private/auth
@@ -87,9 +96,6 @@ postconf -e 'smtpd_sasl_auth_enable = yes'
 postconf -e 'smtpd_sasl_type = dovecot'
 postconf -e 'smtpd_sasl_path = private/auth'
 
-# Sender and recipient restrictions
-postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination'
-
 # Prevent IP address leaks (also removes ip from incoming email)
 postconf -e 'header_checks = regexp:/etc/postfix/header_checks'
 
@@ -116,10 +122,12 @@ submission inet n       -       n       -       -       smtpd
   -o smtpd_tls_security_level=encrypt
   -o smtpd_sasl_auth_enable=yes
   -o smtpd_tls_auth_only=yes
+  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
 smtps     inet  n       -       n       -       -       smtpd
   -o syslog_name=postfix/smtps
   -o smtpd_tls_wrappermode=yes
   -o smtpd_sasl_auth_enable=yes
+  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
 spamassassin unix -     n       n       -       -       pipe
   flags=R user=spamd argv=/usr/bin/vendor_perl/spamc -e /usr/bin/sendmail -oi -f ${sender} ${recipient}' >> /etc/postfix/master.cf
 
@@ -131,7 +139,7 @@ spamassassin unix -     n       n       -       -       pipe
 echo 'Generating a DH parameters file for Dovecot...'
 
 mkdir -p /etc/dovecot
-openssl dhparam -out /etc/dovecot/dh.pem 4096
+openssl dhparam -out /etc/dovecot/dh.pem 3072
 
 echo 'Creating Dovecot config...'
 
@@ -146,21 +154,21 @@ ssl = required
 ssl_cert = <$certdir/fullchain.pem
 ssl_key = <$certdir/privkey.pem
 ssl_min_protocol = TLSv1.2
-ssl_cipher_list=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!LOW:!MEDIUM:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
+ssl_cipher_list=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!LOW:!MEDIUM:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!SHA1:!SHA256:!SHA384
 ssl_prefer_server_ciphers = yes
 ssl_dh = </etc/dovecot/dh.pem
 # Plaintext login. This is safe and easy thanks to SSL.
 auth_mechanisms = plain login
 auth_username_format = %n
 
-protocols = \$protocols imap
+protocols = imap lmtp
 
 # Search for valid users in /etc/passwd
 userdb {
 	driver = passwd
 }
 
-#Fallback: Use plain old PAM to find user passwords
+# Fallback: Use plain old PAM to find user passwords
 passdb {
 	driver = pam
 }
@@ -179,7 +187,6 @@ namespace inbox {
 	mailbox Junk {
 		special_use = \\Junk
 		auto = subscribe
-		autoexpunge = 30d
 	}
 
 	mailbox Sent {
@@ -206,21 +213,14 @@ service auth {
 	}
 }
 
-protocol lda {
-	mail_plugins = \$mail_plugins sieve
-}
-
 protocol lmtp {
 	mail_plugins = \$mail_plugins sieve
 }
 
 plugin {
-	sieve = ~/.dovecot.sieve
 	sieve_default = /var/lib/dovecot/sieve/default.sieve
-	sieve_dir = ~/.sieve
 	sieve_global = /var/lib/dovecot/sieve/
-}
-" > /etc/dovecot/dovecot.conf
+}" > /etc/dovecot/dovecot.conf
 
 mkdir -p /var/lib/dovecot/
 mkdir -p /var/lib/dovecot/sieve/
@@ -236,9 +236,10 @@ chown -R vmail:vmail /var/lib/dovecot
 sievec /var/lib/dovecot/sieve/default.sieve
 
 echo 'Preparing user authentication...'
+
 grep -q nullok /etc/pam.d/dovecot ||
-echo 'auth    required        pam_unix.so nullok
-account required        pam_unix.so' >> /etc/pam.d/dovecot
+echo 'auth    required pam_unix.so nullok
+account required pam_unix.so' >> /etc/pam.d/dovecot
 
 # OpenDKIM
 
@@ -250,13 +251,14 @@ account required        pam_unix.so' >> /etc/pam.d/dovecot
 # OpenDKIM is a way to authenticate your email so you can send to such services
 # without a problem.
 
-# Create an OpenDKIM key in the proper place with proper permissions.
+# Create an OpenDKIM key
 echo 'Generating OpenDKIM keys...'
 mkdir -p /etc/postfix/dkim
-opendkim-genkey -D /etc/postfix/dkim/ -d "$domain" -s "$subdom"
+opendkim-genkey -D /etc/postfix/dkim -d "$domain" -s "$subdom"
 
 # Generate the OpenDKIM info:
 echo 'Configuring OpenDKIM...'
+
 grep -q "$domain" /etc/postfix/dkim/keytable 2>/dev/null ||
 echo "$subdom._domainkey.$domain $domain:$subdom:/etc/postfix/dkim/$subdom.private" >> /etc/postfix/dkim/keytable
 
@@ -267,42 +269,39 @@ grep -q '127.0.0.1' /etc/postfix/dkim/trustedhosts 2>/dev/null ||
 echo '127.0.0.1' >> /etc/postfix/dkim/trustedhosts
 
 # ...and source it from opendkim.conf
-cp /usr/share/doc/opendkim/opendkim.conf.sample /etc/opendkim/opendkim.conf
-sed -i "s/^Domain/Domain $domain/" /etc/opendkim/opendkim.conf
-sed -i 's/example.com//g' /etc/opendkim/opendkim.conf
-grep -q '^KeyTable' /etc/opendkim/opendkim.conf 2>/dev/null || echo 'KeyTable file:/etc/postfix/dkim/keytable
+grep -q '^KeyTable' /etc/opendkim/opendkim.conf 2>/dev/null ||
+echo "KeyTable file:/etc/postfix/dkim/keytable
 SigningTable refile:/etc/postfix/dkim/signingtable
-InternalHosts refile:/etc/postfix/dkim/trustedhosts' >> /etc/opendkim/opendkim.conf
+InternalHosts refile:/etc/postfix/dkim/trustedhosts
+Domain $domain" >> /etc/opendkim/opendkim.conf
 
 sed -i '/^#Canonicalization/s/simple/relaxed\/simple/' /etc/opendkim/opendkim.conf
 sed -i '/^#Canonicalization/s/^#//' /etc/opendkim/opendkim.conf
 
 sed -i '/Socket/s/^#*/#/' /etc/opendkim/opendkim.conf
-grep -q '^Socket\s*inet:12301@localhost' /etc/opendkim/opendkim.conf || echo 'Socket inet:12301@localhost' >> /etc/opendkim/opendkim.conf
+grep -q '^Socket\s*inet:12301@localhost' /etc/opendkim/opendkim.conf ||
+echo 'Socket inet:12301@localhost' >> /etc/opendkim/opendkim.conf
 
 # Here we add to postconf the needed settings for working with OpenDKIM
-echo "Configuring Postfix with OpenDKIM settings..."
+echo 'Configuring Postfix with OpenDKIM settings...'
 postconf -e 'smtpd_sasl_security_options = noanonymous, noplaintext'
 postconf -e 'smtpd_sasl_tls_security_options = noanonymous'
-postconf -e "myhostname = $domain"
+postconf -e "myhostname = $maildomain"
 postconf -e 'milter_default_action = accept'
 postconf -e 'milter_protocol = 6'
 postconf -e 'smtpd_milters = inet:localhost:12301'
 postconf -e 'non_smtpd_milters = inet:localhost:12301'
 postconf -e 'mailbox_command = /usr/lib/dovecot/deliver'
 
-for x in spamassassin opendkim dovecot postfix; do
-	printf "Restarting %s..." "$x"
-	systemctl enable restart "$x" && printf " ...done\\n"
-done
+useradd -mG mail dmarc
+
+systemctl enable --now spamassassin opendkim dovecot postfix
 
 pval="$(tr -d "\n" </etc/postfix/dkim/$subdom.txt | sed "s/k=rsa.* \"p=/k=rsa; p=/;s/\"\s*\"//;s/\"\s*).*//" | grep -o "p=.*")"
 dkimentry="$subdom._domainkey.$domain	TXT	v=DKIM1; k=rsa; $pval"
 dmarcentry="_dmarc.$domain	TXT	v=DMARC1; p=reject; rua=mailto:dmarc@$domain; fo=1"
 spfentry="$domain	TXT	v=spf1 mx a:$maildomain -all"
 
-useradd -m -G mail dmarc
-
 echo "$dkimentry
 $dmarcentry
 $spfentry" > "$HOME/dns_emailwizard"
@@ -321,6 +320,7 @@ $dkimentry
 
 $dmarcentry
 
+Note: You will probably need to modify this later (eg. adding your ip)
 $spfentry
 \033[0m
 NOTE: You may need to omit the \`.$domain\` portion at the beginning if
@@ -329,6 +329,4 @@ inputting them in a registrar's web interface.
 Also, these are now saved to \033[34m~/dns_emailwizard\033[0m in case you want them in a file.
 
 Once you do that, you're done! Check the README for how to add users/accounts
-and how to log in.
-"
-
+and how to log in.\n"