Alexander/emailwiz-arch
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

base: Alexander:afe8d9e16d8c059803f3820c4c33b800a5ac936d
Branches Tags
Alexander:master
..
compare: Alexander:20fd3baa002920e4becb8280104486372d38974d
Branches Tags
Alexander:master

No commits in common. "afe8d9e16d8c059803f3820c4c33b800a5ac936d" and "20fd3baa002920e4becb8280104486372d38974d" have entirely different histories.
afe8d9e16d ... 20fd3baa00

2 changed files with 44 additions and 49 deletions
Show Stats Expand all files Collapse all files

9
README.md
View File

@ -1,10 +1,3 @@
# emailwiz-arch # emailwiz-arch
Same as [emailwiz](https://github.com/LukeSmithxyz/emailwiz) but for Arch Linux. Same as emailwiz but for Arch Linux.
# NOTE
You need to fill the value of **$domain** as outlined in the script.
For questions or bug reports email me at <mgislv@ceppo.xyz>
For more info read https://github.com/LukeSmithxyz/emailwiz/blob/master/README.md

84
emailwiz.sh
View File

@ -15,7 +15,9 @@
# DEPENDENCIES BEFORE RUNNING # DEPENDENCIES BEFORE RUNNING
# 1. Have a Arch system with a static IP and all that. Pretty much any # 1. Have a Arch system with a static IP and all that. Pretty much any
# default VPS offered by a company will have all the basic stuff you need. # default VPS offered by a company will have all the basic stuff you need. This
# script might run on Artix as well. Haven't tried it. If you have, tell me
# what happens.
# 2. Have a Let's Encrypt SSL certificate for $maildomain. You might need one # 2. Have a Let's Encrypt SSL certificate for $maildomain. You might need one
# for $domain as well, but they're free with Let's Encypt so you should have # for $domain as well, but they're free with Let's Encypt so you should have
@ -27,17 +29,14 @@
# Clear out /etc/postfix and /etc/dovecot yourself if needbe. # Clear out /etc/postfix and /etc/dovecot yourself if needbe.
echo 'Installing programs...' echo 'Installing programs...'
pacman -Syu --needed postfix dovecot opendkim spamassassin pigeonhole certbot pacman -Syu --needed postfix dovecot opendkim spamassassin pigeonhole
# Put your domain.tld here (not your subdomain) # Put your domain.tld here (not your subdomain)
domain='domain.tld' domain='domain.tld'
[ "$domain" = "domain.tld" ] && echo 'Fill in your domain name!' && exit 1
subdom=${MAIL_SUBDOM:-mail} subdom=${MAIL_SUBDOM:-mail}
maildomain="$subdom.$domain" maildomain="$subdom.$domain"
certdir="/etc/letsencrypt/live/$maildomain" certdir="/etc/letsencrypt/live/$maildomain"
[ ! -d "$certdir" ] && certdir="$(dirname "$(certbot certificates 2>/dev/null | grep -A 2 "$maildomain\|*.$domain" | awk '/Certificate Path/ {print $3}' | head -n1)")" [ ! -d "$certdir" ] && certdir="$(dirname "$(certbot certificates 2>/dev/null | grep "$maildomain\|*.$domain" -A 2 | awk '/Certificate Path/ {print $3}' | head -n1)")"
[ ! -d "$certdir" ] && echo "Note! You must first have a Let's Encrypt Certbot HTTPS/SSL Certificate for $maildomain. [ ! -d "$certdir" ] && echo "Note! You must first have a Let's Encrypt Certbot HTTPS/SSL Certificate for $maildomain.
@ -57,17 +56,11 @@ echo "Configuring Postfix's main.cf..."
# Necessary to later start Postfix # Necessary to later start Postfix
postalias /etc/postfix/aliases postalias /etc/postfix/aliases
# List of domains that this machine considers itself the final destination for
postconf -e 'mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain'
# Change the cert/key files to the default locations of the Let's Encrypt cert/key # Change the cert/key files to the default locations of the Let's Encrypt cert/key
postconf -e "smtpd_tls_key_file=$certdir/privkey.pem" postconf -e "smtpd_tls_key_file=$certdir/privkey.pem"
postconf -e "smtpd_tls_cert_file=$certdir/fullchain.pem" postconf -e "smtpd_tls_cert_file=$certdir/fullchain.pem"
postconf -e "smtp_tls_CAfile=$certdir/cert.pem" postconf -e "smtp_tls_CAfile=$certdir/cert.pem"
# DH parameters
postconf -e 'smtpd_tls_dh1024_param_file = /etc/dovecot/dh.pem'
# Enable, but do not require TLS. Requiring it with other server would cause # Enable, but do not require TLS. Requiring it with other server would cause
# mail delivery problems and requiring it locally would cause many other # mail delivery problems and requiring it locally would cause many other
# issues. # issues.
@ -86,9 +79,7 @@ postconf -e 'smtp_tls_protocols = >=TLSv1.2, <=TLSv1.3'
# Exclude suboptimal ciphers. # Exclude suboptimal ciphers.
postconf -e 'tls_preempt_cipherlist = yes' postconf -e 'tls_preempt_cipherlist = yes'
postconf -e 'smtpd_tls_ciphers = high' postconf -e 'smtpd_tls_ciphers = high'
postconf -e 'smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, LOW, EXP, MEDIUM, ADH, AECDH, DSS, ECDSA, CAMELLIA128, 3DES, CAMELLIA256, RSA+AES, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, KRB5-DES, CBC3-SHA, SHA1, SHA256, SHA384' postconf -e 'smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, LOW, EXP, MEDIUM, ADH, AECDH, DSS, ECDSA, CAMELLIA128, 3DES, CAMELLIA256, RSA+AES, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, KRB5-DES, CBC3-SHA'
# Disable insecure renegotiation
postconf -e 'tls_ssl_options = NO_RENEGOTIATION'
# Here we tell Postfix to look to Dovecot for authenticating users/passwords. # Here we tell Postfix to look to Dovecot for authenticating users/passwords.
# Dovecot will be putting an authentication socket in /var/spool/postfix/private/auth # Dovecot will be putting an authentication socket in /var/spool/postfix/private/auth
@ -96,6 +87,9 @@ postconf -e 'smtpd_sasl_auth_enable = yes'
postconf -e 'smtpd_sasl_type = dovecot' postconf -e 'smtpd_sasl_type = dovecot'
postconf -e 'smtpd_sasl_path = private/auth' postconf -e 'smtpd_sasl_path = private/auth'
# Sender and recipient restrictions
postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination'
# Prevent IP address leaks (also removes ip from incoming email) # Prevent IP address leaks (also removes ip from incoming email)
postconf -e 'header_checks = regexp:/etc/postfix/header_checks' postconf -e 'header_checks = regexp:/etc/postfix/header_checks'
@ -122,12 +116,10 @@ submission inet n - n - - smtpd
-o smtpd_tls_security_level=encrypt -o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes -o smtpd_sasl_auth_enable=yes
-o smtpd_tls_auth_only=yes -o smtpd_tls_auth_only=yes
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
smtps inet n - n - - smtpd smtps inet n - n - - smtpd
-o syslog_name=postfix/smtps -o syslog_name=postfix/smtps
-o smtpd_tls_wrappermode=yes -o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes -o smtpd_sasl_auth_enable=yes
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
spamassassin unix - n n - - pipe spamassassin unix - n n - - pipe
flags=R user=spamd argv=/usr/bin/vendor_perl/spamc -e /usr/bin/sendmail -oi -f ${sender} ${recipient}' >> /etc/postfix/master.cf flags=R user=spamd argv=/usr/bin/vendor_perl/spamc -e /usr/bin/sendmail -oi -f ${sender} ${recipient}' >> /etc/postfix/master.cf
@ -139,7 +131,7 @@ spamassassin unix - n n - - pipe
echo 'Generating a DH parameters file for Dovecot...' echo 'Generating a DH parameters file for Dovecot...'
mkdir -p /etc/dovecot mkdir -p /etc/dovecot
openssl dhparam -out /etc/dovecot/dh.pem 3072 openssl dhparam -out /etc/dovecot/dh.pem 4096
echo 'Creating Dovecot config...' echo 'Creating Dovecot config...'
@ -154,21 +146,21 @@ ssl = required
ssl_cert = <$certdir/fullchain.pem ssl_cert = <$certdir/fullchain.pem
ssl_key = <$certdir/privkey.pem ssl_key = <$certdir/privkey.pem
ssl_min_protocol = TLSv1.2 ssl_min_protocol = TLSv1.2
ssl_cipher_list=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!LOW:!MEDIUM:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!SHA1:!SHA256:!SHA384 ssl_cipher_list=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!LOW:!MEDIUM:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
ssl_prefer_server_ciphers = yes ssl_prefer_server_ciphers = yes
ssl_dh = </etc/dovecot/dh.pem ssl_dh = </etc/dovecot/dh.pem
# Plaintext login. This is safe and easy thanks to SSL. # Plaintext login. This is safe and easy thanks to SSL.
auth_mechanisms = plain login auth_mechanisms = plain login
auth_username_format = %n auth_username_format = %n
protocols = imap lmtp protocols = \$protocols imap
# Search for valid users in /etc/passwd # Search for valid users in /etc/passwd
userdb { userdb {
driver = passwd driver = passwd
} }
# Fallback: Use plain old PAM to find user passwords #Fallback: Use plain old PAM to find user passwords
passdb { passdb {
driver = pam driver = pam
} }
@ -187,6 +179,7 @@ namespace inbox {
mailbox Junk { mailbox Junk {
special_use = \\Junk special_use = \\Junk
auto = subscribe auto = subscribe
autoexpunge = 30d
} }
mailbox Sent { mailbox Sent {
@ -213,14 +206,21 @@ service auth {
} }
} }
protocol lda {
mail_plugins = \$mail_plugins sieve
}
protocol lmtp { protocol lmtp {
mail_plugins = \$mail_plugins sieve mail_plugins = \$mail_plugins sieve
} }
plugin { plugin {
sieve = ~/.dovecot.sieve
sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_default = /var/lib/dovecot/sieve/default.sieve
sieve_dir = ~/.sieve
sieve_global = /var/lib/dovecot/sieve/ sieve_global = /var/lib/dovecot/sieve/
}" > /etc/dovecot/dovecot.conf }
" > /etc/dovecot/dovecot.conf
mkdir -p /var/lib/dovecot/ mkdir -p /var/lib/dovecot/
mkdir -p /var/lib/dovecot/sieve/ mkdir -p /var/lib/dovecot/sieve/
@ -236,10 +236,9 @@ chown -R vmail:vmail /var/lib/dovecot
sievec /var/lib/dovecot/sieve/default.sieve sievec /var/lib/dovecot/sieve/default.sieve
echo 'Preparing user authentication...' echo 'Preparing user authentication...'
grep -q nullok /etc/pam.d/dovecot || grep -q nullok /etc/pam.d/dovecot ||
echo 'auth required pam_unix.so nullok echo 'auth required pam_unix.so nullok
account required pam_unix.so' >> /etc/pam.d/dovecot account required pam_unix.so' >> /etc/pam.d/dovecot
# OpenDKIM # OpenDKIM
@ -251,14 +250,13 @@ account required pam_unix.so' >> /etc/pam.d/dovecot
# OpenDKIM is a way to authenticate your email so you can send to such services # OpenDKIM is a way to authenticate your email so you can send to such services
# without a problem. # without a problem.
# Create an OpenDKIM key # Create an OpenDKIM key in the proper place with proper permissions.
echo 'Generating OpenDKIM keys...' echo 'Generating OpenDKIM keys...'
mkdir -p /etc/postfix/dkim mkdir -p /etc/postfix/dkim
opendkim-genkey -D /etc/postfix/dkim -d "$domain" -s "$subdom" opendkim-genkey -D /etc/postfix/dkim/ -d "$domain" -s "$subdom"
# Generate the OpenDKIM info: # Generate the OpenDKIM info:
echo 'Configuring OpenDKIM...' echo 'Configuring OpenDKIM...'
grep -q "$domain" /etc/postfix/dkim/keytable 2>/dev/null || grep -q "$domain" /etc/postfix/dkim/keytable 2>/dev/null ||
echo "$subdom._domainkey.$domain $domain:$subdom:/etc/postfix/dkim/$subdom.private" >> /etc/postfix/dkim/keytable echo "$subdom._domainkey.$domain $domain:$subdom:/etc/postfix/dkim/$subdom.private" >> /etc/postfix/dkim/keytable
@ -269,39 +267,42 @@ grep -q '127.0.0.1' /etc/postfix/dkim/trustedhosts 2>/dev/null ||
echo '127.0.0.1' >> /etc/postfix/dkim/trustedhosts echo '127.0.0.1' >> /etc/postfix/dkim/trustedhosts
# ...and source it from opendkim.conf # ...and source it from opendkim.conf
grep -q '^KeyTable' /etc/opendkim/opendkim.conf 2>/dev/null || cp /usr/share/doc/opendkim/opendkim.conf.sample /etc/opendkim/opendkim.conf
echo "KeyTable file:/etc/postfix/dkim/keytable sed -i "s/^Domain/Domain $domain/" /etc/opendkim/opendkim.conf
sed -i 's/example.com//g' /etc/opendkim/opendkim.conf
grep -q '^KeyTable' /etc/opendkim/opendkim.conf 2>/dev/null || echo 'KeyTable file:/etc/postfix/dkim/keytable
SigningTable refile:/etc/postfix/dkim/signingtable SigningTable refile:/etc/postfix/dkim/signingtable
InternalHosts refile:/etc/postfix/dkim/trustedhosts InternalHosts refile:/etc/postfix/dkim/trustedhosts' >> /etc/opendkim/opendkim.conf
Domain $domain" >> /etc/opendkim/opendkim.conf
sed -i '/^#Canonicalization/s/simple/relaxed\/simple/' /etc/opendkim/opendkim.conf sed -i '/^#Canonicalization/s/simple/relaxed\/simple/' /etc/opendkim/opendkim.conf
sed -i '/^#Canonicalization/s/^#//' /etc/opendkim/opendkim.conf sed -i '/^#Canonicalization/s/^#//' /etc/opendkim/opendkim.conf
sed -i '/Socket/s/^#*/#/' /etc/opendkim/opendkim.conf sed -i '/Socket/s/^#*/#/' /etc/opendkim/opendkim.conf
grep -q '^Socket\s*inet:12301@localhost' /etc/opendkim/opendkim.conf || grep -q '^Socket\s*inet:12301@localhost' /etc/opendkim/opendkim.conf || echo 'Socket inet:12301@localhost' >> /etc/opendkim/opendkim.conf
echo 'Socket inet:12301@localhost' >> /etc/opendkim/opendkim.conf
# Here we add to postconf the needed settings for working with OpenDKIM # Here we add to postconf the needed settings for working with OpenDKIM
echo 'Configuring Postfix with OpenDKIM settings...' echo "Configuring Postfix with OpenDKIM settings..."
postconf -e 'smtpd_sasl_security_options = noanonymous, noplaintext' postconf -e 'smtpd_sasl_security_options = noanonymous, noplaintext'
postconf -e 'smtpd_sasl_tls_security_options = noanonymous' postconf -e 'smtpd_sasl_tls_security_options = noanonymous'
postconf -e "myhostname = $maildomain" postconf -e "myhostname = $domain"
postconf -e 'milter_default_action = accept' postconf -e 'milter_default_action = accept'
postconf -e 'milter_protocol = 6' postconf -e 'milter_protocol = 6'
postconf -e 'smtpd_milters = inet:localhost:12301' postconf -e 'smtpd_milters = inet:localhost:12301'
postconf -e 'non_smtpd_milters = inet:localhost:12301' postconf -e 'non_smtpd_milters = inet:localhost:12301'
postconf -e 'mailbox_command = /usr/lib/dovecot/deliver' postconf -e 'mailbox_command = /usr/lib/dovecot/deliver'
useradd -mG mail dmarc for x in spamassassin opendkim dovecot postfix; do
printf "Restarting %s..." "$x"
systemctl enable --now spamassassin opendkim dovecot postfix systemctl enable restart "$x" && printf " ...done\\n"
done
pval="$(tr -d "\n" </etc/postfix/dkim/$subdom.txt | sed "s/k=rsa.* \"p=/k=rsa; p=/;s/\"\s*\"//;s/\"\s*).*//" | grep -o "p=.*")" pval="$(tr -d "\n" </etc/postfix/dkim/$subdom.txt | sed "s/k=rsa.* \"p=/k=rsa; p=/;s/\"\s*\"//;s/\"\s*).*//" | grep -o "p=.*")"
dkimentry="$subdom._domainkey.$domain TXT v=DKIM1; k=rsa; $pval" dkimentry="$subdom._domainkey.$domain TXT v=DKIM1; k=rsa; $pval"
dmarcentry="_dmarc.$domain TXT v=DMARC1; p=reject; rua=mailto:dmarc@$domain; fo=1" dmarcentry="_dmarc.$domain TXT v=DMARC1; p=reject; rua=mailto:dmarc@$domain; fo=1"
spfentry="$domain TXT v=spf1 mx a:$maildomain -all" spfentry="$domain TXT v=spf1 mx a:$maildomain -all"
useradd -m -G mail dmarc
echo "$dkimentry echo "$dkimentry
$dmarcentry $dmarcentry
$spfentry" > "$HOME/dns_emailwizard" $spfentry" > "$HOME/dns_emailwizard"
@ -320,7 +321,6 @@ $dkimentry
$dmarcentry $dmarcentry
Note: You will probably need to modify this later (eg. adding your ip)
$spfentry $spfentry
\033[0m \033[0m
NOTE: You may need to omit the \`.$domain\` portion at the beginning if NOTE: You may need to omit the \`.$domain\` portion at the beginning if
@ -329,4 +329,6 @@ inputting them in a registrar's web interface.
Also, these are now saved to \033[34m~/dns_emailwizard\033[0m in case you want them in a file. Also, these are now saved to \033[34m~/dns_emailwizard\033[0m in case you want them in a file.
Once you do that, you're done! Check the README for how to add users/accounts Once you do that, you're done! Check the README for how to add users/accounts
and how to log in.\n" and how to log in.
"