install_update_dovecot-2.4.sh: increase sieve_max_redirects to 25.

DOC/DMARC-Report/dmarc-server-setup.md

@@ -1,9 +1,8 @@
-
 # DMARC-Server-Sammelsystem – Einrichtung und Betrieb
 
 ## 📖 Präambel
 
-Dieses Dokument beschreibt die vollständige Einrichtung eines automatisierten DMARC-Report-Sammelsystems auf einem Linux-Mailserver mit **Postfix**, **Amavis** und **Dovecot (LMTP)**.  
+Dieses Dokument beschreibt die vollständige Einrichtung eines automatisierten DMARC-Report-Sammelsystems auf einem Linux-Mailserver mit **Postfix**, **Amavis** und **Dovecot (LMTP)**.
 Ziel: DMARC-Aggregatberichte (XML, .gz, .zip) serverseitig empfangen, speichern und regelmäßig auswerten.
 
 ---
@@ -34,7 +33,7 @@ Alle Dateien werden unter `/var/lib/dmarc` abgelegt:
 Verzeichnisse anlegen:
 
 ```bash
-sudo install -d -o root -g root -m 750 /var/lib/dmarc/{reports,processed,exports,logs}
+sudo install -d -o vmail -g vmail -m 750 /var/lib/dmarc/{reports,processed,exports,logs}
 sudo install -d -o root -g root -m 750 /usr/local/lib/dmarc
 ```
 
@@ -74,21 +73,21 @@ Damit weiß Postfix, dass Mails an diese Adresse an das Skript weitergegeben wer
 
 Wenn du zusätzlich eine Kopie im IMAP-Postfach haben willst:
 
-In `/etc/postfix/virtual`:
+In `/etc/postfix/virtual_alias_maps`:
 
 ```bash
-dmarc-reports@oopen.de   reports@oopen.de, dmarc-pipe:
+dmarc-reports@oopen.de   dmarc-reports-mbox@oopen.de
 ```
 
 Dann:
 
 ```bash
-sudo postmap /etc/postfix/virtual
+sudo postmap btree:/etc/postfix/virtual_alias_maps
 sudo systemctl reload postfix
 ```
 
-> **Merke:** `/etc/postfix/transport` = ZustellWEG, `/etc/postfix/virtual` = EmpfängerALIAS.  
-> Nur Skript? → Nur `transport`-Eintrag.  
+> **Merke:** `/etc/postfix/transport` = ZustellWEG, `/etc/postfix/virtual_alias_maps` = EmpfängerALIAS.
+> Nur Skript? → Nur `transport`-Eintrag.
 > Skript + Kopie? → `virtual`-Alias **zusätzlich**.
 
 ---
@@ -115,6 +114,7 @@ oopen.de._report._dmarc.oopen.de.   IN TXT  "v=DMARC1"
 ## 🧰 3. Sammelskript `/usr/local/bin/dmarc-collect.sh`
 
 **Datei anlegen:**
+
 ```bash
 sudo tee /usr/local/bin/dmarc-collect.sh >/dev/null <<'EOF'
 #!/usr/bin/env bash
@@ -166,10 +166,12 @@ fi
 
 EOF
 sudo apt install -y ripmime
-sudo install -m 750 -o vmail -g vmail /usr/local/bin/dmarc-collect.sh
+sudo chown vmail:vmail /usr/local/bin/dmarc-collect.sh
+sudo chmod 750 /usr/local/bin/dmarc-collect.sh
 ```
 
 Inhalt von `dmarc-collect.sh`:
+
 ```bash
 #!/usr/bin/env bash
 set -euo pipefail
@@ -217,7 +219,6 @@ else
   echo "$(date -Is) no usable attachment in message" >> "$LOGF"
   exit 0
 fi
-
 ```
 
 ---
@@ -247,6 +248,7 @@ sudo chmod 750 /usr/local/lib/dmarc/daily-run.sh
 ```
 
 Cronjob anlegen:
+
 ```bash
 echo '17 3 * * * root /usr/local/lib/dmarc/daily-run.sh' | sudo tee /etc/cron.d/dmarc-daily >/dev/null
 ```
@@ -256,6 +258,7 @@ echo '17 3 * * * root /usr/local/lib/dmarc/daily-run.sh' | sudo tee /etc/cron.d/
 ## 🧮 5. Auswertungsskript `/usr/local/bin/dmarc-scan.sh`
 
 Installation:
+
 ```bash
 sudo apt install -y xmlstarlet unzip gzip
 sudo tee /usr/local/bin/dmarc-scan.sh >/dev/null <<'EOF'
@@ -494,7 +497,7 @@ done
 
 # Zusammenfassung
 unique_ips=${#SEEN_IPS[@]}
-echo "==============================================================================" 
+echo "=============================================================================="
 echo "GESAMT-ZUSAMMENFASSUNG"
 echo "Nachrichten gesamt:         $total_msgs"
 echo "Eindeutige Source-IPs:      $unique_ips"
@@ -568,6 +571,7 @@ sudo chmod 750 /usr/local/bin/dmarc-scan.sh
 Beschreibung: Das Skript liest XML/ZIP/GZ-Reports, zeigt eine Tabelle pro Report, schreibt eine Records-CSV (mit `--append` fortsetzbar) und exportiert Top-Listen als CSV in `--outdir`.
 
 **Wichtige Parameter:**
+
 - `--domain DOMAIN` (Filter)
 - `--csv PFAD` (Records-CSV)
 - `--append` (anhängen statt überschreiben)
@@ -575,6 +579,7 @@ Beschreibung: Das Skript liest XML/ZIP/GZ-Reports, zeigt eine Tabelle pro Report
 - `--outdir PFAD` (Top-CSV Ziel)
 
 **Beispiel:**
+
 ```bash
 dmarc-scan.sh /var/lib/dmarc/reports/2025/11/12   --domain fluechtlingsrat-brandenburg.de   --csv /var/lib/dmarc/exports/records.csv   --append   --top 25   --outdir /var/lib/dmarc/exports/
 ```
@@ -611,6 +616,6 @@ sudo -u vmail /usr/local/bin/dmarc-collect.sh < testmail.eml
 
 ---
 
-**Autor:** oopen.de / Systemkonfiguration  
-**Stand:** November 2025  
+**Autor:** oopen.de / Systemkonfiguration
+**Stand:** November 2025
 **Version:** 1.2

DOC/dovecot/README.dovecot.index

@@ -19,3 +19,19 @@ doveadm index -A INBOX
 # -the storage files will be also checked.
 # -
 doveadm force-resync -A INBOX
+
+
+# - Index users .Sent Folder
+# -
+doveadm index -u <user@domain.ltd> .Sent
+
+
+# - oder alternativ und etwas allgemeiner für egal welchen Unterordner
+# - ==================================================================
+# -
+# - Index eines Unterverzeichnisses einer Mailbox löschen
+# -
+# -   z.Bsp. für den 'gesendet' Ordner der Mailbox presse@mbr-berlin.de
+# -
+# -      rm /var/vmail/mbr-berlin.de/presse/Maildir/.Sent/dovecot.index*
+# -      systemctl restart dovecot.service

install_amavis.sh

@@ -5116,6 +5116,8 @@ while IFS='' read -r _line || [[ -n $_line ]] ; do
 smtp      inet  n       -       y       -       -       smtpd
    -o smtpd_proxy_filter=127.0.0.1:10024
    -o content_filter=
+   -o smtpd_milters=
+   -o non_smtpd_milters=
 EOF
       if [[ "$SASL_AUTH_ENABLED" = "no" ]] ; then
          cat >> $postfix_master_cf << EOF

install_opendkim.sh

@@ -14,6 +14,8 @@ echo -e "\n   \033[32mStart Installation of OpenDKIM..\033[m"
 
 log_file="$(mktemp)"
 
+backup_date="$(date +%Y-%m-%d-%H%M)"
+
 _opendkim_packages="opendkim opendkim-tools"
 
 opendkim_base_dir="/etc/opendkim"
@@ -28,6 +30,7 @@ opendkim_socket_file="${opendkim_socket_dir}/opendkim.sock"
 postfix_needs_restart=false
 opendkim_needs_restart=false
 
+
 # -------------
 # --- Some functions
 # -------------
@@ -175,6 +178,18 @@ else
    echo_skipped
 fi
 
+echononl "   Backup existing file '${opendkim_conf_file}'.."
+if [[ -f "${opendkim_conf_file}" ]] ; then
+   mv "${opendkim_conf_file}" "${opendkim_conf_file}.${backup_date}"
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
 
 # - Create OpenDKIM configuration
 # -
@@ -200,6 +215,7 @@ AuthservID              "DKIM check $(hostname -f)"
 # Modi signer (s) und verifier (v) und verwendet eine
 # Socket-Datei zur Kommunikation (alternativ: lokaler Port)
 Mode                    sv
+
 # Socket                local:/var/run/opendkim/opendkim.sock
 # Socket                local:$opendkim_socket_file
 # Socket                inet:12345@localhost
@@ -489,9 +505,38 @@ milter_protocol = 6
 #    If you want sign mails before sending through AmaVIS, set
 #    'smtpd_milters = local:/opendkim/opendkim.sock' here and add to
 #    localhost:10025 section in master.cf: 'smtpd_milters='
-# 
+#
 #smtpd_milters = local:/opendkim/opendkim.sock
 smtpd_milters =
+
+# Was sind non_smtpd_milters?
+#
+# non_smtpd_milters gilt für alle Postfix-Prozesse, die Mails verarbeiten, aber NICHT
+# der smtpd-Daemon sind.
+#
+# Das betrifft z. B.:
+#
+#     cleanup        Header/Content-Bereinigung
+#     qmgr           Queue-Manager
+#     lmtp / smtp    Auslieferung nach extern
+#     local          lokale Zustellung
+#
+# Das sind z. B.:
+#
+#     -  interne Bounces (MAILER-DAEMON)
+#
+#     -  Cron-Mails vom Server
+#
+#     -  Weiterleitungen, die Postfix selbst generiert
+#
+#     -  Mails, die über sendmail CLI gesendet werden
+#
+#     -  Mails, die Amavis über LMTP zurückgibt
+#
+#     -  etc.
+#
+#
+# DKIM soll auch die ausgehenden Mails signieren, die nicht über smtpd daemon versendet werden.
 non_smtpd_milters = local:/opendkim/opendkim.sock
 EOF
    postfix_needs_restart=true
@@ -542,9 +587,14 @@ while IFS='' read -r _line || [[ -n $_line ]] ; do
 
    if $_found && echo "$_line" | grep -i -q -E "^\s*-o\s+smtpd_milters=\s*" ; then
       _found=false
+      if ! echo "$_line" | grep -i -q -E "^\s*-o\s+smtpd_milters=\s*local:/opendkim/opendkim.sock\s*$" ; then
+         echo "   -o smtpd_milters=local:/opendkim/opendkim.sock" >> "$tmp_master_file"
+         _changed=true
+         continue
+      fi
    fi
 
-   if echo "$_line" | grep -i -q -E "^\s*(127.0.0.1|localhost):10025\s+inet\s+" 2> /dev/null ; then
+   if echo "$_line" | grep -i -q -E "^\s*(submission|smtps)\s+inet\s+" 2> /dev/null ; then
       _found=true
    fi
 
@@ -562,7 +612,7 @@ if $_changed ; then
    fi
 else
    echo_skipped
-   warn "Postfix (master.cf) seems already be configured."
+   info "Postfix (master.cf) was not changed - seems already be configured right."
    echononl "   Delete previosly saved file '/etc/postfix/master.cf'.."
    rm /etc/postfix/master.cf.$backup_date 2> $log_file
    if [[ $? -eq 0 ]] ; then

install_opendmarc.sh

@@ -3,6 +3,7 @@
 clear
 echo -e "\n   \033[32mStart Installation of OpenDMARC..\033[m"
 
+overwrite_config_files=true
 
 
 # -------------
@@ -23,13 +24,14 @@ opendmarc_socket_dir="${postfix_spool_dir}/opendmarc"
 opendmarc_socket_file="${opendmarc_socket_dir}/opendmarc.sock"
 
 config_file_name_value_parameters="
-   AuthservID|DMARC check $(hostname -f)
+   AuthservID|$(hostname -f)
+   TrustedAuthservIDs|$(hostname -f)
    PidFile|/run/opendmarc/opendmarc.pid
    RejectFailures|true
    Syslog|true
    SyslogFacility|mail
-   TrustedAuthservIDs|$(hostname -f)
-   IgnoreHosts|/etc/opendmarc/ignore.hosts
+   IgnoreHosts|${opendmarc_base_dir}/ignore.hosts
+   IgnoreMailFrom|${opendmarc_base_dir}/ignore.mailfrom
    IgnoreAuthenticatedClients|true
    RequiredHeaders|false
    UMask|002
@@ -194,6 +196,9 @@ if ! $(grep -q -E "^IgnoreHosts\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
 ## ignored by the filter. If not specified, defaults to "127.0.0.1" only.
 #
 IgnoreHosts 127.0.0.1
+
+# Optional - auch nach Absender-Domain ignorieren:
+IgnoreMailFrom ${opendmarc_base_dir}/ignore.mailfrom
 EOF
    if [[ $? -eq 0 ]] ; then
       echo_ok
@@ -213,7 +218,7 @@ echononl " Add '${_param}' with default value to the opendmarc.conf file.."
 if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
    cat << EOF >> ${opendmarc_conf_file}
 
-## If set, causes mail from authenticated clients (i.e., those that used 
+## If set, causes mail from authenticated clients (i.e., those that used
 ## SMTP AUTH) to be ignored by the filter. The default is "false".
 #
 IgnoreAuthenticatedClients false
@@ -229,6 +234,33 @@ else
 fi
 
 
+# - Add 'TrustedAuthservIDs' with default value to the original opendmarc.conf file
+#
+_param="TrustedAuthservIDs"
+echononl " Add '${_param}' with default value to the opendmarc.conf file.."
+if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
+   cat << EOF >> ${opendmarc_conf_file}
+
+# Provides a list of authserv-ids that are to be used to identify Authentication-Results
+# header fields whose contents are to be assumed as valid input for the DMARC assessment.
+# To provide a list, separate values by commas. If the string "HOSTNAME" is provided,
+# the name of the host running the filter (as returned by the gethostname(3) function)
+# will be used. Matching against this list is case-insensitive. The default is to use the
+# value of AuthservID.
+#
+TrustedAuthservIDs OpenDMARC
+EOF
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+
 # - Add 'RequiredHeaders' with default value to the original opendmarc.conf file
 #
 _param="IgnoreAuthenticatedClients"
@@ -259,9 +291,9 @@ echononl " Add '${_param}' with default value to the opendmarc.conf file.."
 if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
    cat << EOF >> ${opendmarc_conf_file}
 
-## If set, the filter will ensure the header of the message conforms to the basic 
-## header field count restrictions laid out in RFC5322, Section 3.6. Messages 
-## failing this test are rejected without further processing. A From: field from 
+## If set, the filter will ensure the header of the message conforms to the basic
+## header field count restrictions laid out in RFC5322, Section 3.6. Messages
+## failing this test are rejected without further processing. A From: field from
 ## which no domain name could be extracted will also be rejected.
 #
 RequiredHeaders false
@@ -445,8 +477,8 @@ else
 fi
 
 
-# - Create the directories to hold opendmarc's data files, assign 
-# - ownership to the opendmarc user, and restrict the file 
+# - Create the directories to hold opendmarc's data files, assign
+# - ownership to the opendmarc user, and restrict the file
 # - permissions:
 # -
 echononl "   Create directory '$opendmarc_base_dir'"
@@ -472,6 +504,18 @@ else
 fi
 
 
+echononl "   Backup existing file '${opendmarc_base_dir}/ignore.hosts'.."
+if [[ -f "${opendmarc_base_dir}/ignore.hosts" ]] ; then
+   mv "${opendmarc_base_dir}/ignore.hosts" "${opendmarc_base_dir}/ignore.hosts.${backup_date}"
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
 
 # - Create the file ${opendmarc_base_dir}/ignore.hosts
 # -
@@ -480,11 +524,68 @@ if [[ -f "${opendmarc_base_dir}/ignore.hosts" ]] ; then
    echo_skipped
 else
    cat <<EOF > ${opendmarc_base_dir}/ignore.hosts 2> $log_file
-# We are using AmaViS at 'localhost 127.0.0.1 . So we cannot bypass them
+# /etc/opendmarc/ignore.hosts
 #
-# 127.0.0.1
-# localhost
-$(hostname -f)
+# Aktuell hat OpenDMARC seinen Milter nur am Dienst
+# 'localhost:10025' hängen. Dort ist der Client
+# immer 127.0.0.1, nicht die externe Gegenstelle.
+#
+# Deshalb macht es in diesem Setup keinen Sinn,
+# hier IP-Adressen von externen Diensten (CRSend etc.)
+# einzutragen – sie würden nie matchen.
+#
+# WICHTIG:
+#  - KEIN 127.0.0.1
+#  - KEIN localhost
+#  - KEIN ::1
+#
+# Eintrag dieser Adressen würde DMARC komplett deaktivieren.
+#
+# ==> Datei bleibt absichtlich leer.
+EOF
+   opendmarc_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+# - Create the file ${opendmarc_base_dir}/ignore.hosts
+# -
+
+echononl "   Backup existing file '${opendmarc_base_dir}/ignore.mailfrom'.."
+if [[ -f "${opendmarc_base_dir}/ignore.mailfrom" ]] ; then
+   mv "${opendmarc_base_dir}/ignore.mailfrom" "${opendmarc_base_dir}/ignore.mailfrom.${backup_date}"
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+echononl "   Create file '${opendmarc_base_dir}/ignore.mailfrom'.."
+if [[ -f "${opendmarc_base_dir}/ignore.mailfrom" ]] ; then
+   echo_skipped
+else
+   cat <<EOF > ${opendmarc_base_dir}/ignore.mailfrom 2> $log_file
+# /etc/opendmarc/ignore.mailfrom
+#
+# Hier könnte man Absender-Domains von der DMARC-Prüfung
+# ausnehmen (z. B. problematische Partner-Domains).
+#
+# Aktuell ist das für dein Setup nicht notwendig.
+#
+# Beispiele (NICHT aktiv!):
+#   @example.org
+#   example.org
+#
+# ==> Datei bleibt absichtlich leer.
 EOF
    opendmarc_needs_restart=true
    if [[ $? -eq 0 ]] ; then
@@ -529,7 +630,7 @@ EOF
 fi
 
 
-# - Create the opendmarc socket directory in Postfix’s work area 
+# - Create the opendmarc socket directory in Postfix’s work area
 # - and make sure it has the correct ownership:
 # -
 echononl "   Create the opendmarc socket directory in Postfix's work area.."
@@ -555,7 +656,7 @@ else
 fi
 
 
-# - Edit /etc/postfix/main.cf and add a section to activate 
+# - Edit /etc/postfix/main.cf and add a section to activate
 # - processing of e-mail through the opendmarc daemon:
 # -
 echononl "   Backup existing postfix configuration (main.cf).."
@@ -588,18 +689,113 @@ else
 fi
 
 
+echo ""
+
+
+# - Edit /etc/postfix/main.cf and add a section to activate 
+# - processing of e-mail through the OpenDKIM daemon:
+# -
+backup_date="$(date +%Y-%m-%d-%H%M)"
+echononl "   Backup existing postfix configuration (main.cf).."
+cp -a /etc/postfix/main.cf /etc/postfix/main.cf.$backup_date 2> $log_file
+if [[ $? -eq 0 ]] ; then
+   echo_ok
+else
+   echo_failed
+   error "$(cat $log_file)"
+fi
+
+echononl "   Activate processing of e-mail through the OpenDKIM daemon.."
+if grep -q -E "milter_default_action\s*=\s*accept" /etc/postfix/main.cf ; then
+   echo_skipped
+   info "Postfix (main.cf) was not changed - seems already be configured right."
+   echononl "   Delete previosly saved Postfix configuration.."
+   rm /etc/postfix/main.cf.$backup_date 2> $log_file
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   cat <<EOF >> /etc/postfix/main.cf 2> $log_file
+
+# ======= Milter configuration =======
+
+# OpenDKIM
+
+milter_default_action = accept
+
+# Postfix ≥ 2.6 milter_protocol = 6, Postfix ≤ 2.5 milter_protocol = 2
+milter_protocol = 6
+
+# Note:
+#    We will sign AFTER sending through AmaVIS, just befor sending out. So
+#    set 'smtpd_milters =' to an emty string here and add to localhost:10025
+#    section in master.cf: 'smtpd_milters=local:/opendkim/opendkim.sock'
+#
+#    If you want sign mails before sending through AmaVIS, set
+#    'smtpd_milters = local:/opendkim/opendkim.sock' here and add to
+#    localhost:10025 section in master.cf: 'smtpd_milters='
+#
+#smtpd_milters = local:/opendkim/opendkim.sock
+smtpd_milters =
+
+# Was sind non_smtpd_milters?
+#
+# non_smtpd_milters gilt für alle Postfix-Prozesse, die Mails verarbeiten, aber NICHT
+# der smtpd-Daemon sind.
+#
+# Das betrifft z. B.:
+#
+#     cleanup        Header/Content-Bereinigung
+#     qmgr           Queue-Manager
+#     lmtp / smtp    Auslieferung nach extern
+#     local          lokale Zustellung
+#
+# Das sind z. B.:
+#
+#     -  interne Bounces (MAILER-DAEMON)
+#
+#     -  Cron-Mails vom Server
+#
+#     -  Weiterleitungen, die Postfix selbst generiert
+#
+#     -  Mails, die über sendmail CLI gesendet werden
+#
+#     -  Mails, die Amavis über LMTP zurückgibt
+#
+#     -  etc.
+#
+#
+# DKIM soll auch die ausgehenden Mails signieren, die nicht über smtpd daemon versendet werden.
+non_smtpd_milters = local:/opendkim/opendkim.sock
+EOF
+   postfix_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+fi
+
+
+echo ""
+
+
 # - Prevent Postfix from setting the DMARC Header twice (one befor
 # - and one after processing amavis
 # -
-# - To disable milter processing after amavis, add to your master.cf in 
+# - To disable milter processing after amavis, add to your master.cf in
 # - the after-amavis section:
 # -    127.0.0.1:10025 inet    n       -       -       -       -       smtpd
 # -       [...]
 # -       -o smtpd_milters=
 # -
 # - If you want to run the milter after amavis, set in main.cf
-# -    smtpd_milters= 
-# - to an empty string and add the smtpd_milters configuration to master.cf 
+# -    smtpd_milters=
+# - to an empty string and add the smtpd_milters configuration to master.cf
 # - (after-section amavis) instead:
 # -    -o smtpd_milters=local:/opendmarc/opendmarc.sock
 # -
@@ -613,24 +809,58 @@ else
 fi
 
 echononl "   Adjust /etc/postfix/master.cf. Set DMARC after sending throuh AmaVIS.."
-if $(grep -q -E "^\s*-o\s+smtpd_milters\s*=\s*.*opendkim.sock" /etc/postfix/master.cf 2> /dev/null) ; then
-   if $(grep -q -E "^\s*-o\s+smtpd_milters\s*=\s*.*$(basename ${opendmarc_socket_file})" /etc/postfix/master.cf); then
-      echo_skipped
-   else
-      perl -i -n -p -e "s&(^\s*-o\s+smtpd_milters\s*=.*)&\1,local:/$(basename "${opendmarc_socket_dir}")/$(basename "${opendmarc_socket_file}")&" \
-         /etc/postfix/master.cf > $log_file 2>&1
-      if [[ $? -eq 0 ]] ; then
-         echo_ok
-         postfix_needs_restart=true
-      else
-         echo_failed
-         error "$(cat $log_file)"
+_found=false
+_changed=false
+tmp_master_file="/tmp/postfix_master.cf"
+> $tmp_master_file
+while IFS='' read -r _line || [[ -n $_line ]] ; do
+
+   if $_found && ! echo "$_line" | grep -i -q -E "^\s*-o" 2> /dev/null ; then
+      echo "   -o smtpd_milters=local:/opendmarc/opendmarc.sock" >> "$tmp_master_file"
+      _changed=true
+      _found=false
+   fi
+
+   if $_found && echo "$_line" | grep -i -q -E "^\s*-o\s+smtpd_milters=\s*" ; then
+      _found=false
+      if ! echo "$_line" | grep -i -q -E "^\s*-o\s+smtpd_milters=\s*local:/opendmarc/opendmarc.sock\s*$" ; then
+         echo "   -o smtpd_milters=local:/opendmarc/opendmarc.sock" >> "$tmp_master_file"
+         _changed=true
+         continue
       fi
+         
+   fi
+
+   if echo "$_line" | grep -i -q -E "^\s*(localhost|127.0.0.1):10025\s+inet\s+" 2> /dev/null ; then
+      _found=true
+   fi
+
+   echo "$_line" >> "$tmp_master_file"
+
+done < "/etc/postfix/master.cf"
+
+if $_changed ; then
+   cp $tmp_master_file /etc/postfix/master.cf 2> $log_file
+   postfix_needs_restart=true
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
    fi
 else
    echo_skipped
-   warn "Postfix is not adjusted. Complete Postfix configuration (master.cf) manually\!"
+   info "Postfix (master.cf) was not changed - seems already be configured right."
+   echononl "   Delete previosly saved file '/etc/postfix/master.cf'.."
+   rm /etc/postfix/master.cf.$backup_date 2> $log_file
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
 fi
+rm -f $tmp_master_file
 
 echo ""
 
@@ -648,7 +878,7 @@ else
 fi
 
 # - Restart opendmarc
-# - 
+# -
 echononl "   Restart opendmarc.."
 if $opendmarc_needs_restart ; then
    if $SYSTEMD_EXISTS ; then
@@ -698,20 +928,6 @@ else
    echo_skipped
 fi
 
-echo ""
-if [[ -f "/etc/postfix/master.cf.${backup_date}" ]] ; then
-   if  $(diff "/etc/postfix/master.cf" "/etc/postfix/master.cf.${backup_date}"> /dev/null 2>&1) ; then
-         info "File \033[1m/etc/postfix/master.cf\033[m  has not changed.\n\t          Removing previos created backup.."
-         rm "/etc/postfix/master.cf.${backup_date}"
-   fi
-fi
-if [[ -f "/etc/postfix/main.cf.${backup_date}" ]] ; then
-   if  $(diff "/etc/postfix/main.cf" "/etc/postfix/main.cf.${backup_date}"> /dev/null 2>&1) ; then
-         info "File \033[1m/etc/postfix/main.cf\033[m  has not changed.\n\t          Removing previos created backup.."
-         rm "/etc/postfix/main.cf.${backup_date}"
-   fi
-fi
-
 
 echo ""
 rm -f "$log_file"

install_postfix_advanced.sh

@@ -3011,21 +3011,45 @@ milter_protocol = 6
 #
 smtpd_milter_maps = cidr:/etc/postfix/smtpd_milter_map
 smtpd_milters =
+# Was sind non_smtpd_milters?
+#
+# non_smtpd_milters gilt für alle Postfix-Prozesse, die Mails verarbeiten, aber NICHT 
+# der smtpd-Daemon sind.
+#
+# Das betrifft z. B.:
+#
+#     cleanup        Header/Content-Bereinigung
+#     qmgr           Queue-Manager
+#     lmtp / smtp    Auslieferung nach extern
+#     local          lokale Zustellung
+#
+# Das sind z. B.:
+#
+#     -  interne Bounces (MAILER-DAEMON)
+#
+#     -  Cron-Mails vom Server
+#
+#     -  Weiterleitungen, die Postfix selbst generiert
+#
+#     -  Mails, die über sendmail CLI gesendet werden
+#
+#     -  Mails, die Amavis über LMTP zurückgibt
+#
+#     -  etc.
+#
+#
 EOF
 fi
+
 if [[ -n "$(which opendkim)" ]] ; then
-   if [[ -n "$(which opendmarc)" ]] ; then
-      cat <<EOF >> /etc/postfix/main.cf
-non_smtpd_milters = local:/opendkim/opendkim.sock,local:/opendmarc/opendmarc.sock
-EOF
-   else
-      cat <<EOF >> /etc/postfix/main.cf
+   cat <<EOF >> /etc/postfix/main.cf
+# DKIM soll auch die ausgehenden Mails signieren, die nicht über smtpd daemon versendet werden.
+#
 non_smtpd_milters = local:/opendkim/opendkim.sock
 EOF
-   fi
-elif [[ -n "$(which opendmarc)" ]] ; then
+else
    cat <<EOF >> /etc/postfix/main.cf
-non_smtpd_milters = local:/opendmarc/opendmarc.sock
+non_smtpd_milters =
 EOF
 fi
 

install_update_dovecot-2.4.sh

@@ -7776,6 +7776,32 @@ EOF
 
    fi
 
+   _replace_key="sieve_max_redirects"
+   _replace_val=25
+
+   read -r -d '' COMMENT_BLOCK <<EOF
+# sieve_max_redirects
+#
+# The maximum number of redirect actions that can be performed during a single script execution.
+#
+#  Defaults to: 4
+
+EOF
+
+
+   if grep -qE "^\s*${_replace_key}\s*=" "${_conf_file}"; then
+
+      replace_variable "${_replace_key}" "${_replace_val}" "${_conf_file}" 2>> "${log_file}" || _failed=true
+
+   else
+
+      cat <<EOF >> "${_conf_file}" 2>> "${log_file}" || _failed=true
+
+${COMMENT_BLOCK}
+${_replace_key} = ${_replace_val}
+EOF
+   fi
+
 
 else