install_update_dovecot-2.4.sh: fix error writing (mysql) 'auth-sql.conf.ext' file.

DOC/DMARC_Rejections_SOP.md

@@ -0,0 +1,36 @@
+# Analyse und Begründung von DMARC-Rejects
+## (Postfix + OpenDMARC 1.4.2)
+
+### 1. Zweck
+Diese SOP beschreibt, wie DMARC-Rejects auf dem Mailserver revisionssicher analysiert und begründet werden, ohne die betroffene E-Mail anzunehmen oder erneut senden zu lassen.
+
+### 2. Systemkontext
+- MTA: Postfix
+- DMARC-Filter: OpenDMARC 1.4.2
+- SPF-Prüfung: policyd-spf
+- DKIM-Prüfung: OpenDKIM
+- Entscheidungspunkt: SMTP END-OF-MESSAGE
+
+### 3. Grundprinzip
+OpenDMARC loggt nur das Endergebnis der DMARC-Evaluation, nicht die Detailursachen. Die Ursache eines Rejects wird durch Log-Korrelation ermittelt.
+
+### 4. Relevante Logquellen
+- Postfix (SMTP-Rejects)
+- policyd-spf (SPF-Ergebnis, identity)
+- OpenDMARC (pass/fail/none pro Domain)
+
+### 5. Entscheidungslogik
+DMARC besteht nur, wenn mindestens ein Mechanismus DMARC-konform erfolgreich ist:
+- SPF(mailfrom) aligned
+- DKIM valid + aligned
+
+SPF über HELO ist für DMARC nicht verwertbar.
+
+### 6. Ableitungsregel
+Wenn SPF nur über HELO erfolgreich war und DMARC fail meldet, muss DKIM fehlgeschlagen sein.
+
+### 7. Revisionssichere Begründung
+Die E-Mail wurde gemäß der DMARC-Policy der Absenderdomain abgelehnt, da keine DMARC-konforme Authentifizierung vorlag.
+
+### 8. Referenzen
+RFC 7489 (DMARC), RFC 7208 (SPF), RFC 6376 (DKIM)

README.install

@@ -58,7 +58,7 @@
    -  create configuration file 'install_update_dovecot.conf'
          cp -a conf install_update_dovecot.conf.sample install_update_dovecot.conf
    - adjust configuration file 'install_update_dovecot.conf' to your needs
-   - run script 'install_update_dovecot.sh'
+   - run script 'install_update_dovecot-2.4.sh' # the old one was: 'install_update_dovecot.sh'
 
    Note:
       Maybe you have to finish installing postfixadmin, i.e creating admin account(s).

install_amavis.sh

@@ -5115,7 +5115,6 @@ EOF
 amavisfeed unix -       -       n       -       20       lmtp
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
-   -o disable_dns_lookups=yes
 EOF
 			fi
 		fi # if ! $smtps_present
@@ -5168,7 +5167,6 @@ EOF
 amavisfeed unix -       -       n       -       20       lmtp
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
-   -o disable_dns_lookups=yes
 EOF
 		fi
 
@@ -5207,7 +5205,6 @@ EOF
 amavisfeed unix -       -       n       -       20       lmtp
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
-   -o disable_dns_lookups=yes
 EOF
       continue
    fi

install_opendkim.sh

@@ -643,7 +643,7 @@ milter_protocol = 6
 #    localhost:10025 section in master.cf: 'smtpd_milters='
 #
 #smtpd_milters = local:/opendkim/opendkim.sock
-smtpd_milters =
+smtpd_milters = local:/opendkim/opendkim.sock
 
 # Was sind non_smtpd_milters?
 #

install_opendmarc.sh

@@ -780,8 +780,30 @@ if $(grep -q -E "^\s*non_smtpd_milters\s*=\s*.*opendkim.sock" /etc/postfix/main.
       fi
    fi
 else
+
    echo_skipped
-   warn "Postfix is not adjusted. Complete Postfix configuration (main.cf) manually\!"
+   warn "non_smtpd_milters is not adjusted. Complete Postfix configuration (main.cf) manually\!"
+fi
+
+
+echononl "   Set Variable smtpd_milters at '/etc/postfix/main.cf'.."
+if $(grep -q -E "^\s*smtpd_milters\s*=\s*.*opendkim.sock" /etc/postfix/main.cf 2> /dev/null) ; then
+   if $(grep -q -E "^\s*smtpd_milters\s*=\s*.*$(basename "${opendmarc_socket_file}")" /etc/postfix/main.cf); then
+      echo_skipped
+   else
+      perl -i -n -p -e "s&^\s*(smtpd_milters\s*=.*opendkim.sock)&\1,local:/$(basename "${opendmarc_socket_dir}")/$(basename "${opendmarc_socket_file}")&" \
+         /etc/postfix/main.cf > $log_file 2>&1
+      if [[ $? -eq 0 ]] ; then
+         echo_ok
+         postfix_needs_restart=true
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   fi
+else
+   echo_skipped
+   warn "smtpd_milters was not adjusted. Complete Postfix configuration (main.cf) manually\!"
 fi
 
 
@@ -818,7 +840,7 @@ else
 
 # ======= Milter configuration =======
 
-# OpenDKIM
+# OpenDKIM, OpenDMARC
 
 milter_default_action = accept
 

install_postfix_advanced.sh

@@ -2123,7 +2123,9 @@ smtpd_tls_key_file = $_TLS_KEY_FILE
 #smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_1024.pem
 ## - also possible to use 2048 key with that parameter
 ## -
-smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_2048.pem
+## - DEPRECATED parameter-
+## -
+#smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_2048.pem
 
 ## - File with DH parameters that the Postfix SMTP server should use with EDH ciphers.
 ## -

install_postfix_base.sh

@@ -929,7 +929,9 @@ smtpd_tls_key_file = $_TLS_KEY_FILE
 #smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_1024.pem
 ## - also possible to use 2048 key with that parameter
 ## -
-smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_2048.pem
+## - DEPRECATED parameter-
+## -
+#smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_2048.pem
 
 ## - File with DH parameters that the Postfix SMTP server should use with EDH ciphers.
 ## -

install_postfixadmin.sh

@@ -2496,7 +2496,7 @@ fi
 ## -    $CONF['show_undeliverable']='NO';
 ## -    $CONF['show_popimap']='NO';
 ## -
-## -    $CONF['used_quotas'] = 'YES';
+## -    $CONF['used_quotas'] = 'NO';
 ## -    $CONF['new_quota_table'] = 'YES';
 ## -
 echononl "\tAdjust Postfix Admin's Configuration - Part 5"
@@ -2528,7 +2528,7 @@ perl -i -n -p -e "s#^(\s*\\\$CONF\['show_undeliverable'\]\s*=.*)#//!\1\n\\\$CONF
   $pfa_conf_file >> $log_file 2>&1 || _failed=true 
 perl -i -n -p -e "s#^(\s*\\\$CONF\['show_popimap'\]\s*=.*)#//!\1\n\\\$CONF['show_popimap'] = 'NO';#" \
   $pfa_conf_file >> $log_file 2>&1 || _failed=true 
-perl -i -n -p -e "s#^(\s*\\\$CONF\['used_quotas'\]\s*=.*)#//!\1\n\\\$CONF['used_quotas'] = 'YES';#" \
+perl -i -n -p -e "s#^(\s*\\\$CONF\['used_quotas'\]\s*=.*)#//!\1\n\\\$CONF['used_quotas'] = 'NO';#" \
   $pfa_conf_file >> $log_file 2>&1 || _failed=true 
 perl -i -n -p -e "s#^(\s*\\\$CONF\['new_quota_table'\]\s*=.*)#//!\1\n\\\$CONF['new_quota_table'] = 'YES';#" \
   $pfa_conf_file >> $log_file 2>&1 || _failed=true 

install_update_dovecot-2.4.sh

@@ -2639,6 +2639,58 @@ if $_new ; then
 fi
 
 
+# Dovecot's configure script queries pkg-config for "systemd" and expects
+# the variable "systemdsystemunitdir" to be defined.
+# On minimal Debian(13)-based systems, only libsystemd.pc is provided and
+# no systemd.pc (and often no systemd binary) exists.
+# This pkg-config wrapper provides the missing metadata so configure
+# can auto-detect the correct systemd unit installation directory.
+#
+if [[ "${os_dist,,}" = "debian" ]] && [[ "$os_version" -ge 13 ]] ; then
+   echononl "   Create '/usr/lib/x86_64-linux-gnu/pkgconfig/systemd.pc'."
+   if [[ ! -f "/usr/lib/x86_64-linux-gnu/pkgconfig/systemd.pc" ]] ; then
+      cat <<'EOF' > /usr/lib/x86_64-linux-gnu/pkgconfig/systemd.pc 2>>${_log_dir}/debian-install.log 
+prefix=/usr
+exec_prefix=${prefix}
+libdir=/usr/lib/x86_64-linux-gnu
+includedir=/usr/include
+
+# Some build systems (incl. Dovecot's configure) query this to decide where
+# to install systemd service/unit files:
+systemdsystemunitdir=/usr/lib/systemd/system
+
+Name: systemd
+Description: systemd (pkg-config compatibility wrapper)
+Version: 0
+Requires: libsystemd
+EOF
+
+      if [[ $? -gt 0 ]] ; then
+         echo -e "$rc_failed"
+         error "$(cat $log_file)"
+
+         echo ""
+         echo "   command was:"
+         echo "      ln -s  libsystemd.pc /usr/lib/x86_64-linux-gnu/pkgconfig/systemd.pc"
+         echo ""
+
+         echononl "   continue anyway [yes/no]: "
+         read OK
+         OK="$(echo "$OK" | tr '[:upper:]' '[:lower:]')"
+         while [[ "$OK" != "yes" ]] && [[  "$OK" != "no" ]] ; do
+            echononl "Wrong entry! - repeat [yes/no]: "
+            read OK
+         done
+         [[ $OK = "yes" ]] || fatal "Abbruch durch User"
+      else
+         echo -e "$rc_done"
+      fi
+   else
+      echo -e "$rc_skipped"
+   fi
+fi
+
+
 ## -----------------
 ## - Create Users/groups needed for dovecot
 
@@ -2778,6 +2830,11 @@ if $systemd_support ; then
 fi
    #--with-systemdsystemunitdir=/etc/systemd/system/"
 
+#if [[ "${os_dist,,}" = "debian" ]] && [[ "$os_version" -ge 13 ]] ; then
+#   config_params="$config_params systemdsystemunitdir=/lib/systemd/system"
+#fi
+
+
 echononl "   Configure Dovecot.."
 #./configure \
 #   --prefix=/usr/local/dovecot-${_version} \
@@ -3151,12 +3208,12 @@ EOF
    echononl "   Create empty file '$(basename "${_conf_file}")'.."
    if [[ ! -f "${_conf_file}" ]] ; then
       _failed=false
-      cat <<'EOF' > "${_conf_file}" 2> "${log_file}"
+      cat <<EOF > "${_conf_file}" 2> "${log_file}"
 ##
 ## Settings for the Sieve interpreter
 ##
 
-# see also:  https://doc.dovecot.org/2.4.1/core/plugins/sieve.html
+# see also:  https://doc.dovecot.org/${_version}/core/plugins/sieve.html
 
 # To use Sieve, you will first need to make sure you are using Dovecot LDA or LMTP Server
 # for delivering incoming mail to users' mailboxes.
@@ -3221,12 +3278,12 @@ EOF
    echononl "   Create empty file '$(basename "${_conf_file}")'.."
    if [[ ! -f "${_conf_file}" ]] ; then
       _failed=false
-      cat <<'EOF' > "${_conf_file}" 2> "${log_file}"
+      cat <<EOF > "${_conf_file}" 2> "${log_file}"
 ##
 ## Settings for the Sieve Vacation Extension
 ##
 
-# see also:  https://doc.dovecot.org/2.4.1/core/config/sieve/extensions/vacation.html
+# see also:  https://doc.dovecot.org/${_version}/core/config/sieve/extensions/vacation.html
 
 # The Sieve vacation extension (RFC 5230) defines a mechanism to generate automatic
 # replies to incoming email messages. It takes various precautions to make sure replies
@@ -6291,7 +6348,7 @@ EOF
 # same as IMAP's LOGIN command. The LOGIN command is internally handled using PLAIN
 # mechanism.
 #
-# see https://doc.dovecot.org/2.4.1/core/config/auth/mechanisms/overview.html for
+# see https://doc.dovecot.org/${_version}/core/config/auth/mechanisms/overview.html for
 # further (non-rcCleartext) Authentication.
 auth_mechanisms = ${auth_mechanisms}
 EOF
@@ -6417,11 +6474,11 @@ if [[ $dovecot_major_version -gt 2 ]] \
 
    if [[ "$db_driver" = "pgsql" ]]; then
 
-      read -r -d '' NEW_BLOCK <<'EOF'
+      read -r -d '' NEW_BLOCK <<EOF
 passdb sql {
 
    # Load SQL connection data
-   !include /usr/local/dovecot-2.4.1-4/etc/dovecot/sql-connect.conf.ext
+   !include /usr/local/dovecot-${_version}/etc/dovecot/sql-connect.conf.ext
 
    query = SELECT username AS user, password \\
       FROM mailbox \\
@@ -6449,18 +6506,18 @@ EOF
 # LMTP mail delivery	   YES	            YES
 # doveadm commands	   YES	            YES
 #
-# see also: https://doc.dovecot.org/2.4.1/core/config/auth/passdb.html
+# see also: https://doc.dovecot.org/${_version}/core/config/auth/passdb.html
 #
 $(echo -e "${NEW_BLOCK}")
 EOF
       fi
 
 
-      read -r -d '' NEW_BLOCK <<'EOF'
+      read -r -d '' NEW_BLOCK <<EOF
 userdb sql {
 
    # Load SQL connection data
-   !include /usr/local/dovecot-2.4.1-4/etc/dovecot/sql-connect.conf.ext
+   !include /usr/local/dovecot-${_version}/etc/dovecot/sql-connect.conf.ext
 
    query = SELECT '/var/vmail/' || maildir AS home, \\
       '5000' AS uid, '5000' AS gid \\
@@ -6497,7 +6554,7 @@ EOF
 # The userdb and passdb may be the same or they may be different depending on your needs.
 # You can also have multiple authentication databases.
 #
-# see: https://doc.dovecot.org/2.4.1/core/config/auth/userdb.html
+# see: https://doc.dovecot.org/${_version}/core/config/auth/userdb.html
 #
 $(echo -e "${NEW_BLOCK}")
 EOF
@@ -6505,11 +6562,11 @@ EOF
 
    elif [[ "$db_driver" = "mysql" ]]; then
 
-      read -r -d '' NEW_BLOCK <<'EOF'
+      read -r -d '' NEW_BLOCK <<EOF
 passdb sql {
 
    # Load SQL connection data
-   !include /usr/local/dovecot-2.4.1-4/etc/dovecot/sql-connect.conf.ext
+   !include /usr/local/dovecot-${_version}/etc/dovecot/sql-connect.conf.ext
 
    query = SELECT username AS user, password \\
       FROM mailbox \\
@@ -6537,17 +6594,17 @@ EOF
 # LMTP mail delivery	   YES	            YES
 # doveadm commands	   YES	            YES
 #
-# see also: https://doc.dovecot.org/2.4.1/core/config/auth/passdb.html
+# see also: https://doc.dovecot.org/${_version}/core/config/auth/passdb.html
 #
 $(echo -e "${NEW_BLOCK}")
 EOF
       fi
 
-      read -r -d '' NEW_BLOCK <<'EOF'
+      read -r -d '' NEW_BLOCK <<EOF
 userdb sql {
 
    # Load SQL connection data
-   !include /usr/local/dovecot-2.4.1-4/etc/dovecot/sql-connect.conf.ext
+   !include /usr/local/dovecot-${_version}/etc/dovecot/sql-connect.conf.ext
 
    query = SELECT CONCAT('/var/vmail/',maildir) AS home, \\
       '5000' AS uid, '5000' AS gid \\
@@ -6584,7 +6641,7 @@ EOF
 # The userdb and passdb may be the same or they may be different depending on your needs.
 # You can also have multiple authentication databases.
 #
-# see: https://doc.dovecot.org/2.4.1/core/config/auth/userdb.html
+# see: https://doc.dovecot.org/${_version}/core/config/auth/userdb.html
 #
 $(echo -e "${NEW_BLOCK}")
 EOF
@@ -7081,7 +7138,7 @@ if [[ $dovecot_major_version -gt 2 ]] \
 #
 # As used here, %{user | domain} expands to the domain of the local user.  Other Mail user
 # variables can be used as well.
-#     see: https://doc.dovecot.org/2.4.1/core/settings/variables.html#mail-user-variables
+#     see: https://doc.dovecot.org/${_version}/core/settings/variables.html#mail-user-variables
 postmaster_address = ${postmaster_address}
 EOF
    fi
@@ -7231,7 +7288,7 @@ protocol lmtp {
    #
    # As used here, %{user | domain} expands to the domain of the local user.  Other Mail user
    # variables can be used as well.
-   #     see: https://doc.dovecot.org/2.4.1/core/settings/variables.html#mail-user-variables
+   #     see: https://doc.dovecot.org/${_version}/core/settings/variables.html#mail-user-variables
    postmaster_address = ${postmaster_address}
 
    mail_plugins {
@@ -9180,11 +9237,11 @@ if [[ $dovecot_major_version -gt 2 ]] \
 
    if [[ "$db_driver" = "pgsql" ]]; then
 
-      read -r -d '' NEW_BLOCK <<'EOF'
+      read -r -d '' NEW_BLOCK <<EOF
 userdb sql {
 
    # Load SQL connection data
-   !include /usr/local/dovecot-2.4.1-4/etc/dovecot/sql-connect.conf.ext
+   !include /usr/local/dovecot-${_version}/etc/dovecot/sql-connect.conf.ext
 
    query = SELECT '/var/vmail/' || maildir AS home, \\
       '5000' AS uid, '5000' AS gid, \\
@@ -9222,7 +9279,7 @@ EOF
 # The userdb and passdb may be the same or they may be different depending on your needs.
 # You can also have multiple authentication databases.
 #
-# see: https://doc.dovecot.org/2.4.1/core/config/auth/userdb.html
+# see: https://doc.dovecot.org/${_version}/core/config/auth/userdb.html
 #
 ${NEW_BLOCK}
 EOF
@@ -9234,11 +9291,11 @@ EOF
 
    elif [[ "$db_driver" = "mysql" ]]; then
 
-      read -r -d '' NEW_BLOCK <<'EOF'
+      read -r -d '' NEW_BLOCK <<EOF
 userdb sql {
 
    # Load SQL connection data
-   !include /usr/local/dovecot-2.4.1-4/etc/dovecot/sql-connect.conf.ext
+   !include /usr/local/dovecot-${_version}/etc/dovecot/sql-connect.conf.ext
 
    query = SELECT CONCAT('/var/vmail/',maildir) AS home, \
       '5000' AS uid, '5000' AS gid, \
@@ -9276,7 +9333,7 @@ EOF
 # The userdb and passdb may be the same or they may be different depending on your needs.
 # You can also have multiple authentication databases.
 #
-# see: https://doc.dovecot.org/2.4.1/core/config/auth/userdb.html
+# see: https://doc.dovecot.org/${_version}/core/config/auth/userdb.html
 #
 $(echo -e "${NEW_BLOCK}")
 EOF