WIP.

diff --git a/all_new_2018/linkable_etc_files/mail/etc/opendkim.conf b/all_new_2018/linkable_etc_files/mail/etc/opendkim.conf
index c7691ead5b2165286ccf44f40404c06fc81685ab..dbd31b4ddff36b96d38ef786f3ec82bd37d8d9e0 100644 (file)
--- a/all_new_2018/linkable_etc_files/mail/etc/opendkim.conf
+++ b/all_new_2018/linkable_etc_files/mail/etc/opendkim.conf
@@ -6,7 +6,7 @@
 Syslog                 yes
 # Required to use local socket with MTAs that access the socket as a non-
 # privileged user (e.g. Postfix)
-UMask                  002
+UMask                  007
 
 # Sign for example.com with key in /etc/dkimkeys/dkim.key using
 # selector '2007' (e.g. 2007._domainkey.example.com)

diff --git a/all_new_2018/linkable_etc_files/server/etc/iptables/rules.v4 b/all_new_2018/linkable_etc_files/server/etc/iptables/rules.v4
index fa4882dfa1340e80cbee94ce5758c5a03a1e95a8..3e518d5079c9cba91c032c06ebdd35e82e956cbe 100644 (file)
--- a/all_new_2018/linkable_etc_files/server/etc/iptables/rules.v4
+++ b/all_new_2018/linkable_etc_files/server/etc/iptables/rules.v4
@@ -8,6 +8,9 @@
 -A INPUT -p icmp -j ACCEPT
 # SSH
 -A INPUT -p tcp --dport 22 -j ACCEPT
+# HTTP; uncomment for creating LetsEncrypt certificates in standalone mode.
+#-A INPUT -p tcp --dport 80 -j ACCEPT
+# SMTP (allowing for STARTTLS); necessary for mail server to mail server banter
 # HTTPS in theory, in practice my second SSH port, see sshd_config
 -A INPUT -p tcp --dport 443 -j ACCEPT
 # SMTP (allowing for STARTTLS); necessary for mail server to mail server banter

diff --git a/all_new_2018/setup_mail.sh b/all_new_2018/setup_mail.sh
index 285ecb689b63481b052295cb348c68bdbbd59704..f19d36ea9fd0e71f63016570e4da41934adf7107 100755 (executable)
--- a/all_new_2018/setup_mail.sh
+++ b/all_new_2018/setup_mail.sh
@@ -1,8 +1,8 @@
 #/bin/sh
 set -e
 
-selector=$1
-if [ ! -n "${selector}" ]; then
+dkim_selector=$1
+if [ ! -n "${dkim_selector}" ]; then
     echo "Give DKIM selector argument."
     false
 fi
@@ -12,14 +12,17 @@ mkdir -p /etc/dkimkeys/
 add_dkim_record=0
 if [ ! -f "/etc/dkimkeys/${dkim_selector}.private" ]; then
     add_dkim_record=1
+    set +e
     dpkg -s opendkim-tools &> /dev/null
     preinstalled="$?"
+    set -e
     if [ ! "${preinstalled}" -eq "0" ]; then
         apt install -y opendkim-tools
     fi
     opendkim-genkey -s "${dkim_selector}"
+    mv "${dkim_selector}.private" /etc/dkimkeys/
     if [ ! "${preinstalled}" -eq "0" ]; then
-        apt --purge autoremove opendkim-tools
+        apt -y --purge autoremove opendkim-tools
     fi
 fi
 
@@ -41,7 +44,8 @@ echo "$(hostname -f)" > /etc/mailname
 
 # Everything should now be ready for installations.
 apt install -y postfix dovecot-imapd opendkim
-echo "TODO: Ensure a proper SPF entry for this system in your DNS configuration."
+echo "TODO: Ensure MX entry for your system in your DNS configuration."
+echo "TODO: Ensure a proper SPF entry for this system in your DNS configuration; something like 'v=spf1 a mx -all' mapped to your subdomain."
 if [ "${add_dkim_record}" -eq "1" ]; then
     echo "TODO: Add the following DKIM entry to your DNS configuration (possibly with slightly changed host entry – if your mail domain includes a subdomain, append that with a dot):"
     cat "${dkim_selector}.txt"