This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
Quote from: mimugmail on July 05, 2021, 09:04:23 AM
I'm not sure if I find the time for it. Is there already a feature request in github?
"usage: setup-dkim-signing.sh {add|check|del|deleteall} [example.com] [myselector]
add {example.com} {myselector}
Generate a new DKIM key (if necessary), upload it into Redis and configure rspamd accordingly.
check
Show keys stored in Redis and domains configured in rspamd
del {example.com} {myselector}
Delete a single key from Redis and rspamd. The key files will not be deleted.
deleteall
Delete all keys from Redis and rspamd. The key files will not be deleted../setup-dkim-signing.sh add example.com myselector#!/bin/sh
# setup-dkim-signing.sh
# OPNsense firewall shell script to implement DKIM signing of outgoing e-mails
# Forum thread: https://forum.opnsense.org/index.php?topic=20280.0
# v0.1 20210523 AlienMindbender
# prepare environment
COMMAND=$1
DOMAIN=$2
SELECTOR=$3
KEYPATH="/root/dkim"
CONFIGPATH="/usr/local/etc/rspamd/local.d/"
CONFIGFILE=$CONFIGPATH"dkim_signing.conf"
TMPFILE="/tmp/setup-dkim-signing.$$.tmp"
mkdir $KEYPATH >/dev/null 2>&1
cd $KEYPATH
case $1 in
add)
# check for 3 arguments
if [ $# -lt 3 ]; then
echo "Both domain name and selector are required to add a key:"
echo " add {example.com} {myselector}"
exit 1
fi
# generate 2048 bit RSA key
if [ -f "$DOMAIN.key" ];
then
echo "Key file "$KEYPATH"/"$DOMAIN".key exists, skipping key generation"
else
echo "Generating new 2048 bit RSA key..."
rspamadm dkim_keygen -b 2048 -d $DOMAIN -s $SELECTOR -k $DOMAIN.key > $DOMAIN.dns
echo "Done, key stored in "$KEYPATH
fi
echo
# display DNS record
echo "The following record needs to be added to your DNS zonefile:"
cat $DOMAIN.dns
echo
# upload key to Redis
echo "Uploading key to Redis..."
echo "local key = [[""`cat $DOMAIN.key`""]]" > $DOMAIN.redis && echo "redis.call('HMSET', 'DKIM_KEYS', '$SELECTOR.$DOMAIN', key)" >> $DOMAIN.redis
redis-cli --eval ./$DOMAIN.redis
echo
# configure Rspamd
echo "Unprotecting Rspamd config file..."
chflags noschg $CONFIGFILE
chmod u+w $CONFIGFILE
echo "Adding domain "$DOMAIN" to config file..."
echo "domain { "$DOMAIN" { selector = '"$SELECTOR"'; } }" >> $CONFIGFILE
echo "Write protecting Rspamd config file..."
chmod u-w $CONFIGFILE
chflags schg $CONFIGFILE
echo
echo "Done."
;;
check)
echo "*** Redis key storage ***"
redis-cli HGETALL DKIM_KEYS
echo
echo "*** Rspamd configured domains ***"
grep "domain {" $CONFIGFILE
echo
echo "*** Rspamd config file protection ***"
ls -lo $CONFIGFILE > $TMPFILE
if grep "schg" $TMPFILE 2> /dev/null;
then
echo "Config file is write protected."
else
echo "Config file is not write protected."
fi
rm -f $TMPFILE
;;
del)
# check for 3 arguments
if [ $# -lt 3 ]; then
echo "Both domain name and selector are required to delete a single key:"
echo " del {example.com} {myselector}"
exit 1
fi
echo "Removing key from Redis..."
redis-cli HDEL DKIM_KEYS $SELECTOR.$DOMAIN
echo
echo "Unprotecting Rspamd config file..."
chflags noschg $CONFIGFILE
chmod u+w $CONFIGFILE
echo "Removing key from configuration file..."
grep -v "domain { $DOMAIN { selector = '$SELECTOR'; } }" $CONFIGFILE > $TMPFILE
cat $TMPFILE > $CONFIGFILE
rm -f $TMPFILE
echo "Write protecting Rspamd config file..."
chmod u-w $CONFIGFILE
chflags schg $CONFIGFILE
echo
echo "Done."
;;
deleteall)
read -r -p "Delete all DKIM keys from Redis and Rspamd configuration (y/N)? " REPLY
case $REPLY in
[yY])
echo "Deleting keys from Redis..."
redis-cli DEL DKIM_KEYS
echo "Unprotecting Rspamd config file..."
chflags noschg $CONFIGFILE
chmod u+w $CONFIGFILE
echo "Removing domains from Rspamd configuration..."
grep -v "domain {" $CONFIGFILE > $TMPFILE
cat $TMPFILE > $CONFIGFILE
rm -f $TMPFILE
echo
echo "Done."
;;
*)
echo "Aborting."
;;
esac
;;
*)
echo "usage: setup-dkim-signing.sh {add|check|del|deleteall} [example.com] [myselector]"
echo " add {example.com} {myselector}"
echo " Generate a new DKIM key (if necessary), upload it into Redis and configure rspamd accordingly."
echo " check"
echo " Show keys stored in Redis and domains configured in rspamd"
echo " del {example.com} {myselector}"
echo " Delete a single key from Redis and rspamd. The key files will not be deleted."
echo " deleteall"
echo " Delete all keys from Redis and rspamd. The key files will not be deleted."
echo
exit 1
;;
esacenabled = true;
allow_envfrom_empty = true;
allow_hdrfrom_mismatch = true;
allow_hdrfrom_multiple = false;
allow_username_mismatch = true;
auth_only = false;
selector = "dkim";
sign_local = true;
symbol = "DKIM_SIGNED";
try_fallback = false;
use_domain = "header";
use_esld = true;
use_redis = true;
key_prefix = "DKIM_KEYS";
domain { example.com { selector = 'selectone'; },
example2.com { selector = 'selecttwo'; }
}
QuoteUsing ECC RAM is strongly recommended(Quelle: https://www.truenas.com/docs/hub/intro/corehardwareguide/)
Quote from: JeGr on February 17, 2021, 03:32:43 PM
Mein Punkt ist einfach: wir haben in BSD mit ZFS ein rock solid enterprise grade Filesystem.
Quote from: IcarusOPN on February 12, 2021, 10:29:52 PM
Curious about the RLAN. Is that setup through opnsense? Just a VLAN?
Quote from: IcarusOPN on February 12, 2021, 10:29:52 PM
I have all my IoTs connected to my guest account. I don't think my Orbi has the ability to create more than 1 guest wireless. What type of wireless point are you using that does this?
