Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
I'm not sure if I find the time for it. Is there already a feature request in github?
usage: setup-dkim-signing.sh {add|check|del|deleteall} [example.com] [myselector]
add {example.com} {myselector}
Generate a new DKIM key (if necessary), upload it into Redis and configure rspamd accordingly.
check
Show keys stored in Redis and domains configured in rspamd
del {example.com} {myselector}
Delete a single key from Redis and rspamd. The key files will not be deleted.
deleteall
Delete all keys from Redis and rspamd. The key files will not be deleted../setup-dkim-signing.sh add example.com myselector(Update 05.08.2021: Bug: The domain clause in the config file is not formatted properly in case of multiple domains, but this can be fixed manually following the template at the end of this post)#!/bin/sh
# setup-dkim-signing.sh
# OPNsense firewall shell script to implement DKIM signing of outgoing e-mails
# Forum thread: https://forum.opnsense.org/index.php?topic=20280.0
# v0.1 20210523 AlienMindbender
# prepare environment
COMMAND=$1
DOMAIN=$2
SELECTOR=$3
KEYPATH="/root/dkim"
CONFIGPATH="/usr/local/etc/rspamd/local.d/"
CONFIGFILE=$CONFIGPATH"dkim_signing.conf"
TMPFILE="/tmp/setup-dkim-signing.$$.tmp"
mkdir $KEYPATH >/dev/null 2>&1
cd $KEYPATH
case $1 in
add)
# check for 3 arguments
if [ $# -lt 3 ]; then
echo "Both domain name and selector are required to add a key:"
echo " add {example.com} {myselector}"
exit 1
fi
# generate 2048 bit RSA key
if [ -f "$DOMAIN.key" ];
then
echo "Key file "$KEYPATH"/"$DOMAIN".key exists, skipping key generation"
else
echo "Generating new 2048 bit RSA key..."
rspamadm dkim_keygen -b 2048 -d $DOMAIN -s $SELECTOR -k $DOMAIN.key > $DOMAIN.dns
echo "Done, key stored in "$KEYPATH
fi
echo
# display DNS record
echo "The following record needs to be added to your DNS zonefile:"
cat $DOMAIN.dns
echo
# upload key to Redis
echo "Uploading key to Redis..."
echo "local key = [[""`cat $DOMAIN.key`""]]" > $DOMAIN.redis && echo "redis.call('HMSET', 'DKIM_KEYS', '$SELECTOR.$DOMAIN', key)" >> $DOMAIN.redis
redis-cli --eval ./$DOMAIN.redis
echo
# configure Rspamd
echo "Unprotecting Rspamd config file..."
chflags noschg $CONFIGFILE
chmod u+w $CONFIGFILE
echo "Adding domain "$DOMAIN" to config file..."
echo "domain { "$DOMAIN" { selector = '"$SELECTOR"'; } }" >> $CONFIGFILE
echo "Write protecting Rspamd config file..."
chmod u-w $CONFIGFILE
chflags schg $CONFIGFILE
echo
echo "Done."
;;
check)
echo "*** Redis key storage ***"
redis-cli HGETALL DKIM_KEYS
echo
echo "*** Rspamd configured domains ***"
grep "domain {" $CONFIGFILE
echo
echo "*** Rspamd config file protection ***"
ls -lo $CONFIGFILE > $TMPFILE
if grep "schg" $TMPFILE 2> /dev/null;
then
echo "Config file is write protected."
else
echo "Config file is not write protected."
fi
rm -f $TMPFILE
;;
del)
# check for 3 arguments
if [ $# -lt 3 ]; then
echo "Both domain name and selector are required to delete a single key:"
echo " del {example.com} {myselector}"
exit 1
fi
echo "Removing key from Redis..."
redis-cli HDEL DKIM_KEYS $SELECTOR.$DOMAIN
echo
echo "Unprotecting Rspamd config file..."
chflags noschg $CONFIGFILE
chmod u+w $CONFIGFILE
echo "Removing key from configuration file..."
grep -v "domain { $DOMAIN { selector = '$SELECTOR'; } }" $CONFIGFILE > $TMPFILE
cat $TMPFILE > $CONFIGFILE
rm -f $TMPFILE
echo "Write protecting Rspamd config file..."
chmod u-w $CONFIGFILE
chflags schg $CONFIGFILE
echo
echo "Done."
;;
deleteall)
read -r -p "Delete all DKIM keys from Redis and Rspamd configuration (y/N)? " REPLY
case $REPLY in
[yY])
echo "Deleting keys from Redis..."
redis-cli DEL DKIM_KEYS
echo "Unprotecting Rspamd config file..."
chflags noschg $CONFIGFILE
chmod u+w $CONFIGFILE
echo "Removing domains from Rspamd configuration..."
grep -v "domain {" $CONFIGFILE > $TMPFILE
cat $TMPFILE > $CONFIGFILE
rm -f $TMPFILE
echo
echo "Done."
;;
*)
echo "Aborting."
;;
esac
;;
*)
echo "usage: setup-dkim-signing.sh {add|check|del|deleteall} [example.com] [myselector]"
echo " add {example.com} {myselector}"
echo " Generate a new DKIM key (if necessary), upload it into Redis and configure rspamd accordingly."
echo " check"
echo " Show keys stored in Redis and domains configured in rspamd"
echo " del {example.com} {myselector}"
echo " Delete a single key from Redis and rspamd. The key files will not be deleted."
echo " deleteall"
echo " Delete all keys from Redis and rspamd. The key files will not be deleted."
echo
exit 1
;;
esacenabled = true;
allow_envfrom_empty = true;
allow_hdrfrom_mismatch = true;
allow_hdrfrom_multiple = false;
allow_username_mismatch = true;
auth_only = false;
selector = "dkim";
sign_local = true;
symbol = "DKIM_SIGNED";
try_fallback = false;
use_domain = "header";
use_esld = true;
use_redis = true;
key_prefix = "DKIM_KEYS";
domain { example.com { selector = 'selectone'; },
example2.com { selector = 'selecttwo'; }
}
Using ECC RAM is strongly recommended(Quelle: https://www.truenas.com/docs/hub/intro/corehardwareguide/)
Mein Punkt ist einfach: wir haben in BSD mit ZFS ein rock solid enterprise grade Filesystem.
)
Curious about the RLAN. Is that setup through opnsense? Just a VLAN?
I have all my IoTs connected to my guest account. I don't think my Orbi has the ability to create more than 1 guest wireless. What type of wireless point are you using that does this?