Hi bubbel,switching over from a Sophos UTM home licence to OPNsense I was up to the same taks.It appears to me that especially the rspamd / postfix integration is work in progress, for DKIM signing the options are uncommented and a bit cryptic, plus there appears to be no way from the GUI to upload / manage the DKIM keys in redis.Rspamd would be able to use keys from a config file, but such CLI changes would most probably be overwritten.There is a generic description on how to use redis based DKIM key storage in the rspamd documentation:https://rspamd.com/doc/modules/dkim_signing.html#dkim-key-managementI am going to try this approach and I will comment on my findings, should anybody be interested.
Quote from: AlienMindbender on February 11, 2021, 04:36:32 pmHi bubbel,switching over from a Sophos UTM home licence to OPNsense I was up to the same taks.It appears to me that especially the rspamd / postfix integration is work in progress, for DKIM signing the options are uncommented and a bit cryptic, plus there appears to be no way from the GUI to upload / manage the DKIM keys in redis.Rspamd would be able to use keys from a config file, but such CLI changes would most probably be overwritten.There is a generic description on how to use redis based DKIM key storage in the rspamd documentation:https://rspamd.com/doc/modules/dkim_signing.html#dkim-key-managementI am going to try this approach and I will comment on my findings, should anybody be interested.If you have a quick howto on where to put which content I can update the GUI for this.
rspamadm dkim_keygen -b 2048 -s opndkim -k /tmp/opndkim.key | sudo tee -a /tmp/opndkim.pubchown -R rspamd: /tmp/opndkim.*chmod 440 /tmp/opndkim.*
/usr/local/etc/rspamd/local.d/dkim_signing.conf# Please don't modify this file as your changes might be overwritten with# the next update.# allow_envfrom_empty = true; allow_hdrfrom_mismatch = false; allow_hdrfrom_multiple = false; allow_username_mismatch = false; auth_only = true; #path = "/var/lib/rspamd/dkim/$domain.$selector.key"; selector = "dkim"; sign_local = true; symbol = "DKIM_SIGNED"; try_fallback = false; use_domain = "header"; use_esld = true; use_redis = false; # Hash for DKIM keys in Redis key_prefix = "DKIM_KEYS"; domain { # Domain name is used as key mydomain.com { # Private key path path = "/tmp/opndkim.key"; # Selector selector = "opndkim"; } }
Yes this should be ..
usage: setup-dkim-signing.sh {add|check|del|deleteall} [example.com] [myselector] add {example.com} {myselector} Generate a new DKIM key (if necessary), upload it into Redis and configure rspamd accordingly. check Show keys stored in Redis and domains configured in rspamd del {example.com} {myselector} Delete a single key from Redis and rspamd. The key files will not be deleted. deleteall Delete all keys from Redis and rspamd. The key files will not be deleted.
./setup-dkim-signing.sh add example.com myselector
#!/bin/sh# setup-dkim-signing.sh# OPNsense firewall shell script to implement DKIM signing of outgoing e-mails# Forum thread: https://forum.opnsense.org/index.php?topic=20280.0# v0.1 20210523 AlienMindbender# prepare environmentCOMMAND=$1DOMAIN=$2SELECTOR=$3KEYPATH="/root/dkim"CONFIGPATH="/usr/local/etc/rspamd/local.d/"CONFIGFILE=$CONFIGPATH"dkim_signing.conf"TMPFILE="/tmp/setup-dkim-signing.$$.tmp"mkdir $KEYPATH >/dev/null 2>&1cd $KEYPATHcase $1 in add) # check for 3 arguments if [ $# -lt 3 ]; then echo "Both domain name and selector are required to add a key:" echo " add {example.com} {myselector}" exit 1 fi # generate 2048 bit RSA key if [ -f "$DOMAIN.key" ]; then echo "Key file "$KEYPATH"/"$DOMAIN".key exists, skipping key generation" else echo "Generating new 2048 bit RSA key..." rspamadm dkim_keygen -b 2048 -d $DOMAIN -s $SELECTOR -k $DOMAIN.key > $DOMAIN.dns echo "Done, key stored in "$KEYPATH fi echo # display DNS record echo "The following record needs to be added to your DNS zonefile:" cat $DOMAIN.dns echo # upload key to Redis echo "Uploading key to Redis..." echo "local key = [[""`cat $DOMAIN.key`""]]" > $DOMAIN.redis && echo "redis.call('HMSET', 'DKIM_KEYS', '$SELECTOR.$DOMAIN', key)" >> $DOMAIN.redis redis-cli --eval ./$DOMAIN.redis echo # configure Rspamd echo "Unprotecting Rspamd config file..." chflags noschg $CONFIGFILE chmod u+w $CONFIGFILE echo "Adding domain "$DOMAIN" to config file..." echo "domain { "$DOMAIN" { selector = '"$SELECTOR"'; } }" >> $CONFIGFILE echo "Write protecting Rspamd config file..." chmod u-w $CONFIGFILE chflags schg $CONFIGFILE echo echo "Done." ;; check) echo "*** Redis key storage ***" redis-cli HGETALL DKIM_KEYS echo echo "*** Rspamd configured domains ***" grep "domain {" $CONFIGFILE echo echo "*** Rspamd config file protection ***" ls -lo $CONFIGFILE > $TMPFILE if grep "schg" $TMPFILE 2> /dev/null; then echo "Config file is write protected." else echo "Config file is not write protected." fi rm -f $TMPFILE ;; del) # check for 3 arguments if [ $# -lt 3 ]; then echo "Both domain name and selector are required to delete a single key:" echo " del {example.com} {myselector}" exit 1 fi echo "Removing key from Redis..." redis-cli HDEL DKIM_KEYS $SELECTOR.$DOMAIN echo echo "Unprotecting Rspamd config file..." chflags noschg $CONFIGFILE chmod u+w $CONFIGFILE echo "Removing key from configuration file..." grep -v "domain { $DOMAIN { selector = '$SELECTOR'; } }" $CONFIGFILE > $TMPFILE cat $TMPFILE > $CONFIGFILE rm -f $TMPFILE echo "Write protecting Rspamd config file..." chmod u-w $CONFIGFILE chflags schg $CONFIGFILE echo echo "Done." ;; deleteall) read -r -p "Delete all DKIM keys from Redis and Rspamd configuration (y/N)? " REPLY case $REPLY in [yY]) echo "Deleting keys from Redis..." redis-cli DEL DKIM_KEYS echo "Unprotecting Rspamd config file..." chflags noschg $CONFIGFILE chmod u+w $CONFIGFILE echo "Removing domains from Rspamd configuration..." grep -v "domain {" $CONFIGFILE > $TMPFILE cat $TMPFILE > $CONFIGFILE rm -f $TMPFILE echo echo "Done." ;; *) echo "Aborting." ;; esac ;; *) echo "usage: setup-dkim-signing.sh {add|check|del|deleteall} [example.com] [myselector]" echo " add {example.com} {myselector}" echo " Generate a new DKIM key (if necessary), upload it into Redis and configure rspamd accordingly." echo " check" echo " Show keys stored in Redis and domains configured in rspamd" echo " del {example.com} {myselector}" echo " Delete a single key from Redis and rspamd. The key files will not be deleted." echo " deleteall" echo " Delete all keys from Redis and rspamd. The key files will not be deleted." echo exit 1 ;;esac
enabled = true;allow_envfrom_empty = true;allow_hdrfrom_mismatch = true;allow_hdrfrom_multiple = false;allow_username_mismatch = true;auth_only = false;selector = "dkim";sign_local = true;symbol = "DKIM_SIGNED";try_fallback = false;use_domain = "header";use_esld = true;use_redis = true;key_prefix = "DKIM_KEYS";domain { example.com { selector = 'selectone'; }, example2.com { selector = 'selecttwo'; } }
I'm not sure if I find the time for it. Is there already a feature request in github?
