#!/bin/bash
######系統配合
#下載ISO檔
# https://ftp.ubuntu-tw.org/ubuntu-releases/26.04.1/ 安裝
######鄭亮星 jls@mail.jls.idv.tw , jls550225@gmail.com , jls@acfs.tw
##設定 E-mail webmail 郵件流量
ETH0=$(ls /proc/net/dev_snmp6 |awk '{ print $1 }' |sed -n '1p')
IP=$(ifconfig $ETH0 |grep 'inet ' |awk '{print $2}')
HOSTNAME=$(/bin/hostname)
DOMAINNAME=$(/bin/hostname -d)
DATE=$(date "+%Y%m%d%H")
sync
cp -arf /etc/postfix/main.cf /etc/postfix/main.cf-$DATE
cat > /etc/postfix/main.cf << EOF
queue_directory = /var/spool/postfix
command_directory = /usr/sbin
data_directory = /var/lib/postfix
mail_owner = postfix
myorigin = \$myhostname
inet_interfaces = all
inet_protocols = all
mydestination = \$myhostname, \$mydomain, mail.\$mydomain, localhost.\$mydomain, localhost
# masquerade_domains = $mydomain
unknown_local_recipient_reject_code = 550
relay_domains =
smtpd_banner = 愛你喔！
#relayhost = [ms25.hinet.net]
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
# body_checks = regexp:/etc/postfix/body_checks
# header_checks = regexp:/etc/postfix/header_checks
debug_peer_level = 2
debugger_command =
         PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
         ddd \$daemon_directory/\$process_name \$process_id & sleep 5
sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
#sample_directory = /usr/share/doc/postfix/examples
#readme_directory = /usr/share/doc/postfix/README_FILES
mydomain = $DOMAINNAME
myhostname = $HOSTNAME
mailbox_size_limit = 5120000000
message_size_limit = 51200000
smtpd_recipient_limit = 200
#====================SASL========================
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain =
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_destination, check_policy_service inet:127.0.0.1:10023, permit
smtpd_sasl_security_options = noanonymous
#===================TLS parameters===============
####將 Let's Encrypt 申請到的 SSL 憑證用在 Postfix 上
smtpd_use_tls = yes
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
#smtpd_tls_cert_file = /etc/letsencrypt/live/$DOMAINNAME/fullchain.pem
#smtpd_tls_key_file = /etc/letsencrypt/live/$DOMAINNAME/privkey.pem
#smtpd_tls_CAfile = /etc/letsencrypt/live/$DOMAINNAME/chain.pem
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_protocols = !SSLv2, !SSLv3
smtpd_tls_security_level = may
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_auth_only = yes
smtpd_sasl_tls_security_options = noanonymous
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_ciphers = high
smtp_use_tls = yes
smtp_tls_note_starttls_offer = yes
tls_random_source = dev:/dev/urandom

#always_bcc = SuperUSER

EOF
cp -arf /etc/dovecot/conf.d/10-auth.conf /etc/dovecot/conf.d/10-auth.conf-$DATE
cp -arf /etc/dovecot/conf.d/10-mail.conf /etc/dovecot/conf.d/10-mail.conf-$DATE
cp -arf /etc/dovecot/conf.d/10-ssl.conf /etc/dovecot/conf.d/10-ssl.conf-$DATE
cp -arf /etc/dovecot/conf.d/10-master.conf /etc/dovecot/conf.d/10-master.conf-$DATE
/usr/bin/sed -i '/^  # Postfix smtp-auth/i   unix_listener /var/spool/postfix/private/auth {\n     mode = 0666\n     user = postfix\n     group = postfix\n   }' /etc/dovecot/conf.d/10-master.conf
find /etc/dovecot/conf.d/10-auth.conf -type f -exec perl -i -pe s/"#disable_plaintext_auth = yes"/"disable_plaintext_auth = no"/g {} \;
#find /etc/dovecot/conf.d/10-auth.conf -type f -exec perl -i -pe s/"#disable_plaintext_auth = yes"/"disable_plaintext_auth = yes"/g {} \;
find /etc/dovecot/conf.d/10-auth.conf -type f -exec perl -i -pe s/"auth_mechanisms = plain"/"auth_mechanisms = plain login"/g {} \;
#find /etc/dovecot/conf.d/10-mail.conf -type f -exec perl -i -pe s/"#   mail_location = mbox:~\/mail:INBOX=\/var\/mail\/%u"/"   mail_location = mbox:~\/mail:INBOX=\/var\/mail\/%u"/g {} \;
find /etc/dovecot/conf.d/10-ssl.conf -type f -exec perl -i -pe s/"ssl = required"/"ssl = yes"/g {} \;
/usr/bin/sed -i '/^ssl_cert/i####將 Letˊs Encrypt 申請到的 SSL 憑證用在 Dovecot 上\n#ssl_cert = </etc/letsencrypt/'$DOMAINNAME'-0001/fullchain.pem\n#ssl_cert = </etc/letsencrypt/'$DOMAINNAME'-0001/privkey.pem\n' /etc/dovecot/conf.d/10-ssl.conf
sync
cp -arf /etc/postfix/master.cf /etc/postfix/master.cf-$DATE
/usr/bin/sed -i '/^#smtps/ismtps     inet  n       -       n       -       -       smtpd\n    -o syslog_name=postfix/smtps\n    -o smtpd_tls_wrappermode=yes\n    -o smtpd_sasl_auth_enable=yes' /etc/postfix/master.cf
/usr/bin/sed -i '/^#submission/isubmission inet n       -       n       -       -       smtpd\n  -o syslog_name=postfix/submission\n  -o smtpd_tls_security_level=encrypt\n  -o smtpd_sasl_auth_enable=yes\n  -o smtpd_tls_auth_only=yes' /etc/postfix/master.cf
sync

tar zxvf openwebmail-current.tar.gz -C /tmp
if [ -d /var/www/webmail ]; then
  cp -arf /var/www/webmail /var/www/webmail-$DATE
fi
sync
mkdir -p /var/www/webmail
mv /tmp/cgi-bin/openwebmail /var/www/webmail/mail
mv /tmp/data /var/www/webmail
sync
touch /var/log/openwebmail.log
cat > /var/www/webmail/mail/etc/openwebmail.conf << EOF
domainnames                     $DOMAINNAME
auth_module                     auth_unix.pl
quota_module                    quota_du.pl

ow_cgidir                               /var/www/webmail/mail
ow_cgiurl                               /mail
ow_htmldir                      /var/www/webmail/data/openwebmail
ow_htmlurl                      /data/openwebmail

logo_link                       http://www.$DOMAINNAME/

logfile                         /var/log/openwebmail.log

spellcheck                      /usr/bin/aspell

quota_limit                     100000000

maxbooksize                     500000

attlimit                                50000000

webdisk_uploadlimit             50000000

enable_viruscheck               yes
viruscheck_pipe                 /usr/bin/clamdscan --disable-summary --stdout -
viruscheck_source_allowed       all
default_filter_badaddrformat            yes
default_filter_fakedsmtp                yes
default_filter_fakedfrom                yes
default_filter_fakedexecontenttype      yes
default_viruscheck_source               all
default_viruscheck_minbodysize          0
<page_footer>
<a href="http://webmail.$DOMAINNAME/data/openwebmail/help/zh_TW.Big5/index.html" target="_blank">線上中文說明</a><br>
<a href="http://www.openwebmail.org/" target="_blank">Powered By Openwebmail</a><br>
</page_footer>
default_locale                        zh_TW.UTF-8
default_iconset                       cool3d.zh_TW
default_autoreplysubject                此為自動回信信件...[Re: \$SUBJECT]

<default_autoreplytext>
您好 :
我無法馬上閱讀您的信件
您所寄來的\$SUBJECT,當我閱讀完您的信件後,將會給您一個滿意的答覆

我們的官方網站 (http://www.$DOMAINNAME)
</default_autoreplytext>

<DEFAULT_signature>
----------------------------------------------------------------
1.不要把自己的快樂,建築在別人的痛苦上
2.或許您可以欺騙全世界所有的人,不過您．．郤無法欺騙自己的良心
3.世間最珍貴的不是 “得不到” 和 “已失去”，而是現在能把握的幸福。
4.把每一次戀愛都當成最後一次...才懂得付出
5.把每一次相處都當成最後一天...才學會珍惜
6.取之於網路,回饋於社會

我們的官方網站 (http://www.$DOMAINNAME)
--------------------------------------------------------------
</DEFAULT_signature>

EOF

cat > /var/www/webmail/mail/etc/auth_unix.conf << EOF
passwdfile_plaintext    /etc/passwd
passwdfile_encrypted    /etc/shadow
passwdmkdb              none
check_expire            no
check_nologin           no
check_shell             no
check_cobaltuser        no
change_smbpasswd        no
EOF

cat > /var/www/webmail/mail/etc/dbm.conf << EOF
dbm_ext                 .pag
dbmopen_ext             none
dbmopen_haslock         no
EOF

cat > /var/www/webmail/index.html << EOF
<html>
<head><meta http-equiv=Refresh content=0
</head>
<body onload="window.open('/mail/openwebmail.pl','_top')">
</body>
</html>
EOF
/var/www/webmail/mail/openwebmail-tool.pl --init
sync
chmod 4755 /var/www/webmail/mail/openwebmail*
sync

chmod a+x update-mailstats.pl mailstats.pl mrtg-mailstats.pl
mv update-mailstats.pl mailstats.pl mrtg-mailstats.pl /usr/bin
#find /usr/bin/update-mailstats.pl -type f -exec perl -i -pe s/"mail.log"/"maillog"/g {} \;
/usr/bin/update-mailstats.pl &
echo "/usr/bin/update-mailstats.pl & > /dev/null" >> /usr/sbin/load.system
mkdir -p /var/www/mrtg/mailstats

cat > /etc/mrtg/mrtg-mail.cfg << EOF
WorkDir: /var/www/mrtg/mailstats
Target[postfix]: \`/usr/bin/mrtg-mailstats.pl\`
MaxBytes[postfix]: 1000
Options[postfix]: gauge, growright
WithPeak[postfix]: dwmy
YLegend[postfix]: No. of messages
ShortLegend[postfix]: messages
LegendI[postfix]: &nbsp;Incoming:
LegendO[postfix]: &nbsp;Outgoing:
Title[postfix]: Postfix Statistics
PageTop[postfix]: <H1>Postfix Statistics</H1>
Language: big5
EOF

mrtg /etc/mrtg/mrtg-mail.cfg
LANG=C /usr/bin/mrtg /etc/mrtg/mrtg-mail.cfg
LANG=C /usr/bin/mrtg /etc/mrtg/mrtg-mail.cfg
LANG=C /usr/bin/mrtg /etc/mrtg/mrtg-mail.cfg
LANG=C /usr/bin/mrtg /etc/mrtg/mrtg-mail.cfg
LANG=C LC_ALL=C /usr/bin/mrtg /etc/mrtg/mrtg-mail.cfg --lock-file /var/lock/mrtg/mrtg_2 --confcache-file /var/lib/mrtg/mrtg-mail.ok
LANG=C LC_ALL=C /usr/bin/mrtg /etc/mrtg/mrtg-mail.cfg --lock-file /var/lock/mrtg/mrtg_2 --confcache-file /var/lib/mrtg/mrtg-mail.ok
LANG=C LC_ALL=C /usr/bin/mrtg /etc/mrtg/mrtg-mail.cfg --lock-file /var/lock/mrtg/mrtg_2 --confcache-file /var/lib/mrtg/mrtg-mail.ok
LANG=C LC_ALL=C /usr/bin/mrtg /etc/mrtg/mrtg-mail.cfg --lock-file /var/lock/mrtg/mrtg_2 --confcache-file /var/lib/mrtg/mrtg-mail.ok
echo "*/5 * * * * root LANG=C LC_ALL=C /usr/bin/mrtg /etc/mrtg/mrtg-mail.cfg --lock-file /var/lock/mrtg/mrtg_2 --confcache-file /var/lib/mrtg/mrtg-mail.ok" >> /etc/cron.d/mrtg
ln -sf /var/www/mrtg/mailstats /var/www/html/postfix
ln -sf /var/www/mrtg/mailstats/postfix.html /var/www/mrtg/mailstats/index.html
cp -arf /etc/apache2/sites-available/http_80.conf /etc/apache2/sites-available/http_80.conf-$DATE
cat >> /etc/apache2/sites-available/http_80.conf << EOF
#------------------------------------------------------------------------------------------------------------------------
<VirtualHost *:80>
  AddDefaultCharset Big5
  ServerAdmin root@$DOMAINNAME
  DocumentRoot /var/www/mrtg/mailstats
  ServerName postfix.$DOMAINNAME
  DirectoryIndex postfix.html index.html index.php index.htm index.php3
#       <FilesMatch \.php$>
####    From the Apache version 2.4.10 and above, use the SetHandler to run PHP as a fastCGI process server
#            SetHandler "proxy:unix:/run/php/php7.4-fpm.sock|fcgi://localhost"
#       </FilesMatch>
#  CBandSpeed 40960 200 200
#  CBandRemoteSpeed 40960kb/s 100 100
#  CBandLimit 10000Mb
#  CBandPeriod 4W
#  CBandScoreboard /var/log/scoreboard/postfix.$DOMAINNAME
#  CBandScoreFlushPeriod /var/log/scoreboard/postfix.$DOMAINNAME
#  CBandExceededURL http://$DOMAINNAME/cband_error.html
</VirtualHost>
EOF
cp -arf /etc/apache2/sites-available/https_443.conf /etc/apache2/sites-available/https_443.conf-$DATE
cat >> /etc/apache2/sites-available/https_443.conf << EOF
#------------------------------------------------------------------------------------------------------------------------
<VirtualHost _default_:443>
  AddDefaultCharset Big5
  ServerAdmin root@$DOMAINNAME
  DocumentRoot /var/www/mrtg/mailstats
  ServerName postfix.$DOMAINNAME
  DirectoryIndex postfix.html index.html index.php index.htm index.php3
#       <FilesMatch \.php$>
####    From the Apache version 2.4.10 and above, use the SetHandler to run PHP as a fastCGI process server
#            SetHandler "proxy:unix:/run/php/php7.4-fpm.sock|fcgi://localhost"
#       </FilesMatch>
#  CBandSpeed 40960 200 200
#  CBandRemoteSpeed 40960kb/s 100 100
#  CBandLimit 10000Mb
#  CBandPeriod 4W
#  CBandScoreboard /var/log/scoreboard/postfix.$DOMAINNAME
#  CBandScoreFlushPeriod /var/log/scoreboard/postfix.$DOMAINNAME
#  CBandExceededURL https://$DOMAINNAME/cband_error.html
</VirtualHost>
EOF
a2enmod cgi cgid
systemctl enable postfix.service
systemctl enable dovecot.service
systemctl restart postfix.service
systemctl restart dovecot.service
systemctl restart named.service
systemctl restart apache2.service