147 lines
3.9 KiB
Bash
Executable File
147 lines
3.9 KiB
Bash
Executable File
#!/bin/bash
|
||
|
||
|
||
|
||
|
||
# Vérifier si le script est exécuté en root
|
||
if [[ $EUID -ne 0 ]]; then
|
||
echo "❌ Ce script doit être exécuté en tant que root."
|
||
exit 1
|
||
fi
|
||
|
||
|
||
|
||
echo "=== Mise à jour du système ==="
|
||
apt update && apt upgrade -y
|
||
|
||
echo "=== Installation de Postfix, Dovecot et outils nécessaires ==="
|
||
apt install -y postfix dovecot-core dovecot-imapd dovecot-pop3d dovecot-lmtpd dovecot-sieve certbot curl dnsutils
|
||
|
||
# Récupérer le nom d’hôte complet (FQDN)
|
||
FQDN=$(hostname -f)
|
||
|
||
# Vérifier si le FQDN est vide
|
||
if [[ -z "$FQDN" ]]; then
|
||
FQDN=$(cat /etc/hostname)
|
||
fi
|
||
|
||
# Extraire le domaine principal (ex: mail.acemail.fr -> acemail.fr)
|
||
DOMAIN=$(echo "$FQDN" | sed -E 's/^[^.]+\.//')
|
||
|
||
echo "🔍 Serveur détecté : $FQDN"
|
||
echo "🌐 Domaine géré pour les emails : $DOMAIN"
|
||
|
||
|
||
# Récupération des IP (IPv4 et IPv6)
|
||
SERVER_IP=$(curl -4 -s ifconfig.me || hostname -I | awk '{print $1}')
|
||
SERVER_IPv6=$(curl -6 -s ifconfig.me || hostname -I | awk '{print $2}')
|
||
FQDN_IP=$(dig +short A "$FQDN" | tail -n1)
|
||
FQDN_IPv6=$(dig +short AAAA "$FQDN" | tail -n1)
|
||
|
||
echo "🌍 IP publique du serveur : $SERVER_IP (IPv4), $SERVER_IPv6 (IPv6)"
|
||
echo "🔎 IP DNS du serveur : $FQDN_IP (IPv4), $FQDN_IPv6 (IPv6)"
|
||
|
||
|
||
# Vérification du DNS
|
||
if [[ -z "$FQDN_IP" ]]; then
|
||
echo "❌ Impossible de récupérer l'IP du serveur ($FQDN)."
|
||
echo "🔹 Vérifie la configuration DNS et assure-toi que le nom de serveur pointe bien vers ce serveur."
|
||
exit 1
|
||
fi
|
||
|
||
if [[ "$SERVER_IP" != "$FQDN_IP" ]]; then
|
||
echo "⚠️ Problème DNS : L'IP du serveur ($FQDN_IP) ne correspond pas à l'IP du serveur ($SERVER_IP)."
|
||
echo "🔹 Corrige l'entrée DNS ou attends sa propagation avant de continuer."
|
||
exit 1
|
||
fi
|
||
|
||
echo "✅ DNS correct : $FQDN pointe bien vers $SERVER_IP"
|
||
|
||
|
||
# Variables
|
||
MAIL_DIR="/var/mail/vhosts"
|
||
LE_DIR="/etc/letsencrypt/live/$FQDN"
|
||
BACKUP_DIR="/backup/mail"
|
||
|
||
echo "=== Génération du certificat SSL avec Let's Encrypt ==="
|
||
if [[ -f "$LE_DIR/fullchain.pem" ]]; then
|
||
echo "✅ Certificat SSL déjà existant."
|
||
openssl x509 -noout -text -in "$LE_DIR/fullchain.pem" | grep "Not After"
|
||
else
|
||
echo "🔄 Génération d’un nouveau certificat SSL..."
|
||
certbot certonly --standalone -d "$FQDN" --non-interactive --agree-tos --register-unsafely-without-email
|
||
if [[ $? -ne 0 ]]; then
|
||
echo "❌ Erreur lors de la génération du certificat Let's Encrypt."
|
||
exit 1
|
||
fi
|
||
fi
|
||
|
||
|
||
# Création des fichiers de configuration
|
||
mkdir -p "$BACKUP_DIR"
|
||
|
||
echo "=== Configuration de Postfix ==="
|
||
cat > /etc/postfix/main.cf <<EOF
|
||
smtpd_banner = \$myhostname ESMTP
|
||
biff = no
|
||
append_dot_mydomain = no
|
||
readme_directory = no
|
||
myhostname = $FQDN
|
||
myorigin = /etc/mailname
|
||
mydestination = localhost
|
||
relayhost =
|
||
mynetworks = 127.0.0.0/8
|
||
mailbox_size_limit = 0
|
||
recipient_delimiter = +
|
||
inet_interfaces = all
|
||
inet_protocols = ipv4
|
||
|
||
# Sécurisation avec TLS
|
||
smtpd_tls_cert_file=$LE_DIR/fullchain.pem
|
||
smtpd_tls_key_file=$LE_DIR/privkey.pem
|
||
smtpd_use_tls=yes
|
||
smtpd_tls_auth_only = yes
|
||
EOF
|
||
|
||
echo "=== Configuration de Dovecot ==="
|
||
cat > /etc/dovecot/dovecot.conf <<EOF
|
||
disable_plaintext_auth = no
|
||
ssl = required
|
||
ssl_cert = <$LE_DIR/fullchain.pem
|
||
ssl_key = <$LE_DIR/privkey.pem
|
||
mail_location = maildir:$MAIL_DIR/%d/%n
|
||
|
||
protocols = imap pop3 lmtp
|
||
auth_mechanisms = plain login
|
||
|
||
service imap-login {
|
||
inet_listener imap {
|
||
port = 143
|
||
}
|
||
inet_listener imaps {
|
||
port = 993
|
||
ssl = yes
|
||
}
|
||
}
|
||
service pop3-login {
|
||
inet_listener pop3 {
|
||
port = 110
|
||
}
|
||
inet_listener pop3s {
|
||
port = 995
|
||
ssl = yes
|
||
}
|
||
}
|
||
EOF
|
||
|
||
echo "=== Redémarrage des services ==="
|
||
systemctl restart postfix dovecot
|
||
systemctl enable postfix dovecot
|
||
|
||
echo "=== Vérification des ports ouverts ==="
|
||
ss -tulpen | grep -E "postfix|dovecot"
|
||
|
||
echo "=== Ajout d’un cron pour renouveler le certificat ==="
|
||
echo "0 3 * * * certbot renew --quiet && systemctl reload postfix dovecot" > /etc/cron.d/letsencrypt-renew
|
||
|
||
echo "✅ Configuration terminée avec succès !" |