feat(mail): fleet mail-env audit + map; PMG VIP proposal [#696][#694]

Audit findings note (55/64 systems, read-only): https://projects.knownelement.com/issues/696#note-4088 Map + deploy plan: https://community.turnsys.com/t/322 Key: relayhost empty fleet-wide (direct-to-MX today); prod PMG pair already installed (VM 604/711, PMG 9.1, unclustered); VIP slot proposed 192.168.3.249; open PQs in questions-v8.md.
2026-09-03 12:49:59 -05:00
parent 7ca87c1200
commit d3b9099d5f
5 changed files with 309 additions and 0 deletions
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# audit-mail-env.sh — read-only mail environment probe.
+#
+# Runs ON the target host, delivered via the ssh chokepoints:
+#   tests/remote.sh prox-file|vm-file   OR   remote-dns.sh <host>-file
+# Collects: installed MTAs, postfix relay config, alternative relay configs
+# (ssmtp/msmtp/nullmailer/dma), identity (mailname/aliases/forward),
+# smtp listeners, and recent relay evidence from mail logs.
+# Makes NO changes. Redacts auth material. Output is "KEY value" text.
+set -u
+
+as_root() {
+  if [ "$(id -u)" -eq 0 ]; then
+    "$@"
+  else
+    if sudo -n "$@" 2>/dev/null; then
+      :
+    else
+      "$@"
+    fi
+  fi
+}
+
+echo "== host $(hostname -f 2>/dev/null || hostname) | $(date '+%F %T %Z')"
+
+echo "== mtas"
+for b in postconf postfix sendmail exim4 msmtp ssmtp nullmailer-send dma; do
+  p="$(command -v "$b" 2>/dev/null)"
+  if [ -n "${p}" ]; then
+    echo "bin ${b}: ${p}"
+  fi
+done
+
+echo "== postfix"
+if command -v postconf >/dev/null 2>&1; then
+  for k in myhostname myorigin relayhost mydestination inet_interfaces; do
+    v="$(as_root postconf -h "$k" 2>/dev/null)"
+    echo "postconf ${k} = ${v:-<empty>}"
+  done
+else
+  echo "postconf: not installed"
+  grep -Hs '^relayhost' /etc/postfix/main.cf 2>/dev/null
+fi
+
+echo "== alt-relay"
+if [ -r /etc/ssmtp/ssmtp.conf ]; then
+  sed -n -E 's/^(AuthPass|AuthUser)=.*/\1=<redacted>/p; s/^(mailhub|hostname|rewriteDomain|UseSTARTTLS|UseTLS)=/\1=/p' /etc/ssmtp/ssmtp.conf | sed 's/^/ssmtp /'
+fi
+for f in /etc/msmtp.conf /root/.msmtprc "${HOME}/.msmtprc"; do
+  if [ -r "$f" ]; then
+    grep -Es '^(account|host|port|from|auth |tls|syslog)' "$f" | sed "s|^|msmtp ${f} |"
+  fi
+done
+for f in /etc/nullmailer/remotes /var/spool/nullmailer/remotes; do
+  if [ -r "$f" ]; then
+    sed -E 's/ --[^ ]*//g' "$f" | sed 's/^/nullmailer-remote /'
+  fi
+done
+if [ -r /etc/dma/dma.conf ]; then
+  grep -Es '^(SMARTHOST|PORT|MAILNAME)' /etc/dma/dma.conf | sed 's/^/dma /'
+fi
+
+echo "== identity"
+if [ -r /etc/mailname ]; then
+  echo "mailname: $(cat /etc/mailname)"
+fi
+grep -hsE '^root:' /etc/aliases /etc/mail/aliases 2>/dev/null | sed 's/^/alias /'
+if [ -r /root/.forward ]; then
+  echo "root-forward: $(head -1 /root/.forward)"
+fi
+
+echo "== listeners-25-465-587"
+as_root ss -ltn 2>/dev/null | awk 'NR==1 || $4 ~ /:(25|465|587|2525)$/'
+
+echo "== recent-relay-evidence"
+as_root sh -c 'grep -h "relay=" /var/log/mail.log /var/log/mail.log.1 /var/log/maillog 2>/dev/null | tail -n 6'
+
+echo "== done $(hostname -f 2>/dev/null || hostname)"