mrcharles
d3b9099d5f
Audit findings note (55/64 systems, read-only): https://projects.knownelement.com/issues/696#note-4088 Map + deploy plan: https://community.turnsys.com/t/322 Key: relayhost empty fleet-wide (direct-to-MX today); prod PMG pair already installed (VM 604/711, PMG 9.1, unclustered); VIP slot proposed 192.168.3.249; open PQs in questions-v8.md.
79 lines
2.4 KiB
Bash
79 lines
2.4 KiB
Bash
#!/usr/bin/env bash
|
|
# audit-mail-env.sh — read-only mail environment probe.
|
|
#
|
|
# Runs ON the target host, delivered via the ssh chokepoints:
|
|
# tests/remote.sh prox-file|vm-file OR remote-dns.sh <host>-file
|
|
# Collects: installed MTAs, postfix relay config, alternative relay configs
|
|
# (ssmtp/msmtp/nullmailer/dma), identity (mailname/aliases/forward),
|
|
# smtp listeners, and recent relay evidence from mail logs.
|
|
# Makes NO changes. Redacts auth material. Output is "KEY value" text.
|
|
set -u
|
|
|
|
as_root() {
|
|
if [ "$(id -u)" -eq 0 ]; then
|
|
"$@"
|
|
else
|
|
if sudo -n "$@" 2>/dev/null; then
|
|
:
|
|
else
|
|
"$@"
|
|
fi
|
|
fi
|
|
}
|
|
|
|
echo "== host $(hostname -f 2>/dev/null || hostname) | $(date '+%F %T %Z')"
|
|
|
|
echo "== mtas"
|
|
for b in postconf postfix sendmail exim4 msmtp ssmtp nullmailer-send dma; do
|
|
p="$(command -v "$b" 2>/dev/null)"
|
|
if [ -n "${p}" ]; then
|
|
echo "bin ${b}: ${p}"
|
|
fi
|
|
done
|
|
|
|
echo "== postfix"
|
|
if command -v postconf >/dev/null 2>&1; then
|
|
for k in myhostname myorigin relayhost mydestination inet_interfaces; do
|
|
v="$(as_root postconf -h "$k" 2>/dev/null)"
|
|
echo "postconf ${k} = ${v:-<empty>}"
|
|
done
|
|
else
|
|
echo "postconf: not installed"
|
|
grep -Hs '^relayhost' /etc/postfix/main.cf 2>/dev/null
|
|
fi
|
|
|
|
echo "== alt-relay"
|
|
if [ -r /etc/ssmtp/ssmtp.conf ]; then
|
|
sed -n -E 's/^(AuthPass|AuthUser)=.*/\1=<redacted>/p; s/^(mailhub|hostname|rewriteDomain|UseSTARTTLS|UseTLS)=/\1=/p' /etc/ssmtp/ssmtp.conf | sed 's/^/ssmtp /'
|
|
fi
|
|
for f in /etc/msmtp.conf /root/.msmtprc "${HOME}/.msmtprc"; do
|
|
if [ -r "$f" ]; then
|
|
grep -Es '^(account|host|port|from|auth |tls|syslog)' "$f" | sed "s|^|msmtp ${f} |"
|
|
fi
|
|
done
|
|
for f in /etc/nullmailer/remotes /var/spool/nullmailer/remotes; do
|
|
if [ -r "$f" ]; then
|
|
sed -E 's/ --[^ ]*//g' "$f" | sed 's/^/nullmailer-remote /'
|
|
fi
|
|
done
|
|
if [ -r /etc/dma/dma.conf ]; then
|
|
grep -Es '^(SMARTHOST|PORT|MAILNAME)' /etc/dma/dma.conf | sed 's/^/dma /'
|
|
fi
|
|
|
|
echo "== identity"
|
|
if [ -r /etc/mailname ]; then
|
|
echo "mailname: $(cat /etc/mailname)"
|
|
fi
|
|
grep -hsE '^root:' /etc/aliases /etc/mail/aliases 2>/dev/null | sed 's/^/alias /'
|
|
if [ -r /root/.forward ]; then
|
|
echo "root-forward: $(head -1 /root/.forward)"
|
|
fi
|
|
|
|
echo "== listeners-25-465-587"
|
|
as_root ss -ltn 2>/dev/null | awk 'NR==1 || $4 ~ /:(25|465|587|2525)$/'
|
|
|
|
echo "== recent-relay-evidence"
|
|
as_root sh -c 'grep -h "relay=" /var/log/mail.log /var/log/mail.log.1 /var/log/maillog 2>/dev/null | tail -n 6'
|
|
|
|
echo "== done $(hostname -f 2>/dev/null || hostname)"
|