MAIEREDV/SMTPGraphRelay
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Test-SMTPGraphRelay.ps1 gelöscht

Browse Source
This commit is contained in:
manuel.maier
2026-08-14 00:14:03 +02:00
parent 2708a40397
commit a1771adf0f
1 changed files with 0 additions and 589 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Test-SMTPGraphRelay.ps1
-589
View File
@@ -1,589 +0,0 @@
#Requires -Version 5.1
<#
.SYNOPSIS
Health Check für SMTPGraphRelay.
.DESCRIPTION
Prüft die lokale SMTPGraphRelay-Installation ohne Änderungen vorzunehmen.
Standardprüfungen:
- Windows PowerShell 5.1
- Administratorstatus
- config.json
- Microsoft.Graph.Authentication Modul
- Zertifikat + Private Key + Ablaufdatum
- Verzeichnisse und Schreibrechte
- Scheduled Task
- SMTP Listener
- Queue / Failed Queue
- App-only Microsoft Graph Anmeldung
Optional:
- echte SMTP-Testmail über das lokale Relay
.EXAMPLE
.\Test-SMTPGraphRelay.ps1
.EXAMPLE
.\Test-SMTPGraphRelay.ps1 -SendTestMail -TestRecipient manuel.maier@maieredv.de
#>
[CmdletBinding()]
param(
[string]$ConfigPath = "$PSScriptRoot\config.json",
[switch]$SendTestMail,
[string]$TestRecipient,
[int]$QueueWarningAgeMinutes = 30,
[int]$FailedWarningCount = 1
)
$ErrorActionPreference = "Stop"
[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
$script:OkCount = 0
$script:WarnCount = 0
$script:FailCount = 0
function Write-Result {
param(
[Parameter(Mandatory)]
[ValidateSet("OK","WARN","FAIL","INFO")]
[string]$Status,
[Parameter(Mandatory)]
[string]$Message
)
switch ($Status) {
"OK" {
$script:OkCount++
Write-Host "[OK] $Message" -ForegroundColor Green
}
"WARN" {
$script:WarnCount++
Write-Host "[WARN] $Message" -ForegroundColor Yellow
}
"FAIL" {
$script:FailCount++
Write-Host "[FAIL] $Message" -ForegroundColor Red
}
"INFO" {
Write-Host "[INFO] $Message" -ForegroundColor Cyan
}
}
}
function Resolve-ConfigPath {
param([Parameter(Mandatory)][string]$Path)
if ([IO.Path]::IsPathRooted($Path)) {
return $Path
}
return Join-Path $PSScriptRoot $Path
}
function Test-IsAdministrator {
try {
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = New-Object Security.Principal.WindowsPrincipal($identity)
return $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
}
catch {
return $false
}
}
function Test-DirectoryWritable {
param([Parameter(Mandatory)][string]$Path)
try {
if (-not (Test-Path -LiteralPath $Path)) {
return $false
}
$testFile = Join-Path $Path (".healthcheck-{0}.tmp" -f [guid]::NewGuid().ToString("N"))
[IO.File]::WriteAllText($testFile, "SMTPGraphRelay health check")
Remove-Item -LiteralPath $testFile -Force
return $true
}
catch {
return $false
}
}
function Send-RawSmtpTestMail {
param(
[Parameter(Mandatory)][string]$Server,
[Parameter(Mandatory)][int]$Port,
[Parameter(Mandatory)][string]$From,
[Parameter(Mandatory)][string]$To
)
$client = New-Object System.Net.Sockets.TcpClient
try {
$connect = $client.BeginConnect($Server, $Port, $null, $null)
if (-not $connect.AsyncWaitHandle.WaitOne(5000)) {
throw "Timeout beim Verbindungsaufbau zu $Server`:$Port"
}
$client.EndConnect($connect)
$stream = $client.GetStream()
$stream.ReadTimeout = 5000
$stream.WriteTimeout = 5000
$reader = New-Object System.IO.StreamReader($stream, [System.Text.Encoding]::ASCII)
$writer = New-Object System.IO.StreamWriter($stream, [System.Text.Encoding]::ASCII)
$writer.NewLine = "`r`n"
$writer.AutoFlush = $true
function Read-SmtpResponse {
param([int[]]$ExpectedCodes)
$lines = New-Object System.Collections.Generic.List[string]
while ($true) {
$line = $reader.ReadLine()
if ($null -eq $line) {
throw "SMTP-Verbindung unerwartet geschlossen."
}
$lines.Add($line)
if ($line -match '^(\d{3})([ -])') {
$code = [int]$matches[1]
$separator = $matches[2]
if ($separator -eq " ") {
if ($ExpectedCodes -notcontains $code) {
throw "Unerwartete SMTP-Antwort: $($lines -join ' | ')"
}
return ($lines -join " | ")
}
}
}
}
[void](Read-SmtpResponse -ExpectedCodes @(220))
$writer.WriteLine("EHLO localhost")
[void](Read-SmtpResponse -ExpectedCodes @(250))
$writer.WriteLine("MAIL FROM:<$From>")
[void](Read-SmtpResponse -ExpectedCodes @(250))
$writer.WriteLine("RCPT TO:<$To>")
[void](Read-SmtpResponse -ExpectedCodes @(250))
$writer.WriteLine("DATA")
[void](Read-SmtpResponse -ExpectedCodes @(354))
$subject = "SMTPGraphRelay Health Check $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
$writer.WriteLine("From: <$From>")
$writer.WriteLine("To: <$To>")
$writer.WriteLine("Subject: $subject")
$writer.WriteLine("Date: $([DateTime]::Now.ToString('ddd, dd MMM yyyy HH:mm:ss zzz', [Globalization.CultureInfo]::InvariantCulture))")
$writer.WriteLine("Message-ID: <$([guid]::NewGuid().ToString('N'))@smtpgraphrelay-healthcheck>")
$writer.WriteLine("MIME-Version: 1.0")
$writer.WriteLine("Content-Type: text/plain; charset=utf-8")
$writer.WriteLine("")
$writer.WriteLine("SMTPGraphRelay Health Check")
$writer.WriteLine("")
$writer.WriteLine("Zeit: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')")
$writer.WriteLine("Host: $env:COMPUTERNAME")
$writer.WriteLine(".")
[void](Read-SmtpResponse -ExpectedCodes @(250))
$writer.WriteLine("QUIT")
[void](Read-SmtpResponse -ExpectedCodes @(221))
return $true
}
finally {
try { $client.Close() } catch {}
}
}
Write-Host ""
Write-Host "==========================================================" -ForegroundColor Cyan
Write-Host " SMTPGraphRelay - Health Check" -ForegroundColor Cyan
Write-Host "==========================================================" -ForegroundColor Cyan
Write-Host ""
# ---------------------------------------------------------------------------
# PowerShell / Rechte
# ---------------------------------------------------------------------------
if ($PSVersionTable.PSEdition -eq "Desktop" -and $PSVersionTable.PSVersion.Major -eq 5) {
Write-Result OK "Windows PowerShell $($PSVersionTable.PSVersion) erkannt."
}
else {
Write-Result FAIL "Dieses Tool sollte mit Windows PowerShell 5.1 laufen. Erkannt: $($PSVersionTable.PSEdition) $($PSVersionTable.PSVersion)"
}
if (Test-IsAdministrator) {
Write-Result OK "PowerShell läuft als Administrator."
}
else {
Write-Result WARN "PowerShell läuft nicht als Administrator. Einige Prüfungen können eingeschränkt sein."
}
# ---------------------------------------------------------------------------
# Config
# ---------------------------------------------------------------------------
if (-not (Test-Path -LiteralPath $ConfigPath)) {
Write-Result FAIL "config.json nicht gefunden: $ConfigPath"
Write-Host ""
Write-Host "Health Check abgebrochen, da ohne Config keine weiteren Prüfungen möglich sind." -ForegroundColor Red
exit 2
}
try {
$config = Get-Content -LiteralPath $ConfigPath -Raw -Encoding UTF8 | ConvertFrom-Json
Write-Result OK "config.json konnte gelesen und geparst werden."
}
catch {
Write-Result FAIL "config.json ist ungültig: $($_.Exception.Message)"
exit 2
}
$requiredConfig = @(
"Smtp.ListenAddress",
"Smtp.Port",
"Graph.TenantId",
"Graph.ClientId",
"Graph.CertificateThumbprint",
"Graph.SenderMailbox",
"Paths.Queue",
"Paths.Failed",
"Paths.Logs"
)
$configMissing = $false
foreach ($item in $requiredConfig) {
$parts = $item -split '\.'
$value = $config
foreach ($part in $parts) {
if ($null -eq $value -or -not ($value.PSObject.Properties.Name -contains $part)) {
$value = $null
break
}
$value = $value.$part
}
if ($null -eq $value -or ([string]$value).Trim().Length -eq 0) {
Write-Result FAIL "Config-Wert fehlt: $item"
$configMissing = $true
}
}
if (-not $configMissing) {
Write-Result OK "Alle erforderlichen Config-Werte sind vorhanden."
}
# ---------------------------------------------------------------------------
# Module
# ---------------------------------------------------------------------------
$graphModule = Get-Module -ListAvailable -Name Microsoft.Graph.Authentication |
Sort-Object Version -Descending |
Select-Object -First 1
if ($graphModule) {
Write-Result OK "Microsoft.Graph.Authentication $($graphModule.Version) gefunden: $($graphModule.ModuleBase)"
}
else {
Write-Result FAIL "Microsoft.Graph.Authentication ist nicht installiert."
}
# ---------------------------------------------------------------------------
# Zertifikat
# ---------------------------------------------------------------------------
$cert = $null
$certPath = "Cert:\LocalMachine\My\$($config.Graph.CertificateThumbprint)"
try {
$cert = Get-Item -LiteralPath $certPath -ErrorAction Stop
Write-Result OK "Relay-Zertifikat gefunden: $($cert.Thumbprint)"
if ($cert.HasPrivateKey) {
Write-Result OK "Zertifikat besitzt einen privaten Schlüssel."
}
else {
Write-Result FAIL "Zertifikat besitzt keinen privaten Schlüssel."
}
$daysRemaining = [Math]::Floor(($cert.NotAfter.ToUniversalTime() - [DateTime]::UtcNow).TotalDays)
if ($daysRemaining -lt 0) {
Write-Result FAIL "Zertifikat ist abgelaufen seit $($cert.NotAfter)."
}
elseif ($daysRemaining -le 14) {
Write-Result FAIL "Zertifikat läuft in $daysRemaining Tagen ab ($($cert.NotAfter))."
}
elseif ($daysRemaining -le 60) {
Write-Result WARN "Zertifikat läuft in $daysRemaining Tagen ab ($($cert.NotAfter))."
}
else {
Write-Result OK "Zertifikat gültig bis $($cert.NotAfter) ($daysRemaining Tage verbleibend)."
}
}
catch {
Write-Result FAIL "Relay-Zertifikat nicht gefunden oder nicht lesbar: $($_.Exception.Message)"
}
# ---------------------------------------------------------------------------
# Pfade / Queue
# ---------------------------------------------------------------------------
$queueRoot = Resolve-ConfigPath $config.Paths.Queue
$failedDir = Resolve-ConfigPath $config.Paths.Failed
$logsDir = Resolve-ConfigPath $config.Paths.Logs
$queueIncoming = Join-Path $queueRoot "incoming"
$queuePending = Join-Path $queueRoot "pending"
$queueProcessing = Join-Path $queueRoot "processing"
foreach ($entry in @(
@{ Name = "Queue Root"; Path = $queueRoot },
@{ Name = "Queue incoming"; Path = $queueIncoming },
@{ Name = "Queue pending"; Path = $queuePending },
@{ Name = "Queue processing"; Path = $queueProcessing },
@{ Name = "Failed"; Path = $failedDir },
@{ Name = "Logs"; Path = $logsDir }
)) {
if (Test-Path -LiteralPath $entry.Path) {
if (Test-DirectoryWritable -Path $entry.Path) {
Write-Result OK "$($entry.Name) vorhanden und beschreibbar: $($entry.Path)"
}
else {
Write-Result FAIL "$($entry.Name) vorhanden, aber nicht beschreibbar: $($entry.Path)"
}
}
else {
Write-Result WARN "$($entry.Name) fehlt: $($entry.Path)"
}
}
$pendingFiles = @()
$processingFiles = @()
$failedFiles = @()
if (Test-Path -LiteralPath $queuePending) {
$pendingFiles = @(Get-ChildItem -LiteralPath $queuePending -Filter "*.eml" -File -ErrorAction SilentlyContinue)
}
if (Test-Path -LiteralPath $queueProcessing) {
$processingFiles = @(Get-ChildItem -LiteralPath $queueProcessing -Filter "*.eml" -File -ErrorAction SilentlyContinue)
}
if (Test-Path -LiteralPath $failedDir) {
$failedFiles = @(Get-ChildItem -LiteralPath $failedDir -Filter "*.eml" -File -ErrorAction SilentlyContinue)
}
if ($pendingFiles.Count -eq 0) {
Write-Result OK "Pending Queue ist leer."
}
else {
$oldestPending = $pendingFiles | Sort-Object LastWriteTime | Select-Object -First 1
$ageMinutes = [Math]::Floor(((Get-Date) - $oldestPending.LastWriteTime).TotalMinutes)
if ($ageMinutes -ge $QueueWarningAgeMinutes) {
Write-Result WARN "$($pendingFiles.Count) Mail(s) in pending; älteste ist $ageMinutes Minuten alt."
}
else {
Write-Result INFO "$($pendingFiles.Count) Mail(s) in pending; älteste ist $ageMinutes Minuten alt."
}
}
if ($processingFiles.Count -gt 0) {
Write-Result WARN "$($processingFiles.Count) Mail(s) liegen aktuell in processing."
}
else {
Write-Result OK "Processing Queue ist leer."
}
if ($failedFiles.Count -ge $FailedWarningCount) {
Write-Result WARN "$($failedFiles.Count) Mail(s) liegen in failed."
}
else {
Write-Result OK "Failed Queue enthält $($failedFiles.Count) Mail(s)."
}
# ---------------------------------------------------------------------------
# Scheduled Task
# ---------------------------------------------------------------------------
$task = Get-ScheduledTask -TaskName "SMTPGraphRelay" -ErrorAction SilentlyContinue
if ($task) {
Write-Result OK "Scheduled Task 'SMTPGraphRelay' vorhanden."
$taskInfo = Get-ScheduledTaskInfo -TaskName "SMTPGraphRelay"
if ($task.State -eq "Running") {
Write-Result OK "Scheduled Task läuft."
}
else {
Write-Result WARN "Scheduled Task State: $($task.State)"
}
if ($taskInfo.LastTaskResult -eq 0 -or $taskInfo.LastTaskResult -eq 267009) {
Write-Result OK "LastTaskResult: $($taskInfo.LastTaskResult)"
}
else {
Write-Result WARN "LastTaskResult: $($taskInfo.LastTaskResult)"
}
$action = $task.Actions | Select-Object -First 1
if ($action.Execute -match 'WindowsPowerShell\\v1\.0\\powershell\.exe$') {
Write-Result OK "Scheduled Task verwendet Windows PowerShell 5.1."
}
else {
Write-Result WARN "Scheduled Task verwendet unerwartetes PowerShell-Binary: $($action.Execute)"
}
}
else {
Write-Result FAIL "Scheduled Task 'SMTPGraphRelay' wurde nicht gefunden."
}
# ---------------------------------------------------------------------------
# SMTP Listener
# ---------------------------------------------------------------------------
$listenPort = [int]$config.Smtp.Port
try {
$listeners = @(Get-NetTCPConnection -LocalPort $listenPort -State Listen -ErrorAction Stop)
if ($listeners.Count -gt 0) {
$owners = @($listeners | Select-Object -ExpandProperty OwningProcess -Unique)
Write-Result OK "SMTP Listener aktiv auf TCP $listenPort (PID: $($owners -join ', '))."
}
else {
Write-Result FAIL "Kein Listener auf TCP $listenPort."
}
}
catch {
# Fallback falls Get-NetTCPConnection nicht verfügbar / eingeschränkt.
try {
$tcp = New-Object System.Net.Sockets.TcpClient
$result = $tcp.BeginConnect("127.0.0.1", $listenPort, $null, $null)
if ($result.AsyncWaitHandle.WaitOne(2000)) {
$tcp.EndConnect($result)
Write-Result OK "SMTP Listener auf 127.0.0.1:$listenPort erreichbar."
}
else {
Write-Result FAIL "SMTP Listener auf 127.0.0.1:$listenPort nicht erreichbar."
}
$tcp.Close()
}
catch {
Write-Result FAIL "SMTP Listener auf TCP $listenPort nicht erreichbar."
}
}
# ---------------------------------------------------------------------------
# Graph App-only Auth
# ---------------------------------------------------------------------------
if ($graphModule -and $cert -and $cert.HasPrivateKey) {
try {
Import-Module Microsoft.Graph.Authentication -ErrorAction Stop
Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
Connect-MgGraph `
-TenantId $config.Graph.TenantId `
-ClientId $config.Graph.ClientId `
-Certificate $cert `
-NoWelcome | Out-Null
$ctx = Get-MgContext
if ($ctx -and
$ctx.AuthType -eq "AppOnly" -and
$ctx.ClientId -eq $config.Graph.ClientId -and
$ctx.TenantId -eq $config.Graph.TenantId) {
Write-Result OK "Microsoft Graph App-only Anmeldung erfolgreich."
}
else {
Write-Result FAIL "Graph-Verbindung vorhanden, aber Kontext entspricht nicht der Relay-App."
}
}
catch {
Write-Result FAIL "Microsoft Graph App-only Anmeldung fehlgeschlagen: $($_.Exception.Message)"
}
finally {
Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
}
}
else {
Write-Result WARN "Graph App-only Test übersprungen, da Modul/Zertifikat/Private Key nicht vollständig verfügbar sind."
}
# ---------------------------------------------------------------------------
# Optionale echte SMTP-Testmail
# ---------------------------------------------------------------------------
if ($SendTestMail) {
if ([string]::IsNullOrWhiteSpace($TestRecipient)) {
Write-Result FAIL "-SendTestMail wurde angegeben, aber -TestRecipient fehlt."
}
else {
try {
$testFrom = [string]$config.Graph.SenderMailbox
Write-Result INFO "Sende SMTP-Testmail über 127.0.0.1:$listenPort an $TestRecipient ..."
[void](Send-RawSmtpTestMail `
-Server "127.0.0.1" `
-Port $listenPort `
-From $testFrom `
-To $TestRecipient)
Write-Result OK "SMTP-Testmail wurde vom Relay mit 250 Queued angenommen."
Write-Result INFO "Die endgültige Graph-/M365-Zustellung bitte im Relay-Log bzw. Empfängerpostfach prüfen."
}
catch {
Write-Result FAIL "SMTP-Testmail fehlgeschlagen: $($_.Exception.Message)"
}
}
}
# ---------------------------------------------------------------------------
# Zusammenfassung
# ---------------------------------------------------------------------------
Write-Host ""
Write-Host "==========================================================" -ForegroundColor Cyan
Write-Host " Ergebnis" -ForegroundColor Cyan
Write-Host "==========================================================" -ForegroundColor Cyan
Write-Host ""
Write-Host (" OK: {0}" -f $script:OkCount) -ForegroundColor Green
Write-Host (" WARN: {0}" -f $script:WarnCount) -ForegroundColor Yellow
Write-Host (" FAIL: {0}" -f $script:FailCount) -ForegroundColor Red
Write-Host ""
if ($script:FailCount -gt 0) {
Write-Host "Gesamtstatus: FEHLER" -ForegroundColor Red
exit 2
}
elseif ($script:WarnCount -gt 0) {
Write-Host "Gesamtstatus: WARNUNG" -ForegroundColor Yellow
exit 1
}
else {
Write-Host "Gesamtstatus: OK" -ForegroundColor Green
exit 0
}