X-Git-Url: http://git.pld-linux.org/?a=blobdiff_plain;f=exim4.conf;h=0b323e27567fea04deb9793dfe9709c2160b37fb;hb=449bb67fc1a6c088d9f785cabb24edcd9a7dbbe4;hp=656a12582621f48c444a0e662b6b0aafedfe997d;hpb=4fd05b1b3866cc66693a00873c87d41f84e25945;p=packages%2Fexim.git diff --git a/exim4.conf b/exim4.conf index 656a125..0b323e2 100644 --- a/exim4.conf +++ b/exim4.conf @@ -41,6 +41,10 @@ # MAIN CONFIGURATION SETTINGS # ###################################################################### +# Log more information +# log_selector = +all -arguments +log_selector = +smtp_confirmation +queue_time + # Specify your host's canonical name here. This should normally be the fully # qualified "official" name of your host. If this option is not set, the # uname() function is called to obtain the name. In many cases this does @@ -48,6 +52,8 @@ # primary_hostname = +# daemon_smtp_ports = 25 : 465 +# tls_on_connect_ports = 465 # The next three settings create two lists of domains and one list of hosts. # These lists are referred to later in this configuration using the syntax @@ -58,14 +64,11 @@ domainlist local_domains = @ domainlist relay_to_domains = hostlist relay_from_hosts = 127.0.0.1 -# If You wish to enable support for clam antivirus, uncomment the following -# lines here, and search for 'acl' section of this file (look for 'begin acl' -# keyword). This will require clamav package to be installed and configured. -# Other antivirus engines are also supported. Read -# /usr/share/doc/exim-*/exiscan-acl-spec.txt.gz for more info. +# If You wish to enable support for STARTTLS, uncomment folowing lines: -# av_scanner = clamd:/var/lib/clamav/clamd.socket -# acl_smtp_data = acl_check_data +# tls_certificate = /etc/openssl/mail.crt +# tls_privatekey = /etc/openssl/mail.key +# tls_advertise_hosts = * # You can use self-signed cerficates (you will need openssl-tools package): @@ -84,7 +87,7 @@ hostlist relay_from_hosts = 127.0.0.1 # You can use "@" to mean "the name of the local host", as in the default # setting above. This is the name that is specified by primary_hostname, # as specified above (or defaulted). If you do not want to do any local -# deliveries, remove the "@" rom the setting above. If you want to accept mail +# deliveries, remove the "@" from the setting above. If you want to accept mail # addressed to your host's literal IP address, for example, mail addressed to # "user@[192.168.23.44]", you can add "@[]" as an item in the local domains # list. You also need to uncomment "allow_domain_literals" below. This is not @@ -122,10 +125,30 @@ acl_smtp_rcpt = acl_check_rcpt # You should not change that setting until you understand how ACLs work. +# The following ACL entries are used if you want to do content scanning with +# the exiscan-acl patch. When you uncomment one of these lines, you must also +# review the respective entries in the ACL section further below. + +# acl_smtp_mime = acl_check_mime +# acl_smtp_data = acl_check_content + +# This configuration variable defines the virus scanner that is used with +# the 'malware' ACL condition of the exiscan acl-patch. If you do not use +# virus scanning, leave it commented. Please read doc/exiscan-acl-readme.txt +# for a list of supported scanners. + +# av_scanner = sophie:/var/run/sophie + +# The following setting is only needed if you use the 'spam' ACL condition +# of the exiscan-acl patch. It specifies on which host and port the SpamAssassin +# "spamd" daemon is listening. If you do not use this condition, or you use +# the default of "127.0.0.1 783", you can omit this option. + +# spamd_address = 127.0.0.1 783 # Specify the domain you want to be added to all unqualified addresses # here. An unqualified address is one that does not contain an "@" character -# followed by a domain. For example, "caesar@rome.ex" is a fully qualified +# followed by a domain. For example, "caesar@rome.example" is a fully qualified # address, but the string "caesar" (i.e. just a login name) is an unqualified # email address. Unqualified addresses are accepted only from local callers by # default. See the recipient_unqualified_hosts option if you want to permit @@ -156,11 +179,17 @@ acl_smtp_rcpt = acl_check_rcpt # No deliveries will ever be run under the uids of these users (a colon- # separated list). An attempt to do so causes a panic error to be logged, and -# the delivery to be deferred. This is a paranoic safety catch. Note that the -# default setting means you cannot deliver mail addressed to root as if it -# were a normal user. This isn't usually a problem, as most sites have an alias -# for root that redirects such mail to a human administrator. - +# the delivery to be deferred. This is a paranoic safety catch. There is an +# even stronger safety catch in the form of the FIXED_NEVER_USERS setting +# in the configuration for building Exim. The list of users that it specifies +# is built into the binary, and cannot be changed. The option below just adds +# additional users to the list. The default for FIXED_NEVER_USERS is "root", +# but just to be absolutely sure, the default here is also "root". + +# Note that the default setting means you cannot deliver mail addressed to root +# as if it were a normal user. This isn't usually a problem, as most sites have +# an alias for root that redirects such mail to a human administrator. + never_users = root @@ -171,18 +200,21 @@ never_users = root host_lookup = * +# Advertise DSN for these hosts + +dsn_advertise_hosts = * -# The settings below, which are actually the same as the defaults in the -# code, cause Exim to make RFC 1413 (ident) callbacks for all incoming SMTP -# calls. You can limit the hosts to which these calls are made, and/or change -# the timeout that is used. If you set the timeout to zero, all RFC 1413 calls +# The settings below (default is 30s) cause Exim to make RFC 1413 (ident) +# callbacks for all incoming SMTP calls. You can limit the hosts to which +# these calls are made, and/or change # the timeout that is used. +# If you set the timeout to zero, all RFC 1413 calls # are disabled. RFC 1413 calls are cheap and can provide useful information # for tracing problem messages, but some hosts and firewalls have problems # with them. This can result in a timeout instead of an immediate refused # connection, leading to delays on starting up an SMTP session. rfc1413_hosts = * -rfc1413_query_timeout = 30s +rfc1413_query_timeout = 3s # By default, Exim expects all envelope addresses to be fully qualified, that @@ -235,33 +267,6 @@ timeout_frozen_after = 7d begin acl -# This access control list is used for every message after DATA command in -# incoming SMTP connection. It's used mainly for malware (viruses) scanning. -# Uncomment it, 'av_scanner' and 'acl_smtp_data' to enable support for -# antivirus software. Read /usr/share/doc/exim-*/exiscan-acl-spec.txt.gz -# for detailed instructions. Also remember to change 'mysecret' to -# something else. This will add cryptographic "checks done" header that -# will prevent re-scanning when the message re-visits one of your mail -# servers, and the body size did not change. - -# acl_check_data: -# -# accept condition = ${if eq {${hmac{md5}{mysecret}{$body_linecount}}}{$h_X-Scan-Signature:} {1}{0}} -# -# deny message = $found_extension files are not accepted here -# demime = com:vbs:bat:pif:scr -# -# warn message = X-MIME-Warning: Serious MIME defect detected ($demime_reason) -# demime = * -# condition = ${if >{$demime_errorlevel}{2}{1}{0}} -# -# deny message = Virus found :$malware_name -# malware = * -# -# warn message = X-Scan-Signature: ${hmac{md5}{mysecret}{$body_linecount}} -# -# accept - # This access control list is used for every RCPT command in an incoming # SMTP message. The tests are run in order until the address is either # accepted or denied. @@ -273,11 +278,47 @@ acl_check_rcpt: accept hosts = : - # Deny if the local part contains @ or % or / or | or !. These are rarely - # found in genuine local parts, but are often tried by people looking to - # circumvent relaying restrictions. + ############################################################################# + # The following section of the ACL is concerned with local parts that contain + # @ or % or ! or / or | or dots in unusual places. + # + # The characters other than dots are rarely found in genuine local parts, but + # are often tried by people looking to circumvent relaying restrictions. + # Therefore, although they are valid in local parts, these rules lock them + # out, as a precaution. + # + # Empty components (two dots in a row) are not valid in RFC 2822, but Exim + # allows them because they have been encountered. (Consider local parts + # constructed as "firstinitial.secondinitial.familyname" when applied to + # someone like me, who has no second initial.) However, a local part starting + # with a dot or containing /../ can cause trouble if it is used as part of a + # file name (e.g. for a mailing list). This is also true for local parts that + # contain slashes. A pipe symbol can also be troublesome if the local part is + # incorporated unthinkingly into a shell command line. + # + # Two different rules are used. The first one is stricter, and is applied to + # messages that are addressed to one of the local domains handled by this + # host. It blocks local parts that begin with a dot or contain @ % ! / or |. + # If you have local accounts that include these characters, you will have to + # modify this rule. - deny local_parts = ^.*[@%!/|] + deny message = Restricted characters in address + domains = +local_domains + local_parts = ^[.] : ^.*[@%!|] + + # The second rule applies to all other domains, and is less strict. This + # allows your own users to send outgoing messages to sites that use slashes + # and vertical bars in their local parts. It blocks local parts that begin + # with a dot, slash, or vertical bar, but allows these characters within the + # local part. However, the sequence /../ is barred. The use of @ % and ! is + # blocked, as before. The motivation here is to prevent your users (or + # your users' viruses) from mounting certain kinds of attack on remote sites. + + + deny message = Restricted characters in address + domains = !+local_domains + local_parts = ^[.|] : ^.*[@%!] : ^.*/\\.\\./ + ############################################################################# # Accept mail to postmaster in any local domain, regardless of the source, # and without verifying the sender. @@ -310,7 +351,6 @@ acl_check_rcpt: accept domains = +local_domains endpass - message = unknown user verify = recipient # Accept if the address is in a domain for which we are relaying, but again, @@ -318,9 +358,7 @@ acl_check_rcpt: accept domains = +relay_to_domains endpass - message = unrouteable address verify = recipient - # If control reaches this point, the domain is neither in +local_domains # nor in +relay_to_domains. @@ -343,6 +381,55 @@ acl_check_rcpt: deny message = relay not permitted +# These access control lists are used for content scanning with the exiscan-acl +# patch. You must also uncomment the entries for acl_smtp_data and acl_smtp_mime +# (scroll up), otherwise the ACLs will not be used. IMPORTANT: the default entries here +# should be treated as EXAMPLES. You MUST read the file doc/exiscan-acl-spec.txt +# to fully understand what you are doing ... + +acl_check_mime: + + # Decode MIME parts to disk. This will support virus scanners later. + warn decode = default + + # File extension filtering. + deny message = Blacklisted file extension detected + condition = ${if match \ + {${lc:$mime_filename}} \ + {\N(\.exe|\.pif|\.bat|\.scr|\.lnk|\.com)$\N} \ + {1}{0}} + + # Reject messages that carry chinese character sets. + # WARNING: This is an EXAMPLE. + deny message = Sorry, noone speaks chinese here + condition = ${if eq{$mime_charset}{gb2312}{1}{0}} + + accept + +acl_check_content: + + # Reject virus infested messages. + deny message = This message contains malware ($malware_name) + malware = * + + # Always add X-Spam-Score and X-Spam-Report headers, using SA system-wide settings + # (user "nobody"), no matter if over threshold or not. + warn message = X-Spam-Score: $spam_score ($spam_bar) + spam = nobody:true + warn message = X-Spam-Report: $spam_report + spam = nobody:true + + # Add X-Spam-Flag if spam is over system-wide threshold + warn message = X-Spam-Flag: YES + spam = nobody + + # Reject spam messages with score over 10, using an extra condition. + deny message = This message scored $spam_score points. Congratulations! + spam = nobody:true + condition = ${if >{$spam_score_int}{100}{1}{0}} + + # finally accept all the rest + accept ###################################################################### @@ -366,29 +453,37 @@ begin routers # domain_literal: # driver = ipliteral +# domains = ! +local_domains # transport = remote_smtp # This router routes addresses that are not in local domains by doing a DNS -# lookup on the domain name. Any domain that resolves to a loopback interface -# address (127.0.0.0/8) is treated as if it had no DNS entry. If the DNS -# lookup fails, no further routers are tried because of the no_more setting, -# and consequently the address is unrouteable. +# lookup on the domain name. Any domain that resolves to 0.0.0.0 or to a +# loopback interface address (127.0.0.0/8) is treated as if it had no DNS +# entry. Note that 0.0.0.0 is the same as 0.0.0.0/32, which is commonly treated +# as the local host inside the network stack. It is not 0.0.0.0/0, the default +# route. If the DNS lookup fails, no further routers are tried because of +# the no_more setting, and consequently the address is unrouteable. dnslookup: driver = dnslookup domains = ! +local_domains transport = remote_smtp - ignore_target_hosts = 127.0.0.0/8 + ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8 no_more # The remaining routers handle addresses in the local domain(s). -# This router handles aliasing using a traditional /etc/mail/aliases file. +# This router handles aliasing using a linearly searched alias file with the +# name /etc/mail/aliases. When this configuration is installed automatically, +# the name gets inserted into this file from whatever is set in Exim's +# build-time configuration. The default path is the traditional /etc/aliases. +# If you install this configuration by hand, you need to specify the correct +# path in the "data" setting below. # -##### NB You must ensure that /etc/mail/aliases exists. It used to be the case +##### NB You must ensure that the alias file exists. It used to be the case ##### NB that every Unix had that file, because it was the Sendmail default. ##### NB These days, there are systems that don't have it. Your aliases ##### NB file should at least contain an alias for "postmaster". @@ -413,8 +508,14 @@ system_aliases: # This router handles forwarding using traditional .forward files in users' # home directories. If you want it also to allow mail filtering when a forward -# file starts with the string "# Exim filter", uncomment the "allow_filter" -# option. +# file starts with the string "# Exim filter" or "# Sieve filter", uncomment +# the "allow_filter" option. + +# If you want this router to treat local parts with suffixes introduced by "-" +# or "+" characters as if the suffixes did not exist, uncomment the two local_ +# part_suffix options. Then, for example, xxxx-foo@your.domain will be treated +# in the same way as xxxx@your.domain by this router. You probably want to make +# the same change to the localuser router. # The no_verify setting means that this router is skipped when Exim is # verifying addresses. Similarly, no_expn means that this router is skipped if @@ -432,11 +533,13 @@ system_aliases: userforward: driver = redirect check_local_user +# local_part_suffix = +* : -* +# local_part_suffix_optional file = $home/.forward +# allow_filter no_verify no_expn check_ancestor -# allow_filter file_transport = address_file pipe_transport = address_pipe reply_transport = address_reply @@ -452,14 +555,22 @@ userforward: # +/usr/bin/procmail:!${home}/.forward" # transport = procmail_pipe -# This router matches local user mailboxes. +# This router matches local user mailboxes. If the router fails, the error +# message is "Unknown user". + +# If you want this router to treat local parts with suffixes introduced by "-" +# or "+" characters as if the suffixes did not exist, uncomment the two local_ +# part_suffix options. Then, for example, xxxx-foo@your.domain will be treated +# in the same way as xxxx@your.domain by this router. localuser: driver = accept check_local_user +# local_part_suffix = +* : -* +# local_part_suffix_optional transport = local_delivery - - + cannot_route_message = Unknown user + ###################################################################### # TRANSPORTS CONFIGURATION #