X-Git-Url: http://git.pld-linux.org/?a=blobdiff_plain;f=exim4.conf;h=a4630484d764fcd14a62169a7efc67b87a710930;hb=b8bf635f1debb1e55e732603b79b2a843c650294;hp=4d37332ac4705d21cd4def96ee2b75149086f09d;hpb=a59efb337fc01302aa1032d8e6a21c8bd48e2c7a;p=packages%2Fexim.git diff --git a/exim4.conf b/exim4.conf index 4d37332..a463048 100644 --- a/exim4.conf +++ b/exim4.conf @@ -41,6 +41,10 @@ # MAIN CONFIGURATION SETTINGS # ###################################################################### +# Log more information +# log_selector = +all -arguments +log_selector = +smtp_confirmation +queue_time + # Specify your host's canonical name here. This should normally be the fully # qualified "official" name of your host. If this option is not set, the # uname() function is called to obtain the name. In many cases this does @@ -48,6 +52,8 @@ # primary_hostname = +# daemon_smtp_ports = 25 : 465 +# tls_on_connect_ports = 465 # The next three settings create two lists of domains and one list of hosts. # These lists are referred to later in this configuration using the syntax @@ -58,6 +64,17 @@ domainlist local_domains = @ domainlist relay_to_domains = hostlist relay_from_hosts = 127.0.0.1 +# If You wish to enable support for STARTTLS, uncomment folowing lines: + +# tls_certificate = /etc/openssl/mail.crt +# tls_privatekey = /etc/openssl/mail.key +# tls_advertise_hosts = * + +# You can use self-signed cerficates (you will need openssl-tools package): + +# openssl genrsa -out /etc/openssl/mail.key 1024 +# openssl req -new -x509 -days 365 -key /etc/openssl/mail.key -out /etc/openssl/mail.crt + # Most straightforward access control requirements can be obtained by # appropriate settings of the above options. In more complicated situations, you # may need to modify the Access Control List (ACL) which appears later in this @@ -70,7 +87,7 @@ hostlist relay_from_hosts = 127.0.0.1 # You can use "@" to mean "the name of the local host", as in the default # setting above. This is the name that is specified by primary_hostname, # as specified above (or defaulted). If you do not want to do any local -# deliveries, remove the "@" rom the setting above. If you want to accept mail +# deliveries, remove the "@" from the setting above. If you want to accept mail # addressed to your host's literal IP address, for example, mail addressed to # "user@[192.168.23.44]", you can add "@[]" as an item in the local domains # list. You also need to uncomment "allow_domain_literals" below. This is not @@ -108,10 +125,30 @@ acl_smtp_rcpt = acl_check_rcpt # You should not change that setting until you understand how ACLs work. +# The following ACL entries are used if you want to do content scanning with +# the exiscan-acl patch. When you uncomment one of these lines, you must also +# review the respective entries in the ACL section further below. + +# acl_smtp_mime = acl_check_mime +# acl_smtp_data = acl_check_content + +# This configuration variable defines the virus scanner that is used with +# the 'malware' ACL condition of the exiscan acl-patch. If you do not use +# virus scanning, leave it commented. Please read doc/exiscan-acl-readme.txt +# for a list of supported scanners. + +# av_scanner = sophie:/var/run/sophie + +# The following setting is only needed if you use the 'spam' ACL condition +# of the exiscan-acl patch. It specifies on which host and port the SpamAssassin +# "spamd" daemon is listening. If you do not use this condition, or you use +# the default of "127.0.0.1 783", you can omit this option. + +# spamd_address = 127.0.0.1 783 # Specify the domain you want to be added to all unqualified addresses # here. An unqualified address is one that does not contain an "@" character -# followed by a domain. For example, "caesar@rome.ex" is a fully qualified +# followed by a domain. For example, "caesar@rome.example" is a fully qualified # address, but the string "caesar" (i.e. just a login name) is an unqualified # email address. Unqualified addresses are accepted only from local callers by # default. See the recipient_unqualified_hosts option if you want to permit @@ -142,11 +179,17 @@ acl_smtp_rcpt = acl_check_rcpt # No deliveries will ever be run under the uids of these users (a colon- # separated list). An attempt to do so causes a panic error to be logged, and -# the delivery to be deferred. This is a paranoic safety catch. Note that the -# default setting means you cannot deliver mail addressed to root as if it -# were a normal user. This isn't usually a problem, as most sites have an alias -# for root that redirects such mail to a human administrator. - +# the delivery to be deferred. This is a paranoic safety catch. There is an +# even stronger safety catch in the form of the FIXED_NEVER_USERS setting +# in the configuration for building Exim. The list of users that it specifies +# is built into the binary, and cannot be changed. The option below just adds +# additional users to the list. The default for FIXED_NEVER_USERS is "root", +# but just to be absolutely sure, the default here is also "root". + +# Note that the default setting means you cannot deliver mail addressed to root +# as if it were a normal user. This isn't usually a problem, as most sites have +# an alias for root that redirects such mail to a human administrator. + never_users = root @@ -157,18 +200,21 @@ never_users = root host_lookup = * +# Advertise DSN for these hosts -# The settings below, which are actually the same as the defaults in the -# code, cause Exim to make RFC 1413 (ident) callbacks for all incoming SMTP -# calls. You can limit the hosts to which these calls are made, and/or change -# the timeout that is used. If you set the timeout to zero, all RFC 1413 calls +dsn_advertise_hosts = * + +# The settings below (default is 30s) cause Exim to make RFC 1413 (ident) +# callbacks for all incoming SMTP calls. You can limit the hosts to which +# these calls are made, and/or change # the timeout that is used. +# If you set the timeout to zero, all RFC 1413 calls # are disabled. RFC 1413 calls are cheap and can provide useful information # for tracing problem messages, but some hosts and firewalls have problems # with them. This can result in a timeout instead of an immediate refused # connection, leading to delays on starting up an SMTP session. -rfc1413_hosts = * -rfc1413_query_timeout = 30s +# rfc1413_hosts = * +# rfc1413_query_timeout = 3s # By default, Exim expects all envelope addresses to be fully qualified, that @@ -232,11 +278,47 @@ acl_check_rcpt: accept hosts = : - # Deny if the local part contains @ or % or / or | or !. These are rarely - # found in genuine local parts, but are often tried by people looking to - # circumvent relaying restrictions. + ############################################################################# + # The following section of the ACL is concerned with local parts that contain + # @ or % or ! or / or | or dots in unusual places. + # + # The characters other than dots are rarely found in genuine local parts, but + # are often tried by people looking to circumvent relaying restrictions. + # Therefore, although they are valid in local parts, these rules lock them + # out, as a precaution. + # + # Empty components (two dots in a row) are not valid in RFC 2822, but Exim + # allows them because they have been encountered. (Consider local parts + # constructed as "firstinitial.secondinitial.familyname" when applied to + # someone like me, who has no second initial.) However, a local part starting + # with a dot or containing /../ can cause trouble if it is used as part of a + # file name (e.g. for a mailing list). This is also true for local parts that + # contain slashes. A pipe symbol can also be troublesome if the local part is + # incorporated unthinkingly into a shell command line. + # + # Two different rules are used. The first one is stricter, and is applied to + # messages that are addressed to one of the local domains handled by this + # host. It blocks local parts that begin with a dot or contain @ % ! / or |. + # If you have local accounts that include these characters, you will have to + # modify this rule. - deny local_parts = ^.*[@%!/|] + deny message = Restricted characters in address + domains = +local_domains + local_parts = ^[.] : ^.*[@%!|] + + # The second rule applies to all other domains, and is less strict. This + # allows your own users to send outgoing messages to sites that use slashes + # and vertical bars in their local parts. It blocks local parts that begin + # with a dot, slash, or vertical bar, but allows these characters within the + # local part. However, the sequence /../ is barred. The use of @ % and ! is + # blocked, as before. The motivation here is to prevent your users (or + # your users' viruses) from mounting certain kinds of attack on remote sites. + + + deny message = Restricted characters in address + domains = !+local_domains + local_parts = ^[.|] : ^.*[@%!] : ^.*/\\.\\./ + ############################################################################# # Accept mail to postmaster in any local domain, regardless of the source, # and without verifying the sender. @@ -269,7 +351,6 @@ acl_check_rcpt: accept domains = +local_domains endpass - message = unknown user verify = recipient # Accept if the address is in a domain for which we are relaying, but again, @@ -277,9 +358,7 @@ acl_check_rcpt: accept domains = +relay_to_domains endpass - message = unrouteable address verify = recipient - # If control reaches this point, the domain is neither in +local_domains # nor in +relay_to_domains. @@ -302,6 +381,55 @@ acl_check_rcpt: deny message = relay not permitted +# These access control lists are used for content scanning with the exiscan-acl +# patch. You must also uncomment the entries for acl_smtp_data and acl_smtp_mime +# (scroll up), otherwise the ACLs will not be used. IMPORTANT: the default entries here +# should be treated as EXAMPLES. You MUST read the file doc/exiscan-acl-spec.txt +# to fully understand what you are doing ... + +acl_check_mime: + + # Decode MIME parts to disk. This will support virus scanners later. + warn decode = default + + # File extension filtering. + deny message = Blacklisted file extension detected + condition = ${if match \ + {${lc:$mime_filename}} \ + {\N(\.exe|\.pif|\.bat|\.scr|\.lnk|\.com)$\N} \ + {1}{0}} + + # Reject messages that carry chinese character sets. + # WARNING: This is an EXAMPLE. + deny message = Sorry, noone speaks chinese here + condition = ${if eq{$mime_charset}{gb2312}{1}{0}} + + accept + +acl_check_content: + + # Reject virus infested messages. + deny message = This message contains malware ($malware_name) + malware = * + + # Always add X-Spam-Score and X-Spam-Report headers, using SA system-wide settings + # (user "nobody"), no matter if over threshold or not. + warn message = X-Spam-Score: $spam_score ($spam_bar) + spam = nobody:true + warn message = X-Spam-Report: $spam_report + spam = nobody:true + + # Add X-Spam-Flag if spam is over system-wide threshold + warn message = X-Spam-Flag: YES + spam = nobody + + # Reject spam messages with score over 10, using an extra condition. + deny message = This message scored $spam_score points. Congratulations! + spam = nobody:true + condition = ${if >{$spam_score_int}{100}{1}{0}} + + # finally accept all the rest + accept ###################################################################### @@ -325,29 +453,37 @@ begin routers # domain_literal: # driver = ipliteral +# domains = ! +local_domains # transport = remote_smtp # This router routes addresses that are not in local domains by doing a DNS -# lookup on the domain name. Any domain that resolves to a loopback interface -# address (127.0.0.0/8) is treated as if it had no DNS entry. If the DNS -# lookup fails, no further routers are tried because of the no_more setting, -# and consequently the address is unrouteable. +# lookup on the domain name. Any domain that resolves to 0.0.0.0 or to a +# loopback interface address (127.0.0.0/8) is treated as if it had no DNS +# entry. Note that 0.0.0.0 is the same as 0.0.0.0/32, which is commonly treated +# as the local host inside the network stack. It is not 0.0.0.0/0, the default +# route. If the DNS lookup fails, no further routers are tried because of +# the no_more setting, and consequently the address is unrouteable. dnslookup: driver = dnslookup domains = ! +local_domains transport = remote_smtp - ignore_target_hosts = 127.0.0.0/8 + ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8 no_more # The remaining routers handle addresses in the local domain(s). -# This router handles aliasing using a traditional /etc/aliases file. +# This router handles aliasing using a linearly searched alias file with the +# name /etc/mail/aliases. When this configuration is installed automatically, +# the name gets inserted into this file from whatever is set in Exim's +# build-time configuration. The default path is the traditional /etc/aliases. +# If you install this configuration by hand, you need to specify the correct +# path in the "data" setting below. # -##### NB You must ensure that /etc/aliases exists. It used to be the case +##### NB You must ensure that the alias file exists. It used to be the case ##### NB that every Unix had that file, because it was the Sendmail default. ##### NB These days, there are systems that don't have it. Your aliases ##### NB file should at least contain an alias for "postmaster". @@ -364,7 +500,7 @@ system_aliases: driver = redirect allow_fail allow_defer - data = ${lookup{$local_part}lsearch{/etc/aliases}} + data = ${lookup{$local_part}lsearch{/etc/mail/aliases}} # user = exim file_transport = address_file pipe_transport = address_pipe @@ -372,8 +508,14 @@ system_aliases: # This router handles forwarding using traditional .forward files in users' # home directories. If you want it also to allow mail filtering when a forward -# file starts with the string "# Exim filter", uncomment the "allow_filter" -# option. +# file starts with the string "# Exim filter" or "# Sieve filter", uncomment +# the "allow_filter" option. + +# If you want this router to treat local parts with suffixes introduced by "-" +# or "+" characters as if the suffixes did not exist, uncomment the two local_ +# part_suffix options. Then, for example, xxxx-foo@your.domain will be treated +# in the same way as xxxx@your.domain by this router. You probably want to make +# the same change to the localuser router. # The no_verify setting means that this router is skipped when Exim is # verifying addresses. Similarly, no_expn means that this router is skipped if @@ -391,24 +533,44 @@ system_aliases: userforward: driver = redirect check_local_user +# local_part_suffix = +* : -* +# local_part_suffix_optional file = $home/.forward +# allow_filter no_verify no_expn check_ancestor -# allow_filter file_transport = address_file pipe_transport = address_pipe reply_transport = address_reply +# Procmail. Uncomment following if you want procmail delivery. -# This router matches local user mailboxes. +#procmail: +# driver = accept +# check_local_user +# local_part_suffix = DSUFFIX* +# local_part_suffix_optional +# require_files = "${local_part}:+${home}/.procmailrc:\ +# +/usr/bin/procmail:!${home}/.forward" +# transport = procmail_pipe + +# This router matches local user mailboxes. If the router fails, the error +# message is "Unknown user". + +# If you want this router to treat local parts with suffixes introduced by "-" +# or "+" characters as if the suffixes did not exist, uncomment the two local_ +# part_suffix options. Then, for example, xxxx-foo@your.domain will be treated +# in the same way as xxxx@your.domain by this router. localuser: driver = accept check_local_user +# local_part_suffix = +* : -* +# local_part_suffix_optional transport = local_delivery - - + cannot_route_message = Unknown user + ###################################################################### # TRANSPORTS CONFIGURATION # @@ -442,9 +604,23 @@ local_delivery: delivery_date_add envelope_to_add return_path_add -# group = mail + group = mail # mode = 0660 +# Procmail transport. Uncomment following if you want procmail delivery + +#procmail_pipe: +# driver = pipe +# command = "procmail -f-" +# delivery_date_add +# envelope_to_add +# path = "/usr/local/bin:/usr/bin:/bin" +# return_path_add +# user = ${local_part} +# temp_errors= 75 : 75 : 256 +# log_defer_output +# log_fail_output + # This transport is used for handling pipe deliveries generated by alias or # .forward files. If the pipe generates any standard output, it is returned @@ -514,5 +690,21 @@ begin rewrite begin authenticators +# Uncomment lines below to enable SMTP AUTH support. Be aware that this +# requires cyrus-sasl-saslauthd package to be installed. + +# plain: +# driver = plaintext +# public_name = PLAIN +# server_prompts = : +# server_condition = ${if saslauthd{{$2}{$3}{smtp}}{1}{0}} +# server_set_id = $2 +# +# login: +# driver = plaintext +# public_name = LOGIN +# server_prompts = "Username:: : Password::" +# server_condition = ${if saslauthd{{$1}{$2}{smtp}}{1}{0}} +# server_set_id = $1 # End of Exim configuration file