# MAIN CONFIGURATION SETTINGS #
######################################################################
+# Log more information
+# log_selector = +all -arguments
+log_selector = +smtp_confirmation +queue_time
+
# Specify your host's canonical name here. This should normally be the fully
# qualified "official" name of your host. If this option is not set, the
# uname() function is called to obtain the name. In many cases this does
# primary_hostname =
+# daemon_smtp_ports = 25 : 465
+# tls_on_connect_ports = 465
# The next three settings create two lists of domains and one list of hosts.
# These lists are referred to later in this configuration using the syntax
domainlist relay_to_domains =
hostlist relay_from_hosts = 127.0.0.1
-# If You wish to enable support for clam antivirus, uncomment the following
-# lines here, and search for 'acl' section of this file (look for 'begin acl'
-# keyword). This will require clamav package to be installed and configured.
-# Other antivirus engines are also supported. Read
-# /usr/share/doc/exim-*/exiscan-acl-spec.txt.gz for more info.
+# If You wish to enable support for STARTTLS, uncomment folowing lines:
+
+# tls_certificate = /etc/openssl/mail.crt
+# tls_privatekey = /etc/openssl/mail.key
+# tls_advertise_hosts = *
-# av_scanner = clamd:/var/lib/clamav/clamd.socket
-# acl_smtp_data = acl_check_data
+# You can use self-signed cerficates (you will need openssl-tools package):
+# openssl genrsa -out /etc/openssl/mail.key 1024
+# openssl req -new -x509 -days 365 -key /etc/openssl/mail.key -out /etc/openssl/mail.crt
# Most straightforward access control requirements can be obtained by
# appropriate settings of the above options. In more complicated situations, you
# You can use "@" to mean "the name of the local host", as in the default
# setting above. This is the name that is specified by primary_hostname,
# as specified above (or defaulted). If you do not want to do any local
-# deliveries, remove the "@" rom the setting above. If you want to accept mail
+# deliveries, remove the "@" from the setting above. If you want to accept mail
# addressed to your host's literal IP address, for example, mail addressed to
# "user@[192.168.23.44]", you can add "@[]" as an item in the local domains
# list. You also need to uncomment "allow_domain_literals" below. This is not
# You should not change that setting until you understand how ACLs work.
+# The following ACL entries are used if you want to do content scanning with
+# the exiscan-acl patch. When you uncomment one of these lines, you must also
+# review the respective entries in the ACL section further below.
+
+# acl_smtp_mime = acl_check_mime
+# acl_smtp_data = acl_check_content
+
+# This configuration variable defines the virus scanner that is used with
+# the 'malware' ACL condition of the exiscan acl-patch. If you do not use
+# virus scanning, leave it commented. Please read doc/exiscan-acl-readme.txt
+# for a list of supported scanners.
+
+# av_scanner = sophie:/var/run/sophie
+
+# The following setting is only needed if you use the 'spam' ACL condition
+# of the exiscan-acl patch. It specifies on which host and port the SpamAssassin
+# "spamd" daemon is listening. If you do not use this condition, or you use
+# the default of "127.0.0.1 783", you can omit this option.
+
+# spamd_address = 127.0.0.1 783
# Specify the domain you want to be added to all unqualified addresses
# here. An unqualified address is one that does not contain an "@" character
-# followed by a domain. For example, "caesar@rome.ex" is a fully qualified
+# followed by a domain. For example, "caesar@rome.example" is a fully qualified
# address, but the string "caesar" (i.e. just a login name) is an unqualified
# email address. Unqualified addresses are accepted only from local callers by
# default. See the recipient_unqualified_hosts option if you want to permit
# No deliveries will ever be run under the uids of these users (a colon-
# separated list). An attempt to do so causes a panic error to be logged, and
-# the delivery to be deferred. This is a paranoic safety catch. Note that the
-# default setting means you cannot deliver mail addressed to root as if it
-# were a normal user. This isn't usually a problem, as most sites have an alias
-# for root that redirects such mail to a human administrator.
-
+# the delivery to be deferred. This is a paranoic safety catch. There is an
+# even stronger safety catch in the form of the FIXED_NEVER_USERS setting
+# in the configuration for building Exim. The list of users that it specifies
+# is built into the binary, and cannot be changed. The option below just adds
+# additional users to the list. The default for FIXED_NEVER_USERS is "root",
+# but just to be absolutely sure, the default here is also "root".
+
+# Note that the default setting means you cannot deliver mail addressed to root
+# as if it were a normal user. This isn't usually a problem, as most sites have
+# an alias for root that redirects such mail to a human administrator.
+
never_users = root
begin acl
-# This access control list is used for every message after DATA command in
-# incoming SMTP connection. It's used mainly for malware (viruses) scanning.
-# Uncomment it, 'av_scanner' and 'acl_smtp_data' to enable support for
-# antivirus software. Read /usr/share/doc/exim-*/exiscan-acl-spec.txt.gz
-# for detailed instructions. Also remember to change 'mysecret' to
-# something else. This will add cryptographic "checks done" header that
-# will prevent re-scanning when the message re-visits one of your mail
-# servers, and the body size did not change.
-
-# acl_check_data:
-#
-# accept condition = ${if eq {${hmac{md5}{mysecret}{$body_linecount}}}{$h_X-Scan-Signature:} {1}{0}}
-#
-# deny message = $found_extension files are not accepted here
-# demime = com:vbs:bat:pif:scr
-#
-# warn message = X-MIME-Warning: Serious MIME defect detected ($demime_reason)
-# demime = *
-# condition = ${if >{$demime_errorlevel}{2}{1}{0}}
-#
-# deny message = Virus found :$malware_name
-# malware = *
-#
-# warn message = X-Scan-Signature: ${hmac{md5}{mysecret}{$body_linecount}}
-#
-# accept
-
# This access control list is used for every RCPT command in an incoming
# SMTP message. The tests are run in order until the address is either
# accepted or denied.
accept hosts = :
- # Deny if the local part contains @ or % or / or | or !. These are rarely
- # found in genuine local parts, but are often tried by people looking to
- # circumvent relaying restrictions.
+ #############################################################################
+ # The following section of the ACL is concerned with local parts that contain
+ # @ or % or ! or / or | or dots in unusual places.
+ #
+ # The characters other than dots are rarely found in genuine local parts, but
+ # are often tried by people looking to circumvent relaying restrictions.
+ # Therefore, although they are valid in local parts, these rules lock them
+ # out, as a precaution.
+ #
+ # Empty components (two dots in a row) are not valid in RFC 2822, but Exim
+ # allows them because they have been encountered. (Consider local parts
+ # constructed as "firstinitial.secondinitial.familyname" when applied to
+ # someone like me, who has no second initial.) However, a local part starting
+ # with a dot or containing /../ can cause trouble if it is used as part of a
+ # file name (e.g. for a mailing list). This is also true for local parts that
+ # contain slashes. A pipe symbol can also be troublesome if the local part is
+ # incorporated unthinkingly into a shell command line.
+ #
+ # Two different rules are used. The first one is stricter, and is applied to
+ # messages that are addressed to one of the local domains handled by this
+ # host. It blocks local parts that begin with a dot or contain @ % ! / or |.
+ # If you have local accounts that include these characters, you will have to
+ # modify this rule.
- deny local_parts = ^.*[@%!/|]
+ deny message = Restricted characters in address
+ domains = +local_domains
+ local_parts = ^[.] : ^.*[@%!/|]
+
+ # The second rule applies to all other domains, and is less strict. This
+ # allows your own users to send outgoing messages to sites that use slashes
+ # and vertical bars in their local parts. It blocks local parts that begin
+ # with a dot, slash, or vertical bar, but allows these characters within the
+ # local part. However, the sequence /../ is barred. The use of @ % and ! is
+ # blocked, as before. The motivation here is to prevent your users (or
+ # your users' viruses) from mounting certain kinds of attack on remote sites.
+
+
+ deny message = Restricted characters in address
+ domains = !+local_domains
+ local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
+ #############################################################################
# Accept mail to postmaster in any local domain, regardless of the source,
# and without verifying the sender.
accept domains = +local_domains
endpass
- message = unknown user
verify = recipient
# Accept if the address is in a domain for which we are relaying, but again,
accept domains = +relay_to_domains
endpass
- message = unrouteable address
verify = recipient
-
# If control reaches this point, the domain is neither in +local_domains
# nor in +relay_to_domains.
deny message = relay not permitted
+# These access control lists are used for content scanning with the exiscan-acl
+# patch. You must also uncomment the entries for acl_smtp_data and acl_smtp_mime
+# (scroll up), otherwise the ACLs will not be used. IMPORTANT: the default entries here
+# should be treated as EXAMPLES. You MUST read the file doc/exiscan-acl-spec.txt
+# to fully understand what you are doing ...
+
+acl_check_mime:
+
+ # Decode MIME parts to disk. This will support virus scanners later.
+ warn decode = default
+
+ # File extension filtering.
+ deny message = Blacklisted file extension detected
+ condition = ${if match \
+ {${lc:$mime_filename}} \
+ {\N(\.exe|\.pif|\.bat|\.scr|\.lnk|\.com)$\N} \
+ {1}{0}}
+
+ # Reject messages that carry chinese character sets.
+ # WARNING: This is an EXAMPLE.
+ deny message = Sorry, noone speaks chinese here
+ condition = ${if eq{$mime_charset}{gb2312}{1}{0}}
+
+ accept
+
+acl_check_content:
+
+ # Reject virus infested messages.
+ deny message = This message contains malware ($malware_name)
+ malware = *
+
+ # Always add X-Spam-Score and X-Spam-Report headers, using SA system-wide settings
+ # (user "nobody"), no matter if over threshold or not.
+ warn message = X-Spam-Score: $spam_score ($spam_bar)
+ spam = nobody:true
+ warn message = X-Spam-Report: $spam_report
+ spam = nobody:true
+
+ # Add X-Spam-Flag if spam is over system-wide threshold
+ warn message = X-Spam-Flag: YES
+ spam = nobody
+
+ # Reject spam messages with score over 10, using an extra condition.
+ deny message = This message scored $spam_score points. Congratulations!
+ spam = nobody:true
+ condition = ${if >{$spam_score_int}{100}{1}{0}}
+
+ # finally accept all the rest
+ accept
######################################################################
# domain_literal:
# driver = ipliteral
+# domains = ! +local_domains
# transport = remote_smtp
# This router routes addresses that are not in local domains by doing a DNS
-# lookup on the domain name. Any domain that resolves to a loopback interface
-# address (127.0.0.0/8) is treated as if it had no DNS entry. If the DNS
-# lookup fails, no further routers are tried because of the no_more setting,
-# and consequently the address is unrouteable.
+# lookup on the domain name. Any domain that resolves to 0.0.0.0 or to a
+# loopback interface address (127.0.0.0/8) is treated as if it had no DNS
+# entry. Note that 0.0.0.0 is the same as 0.0.0.0/32, which is commonly treated
+# as the local host inside the network stack. It is not 0.0.0.0/0, the default
+# route. If the DNS lookup fails, no further routers are tried because of
+# the no_more setting, and consequently the address is unrouteable.
dnslookup:
driver = dnslookup
domains = ! +local_domains
transport = remote_smtp
- ignore_target_hosts = 127.0.0.0/8
+ ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
no_more
# The remaining routers handle addresses in the local domain(s).
-# This router handles aliasing using a traditional /etc/mail/aliases file.
+# This router handles aliasing using a linearly searched alias file with the
+# name /etc/mail/aliases. When this configuration is installed automatically,
+# the name gets inserted into this file from whatever is set in Exim's
+# build-time configuration. The default path is the traditional /etc/aliases.
+# If you install this configuration by hand, you need to specify the correct
+# path in the "data" setting below.
#
-##### NB You must ensure that /etc/mail/aliases exists. It used to be the case
+##### NB You must ensure that the alias file exists. It used to be the case
##### NB that every Unix had that file, because it was the Sendmail default.
##### NB These days, there are systems that don't have it. Your aliases
##### NB file should at least contain an alias for "postmaster".
# This router handles forwarding using traditional .forward files in users'
# home directories. If you want it also to allow mail filtering when a forward
-# file starts with the string "# Exim filter", uncomment the "allow_filter"
-# option.
+# file starts with the string "# Exim filter" or "# Sieve filter", uncomment
+# the "allow_filter" option.
+
+# If you want this router to treat local parts with suffixes introduced by "-"
+# or "+" characters as if the suffixes did not exist, uncomment the two local_
+# part_suffix options. Then, for example, xxxx-foo@your.domain will be treated
+# in the same way as xxxx@your.domain by this router. You probably want to make
+# the same change to the localuser router.
# The no_verify setting means that this router is skipped when Exim is
# verifying addresses. Similarly, no_expn means that this router is skipped if
userforward:
driver = redirect
check_local_user
+# local_part_suffix = +* : -*
+# local_part_suffix_optional
file = $home/.forward
+# allow_filter
no_verify
no_expn
check_ancestor
-# allow_filter
file_transport = address_file
pipe_transport = address_pipe
reply_transport = address_reply
# +/usr/bin/procmail:!${home}/.forward"
# transport = procmail_pipe
-# This router matches local user mailboxes.
+# This router matches local user mailboxes. If the router fails, the error
+# message is "Unknown user".
+
+# If you want this router to treat local parts with suffixes introduced by "-"
+# or "+" characters as if the suffixes did not exist, uncomment the two local_
+# part_suffix options. Then, for example, xxxx-foo@your.domain will be treated
+# in the same way as xxxx@your.domain by this router.
localuser:
driver = accept
check_local_user
+# local_part_suffix = +* : -*
+# local_part_suffix_optional
transport = local_delivery
-
-
+ cannot_route_message = Unknown user
+
######################################################################
# TRANSPORTS CONFIGURATION #
delivery_date_add
envelope_to_add
return_path_add
-# group = mail
+ group = mail
# mode = 0660
# Procmail transport. Uncomment following if you want procmail delivery
# driver = plaintext
# public_name = PLAIN
# server_prompts = :
-# server_condition = ${if saslauthd{{$1}{$3}{smtp}}{1}{0}}
+# server_condition = ${if saslauthd{{$2}{$3}{smtp}}{1}{0}}
# server_set_id = $2
#
# login:
projects / packages / exim.git / blobdiff