API tools faq
paste
Advertisement
Guest User

Exim config

a guest
Aug 4th, 2014
252
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 63.16 KB | None | 0 0
raw download clone embed print report diff
  1. # $Cambridge: exim/exim-src/src/configure.default,v 1.10 2006/07/27 10:36:34 ph10 Exp $
  2.  
  3. ######################################################################
  4. # Runtime configuration file for Exim #
  5. ######################################################################
  6.  
  7.  
  8. # This is a default configuration file which will operate correctly in
  9. # uncomplicated installations. Please see the manual for a complete list
  10. # of all the runtime configuration options that can be included in a
  11. # configuration file. There are many more than are mentioned here. The
  12. # manual is in the file doc/spec.txt in the Exim distribution as a plain
  13. # ASCII file. Other formats (PostScript, Texinfo, HTML, PDF) are available
  14. # from the Exim ftp sites. The manual is also online at the Exim web sites.
  15.  
  16.  
  17. # This file is divided into several parts, all but the first of which are
  18. # headed by a line starting with the word "begin". Only those parts that
  19. # are required need to be present. Blank lines, and lines starting with #
  20. # are ignored.
  21.  
  22.  
  23. ########### IMPORTANT ########## IMPORTANT ########### IMPORTANT ###########
  24. # #
  25. # Whenever you change Exim's configuration file, you *must* remember to #
  26. # HUP the Exim daemon, because it will not pick up the new configuration #
  27. # until you do. However, any other Exim processes that are started, for #
  28. # example, a process started by an MUA in order to send a message, will #
  29. # see the new configuration as soon as it is in place. #
  30. # #
  31. # You do not need to HUP the daemon for changes in auxiliary files that #
  32. # are referenced from this file. They are read every time they are used. #
  33. # #
  34. # It is usually a good idea to test a new configuration for syntactic #
  35. # correctness before installing it (for example, by running the command #
  36. # "exim -C /config/file.new -bV"). #
  37. # #
  38. ########### IMPORTANT ########## IMPORTANT ########### IMPORTANT ###########
  39.  
  40.  
  41.  
  42. ######################################################################
  43. # MAIN CONFIGURATION SETTINGS #
  44. ######################################################################
  45.  
  46. # Specify your host's canonical name here. This should normally be the fully
  47. # qualified "official" name of your host. If this option is not set, the
  48. # uname() function is called to obtain the name. In many cases this does
  49. # the right thing and you need not set anything explicitly.
  50.  
  51. primary_hostname = corp-2.mycompany.co.uk
  52.  
  53. disable_ipv6=true
  54.  
  55. # The next three settings create two lists of domains and one list of hosts.
  56. # These lists are referred to later in this configuration using the syntax
  57. # +local_domains, +relay_to_domains, and +relay_from_hosts, respectively. They
  58. # are all colon-separated lists:
  59.  
  60. #domainlist local_domains = @ : localhost : localhost.localdomain
  61. domainlist relay_to_domains =
  62. hostlist relay_from_hosts = 127.0.0.1 : 172.17.0.0/24
  63.  
  64. domainlist local_domains = ${lookup mysql {\
  65. SELECT domain FROM user WHERE domain='${quote_mysql:$domain}' \
  66. UNION \
  67. SELECT domain FROM alias WHERE domain='${quote_mysql:$domain}' \
  68. UNION \
  69. SELECT domain FROM catchall WHERE domain='${quote_mysql:$domain}'\
  70. }}
  71.  
  72. # Most straightforward access control requirements can be obtained by
  73. # appropriate settings of the above options. In more complicated situations,
  74. # you may need to modify the Access Control List (ACL) which appears later in
  75. # this file.
  76.  
  77. # The first setting specifies your local domains, for example:
  78. #
  79. # domainlist local_domains = my.first.domain : my.second.domain
  80. #
  81. # You can use "@" to mean "the name of the local host", as in the default
  82. # setting above. This is the name that is specified by primary_hostname,
  83. # as specified above (or defaulted). If you do not want to do any local
  84. # deliveries, remove the "@" from the setting above. If you want to accept mail
  85. # addressed to your host's literal IP address, for example, mail addressed to
  86. # "user@[192.168.23.44]", you can add "@[]" as an item in the local domains
  87. # list. You also need to uncomment "allow_domain_literals" below. This is not
  88. # recommended for today's Internet.
  89.  
  90. # The second setting specifies domains for which your host is an incoming relay.
  91. # If you are not doing any relaying, you should leave the list empty. However,
  92. # if your host is an MX backup or gateway of some kind for some domains, you
  93. # must set relay_to_domains to match those domains. For example:
  94. #
  95. # domainlist relay_to_domains = *.myco.com : my.friend.org
  96. #
  97. # This will allow any host to relay through your host to those domains.
  98. # See the section of the manual entitled "Control of relaying" for more
  99. # information.
  100.  
  101. # The third setting specifies hosts that can use your host as an outgoing relay
  102. # to any other host on the Internet. Such a setting commonly refers to a
  103. # complete local network as well as the localhost. For example:
  104. #
  105. # hostlist relay_from_hosts = 127.0.0.1 : 192.168.0.0/16
  106. #
  107. # The "/16" is a bit mask (CIDR notation), not a number of hosts. Note that you
  108. # have to include 127.0.0.1 if you want to allow processes on your host to send
  109. # SMTP mail by using the loopback address. A number of MUAs use this method of
  110. # sending mail.
  111.  
  112. # All three of these lists may contain many different kinds of item, including
  113. # wildcarded names, regular expressions, and file lookups. See the reference
  114. # manual for details. The lists above are used in the access control lists for
  115. # checking incoming messages. The names of these ACLs are defined here:
  116.  
  117. acl_smtp_rcpt = acl_check_rcpt
  118. acl_smtp_data = acl_check_data
  119. acl_smtp_mime = acl_check_mime
  120.  
  121. # You should not change those settings until you understand how ACLs work.
  122.  
  123.  
  124. # If you are running a version of Exim that was compiled with the content-
  125. # scanning extension, you can cause incoming messages to be automatically
  126. # scanned for viruses. You have to modify the configuration in two places to
  127. # set this up. The first of them is here, where you define the interface to
  128. # your scanner. This example is typical for ClamAV; see the manual for details
  129. # of what to set for other virus scanners. The second modification is in the
  130. # acl_check_data access control list (see below).
  131.  
  132. #av_scanner = clamd:/var/run/clamav/clamd.sock
  133.  
  134.  
  135. # For spam scanning, there is a similar option that defines the interface to
  136. # SpamAssassin. You do not need to set this if you are using the default, which
  137. # is shown in this commented example. As for virus scanning, you must also
  138. # modify the acl_check_data access control list to enable spam scanning.
  139.  
  140. #spamd_address = 127.0.0.1 783
  141. ##spamd_address = /var/run/spamassassin/spamd.sock
  142.  
  143. # If Exim is compiled with support for TLS, you may want to enable the
  144. # following options so that Exim allows clients to make encrypted
  145. # connections. In the authenticators section below, there are template
  146. # configurations for plaintext username/password authentication. This kind
  147. # of authentication is only safe when used within a TLS connection, so the
  148. # authenticators will only work if the following TLS settings are turned on
  149. # as well.
  150.  
  151. # Allow any client to use TLS.
  152.  
  153. tls_advertise_hosts = *
  154.  
  155. # Specify the location of the Exim server's TLS certificate and private key.
  156. # The private key must not be encrypted (password protected). You can put
  157. # the certificate and private key in the same file, in which case you only
  158. # need the first setting, or in separate files, in which case you need both
  159. # options.
  160.  
  161. tls_certificate = /etc/pki/tls/certs/exim.pem
  162. tls_privatekey = /etc/pki/tls/private/exim.pem
  163.  
  164. # In order to support roaming users who wish to send email from anywhere,
  165. # you may want to make Exim listen on other ports as well as port 25, in
  166. # case these users need to send email from a network that blocks port 25.
  167. # The standard port for this purpose is port 587, the "message submission"
  168. # port. See RFC 4409 for details. Microsoft MUAs cannot be configured to
  169. # talk the message submission protocol correctly, so if you need to support
  170. # them you should also allow TLS-on-connect on the traditional but
  171. # non-standard port 465.
  172.  
  173. #daemon_smtp_ports = 25 : 465 : 587
  174. daemon_smtp_ports = smtp : smtps : submission
  175. tls_on_connect_ports = 465
  176.  
  177.  
  178. # Specify list of interface IP addresses on which to listen. Each item
  179. # may optionally also specify a port. By default, Exim listens on all
  180. # available interfaces.
  181.  
  182. # Listen only on loopback interface
  183. #local_interfaces = <; 127.0.0.1 ; ::1
  184. local_interfaces = <; 127.0.0.1 ; 172.17.0.16
  185.  
  186.  
  187. # Specify the domain you want to be added to all unqualified addresses
  188. # here. An unqualified address is one that does not contain an "@" character
  189. # followed by a domain. For example, "caesar@rome.example" is a fully qualified
  190. # address, but the string "caesar" (i.e. just a login name) is an unqualified
  191. # email address. Unqualified addresses are accepted only from local callers by
  192. # default. See the recipient_unqualified_hosts option if you want to permit
  193. # unqualified addresses from remote sources. If this option is not set, the
  194. # primary_hostname value is used for qualification.
  195.  
  196. # qualify_domain =
  197.  
  198.  
  199. # If you want unqualified recipient addresses to be qualified with a different
  200. # domain to unqualified sender addresses, specify the recipient domain here.
  201. # If this option is not set, the qualify_domain value is used.
  202.  
  203. # qualify_recipient =
  204.  
  205.  
  206. # The following line must be uncommented if you want Exim to recognize
  207. # addresses of the form "user@[10.11.12.13]" that is, with a "domain literal"
  208. # (an IP address) instead of a named domain. The RFCs still require this form,
  209. # but it makes little sense to permit mail to be sent to specific hosts by
  210. # their IP address in the modern Internet. This ancient format has been used
  211. # by those seeking to abuse hosts by using them for unwanted relaying. If you
  212. # really do want to support domain literals, uncomment the following line, and
  213. # see also the "domain_literal" router below.
  214.  
  215. # allow_domain_literals
  216.  
  217.  
  218. # No deliveries will ever be run under the uids of these users (a colon-
  219. # separated list). An attempt to do so causes a panic error to be logged, and
  220. # the delivery to be deferred. This is a paranoic safety catch. There is an
  221. # even stronger safety catch in the form of the FIXED_NEVER_USERS setting
  222. # in the configuration for building Exim. The list of users that it specifies
  223. # is built into the binary, and cannot be changed. The option below just adds
  224. # additional users to the list. The default for FIXED_NEVER_USERS is "root",
  225. # but just to be absolutely sure, the default here is also "root".
  226.  
  227. # Note that the default setting means you cannot deliver mail addressed to root
  228. # as if it were a normal user. This isn't usually a problem, as most sites have
  229. # an alias for root that redirects such mail to a human administrator.
  230.  
  231. never_users = root
  232.  
  233.  
  234. # The setting below causes Exim to do a reverse DNS lookup on all incoming
  235. # IP calls, in order to get the true host name. If you feel this is too
  236. # expensive, you can specify the networks for which a lookup is done, or
  237. # remove the setting entirely.
  238.  
  239. host_lookup = *
  240.  
  241.  
  242. # The settings below, which are actually the same as the defaults in the
  243. # code, cause Exim to make RFC 1413 (ident) callbacks for all incoming SMTP
  244. # calls. You can limit the hosts to which these calls are made, and/or change
  245. # the timeout that is used. If you set the timeout to zero, all RFC 1413 calls
  246. # are disabled. RFC 1413 calls are cheap and can provide useful information
  247. # for tracing problem messages, but some hosts and firewalls have problems
  248. # with them. This can result in a timeout instead of an immediate refused
  249. # connection, leading to delays on starting up SMTP sessions. (The default was
  250. # reduced from 30s to 5s for release 4.61.)
  251.  
  252. rfc1413_hosts = *
  253. rfc1413_query_timeout = 5s
  254.  
  255.  
  256. # By default, Exim expects all envelope addresses to be fully qualified, that
  257. # is, they must contain both a local part and a domain. If you want to accept
  258. # unqualified addresses (just a local part) from certain hosts, you can specify
  259. # these hosts by setting one or both of
  260. #
  261. # sender_unqualified_hosts =
  262. # recipient_unqualified_hosts =
  263. #
  264. # to control sender and recipient addresses, respectively. When this is done,
  265. # unqualified addresses are qualified using the settings of qualify_domain
  266. # and/or qualify_recipient (see above).
  267.  
  268.  
  269. # If you want Exim to support the "percent hack" for certain domains,
  270. # uncomment the following line and provide a list of domains. The "percent
  271. # hack" is the feature by which mail addressed to x%y@z (where z is one of
  272. # the domains listed) is locally rerouted to x@y and sent on. If z is not one
  273. # of the "percent hack" domains, x%y is treated as an ordinary local part. This
  274. # hack is rarely needed nowadays; you should not enable it unless you are sure
  275. # that you really need it.
  276. #
  277. # percent_hack_domains =
  278. #
  279. # As well as setting this option you will also need to remove the test
  280. # for local parts containing % in the ACL definition below.
  281.  
  282.  
  283. # When Exim can neither deliver a message nor return it to sender, it "freezes"
  284. # the delivery error message (aka "bounce message"). There are also other
  285. # circumstances in which messages get frozen. They will stay on the queue for
  286. # ever unless one of the following options is set.
  287.  
  288. # This option unfreezes frozen bounce messages after two days, tries
  289. # once more to deliver them, and ignores any delivery failures.
  290.  
  291. ignore_bounce_errors_after = 2d
  292.  
  293. # This option cancels (removes) frozen messages that are older than a week.
  294.  
  295. timeout_frozen_after = 7d
  296.  
  297. # This setting, if uncommented, allows users to authenticate using
  298. # their system passwords against saslauthd if they connect over a
  299. # secure connection. If you have network logins such as NIS or
  300. # Kerberos rather than only local users, then you possibly also want
  301. # to configure /etc/sysconfig/saslauthd to use the 'pam' mechanism
  302. # too. Once a user is authenticated, the acl_check_rcpt ACL then
  303. # allows them to relay through the system.
  304. #
  305. #auth_advertise_hosts = ${if eq {$tls_cipher}{}{}{*}}
  306. #
  307. # By default, we set this option to allow SMTP AUTH from nowhere
  308. # (Exim's default would be to allow it from anywhere, even on an
  309. # unencrypted connection).
  310. #
  311. # Comment this one out if you uncomment the above. Did you make sure
  312. # saslauthd is actually running first?
  313. #
  314. #auth_advertise_hosts =
  315.  
  316. # mysql auth
  317. hide mysql_servers = localhost/system/username/password
  318.  
  319. # seconds after a greylisted message is accepted (10 minutes)
  320. GREYLIST_TIMEOUT = ${eval:10*60}
  321. # integer spam score threshold to activate selective greylisting (3.0 points)
  322. GREYLIST_SPAM_THRESHOLD = 30
  323. # messages bigger than this aren't spam-scanned
  324. SPAM_FILESIZE_LIMIT = 1M
  325. # messages bigger than this aren't virus-scanned
  326. VIRUS_FILESIZE_LIMIT = 32M
  327.  
  328. ######################################################################
  329. # ACL CONFIGURATION #
  330. # Specifies access control lists for incoming SMTP mail #
  331. ######################################################################
  332.  
  333. begin acl
  334.  
  335. # This access control list is used for every RCPT command in an incoming
  336. # SMTP message. The tests are run in order until the address is either
  337. # accepted or denied.
  338.  
  339. acl_check_rcpt:
  340.  
  341. # Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
  342. # testing for an empty sending host field.
  343.  
  344. accept hosts = :
  345.  
  346. # temporary reject message, if already greylisted and entry hasn't expired yet
  347. # authenticated users skip this
  348. defer message = Your Message is currently still greylisted! Please try again later.
  349. log_message = message from ${sender_address} over [${sender_host_address}] is still GreyListed
  350. !authenticated = *
  351. # true, if triple is in db and not yet GREYLIST_TIMEOUT seconds since first seen
  352. # false, else (older or not in db)
  353. condition = ${if >={GREYLIST_TIMEOUT}{${lookup mysql{\
  354. SELECT (UNIX_TIMESTAMP()-MAX(first_seen)) AS QueueTime \
  355. FROM greylist \
  356. WHERE SenderIP = '${quote_mysql:$sender_host_address}' \
  357. AND SenderAddress = '${quote_mysql:$sender_address}' \
  358. }{$value}{${eval:GREYLIST_TIMEOUT+1}}}}{true}{false}}
  359.  
  360.  
  361. ## deny, if foreign, unauthenticated connection claims to come from a local domain
  362. ## 2009-08-01 this has some strange behaviour (blocking) on two systems (A & B are different servers) with this config under the following condition
  363. ## A: user@Adomain writes to user user@Bdomain (which is an alias for someotheruser@Adomain)
  364. ## if your users have such circular aliases on different servers using this config, simply comment it out!
  365. #deny message = Sender claims to have a local address, but is neither authenticated nor relayed (try using SMTP-AUTH!)
  366. # log_message = Forged Sender address (claims to be local user [${sender_address}], but isn't authenticated)
  367. # !hosts = +relay_from_hosts
  368. # !authenticated = *
  369. # condition = ${if match_domain{$sender_address_domain}{+local_domains}}
  370.  
  371. warn message = You cannot be localhost.localdomain in the internet
  372. log_message = HELO is faked as localhost.localdomain
  373. condition = ${if match{$sender_helo_name}{\Nlocalhost\.localdomain\N}}
  374.  
  375. # we're doing HELO checks here, because we can't add headers in acl_smtp_helo
  376. warn message = X-Invalid-HELO: HELO is IP only (See RFC2821 4.1.3)
  377. log_message = HELO ($sender_helo_name) is IP only (See RFC2821 4.1.3)
  378. condition = ${if isip{$sender_helo_name}}
  379.  
  380. warn message = X-Invalid-HELO: HELO is no FQDN (contains no dot) (See RFC2821 4.1.1.1)
  381. log_message = HELO ($sender_helo_name) is no FQDN (contains no dot) (See RFC2821 4.1.1.1)
  382. # Required because "[IPv6:<address>]" will have no .s
  383. condition = ${if match{$sender_helo_name}{\N^\[\N}{no}{yes}}
  384. condition = ${if match{$sender_helo_name}{\N\.\N}{no}{yes}}
  385.  
  386. warn message = X-Invalid-HELO: HELO is no FQDN (ends in dot) (See RFC2821 4.1.1.1)
  387. log_message = HELO ($sender_helo_name) is no FQDN (ends in dot) (See RFC2821 4.1.1.1)
  388. condition = ${if match{$sender_helo_name}{\N\.$\N}}
  389.  
  390. warn message = X-Invalid-HELO: HELO is no FQDN (contains double dot) (See RFC2821 4.1.1.1)
  391. log_message = HELO ($sender_helo_name) is no FQDN (contains double dot) (See RFC2821 4.1.1.1)
  392. condition = ${if match{$sender_helo_name}{\N\.\.\N}}
  393.  
  394. warn message = X-Invalid-HELO: Host impersonating [$primary_hostname]
  395. log_message = HELO ($sender_helo_name) impersonating [$primary_hostname]
  396. condition = ${if match{$sender_helo_name}{$primary_hostname}{yes}{no}}
  397. # TODO: nicht auf loopback generieren
  398.  
  399. warn message = X-Invalid-HELO: $interface_address is _my_ address
  400. log_message = HELO ($sender_helo_name) uses _my_ address ($interface_address)
  401. # [own IP] or even without brackets as HELO
  402. condition = ${if or{{\
  403. eq{[$interface_address]}{$sender_helo_name}\
  404. }{\
  405. eq{$interface_address}{$sender_helo_name}\
  406. }}}
  407.  
  408. warn message = X-Invalid-HELO: no HELO
  409. log_message = no HELO ($sender_helo_name)
  410. condition = ${if !def:sender_helo_name}
  411.  
  412.  
  413. #############################################################################
  414. # The following section of the ACL is concerned with local parts that contain
  415. # @ or % or ! or / or | or dots in unusual places.
  416. #
  417. # The characters other than dots are rarely found in genuine local parts, but
  418. # are often tried by people looking to circumvent relaying restrictions.
  419. # Therefore, although they are valid in local parts, these rules lock them
  420. # out, as a precaution.
  421. #
  422. # Empty components (two dots in a row) are not valid in RFC 2822, but Exim
  423. # allows them because they have been encountered. (Consider local parts
  424. # constructed as "firstinitial.secondinitial.familyname" when applied to
  425. # someone like me, who has no second initial.) However, a local part starting
  426. # with a dot or containing /../ can cause trouble if it is used as part of a
  427. # file name (e.g. for a mailing list). This is also true for local parts that
  428. # contain slashes. A pipe symbol can also be troublesome if the local part is
  429. # incorporated unthinkingly into a shell command line.
  430. #
  431. # Two different rules are used. The first one is stricter, and is applied to
  432. # messages that are addressed to one of the local domains handled by this
  433. # host. The line "domains = +local_domains" restricts it to domains that are
  434. # defined by the "domainlist local_domains" setting above. The rule blocks
  435. # local parts that begin with a dot or contain @ % ! / or |. If you have
  436. # local accounts that include these characters, you will have to modify this
  437. # rule.
  438.  
  439. deny message = Restricted characters in address
  440. domains = +local_domains
  441. local_parts = ^[.] : ^.*[@%!/|]
  442.  
  443. # The second rule applies to all other domains, and is less strict. The line
  444. # "domains = !+local_domains" restricts it to domains that are NOT defined by
  445. # the "domainlist local_domains" setting above. The exclamation mark is a
  446. # negating operator. This rule allows your own users to send outgoing
  447. # messages to sites that use slashes and vertical bars in their local parts.
  448. # It blocks local parts that begin with a dot, slash, or vertical bar, but
  449. # allows these characters within the local part. However, the sequence /../
  450. # is barred. The use of @ % and ! is blocked, as before. The motivation here
  451. # is to prevent your users (or your users' viruses) from mounting certain
  452. # kinds of attack on remote sites.
  453.  
  454. deny message = Restricted characters in address
  455. domains = !+local_domains
  456. local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
  457. #############################################################################
  458.  
  459. # Accept mail to postmaster in any local domain, regardless of the source,
  460. # and without verifying the sender.
  461.  
  462. accept local_parts = postmaster
  463. domains = +local_domains
  464.  
  465. # Deny unless the sender address can be routed. For proper verification of the
  466. # address, read the documentation on callouts and add the /callout modifier.
  467.  
  468. require verify = sender
  469.  
  470. # embed a header flag, if sender callout verification fails. this may lead to rejection in future, or give a hint to bayes filter
  471. # the next both directives have complement verify conditions, so only one matches
  472. warn message = X-Sender-Verify: FAILED ($sender_verify_failure)
  473. log_message = Sender ($sender_address) could not be verified using callout: $acl_verify_message ($sender_verify_failure)
  474. !verify = sender/callout=10s,random
  475.  
  476. warn message = X-Sender-Verify: SUCCEEDED (sender exists & accepts mail)
  477. verify = sender/callout=10s,random
  478.  
  479. # Accept if the message comes from one of the hosts for which we are an
  480. # outgoing relay. It is assumed that such hosts are most likely to be MUAs,
  481. # so we set control=submission to make Exim treat the message as a
  482. # submission. It will fix up various errors in the message, for example, the
  483. # lack of a Date: header line. If you are actually relaying out out from
  484. # MTAs, you may want to disable this. If you are handling both relaying from
  485. # MTAs and submissions from MUAs you should probably split them into two
  486. # lists, and handle them differently.
  487.  
  488. # Recipient verification is omitted here, because in many cases the clients
  489. # are dumb MUAs that don't cope well with SMTP error responses. If you are
  490. # actually relaying out from MTAs, you should probably add recipient
  491. # verification here.
  492.  
  493. # Note that, by putting this test before any DNS black list checks, you will
  494. # always accept from these hosts, even if they end up on a black list. The
  495. # assumption is that they are your friends, and if they get onto a black
  496. # list, it is a mistake.
  497.  
  498. accept hosts = +relay_from_hosts
  499. control = submission
  500.  
  501. # Accept if the message arrived over an authenticated connection, from
  502. # any host. Again, these messages are usually from MUAs, so recipient
  503. # verification is omitted, and submission mode is set. And again, we do this
  504. # check before any black list tests.
  505.  
  506. accept authenticated = *
  507. control = submission/sender_retain/domain=
  508.  
  509. # Insist that any other recipient address that we accept is either in one of
  510. # our local domains, or is in a domain for which we explicitly allow
  511. # relaying. Any other domain is rejected as being unacceptable for relaying.
  512.  
  513. require message = relay not permitted
  514. domains = +local_domains : +relay_to_domains
  515.  
  516. # We also require all accepted addresses to be verifiable. This check will
  517. # do local part verification for local domains, but only check the domain
  518. # for remote domains. The only way to check local parts for the remote
  519. # relay domains is to use a callout (add /callout), but please read the
  520. # documentation about callouts before doing this.
  521.  
  522. require verify = recipient
  523.  
  524. #############################################################################
  525. # There are no default checks on DNS black lists because the domains that
  526. # contain these lists are changing all the time. However, here are two
  527. # examples of how you can get Exim to perform a DNS black list lookup at this
  528. # point. The first one denies, whereas the second just warns.
  529. #
  530. # deny message = rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text
  531. # dnslists = black.list.example
  532. #
  533. # warn dnslists = black.list.example
  534. # add_header = X-Warning: $sender_host_address is in a black list at $dnslist_domain
  535. # log_message = found in $dnslist_domain
  536. #############################################################################
  537.  
  538. #############################################################################
  539. # This check is commented out because it is recognized that not every
  540. # sysadmin will want to do it. If you enable it, the check performs
  541. # Client SMTP Authorization (csa) checks on the sending host. These checks
  542. # do DNS lookups for SRV records. The CSA proposal is currently (May 2005)
  543. # an Internet draft. You can, of course, add additional conditions to this
  544. # ACL statement to restrict the CSA checks to certain hosts only.
  545. #
  546. # require verify = csa
  547. #############################################################################
  548.  
  549. # At this point, the address has passed all the checks that have been
  550. # configured, so we accept it unconditionally.
  551.  
  552. accept
  553.  
  554.  
  555. # This ACL is used after the contents of a message have been received. This
  556. # is the ACL in which you can test a message's headers or body, and in
  557. # particular, this is where you can invoke external virus or spam scanners.
  558. # Some suggested ways of configuring these tests are shown below, commented
  559. # out. Without any tests, this ACL accepts all messages. If you want to use
  560. # such tests, you must ensure that Exim is compiled with the content-scanning
  561. # extension (WITH_CONTENT_SCAN=yes in Local/Makefile).
  562.  
  563. acl_check_data:
  564.  
  565. # Unpack MIME containers and reject file extensions
  566. # used by worms. Note that the extension list may be
  567. # incomplete.
  568. deny message = $found_extension files are not accepted here
  569. demime = com:exe:vbs:bat:pif:reg:scr
  570.  
  571.  
  572. # Reject messages that have serious MIME errors.
  573. # This calls the demime condition again, but will return cached results.
  574. deny message = Serious MIME defect detected ($demime_reason).
  575. demime = *
  576. condition = ${if >{$demime_errorlevel}{2}{1}{0}}
  577.  
  578.  
  579. # # Deny if the message contains a virus. Before enabling this check, you
  580. # # must install a virus scanner and set the av_scanner option above.
  581. # deny message = This message contains a virus ($malware_name) and is rejected.
  582. # log_message = rejected VIRUS ($malware_name) from $sender_address to $recipients (ClamAV)
  583. # set acl_m0 = clamd:/var/run/clamav/clamd.sock
  584. # condition = ${if < {$message_size}{VIRUS_FILESIZE_LIMIT}}
  585. # demime = *
  586. # malware = *
  587.  
  588. # 2009-08-01 disable f-prot for now, since its usage has changed
  589. # this is the place to configure additional virus scanning engines.
  590. # just copy and modify this block (read exim doc for available scanners)
  591. # deny message = This message contains a virus ($malware_name) and is rejected.
  592. # log_message = rejected VIRUS ($malware_name) from $sender_address to $recipients (F-Prot)
  593. # set acl_m0 = cmdline:/usr/bin/f-prot -ai -archive -collect -dumb -packed %s:Infection. :Infection. (.+)\$
  594. # condition = ${if < {$message_size}{VIRUS_FILESIZE_LIMIT}}
  595. # demime = *
  596. # malware = *
  597.  
  598.  
  599. ## reject executeable double extensions in archives
  600. # deny demime = zip:rar:arj:tar:tgz:gz:bz2
  601. # condition = ${run{/etc/exim/scan_archive.sh $message_exim_id ${lc:$found_extension}}{no}{yes}}
  602. # message = This message contains an unwanted binary Attachment in ${uc:$found_extension} file using a double extension
  603. # log_message = ${uc:$found_extension} archive contains potential dangerous double extension.
  604. # delay = 15s
  605.  
  606.  
  607. # # Add headers to all messages (:true). Before enabling this,
  608. # # you must install SpamAssassin. You may also need to set the spamd_address
  609. # # option above.
  610. # #
  611. # warn message = X-Spam-Score: $spam_score\n\
  612. # X-Spam-Score-Int: $spam_score_int\n\
  613. # X-Spam-Bar: $spam_bar\n\
  614. # X-Spam-Report: $spam_report
  615. # !authenticated = *
  616. # condition = ${if < {$message_size}{SPAM_FILESIZE_LIMIT}}
  617. # spam = spamassassin:true
  618. #
  619. # # temp. reject messages that seem to have timeouts during spam-scan
  620. # defer message = Temporary error while spam-scanning. Please try again later.
  621. # log_message = message temporarily rejected, because of spam-scan error (maybe timeout)
  622. # !authenticated = *
  623. # condition = ${if < {$message_size}{SPAM_FILESIZE_LIMIT}}
  624. # condition = ${if !def:spam_score}
  625. #
  626. # # Reject spam messages with score over 10+2*max_score_from_db (fallback=15 if mysql fails), using an extra condition.
  627. # deny message = This message is classified as UBE (SPAM) and therefore rejected. You scored $spam_score points. Congratulations!
  628. # #spam = spamassassin:true
  629. # !authenticated = *
  630. # condition = ${if >={$spam_score_int}{${lookup mysql{\
  631. # SELECT ((max(spam_threshold)*2+10)*10) AS spam_reject_threshold \
  632. # FROM user \
  633. # WHERE SMTP_allowed='YES' \
  634. # }{$value}{15}}}{true}{false}}
  635.  
  636. # temporary reject message for greylisting, if integer spamscore is above GREYLIST_SPAM_THRESHOLD and the message (sender address + IP) is seen for the first time
  637. # authenticated users skip this
  638. defer message = Your Message will be greylisted! Please try again in GREYLIST_TIMEOUT seconds.
  639. log_message = message from ${sender_address} over [${sender_host_address}] will be GreyListed as it scores $spam_score spam points
  640. !authenticated = *
  641. condition = ${if >={$spam_score_int}{GREYLIST_SPAM_THRESHOLD}{true}{false}}
  642. # false, if triple is in db (at this point if it's in the timeout has expired)
  643. # true, if not
  644. condition = ${lookup mysql{ \
  645. SELECT MAX(first_seen) \
  646. FROM greylist \
  647. WHERE SenderIP = '${quote_mysql:$sender_host_address}' \
  648. AND SenderAddress = '${quote_mysql:$sender_address}' \
  649. }{false}{true}}
  650. # insert triple into database (which should succeed)
  651. condition = ${lookup mysql{ \
  652. INSERT INTO greylist ( SenderIP, SenderAddress, first_seen ) \
  653. VALUES ( '${quote_mysql:$sender_host_address}', '${quote_mysql:$sender_address}', UNIX_TIMESTAMP() ) \
  654. }{$value}fail}
  655.  
  656. # log, if mail successfully passed greylisting
  657. warn message = X-GreyList: Message successfully passed GreyListing after $acl_m0 seconds.
  658. log_message = message from ${sender_address} over [${sender_host_address}] with HELO ($sender_helo_name) successfully passed GreyListing after $acl_m0 seconds and scores $spam_score spam points
  659. !authenticated = *
  660. # true, if triple is in db (at this point if it's in the timeout has expired)
  661. # false, if not
  662. condition = ${lookup mysql{ \
  663. SELECT MAX(first_seen) \
  664. FROM greylist \
  665. WHERE SenderIP = '${quote_mysql:$sender_host_address}' \
  666. AND SenderAddress = '${quote_mysql:$sender_address}' \
  667. }{true}{false}}
  668. set acl_m0 = ${eval:$tod_epoch-${lookup mysql{ \
  669. SELECT MAX(first_seen) \
  670. FROM greylist \
  671. WHERE SenderIP = '${quote_mysql:$sender_host_address}' \
  672. AND SenderAddress = '${quote_mysql:$sender_address}' \
  673. }{$value}}}
  674.  
  675.  
  676. # save exim version and current date in header
  677. warn message = X-Exim-Version: $version_number (build at $compile_date)\n\
  678. X-Date: $tod_log\n\
  679. X-Connected-IP: $sender_host_address:$sender_host_port
  680.  
  681. # save additional information in header
  682. warn message = X-Message-Linecount: $message_linecount\n\
  683. X-Body-Linecount: $body_linecount\n\
  684. X-Message-Size: $message_size\n\
  685. X-Body-Size: $message_body_size
  686. #X-Received-Count: $received_count\n\
  687. #X-Recipient-Count: $recipients_count\n\
  688. #X-Local-Recipient-Count: $rcpt_count\n\
  689. #X-Local-Recipient-Defer-Count: $rcpt_defer_count\n\
  690. #X-Local-Recipient-Fail-Count: $rcpt_fail_count
  691.  
  692. warn log_message = DEBUG load_avgx1000: $load_average spam_score: $spam_score message_size: $message_size
  693.  
  694. # finally accept the message in DATA ACL.
  695. accept
  696.  
  697.  
  698. acl_check_mime:
  699.  
  700. # File extension filtering.
  701. deny message = Blacklisted file extension detected
  702. condition = ${if match \
  703. {${lc:$mime_filename}} \
  704. {\N(\.exe|\.pif|\.bat|\.scr|\.lnk|\.com)$\N} \
  705. {1}{0}}
  706.  
  707. accept
  708.  
  709.  
  710. ######################################################################
  711. # ROUTERS CONFIGURATION #
  712. # Specifies how addresses are handled #
  713. ######################################################################
  714. # THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT! #
  715. # An address is passed to each router in turn until it is accepted. #
  716. ######################################################################
  717.  
  718. begin routers
  719.  
  720. # This router routes to remote hosts over SMTP by explicit IP address,
  721. # when an email address is given in "domain literal" form, for example,
  722. # <user@[192.168.35.64]>. The RFCs require this facility. However, it is
  723. # little-known these days, and has been exploited by evil people seeking
  724. # to abuse SMTP relays. Consequently it is commented out in the default
  725. # configuration. If you uncomment this router, you also need to uncomment
  726. # allow_domain_literals above, so that Exim can recognize the syntax of
  727. # domain literal addresses.
  728.  
  729. # domain_literal:
  730. # driver = ipliteral
  731. # domains = ! +local_domains
  732. # transport = remote_smtp
  733.  
  734.  
  735. # This router routes addresses that are not in local domains by doing a DNS
  736. # lookup on the domain name. The exclamation mark that appears in "domains = !
  737. # +local_domains" is a negating operator, that is, it can be read as "not". The
  738. # recipient's domain must not be one of those defined by "domainlist
  739. # local_domains" above for this router to be used.
  740. #
  741. # If the router is used, any domain that resolves to 0.0.0.0 or to a loopback
  742. # interface address (127.0.0.0/8) is treated as if it had no DNS entry. Note
  743. # that 0.0.0.0 is the same as 0.0.0.0/32, which is commonly treated as the
  744. # local host inside the network stack. It is not 0.0.0.0/0, the default route.
  745. # If the DNS lookup fails, no further routers are tried because of the no_more
  746. # setting, and consequently the address is unrouteable.
  747.  
  748. dnslookup:
  749. driver = dnslookup
  750. domains = ! +local_domains
  751. transport = remote_smtp
  752. ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
  753. no_more
  754.  
  755. # alle@ is an auto-generated alias for all users of , which is only available for authenticated senders
  756. # NOTE: we need to respect SMTP_allowed for every user!
  757. mysql_all_domain_alias:
  758. driver = redirect
  759. # restriction to local domains only may be a double check, as data takes care of it already ;-)
  760. domains = +local_domains
  761. local_parts = alle
  762. data = ${lookup mysql{ \
  763. SELECT CONCAT(username,'@',domain) AS sendto \
  764. FROM user \
  765. WHERE domain='${quote_mysql:$domain}' \
  766. AND SMTP_allowed='YES' \
  767. }}
  768. # treat localhost as authenticated
  769. condition = ${if or {{\
  770. def:authenticated_id\
  771. }{\
  772. eq {$sender_host_address}{127.0.0.1}\
  773. }}\
  774. }
  775. file_transport = address_file
  776. pipe_transport = address_pipe
  777.  
  778.  
  779. # an alias can be specified by giving one or more db-entries that match username and domain,
  780. # or return a comma-seperated list of recipients.
  781. # when no domain is specified in db-entry, recipients are taken from all domains with a matching username
  782. # setting internal='YES' only allows sending mail to this alias, if authenticated (for internal usage)
  783. mysql_alias:
  784. driver = redirect
  785. # restriction to local domains only may be a double check, as data takes care of it already ;-)
  786. domains = +local_domains
  787. file_transport = address_file
  788. pipe_transport = address_pipe
  789. data = ${if or {{\
  790. def:authenticated_id\
  791. }{\
  792. eq {$sender_host_address}{127.0.0.1}\
  793. }}{\
  794. ${lookup mysql{ \
  795. SELECT sendto \
  796. FROM alias \
  797. WHERE ( username='${quote_mysql:$local_part}' \
  798. AND (domain='${quote_mysql:$domain}' OR domain='') )}}\
  799. } {\
  800. ${lookup mysql{ \
  801. SELECT sendto \
  802. FROM alias \
  803. WHERE ( ( username='${quote_mysql:$local_part}' AND (domain='${quote_mysql:$domain}' OR domain='') ) \
  804. AND internal='NO' )}}\
  805. }}
  806. local_part_suffix = +*
  807. local_part_suffix_optional
  808.  
  809. # 2006-10-03
  810. # virtual user in mysql-db? and suffixed with a condition?
  811. # currently supported:
  812. # #before#@ e.g.: pille#before#20061003@struction.de will accept mail for existing user pille@struction.de, if current date is before 20061003
  813. # #fromdomain#@ e.g.: pille#fromdomain#example.com@struction.de will accept mail for existing user pille@struction.de, if current domain of sender is example.com
  814. mysql_user_condition:
  815. driver = accept
  816. # restriction to local domains only may be a double check, as the condition takes care of it already ;-)
  817. domains = +local_domains
  818. # 2006-10-08
  819. # as we embed base64 encoded strings in local_part_suffix, and these are case sensitive, we must take care of them.
  820. # NOTE: this results in the missing feature, that conditional-mails in this router are case-sensitive! (pille#...#...@struction.de != Pille#...#...@struction.de)
  821. caseful_local_part = true
  822. condition = ${if and {{\
  823. # existing user
  824. eq {${lookup mysql{ \
  825. SELECT CONCAT(username,'@',domain) AS email \
  826. FROM user \
  827. WHERE username='${quote_mysql:$local_part}' \
  828. AND domain='${quote_mysql:$domain}' \
  829. AND SMTP_allowed='YES' \
  830. }{true}{false}}}{true}\
  831. }{\
  832. # different conditions
  833. or {{\
  834. # suffix contains #before# and date (yyyymmdd) is not yet #before#yyyymmdd
  835. and {{\
  836. eq {${sg{$local_part_suffix}{^#([^#]+)#[0-9]\{8\}\$}{\$1}}}{before}\
  837. }{\
  838. lt {$tod_logfile}{${sg{$local_part_suffix}{^#[^#]+#([0-9]\{8\})\$}{\$1}}}\
  839. }\
  840. }\
  841. }{\
  842. # suffix contains #fromdomain# and the domain-name of sender
  843. and {{\
  844. eq {${sg{$local_part_suffix}{^#([^#]+)#.*\$}{\$1}}}{fromdomain}\
  845. }{\
  846. eq {$sender_address_domain}{${sg{$local_part_suffix}{^#[^#]+#(.*)\$}{\$1}}}\
  847. }\
  848. }\
  849. }{\
  850. # suffix contains #b64from# and the base64 encoded address of sender DOES NOT WORK YET!
  851. and {{\
  852. eq {${sg{$local_part_suffix}{^#([^#]+)#.*\$}{\$1}}}{b64from}\
  853. }{\
  854. eq {${str2b64:$sender_address}}{${sg{$local_part_suffix}{^#[^#]+#(.*)\$}{\$1}}}\
  855. }\
  856. }\
  857. }\
  858. }\
  859. }\
  860. }\
  861. }
  862. local_part_suffix = #*
  863. transport = local_mysql_delivery
  864.  
  865.  
  866. # 2006-09-07 virtual user in mysql-db? (note: it's not nessessary to return real data)
  867. mysql_user:
  868. driver = accept
  869. # restriction to local domains only may be a double check, as the condition takes care of it already ;-)
  870. domains = +local_domains
  871. condition = ${lookup mysql{ \
  872. SELECT CONCAT(username,'@',domain) AS email \
  873. FROM user \
  874. WHERE username='${quote_mysql:$local_part}' \
  875. AND domain='${quote_mysql:$domain}' \
  876. AND SMTP_allowed='YES' \
  877. }{true}{false}}
  878. local_part_suffix = +*
  879. local_part_suffix_optional
  880. transport = local_mysql_delivery
  881. no_more
  882.  
  883. # 2007-01-16 catchall domains
  884. # a catchall domain can be specified by giving one or more db-entries that match the domain,
  885. # or return a comma-seperated list of recipients.
  886. # this router acts as a fallback, so it has to be placed below all routers that react on 'users'.
  887. # any mail to a not otherwise (in another router above) defined local_prefix in these domains are forwarded.
  888. # so keep in mind that this mostly may forward unsolicited mail and should not be used at all ;-)
  889. mysql_catchall:
  890. driver = redirect
  891. # restriction to local domains only may be a double check, as data takes care of it already ;-)
  892. domains = +local_domains
  893. file_transport = address_file
  894. pipe_transport = address_pipe
  895. data = ${lookup mysql{ \
  896. SELECT sendto \
  897. FROM catchall \
  898. WHERE domain='${quote_mysql:$domain}' \
  899. }}
  900.  
  901. # The remaining routers handle addresses in the local domain(s), that is those
  902. # domains that are defined by "domainlist local_domains" above.
  903.  
  904.  
  905. # This router handles aliasing using a linearly searched alias file with the
  906. # name SYSTEM_ALIASES_FILE. When this configuration is installed automatically,
  907. # the name gets inserted into this file from whatever is set in Exim's
  908. # build-time configuration. The default path is the traditional /etc/aliases.
  909. # If you install this configuration by hand, you need to specify the correct
  910. # path in the "data" setting below.
  911. #
  912. ##### NB You must ensure that the alias file exists. It used to be the case
  913. ##### NB that every Unix had that file, because it was the Sendmail default.
  914. ##### NB These days, there are systems that don't have it. Your aliases
  915. ##### NB file should at least contain an alias for "postmaster".
  916. #
  917. # If any of your aliases expand to pipes or files, you will need to set
  918. # up a user and a group for these deliveries to run under. You can do
  919. # this by uncommenting the "user" option below (changing the user name
  920. # as appropriate) and adding a "group" option if necessary. Alternatively, you
  921. # can specify "user" on the transports that are used. Note that the transports
  922. # listed below are the same as are used for .forward files; you might want
  923. # to set up different ones for pipe and file deliveries from aliases.
  924.  
  925. system_aliases:
  926. driver = redirect
  927. allow_fail
  928. allow_defer
  929. data = ${lookup{$local_part}lsearch{/etc/aliases}}
  930. # user = exim
  931. file_transport = address_file
  932. pipe_transport = address_pipe
  933.  
  934.  
  935. # This router handles forwarding using traditional .forward files in users'
  936. # home directories. If you want it also to allow mail filtering when a forward
  937. # file starts with the string "# Exim filter" or "# Sieve filter", uncomment
  938. # the "allow_filter" option.
  939.  
  940. # If you want this router to treat local parts with suffixes introduced by "-"
  941. # or "+" characters as if the suffixes did not exist, uncomment the two local_
  942. # part_suffix options. Then, for example, xxxx-foo@your.domain will be treated
  943. # in the same way as xxxx@your.domain by this router. You probably want to make
  944. # the same change to the localuser router.
  945.  
  946. # The no_verify setting means that this router is skipped when Exim is
  947. # verifying addresses. Similarly, no_expn means that this router is skipped if
  948. # Exim is processing an EXPN command.
  949.  
  950. # The check_ancestor option means that if the forward file generates an
  951. # address that is an ancestor of the current one, the current one gets
  952. # passed on instead. This covers the case where A is aliased to B and B
  953. # has a .forward file pointing to A.
  954.  
  955. # The three transports specified at the end are those that are used when
  956. # forwarding generates a direct delivery to a file, or to a pipe, or sets
  957. # up an auto-reply, respectively.
  958.  
  959. userforward:
  960. driver = redirect
  961. check_local_user
  962. # local_part_suffix = +* : -*
  963. # local_part_suffix_optional
  964. file = $home/.forward
  965. allow_filter
  966. no_verify
  967. no_expn
  968. check_ancestor
  969. file_transport = address_file
  970. pipe_transport = address_pipe
  971. reply_transport = address_reply
  972.  
  973. procmail:
  974. driver = accept
  975. check_local_user
  976. require_files = ${local_part}:+${home}/.procmailrc:/usr/bin/procmail
  977. transport = procmail
  978. no_verify
  979.  
  980. # This router matches local user mailboxes. If the router fails, the error
  981. # message is "Unknown user".
  982.  
  983. # If you want this router to treat local parts with suffixes introduced by "-"
  984. # or "+" characters as if the suffixes did not exist, uncomment the two local_
  985. # part_suffix options. Then, for example, xxxx-foo@your.domain will be treated
  986. # in the same way as xxxx@your.domain by this router.
  987.  
  988. localuser:
  989. driver = accept
  990. check_local_user
  991. # local_part_suffix = +* : -*
  992. # local_part_suffix_optional
  993. transport = local_delivery
  994. cannot_route_message = Unknown user
  995.  
  996.  
  997.  
  998. ######################################################################
  999. # TRANSPORTS CONFIGURATION #
  1000. ######################################################################
  1001. # ORDER DOES NOT MATTER #
  1002. # Only one appropriate transport is called for each delivery. #
  1003. ######################################################################
  1004.  
  1005. # A transport is used only when referenced from a router that successfully
  1006. # handles an address.
  1007.  
  1008. begin transports
  1009.  
  1010.  
  1011. # This transport is used for delivering messages over SMTP connections.
  1012.  
  1013. remote_smtp:
  1014. driver = smtp
  1015. headers_remove = X-Spam-Report:X-Spam-Bar
  1016.  
  1017. local_mysql_delivery:
  1018. driver = appendfile
  1019. # file = /var/mail/$local_part
  1020. # directory = /home/$local_part/.maildir
  1021. directory = /var/mail/${domain}/${local_part}/
  1022. maildir_format
  1023. delivery_date_add
  1024. envelope_to_add
  1025. return_path_add
  1026. user = mail
  1027. group = mail
  1028. mode = 0660
  1029. # at this time, we know a local user to get his individual preferences to tag the mail
  1030. # the '${eval:$header_X-Spam-Score-Int:}' is is a hack to cope with negative ints that seem to be parsed as strings, thus failing the comparsion
  1031. # if there's no X-Spam-Score-Int header set by data-acl above, don't panic ;-)
  1032. # another hack is that we remove important headers, we add later to be sure there are no multiple versions from earlier relays, or forged ones (this is BUGGY right now as it merges all equal headers!)
  1033. # therefore i implemented the ${sg{$header_X-Spam-Score-Int:}{^.*\n}{}} regex hack, that strips all
  1034. # headers_remove = Subject : X-Spam-Flag : X-Spam-Score-Int : X-Spam-Score : X-Spam-Bar : X-Spam-Report
  1035. headers_remove = X-Spam-Flag : X-Spam-Score-Int : X-Spam-Score : X-Spam-Bar : X-Spam-Report
  1036. # headers_add = "X-Spam-Threshold: ${lookup mysql{ \
  1037. # SELECT spam_threshold \
  1038. # FROM user \
  1039. # WHERE username='${quote_mysql:$local_part}' \
  1040. # AND domain='${quote_mysql:$domain}' \
  1041. # AND SMTP_allowed='YES' \
  1042. # }{$value}{ERROR}}\n\
  1043. # X-Spam-Score: $header_X-Spam-Score:\n\
  1044. # X-Spam-Score-Int: $header_X-Spam-Score-Int:\n\
  1045. # X-Spam-Bar: $header_X-Spam-Bar:\n\
  1046. # X-Spam-Report: $header_X-Spam-Report:\n\
  1047. # X-Spam-Flag: ${if def:header_X-Spam-Score-Int:{\
  1048. # ${if >={${eval:${sg{$header_X-Spam-Score-Int:}{^.*\n}{}}}}\
  1049. # {${lookup mysql{ \
  1050. # SELECT spam_threshold*10 \
  1051. # FROM user \
  1052. # WHERE username='${quote_mysql:$local_part}' \
  1053. # AND domain='${quote_mysql:$domain}' \
  1054. # AND SMTP_allowed='YES' \
  1055. # }{$value}{ERROR}}}{YES}{NO}}\
  1056. # }{\
  1057. # UNKNOWN\
  1058. # }}\n\
  1059. # Subject: ${if def:header_X-Spam-Score-Int:{\
  1060. # ${if >={${eval:${sg{$header_X-Spam-Score-Int:}{^.*\n}{}}}}\
  1061. # {${lookup mysql{ \
  1062. # SELECT spam_threshold*10 \
  1063. # FROM user \
  1064. # WHERE username='${quote_mysql:$local_part}' \
  1065. # AND domain='${quote_mysql:$domain}' \
  1066. # AND SMTP_allowed='YES' \
  1067. # }{$value}{ERROR}}}{${lookup mysql{ \
  1068. # SELECT spam_tag \
  1069. # FROM user \
  1070. # WHERE username='${quote_mysql:$local_part}' \
  1071. # AND domain='${quote_mysql:$domain}' \
  1072. # AND SMTP_allowed='YES' \
  1073. # }{$value}{ERROR}}$h_subject:}{$h_subject:}}\
  1074. # }{$h_subject:}}\n\
  1075. # X-Delivered-To: $original_local_part@$original_domain ($local_part@$domain)\n\
  1076. # X-Message-Age: $message_age"
  1077.  
  1078. # This transport invokes procmail to deliver mail
  1079. procmail:
  1080. driver = pipe
  1081. command = "/usr/bin/procmail -d $local_part"
  1082. return_path_add
  1083. delivery_date_add
  1084. envelope_to_add
  1085. user = $local_part
  1086. initgroups
  1087. return_output
  1088.  
  1089. # This transport is used for local delivery to user mailboxes in traditional
  1090. # BSD mailbox format. By default it will be run under the uid and gid of the
  1091. # local user, and requires the sticky bit to be set on the /var/mail directory.
  1092. # Some systems use the alternative approach of running mail deliveries under a
  1093. # particular group instead of using the sticky bit. The commented options below
  1094. # show how this can be done.
  1095.  
  1096. local_delivery:
  1097. driver = appendfile
  1098. file = /var/mail/$local_part
  1099. delivery_date_add
  1100. envelope_to_add
  1101. return_path_add
  1102. group = mail
  1103. mode = 0660
  1104.  
  1105.  
  1106. # This transport is used for handling pipe deliveries generated by alias or
  1107. # .forward files. If the pipe generates any standard output, it is returned
  1108. # to the sender of the message as a delivery error. Set return_fail_output
  1109. # instead of return_output if you want this to happen only when the pipe fails
  1110. # to complete normally. You can set different transports for aliases and
  1111. # forwards if you want to - see the references to address_pipe in the routers
  1112. # section above.
  1113.  
  1114. address_pipe:
  1115. driver = pipe
  1116. return_output
  1117.  
  1118.  
  1119. # This transport is used for handling deliveries directly to files that are
  1120. # generated by aliasing or forwarding.
  1121.  
  1122. address_file:
  1123. driver = appendfile
  1124. delivery_date_add
  1125. envelope_to_add
  1126. return_path_add
  1127.  
  1128.  
  1129. # This transport is used for handling autoreplies generated by the filtering
  1130. # option of the userforward router.
  1131.  
  1132. address_reply:
  1133. driver = autoreply
  1134.  
  1135.  
  1136. # This transport is used to deliver local mail to cyrus IMAP server via UNIX
  1137. # socket. You'll need to configure the 'localuser' router above to use it.
  1138. #
  1139. #lmtp_delivery:
  1140. # home_directory = /var/spool/imap
  1141. # driver = lmtp
  1142. # command = "/usr/lib/cyrus-imapd/deliver -l"
  1143. # batch_max = 20
  1144. # user = cyrus
  1145.  
  1146.  
  1147. ######################################################################
  1148. # RETRY CONFIGURATION #
  1149. ######################################################################
  1150.  
  1151. begin retry
  1152.  
  1153. # This single retry rule applies to all domains and all errors. It specifies
  1154. # retries every 15 minutes for 2 hours, then increasing retry intervals,
  1155. # starting at 1 hour and increasing each time by a factor of 1.5, up to 16
  1156. # hours, then retries every 6 hours until 4 days have passed since the first
  1157. # failed delivery.
  1158.  
  1159. # Address or Domain Error Retries
  1160. # ----------------- ----- -------
  1161.  
  1162. * * F,2h,15m; G,16h,1h,1.5; F,4d,6h
  1163.  
  1164.  
  1165.  
  1166. ######################################################################
  1167. # REWRITE CONFIGURATION #
  1168. ######################################################################
  1169.  
  1170. # There are no rewriting specifications in this default configuration file.
  1171.  
  1172. begin rewrite
  1173.  
  1174.  
  1175.  
  1176. ######################################################################
  1177. # AUTHENTICATION CONFIGURATION #
  1178. ######################################################################
  1179.  
  1180. # The following authenticators support plaintext username/password
  1181. # authentication using the standard PLAIN mechanism and the traditional
  1182. # but non-standard LOGIN mechanism, with Exim acting as the server.
  1183. # PLAIN and LOGIN are enough to support most MUA software.
  1184. #
  1185. # These authenticators are not complete: you need to change the
  1186. # server_condition settings to specify how passwords are verified.
  1187. # They are set up to offer authentication to the client only if the
  1188. # connection is encrypted with TLS, so you also need to add support
  1189. # for TLS. See the global configuration options section at the start
  1190. # of this file for more about TLS.
  1191. #
  1192. # The default RCPT ACL checks for successful authentication, and will accept
  1193. # messages from authenticated users from anywhere on the Internet.
  1194.  
  1195. begin authenticators
  1196.  
  1197. # PLAIN authentication has no server prompts. The client sends its
  1198. # credentials in one lump, containing an authorization ID (which we do not
  1199. # use), an authentication ID, and a password. The latter two appear as
  1200. # $auth2 and $auth3 in the configuration and should be checked against a
  1201. # valid username and password. In a real configuration you would typically
  1202. # use $auth2 as a lookup key, and compare $auth3 against the result of the
  1203. # lookup, perhaps using the crypteq{}{} condition.
  1204.  
  1205. #plain:
  1206. #driver = plaintext
  1207. #public_name = PLAIN
  1208. #server_advertise_condition = ${if eq{$tls_cipher}{}{no}{yes}}
  1209. #server_condition = ${if crypteq {$3}{\{sha1\}${lookup mysql{ \
  1210. # SELECT password_sha1 \
  1211. # FROM user \
  1212. # WHERE CONCAT(username,'@',domain)='${quote_mysql:$2}' \
  1213. # AND SMTPAUTH_allowed='YES' \
  1214. # }}}{yes}{no}}
  1215. #server_set_id = $2
  1216.  
  1217. #login:
  1218. #driver = "plaintext"
  1219. #public_name = "LOGIN"
  1220. #server_prompts = Username:: : Password::
  1221. #server_advertise_condition = ${if eq{$tls_cipher}{}{no}{yes}}
  1222. #server_condition = ${if crypteq {$2}{\{sha1\}${lookup mysql{ \
  1223. # SELECT password_sha1 \
  1224. # FROM user \
  1225. # WHERE CONCAT(username,'@',domain)='${quote_mysql:$1}' \
  1226. # AND SMTPAUTH_allowed='YES' \
  1227. # }}}{yes}{no}}
  1228. #server_set_id = $1
  1229.  
  1230.  
  1231.  
  1232.  
  1233.  
  1234.  
  1235.  
  1236.  
  1237.  
  1238. auth_login:
  1239. driver = plaintext
  1240. public_name = LOGIN
  1241. server_condition = ${if eq{$1}{${lookup mysql{SELECT CONCAT(username, '@', domain) AS username FROM `user` WHERE CONCAT(username, '@', domain)='$1' and `password`='$2'}{$value}fail}}{1}{0}}
  1242. server_prompts = "Username:: : Password::"
  1243. server_set_id = $1
  1244.  
  1245.  
  1246.  
  1247.  
  1248.  
  1249.  
  1250.  
  1251.  
  1252.  
  1253.  
  1254. #PLAIN:
  1255. # driver = plaintext
  1256. # server_set_id = $auth2
  1257. # server_prompts = :
  1258. # server_condition = ${if saslauthd{{$2}{$3}{smtp}} {1}}
  1259. # server_advertise_condition = ${if def:tls_cipher }
  1260.  
  1261. # LOGIN authentication has traditional prompts and responses. There is no
  1262. # authorization ID in this mechanism, so unlike PLAIN the username and
  1263. # password are $auth1 and $auth2. Apart from that you can use the same
  1264. # server_condition setting for both authenticators.
  1265.  
  1266. #LOGIN:
  1267. # driver = plaintext
  1268. # server_set_id = $auth1
  1269. # server_prompts = <| Username: | Password:
  1270. # server_condition = ${if saslauthd{{$1}{$2}{smtp}} {1}}
  1271. # server_advertise_condition = ${if def:tls_cipher }
  1272.  
  1273.  
  1274. ######################################################################
  1275. # CONFIGURATION FOR local_scan() #
  1276. ######################################################################
  1277.  
  1278. # If you have built Exim to include a local_scan() function that contains
  1279. # tables for private options, you can define those options here. Remember to
  1280. # uncomment the "begin" line. It is commented by default because it provokes
  1281. # an error with Exim binaries that are not built with LOCAL_SCAN_HAS_OPTIONS
  1282. # set in the Local/Makefile.
  1283.  
  1284. # begin local_scan
  1285.  
  1286.  
  1287. # End of Exim configuration file
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!