API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Jan 14th, 2012
102
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 76.49 KB | None | 0 0
raw download clone embed print report
  1. #####################################################
  2. ### main/01_exim4-config_listmacrosdefs
  3. #####################################################
  4. ######################################################################
  5. #      Runtime configuration file for Exim 4 (Debian Packaging)      #
  6. ######################################################################
  7.  
  8. ######################################################################
  9. # /etc/exim4/exim4.conf.template is only used with the non-split
  10. #   configuration scheme.
  11. # /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs is only used
  12. #   with the split configuration scheme.
  13. # If you find this comment anywhere else, somebody copied it there.
  14. # Documentation about the Debian exim4 configuration scheme can be
  15. # found in /usr/share/doc/exim4-base/README.Debian.gz.
  16. ######################################################################
  17.  
  18. ######################################################################
  19. #                    MAIN CONFIGURATION SETTINGS                     #
  20. ######################################################################
  21.  
  22. # Just for reference and scripts.
  23. # On Debian systems, the main binary is installed as exim4 to avoid
  24. # conflicts with the exim 3 packages.
  25. exim_path = /usr/sbin/exim4
  26.  
  27. # Macro defining the main configuration directory.
  28. # We do not use absolute paths.
  29. .ifndef CONFDIR
  30. CONFDIR = /etc/exim4
  31. .endif
  32.  
  33. # debconf-driven macro definitions get inserted after this line
  34. UPEX4CmacrosUPEX4C = 1
  35.  
  36. # Create domain and host lists for relay control
  37. # '@' refers to 'the name of the local host'
  38.  
  39. # List of domains considered local for exim. Domains not listed here
  40. # need to be deliverable remotely.
  41. domainlist local_domains = MAIN_LOCAL_DOMAINS
  42.  
  43. # List of recipient domains to relay _to_. Use this list if you're -
  44. # for example - fallback MX or mail gateway for domains.
  45. domainlist relay_to_domains = MAIN_RELAY_TO_DOMAINS
  46.  
  47. # List of sender networks (IP addresses) to _unconditionally_ relay
  48. # _for_. If you intend to be SMTP AUTH server, you do not need to enter
  49. # anything here.
  50. hostlist relay_from_hosts = MAIN_RELAY_NETS
  51.  
  52.  
  53. # Decide which domain to use to add to all unqualified addresses.
  54. # If MAIN_PRIMARY_HOSTNAME_AS_QUALIFY_DOMAIN is defined, the primary
  55. # hostname is used. If not, but MAIN_QUALIFY_DOMAIN is set, the value
  56. # of MAIN_QUALIFY_DOMAIN is used. If both macros are not defined,
  57. # the first line of /etc/mailname is used.
  58. .ifndef MAIN_PRIMARY_HOSTNAME_AS_QUALIFY_DOMAIN
  59. .ifndef MAIN_QUALIFY_DOMAIN
  60. qualify_domain = ETC_MAILNAME
  61. .else
  62. qualify_domain = MAIN_QUALIFY_DOMAIN
  63. .endif
  64. .endif
  65.  
  66. # listen on all all interfaces?
  67. .ifdef MAIN_LOCAL_INTERFACES
  68. local_interfaces = MAIN_LOCAL_INTERFACES
  69. .endif
  70.  
  71. .ifndef LOCAL_DELIVERY
  72. # The default transport, set in /etc/exim4/update-exim4.conf.conf,
  73. # defaulting to mail_spool. See CONFDIR/conf.d/transport/ for possibilities
  74. LOCAL_DELIVERY=mail_spool
  75. .endif
  76.  
  77. # The gecos field in /etc/passwd holds not only the name. see passwd(5).
  78. gecos_pattern = ^([^,:]*)
  79. gecos_name = $1
  80.  
  81. # define macros to be used in acl/30_exim4-config_check_rcpt to check
  82. # recipient local parts for strange characters.
  83.  
  84. # This macro definition really should be in
  85. # acl/30_exim4-config_check_rcpt but cannot be there due to
  86. # http://www.exim.org/bugzilla/show_bug.cgi?id=101 as of exim 4.62.
  87.  
  88. # These macros are documented in acl/30_exim4-config_check_rcpt,
  89. # can be changed here or overridden by a locally added configuration
  90. # file as described in README.Debian chapter 2.1.2
  91.  
  92. .ifndef CHECK_RCPT_LOCAL_LOCALPARTS
  93. CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] : ^.*[@%!/|`#&?]
  94. .endif
  95.  
  96. .ifndef CHECK_RCPT_REMOTE_LOCALPARTS
  97. CHECK_RCPT_REMOTE_LOCALPARTS = ^[./|] : ^.*[@%!`#&?] : ^.*/\\.\\./
  98. .endif
  99.  
  100. # always log tls_peerdn as we use TLS for outgoing connects by default
  101. .ifndef MAIN_LOG_SELECTOR
  102. MAIN_LOG_SELECTOR = +tls_peerdn
  103. .endif
  104. #####################################################
  105. ### end main/01_exim4-config_listmacrosdefs
  106. #####################################################
  107. #####################################################
  108. ### main/02_exim4-config_options
  109. #####################################################
  110.  
  111. ### main/02_exim4-config_options
  112. #################################
  113.  
  114.  
  115. # Defines the access control list that is run when an
  116. # SMTP MAIL command is received.
  117. #
  118. .ifndef MAIN_ACL_CHECK_MAIL
  119. MAIN_ACL_CHECK_MAIL = acl_check_mail
  120. .endif
  121. acl_smtp_mail = MAIN_ACL_CHECK_MAIL
  122.  
  123.  
  124. # Defines the access control list that is run when an
  125. # SMTP RCPT command is received.
  126. #
  127. .ifndef MAIN_ACL_CHECK_RCPT
  128. MAIN_ACL_CHECK_RCPT = acl_check_rcpt
  129. .endif
  130. acl_smtp_rcpt = MAIN_ACL_CHECK_RCPT
  131.  
  132.  
  133. # Defines the access control list that is run when an
  134. # SMTP DATA command is received.
  135. #
  136. .ifndef MAIN_ACL_CHECK_DATA
  137. MAIN_ACL_CHECK_DATA = acl_check_data
  138. .endif
  139. acl_smtp_data = MAIN_ACL_CHECK_DATA
  140.  
  141.  
  142. # Message size limit. The default (used when MESSAGE_SIZE_LIMIT
  143. # is unset) is 50 MB
  144. .ifdef MESSAGE_SIZE_LIMIT
  145. message_size_limit = MESSAGE_SIZE_LIMIT
  146. .endif
  147.  
  148.  
  149. # If you are running exim4-daemon-heavy or a custom version of Exim that
  150. # was compiled with the content-scanning extension, you can cause incoming
  151. # messages to be automatically scanned for viruses. You have to modify the
  152. # configuration in two places to set this up. The first of them is here,
  153. # where you define the interface to your scanner. This example is typical
  154. # for ClamAV; see the manual for details of what to set for other virus
  155. # scanners. The second modification is in the acl_check_data access
  156. # control list.
  157.  
  158. # av_scanner = clamd:/tmp/clamd
  159.  
  160.  
  161. # For spam scanning, there is a similar option that defines the interface to
  162. # SpamAssassin. You do not need to set this if you are using the default, which
  163. # is shown in this commented example. As for virus scanning, you must also
  164. # modify the acl_check_data access control list to enable spam scanning.
  165.  
  166. # spamd_address = 127.0.0.1 783
  167.  
  168. # Domain used to qualify unqualified recipient addresses
  169. # If this option is not set, the qualify_domain value is used.
  170. # qualify_recipient = <value of qualify_domain>
  171.  
  172.  
  173. # Allow Exim to recognize addresses of the form "user@[10.11.12.13]",
  174. # where the domain part is a "domain literal" (an IP address) instead
  175. # of a named domain. The RFCs require this facility, but it is disabled
  176. # in the default config since it is seldomly used and frequently abused.
  177. # Domain literal support also needs a special router, which is automatically
  178. # enabled if you use the enable macro MAIN_ALLOW_DOMAIN_LITERALS.
  179. # Additionally, you might want to make your local IP addresses (or @[])
  180. # local domains.
  181. .ifdef MAIN_ALLOW_DOMAIN_LITERALS
  182. allow_domain_literals
  183. .endif
  184.  
  185.  
  186. # Do a reverse DNS lookup on all incoming IP calls, in order to get the
  187. # true host name. If you feel this is too expensive, the networks for
  188. # which a lookup is done can be listed here.
  189. .ifndef DC_minimaldns
  190. .ifndef MAIN_HOST_LOOKUP
  191. MAIN_HOST_LOOKUP = *
  192. .endif
  193. host_lookup = MAIN_HOST_LOOKUP
  194. .endif
  195.  
  196.  
  197. # In a minimaldns setup, update-exim4.conf guesses the hostname and
  198. # dumps it here to avoid DNS lookups being done at Exim run time.
  199. .ifdef MAIN_HARDCODE_PRIMARY_HOSTNAME
  200. primary_hostname = MAIN_HARDCODE_PRIMARY_HOSTNAME
  201. .endif
  202.  
  203. # The settings below, which are actually the same as the defaults in the
  204. # code, cause Exim to make RFC 1413 (ident) callbacks for all incoming SMTP
  205. # calls. You can limit the hosts to which these calls are made, and/or change
  206. # the timeout that is used. If you set the timeout to zero, all RFC 1413 calls
  207. # are disabled. RFC 1413 calls are cheap and can provide useful information
  208. # for tracing problem messages, but some hosts and firewalls are
  209. # misconfigured to drop the requests instead of either answering or
  210. # rejecting them. This can result in a timeout instead of an immediate refused
  211. # connection, leading to delays on starting up SMTP sessions. (The default was
  212. # reduced from 30s to 5s for release 4.61.)
  213. # rfc1413_hosts = *
  214. # rfc1413_query_timeout = 5s
  215.  
  216. # When using an external relay tester (such as rt.njabl.org and/or the
  217. # currently defunct relay-test.mail-abuse.org, the test may be aborted
  218. # since exim complains about "too many nonmail commands". If you want
  219. # the test to complete, add the host from where "your" relay tester
  220. # connects from to the MAIN_SMTP_ACCEPT_MAX_NOMAIL_HOSTS macro.
  221. # Please note that a non-empty setting may cause extra DNS lookups to
  222. # happen, which is the reason why this option is commented out in the
  223. # default settings.
  224. # MAIN_SMTP_ACCEPT_MAX_NOMAIL_HOSTS = !rt.njabl.org
  225. .ifdef MAIN_SMTP_ACCEPT_MAX_NOMAIL_HOSTS
  226. smtp_accept_max_nonmail_hosts = MAIN_SMTP_ACCEPT_MAX_NOMAIL_HOSTS
  227. .endif
  228.  
  229. # By default, exim forces a Sender: header containing the local
  230. # account name at the local host name in all locally submitted messages
  231. # that don't have the local account name at the local host name in the
  232. # From: header, deletes any Sender: header present in the submitted
  233. # message and forces the envelope sender of all locally submitted
  234. # messages to the local account name at the local host name.
  235. # The following settings allow local users to specify their own envelope sender
  236. # in a locally submitted message. Sender: headers existing in a locally
  237. # submitted message are not removed, and no automatic Sender: headers
  238. # are added. These settings are fine for most hosts.
  239. # If you run exim on a classical multi-user systems where all users
  240. # have local mailboxes that can be reached via SMTP from the Internet
  241. # with the local FQDN as the domain part of the address, you might want
  242. # to disable the following three lines for traceability reasons.
  243. .ifndef MAIN_FORCE_SENDER
  244. local_from_check = false
  245. local_sender_retain = true
  246. untrusted_set_sender = *
  247. .endif
  248.  
  249.  
  250. # By default, Exim expects all envelope addresses to be fully qualified, that
  251. # is, they must contain both a local part and a domain. Configure exim
  252. # to accept unqualified addresses from certain hosts. When this is done,
  253. # unqualified addresses are qualified using the settings of qualify_domain
  254. # and/or qualify_recipient (see above).
  255. # sender_unqualified_hosts = <unset>
  256. # recipient_unqualified_hosts = <unset>
  257.  
  258.  
  259. # Configure Exim to support the "percent hack" for certain domains.
  260. # The "percent hack" is the feature by which mail addressed to x%y@z
  261. # (where z is one of the domains listed) is locally rerouted to x@y
  262. # and sent on. If z is not one of the "percent hack" domains, x%y is
  263. # treated as an ordinary local part. The percent hack is rarely needed
  264. # nowadays but frequently abused. You should not enable it unless you
  265. # are sure that you really need it.
  266. # percent_hack_domains = <unset>
  267.  
  268.  
  269. # Bounce handling
  270. .ifndef MAIN_IGNORE_BOUNCE_ERRORS_AFTER
  271. MAIN_IGNORE_BOUNCE_ERRORS_AFTER = 2d
  272. .endif
  273. ignore_bounce_errors_after = MAIN_IGNORE_BOUNCE_ERRORS_AFTER
  274.  
  275. .ifndef MAIN_TIMEOUT_FROZEN_AFTER
  276. MAIN_TIMEOUT_FROZEN_AFTER = 7d
  277. .endif
  278. timeout_frozen_after = MAIN_TIMEOUT_FROZEN_AFTER
  279.  
  280. .ifndef MAIN_FREEZE_TELL
  281. MAIN_FREEZE_TELL = postmaster
  282. .endif
  283. freeze_tell = MAIN_FREEZE_TELL
  284.  
  285.  
  286. # Define spool directory
  287. .ifndef SPOOLDIR
  288. SPOOLDIR = /var/spool/exim4
  289. .endif
  290. spool_directory = SPOOLDIR
  291.  
  292.  
  293. # trusted users can set envelope-from to arbitrary values
  294. .ifndef MAIN_TRUSTED_USERS
  295. MAIN_TRUSTED_USERS = uucp
  296. .endif
  297. trusted_users = MAIN_TRUSTED_USERS
  298. .ifdef MAIN_TRUSTED_GROUPS
  299. trusted_groups = MAIN_TRUSTED_GROUPS
  300. .endif
  301.  
  302.  
  303. # users in admin group can do many other things
  304. # admin_groups = <unset>
  305.  
  306.  
  307. # SMTP Banner. The example includes the Debian version in the SMTP dialog
  308. # MAIN_SMTP_BANNER = "${primary_hostname} ESMTP Exim ${version_number} (Debian package MAIN_PACKAGE_VERSION) ${tod_full}"
  309. # smtp_banner = $smtp_active_hostname ESMTP Exim $version_number $tod_full
  310. #####################################################
  311. ### end main/02_exim4-config_options
  312. #####################################################
  313. #####################################################
  314. ### main/03_exim4-config_tlsoptions
  315. #####################################################
  316.  
  317. ### main/03_exim4-config_tlsoptions
  318. #################################
  319.  
  320. # TLS/SSL configuration for exim as an SMTP server.
  321. # See /usr/share/doc/exim4-base/README.Debian.gz for explanations.
  322.  
  323. .ifdef MAIN_TLS_ENABLE
  324. # Defines what hosts to 'advertise' STARTTLS functionality to. The
  325. # default, *, will advertise to all hosts that connect with EHLO.
  326. .ifndef MAIN_TLS_ADVERTISE_HOSTS
  327. MAIN_TLS_ADVERTISE_HOSTS = *
  328. .endif
  329. tls_advertise_hosts = MAIN_TLS_ADVERTISE_HOSTS
  330.  
  331.  
  332. # Full paths to Certificate and Private Key. The Private Key file
  333. # must be kept 'secret' and should be owned by root.Debian-exim mode
  334. # 640 (-rw-r-----). exim-gencert takes care of these prerequisites.
  335. # Normally, exim4 looks for certificate and key in different files:
  336. #   MAIN_TLS_CERTIFICATE - path to certificate file,
  337. #                          CONFDIR/exim.crt if unset
  338. #   MAIN_TLS_PRIVATEKEY  - path to private key file
  339. #                          CONFDIR/exim.key if unset
  340. # You can also configure exim to look for certificate and key in the
  341. # same file, set MAIN_TLS_CERTKEY to that file to enable. This takes
  342. # precedence over all other settings regarding certificate and key file.
  343. .ifdef MAIN_TLS_CERTKEY
  344. tls_certificate = MAIN_TLS_CERTKEY
  345. .else
  346. .ifndef MAIN_TLS_CERTIFICATE
  347. MAIN_TLS_CERTIFICATE = CONFDIR/exim.crt
  348. .endif
  349. tls_certificate = MAIN_TLS_CERTIFICATE
  350.  
  351. .ifndef MAIN_TLS_PRIVATEKEY
  352. MAIN_TLS_PRIVATEKEY = CONFDIR/exim.key
  353. .endif
  354. tls_privatekey = MAIN_TLS_PRIVATEKEY
  355. .endif
  356.  
  357. # Pointer to the CA Certificates against which client certificates are
  358. # checked. This is controlled by the `tls_verify_hosts' and
  359. # `tls_try_verify_hosts' lists below.
  360. # If you want to check server certificates, you need to add an
  361. # tls_verify_certificates statement to the smtp transport.
  362. # /etc/ssl/certs/ca-certificates.crt is generated by
  363. # the "ca-certificates" package's update-ca-certificates(8) command.
  364. .ifndef MAIN_TLS_VERIFY_CERTIFICATES
  365. MAIN_TLS_VERIFY_CERTIFICATES = ${if exists{/etc/ssl/certs/ca-certificates.crt}\
  366.                                     {/etc/ssl/certs/ca-certificates.crt}\
  367.                     {/dev/null}}
  368. .endif
  369. tls_verify_certificates = MAIN_TLS_VERIFY_CERTIFICATES
  370.  
  371.  
  372. # A list of hosts which are constrained by `tls_verify_certificates'. A host
  373. # that matches `tls_verify_host' must present a certificate that is
  374. # verifyable through `tls_verify_certificates' in order to be accepted as an
  375. # SMTP client. If it does not, the connection is aborted.
  376. .ifdef MAIN_TLS_VERIFY_HOSTS
  377. tls_verify_hosts = MAIN_TLS_VERIFY_HOSTS
  378. .endif
  379.  
  380. # A weaker form of checking: if a client matches `tls_try_verify_hosts' (but
  381. # not `tls_verify_hosts'), request a certificate and check it against
  382. # `tls_verify_certificates' but do not abort the connection if there is no
  383. # certificate or if the certificate presented does not match. (This
  384. # condition can be tested for in ACLs through `verify = certificate')
  385. # By default, this check is done for all hosts. It is known that some
  386. # clients (including incredimail's version downloadable in February
  387. # 2008) choke on this. To disable, set MAIN_TLS_TRY_VERIFY_HOSTS to an
  388. # empty value.
  389. .ifdef MAIN_TLS_TRY_VERIFY_HOSTS
  390. tls_try_verify_hosts = MAIN_TLS_TRY_VERIFY_HOSTS
  391. .endif
  392.  
  393. .endif
  394. #####################################################
  395. ### end main/03_exim4-config_tlsoptions
  396. #####################################################
  397. #####################################################
  398. ### main/90_exim4-config_log_selector
  399. #####################################################
  400.  
  401. ### main/90_exim4-config_log_selector
  402. #################################
  403.  
  404. # uncomment this for debugging
  405. # MAIN_LOG_SELECTOR == MAIN_LOG_SELECTOR +all -subject -arguments
  406.  
  407. .ifdef MAIN_LOG_SELECTOR
  408. log_selector = MAIN_LOG_SELECTOR
  409. .endif
  410. #####################################################
  411. ### end main/90_exim4-config_log_selector
  412. #####################################################
  413. #####################################################
  414. ### acl/00_exim4-config_header
  415. #####################################################
  416.  
  417. ######################################################################
  418. #                       ACL CONFIGURATION                            #
  419. #         Specifies access control lists for incoming SMTP mail      #
  420. ######################################################################
  421. begin acl
  422.  
  423.  
  424. #####################################################
  425. ### end acl/00_exim4-config_header
  426. #####################################################
  427. #####################################################
  428. ### acl/20_exim4-config_local_deny_exceptions
  429. #####################################################
  430.  
  431. ### acl/20_exim4-config_local_deny_exceptions
  432. #################################
  433.  
  434. # This is used to determine whitelisted senders and hosts.
  435. # It checks for CONFDIR/host_local_deny_exceptions and
  436. # CONFDIR/sender_local_deny_exceptions.
  437. #
  438. # It is meant to be used from some other acl entry.
  439. #
  440. # See exim4-config_files(5) for details.
  441. #
  442. # If the files do not exist, the white list never matches, which is
  443. # the desired behaviour.
  444. #
  445. # The old file names CONFDIR/local_host_whitelist and
  446. # CONFDIR/local_sender_whitelist will continue to be honored for a
  447. # transition period. Their use is deprecated.
  448.  
  449. acl_local_deny_exceptions:
  450.   accept
  451.     hosts = ${if exists{CONFDIR/host_local_deny_exceptions}\
  452.                  {CONFDIR/host_local_deny_exceptions}\
  453.                  {}}
  454.   accept
  455.     senders = ${if exists{CONFDIR/sender_local_deny_exceptions}\
  456.                    {CONFDIR/sender_local_deny_exceptions}\
  457.                    {}}
  458.   accept
  459.     hosts = ${if exists{CONFDIR/local_host_whitelist}\
  460.                  {CONFDIR/local_host_whitelist}\
  461.                  {}}
  462.   accept
  463.     senders = ${if exists{CONFDIR/local_sender_whitelist}\
  464.                    {CONFDIR/local_sender_whitelist}\
  465.                    {}}
  466.  
  467.   # This hook allows you to hook in your own ACLs without having to
  468.   # modify this file. If you do it like we suggest, you'll end up with
  469.   # a small performance penalty since there is an additional file being
  470.   # accessed. This doesn't happen if you leave the macro unset.
  471.   .ifdef LOCAL_DENY_EXCEPTIONS_LOCAL_ACL_FILE
  472.   .include LOCAL_DENY_EXCEPTIONS_LOCAL_ACL_FILE
  473.   .endif
  474.  
  475.   # this is still supported for a transition period and is deprecated.
  476.   .ifdef WHITELIST_LOCAL_DENY_LOCAL_ACL_FILE
  477.   .include WHITELIST_LOCAL_DENY_LOCAL_ACL_FILE
  478.   .endif
  479. #####################################################
  480. ### end acl/20_exim4-config_local_deny_exceptions
  481. #####################################################
  482. #####################################################
  483. ### acl/30_exim4-config_check_mail
  484. #####################################################
  485.  
  486. ### acl/30_exim4-config_check_mail
  487. #################################
  488.  
  489. # This access control list is used for every MAIL command in an incoming
  490. # SMTP message. The tests are run in order until the address is either
  491. # accepted or denied.
  492. #
  493. acl_check_mail:
  494.   .ifdef CHECK_MAIL_HELO_ISSUED
  495.   deny
  496.     message = no HELO given before MAIL command
  497.     condition = ${if def:sender_helo_name {no}{yes}}
  498.   .endif
  499.  
  500.   accept
  501. #####################################################
  502. ### end acl/30_exim4-config_check_mail
  503. #####################################################
  504. #####################################################
  505. ### acl/30_exim4-config_check_rcpt
  506. #####################################################
  507.  
  508. ### acl/30_exim4-config_check_rcpt
  509. #################################
  510.  
  511. # This access control list is used for every RCPT command in an incoming
  512. # SMTP message. The tests are run in order until the address is either
  513. # accepted or denied.
  514. #
  515. acl_check_rcpt:
  516.  
  517.   # Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
  518.   # testing for an empty sending host field.
  519.   accept
  520.     hosts = :
  521.     control = dkim_disable_verify
  522.  
  523.  
  524.   # The following section of the ACL is concerned with local parts that contain
  525.   # certain non-alphanumeric characters. Dots in unusual places are
  526.   # handled by this ACL as well.
  527.   #
  528.   # Non-alphanumeric characters other than dots are rarely found in genuine
  529.   # local parts, but are often tried by people looking to circumvent
  530.   # relaying restrictions. Therefore, although they are valid in local
  531.   # parts, these rules disallow certain non-alphanumeric characters, as
  532.   # a precaution.
  533.   #
  534.   # Empty components (two dots in a row) are not valid in RFC 2822, but Exim
  535.   # allows them because they have been encountered. (Consider local parts
  536.   # constructed as "firstinitial.secondinitial.familyname" when applied to
  537.   # a name without a second initial.) However, a local part starting
  538.   # with a dot or containing /../ can cause trouble if it is used as part of a
  539.   # file name (e.g. for a mailing list). This is also true for local parts that
  540.   # contain slashes. A pipe symbol can also be troublesome if the local part is
  541.   # incorporated unthinkingly into a shell command line.
  542.   #
  543.   # These ACL components will block recipient addresses that are valid
  544.   # from an RFC2822 point of view. We chose to have them blocked by
  545.   # default for security reasons.
  546.   #
  547.   # If you feel that your site should have less strict recipient
  548.   # checking, please feel free to change the default values of the macros
  549.   # defined in main/01_exim4-config_listmacrosdefs or override them from a
  550.   # local configuration file.
  551.   #
  552.   # Two different rules are used. The first one has a quite strict
  553.   # default, and is applied to messages that are addressed to one of the
  554.   # local domains handled by this host.
  555.  
  556.   # The default value of CHECK_RCPT_LOCAL_LOCALPARTS is defined in
  557.   # main/01_exim4-config_listmacrosdefs:
  558.   # CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] : ^.*[@%!/|`#&?]
  559.   # This blocks local parts that begin with a dot or contain a quite
  560.   # broad range of non-alphanumeric characters.
  561.   .ifdef CHECK_RCPT_LOCAL_LOCALPARTS
  562.   deny
  563.     domains = +local_domains
  564.     local_parts = CHECK_RCPT_LOCAL_LOCALPARTS
  565.     message = restricted characters in address
  566.   .endif
  567.  
  568.  
  569.   # The second rule applies to all other domains, and its default is
  570.   # considerably less strict.
  571.  
  572.   # The default value of CHECK_RCPT_REMOTE_LOCALPARTS is defined in
  573.   # main/01_exim4-config_listmacrosdefs:
  574.   # CHECK_RCPT_REMOTE_LOCALPARTS = ^[./|] : ^.*[@%!`#&?] : ^.*/\\.\\./
  575.  
  576.   # It allows local users to send outgoing messages to sites
  577.   # that use slashes and vertical bars in their local parts. It blocks
  578.   # local parts that begin with a dot, slash, or vertical bar, but allows
  579.   # these characters within the local part. However, the sequence /../ is
  580.   # barred. The use of some other non-alphanumeric characters is blocked.
  581.   # Single quotes might probably be dangerous as well, but they're
  582.   # allowed by the default regexps to avoid rejecting mails to Ireland.
  583.   # The motivation here is to prevent local users (or local users' malware)
  584.   # from mounting certain kinds of attack on remote sites.
  585.   .ifdef CHECK_RCPT_REMOTE_LOCALPARTS
  586.   deny
  587.     domains = !+local_domains
  588.     local_parts = CHECK_RCPT_REMOTE_LOCALPARTS
  589.     message = restricted characters in address
  590.   .endif
  591.  
  592.  
  593.   # Accept mail to postmaster in any local domain, regardless of the source,
  594.   # and without verifying the sender.
  595.   #
  596.   accept
  597.     .ifndef CHECK_RCPT_POSTMASTER
  598.     local_parts = postmaster
  599.     .else
  600.     local_parts = CHECK_RCPT_POSTMASTER
  601.     .endif
  602.     domains = +local_domains : +relay_to_domains
  603.  
  604.  
  605.   # Deny unless the sender address can be verified.
  606.   #
  607.   # This is disabled by default so that DNSless systems don't break. If
  608.   # your system can do DNS lookups without delay or cost, you might want
  609.   # to enable this feature.
  610.   #
  611.   # This feature does not work in smarthost and satellite setups as
  612.   # with these setups all domains pass verification. See spec.txt chapter
  613.   # 39.31 with the added information that a smarthost/satellite setup
  614.   # routes all non-local e-mail to the smarthost.
  615.   .ifdef CHECK_RCPT_VERIFY_SENDER
  616.   deny
  617.     message = Sender verification failed
  618.     !acl = acl_local_deny_exceptions
  619.     !verify = sender
  620.   .endif
  621.  
  622.   # Verify senders listed in local_sender_callout with a callout.
  623.   #
  624.   # In smarthost and satellite setups, this causes the callout to be
  625.   # done to the smarthost. Verification will thus only be reliable if the
  626.   # smarthost does reject illegal addresses in the SMTP dialog.
  627.   deny
  628.     !acl = acl_local_deny_exceptions
  629.     senders = ${if exists{CONFDIR/local_sender_callout}\
  630.                          {CONFDIR/local_sender_callout}\
  631.                    {}}
  632.     !verify = sender/callout
  633.  
  634.  
  635.   # Accept if the message comes from one of the hosts for which we are an
  636.   # outgoing relay. It is assumed that such hosts are most likely to be MUAs,
  637.   # so we set control=submission to make Exim treat the message as a
  638.   # submission. It will fix up various errors in the message, for example, the
  639.   # lack of a Date: header line. If you are actually relaying out out from
  640.   # MTAs, you may want to disable this. If you are handling both relaying from
  641.   # MTAs and submissions from MUAs you should probably split them into two
  642.   # lists, and handle them differently.
  643.  
  644.   # Recipient verification is omitted here, because in many cases the clients
  645.   # are dumb MUAs that don't cope well with SMTP error responses. If you are
  646.   # actually relaying out from MTAs, you should probably add recipient
  647.   # verification here.
  648.  
  649.   # Note that, by putting this test before any DNS black list checks, you will
  650.   # always accept from these hosts, even if they end up on a black list. The
  651.   # assumption is that they are your friends, and if they get onto black
  652.   # list, it is a mistake.
  653.   accept
  654.     hosts = +relay_from_hosts
  655.     control = submission/sender_retain
  656.     control = dkim_disable_verify
  657.  
  658.  
  659.   # Accept if the message arrived over an authenticated connection, from
  660.   # any host. Again, these messages are usually from MUAs, so recipient
  661.   # verification is omitted, and submission mode is set. And again, we do this
  662.   # check before any black list tests.
  663.   accept
  664.     authenticated = *
  665.     control = submission/sender_retain
  666.     control = dkim_disable_verify
  667.  
  668.  
  669.   # Insist that any other recipient address that we accept is either in one of
  670.   # our local domains, or is in a domain for which we explicitly allow
  671.   # relaying. Any other domain is rejected as being unacceptable for relaying.
  672.   require
  673.     message = relay not permitted
  674.     domains = +local_domains : +relay_to_domains
  675.  
  676.  
  677.   # We also require all accepted addresses to be verifiable. This check will
  678.   # do local part verification for local domains, but only check the domain
  679.   # for remote domains.
  680.   require
  681.     verify = recipient
  682.  
  683.  
  684.   # Verify recipients listed in local_rcpt_callout with a callout.
  685.   # This is especially handy for forwarding MX hosts (secondary MX or
  686.   # mail hubs) of domains that receive a lot of spam to non-existent
  687.   # addresses.  The only way to check local parts for remote relay
  688.   # domains is to use a callout (add /callout), but please read the
  689.   # documentation about callouts before doing this.
  690.   deny
  691.     !acl = acl_local_deny_exceptions
  692.     recipients = ${if exists{CONFDIR/local_rcpt_callout}\
  693.                             {CONFDIR/local_rcpt_callout}\
  694.                       {}}
  695.     !verify = recipient/callout
  696.  
  697.  
  698.   # CONFDIR/local_sender_blacklist holds a list of envelope senders that
  699.   # should have their access denied to the local host. Incoming messages
  700.   # with one of these senders are rejected at RCPT time.
  701.   #
  702.   # The explicit white lists are honored as well as negative items in
  703.   # the black list. See exim4-config_files(5) for details.
  704.   deny
  705.     message = sender envelope address $sender_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
  706.     !acl = acl_local_deny_exceptions
  707.     senders = ${if exists{CONFDIR/local_sender_blacklist}\
  708.                    {CONFDIR/local_sender_blacklist}\
  709.                    {}}
  710.  
  711.  
  712.   # deny bad sites (IP address)
  713.   # CONFDIR/local_host_blacklist holds a list of host names, IP addresses
  714.   # and networks (CIDR notation)  that should have their access denied to
  715.   # The local host. Messages coming in from a listed host will have all
  716.   # RCPT statements rejected.
  717.   #
  718.   # The explicit white lists are honored as well as negative items in
  719.   # the black list. See exim4-config_files(5) for details.
  720.   deny
  721.     message = sender IP address $sender_host_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
  722.     !acl = acl_local_deny_exceptions
  723.     hosts = ${if exists{CONFDIR/local_host_blacklist}\
  724.                  {CONFDIR/local_host_blacklist}\
  725.                  {}}
  726.  
  727.  
  728.   # Warn if the sender host does not have valid reverse DNS.
  729.   #
  730.   # If your system can do DNS lookups without delay or cost, you might want
  731.   # to enable this.
  732.   # If sender_host_address is defined, it's a remote call.  If
  733.   # sender_host_name is not defined, then reverse lookup failed.  Use
  734.   # this instead of !verify = reverse_host_lookup to catch deferrals
  735.   # as well as outright failures.
  736.   .ifdef CHECK_RCPT_REVERSE_DNS
  737.   warn
  738.     condition = ${if and{{def:sender_host_address}{!def:sender_host_name}}\
  739.                       {yes}{no}}
  740.     add_header = X-Host-Lookup-Failed: Reverse DNS lookup failed for $sender_host_address (${if eq{$host_lookup_failed}{1}{failed}{deferred}})
  741.   .endif
  742.  
  743.  
  744.   # Use spfquery to perform a pair of SPF checks (for details, see
  745.   # http://www.openspf.org/)
  746.   #
  747.   # This is quite costly in terms of DNS lookups (~6 lookups per mail).  Do not
  748.   # enable if that's an issue.  Also note that if you enable this, you must
  749.   # install "spf-tools-perl" which provides the spfquery command.
  750.   # Missing spf-tools-perl will trigger the "Unexpected error in
  751.   # SPF check" warning.
  752.   .ifdef CHECK_RCPT_SPF
  753.   deny
  754.     message = [SPF] $sender_host_address is not allowed to send mail from \
  755.               ${if def:sender_address_domain {$sender_address_domain}{$sender_helo_name}}.  \
  756.               Please see \
  757.           http://www.openspf.org/Why?scope=${if def:sender_address_domain \
  758.               {mfrom}{helo}};identity=${if def:sender_address_domain \
  759.               {$sender_address}{$sender_helo_name}};ip=$sender_host_address
  760.     log_message = SPF check failed.
  761.     !acl = acl_local_deny_exceptions
  762.     condition = ${run{/usr/bin/spfquery.mail-spf-perl --ip \
  763.                    \"$sender_host_address\" --identity \
  764.                    ${if def:sender_address_domain \
  765.                        {--scope mfrom  --identity \"$sender_address\"}\
  766.                        {--scope helo --identity  \"$sender_helo_name\"}}}\
  767.                    {no}{${if eq {$runrc}{1}{yes}{no}}}}
  768.  
  769.   defer
  770.     message = Temporary DNS error while checking SPF record.  Try again later.
  771.     !acl = acl_local_deny_exceptions
  772.     condition = ${if eq {$runrc}{5}{yes}{no}}
  773.  
  774.   warn
  775.     condition = ${if <={$runrc}{6}{yes}{no}}
  776.     add_header = Received-SPF: ${if eq {$runrc}{0}{pass}\
  777.                                 {${if eq {$runrc}{2}{softfail}\
  778.                                  {${if eq {$runrc}{3}{neutral}\
  779.                   {${if eq {$runrc}{4}{permerror}\
  780.                    {${if eq {$runrc}{6}{none}{error}}}}}}}}}\
  781.                 } client-ip=$sender_host_address; \
  782.                 ${if def:sender_address_domain \
  783.                    {envelope-from=${sender_address}; }{}}\
  784.                 helo=$sender_helo_name
  785.  
  786.   warn
  787.     log_message = Unexpected error in SPF check.
  788.     condition = ${if >{$runrc}{6}{yes}{no}}
  789.   .endif
  790.  
  791.  
  792.   # Check against classic DNS "black" lists (DNSBLs) which list
  793.   # sender IP addresses
  794.   .ifdef CHECK_RCPT_IP_DNSBLS
  795.   warn
  796.     dnslists = CHECK_RCPT_IP_DNSBLS
  797.     add_header = X-Warning: $sender_host_address is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
  798.     log_message = $sender_host_address is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
  799.   .endif
  800.  
  801.  
  802.   # Check against DNSBLs which list sender domains, with an option to locally
  803.   # whitelist certain domains that might be blacklisted.
  804.   #
  805.   # Note: If you define CHECK_RCPT_DOMAIN_DNSBLS, you must append
  806.   # "/$sender_address_domain" after each domain.  For example:
  807.   # CHECK_RCPT_DOMAIN_DNSBLS = rhsbl.foo.org/$sender_address_domain \
  808.   #                            : rhsbl.bar.org/$sender_address_domain
  809.   .ifdef CHECK_RCPT_DOMAIN_DNSBLS
  810.   warn
  811.     !senders = ${if exists{CONFDIR/local_domain_dnsbl_whitelist}\
  812.                     {CONFDIR/local_domain_dnsbl_whitelist}\
  813.                     {}}
  814.     dnslists = CHECK_RCPT_DOMAIN_DNSBLS
  815.     add_header = X-Warning: $sender_address_domain is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
  816.     log_message = $sender_address_domain is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
  817.   .endif
  818.  
  819.  
  820.   # This hook allows you to hook in your own ACLs without having to
  821.   # modify this file. If you do it like we suggest, you'll end up with
  822.   # a small performance penalty since there is an additional file being
  823.   # accessed. This doesn't happen if you leave the macro unset.
  824.   .ifdef CHECK_RCPT_LOCAL_ACL_FILE
  825.   .include CHECK_RCPT_LOCAL_ACL_FILE
  826.   .endif
  827.  
  828.  
  829.   #############################################################################
  830.   # This check is commented out because it is recognized that not every
  831.   # sysadmin will want to do it. If you enable it, the check performs
  832.   # Client SMTP Authorization (csa) checks on the sending host. These checks
  833.   # do DNS lookups for SRV records. The CSA proposal is currently (May 2005)
  834.   # an Internet draft. You can, of course, add additional conditions to this
  835.   # ACL statement to restrict the CSA checks to certain hosts only.
  836.   #
  837.   # require verify = csa
  838.   #############################################################################
  839.  
  840.  
  841.   # Accept if the address is in a domain for which we are an incoming relay,
  842.   # but again, only if the recipient can be verified.
  843.  
  844.   accept
  845.     domains = +relay_to_domains
  846.     endpass
  847.     verify = recipient
  848.  
  849.  
  850.   # At this point, the address has passed all the checks that have been
  851.   # configured, so we accept it unconditionally.
  852.  
  853.   accept
  854. #####################################################
  855. ### end acl/30_exim4-config_check_rcpt
  856. #####################################################
  857. #####################################################
  858. ### acl/40_exim4-config_check_data
  859. #####################################################
  860.  
  861. ### acl/40_exim4-config_check_data
  862. #################################
  863.  
  864. # This ACL is used after the contents of a message have been received. This
  865. # is the ACL in which you can test a message's headers or body, and in
  866. # particular, this is where you can invoke external virus or spam scanners.
  867.  
  868. acl_check_data:
  869.  
  870.   # Deny unless the address list headers are syntactically correct.
  871.   #
  872.   # If you enable this, you might reject legitimate mail.
  873.   .ifdef CHECK_DATA_VERIFY_HEADER_SYNTAX
  874.   deny
  875.     message = Message headers fail syntax check
  876.     !acl = acl_local_deny_exceptions
  877.     !verify = header_syntax
  878.   .endif
  879.  
  880.  
  881.   # require that there is a verifiable sender address in at least
  882.   # one of the "Sender:", "Reply-To:", or "From:" header lines.
  883.   .ifdef CHECK_DATA_VERIFY_HEADER_SENDER
  884.   deny
  885.     message = No verifiable sender address in message headers
  886.     !acl = acl_local_deny_exceptions
  887.     !verify = header_sender
  888.   .endif
  889.  
  890.  
  891.   # Deny if the message contains malware. Before enabling this check, you
  892.   # must install a virus scanner and set the av_scanner option in the
  893.   # main configuration.
  894.   #
  895.   # exim4-daemon-heavy must be used for this section to work.
  896.   #
  897.   # deny
  898.   #   malware = *
  899.   #   message = This message was detected as possible malware ($malware_name).
  900.  
  901.  
  902.   # Add headers to a message if it is judged to be spam. Before enabling this,
  903.   # you must install SpamAssassin. You also need to set the spamd_address
  904.   # option in the main configuration.
  905.   #
  906.   # exim4-daemon-heavy must be used for this section to work.
  907.   #
  908.   # Please note that this is only suiteable as an example. There are
  909.   # multiple issues with this configuration method. For example, if you go
  910.   # this way, you'll give your spamassassin daemon write access to the
  911.   # entire exim spool which might be a security issue in case of a
  912.   # spamassassin exploit.
  913.   #
  914.   # See the exim docs and the exim wiki for more suitable examples.
  915.   #
  916.   # warn
  917.   #   spam = Debian-exim:true
  918.   #   add_header = X-Spam_score: $spam_score\n\
  919.   #             X-Spam_score_int: $spam_score_int\n\
  920.   #             X-Spam_bar: $spam_bar\n\
  921.   #             X-Spam_report: $spam_report
  922.  
  923.  
  924.   # This hook allows you to hook in your own ACLs without having to
  925.   # modify this file. If you do it like we suggest, you'll end up with
  926.   # a small performance penalty since there is an additional file being
  927.   # accessed. This doesn't happen if you leave the macro unset.
  928.   .ifdef CHECK_DATA_LOCAL_ACL_FILE
  929.   .include CHECK_DATA_LOCAL_ACL_FILE
  930.   .endif
  931.  
  932.  
  933.   # accept otherwise
  934.   accept
  935. #####################################################
  936. ### end acl/40_exim4-config_check_data
  937. #####################################################
  938. #####################################################
  939. ### router/00_exim4-config_header
  940. #####################################################
  941.  
  942. ######################################################################
  943. #                      ROUTERS CONFIGURATION                         #
  944. #               Specifies how addresses are handled                  #
  945. ######################################################################
  946. #     THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT!       #
  947. # An address is passed to each router in turn until it is accepted.  #
  948. ######################################################################
  949.  
  950. begin routers
  951.  
  952. #####################################################
  953. ### end router/00_exim4-config_header
  954. #####################################################
  955. #####################################################
  956. ### router/100_exim4-config_domain_literal
  957. #####################################################
  958.  
  959. ### router/100_exim4-config_domain_literal
  960. #################################
  961.  
  962. # This router handles e-mail addresses in "domain literal" form like
  963. # <user@[10.11.12.13]>. The RFCs require this facility, but it is disabled
  964. # in the default config since it is seldomly used and frequently abused.
  965. # Domain literal support also needs to be enabled in the main config,
  966. # which is automatically done if you use the enable macro
  967. # MAIN_ALLOW_DOMAIN_LITERALS.
  968.  
  969. .ifdef MAIN_ALLOW_DOMAIN_LITERALS
  970. domain_literal:
  971.   debug_print = "R: domain_literal for $local_part@$domain"
  972.   driver = ipliteral
  973.   domains = ! +local_domains
  974.   transport = remote_smtp
  975. .endif
  976. #####################################################
  977. ### end router/100_exim4-config_domain_literal
  978. #####################################################
  979. #####################################################
  980. ### router/150_exim4-config_hubbed_hosts
  981. #####################################################
  982.  
  983. # router/150_exim4-config_hubbed_hosts
  984. #################################
  985.  
  986. # route specific domains manually.
  987. #
  988. # see exim4-config_files(5) and spec.txt chapter 20.3 through 20.7 for
  989. # more detailed documentation.
  990.  
  991. hubbed_hosts:
  992.   debug_print = "R: hubbed_hosts for $domain"
  993.   driver = manualroute
  994.   domains = "${if exists{CONFDIR/hubbed_hosts}\
  995.                   {partial-lsearch;CONFDIR/hubbed_hosts}\
  996.              fail}"
  997.   same_domain_copy_routing = yes
  998.   route_data = ${lookup{$domain}partial-lsearch{CONFDIR/hubbed_hosts}}
  999.   transport = remote_smtp
  1000. #####################################################
  1001. ### end router/150_exim4-config_hubbed_hosts
  1002. #####################################################
  1003. #####################################################
  1004. ### router/200_exim4-config_primary
  1005. #####################################################
  1006.  
  1007. ### router/200_exim4-config_primary
  1008. #################################
  1009. # This file holds the primary router, responsible for nonlocal mails
  1010.  
  1011. .ifdef DCconfig_internet
  1012. # configtype=internet
  1013. #
  1014. # deliver mail to the recipient if recipient domain is a domain we
  1015. # relay for. We do not ignore any target hosts here since delivering to
  1016. # a site local or even a link local address might be wanted here, and if
  1017. # such an address has found its way into the MX record of such a domain,
  1018. # the local admin is probably in a place where that broken MX record
  1019. # could be fixed.
  1020.  
  1021. dnslookup_relay_to_domains:
  1022.   debug_print = "R: dnslookup_relay_to_domains for $local_part@$domain"
  1023.   driver = dnslookup
  1024.   domains = ! +local_domains : +relay_to_domains
  1025.   transport = remote_smtp
  1026.   same_domain_copy_routing = yes
  1027.   no_more
  1028.  
  1029. # deliver mail directly to the recipient. This router is only reached
  1030. # for domains that we do not relay for. Since we most probably can't
  1031. # have broken MX records pointing to site local or link local IP
  1032. # addresses fixed, we ignore target hosts pointing to these addresses.
  1033.  
  1034. dnslookup:
  1035.   debug_print = "R: dnslookup for $local_part@$domain"
  1036.   driver = dnslookup
  1037.   domains = ! +local_domains
  1038.   transport = remote_smtp
  1039.   same_domain_copy_routing = yes
  1040.   # ignore private rfc1918 and APIPA addresses
  1041.   ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8 : 192.168.0.0/16 :\
  1042.                         172.16.0.0/12 : 10.0.0.0/8 : 169.254.0.0/16 :\
  1043.             255.255.255.255
  1044.   no_more
  1045.  
  1046. .endif
  1047.  
  1048.  
  1049. .ifdef DCconfig_local
  1050. # configtype=local
  1051. #
  1052. # Stand-alone system, so generate an error for mail to a non-local domain
  1053. nonlocal:
  1054.   debug_print = "R: nonlocal for $local_part@$domain"
  1055.   driver = redirect
  1056.   domains = ! +local_domains
  1057.   allow_fail
  1058.   data = :fail: Mailing to remote domains not supported
  1059.   no_more
  1060.  
  1061. .endif
  1062.  
  1063.  
  1064. .ifdef DCconfig_smarthost DCconfig_satellite
  1065. # configtype=smarthost or configtype=satellite
  1066. #
  1067. # Send all non-local mail to a single other machine (smarthost).
  1068. #
  1069. # This means _ALL_ non-local mail goes to the smarthost. This will most
  1070. # probably not do what you want for domains that are listed in
  1071. # relay_domains. The most typical use for relay_domains is to control
  1072. # relaying for incoming e-mail on secondary MX hosts. In that case,
  1073. # it doesn't make sense to send the mail to the smarthost since the
  1074. # smarthost will probably send the message right back here, causing a
  1075. # loop.
  1076. #
  1077. # If you want to use a smarthost while being secondary MX for some
  1078. # domains, you'll need to copy the dnslookup_relay_to_domains router
  1079. # here so that mail to relay_domains is handled separately.
  1080.  
  1081. smarthost:
  1082.   debug_print = "R: smarthost for $local_part@$domain"
  1083.   driver = manualroute
  1084.   domains = ! +local_domains
  1085.   transport = remote_smtp_smarthost
  1086.   route_list = * DCsmarthost byname
  1087.   host_find_failed = defer
  1088.   same_domain_copy_routing = yes
  1089.   no_more
  1090.  
  1091. .endif
  1092.  
  1093.  
  1094. # The "no_more" above means that all later routers are for
  1095. # domains in the local_domains list, i.e. just like Exim 3 directors.
  1096. #####################################################
  1097. ### end router/200_exim4-config_primary
  1098. #####################################################
  1099. #####################################################
  1100. ### router/300_exim4-config_real_local
  1101. #####################################################
  1102.  
  1103. ### router/300_exim4-config_real_local
  1104. #################################
  1105.  
  1106. # This router allows reaching a local user while avoiding local
  1107. # processing. This can be used to inform a user of a broken .forward
  1108. # file, for example. The userforward router does this.
  1109.  
  1110. COND_LOCAL_SUBMITTER = "\
  1111.               ${if match_ip{$sender_host_address}{:@[]}\
  1112.                    {1}{0}\
  1113.         }"
  1114.  
  1115. real_local:
  1116.   debug_print = "R: real_local for $local_part@$domain"
  1117.   driver = accept
  1118.   domains = +local_domains
  1119.   condition = COND_LOCAL_SUBMITTER
  1120.   local_part_prefix = real-
  1121.   check_local_user
  1122.   transport = LOCAL_DELIVERY
  1123.  
  1124. #####################################################
  1125. ### end router/300_exim4-config_real_local
  1126. #####################################################
  1127. #####################################################
  1128. ### router/400_exim4-config_system_aliases
  1129. #####################################################
  1130.  
  1131. ### router/400_exim4-config_system_aliases
  1132. #################################
  1133.  
  1134. # This router handles aliasing using a traditional /etc/aliases file.
  1135. #
  1136. ##### NB  You must ensure that /etc/aliases exists. It used to be the case
  1137. ##### NB  that every Unix had that file, because it was the Sendmail default.
  1138. ##### NB  These days, there are systems that don't have it. Your aliases
  1139. ##### NB  file should at least contain an alias for "postmaster".
  1140. #
  1141. # This router handles the local part in a case-insensitive way which
  1142. # satisfies the RFCs requirement that postmaster be reachable regardless
  1143. # of case. If you decide to handle /etc/aliases in a caseful way, you
  1144. # need to make arrangements for a caseless postmaster.
  1145. #
  1146. # Delivery to arbitrary directories, files, and piping to programs in
  1147. # /etc/aliases is disabled per default.
  1148. # If that is a problem for you, see
  1149. #   /usr/share/doc/exim4-base/README.Debian.gz
  1150. # for explanation and some workarounds.
  1151.  
  1152. system_aliases:
  1153.   debug_print = "R: system_aliases for $local_part@$domain"
  1154.   driver = redirect
  1155.   domains = +local_domains
  1156.   allow_fail
  1157.   allow_defer
  1158.   data = ${lookup{$local_part}lsearch{/etc/aliases}}
  1159.   .ifdef SYSTEM_ALIASES_USER
  1160.   user = SYSTEM_ALIASES_USER
  1161.   .endif
  1162.   .ifdef SYSTEM_ALIASES_GROUP
  1163.   group = SYSTEM_ALIASES_GROUP
  1164.   .endif
  1165.   .ifdef SYSTEM_ALIASES_FILE_TRANSPORT
  1166.   file_transport = SYSTEM_ALIASES_FILE_TRANSPORT
  1167.   .endif
  1168.   .ifdef SYSTEM_ALIASES_PIPE_TRANSPORT
  1169.   pipe_transport = SYSTEM_ALIASES_PIPE_TRANSPORT
  1170.   .endif
  1171.   .ifdef SYSTEM_ALIASES_DIRECTORY_TRANSPORT
  1172.   directory_transport = SYSTEM_ALIASES_DIRECTORY_TRANSPORT
  1173.   .endif
  1174. #####################################################
  1175. ### end router/400_exim4-config_system_aliases
  1176. #####################################################
  1177. #####################################################
  1178. ### router/500_exim4-config_hubuser
  1179. #####################################################
  1180.  
  1181. ### router/500_exim4-config_hubuser
  1182. #################################
  1183.  
  1184. .ifdef DCconfig_satellite
  1185. # This router is only used for configtype=satellite.
  1186. # It takes care to route all mail targetted to <somelocaluser@this.machine>
  1187. # to the host where we read our mail
  1188. #
  1189. hub_user:
  1190.   debug_print = "R: hub_user for $local_part@$domain"
  1191.   driver = redirect
  1192.   domains = +local_domains
  1193.   data = ${local_part}@DCreadhost
  1194.   check_local_user
  1195.  
  1196. # Grab the redirected mail and deliver it.
  1197. # This is a duplicate of the smarthost router, needed because
  1198. # DCreadhost might end up as part of +local_domains
  1199. hub_user_smarthost:
  1200.   debug_print = "R: hub_user_smarthost for $local_part@$domain"
  1201.   driver = manualroute
  1202.   domains = DCreadhost
  1203.   transport = remote_smtp_smarthost
  1204.   route_list = * DCsmarthost byname
  1205.   host_find_failed = defer
  1206.   same_domain_copy_routing = yes
  1207.   check_local_user
  1208. .endif
  1209.  
  1210.  
  1211. #####################################################
  1212. ### end router/500_exim4-config_hubuser
  1213. #####################################################
  1214. #####################################################
  1215. ### router/600_exim4-config_userforward
  1216. #####################################################
  1217.  
  1218. ### router/600_exim4-config_userforward
  1219. #################################
  1220.  
  1221. # This router handles forwarding using traditional .forward files in users'
  1222. # home directories. It also allows mail filtering with a forward file
  1223. # starting with the string "# Exim filter" or "# Sieve filter".
  1224. #
  1225. # The no_verify setting means that this router is skipped when Exim is
  1226. # verifying addresses. Similarly, no_expn means that this router is skipped if
  1227. # Exim is processing an EXPN command.
  1228. #
  1229. # The check_ancestor option means that if the forward file generates an
  1230. # address that is an ancestor of the current one, the current one gets
  1231. # passed on instead. This covers the case where A is aliased to B and B
  1232. # has a .forward file pointing to A.
  1233. #
  1234. # The four transports specified at the end are those that are used when
  1235. # forwarding generates a direct delivery to a directory, or a file, or to a
  1236. # pipe, or sets up an auto-reply, respectively.
  1237. #
  1238. userforward:
  1239.   debug_print = "R: userforward for $local_part@$domain"
  1240.   driver = redirect
  1241.   domains = +local_domains
  1242.   check_local_user
  1243.   file = $home/.forward
  1244.   require_files = $local_part:$home/.forward
  1245.   no_verify
  1246.   no_expn
  1247.   check_ancestor
  1248.   allow_filter
  1249.   forbid_smtp_code = true
  1250.   directory_transport = address_directory
  1251.   file_transport = address_file
  1252.   pipe_transport = address_pipe
  1253.   reply_transport = address_reply
  1254.   skip_syntax_errors
  1255.   syntax_errors_to = real-$local_part@$domain
  1256.   syntax_errors_text = \
  1257.     This is an automatically generated message. An error has\n\
  1258.     been found in your .forward file. Details of the error are\n\
  1259.     reported below. While this error persists, you will receive\n\
  1260.     a copy of this message for every message that is addressed\n\
  1261.     to you. If your .forward file is a filter file, or if it is\n\
  1262.     a non-filter file containing no valid forwarding addresses,\n\
  1263.     a copy of each incoming message will be put in your normal\n\
  1264.     mailbox. If a non-filter file contains at least one valid\n\
  1265.     forwarding address, forwarding to the valid addresses will\n\
  1266.     happen, and those will be the only deliveries that occur.
  1267.  
  1268. #####################################################
  1269. ### end router/600_exim4-config_userforward
  1270. #####################################################
  1271. #####################################################
  1272. ### router/700_exim4-config_procmail
  1273. #####################################################
  1274.  
  1275. procmail:
  1276.   debug_print = "R: procmail for $local_part@$domain"
  1277.   driver = accept
  1278.   domains = +local_domains
  1279.   check_local_user
  1280.   transport = procmail_pipe
  1281.   # emulate OR with "if exists"-expansion
  1282.   require_files = ${local_part}:\
  1283.                   ${if exists{/etc/procmailrc}\
  1284.                     {/etc/procmailrc}{${home}/.procmailrc}}:\
  1285.                   +/usr/bin/procmail
  1286.   no_verify
  1287.   no_expn
  1288.  
  1289. #####################################################
  1290. ### end router/700_exim4-config_procmail
  1291. #####################################################
  1292. #####################################################
  1293. ### router/800_exim4-config_maildrop
  1294. #####################################################
  1295.  
  1296. ### router/800_exim4-config_maildrop
  1297. #################################
  1298.  
  1299. maildrop:
  1300.   debug_print = "R: maildrop for $local_part@$domain"
  1301.   driver = accept
  1302.   domains = +local_domains
  1303.   check_local_user
  1304.   transport = maildrop_pipe
  1305.   require_files = ${local_part}:${home}/.mailfilter:+/usr/bin/maildrop
  1306.   no_verify
  1307.   no_expn
  1308.  
  1309. #####################################################
  1310. ### end router/800_exim4-config_maildrop
  1311. #####################################################
  1312. #####################################################
  1313. ### router/850_exim4-config_lowuid
  1314. #####################################################
  1315.  
  1316. ### router/850_exim4-config_lowuid
  1317. #################################
  1318.  
  1319. .ifndef FIRST_USER_ACCOUNT_UID
  1320. FIRST_USER_ACCOUNT_UID = 0
  1321. .endif
  1322.  
  1323. .ifndef DEFAULT_SYSTEM_ACCOUNT_ALIAS
  1324. DEFAULT_SYSTEM_ACCOUNT_ALIAS = :fail: no mail to system accounts
  1325. .endif
  1326.  
  1327. COND_SYSTEM_USER_AND_REMOTE_SUBMITTER = "\
  1328.               ${if and{{! match_ip{$sender_host_address}{:@[]}}\
  1329.                        {<{$local_user_uid}{FIRST_USER_ACCOUNT_UID}}}\
  1330.                    {1}{0}\
  1331.         }"
  1332.  
  1333. lowuid_aliases:
  1334.   debug_print = "R: lowuid_aliases for $local_part@$domain (UID $local_user_uid)"
  1335.   check_local_user
  1336.   driver = redirect
  1337.   allow_fail
  1338.   domains = +local_domains
  1339.   condition = COND_SYSTEM_USER_AND_REMOTE_SUBMITTER
  1340.   data = ${if exists{CONFDIR/lowuid-aliases}\
  1341.               {${lookup{$local_part}lsearch{CONFDIR/lowuid-aliases}\
  1342.               {$value}{DEFAULT_SYSTEM_ACCOUNT_ALIAS}}}\
  1343.               {DEFAULT_SYSTEM_ACCOUNT_ALIAS}}
  1344. #####################################################
  1345. ### end router/850_exim4-config_lowuid
  1346. #####################################################
  1347. #####################################################
  1348. ### router/900_exim4-config_local_user
  1349. #####################################################
  1350.  
  1351. ### router/900_exim4-config_local_user
  1352. #################################
  1353.  
  1354. # This router matches local user mailboxes. If the router fails, the error
  1355. # message is "Unknown user".
  1356.  
  1357. local_user:
  1358.   debug_print = "R: local_user for $local_part@$domain"
  1359.   driver = accept
  1360.   domains = +local_domains
  1361.   check_local_user
  1362.   local_parts = ! root
  1363.   transport = LOCAL_DELIVERY
  1364.   cannot_route_message = Unknown user
  1365. #####################################################
  1366. ### end router/900_exim4-config_local_user
  1367. #####################################################
  1368. #####################################################
  1369. ### router/mmm_mail4root
  1370. #####################################################
  1371.  
  1372. ### router/mmm_mail4root
  1373. #################################
  1374. # deliver mail addressed to root to /var/mail/mail as user mail:mail
  1375. # if it was not redirected in /etc/aliases or by other means
  1376. # Exim cannot deliver as root since 4.24 (FIXED_NEVER_USERS)
  1377.  
  1378. mail4root:
  1379.   debug_print = "R: mail4root for $local_part@$domain"
  1380.   driver = redirect
  1381.   domains = +local_domains
  1382.   data = /var/mail/mail
  1383.   file_transport = address_file
  1384.   local_parts = root
  1385.   user = mail
  1386.   group = mail
  1387.  
  1388. #####################################################
  1389. ### end router/mmm_mail4root
  1390. #####################################################
  1391. #####################################################
  1392. ### transport/00_exim4-config_header
  1393. #####################################################
  1394.  
  1395. ######################################################################
  1396. #                      TRANSPORTS CONFIGURATION                      #
  1397. ######################################################################
  1398. #                       ORDER DOES NOT MATTER                        #
  1399. #     Only one appropriate transport is called for each delivery.    #
  1400. ######################################################################
  1401.  
  1402. # A transport is used only when referenced from a router that successfully
  1403. # handles an address.
  1404.  
  1405. begin transports
  1406.  
  1407. #####################################################
  1408. ### end transport/00_exim4-config_header
  1409. #####################################################
  1410. #####################################################
  1411. ### transport/10_exim4-config_transport-macros
  1412. #####################################################
  1413.  
  1414. ### transport/10_exim4-config_transport-macros
  1415. #################################
  1416.  
  1417. .ifdef HIDE_MAILNAME
  1418. REMOTE_SMTP_HEADERS_REWRITE=*@+local_domains $1@DCreadhost frs : *@ETC_MAILNAME $1@DCreadhost frs
  1419. REMOTE_SMTP_RETURN_PATH=${if match_domain{$sender_address_domain}{+local_domains}{${sender_address_local_part}@DCreadhost}{${if match_domain{$sender_address_domain}{ETC_MAILNAME}{${sender_address_local_part}@DCreadhost}fail}}}
  1420. .endif
  1421.  
  1422. .ifdef REMOTE_SMTP_HELO_FROM_DNS
  1423. .ifdef REMOTE_SMTP_HELO_DATA
  1424. REMOTE_SMTP_HELO_DATA==${lookup dnsdb {ptr=$sending_ip_address}{$value}{$primary_hostname}}
  1425. .else
  1426. REMOTE_SMTP_HELO_DATA=${lookup dnsdb {ptr=$sending_ip_address}{$value}{$primary_hostname}}
  1427. .endif
  1428. .endif
  1429. #####################################################
  1430. ### end transport/10_exim4-config_transport-macros
  1431. #####################################################
  1432. #####################################################
  1433. ### transport/30_exim4-config_address_file
  1434. #####################################################
  1435.  
  1436. # This transport is used for handling deliveries directly to files that are
  1437. # generated by aliasing or forwarding.
  1438. #
  1439. address_file:
  1440.   debug_print = "T: address_file for $local_part@$domain"
  1441.   driver = appendfile
  1442.   delivery_date_add
  1443.   envelope_to_add
  1444.   return_path_add
  1445.  
  1446. #####################################################
  1447. ### end transport/30_exim4-config_address_file
  1448. #####################################################
  1449. #####################################################
  1450. ### transport/30_exim4-config_address_pipe
  1451. #####################################################
  1452.  
  1453. # This transport is used for handling pipe deliveries generated by
  1454. # .forward files. If the commands fails and produces any output on standard
  1455. # output or standard error streams, the output is returned to the sender
  1456. # of the message as a delivery error.
  1457. address_pipe:
  1458.   debug_print = "T: address_pipe for $local_part@$domain"
  1459.   driver = pipe
  1460.   return_fail_output
  1461.  
  1462. #####################################################
  1463. ### end transport/30_exim4-config_address_pipe
  1464. #####################################################
  1465. #####################################################
  1466. ### transport/30_exim4-config_address_reply
  1467. #####################################################
  1468.  
  1469. # This transport is used for handling autoreplies generated by the filtering
  1470. # option of the userforward router.
  1471. #
  1472. address_reply:
  1473.   debug_print = "T: autoreply for $local_part@$domain"
  1474.   driver = autoreply
  1475.  
  1476. #####################################################
  1477. ### end transport/30_exim4-config_address_reply
  1478. #####################################################
  1479. #####################################################
  1480. ### transport/30_exim4-config_mail_spool
  1481. #####################################################
  1482.  
  1483. ### transport/30_exim4-config_mail_spool
  1484.  
  1485. # This transport is used for local delivery to user mailboxes in traditional
  1486. # BSD mailbox format.
  1487. #
  1488. mail_spool:
  1489.   debug_print = "T: appendfile for $local_part@$domain"
  1490.   driver = appendfile
  1491.   file = /var/mail/$local_part
  1492.   delivery_date_add
  1493.   envelope_to_add
  1494.   return_path_add
  1495.   group = mail
  1496.   mode = 0660
  1497.   mode_fail_narrower = false
  1498.  
  1499. #####################################################
  1500. ### end transport/30_exim4-config_mail_spool
  1501. #####################################################
  1502. #####################################################
  1503. ### transport/30_exim4-config_maildir_home
  1504. #####################################################
  1505.  
  1506. ### transport/30_exim4-config_maildir_home
  1507. #################################
  1508.  
  1509. # Use this instead of mail_spool if you want to to deliver to Maildir in
  1510. # home-directory - change the definition of LOCAL_DELIVERY
  1511. #
  1512. maildir_home:
  1513.   debug_print = "T: maildir_home for $local_part@$domain"
  1514.   driver = appendfile
  1515.   .ifdef MAILDIR_HOME_MAILDIR_LOCATION
  1516.   directory = MAILDIR_HOME_MAILDIR_LOCATION
  1517.   .else
  1518.   directory = $home/Maildir
  1519.   .endif
  1520.   .ifdef MAILDIR_HOME_CREATE_DIRECTORY
  1521.   create_directory
  1522.   .endif
  1523.   .ifdef MAILDIR_HOME_CREATE_FILE
  1524.   create_file = MAILDIR_HOME_CREATE_FILE
  1525.   .endif
  1526.   delivery_date_add
  1527.   envelope_to_add
  1528.   return_path_add
  1529.   maildir_format
  1530.   .ifdef MAILDIR_HOME_DIRECTORY_MODE
  1531.   directory_mode = MAILDIR_HOME_DIRECTORY_MODE
  1532.   .else
  1533.   directory_mode = 0700
  1534.   .endif
  1535.   .ifdef MAILDIR_HOME_MODE
  1536.   mode = MAILDIR_HOME_MODE
  1537.   .else
  1538.   mode = 0600
  1539.   .endif
  1540.   mode_fail_narrower = false
  1541.   # This transport always chdirs to $home before trying to deliver. If
  1542.   # $home is not accessible, this chdir fails and prevents delivery.
  1543.   # If you are in a setup where home directories might not be
  1544.   # accessible, uncomment the current_directory line below.
  1545.   # current_directory = /
  1546. #####################################################
  1547. ### end transport/30_exim4-config_maildir_home
  1548. #####################################################
  1549. #####################################################
  1550. ### transport/30_exim4-config_maildrop_pipe
  1551. #####################################################
  1552.  
  1553. maildrop_pipe:
  1554.   debug_print = "T: maildrop_pipe for $local_part@$domain"
  1555.   driver = pipe
  1556.   path = "/bin:/usr/bin:/usr/local/bin"
  1557.   command = "/usr/bin/maildrop"
  1558.   return_path_add
  1559.   delivery_date_add
  1560.   envelope_to_add
  1561.  
  1562. #####################################################
  1563. ### end transport/30_exim4-config_maildrop_pipe
  1564. #####################################################
  1565. #####################################################
  1566. ### transport/30_exim4-config_procmail_pipe
  1567. #####################################################
  1568.  
  1569. procmail_pipe:
  1570.   debug_print = "T: procmail_pipe for $local_part@$domain"
  1571.   driver = pipe
  1572.   path = "/bin:/usr/bin:/usr/local/bin"
  1573.   command = "/usr/bin/procmail"
  1574.   return_path_add
  1575.   delivery_date_add
  1576.   envelope_to_add
  1577.  
  1578. #####################################################
  1579. ### end transport/30_exim4-config_procmail_pipe
  1580. #####################################################
  1581. #####################################################
  1582. ### transport/30_exim4-config_remote_smtp
  1583. #####################################################
  1584.  
  1585. ### transport/30_exim4-config_remote_smtp
  1586. #################################
  1587. # This transport is used for delivering messages over SMTP connections.
  1588.  
  1589. remote_smtp:
  1590.   debug_print = "T: remote_smtp for $local_part@$domain"
  1591.   driver = smtp
  1592. .ifdef REMOTE_SMTP_HOSTS_AVOID_TLS
  1593.   hosts_avoid_tls = REMOTE_SMTP_HOSTS_AVOID_TLS
  1594. .endif
  1595. .ifdef REMOTE_SMTP_HEADERS_REWRITE
  1596.   headers_rewrite = REMOTE_SMTP_HEADERS_REWRITE
  1597. .endif
  1598. .ifdef REMOTE_SMTP_RETURN_PATH
  1599.   return_path = REMOTE_SMTP_RETURN_PATH
  1600. .endif
  1601. .ifdef REMOTE_SMTP_HELO_DATA
  1602.   helo_data=REMOTE_SMTP_HELO_DATA
  1603. .endif
  1604. .ifdef DKIM_DOMAIN
  1605. dkim_domain = DKIM_DOMAIN
  1606. .endif
  1607. .ifdef DKIM_SELECTOR
  1608. dkim_selector = DKIM_SELECTOR
  1609. .endif
  1610. .ifdef DKIM_PRIVATE_KEY
  1611. dkim_private_key = DKIM_PRIVATE_KEY
  1612. .endif
  1613. .ifdef DKIM_CANON
  1614. dkim_canon = DKIM_CANON
  1615. .endif
  1616. .ifdef DKIM_STRICT
  1617. dkim_strict = DKIM_STRICT
  1618. .endif
  1619. .ifdef DKIM_SIGN_HEADERS
  1620. dkim_sign_headers = DKIM_SIGN_HEADERS
  1621. .endif
  1622. #####################################################
  1623. ### end transport/30_exim4-config_remote_smtp
  1624. #####################################################
  1625. #####################################################
  1626. ### transport/30_exim4-config_remote_smtp_smarthost
  1627. #####################################################
  1628.  
  1629. ### transport/30_exim4-config_remote_smtp_smarthost
  1630. #################################
  1631.  
  1632. # This transport is used for delivering messages over SMTP connections
  1633. # to a smarthost. The local host tries to authenticate.
  1634. # This transport is used for smarthost and satellite configurations.
  1635.  
  1636. remote_smtp_smarthost:
  1637.   debug_print = "T: remote_smtp_smarthost for $local_part@$domain"
  1638.   driver = smtp
  1639.   hosts_try_auth = <; ${if exists{CONFDIR/passwd.client} \
  1640.         {\
  1641.         ${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$host_address}}\
  1642.         }\
  1643.         {} \
  1644.       }
  1645. .ifdef REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS
  1646.   hosts_avoid_tls = REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS
  1647. .endif
  1648. .ifdef REMOTE_SMTP_HEADERS_REWRITE
  1649.   headers_rewrite = REMOTE_SMTP_HEADERS_REWRITE
  1650. .endif
  1651. .ifdef REMOTE_SMTP_RETURN_PATH
  1652.   return_path = REMOTE_SMTP_RETURN_PATH
  1653. .endif
  1654. .ifdef REMOTE_SMTP_HELO_DATA
  1655.   helo_data=REMOTE_SMTP_HELO_DATA
  1656. .endif
  1657. #####################################################
  1658. ### end transport/30_exim4-config_remote_smtp_smarthost
  1659. #####################################################
  1660. #####################################################
  1661. ### transport/35_exim4-config_address_directory
  1662. #####################################################
  1663. # This transport is used for handling file addresses generated by alias
  1664. # or .forward files if the path ends in "/", which causes it to be treated
  1665. # as a directory name rather than a file name.
  1666.  
  1667. address_directory:
  1668.   debug_print = "T: address_directory for $local_part@$domain"
  1669.   driver = appendfile
  1670.   delivery_date_add
  1671.   envelope_to_add
  1672.   return_path_add
  1673.   check_string = ""
  1674.   escape_string = ""
  1675.   maildir_format
  1676.  
  1677. #####################################################
  1678. ### end transport/35_exim4-config_address_directory
  1679. #####################################################
  1680. #####################################################
  1681. ### retry/00_exim4-config_header
  1682. #####################################################
  1683.  
  1684. ######################################################################
  1685. #                      RETRY CONFIGURATION                           #
  1686. ######################################################################
  1687.  
  1688. begin retry
  1689.  
  1690. #####################################################
  1691. ### end retry/00_exim4-config_header
  1692. #####################################################
  1693. #####################################################
  1694. ### retry/30_exim4-config
  1695. #####################################################
  1696.  
  1697. ### retry/30_exim4-config
  1698. #################################
  1699.  
  1700. # This single retry rule applies to all domains and all errors. It specifies
  1701. # retries every 15 minutes for 2 hours, then increasing retry intervals,
  1702. # starting at 1 hour and increasing each time by a factor of 1.5, up to 16
  1703. # hours, then retries every 6 hours until 4 days have passed since the first
  1704. # failed delivery.
  1705.  
  1706. # Please note that these rules only limit the frequenzy of retries, the
  1707. # effective retry-time depends on the frequenzy of queue-running, too.
  1708. # See QUEUEINTERVAL in /etc/default/exim4.
  1709.  
  1710. # Address or Domain    Error       Retries
  1711. # -----------------    -----       -------
  1712.  
  1713. *                      *           F,2h,15m; G,16h,1h,1.5; F,4d,6h
  1714.  
  1715. #####################################################
  1716. ### end retry/30_exim4-config
  1717. #####################################################
  1718. #####################################################
  1719. ### rewrite/00_exim4-config_header
  1720. #####################################################
  1721.  
  1722. ######################################################################
  1723. #                      REWRITE CONFIGURATION                         #
  1724. ######################################################################
  1725.  
  1726. begin rewrite
  1727.  
  1728. #####################################################
  1729. ### end rewrite/00_exim4-config_header
  1730. #####################################################
  1731. #####################################################
  1732. ### rewrite/31_exim4-config_rewriting
  1733. #####################################################
  1734.  
  1735. ### rewrite/31_exim4-config_rewriting
  1736. #################################
  1737.  
  1738. # This rewriting rule is particularily useful for dialup users who
  1739. # don't have their own domain, but could be useful for anyone.
  1740. # It looks up the real address of all local users in a file
  1741. .ifndef NO_EAA_REWRITE_REWRITE
  1742. *@+local_domains "${lookup{${local_part}}lsearch{/etc/email-addresses}\
  1743.                   {$value}fail}" Ffrs
  1744. # identical rewriting rule for /etc/mailname
  1745. *@ETC_MAILNAME "${lookup{${local_part}}lsearch{/etc/email-addresses}\
  1746.                   {$value}fail}" Ffrs
  1747. .endif
  1748.  
  1749.  
  1750. #####################################################
  1751. ### end rewrite/31_exim4-config_rewriting
  1752. #####################################################
  1753. #####################################################
  1754. ### auth/00_exim4-config_header
  1755. #####################################################
  1756.  
  1757. ######################################################################
  1758. #                   AUTHENTICATION CONFIGURATION                     #
  1759. ######################################################################
  1760.  
  1761. begin authenticators
  1762.  
  1763.  
  1764. #####################################################
  1765. ### end auth/00_exim4-config_header
  1766. #####################################################
  1767. #####################################################
  1768. ### auth/30_exim4-config_examples
  1769. #####################################################
  1770.  
  1771. ### auth/30_exim4-config_examples
  1772. #################################
  1773.  
  1774. # The examples below are for server side authentication, when the
  1775. # local exim is SMTP server and clients authenticate to the local exim.
  1776.  
  1777. # They allow two styles of plain-text authentication against an
  1778. # CONFDIR/passwd file whose syntax is described in exim4_passwd(5).
  1779.  
  1780. # Hosts that are allowed to use AUTH are defined by the
  1781. # auth_advertise_hosts option in the main configuration. The default is
  1782. # "*", which allows authentication to all hosts over all kinds of
  1783. # connections if there is at least one authenticator defined here.
  1784. # Authenticators which rely on unencrypted clear text passwords don't
  1785. # advertise on unencrypted connections by default. Thus, it might be
  1786. # wise to set up TLS to allow encrypted connections. If TLS cannot be
  1787. # used for some reason, you can set AUTH_SERVER_ALLOW_NOTLS_PASSWORDS to
  1788. # advertise unencrypted clear text password based authenticators on all
  1789. # connections. As this is severely reducing security, using TLS is
  1790. # preferred over allowing clear text password based authenticators on
  1791. # unencrypted connections.
  1792.  
  1793. # PLAIN authentication has no server prompts. The client sends its
  1794. # credentials in one lump, containing an authorization ID (which we do not
  1795. # use), an authentication ID, and a password. The latter two appear as
  1796. # $auth2 and $auth3 in the configuration and should be checked against a
  1797. # valid username and password. In a real configuration you would typically
  1798. # use $auth2 as a lookup key, and compare $auth3 against the result of the
  1799. # lookup, perhaps using the crypteq{}{} condition.
  1800.  
  1801. # plain_server:
  1802. #   driver = plaintext
  1803. #   public_name = PLAIN
  1804. #   server_condition = "${if crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
  1805. #   server_set_id = $auth2
  1806. #   server_prompts = :
  1807. #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1808. #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  1809. #   .endif
  1810.  
  1811. # LOGIN authentication has traditional prompts and responses. There is no
  1812. # authorization ID in this mechanism, so unlike PLAIN the username and
  1813. # password are $auth1 and $auth2. Apart from that you can use the same
  1814. # server_condition setting for both authenticators.
  1815.  
  1816. # login_server:
  1817. #   driver = plaintext
  1818. #   public_name = LOGIN
  1819. #   server_prompts = "Username:: : Password::"
  1820. #   server_condition = "${if crypteq{$auth2}{${extract{1}{:}{${lookup{$auth1}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
  1821. #   server_set_id = $auth1
  1822. #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1823. #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  1824. #   .endif
  1825. #
  1826. # cram_md5_server:
  1827. #   driver = cram_md5
  1828. #   public_name = CRAM-MD5
  1829. #   server_secret = ${extract{2}{:}{${lookup{$auth1}lsearch{CONFDIR/passwd}{$value}fail}}}
  1830. #   server_set_id = $auth1
  1831.  
  1832. # Here is an example of CRAM-MD5 authentication against PostgreSQL:
  1833. #
  1834. # psqldb_auth_server:
  1835. #   driver = cram_md5
  1836. #   public_name = CRAM-MD5
  1837. #   server_secret = ${lookup pgsql{SELECT pw FROM users WHERE username = '${quote_pgsql:$auth1}'}{$value}fail}
  1838. #   server_set_id = $auth1
  1839.  
  1840. # Authenticate against local passwords using sasl2-bin
  1841. # Requires exim_uid to be a member of sasl group, see README.Debian.gz
  1842. # plain_saslauthd_server:
  1843. #   driver = plaintext
  1844. #   public_name = PLAIN
  1845. #   server_condition = ${if saslauthd{{$auth2}{$auth3}}{1}{0}}
  1846. #   server_set_id = $auth2
  1847. #   server_prompts = :
  1848. #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1849. #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  1850. #   .endif
  1851. #
  1852. # login_saslauthd_server:
  1853. #   driver = plaintext
  1854. #   public_name = LOGIN
  1855. #   server_prompts = "Username:: : Password::"
  1856. #   # don't send system passwords over unencrypted connections
  1857. #   server_condition = ${if saslauthd{{$auth1}{$auth2}}{1}{0}}
  1858. #   server_set_id = $auth1
  1859. #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1860. #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  1861. #   .endif
  1862. #
  1863. # ntlm_sasl_server:
  1864. #   driver = cyrus_sasl
  1865. #   public_name = NTLM
  1866. #   server_realm = <short main hostname>
  1867. #   server_set_id = $auth1
  1868. #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1869. #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  1870. #   .endif
  1871. #
  1872. # digest_md5_sasl_server:
  1873. #   driver = cyrus_sasl
  1874. #   public_name = DIGEST-MD5
  1875. #   server_realm = <short main hostname>
  1876. #   server_set_id = $auth1
  1877. #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1878. #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  1879. #   .endif
  1880.  
  1881. # Authentcate against cyrus-sasl
  1882. # This is mainly untested, please report any problems to
  1883. # pkg-exim4-users@lists.alioth.debian.org.
  1884. # cram_md5_sasl_server:
  1885. #   driver = cyrus_sasl
  1886. #   public_name = CRAM-MD5
  1887. #   server_realm = <short main hostname>
  1888. #   server_set_id = $auth1
  1889. #
  1890. # plain_sasl_server:
  1891. #   driver = cyrus_sasl
  1892. #   public_name = PLAIN
  1893. #   server_realm = <short main hostname>
  1894. #   server_set_id = $auth1
  1895. #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1896. #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  1897. #   .endif
  1898. #
  1899. # login_sasl_server:
  1900. #   driver = cyrus_sasl
  1901. #   public_name = LOGIN
  1902. #   server_realm = <short main hostname>
  1903. #   server_set_id = $auth1
  1904. #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1905. #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  1906. #   .endif
  1907.  
  1908. # Authenticate against courier authdaemon
  1909.  
  1910. # This is now the (working!) example from
  1911. # http://www.exim.org/eximwiki/FAQ/Policy_controls/Q0730
  1912. # Possible pitfall: access rights on /var/run/courier/authdaemon/socket.
  1913. # plain_courier_authdaemon:
  1914. #   driver = plaintext
  1915. #   public_name = PLAIN
  1916. #   server_condition = \
  1917. #     ${extract {ADDRESS} \
  1918. #               {${readsocket{/var/run/courier/authdaemon/socket} \
  1919. #               {AUTH ${strlen:exim\nlogin\n$auth2\n$auth3\n}\nexim\nlogin\n$auth2\n$auth3\n} }} \
  1920. #               {yes} \
  1921. #               fail}
  1922. #   server_set_id = $auth2
  1923. #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1924. #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  1925. #   .endif
  1926.  
  1927. # login_courier_authdaemon:
  1928. #   driver = plaintext
  1929. #   public_name = LOGIN
  1930. #   server_prompts = Username:: : Password::
  1931. #   server_condition = \
  1932. #     ${extract {ADDRESS} \
  1933. #               {${readsocket{/var/run/courier/authdaemon/socket} \
  1934. #               {AUTH ${strlen:exim\nlogin\n$auth1\n$auth2\n}\nexim\nlogin\n$auth1\n$auth2\n} }} \
  1935. #               {yes} \
  1936. #               fail}
  1937. #   server_set_id = $auth1
  1938. #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1939. #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  1940. #   .endif
  1941.  
  1942. # This one is a bad hack to support the broken version 4.xx of
  1943. # Microsoft Outlook Express which violates the RFCs by demanding
  1944. # "250-AUTH=" instead of "250-AUTH ".
  1945. # If your list of offered authenticators is other than PLAIN and LOGIN,
  1946. # you need to adapt the public_name line manually.
  1947. # It has to be the last authenticator to work and has not been tested
  1948. # well. Use at your own risk.
  1949. # See the thread entry point from
  1950. # http://www.exim.org/mail-archives/exim-users/Week-of-Mon-20050214/msg00213.html
  1951. # for the related discussion on the exim-users mailing list.
  1952. # Thanks to Fred Viles for this great work.
  1953.  
  1954. # support_broken_outlook_express_4_server:
  1955. #   driver = plaintext
  1956. #   public_name = "\r\n250-AUTH=PLAIN LOGIN"
  1957. #   server_prompts = User Name : Password
  1958. #   server_condition = no
  1959. #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1960. #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  1961. #   .endif
  1962.  
  1963. ##############
  1964. # See /usr/share/doc/exim4-base/README.Debian.gz
  1965. ##############
  1966.  
  1967. # These examples below are the equivalent for client side authentication.
  1968. # They get the passwords from CONFDIR/passwd.client, whose format is
  1969. # defined in exim4_passwd_client(5)
  1970.  
  1971. # Because AUTH PLAIN and AUTH LOGIN send the password in clear, we
  1972. # only allow these mechanisms over encrypted connections by default.
  1973. # You can set AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS to allow unencrypted
  1974. # clear text password authentication on all connections.
  1975.  
  1976. cram_md5:
  1977.   driver = cram_md5
  1978.   public_name = CRAM-MD5
  1979.   client_name = ${extract{1}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}
  1980.   client_secret = ${extract{2}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}
  1981.  
  1982. # this returns the matching line from passwd.client and doubles all ^
  1983. PASSWDLINE=${sg{\
  1984.                 ${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}\
  1985.             }\
  1986.             {\\N[\\^]\\N}\
  1987.             {^^}\
  1988.         }
  1989.  
  1990. plain:
  1991.   driver = plaintext
  1992.   public_name = PLAIN
  1993. .ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS
  1994.   client_send = "<; ${if !eq{$tls_cipher}{}\
  1995.                    {^${extract{1}{:}{PASSWDLINE}}\
  1996.              ^${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}\
  1997.            }fail}"
  1998. .else
  1999.   client_send = "<; ^${extract{1}{:}{PASSWDLINE}}\
  2000.             ^${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}"
  2001. .endif
  2002.  
  2003. login:
  2004.   driver = plaintext
  2005.   public_name = LOGIN
  2006. .ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS
  2007.   # Return empty string if not non-TLS AND looking up $host in passwd-file
  2008.   # yields a non-empty string; fail otherwise.
  2009.   client_send = "<; ${if and{\
  2010.                          {!eq{$tls_cipher}{}}\
  2011.                          {!eq{PASSWDLINE}{}}\
  2012.                         }\
  2013.                      {}fail}\
  2014.                 ; ${extract{1}{::}{PASSWDLINE}}\
  2015.          ; ${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}"
  2016. .else
  2017.   # Return empty string if looking up $host in passwd-file yields a
  2018.   # non-empty string; fail otherwise.
  2019.   client_send = "<; ${if !eq{PASSWDLINE}{}\
  2020.                      {}fail}\
  2021.                 ; ${extract{1}{::}{PASSWDLINE}}\
  2022.          ; ${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}"
  2023. .endif
  2024. #####################################################
  2025. ### end auth/30_exim4-config_examples
  2026. #####################################################
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!