API tools faq
paste
Advertisement
Guest User

exim4.conf.template

a guest
Sep 5th, 2016
211
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 79.79 KB | None | 0 0
raw download clone embed print report
  1. #####################################################
  2. ### main/01_exim4-config_listmacrosdefs
  3. #####################################################
  4. ######################################################################
  5. # Runtime configuration file for Exim 4 (Debian Packaging) #
  6. ######################################################################
  7.  
  8. ######################################################################
  9. # /etc/exim4/exim4.conf.template is only used with the non-split
  10. # configuration scheme.
  11. # /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs is only used
  12. # with the split configuration scheme.
  13. # If you find this comment anywhere else, somebody copied it there.
  14. # Documentation about the Debian exim4 configuration scheme can be
  15. # found in /usr/share/doc/exim4-base/README.Debian.gz.
  16. ######################################################################
  17.  
  18. ######################################################################
  19. # MAIN CONFIGURATION SETTINGS #
  20. ######################################################################
  21.  
  22. # Just for reference and scripts.
  23. # On Debian systems, the main binary is installed as exim4 to avoid
  24. # conflicts with the exim 3 packages.
  25. exim_path = /usr/sbin/exim4
  26.  
  27. # Macro defining the main configuration directory.
  28. # We do not use absolute paths.
  29. .ifndef CONFDIR
  30. CONFDIR = /etc/exim4
  31. .endif
  32.  
  33. # debconf-driven macro definitions get inserted after this line
  34. UPEX4CmacrosUPEX4C = 1
  35.  
  36. # Create domain and host lists for relay control
  37. # '@' refers to 'the name of the local host'
  38.  
  39. # List of domains considered local for exim. Domains not listed here
  40. # need to be deliverable remotely.
  41. #domainlist local_domains = MAIN_LOCAL_DOMAINS
  42. domainlist local_domains = ${lookup mysql{SELECT `domain` FROM `domain` WHERE `domain`='${quote_mysql:$domain}' AND `active`='1'}}
  43.  
  44. # List of recipient domains to relay _to_. Use this list if you're -
  45. # for example - fallback MX or mail gateway for domains.
  46. #domainlist relay_to_domains = MAIN_RELAY_TO_DOMAINS
  47. domainlist relay_to_domains = ${lookup mysql{SELECT `domain` FROM `domain` WHERE `domain`='${quote_mysql:$domain}' AND `active`='1'}}
  48.  
  49. # List of sender networks (IP addresses) to _unconditionally_ relay
  50. # _for_. If you intend to be SMTP AUTH server, you do not need to enter
  51. # anything here.
  52. #hostlist relay_from_hosts = MAIN_RELAY_NETS
  53. hostlist relay_from_hosts =
  54.  
  55. # Decide which domain to use to add to all unqualified addresses.
  56. # If MAIN_PRIMARY_HOSTNAME_AS_QUALIFY_DOMAIN is defined, the primary
  57. # hostname is used. If not, but MAIN_QUALIFY_DOMAIN is set, the value
  58. # of MAIN_QUALIFY_DOMAIN is used. If both macros are not defined,
  59. # the first line of /etc/mailname is used.
  60. #.ifndef MAIN_PRIMARY_HOSTNAME_AS_QUALIFY_DOMAIN
  61. #.ifndef MAIN_QUALIFY_DOMAIN
  62. #qualify_domain = ETC_MAILNAME
  63. #.else
  64. #qualify_domain = MAIN_QUALIFY_DOMAIN
  65. #.endif
  66. #.endif
  67.  
  68. qualify_domain = mydomain.com
  69. qualify_recipient = mydomain.com
  70.  
  71. # listen on all all interfaces?
  72. .ifdef MAIN_LOCAL_INTERFACES
  73. local_interfaces = MAIN_LOCAL_INTERFACES
  74. .endif
  75.  
  76. .ifndef LOCAL_DELIVERY
  77. # The default transport, set in /etc/exim4/update-exim4.conf.conf,
  78. # defaulting to mail_spool. See CONFDIR/conf.d/transport/ for possibilities
  79. LOCAL_DELIVERY=mail_spool
  80. .endif
  81.  
  82. # The gecos field in /etc/passwd holds not only the name. see passwd(5).
  83. gecos_pattern = ^([^,:]*)
  84. gecos_name = $1
  85.  
  86. # define macros to be used in acl/30_exim4-config_check_rcpt to check
  87. # recipient local parts for strange characters.
  88.  
  89. # This macro definition really should be in
  90. # acl/30_exim4-config_check_rcpt but cannot be there due to
  91. # http://www.exim.org/bugzilla/show_bug.cgi?id=101 as of exim 4.62.
  92.  
  93. # These macros are documented in acl/30_exim4-config_check_rcpt,
  94. # can be changed here or overridden by a locally added configuration
  95. # file as described in README.Debian chapter 2.1.2
  96.  
  97. .ifndef CHECK_RCPT_LOCAL_LOCALPARTS
  98. CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] : ^.*[@%!/|`#&?]
  99. .endif
  100.  
  101. .ifndef CHECK_RCPT_REMOTE_LOCALPARTS
  102. CHECK_RCPT_REMOTE_LOCALPARTS = ^[./|] : ^.*[@%!`#&?] : ^.*/\\.\\./
  103. .endif
  104.  
  105. # always log tls_peerdn as we use TLS for outgoing connects by default
  106. .ifndef MAIN_LOG_SELECTOR
  107. MAIN_LOG_SELECTOR = +smtp_protocol_error +smtp_syntax_error +tls_certificate_verified +tls_peerdn
  108. .endif
  109. #####################################################
  110. ### end main/01_exim4-config_listmacrosdefs
  111. #####################################################
  112. #####################################################
  113. ### main/02_exim4-config_options
  114. #####################################################
  115.  
  116. ### main/02_exim4-config_options
  117. #################################
  118.  
  119.  
  120. # Defines the access control list that is run when an
  121. # SMTP MAIL command is received.
  122. #
  123. .ifndef MAIN_ACL_CHECK_MAIL
  124. MAIN_ACL_CHECK_MAIL = acl_check_mail
  125. .endif
  126. acl_smtp_mail = MAIN_ACL_CHECK_MAIL
  127.  
  128.  
  129. # Defines the access control list that is run when an
  130. # SMTP RCPT command is received.
  131. #
  132. #.ifndef MAIN_ACL_CHECK_RCPT
  133. #MAIN_ACL_CHECK_RCPT = acl_check_rcpt
  134. #.endif
  135. #acl_smtp_rcpt = MAIN_ACL_CHECK_RCPT
  136.  
  137. acl_smtp_rcpt = acl_check_rcpt
  138. #acl_smtp_mime = acl_check_mime
  139. acl_smtp_data = acl_check_data
  140.  
  141. # Defines the access control list that is run when an
  142. # SMTP DATA command is received.
  143. #
  144. #.ifndef MAIN_ACL_CHECK_DATA
  145. #MAIN_ACL_CHECK_DATA = acl_check_data
  146. #.endif
  147. #acl_smtp_data = MAIN_ACL_CHECK_DATA
  148.  
  149.  
  150. # Message size limit. The default (used when MESSAGE_SIZE_LIMIT
  151. # is unset) is 50 MB
  152. .ifdef MESSAGE_SIZE_LIMIT
  153. message_size_limit = MESSAGE_SIZE_LIMIT
  154. .endif
  155.  
  156.  
  157. # If you are running exim4-daemon-heavy or a custom version of Exim that
  158. # was compiled with the content-scanning extension, you can cause incoming
  159. # messages to be automatically scanned for viruses. You have to modify the
  160. # configuration in two places to set this up. The first of them is here,
  161. # where you define the interface to your scanner. This example is typical
  162. # for ClamAV; see the manual for details of what to set for other virus
  163. # scanners. The second modification is in the acl_check_data access
  164. # control list.
  165.  
  166. # av_scanner = clamd:/var/run/clamav/clamd.ctl
  167.  
  168.  
  169. # For spam scanning, there is a similar option that defines the interface to
  170. # SpamAssassin. You do not need to set this if you are using the default, which
  171. # is shown in this commented example. As for virus scanning, you must also
  172. # modify the acl_check_data access control list to enable spam scanning.
  173.  
  174. # spamd_address = 127.0.0.1 783
  175.  
  176. # Domain used to qualify unqualified recipient addresses
  177. # If this option is not set, the qualify_domain value is used.
  178. # qualify_recipient = <value of qualify_domain>
  179.  
  180.  
  181. # Allow Exim to recognize addresses of the form "user@[10.11.12.13]",
  182. # where the domain part is a "domain literal" (an IP address) instead
  183. # of a named domain. The RFCs require this facility, but it is disabled
  184. # in the default config since it is seldomly used and frequently abused.
  185. # Domain literal support also needs a special router, which is automatically
  186. # enabled if you use the enable macro MAIN_ALLOW_DOMAIN_LITERALS.
  187. # Additionally, you might want to make your local IP addresses (or @[])
  188. # local domains.
  189. .ifdef MAIN_ALLOW_DOMAIN_LITERALS
  190. allow_domain_literals
  191. .endif
  192.  
  193. allow_domain_literals = true
  194.  
  195.  
  196. daemon_smtp_ports = 25 : 465: 587
  197. tls_on_connect_ports = 465
  198. tls_advertise_hosts = *
  199. tls_certificate = /etc/exim4/ssl/mydomain.com.pem
  200. tls_privatekey = /etc/exim4/ssl/mydomain.com.pem
  201.  
  202. # Do a reverse DNS lookup on all incoming IP calls, in order to get the
  203. # true host name. If you feel this is too expensive, the networks for
  204. # which a lookup is done can be listed here.
  205. .ifndef DC_minimaldns
  206. .ifndef MAIN_HOST_LOOKUP
  207. MAIN_HOST_LOOKUP = *
  208. .endif
  209. host_lookup = MAIN_HOST_LOOKUP
  210. .endif
  211.  
  212.  
  213. # In a minimaldns setup, update-exim4.conf guesses the hostname and
  214. # dumps it here to avoid DNS lookups being done at Exim run time.
  215. #.ifdef MAIN_HARDCODE_PRIMARY_HOSTNAME
  216. primary_hostname = mydomain.com
  217. #MAIN_HARDCODE_PRIMARY_HOSTNAME
  218. #.endif
  219. hide mysql_servers = localhost/postfix/postfix/1074RQUsptMWKv4gSqVdwAiitl9DTOLa
  220.  
  221.  
  222. # The settings below cause Exim to make RFC 1413 (ident) callbacks
  223. # for all incoming SMTP calls. You can limit the hosts to which these
  224. # calls are made, and/or change the timeout that is used. If you set
  225. # the timeout to zero, all RFC 1413 calls are disabled. RFC 1413 calls
  226. # are cheap and can provide useful information for tracing problem
  227. # messages, but some hosts and firewalls have problems with them.
  228. # This can result in a timeout instead of an immediate refused
  229. # connection, leading to delays on starting up SMTP sessions.
  230. # (The default was reduced from 30s to 5s for release 4.61. and to
  231. # disabled for release 4.86)
  232. #
  233. #rfc1413_hosts = *
  234. #rfc1413_query_timeout = 5s
  235.  
  236.  
  237. # Enable an efficiency feature. We advertise the feature; clients
  238. # may request to use it. For multi-recipient mails we then can
  239. # reject or accept per-user after the message is received.
  240. #
  241. prdr_enable = true
  242.  
  243. # When using an external relay tester (such as rt.njabl.org and/or the
  244. # currently defunct relay-test.mail-abuse.org, the test may be aborted
  245. # since exim complains about "too many nonmail commands". If you want
  246. # the test to complete, add the host from where "your" relay tester
  247. # connects from to the MAIN_SMTP_ACCEPT_MAX_NOMAIL_HOSTS macro.
  248. # Please note that a non-empty setting may cause extra DNS lookups to
  249. # happen, which is the reason why this option is commented out in the
  250. # default settings.
  251. # MAIN_SMTP_ACCEPT_MAX_NOMAIL_HOSTS = !rt.njabl.org
  252. .ifdef MAIN_SMTP_ACCEPT_MAX_NOMAIL_HOSTS
  253. smtp_accept_max_nonmail_hosts = MAIN_SMTP_ACCEPT_MAX_NOMAIL_HOSTS
  254. .endif
  255.  
  256. # By default, exim forces a Sender: header containing the local
  257. # account name at the local host name in all locally submitted messages
  258. # that don't have the local account name at the local host name in the
  259. # From: header, deletes any Sender: header present in the submitted
  260. # message and forces the envelope sender of all locally submitted
  261. # messages to the local account name at the local host name.
  262. # The following settings allow local users to specify their own envelope sender
  263. # in a locally submitted message. Sender: headers existing in a locally
  264. # submitted message are not removed, and no automatic Sender: headers
  265. # are added. These settings are fine for most hosts.
  266. # If you run exim on a classical multi-user systems where all users
  267. # have local mailboxes that can be reached via SMTP from the Internet
  268. # with the local FQDN as the domain part of the address, you might want
  269. # to disable the following three lines for traceability reasons.
  270. .ifndef MAIN_FORCE_SENDER
  271. local_from_check = false
  272. local_sender_retain = true
  273. untrusted_set_sender = *
  274. .endif
  275.  
  276.  
  277. # By default, Exim expects all envelope addresses to be fully qualified, that
  278. # is, they must contain both a local part and a domain. Configure exim
  279. # to accept unqualified addresses from certain hosts. When this is done,
  280. # unqualified addresses are qualified using the settings of qualify_domain
  281. # and/or qualify_recipient (see above).
  282. # sender_unqualified_hosts = <unset>
  283. # recipient_unqualified_hosts = <unset>
  284.  
  285. sender_unqualified_hosts = +relay_from_hosts
  286.  
  287. # то же, но для получателей
  288. recipient_unqualified_hosts = +relay_from_hosts
  289.  
  290. # Configure Exim to support the "percent hack" for certain domains.
  291. # The "percent hack" is the feature by which mail addressed to x%y@z
  292. # (where z is one of the domains listed) is locally rerouted to x@y
  293. # and sent on. If z is not one of the "percent hack" domains, x%y is
  294. # treated as an ordinary local part. The percent hack is rarely needed
  295. # nowadays but frequently abused. You should not enable it unless you
  296. # are sure that you really need it.
  297. # percent_hack_domains = <unset>
  298.  
  299.  
  300. # Bounce handling
  301. .ifndef MAIN_IGNORE_BOUNCE_ERRORS_AFTER
  302. MAIN_IGNORE_BOUNCE_ERRORS_AFTER = 2d
  303. .endif
  304. ignore_bounce_errors_after = MAIN_IGNORE_BOUNCE_ERRORS_AFTER
  305.  
  306. .ifndef MAIN_TIMEOUT_FROZEN_AFTER
  307. MAIN_TIMEOUT_FROZEN_AFTER = 7d
  308. .endif
  309. timeout_frozen_after = MAIN_TIMEOUT_FROZEN_AFTER
  310.  
  311. .ifndef MAIN_FREEZE_TELL
  312. MAIN_FREEZE_TELL = postmaster
  313. .endif
  314. freeze_tell = MAIN_FREEZE_TELL
  315.  
  316.  
  317. # Define spool directory
  318. .ifndef SPOOLDIR
  319. SPOOLDIR = /var/spool/exim4
  320. .endif
  321. spool_directory = SPOOLDIR
  322.  
  323.  
  324. # trusted users can set envelope-from to arbitrary values
  325. .ifndef MAIN_TRUSTED_USERS
  326. MAIN_TRUSTED_USERS = uucp
  327. .endif
  328. trusted_users = MAIN_TRUSTED_USERS
  329. .ifdef MAIN_TRUSTED_GROUPS
  330. trusted_groups = MAIN_TRUSTED_GROUPS
  331. .endif
  332.  
  333.  
  334. # users in admin group can do many other things
  335. # admin_groups = <unset>
  336.  
  337.  
  338. # SMTP Banner. The example includes the Debian version in the SMTP dialog
  339. # MAIN_SMTP_BANNER = "${primary_hostname} ESMTP Exim ${version_number} (Debian package MAIN_PACKAGE_VERSION) ${tod_full}"
  340. # smtp_banner = $smtp_active_hostname ESMTP Exim $version_number $tod_full
  341.  
  342. .ifdef MAIN_KEEP_ENVIRONMENT
  343. keep_environment = MAIN_KEEP_ENVIRONMENT
  344. .endif
  345. .ifdef MAIN_ADD_ENVIRONMENT
  346. add_environment = MAIN_ADD_ENVIRONMENT
  347. .elifndef MAIN_KEEP_ENVIRONMENT
  348. # set empty add_environment to avoid warning.
  349. add_environment = <; PATH=/bin:/usr/bin
  350. .endif
  351. #####################################################
  352. ### end main/02_exim4-config_options
  353. #####################################################
  354. #####################################################
  355. ### main/03_exim4-config_tlsoptions
  356. #####################################################
  357.  
  358. ### main/03_exim4-config_tlsoptions
  359. #################################
  360.  
  361. # TLS/SSL configuration for exim as an SMTP server.
  362. # See /usr/share/doc/exim4-base/README.Debian.gz for explanations.
  363.  
  364. .ifdef MAIN_TLS_ENABLE
  365. # Defines what hosts to 'advertise' STARTTLS functionality to. The
  366. # default, *, will advertise to all hosts that connect with EHLO.
  367. .ifndef MAIN_TLS_ADVERTISE_HOSTS
  368. MAIN_TLS_ADVERTISE_HOSTS = *
  369. .endif
  370. tls_advertise_hosts = MAIN_TLS_ADVERTISE_HOSTS
  371.  
  372.  
  373. # Full paths to Certificate and Private Key. The Private Key file
  374. # must be kept 'secret' and should be owned by root.Debian-exim mode
  375. # 640 (-rw-r-----). exim-gencert takes care of these prerequisites.
  376. # Normally, exim4 looks for certificate and key in different files:
  377. # MAIN_TLS_CERTIFICATE - path to certificate file,
  378. # CONFDIR/exim.crt if unset
  379. # MAIN_TLS_PRIVATEKEY - path to private key file
  380. # CONFDIR/exim.key if unset
  381. # You can also configure exim to look for certificate and key in the
  382. # same file, set MAIN_TLS_CERTKEY to that file to enable. This takes
  383. # precedence over all other settings regarding certificate and key file.
  384. .ifdef MAIN_TLS_CERTKEY
  385. tls_certificate = MAIN_TLS_CERTKEY
  386. .else
  387. .ifndef MAIN_TLS_CERTIFICATE
  388. MAIN_TLS_CERTIFICATE = CONFDIR/exim.crt
  389. .endif
  390. tls_certificate = MAIN_TLS_CERTIFICATE
  391.  
  392. .ifndef MAIN_TLS_PRIVATEKEY
  393. MAIN_TLS_PRIVATEKEY = CONFDIR/exim.key
  394. .endif
  395. tls_privatekey = MAIN_TLS_PRIVATEKEY
  396. .endif
  397.  
  398. # Pointer to the CA Certificates against which client certificates are
  399. # checked. This is controlled by the `tls_verify_hosts' and
  400. # `tls_try_verify_hosts' lists below.
  401. # If you want to check server certificates, you need to add an
  402. # tls_verify_certificates statement to the smtp transport.
  403. # /etc/ssl/certs/ca-certificates.crt is generated by
  404. # the "ca-certificates" package's update-ca-certificates(8) command.
  405. .ifndef MAIN_TLS_VERIFY_CERTIFICATES
  406. MAIN_TLS_VERIFY_CERTIFICATES = ${if exists{/etc/ssl/certs/ca-certificates.crt}\
  407. {/etc/ssl/certs/ca-certificates.crt}\
  408. {/dev/null}}
  409. .endif
  410. tls_verify_certificates = MAIN_TLS_VERIFY_CERTIFICATES
  411.  
  412.  
  413. # A list of hosts which are constrained by `tls_verify_certificates'. A host
  414. # that matches `tls_verify_host' must present a certificate that is
  415. # verifyable through `tls_verify_certificates' in order to be accepted as an
  416. # SMTP client. If it does not, the connection is aborted.
  417. .ifdef MAIN_TLS_VERIFY_HOSTS
  418. tls_verify_hosts = MAIN_TLS_VERIFY_HOSTS
  419. .endif
  420.  
  421. # A weaker form of checking: if a client matches `tls_try_verify_hosts' (but
  422. # not `tls_verify_hosts'), request a certificate and check it against
  423. # `tls_verify_certificates' but do not abort the connection if there is no
  424. # certificate or if the certificate presented does not match. (This
  425. # condition can be tested for in ACLs through `verify = certificate')
  426. # By default, this check is done for all hosts. It is known that some
  427. # clients (including incredimail's version downloadable in February
  428. # 2008) choke on this. To disable, set MAIN_TLS_TRY_VERIFY_HOSTS to an
  429. # empty value.
  430. .ifdef MAIN_TLS_TRY_VERIFY_HOSTS
  431. tls_try_verify_hosts = MAIN_TLS_TRY_VERIFY_HOSTS
  432. .endif
  433.  
  434. .endif
  435. #####################################################
  436. ### end main/03_exim4-config_tlsoptions
  437. #####################################################
  438. #####################################################
  439. ### main/90_exim4-config_log_selector
  440. #####################################################
  441.  
  442. ### main/90_exim4-config_log_selector
  443. #################################
  444.  
  445. # uncomment this for debugging
  446. # MAIN_LOG_SELECTOR == MAIN_LOG_SELECTOR +all -subject -arguments
  447.  
  448. .ifdef MAIN_LOG_SELECTOR
  449. log_selector = MAIN_LOG_SELECTOR
  450. .endif
  451. #####################################################
  452. ### end main/90_exim4-config_log_selector
  453. #####################################################
  454. #####################################################
  455. ### acl/00_exim4-config_header
  456. #####################################################
  457.  
  458. ######################################################################
  459. # ACL CONFIGURATION #
  460. # Specifies access control lists for incoming SMTP mail #
  461. ######################################################################
  462. begin acl
  463.  
  464.  
  465. #####################################################
  466. ### end acl/00_exim4-config_header
  467. #####################################################
  468. #####################################################
  469. ### acl/20_exim4-config_local_deny_exceptions
  470. #####################################################
  471.  
  472. ### acl/20_exim4-config_local_deny_exceptions
  473. #################################
  474.  
  475. # This is used to determine whitelisted senders and hosts.
  476. # It checks for CONFDIR/host_local_deny_exceptions and
  477. # CONFDIR/sender_local_deny_exceptions.
  478. #
  479. # It is meant to be used from some other acl entry.
  480. #
  481. # See exim4-config_files(5) for details.
  482. #
  483. # If the files do not exist, the white list never matches, which is
  484. # the desired behaviour.
  485. #
  486. # The old file names CONFDIR/local_host_whitelist and
  487. # CONFDIR/local_sender_whitelist will continue to be honored for a
  488. # transition period. Their use is deprecated.
  489.  
  490. acl_local_deny_exceptions:
  491. accept
  492. hosts = ${if exists{CONFDIR/host_local_deny_exceptions}\
  493. {CONFDIR/host_local_deny_exceptions}\
  494. {}}
  495. accept
  496. senders = ${if exists{CONFDIR/sender_local_deny_exceptions}\
  497. {CONFDIR/sender_local_deny_exceptions}\
  498. {}}
  499. accept
  500. hosts = ${if exists{CONFDIR/local_host_whitelist}\
  501. {CONFDIR/local_host_whitelist}\
  502. {}}
  503. accept
  504. senders = ${if exists{CONFDIR/local_sender_whitelist}\
  505. {CONFDIR/local_sender_whitelist}\
  506. {}}
  507.  
  508. # This hook allows you to hook in your own ACLs without having to
  509. # modify this file. If you do it like we suggest, you'll end up with
  510. # a small performance penalty since there is an additional file being
  511. # accessed. This doesn't happen if you leave the macro unset.
  512. .ifdef LOCAL_DENY_EXCEPTIONS_LOCAL_ACL_FILE
  513. .include LOCAL_DENY_EXCEPTIONS_LOCAL_ACL_FILE
  514. .endif
  515.  
  516. # this is still supported for a transition period and is deprecated.
  517. .ifdef WHITELIST_LOCAL_DENY_LOCAL_ACL_FILE
  518. .include WHITELIST_LOCAL_DENY_LOCAL_ACL_FILE
  519. .endif
  520. #####################################################
  521. ### end acl/20_exim4-config_local_deny_exceptions
  522. #####################################################
  523. #####################################################
  524. ### acl/30_exim4-config_check_mail
  525. #####################################################
  526.  
  527. ### acl/30_exim4-config_check_mail
  528. #################################
  529.  
  530. # This access control list is used for every MAIL command in an incoming
  531. # SMTP message. The tests are run in order until the address is either
  532. # accepted or denied.
  533. #
  534. acl_check_mail:
  535. .ifdef CHECK_MAIL_HELO_ISSUED
  536. deny
  537. message = no HELO given before MAIL command
  538. condition = ${if def:sender_helo_name {no}{yes}}
  539. .endif
  540.  
  541. accept
  542. #####################################################
  543. ### end acl/30_exim4-config_check_mail
  544. #####################################################
  545. #####################################################
  546. ### acl/30_exim4-config_check_rcpt
  547. #####################################################
  548.  
  549. ### acl/30_exim4-config_check_rcpt
  550. #################################
  551.  
  552. # This access control list is used for every RCPT command in an incoming
  553. # SMTP message. The tests are run in order until the address is either
  554. # accepted or denied.
  555. #
  556. acl_check_rcpt:
  557.  
  558. # Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
  559. # testing for an empty sending host field.
  560. accept
  561. hosts = :
  562. control = dkim_disable_verify
  563.  
  564. # Do not try to verify DKIM signatures of incoming mail if DC_minimaldns
  565. # or DISABLE_DKIM_VERIFY are set.
  566. .ifdef DC_minimaldns
  567. warn
  568. control = dkim_disable_verify
  569. .else
  570. .ifdef DISABLE_DKIM_VERIFY
  571. warn
  572. control = dkim_disable_verify
  573. .endif
  574. .endif
  575.  
  576. # The following section of the ACL is concerned with local parts that contain
  577. # certain non-alphanumeric characters. Dots in unusual places are
  578. # handled by this ACL as well.
  579. #
  580. # Non-alphanumeric characters other than dots are rarely found in genuine
  581. # local parts, but are often tried by people looking to circumvent
  582. # relaying restrictions. Therefore, although they are valid in local
  583. # parts, these rules disallow certain non-alphanumeric characters, as
  584. # a precaution.
  585. #
  586. # Empty components (two dots in a row) are not valid in RFC 2822, but Exim
  587. # allows them because they have been encountered. (Consider local parts
  588. # constructed as "firstinitial.secondinitial.familyname" when applied to
  589. # a name without a second initial.) However, a local part starting
  590. # with a dot or containing /../ can cause trouble if it is used as part of a
  591. # file name (e.g. for a mailing list). This is also true for local parts that
  592. # contain slashes. A pipe symbol can also be troublesome if the local part is
  593. # incorporated unthinkingly into a shell command line.
  594. #
  595. # These ACL components will block recipient addresses that are valid
  596. # from an RFC2822 point of view. We chose to have them blocked by
  597. # default for security reasons.
  598. #
  599. # If you feel that your site should have less strict recipient
  600. # checking, please feel free to change the default values of the macros
  601. # defined in main/01_exim4-config_listmacrosdefs or override them from a
  602. # local configuration file.
  603. #
  604. # Two different rules are used. The first one has a quite strict
  605. # default, and is applied to messages that are addressed to one of the
  606. # local domains handled by this host.
  607.  
  608. # The default value of CHECK_RCPT_LOCAL_LOCALPARTS is defined in
  609. # main/01_exim4-config_listmacrosdefs:
  610. # CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] : ^.*[@%!/|`#&?]
  611. # This blocks local parts that begin with a dot or contain a quite
  612. # broad range of non-alphanumeric characters.
  613. .ifdef CHECK_RCPT_LOCAL_LOCALPARTS
  614. deny
  615. domains = +local_domains
  616. local_parts = CHECK_RCPT_LOCAL_LOCALPARTS
  617. message = restricted characters in address
  618. .endif
  619.  
  620.  
  621. # The second rule applies to all other domains, and its default is
  622. # considerably less strict.
  623.  
  624. # The default value of CHECK_RCPT_REMOTE_LOCALPARTS is defined in
  625. # main/01_exim4-config_listmacrosdefs:
  626. # CHECK_RCPT_REMOTE_LOCALPARTS = ^[./|] : ^.*[@%!`#&?] : ^.*/\\.\\./
  627.  
  628. # It allows local users to send outgoing messages to sites
  629. # that use slashes and vertical bars in their local parts. It blocks
  630. # local parts that begin with a dot, slash, or vertical bar, but allows
  631. # these characters within the local part. However, the sequence /../ is
  632. # barred. The use of some other non-alphanumeric characters is blocked.
  633. # Single quotes might probably be dangerous as well, but they're
  634. # allowed by the default regexps to avoid rejecting mails to Ireland.
  635. # The motivation here is to prevent local users (or local users' malware)
  636. # from mounting certain kinds of attack on remote sites.
  637. .ifdef CHECK_RCPT_REMOTE_LOCALPARTS
  638. deny
  639. domains = !+local_domains
  640. local_parts = CHECK_RCPT_REMOTE_LOCALPARTS
  641. message = restricted characters in address
  642. .endif
  643.  
  644.  
  645. # Accept mail to postmaster in any local domain, regardless of the source,
  646. # and without verifying the sender.
  647. #
  648. accept
  649. .ifndef CHECK_RCPT_POSTMASTER
  650. local_parts = postmaster
  651. .else
  652. local_parts = CHECK_RCPT_POSTMASTER
  653. .endif
  654. domains = +local_domains : +relay_to_domains
  655.  
  656.  
  657. # Deny unless the sender address can be verified.
  658. #
  659. # This is disabled by default so that DNSless systems don't break. If
  660. # your system can do DNS lookups without delay or cost, you might want
  661. # to enable this feature.
  662. #
  663. # This feature does not work in smarthost and satellite setups as
  664. # with these setups all domains pass verification. See spec.txt chapter
  665. # 39.31 with the added information that a smarthost/satellite setup
  666. # routes all non-local e-mail to the smarthost.
  667. .ifdef CHECK_RCPT_VERIFY_SENDER
  668. deny
  669. message = Sender verification failed
  670. !acl = acl_local_deny_exceptions
  671. !verify = sender
  672. .endif
  673.  
  674. # Verify senders listed in local_sender_callout with a callout.
  675. #
  676. # In smarthost and satellite setups, this causes the callout to be
  677. # done to the smarthost. Verification will thus only be reliable if the
  678. # smarthost does reject illegal addresses in the SMTP dialog.
  679. deny
  680. !acl = acl_local_deny_exceptions
  681. senders = ${if exists{CONFDIR/local_sender_callout}\
  682. {CONFDIR/local_sender_callout}\
  683. {}}
  684. !verify = sender/callout
  685.  
  686.  
  687. # Accept if the message comes from one of the hosts for which we are an
  688. # outgoing relay. It is assumed that such hosts are most likely to be MUAs,
  689. # so we set control=submission to make Exim treat the message as a
  690. # submission. It will fix up various errors in the message, for example, the
  691. # lack of a Date: header line. If you are actually relaying out out from
  692. # MTAs, you may want to disable this. If you are handling both relaying from
  693. # MTAs and submissions from MUAs you should probably split them into two
  694. # lists, and handle them differently.
  695.  
  696. # Recipient verification is omitted here, because in many cases the clients
  697. # are dumb MUAs that don't cope well with SMTP error responses. If you are
  698. # actually relaying out from MTAs, you should probably add recipient
  699. # verification here.
  700.  
  701. # Note that, by putting this test before any DNS black list checks, you will
  702. # always accept from these hosts, even if they end up on a black list. The
  703. # assumption is that they are your friends, and if they get onto black
  704. # list, it is a mistake.
  705. accept
  706. hosts = +relay_from_hosts
  707. control = submission/sender_retain
  708. control = dkim_disable_verify
  709.  
  710.  
  711. # Accept if the message arrived over an authenticated connection, from
  712. # any host. Again, these messages are usually from MUAs, so recipient
  713. # verification is omitted, and submission mode is set. And again, we do this
  714. # check before any black list tests.
  715. accept
  716. authenticated = *
  717. control = submission/sender_retain
  718. control = dkim_disable_verify
  719.  
  720.  
  721. # Insist that any other recipient address that we accept is either in one of
  722. # our local domains, or is in a domain for which we explicitly allow
  723. # relaying. Any other domain is rejected as being unacceptable for relaying.
  724. require
  725. message = relay not permitted
  726. domains = +local_domains : +relay_to_domains
  727.  
  728.  
  729. # We also require all accepted addresses to be verifiable. This check will
  730. # do local part verification for local domains, but only check the domain
  731. # for remote domains.
  732. require
  733. verify = recipient
  734.  
  735.  
  736. # Verify recipients listed in local_rcpt_callout with a callout.
  737. # This is especially handy for forwarding MX hosts (secondary MX or
  738. # mail hubs) of domains that receive a lot of spam to non-existent
  739. # addresses. The only way to check local parts for remote relay
  740. # domains is to use a callout (add /callout), but please read the
  741. # documentation about callouts before doing this.
  742. deny
  743. !acl = acl_local_deny_exceptions
  744. recipients = ${if exists{CONFDIR/local_rcpt_callout}\
  745. {CONFDIR/local_rcpt_callout}\
  746. {}}
  747. !verify = recipient/callout
  748.  
  749.  
  750. # CONFDIR/local_sender_blacklist holds a list of envelope senders that
  751. # should have their access denied to the local host. Incoming messages
  752. # with one of these senders are rejected at RCPT time.
  753. #
  754. # The explicit white lists are honored as well as negative items in
  755. # the black list. See exim4-config_files(5) for details.
  756. deny
  757. message = sender envelope address $sender_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
  758. !acl = acl_local_deny_exceptions
  759. senders = ${if exists{CONFDIR/local_sender_blacklist}\
  760. {CONFDIR/local_sender_blacklist}\
  761. {}}
  762.  
  763.  
  764. # deny bad sites (IP address)
  765. # CONFDIR/local_host_blacklist holds a list of host names, IP addresses
  766. # and networks (CIDR notation) that should have their access denied to
  767. # The local host. Messages coming in from a listed host will have all
  768. # RCPT statements rejected.
  769. #
  770. # The explicit white lists are honored as well as negative items in
  771. # the black list. See exim4-config_files(5) for details.
  772. deny
  773. message = sender IP address $sender_host_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
  774. !acl = acl_local_deny_exceptions
  775. hosts = ${if exists{CONFDIR/local_host_blacklist}\
  776. {CONFDIR/local_host_blacklist}\
  777. {}}
  778.  
  779.  
  780. # Warn if the sender host does not have valid reverse DNS.
  781. #
  782. # If your system can do DNS lookups without delay or cost, you might want
  783. # to enable this.
  784. # If sender_host_address is defined, it's a remote call. If
  785. # sender_host_name is not defined, then reverse lookup failed. Use
  786. # this instead of !verify = reverse_host_lookup to catch deferrals
  787. # as well as outright failures.
  788. .ifdef CHECK_RCPT_REVERSE_DNS
  789. warn
  790. condition = ${if and{{def:sender_host_address}{!def:sender_host_name}}\
  791. {yes}{no}}
  792. add_header = X-Host-Lookup-Failed: Reverse DNS lookup failed for $sender_host_address (${if eq{$host_lookup_failed}{1}{failed}{deferred}})
  793. .endif
  794.  
  795.  
  796. # Use spfquery to perform a pair of SPF checks (for details, see
  797. # http://www.openspf.org/)
  798. #
  799. # This is quite costly in terms of DNS lookups (~6 lookups per mail). Do not
  800. # enable if that's an issue. Also note that if you enable this, you must
  801. # install "spf-tools-perl" which provides the spfquery command.
  802. # Missing spf-tools-perl will trigger the "Unexpected error in
  803. # SPF check" warning.
  804. .ifdef CHECK_RCPT_SPF
  805. deny
  806. message = [SPF] $sender_host_address is not allowed to send mail from \
  807. ${if def:sender_address_domain {$sender_address_domain}{$sender_helo_name}}. \
  808. Please see \
  809. http://www.openspf.org/Why?scope=${if def:sender_address_domain \
  810. {mfrom}{helo}};identity=${if def:sender_address_domain \
  811. {$sender_address}{$sender_helo_name}};ip=$sender_host_address
  812. log_message = SPF check failed.
  813. !acl = acl_local_deny_exceptions
  814. condition = ${run{/usr/bin/spfquery.mail-spf-perl --ip \
  815. ${quote:$sender_host_address} --identity \
  816. ${if def:sender_address_domain \
  817. {--scope mfrom --identity ${quote:$sender_address}}\
  818. {--scope helo --identity ${quote:$sender_helo_name}}}}\
  819. {no}{${if eq {$runrc}{1}{yes}{no}}}}
  820.  
  821. defer
  822. message = Temporary DNS error while checking SPF record. Try again later.
  823. !acl = acl_local_deny_exceptions
  824. condition = ${if eq {$runrc}{5}{yes}{no}}
  825.  
  826. warn
  827. condition = ${if <={$runrc}{6}{yes}{no}}
  828. add_header = Received-SPF: ${if eq {$runrc}{0}{pass}\
  829. {${if eq {$runrc}{2}{softfail}\
  830. {${if eq {$runrc}{3}{neutral}\
  831. {${if eq {$runrc}{4}{permerror}\
  832. {${if eq {$runrc}{6}{none}{error}}}}}}}}}\
  833. } client-ip=$sender_host_address; \
  834. ${if def:sender_address_domain \
  835. {envelope-from=${sender_address}; }{}}\
  836. helo=$sender_helo_name
  837.  
  838. warn
  839. log_message = Unexpected error in SPF check.
  840. condition = ${if >{$runrc}{6}{yes}{no}}
  841. .endif
  842.  
  843.  
  844. # Check against classic DNS "black" lists (DNSBLs) which list
  845. # sender IP addresses
  846. .ifdef CHECK_RCPT_IP_DNSBLS
  847. warn
  848. dnslists = CHECK_RCPT_IP_DNSBLS
  849. add_header = X-Warning: $sender_host_address is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
  850. log_message = $sender_host_address is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
  851. .endif
  852.  
  853.  
  854. # Check against DNSBLs which list sender domains, with an option to locally
  855. # whitelist certain domains that might be blacklisted.
  856. #
  857. # Note: If you define CHECK_RCPT_DOMAIN_DNSBLS, you must append
  858. # "/$sender_address_domain" after each domain. For example:
  859. # CHECK_RCPT_DOMAIN_DNSBLS = rhsbl.foo.org/$sender_address_domain \
  860. # : rhsbl.bar.org/$sender_address_domain
  861. .ifdef CHECK_RCPT_DOMAIN_DNSBLS
  862. warn
  863. !senders = ${if exists{CONFDIR/local_domain_dnsbl_whitelist}\
  864. {CONFDIR/local_domain_dnsbl_whitelist}\
  865. {}}
  866. dnslists = CHECK_RCPT_DOMAIN_DNSBLS
  867. add_header = X-Warning: $sender_address_domain is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
  868. log_message = $sender_address_domain is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
  869. .endif
  870.  
  871.  
  872. # This hook allows you to hook in your own ACLs without having to
  873. # modify this file. If you do it like we suggest, you'll end up with
  874. # a small performance penalty since there is an additional file being
  875. # accessed. This doesn't happen if you leave the macro unset.
  876. .ifdef CHECK_RCPT_LOCAL_ACL_FILE
  877. .include CHECK_RCPT_LOCAL_ACL_FILE
  878. .endif
  879.  
  880.  
  881. #############################################################################
  882. # This check is commented out because it is recognized that not every
  883. # sysadmin will want to do it. If you enable it, the check performs
  884. # Client SMTP Authorization (csa) checks on the sending host. These checks
  885. # do DNS lookups for SRV records. The CSA proposal is currently (May 2005)
  886. # an Internet draft. You can, of course, add additional conditions to this
  887. # ACL statement to restrict the CSA checks to certain hosts only.
  888. #
  889. # require verify = csa
  890. #############################################################################
  891.  
  892.  
  893. # Accept if the address is in a domain for which we are an incoming relay,
  894. # but again, only if the recipient can be verified.
  895.  
  896. accept
  897. domains = +relay_to_domains
  898. endpass
  899. verify = recipient
  900.  
  901.  
  902. # At this point, the address has passed all the checks that have been
  903. # configured, so we accept it unconditionally.
  904.  
  905. accept
  906. #####################################################
  907. ### end acl/30_exim4-config_check_rcpt
  908. #####################################################
  909. #####################################################
  910. ### acl/40_exim4-config_check_data
  911. #####################################################
  912.  
  913. ### acl/40_exim4-config_check_data
  914. #################################
  915.  
  916. # This ACL is used after the contents of a message have been received. This
  917. # is the ACL in which you can test a message's headers or body, and in
  918. # particular, this is where you can invoke external virus or spam scanners.
  919.  
  920. acl_check_data:
  921.  
  922. # Deny unless the address list headers are syntactically correct.
  923. #
  924. # If you enable this, you might reject legitimate mail.
  925. .ifdef CHECK_DATA_VERIFY_HEADER_SYNTAX
  926. deny
  927. message = Message headers fail syntax check
  928. !acl = acl_local_deny_exceptions
  929. !verify = header_syntax
  930. .endif
  931.  
  932.  
  933. # require that there is a verifiable sender address in at least
  934. # one of the "Sender:", "Reply-To:", or "From:" header lines.
  935. .ifdef CHECK_DATA_VERIFY_HEADER_SENDER
  936. deny
  937. message = No verifiable sender address in message headers
  938. !acl = acl_local_deny_exceptions
  939. !verify = header_sender
  940. .endif
  941.  
  942.  
  943. # Deny if the message contains malware. Before enabling this check, you
  944. # must install a virus scanner and set the av_scanner option in the
  945. # main configuration.
  946. #
  947. # exim4-daemon-heavy must be used for this section to work.
  948. #
  949. # deny
  950. # malware = *
  951. # message = This message was detected as possible malware ($malware_name).
  952.  
  953.  
  954. # Add headers to a message if it is judged to be spam. Before enabling this,
  955. # you must install SpamAssassin. You also need to set the spamd_address
  956. # option in the main configuration.
  957. #
  958. # exim4-daemon-heavy must be used for this section to work.
  959. #
  960. # Please note that this is only suiteable as an example. There are
  961. # multiple issues with this configuration method. For example, if you go
  962. # this way, you'll give your spamassassin daemon write access to the
  963. # entire exim spool which might be a security issue in case of a
  964. # spamassassin exploit.
  965. #
  966. # See the exim docs and the exim wiki for more suitable examples.
  967. #
  968. # warn
  969. # spam = Debian-exim:true
  970. # add_header = X-Spam_score: $spam_score\n\
  971. # X-Spam_score_int: $spam_score_int\n\
  972. # X-Spam_bar: $spam_bar\n\
  973. # X-Spam_report: $spam_report
  974.  
  975.  
  976. # This hook allows you to hook in your own ACLs without having to
  977. # modify this file. If you do it like we suggest, you'll end up with
  978. # a small performance penalty since there is an additional file being
  979. # accessed. This doesn't happen if you leave the macro unset.
  980. .ifdef CHECK_DATA_LOCAL_ACL_FILE
  981. .include CHECK_DATA_LOCAL_ACL_FILE
  982. .endif
  983.  
  984.  
  985. # accept otherwise
  986. accept
  987. #####################################################
  988. ### end acl/40_exim4-config_check_data
  989. #####################################################
  990. #####################################################
  991. ### router/00_exim4-config_header
  992. #####################################################
  993.  
  994. ######################################################################
  995. # ROUTERS CONFIGURATION #
  996. # Specifies how addresses are handled #
  997. ######################################################################
  998. # THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT! #
  999. # An address is passed to each router in turn until it is accepted. #
  1000. ######################################################################
  1001.  
  1002. begin routers
  1003.  
  1004. #####################################################
  1005. ### end router/00_exim4-config_header
  1006. #####################################################
  1007. #####################################################
  1008. ### router/100_exim4-config_domain_literal
  1009. #####################################################
  1010.  
  1011. ### router/100_exim4-config_domain_literal
  1012. #################################
  1013.  
  1014. # This router handles e-mail addresses in "domain literal" form like
  1015. # <user@[10.11.12.13]>. The RFCs require this facility, but it is disabled
  1016. # in the default config since it is seldomly used and frequently abused.
  1017. # Domain literal support also needs to be enabled in the main config,
  1018. # which is automatically done if you use the enable macro
  1019. # MAIN_ALLOW_DOMAIN_LITERALS.
  1020.  
  1021. .ifdef MAIN_ALLOW_DOMAIN_LITERALS
  1022. domain_literal:
  1023. debug_print = "R: domain_literal for $local_part@$domain"
  1024. driver = ipliteral
  1025. domains = ! +local_domains
  1026. transport = remote_smtp
  1027. .endif
  1028. #####################################################
  1029. ### end router/100_exim4-config_domain_literal
  1030. #####################################################
  1031. #####################################################
  1032. ### router/150_exim4-config_hubbed_hosts
  1033. #####################################################
  1034.  
  1035. # router/150_exim4-config_hubbed_hosts
  1036. #################################
  1037.  
  1038. # route specific domains manually.
  1039. #
  1040. # see exim4-config_files(5) and spec.txt chapter 20.3 through 20.7 for
  1041. # more detailed documentation.
  1042.  
  1043. hubbed_hosts:
  1044. debug_print = "R: hubbed_hosts for $domain"
  1045. driver = manualroute
  1046. domains = "${if exists{CONFDIR/hubbed_hosts}\
  1047. {partial-lsearch;CONFDIR/hubbed_hosts}\
  1048. fail}"
  1049. same_domain_copy_routing = yes
  1050. route_data = ${lookup{$domain}partial-lsearch{CONFDIR/hubbed_hosts}}
  1051. transport = remote_smtp
  1052. #####################################################
  1053. ### end router/150_exim4-config_hubbed_hosts
  1054. #####################################################
  1055. #####################################################
  1056. ### router/200_exim4-config_primary
  1057. #####################################################
  1058.  
  1059. ### router/200_exim4-config_primary
  1060. #################################
  1061. # This file holds the primary router, responsible for nonlocal mails
  1062.  
  1063. .ifdef DCconfig_internet
  1064. # configtype=internet
  1065. #
  1066. # deliver mail to the recipient if recipient domain is a domain we
  1067. # relay for. We do not ignore any target hosts here since delivering to
  1068. # a site local or even a link local address might be wanted here, and if
  1069. # such an address has found its way into the MX record of such a domain,
  1070. # the local admin is probably in a place where that broken MX record
  1071. # could be fixed.
  1072.  
  1073. dnslookup_relay_to_domains:
  1074. debug_print = "R: dnslookup_relay_to_domains for $local_part@$domain"
  1075. driver = dnslookup
  1076. domains = ! +local_domains : +relay_to_domains
  1077. transport = remote_smtp
  1078. same_domain_copy_routing = yes
  1079. no_more
  1080.  
  1081. # deliver mail directly to the recipient. This router is only reached
  1082. # for domains that we do not relay for. Since we most probably can't
  1083. # have broken MX records pointing to site local or link local IP
  1084. # addresses fixed, we ignore target hosts pointing to these addresses.
  1085.  
  1086. dnslookup:
  1087. debug_print = "R: dnslookup for $local_part@$domain"
  1088. driver = dnslookup
  1089. domains = ! +local_domains
  1090. transport = remote_smtp
  1091. same_domain_copy_routing = yes
  1092. # ignore private rfc1918 and APIPA addresses
  1093. ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8 : 192.168.0.0/16 :\
  1094. 172.16.0.0/12 : 10.0.0.0/8 : 169.254.0.0/16 :\
  1095. 255.255.255.255
  1096. no_more
  1097.  
  1098. .endif
  1099.  
  1100.  
  1101. .ifdef DCconfig_local
  1102. # configtype=local
  1103. #
  1104. # Stand-alone system, so generate an error for mail to a non-local domain
  1105. nonlocal:
  1106. debug_print = "R: nonlocal for $local_part@$domain"
  1107. driver = redirect
  1108. domains = ! +local_domains
  1109. allow_fail
  1110. data = :fail: Mailing to remote domains not supported
  1111. no_more
  1112.  
  1113. .endif
  1114.  
  1115.  
  1116. .ifdef DCconfig_smarthost DCconfig_satellite
  1117. # configtype=smarthost or configtype=satellite
  1118. #
  1119. # Send all non-local mail to a single other machine (smarthost).
  1120. #
  1121. # This means _ALL_ non-local mail goes to the smarthost. This will most
  1122. # probably not do what you want for domains that are listed in
  1123. # relay_domains. The most typical use for relay_domains is to control
  1124. # relaying for incoming e-mail on secondary MX hosts. In that case,
  1125. # it doesn't make sense to send the mail to the smarthost since the
  1126. # smarthost will probably send the message right back here, causing a
  1127. # loop.
  1128. #
  1129. # If you want to use a smarthost while being secondary MX for some
  1130. # domains, you'll need to copy the dnslookup_relay_to_domains router
  1131. # here so that mail to relay_domains is handled separately.
  1132.  
  1133. smarthost:
  1134. debug_print = "R: smarthost for $local_part@$domain"
  1135. driver = manualroute
  1136. domains = ! +local_domains
  1137. transport = remote_smtp_smarthost
  1138. route_list = * DCsmarthost byname
  1139. host_find_failed = ignore
  1140. same_domain_copy_routing = yes
  1141. no_more
  1142.  
  1143. .endif
  1144.  
  1145.  
  1146. # The "no_more" above means that all later routers are for
  1147. # domains in the local_domains list, i.e. just like Exim 3 directors.
  1148. #####################################################
  1149. ### end router/200_exim4-config_primary
  1150. #####################################################
  1151. #####################################################
  1152. ### router/300_exim4-config_real_local
  1153. #####################################################
  1154.  
  1155. ### router/300_exim4-config_real_local
  1156. #################################
  1157.  
  1158. # This router allows reaching a local user while avoiding local
  1159. # processing. This can be used to inform a user of a broken .forward
  1160. # file, for example. The userforward router does this.
  1161.  
  1162. COND_LOCAL_SUBMITTER = "\
  1163. ${if match_ip{$sender_host_address}{:@[]}\
  1164. {1}{0}\
  1165. }"
  1166.  
  1167. real_local:
  1168. debug_print = "R: real_local for $local_part@$domain"
  1169. driver = accept
  1170. domains = +local_domains
  1171. condition = COND_LOCAL_SUBMITTER
  1172. local_part_prefix = real-
  1173. check_local_user
  1174. transport = LOCAL_DELIVERY
  1175.  
  1176. #####################################################
  1177. ### end router/300_exim4-config_real_local
  1178. #####################################################
  1179. #####################################################
  1180. ### router/400_exim4-config_system_aliases
  1181. #####################################################
  1182.  
  1183. ### router/400_exim4-config_system_aliases
  1184. #################################
  1185.  
  1186. # This router handles aliasing using a traditional /etc/aliases file.
  1187. #
  1188. ##### NB You must ensure that /etc/aliases exists. It used to be the case
  1189. ##### NB that every Unix had that file, because it was the Sendmail default.
  1190. ##### NB These days, there are systems that don't have it. Your aliases
  1191. ##### NB file should at least contain an alias for "postmaster".
  1192. #
  1193. # This router handles the local part in a case-insensitive way which
  1194. # satisfies the RFCs requirement that postmaster be reachable regardless
  1195. # of case. If you decide to handle /etc/aliases in a caseful way, you
  1196. # need to make arrangements for a caseless postmaster.
  1197. #
  1198. # Delivery to arbitrary directories, files, and piping to programs in
  1199. # /etc/aliases is disabled per default.
  1200. # If that is a problem for you, see
  1201. # /usr/share/doc/exim4-base/README.Debian.gz
  1202. # for explanation and some workarounds.
  1203.  
  1204.  
  1205.  
  1206.  
  1207. # Почтовые алиасы (виртуальные адреса)
  1208. system_aliases:
  1209. driver = redirect
  1210. allow_fail
  1211. allow_defer
  1212. data = ${lookup mysql{SELECT `goto` FROM `alias` WHERE `address`='${quote_mysql:$local_part@$domain}' OR `address`='${quote_mysql:@$domain}'}}
  1213. # data = ${lookup{$local_part}lsearch{/etc/exim/alias}}
  1214.  
  1215.  
  1216. dovecot_user:
  1217. driver = accept
  1218. condition = ${lookup mysql{SELECT `goto` FROM `alias` WHERE `address`='${quote_mysql:$local_part@$domain}' OR `address`='${quote_mysql:@$domain}'}{yes}{no}}
  1219. transport = dovecot_delivery
  1220.  
  1221.  
  1222. #system_aliases:
  1223. # debug_print = "R: system_aliases for $local_part@$domain"
  1224. # driver = redirect
  1225. # domains = +local_domains
  1226. # allow_fail
  1227. # allow_defer
  1228. # data = ${lookup{$local_part}lsearch{/etc/aliases}}
  1229. # .ifdef SYSTEM_ALIASES_USER
  1230. # user = SYSTEM_ALIASES_USER
  1231. # .endif
  1232. # .ifdef SYSTEM_ALIASES_GROUP
  1233. # group = SYSTEM_ALIASES_GROUP
  1234. # .endif
  1235. # .ifdef SYSTEM_ALIASES_FILE_TRANSPORT
  1236. # file_transport = SYSTEM_ALIASES_FILE_TRANSPORT
  1237. # .endif
  1238. # .ifdef SYSTEM_ALIASES_PIPE_TRANSPORT
  1239. # pipe_transport = SYSTEM_ALIASES_PIPE_TRANSPORT
  1240. # .endif
  1241. # .ifdef SYSTEM_ALIASES_DIRECTORY_TRANSPORT
  1242. # directory_transport = SYSTEM_ALIASES_DIRECTORY_TRANSPORT
  1243. # .endif
  1244. #####################################################
  1245. ### end router/400_exim4-config_system_aliases
  1246. #####################################################
  1247. #####################################################
  1248. ### router/500_exim4-config_hubuser
  1249. #####################################################
  1250.  
  1251. ### router/500_exim4-config_hubuser
  1252. #################################
  1253.  
  1254. .ifdef DCconfig_satellite
  1255. # This router is only used for configtype=satellite.
  1256. # It takes care to route all mail targetted to <somelocaluser@this.machine>
  1257. # to the host where we read our mail
  1258. #
  1259. hub_user:
  1260. debug_print = "R: hub_user for $local_part@$domain"
  1261. driver = redirect
  1262. domains = +local_domains
  1263. data = ${local_part}@DCreadhost
  1264. check_local_user
  1265.  
  1266. # Grab the redirected mail and deliver it.
  1267. # This is a duplicate of the smarthost router, needed because
  1268. # DCreadhost might end up as part of +local_domains
  1269. hub_user_smarthost:
  1270. debug_print = "R: hub_user_smarthost for $local_part@$domain"
  1271. driver = manualroute
  1272. domains = DCreadhost
  1273. transport = remote_smtp_smarthost
  1274. route_list = * DCsmarthost byname
  1275. host_find_failed = ignore
  1276. same_domain_copy_routing = yes
  1277. check_local_user
  1278. .endif
  1279.  
  1280.  
  1281. #####################################################
  1282. ### end router/500_exim4-config_hubuser
  1283. #####################################################
  1284. #####################################################
  1285. ### router/600_exim4-config_userforward
  1286. #####################################################
  1287.  
  1288. ### router/600_exim4-config_userforward
  1289. #################################
  1290.  
  1291. # This router handles forwarding using traditional .forward files in users'
  1292. # home directories. It also allows mail filtering with a forward file
  1293. # starting with the string "# Exim filter" or "# Sieve filter".
  1294. #
  1295. # The no_verify setting means that this router is skipped when Exim is
  1296. # verifying addresses. Similarly, no_expn means that this router is skipped if
  1297. # Exim is processing an EXPN command.
  1298. #
  1299. # The check_ancestor option means that if the forward file generates an
  1300. # address that is an ancestor of the current one, the current one gets
  1301. # passed on instead. This covers the case where A is aliased to B and B
  1302. # has a .forward file pointing to A.
  1303. #
  1304. # The four transports specified at the end are those that are used when
  1305. # forwarding generates a direct delivery to a directory, or a file, or to a
  1306. # pipe, or sets up an auto-reply, respectively.
  1307. #
  1308. userforward:
  1309. debug_print = "R: userforward for $local_part@$domain"
  1310. driver = redirect
  1311. domains = +local_domains
  1312. check_local_user
  1313. file = $home/.forward
  1314. require_files = $local_part:$home/.forward
  1315. no_verify
  1316. no_expn
  1317. check_ancestor
  1318. allow_filter
  1319. forbid_smtp_code = true
  1320. directory_transport = address_directory
  1321. file_transport = address_file
  1322. pipe_transport = address_pipe
  1323. reply_transport = address_reply
  1324. skip_syntax_errors
  1325. syntax_errors_to = real-$local_part@$domain
  1326. syntax_errors_text = \
  1327. This is an automatically generated message. An error has\n\
  1328. been found in your .forward file. Details of the error are\n\
  1329. reported below. While this error persists, you will receive\n\
  1330. a copy of this message for every message that is addressed\n\
  1331. to you. If your .forward file is a filter file, or if it is\n\
  1332. a non-filter file containing no valid forwarding addresses,\n\
  1333. a copy of each incoming message will be put in your normal\n\
  1334. mailbox. If a non-filter file contains at least one valid\n\
  1335. forwarding address, forwarding to the valid addresses will\n\
  1336. happen, and those will be the only deliveries that occur.
  1337.  
  1338. #####################################################
  1339. ### end router/600_exim4-config_userforward
  1340. #####################################################
  1341. #####################################################
  1342. ### router/700_exim4-config_procmail
  1343. #####################################################
  1344.  
  1345. procmail:
  1346. debug_print = "R: procmail for $local_part@$domain"
  1347. driver = accept
  1348. domains = +local_domains
  1349. check_local_user
  1350. transport = procmail_pipe
  1351. # emulate OR with "if exists"-expansion
  1352. require_files = ${local_part}:\
  1353. ${if exists{/etc/procmailrc}\
  1354. {/etc/procmailrc}{${home}/.procmailrc}}:\
  1355. +/usr/bin/procmail
  1356. no_verify
  1357. no_expn
  1358.  
  1359. #####################################################
  1360. ### end router/700_exim4-config_procmail
  1361. #####################################################
  1362. #####################################################
  1363. ### router/800_exim4-config_maildrop
  1364. #####################################################
  1365.  
  1366. ### router/800_exim4-config_maildrop
  1367. #################################
  1368.  
  1369. maildrop:
  1370. debug_print = "R: maildrop for $local_part@$domain"
  1371. driver = accept
  1372. domains = +local_domains
  1373. check_local_user
  1374. transport = maildrop_pipe
  1375. require_files = ${local_part}:${home}/.mailfilter:+/usr/bin/maildrop
  1376. no_verify
  1377. no_expn
  1378.  
  1379. #####################################################
  1380. ### end router/800_exim4-config_maildrop
  1381. #####################################################
  1382. #####################################################
  1383. ### router/850_exim4-config_lowuid
  1384. #####################################################
  1385.  
  1386. ### router/850_exim4-config_lowuid
  1387. #################################
  1388.  
  1389. .ifndef FIRST_USER_ACCOUNT_UID
  1390. FIRST_USER_ACCOUNT_UID = 0
  1391. .endif
  1392.  
  1393. .ifndef DEFAULT_SYSTEM_ACCOUNT_ALIAS
  1394. DEFAULT_SYSTEM_ACCOUNT_ALIAS = :fail: no mail to system accounts
  1395. .endif
  1396.  
  1397. COND_SYSTEM_USER_AND_REMOTE_SUBMITTER = "\
  1398. ${if and{{! match_ip{$sender_host_address}{:@[]}}\
  1399. {<{$local_user_uid}{FIRST_USER_ACCOUNT_UID}}}\
  1400. {1}{0}\
  1401. }"
  1402.  
  1403. lowuid_aliases:
  1404. debug_print = "R: lowuid_aliases for $local_part@$domain (UID $local_user_uid)"
  1405. check_local_user
  1406. driver = redirect
  1407. allow_fail
  1408. domains = +local_domains
  1409. condition = COND_SYSTEM_USER_AND_REMOTE_SUBMITTER
  1410. data = ${if exists{CONFDIR/lowuid-aliases}\
  1411. {${lookup{$local_part}lsearch{CONFDIR/lowuid-aliases}\
  1412. {$value}{DEFAULT_SYSTEM_ACCOUNT_ALIAS}}}\
  1413. {DEFAULT_SYSTEM_ACCOUNT_ALIAS}}
  1414. #####################################################
  1415. ### end router/850_exim4-config_lowuid
  1416. #####################################################
  1417. #####################################################
  1418. ### router/900_exim4-config_local_user
  1419. #####################################################
  1420.  
  1421. ### router/900_exim4-config_local_user
  1422. #################################
  1423.  
  1424. # This router matches local user mailboxes. If the router fails, the error
  1425. # message is "Unknown user".
  1426.  
  1427. local_user:
  1428. debug_print = "R: local_user for $local_part@$domain"
  1429. driver = accept
  1430. domains = +local_domains
  1431. check_local_user
  1432. local_parts = ! root
  1433. transport = LOCAL_DELIVERY
  1434. cannot_route_message = Unknown user
  1435. #####################################################
  1436. ### end router/900_exim4-config_local_user
  1437. #####################################################
  1438. #####################################################
  1439. ### router/mmm_mail4root
  1440. #####################################################
  1441.  
  1442. ### router/mmm_mail4root
  1443. #################################
  1444. # deliver mail addressed to root to /var/mail/mail as user mail:mail
  1445. # if it was not redirected in /etc/aliases or by other means
  1446. # Exim cannot deliver as root since 4.24 (FIXED_NEVER_USERS)
  1447.  
  1448. mail4root:
  1449. debug_print = "R: mail4root for $local_part@$domain"
  1450. driver = redirect
  1451. domains = +local_domains
  1452. data = /var/mail/mail
  1453. file_transport = address_file
  1454. local_parts = root
  1455. user = mail
  1456. group = mail
  1457.  
  1458. #####################################################
  1459. ### end router/mmm_mail4root
  1460. #####################################################
  1461. #####################################################
  1462. ### transport/00_exim4-config_header
  1463. #####################################################
  1464.  
  1465. ######################################################################
  1466. # TRANSPORTS CONFIGURATION #
  1467. ######################################################################
  1468. # ORDER DOES NOT MATTER #
  1469. # Only one appropriate transport is called for each delivery. #
  1470. ######################################################################
  1471.  
  1472. # A transport is used only when referenced from a router that successfully
  1473. # handles an address.
  1474.  
  1475. begin transports
  1476.  
  1477. #####################################################
  1478. ### end transport/00_exim4-config_header
  1479. #####################################################
  1480. #####################################################
  1481. ### transport/10_exim4-config_transport-macros
  1482. #####################################################
  1483.  
  1484. ### transport/10_exim4-config_transport-macros
  1485. #################################
  1486.  
  1487. .ifdef HIDE_MAILNAME
  1488. REMOTE_SMTP_HEADERS_REWRITE=*@+local_domains $1@DCreadhost frs : *@ETC_MAILNAME $1@DCreadhost frs
  1489. REMOTE_SMTP_RETURN_PATH=${if match_domain{$sender_address_domain}{+local_domains}{${sender_address_local_part}@DCreadhost}{${if match_domain{$sender_address_domain}{ETC_MAILNAME}{${sender_address_local_part}@DCreadhost}fail}}}
  1490. .endif
  1491.  
  1492. .ifdef REMOTE_SMTP_HELO_FROM_DNS
  1493. .ifdef REMOTE_SMTP_HELO_DATA
  1494. REMOTE_SMTP_HELO_DATA==${lookup dnsdb {ptr=$sending_ip_address}{$value}{$primary_hostname}}
  1495. .else
  1496. REMOTE_SMTP_HELO_DATA=${lookup dnsdb {ptr=$sending_ip_address}{$value}{$primary_hostname}}
  1497. .endif
  1498. .endif
  1499. #####################################################
  1500. ### end transport/10_exim4-config_transport-macros
  1501. #####################################################
  1502. #####################################################
  1503. ### transport/30_exim4-config_address_file
  1504. #####################################################
  1505.  
  1506. # This transport is used for handling deliveries directly to files that are
  1507. # generated by aliasing or forwarding.
  1508. #
  1509. address_file:
  1510. debug_print = "T: address_file for $local_part@$domain"
  1511. driver = appendfile
  1512. delivery_date_add
  1513. envelope_to_add
  1514. return_path_add
  1515.  
  1516. #####################################################
  1517. ### end transport/30_exim4-config_address_file
  1518. #####################################################
  1519. #####################################################
  1520. ### transport/30_exim4-config_address_pipe
  1521. #####################################################
  1522.  
  1523. # This transport is used for handling pipe deliveries generated by
  1524. # .forward files. If the commands fails and produces any output on standard
  1525. # output or standard error streams, the output is returned to the sender
  1526. # of the message as a delivery error.
  1527. address_pipe:
  1528. debug_print = "T: address_pipe for $local_part@$domain"
  1529. driver = pipe
  1530. return_fail_output
  1531.  
  1532. #####################################################
  1533. ### end transport/30_exim4-config_address_pipe
  1534. #####################################################
  1535. #####################################################
  1536. ### transport/30_exim4-config_address_reply
  1537. #####################################################
  1538.  
  1539. # This transport is used for handling autoreplies generated by the filtering
  1540. # option of the userforward router.
  1541. #
  1542. address_reply:
  1543. debug_print = "T: autoreply for $local_part@$domain"
  1544. driver = autoreply
  1545.  
  1546. #####################################################
  1547. ### end transport/30_exim4-config_address_reply
  1548. #####################################################
  1549. #####################################################
  1550. ### transport/30_exim4-config_mail_spool
  1551. #####################################################
  1552.  
  1553. ### transport/30_exim4-config_mail_spool
  1554.  
  1555. # This transport is used for local delivery to user mailboxes in traditional
  1556. # BSD mailbox format.
  1557. #
  1558. mail_spool:
  1559. debug_print = "T: appendfile for $local_part@$domain"
  1560. driver = appendfile
  1561. file = /var/mail/$local_part
  1562. delivery_date_add
  1563. envelope_to_add
  1564. return_path_add
  1565. group = mail
  1566. mode = 0660
  1567. mode_fail_narrower = false
  1568.  
  1569. #####################################################
  1570. ### end transport/30_exim4-config_mail_spool
  1571. #####################################################
  1572. #####################################################
  1573. ### transport/30_exim4-config_maildir_home
  1574. #####################################################
  1575.  
  1576. ### transport/30_exim4-config_maildir_home
  1577. #################################
  1578.  
  1579. # Use this instead of mail_spool if you want to to deliver to Maildir in
  1580. # home-directory - change the definition of LOCAL_DELIVERY
  1581. #
  1582. maildir_home:
  1583. debug_print = "T: maildir_home for $local_part@$domain"
  1584. driver = appendfile
  1585. .ifdef MAILDIR_HOME_MAILDIR_LOCATION
  1586. directory = MAILDIR_HOME_MAILDIR_LOCATION
  1587. .else
  1588. directory = $home/Maildir
  1589. .endif
  1590. .ifdef MAILDIR_HOME_CREATE_DIRECTORY
  1591. create_directory
  1592. .endif
  1593. .ifdef MAILDIR_HOME_CREATE_FILE
  1594. create_file = MAILDIR_HOME_CREATE_FILE
  1595. .endif
  1596. delivery_date_add
  1597. envelope_to_add
  1598. return_path_add
  1599. maildir_format
  1600. .ifdef MAILDIR_HOME_DIRECTORY_MODE
  1601. directory_mode = MAILDIR_HOME_DIRECTORY_MODE
  1602. .else
  1603. directory_mode = 0700
  1604. .endif
  1605. .ifdef MAILDIR_HOME_MODE
  1606. mode = MAILDIR_HOME_MODE
  1607. .else
  1608. mode = 0600
  1609. .endif
  1610. mode_fail_narrower = false
  1611. # This transport always chdirs to $home before trying to deliver. If
  1612. # $home is not accessible, this chdir fails and prevents delivery.
  1613. # If you are in a setup where home directories might not be
  1614. # accessible, uncomment the current_directory line below.
  1615. # current_directory = /
  1616. #####################################################
  1617. ### end transport/30_exim4-config_maildir_home
  1618. #####################################################
  1619. #####################################################
  1620. ### transport/30_exim4-config_maildrop_pipe
  1621. #####################################################
  1622.  
  1623. maildrop_pipe:
  1624. debug_print = "T: maildrop_pipe for $local_part@$domain"
  1625. driver = pipe
  1626. path = "/bin:/usr/bin:/usr/local/bin"
  1627. command = "/usr/bin/maildrop"
  1628. message_prefix =
  1629. message_suffix =
  1630. return_path_add
  1631. delivery_date_add
  1632. envelope_to_add
  1633.  
  1634. #####################################################
  1635. ### end transport/30_exim4-config_maildrop_pipe
  1636. #####################################################
  1637. #####################################################
  1638. ### transport/30_exim4-config_procmail_pipe
  1639. #####################################################
  1640.  
  1641. procmail_pipe:
  1642. debug_print = "T: procmail_pipe for $local_part@$domain"
  1643. driver = pipe
  1644. path = "/bin:/usr/bin:/usr/local/bin"
  1645. command = "/usr/bin/procmail"
  1646. return_path_add
  1647. delivery_date_add
  1648. envelope_to_add
  1649.  
  1650. #####################################################
  1651. ### end transport/30_exim4-config_procmail_pipe
  1652. #####################################################
  1653. #####################################################
  1654. ### transport/30_exim4-config_remote_smtp
  1655. #####################################################
  1656.  
  1657. ### transport/30_exim4-config_remote_smtp
  1658. #################################
  1659. # This transport is used for delivering messages over SMTP connections.
  1660.  
  1661.  
  1662.  
  1663.  
  1664.  
  1665. remote_smtp:
  1666. driver = smtp
  1667. dovecot_delivery:
  1668. driver = pipe
  1669. command = /usr/libexec/dovecot/deliver -d $local_part@$domain
  1670. message_prefix =
  1671. message_suffix =
  1672. delivery_date_add
  1673. envelope_to_add
  1674. return_path_add
  1675. log_output
  1676. user = Debian-exim
  1677.  
  1678.  
  1679.  
  1680.  
  1681.  
  1682.  
  1683.  
  1684. #remote_smtp:
  1685. # debug_print = "T: remote_smtp for $local_part@$domain"
  1686. # driver = smtp
  1687. #.ifdef REMOTE_SMTP_HOSTS_AVOID_TLS
  1688. # hosts_avoid_tls = REMOTE_SMTP_HOSTS_AVOID_TLS
  1689. #.endif
  1690. #.ifdef REMOTE_SMTP_HEADERS_REWRITE
  1691. # headers_rewrite = REMOTE_SMTP_HEADERS_REWRITE
  1692. #.endif
  1693. #.ifdef REMOTE_SMTP_RETURN_PATH
  1694. # return_path = REMOTE_SMTP_RETURN_PATH
  1695. #.endif
  1696. #.ifdef REMOTE_SMTP_HELO_DATA
  1697. # helo_data=REMOTE_SMTP_HELO_DATA
  1698. #.endif
  1699. #.ifdef DKIM_DOMAIN
  1700. #dkim_domain = DKIM_DOMAIN
  1701. #.endif
  1702. #.ifdef DKIM_SELECTOR
  1703. #dkim_selector = DKIM_SELECTOR
  1704. #.endif
  1705. #.ifdef DKIM_PRIVATE_KEY
  1706. #dkim_private_key = DKIM_PRIVATE_KEY
  1707. #.endif
  1708. #.ifdef DKIM_CANON
  1709. #dkim_canon = DKIM_CANON
  1710. #.endif
  1711. #.ifdef DKIM_STRICT
  1712. #dkim_strict = DKIM_STRICT
  1713. #.endif
  1714. #.ifdef DKIM_SIGN_HEADERS
  1715. #dkim_sign_headers = DKIM_SIGN_HEADERS
  1716. #.endif
  1717. #.ifdef TLS_DH_MIN_BITS
  1718. #tls_dh_min_bits = TLS_DH_MIN_BITS
  1719. #.endif
  1720. #.ifdef REMOTE_SMTP_TLS_CERTIFICATE
  1721. #tls_certificate = REMOTE_SMTP_TLS_CERTIFICATE
  1722. #.endif
  1723. #.ifdef REMOTE_SMTP_PRIVATEKEY
  1724. #tls_privatekey = REMOTE_SMTP_PRIVATEKEY
  1725. #.endif
  1726. #####################################################
  1727. ### end transport/30_exim4-config_remote_smtp
  1728. #####################################################
  1729. #####################################################
  1730. ### transport/30_exim4-config_remote_smtp_smarthost
  1731. #####################################################
  1732.  
  1733. ### transport/30_exim4-config_remote_smtp_smarthost
  1734. #################################
  1735.  
  1736. # This transport is used for delivering messages over SMTP connections
  1737. # to a smarthost. The local host tries to authenticate.
  1738. # This transport is used for smarthost and satellite configurations.
  1739.  
  1740. remote_smtp_smarthost:
  1741. debug_print = "T: remote_smtp_smarthost for $local_part@$domain"
  1742. driver = smtp
  1743. hosts_try_auth = <; ${if exists{CONFDIR/passwd.client} \
  1744. {\
  1745. ${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$host_address}}\
  1746. }\
  1747. {} \
  1748. }
  1749. .ifdef REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS
  1750. hosts_avoid_tls = REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS
  1751. .endif
  1752. .ifdef REMOTE_SMTP_HEADERS_REWRITE
  1753. headers_rewrite = REMOTE_SMTP_HEADERS_REWRITE
  1754. .endif
  1755. .ifdef REMOTE_SMTP_RETURN_PATH
  1756. return_path = REMOTE_SMTP_RETURN_PATH
  1757. .endif
  1758. .ifdef REMOTE_SMTP_HELO_DATA
  1759. helo_data=REMOTE_SMTP_HELO_DATA
  1760. .endif
  1761. .ifdef TLS_DH_MIN_BITS
  1762. tls_dh_min_bits = TLS_DH_MIN_BITS
  1763. .endif
  1764. .ifdef REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE
  1765. tls_certificate = REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE
  1766. .endif
  1767. .ifdef REMOTE_SMTP_SMARTHOST_PRIVATEKEY
  1768. tls_privatekey = REMOTE_SMTP_SMARTHOST_PRIVATEKEY
  1769. .endif
  1770. #####################################################
  1771. ### end transport/30_exim4-config_remote_smtp_smarthost
  1772. #####################################################
  1773. #####################################################
  1774. ### transport/35_exim4-config_address_directory
  1775. #####################################################
  1776. # This transport is used for handling file addresses generated by alias
  1777. # or .forward files if the path ends in "/", which causes it to be treated
  1778. # as a directory name rather than a file name.
  1779.  
  1780. address_directory:
  1781. debug_print = "T: address_directory for $local_part@$domain"
  1782. driver = appendfile
  1783. delivery_date_add
  1784. envelope_to_add
  1785. return_path_add
  1786. check_string = ""
  1787. escape_string = ""
  1788. maildir_format
  1789.  
  1790. #####################################################
  1791. ### end transport/35_exim4-config_address_directory
  1792. #####################################################
  1793. #####################################################
  1794. ### retry/00_exim4-config_header
  1795. #####################################################
  1796.  
  1797. ######################################################################
  1798. # RETRY CONFIGURATION #
  1799. ######################################################################
  1800.  
  1801. begin retry
  1802.  
  1803. #####################################################
  1804. ### end retry/00_exim4-config_header
  1805. #####################################################
  1806. #####################################################
  1807. ### retry/30_exim4-config
  1808. #####################################################
  1809.  
  1810. ### retry/30_exim4-config
  1811. #################################
  1812.  
  1813. # This single retry rule applies to all domains and all errors. It specifies
  1814. # retries every 15 minutes for 2 hours, then increasing retry intervals,
  1815. # starting at 1 hour and increasing each time by a factor of 1.5, up to 16
  1816. # hours, then retries every 6 hours until 4 days have passed since the first
  1817. # failed delivery.
  1818.  
  1819. # Please note that these rules only limit the frequency of retries, the
  1820. # effective retry-time depends on the frequency of queue-running, too.
  1821. # See QUEUEINTERVAL in /etc/default/exim4.
  1822.  
  1823. # Address or Domain Error Retries
  1824. # ----------------- ----- -------
  1825.  
  1826. * * F,2h,15m; G,16h,1h,1.5; F,4d,6h
  1827.  
  1828. #####################################################
  1829. ### end retry/30_exim4-config
  1830. #####################################################
  1831. #####################################################
  1832. ### rewrite/00_exim4-config_header
  1833. #####################################################
  1834.  
  1835. ######################################################################
  1836. # REWRITE CONFIGURATION #
  1837. ######################################################################
  1838.  
  1839. begin rewrite
  1840.  
  1841. #####################################################
  1842. ### end rewrite/00_exim4-config_header
  1843. #####################################################
  1844. #####################################################
  1845. ### rewrite/31_exim4-config_rewriting
  1846. #####################################################
  1847.  
  1848. ### rewrite/31_exim4-config_rewriting
  1849. #################################
  1850.  
  1851. # This rewriting rule is particularily useful for dialup users who
  1852. # don't have their own domain, but could be useful for anyone.
  1853. # It looks up the real address of all local users in a file
  1854. .ifndef NO_EAA_REWRITE_REWRITE
  1855. *@+local_domains "${lookup{${local_part}}lsearch{/etc/email-addresses}\
  1856. {$value}fail}" Ffrs
  1857. # identical rewriting rule for /etc/mailname
  1858. *@ETC_MAILNAME "${lookup{${local_part}}lsearch{/etc/email-addresses}\
  1859. {$value}fail}" Ffrs
  1860. .endif
  1861.  
  1862.  
  1863. #####################################################
  1864. ### end rewrite/31_exim4-config_rewriting
  1865. #####################################################
  1866. #####################################################
  1867. ### auth/00_exim4-config_header
  1868. #####################################################
  1869.  
  1870. ######################################################################
  1871. # AUTHENTICATION CONFIGURATION #
  1872. ######################################################################
  1873.  
  1874. begin authenticators
  1875.  
  1876.  
  1877. #####################################################
  1878. ### end auth/00_exim4-config_header
  1879. #####################################################
  1880. #####################################################
  1881. ### auth/30_exim4-config_examples
  1882. #####################################################
  1883.  
  1884. ### auth/30_exim4-config_examples
  1885. #################################
  1886.  
  1887. # The examples below are for server side authentication, when the
  1888. # local exim is SMTP server and clients authenticate to the local exim.
  1889.  
  1890. # They allow two styles of plain-text authentication against an
  1891. # CONFDIR/passwd file whose syntax is described in exim4_passwd(5).
  1892.  
  1893. # Hosts that are allowed to use AUTH are defined by the
  1894. # auth_advertise_hosts option in the main configuration. The default is
  1895. # "*", which allows authentication to all hosts over all kinds of
  1896. # connections if there is at least one authenticator defined here.
  1897. # Authenticators which rely on unencrypted clear text passwords don't
  1898. # advertise on unencrypted connections by default. Thus, it might be
  1899. # wise to set up TLS to allow encrypted connections. If TLS cannot be
  1900. # used for some reason, you can set AUTH_SERVER_ALLOW_NOTLS_PASSWORDS to
  1901. # advertise unencrypted clear text password based authenticators on all
  1902. # connections. As this is severely reducing security, using TLS is
  1903. # preferred over allowing clear text password based authenticators on
  1904. # unencrypted connections.
  1905.  
  1906. # PLAIN authentication has no server prompts. The client sends its
  1907. # credentials in one lump, containing an authorization ID (which we do not
  1908. # use), an authentication ID, and a password. The latter two appear as
  1909. # $auth2 and $auth3 in the configuration and should be checked against a
  1910. # valid username and password. In a real configuration you would typically
  1911. # use $auth2 as a lookup key, and compare $auth3 against the result of the
  1912. # lookup, perhaps using the crypteq{}{} condition.
  1913.  
  1914. # plain_server:
  1915. # driver = plaintext
  1916. # public_name = PLAIN
  1917. # server_condition = "${if crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
  1918. # server_set_id = $auth2
  1919. # server_prompts = :
  1920. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1921. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1922. # .endif
  1923.  
  1924. # LOGIN authentication has traditional prompts and responses. There is no
  1925. # authorization ID in this mechanism, so unlike PLAIN the username and
  1926. # password are $auth1 and $auth2. Apart from that you can use the same
  1927. # server_condition setting for both authenticators.
  1928.  
  1929. # login_server:
  1930. # driver = plaintext
  1931. # public_name = LOGIN
  1932. # server_prompts = "Username:: : Password::"
  1933. # server_condition = "${if crypteq{$auth2}{${extract{1}{:}{${lookup{$auth1}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
  1934. # server_set_id = $auth1
  1935. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1936. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1937. # .endif
  1938. #
  1939. # cram_md5_server:
  1940. # driver = cram_md5
  1941. # public_name = CRAM-MD5
  1942. # server_secret = ${extract{2}{:}{${lookup{$auth1}lsearch{CONFDIR/passwd}{$value}fail}}}
  1943. # server_set_id = $auth1
  1944.  
  1945. # Here is an example of CRAM-MD5 authentication against PostgreSQL:
  1946. #
  1947. # psqldb_auth_server:
  1948. # driver = cram_md5
  1949. # public_name = CRAM-MD5
  1950. # server_secret = ${lookup pgsql{SELECT pw FROM users WHERE username = '${quote_pgsql:$auth1}'}{$value}fail}
  1951. # server_set_id = $auth1
  1952.  
  1953. # Authenticate against local passwords using sasl2-bin
  1954. # Requires exim_uid to be a member of sasl group, see README.Debian.gz
  1955. # plain_saslauthd_server:
  1956. # driver = plaintext
  1957. # public_name = PLAIN
  1958. # server_condition = ${if saslauthd{{$auth2}{$auth3}}{1}{0}}
  1959. # server_set_id = $auth2
  1960. # server_prompts = :
  1961. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1962. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1963. # .endif
  1964. #
  1965. # login_saslauthd_server:
  1966. # driver = plaintext
  1967. # public_name = LOGIN
  1968. # server_prompts = "Username:: : Password::"
  1969. # # don't send system passwords over unencrypted connections
  1970. # server_condition = ${if saslauthd{{$auth1}{$auth2}}{1}{0}}
  1971. # server_set_id = $auth1
  1972. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1973. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1974. # .endif
  1975. #
  1976. # ntlm_sasl_server:
  1977. # driver = cyrus_sasl
  1978. # public_name = NTLM
  1979. # server_realm = <short main hostname>
  1980. # server_set_id = $auth1
  1981. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1982. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1983. # .endif
  1984. #
  1985. # digest_md5_sasl_server:
  1986. # driver = cyrus_sasl
  1987. # public_name = DIGEST-MD5
  1988. # server_realm = <short main hostname>
  1989. # server_set_id = $auth1
  1990. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1991. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1992. # .endif
  1993.  
  1994. # Authentcate against cyrus-sasl
  1995. # This is mainly untested, please report any problems to
  1996. # pkg-exim4-users@lists.alioth.debian.org.
  1997. # cram_md5_sasl_server:
  1998. # driver = cyrus_sasl
  1999. # public_name = CRAM-MD5
  2000. # server_realm = <short main hostname>
  2001. # server_set_id = $auth1
  2002. #
  2003. # plain_sasl_server:
  2004. # driver = cyrus_sasl
  2005. # public_name = PLAIN
  2006. # server_realm = <short main hostname>
  2007. # server_set_id = $auth1
  2008. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  2009. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  2010. # .endif
  2011. #
  2012. # login_sasl_server:
  2013. # driver = cyrus_sasl
  2014. # public_name = LOGIN
  2015. # server_realm = <short main hostname>
  2016. # server_set_id = $auth1
  2017. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  2018. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  2019. # .endif
  2020.  
  2021. # Authenticate against courier authdaemon
  2022.  
  2023. # This is now the (working!) example from
  2024. # http://www.exim.org/eximwiki/FAQ/Policy_controls/Q0730
  2025. # Possible pitfall: access rights on /var/run/courier/authdaemon/socket.
  2026. # plain_courier_authdaemon:
  2027. # driver = plaintext
  2028. # public_name = PLAIN
  2029. # server_condition = \
  2030. # ${extract {ADDRESS} \
  2031. # {${readsocket{/var/run/courier/authdaemon/socket} \
  2032. # {AUTH ${strlen:exim\nlogin\n$auth2\n$auth3\n}\nexim\nlogin\n$auth2\n$auth3\n} }} \
  2033. # {yes} \
  2034. # fail}
  2035. # server_set_id = $auth2
  2036. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  2037. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  2038. # .endif
  2039.  
  2040. # login_courier_authdaemon:
  2041. # driver = plaintext
  2042. # public_name = LOGIN
  2043. # server_prompts = Username:: : Password::
  2044. # server_condition = \
  2045. # ${extract {ADDRESS} \
  2046. # {${readsocket{/var/run/courier/authdaemon/socket} \
  2047. # {AUTH ${strlen:exim\nlogin\n$auth1\n$auth2\n}\nexim\nlogin\n$auth1\n$auth2\n} }} \
  2048. # {yes} \
  2049. # fail}
  2050. # server_set_id = $auth1
  2051. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  2052. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  2053. # .endif
  2054.  
  2055. # This one is a bad hack to support the broken version 4.xx of
  2056. # Microsoft Outlook Express which violates the RFCs by demanding
  2057. # "250-AUTH=" instead of "250-AUTH ".
  2058. # If your list of offered authenticators is other than PLAIN and LOGIN,
  2059. # you need to adapt the public_name line manually.
  2060. # It has to be the last authenticator to work and has not been tested
  2061. # well. Use at your own risk.
  2062. # See the thread entry point from
  2063. # http://www.exim.org/mail-archives/exim-users/Week-of-Mon-20050214/msg00213.html
  2064. # for the related discussion on the exim-users mailing list.
  2065. # Thanks to Fred Viles for this great work.
  2066.  
  2067. # support_broken_outlook_express_4_server:
  2068. # driver = plaintext
  2069. # public_name = "\r\n250-AUTH=PLAIN LOGIN"
  2070. # server_prompts = User Name : Password
  2071. # server_condition = no
  2072. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  2073. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  2074. # .endif
  2075.  
  2076. ##############
  2077. # See /usr/share/doc/exim4-base/README.Debian.gz
  2078. ##############
  2079.  
  2080. # These examples below are the equivalent for client side authentication.
  2081. # They get the passwords from CONFDIR/passwd.client, whose format is
  2082. # defined in exim4_passwd_client(5)
  2083.  
  2084. # Because AUTH PLAIN and AUTH LOGIN send the password in clear, we
  2085. # only allow these mechanisms over encrypted connections by default.
  2086. # You can set AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS to allow unencrypted
  2087. # clear text password authentication on all connections.
  2088.  
  2089.  
  2090. auth_cram_md5:
  2091. driver = dovecot
  2092. public_name = CRAM-MD5
  2093. server_socket = /var/run/dovecot/auth-client
  2094. server_set_id = $auth1
  2095.  
  2096.  
  2097.  
  2098.  
  2099.  
  2100.  
  2101.  
  2102.  
  2103.  
  2104. cram_md5:
  2105. driver = cram_md5
  2106. public_name = CRAM-MD5
  2107. client_name = ${extract{1}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}
  2108. client_secret = ${extract{2}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}
  2109.  
  2110. # this returns the matching line from passwd.client and doubles all ^
  2111. PASSWDLINE=${sg{\
  2112. ${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}\
  2113. }\
  2114. {\\N[\\^]\\N}\
  2115. {^^}\
  2116. }
  2117.  
  2118. plain:
  2119. driver = plaintext
  2120. public_name = PLAIN
  2121. .ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS
  2122. client_send = "<; ${if !eq{$tls_out_cipher}{}\
  2123. {^${extract{1}{:}{PASSWDLINE}}\
  2124. ^${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}\
  2125. }fail}"
  2126. .else
  2127. client_send = "<; ^${extract{1}{:}{PASSWDLINE}}\
  2128. ^${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}"
  2129. .endif
  2130.  
  2131. login:
  2132. driver = plaintext
  2133. public_name = LOGIN
  2134. .ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS
  2135. # Return empty string if not non-TLS AND looking up $host in passwd-file
  2136. # yields a non-empty string; fail otherwise.
  2137. client_send = "<; ${if and{\
  2138. {!eq{$tls_out_cipher}{}}\
  2139. {!eq{PASSWDLINE}{}}\
  2140. }\
  2141. {}fail}\
  2142. ; ${extract{1}{::}{PASSWDLINE}}\
  2143. ; ${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}"
  2144. .else
  2145. # Return empty string if looking up $host in passwd-file yields a
  2146. # non-empty string; fail otherwise.
  2147. client_send = "<; ${if !eq{PASSWDLINE}{}\
  2148. {}fail}\
  2149. ; ${extract{1}{::}{PASSWDLINE}}\
  2150. ; ${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}"
  2151. .endif
  2152. #####################################################
  2153. ### end auth/30_exim4-config_examples
  2154. #####################################################
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!