API tools faq
paste
Guest User

Untitled

a guest
Jun 26th, 2020
235
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 79.71 KB | None | 0 0
raw download clone embed print report
  1. #####################################################
  2. ### main/01_exim4-config_listmacrosdefs
  3. #####################################################
  4. ######################################################################
  5. # Runtime configuration file for Exim 4 (Debian Packaging) #
  6. ######################################################################
  7.  
  8. ######################################################################
  9. # /etc/exim4/exim4.conf.template is only used with the non-split
  10. # configuration scheme.
  11. # /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs is only used
  12. # with the split configuration scheme.
  13. # If you find this comment anywhere else, somebody copied it there.
  14. # Documentation about the Debian exim4 configuration scheme can be
  15. # found in /usr/share/doc/exim4-base/README.Debian.gz.
  16. ######################################################################
  17.  
  18. ######################################################################
  19. # MAIN CONFIGURATION SETTINGS #
  20. ######################################################################
  21.  
  22. daemon_smtp_port = 465 : 587
  23. tls_on_connect_ports = 465 : 587
  24.  
  25. # Just for reference and scripts.
  26. # On Debian systems, the main binary is installed as exim4 to avoid
  27. # conflicts with the exim 3 packages.
  28. exim_path = /usr/sbin/exim4
  29.  
  30. # Macro defining the main configuration directory.
  31. # We do not use absolute paths.
  32. .ifndef CONFDIR
  33. CONFDIR = /etc/exim4
  34. .endif
  35.  
  36. # debconf-driven macro definitions get inserted after this line
  37. UPEX4CmacrosUPEX4C = 1
  38.  
  39. # Create domain and host lists for relay control
  40. # '@' refers to 'the name of the local host'
  41.  
  42. # List of domains considered local for exim. Domains not listed here
  43. # need to be deliverable remotely.
  44. domainlist local_domains = MAIN_LOCAL_DOMAINS
  45.  
  46. # List of recipient domains to relay _to_. Use this list if you're -
  47. # for example - fallback MX or mail gateway for domains.
  48. domainlist relay_to_domains = MAIN_RELAY_TO_DOMAINS
  49.  
  50. # List of sender networks (IP addresses) to _unconditionally_ relay
  51. # _for_. If you intend to be SMTP AUTH server, you do not need to enter
  52. # anything here.
  53. hostlist relay_from_hosts = MAIN_RELAY_NETS
  54.  
  55.  
  56. # Decide which domain to use to add to all unqualified addresses.
  57. # If MAIN_PRIMARY_HOSTNAME_AS_QUALIFY_DOMAIN is defined, the primary
  58. # hostname is used. If not, but MAIN_QUALIFY_DOMAIN is set, the value
  59. # of MAIN_QUALIFY_DOMAIN is used. If both macros are not defined,
  60. # the first line of /etc/mailname is used.
  61. .ifndef MAIN_PRIMARY_HOSTNAME_AS_QUALIFY_DOMAIN
  62. .ifndef MAIN_QUALIFY_DOMAIN
  63. qualify_domain = ETC_MAILNAME
  64. .else
  65. qualify_domain = MAIN_QUALIFY_DOMAIN
  66. .endif
  67. .endif
  68.  
  69. # listen on all all interfaces?
  70. .ifdef MAIN_LOCAL_INTERFACES
  71. local_interfaces = MAIN_LOCAL_INTERFACES
  72. .endif
  73.  
  74. .ifndef LOCAL_DELIVERY
  75. # The default transport, set in /etc/exim4/update-exim4.conf.conf,
  76. # defaulting to mail_spool. See CONFDIR/conf.d/transport/ for possibilities
  77. LOCAL_DELIVERY=mail_spool
  78. .endif
  79.  
  80. # The gecos field in /etc/passwd holds not only the name. see passwd(5).
  81. gecos_pattern = ^([^,:]*)
  82. gecos_name = $1
  83.  
  84. # always log tls_peerdn as we use TLS for outgoing connects by default
  85. .ifndef MAIN_LOG_SELECTOR
  86. MAIN_LOG_SELECTOR = +smtp_protocol_error +smtp_syntax_error +tls_certificate_verified +tls_peerdn
  87. .endif
  88. #####################################################
  89. ### end main/01_exim4-config_listmacrosdefs
  90. #####################################################
  91. #####################################################
  92. ### main/02_exim4-config_options
  93. #####################################################
  94.  
  95. ### main/02_exim4-config_options
  96. #################################
  97.  
  98.  
  99. # Defines the access control list that is run when an
  100. # SMTP MAIL command is received.
  101. #
  102. .ifndef MAIN_ACL_CHECK_MAIL
  103. MAIN_ACL_CHECK_MAIL = acl_check_mail
  104. .endif
  105. acl_smtp_mail = MAIN_ACL_CHECK_MAIL
  106.  
  107.  
  108. # Defines the access control list that is run when an
  109. # SMTP RCPT command is received.
  110. #
  111. .ifndef MAIN_ACL_CHECK_RCPT
  112. MAIN_ACL_CHECK_RCPT = acl_check_rcpt
  113. .endif
  114. acl_smtp_rcpt = MAIN_ACL_CHECK_RCPT
  115.  
  116.  
  117. # Defines the access control list that is run when an
  118. # SMTP DATA command is received.
  119. #
  120. .ifndef MAIN_ACL_CHECK_DATA
  121. MAIN_ACL_CHECK_DATA = acl_check_data
  122. .endif
  123. acl_smtp_data = MAIN_ACL_CHECK_DATA
  124.  
  125.  
  126. # Message size limit. The default (used when MESSAGE_SIZE_LIMIT
  127. # is unset) is 50 MB
  128. .ifdef MESSAGE_SIZE_LIMIT
  129. message_size_limit = MESSAGE_SIZE_LIMIT
  130. .endif
  131.  
  132.  
  133. # If you are running exim4-daemon-heavy or a custom version of Exim that
  134. # was compiled with the content-scanning extension, you can cause incoming
  135. # messages to be automatically scanned for viruses. You have to modify the
  136. # configuration in two places to set this up. The first of them is here,
  137. # where you define the interface to your scanner. This example is typical
  138. # for ClamAV; see the manual for details of what to set for other virus
  139. # scanners. The second modification is in the acl_check_data access
  140. # control list.
  141.  
  142. # av_scanner = clamd:/var/run/clamav/clamd.ctl
  143.  
  144.  
  145. # For spam scanning, there is a similar option that defines the interface to
  146. # SpamAssassin. You do not need to set this if you are using the default, which
  147. # is shown in this commented example. As for virus scanning, you must also
  148. # modify the acl_check_data access control list to enable spam scanning.
  149.  
  150. # spamd_address = 127.0.0.1 783
  151.  
  152. # Domain used to qualify unqualified recipient addresses
  153. # If this option is not set, the qualify_domain value is used.
  154. # qualify_recipient = <value of qualify_domain>
  155.  
  156.  
  157. # Allow Exim to recognize addresses of the form "user@[10.11.12.13]",
  158. # where the domain part is a "domain literal" (an IP address) instead
  159. # of a named domain. The RFCs require this facility, but it is disabled
  160. # in the default config since it is rarely used and frequently abused.
  161. # Domain literal support also needs a special router, which is automatically
  162. # enabled if you use the enable macro MAIN_ALLOW_DOMAIN_LITERALS.
  163. # Additionally, you might want to make your local IP addresses (or @[])
  164. # local domains.
  165. .ifdef MAIN_ALLOW_DOMAIN_LITERALS
  166. allow_domain_literals
  167. .endif
  168.  
  169.  
  170. # Do a reverse DNS lookup on all incoming IP calls, in order to get the
  171. # true host name. If you feel this is too expensive, the networks for
  172. # which a lookup is done can be listed here.
  173. .ifndef DC_minimaldns
  174. .ifndef MAIN_HOST_LOOKUP
  175. MAIN_HOST_LOOKUP = *
  176. .endif
  177. host_lookup = MAIN_HOST_LOOKUP
  178. .endif
  179.  
  180. # The setting below causes Exim to try to initialize the system resolver
  181. # library with DNSSEC support. It has no effect if your library lacks
  182. # DNSSEC support.
  183. dns_dnssec_ok = 1
  184.  
  185. # In a minimaldns setup, update-exim4.conf guesses the hostname and
  186. # dumps it here to avoid DNS lookups being done at Exim run time.
  187. .ifdef MAIN_HARDCODE_PRIMARY_HOSTNAME
  188. primary_hostname = MAIN_HARDCODE_PRIMARY_HOSTNAME
  189. .endif
  190.  
  191. # The settings below cause Exim to make RFC 1413 (ident) callbacks
  192. # for all incoming SMTP calls. You can limit the hosts to which these
  193. # calls are made, and/or change the timeout that is used. If you set
  194. # the timeout to zero, all RFC 1413 calls are disabled. RFC 1413 calls
  195. # are cheap and can provide useful information for tracing problem
  196. # messages, but some hosts and firewalls have problems with them.
  197. # This can result in a timeout instead of an immediate refused
  198. # connection, leading to delays on starting up SMTP sessions.
  199. # (The default was reduced from 30s to 5s for release 4.61. and to
  200. # disabled for release 4.86)
  201. #
  202. #rfc1413_hosts = *
  203. #rfc1413_query_timeout = 5s
  204.  
  205.  
  206. # Enable an efficiency feature. We advertise the feature; clients
  207. # may request to use it. For multi-recipient mails we then can
  208. # reject or accept per-user after the message is received.
  209. #
  210. prdr_enable = true
  211.  
  212. # When using an external relay tester (such as rt.njabl.org and/or the
  213. # currently defunct relay-test.mail-abuse.org, the test may be aborted
  214. # since exim complains about "too many nonmail commands". If you want
  215. # the test to complete, add the host from where "your" relay tester
  216. # connects from to the MAIN_SMTP_ACCEPT_MAX_NOMAIL_HOSTS macro.
  217. # Please note that a non-empty setting may cause extra DNS lookups to
  218. # happen, which is the reason why this option is commented out in the
  219. # default settings.
  220. # MAIN_SMTP_ACCEPT_MAX_NOMAIL_HOSTS = !rt.njabl.org
  221. .ifdef MAIN_SMTP_ACCEPT_MAX_NOMAIL_HOSTS
  222. smtp_accept_max_nonmail_hosts = MAIN_SMTP_ACCEPT_MAX_NOMAIL_HOSTS
  223. .endif
  224.  
  225. # By default, exim forces a Sender: header containing the local
  226. # account name at the local host name in all locally submitted messages
  227. # that don't have the local account name at the local host name in the
  228. # From: header, deletes any Sender: header present in the submitted
  229. # message and forces the envelope sender of all locally submitted
  230. # messages to the local account name at the local host name.
  231. # The following settings allow local users to specify their own envelope sender
  232. # in a locally submitted message. Sender: headers existing in a locally
  233. # submitted message are not removed, and no automatic Sender: headers
  234. # are added. These settings are fine for most hosts.
  235. # If you run exim on a classical multi-user systems where all users
  236. # have local mailboxes that can be reached via SMTP from the Internet
  237. # with the local FQDN as the domain part of the address, you might want
  238. # to disable the following three lines for traceability reasons.
  239. .ifndef MAIN_FORCE_SENDER
  240. local_from_check = false
  241. local_sender_retain = true
  242. untrusted_set_sender = *
  243. .endif
  244.  
  245.  
  246. # By default, Exim expects all envelope addresses to be fully qualified, that
  247. # is, they must contain both a local part and a domain. Configure exim
  248. # to accept unqualified addresses from certain hosts. When this is done,
  249. # unqualified addresses are qualified using the settings of qualify_domain
  250. # and/or qualify_recipient (see above).
  251. # sender_unqualified_hosts = <unset>
  252. # recipient_unqualified_hosts = <unset>
  253.  
  254.  
  255. # Configure Exim to support the "percent hack" for certain domains.
  256. # The "percent hack" is the feature by which mail addressed to x%y@z
  257. # (where z is one of the domains listed) is locally rerouted to x@y
  258. # and sent on. If z is not one of the "percent hack" domains, x%y is
  259. # treated as an ordinary local part. The percent hack is rarely needed
  260. # nowadays but frequently abused. You should not enable it unless you
  261. # are sure that you really need it.
  262. # percent_hack_domains = <unset>
  263.  
  264.  
  265. # Bounce handling
  266. .ifndef MAIN_IGNORE_BOUNCE_ERRORS_AFTER
  267. MAIN_IGNORE_BOUNCE_ERRORS_AFTER = 2d
  268. .endif
  269. ignore_bounce_errors_after = MAIN_IGNORE_BOUNCE_ERRORS_AFTER
  270.  
  271. .ifndef MAIN_TIMEOUT_FROZEN_AFTER
  272. MAIN_TIMEOUT_FROZEN_AFTER = 7d
  273. .endif
  274. timeout_frozen_after = MAIN_TIMEOUT_FROZEN_AFTER
  275.  
  276. .ifndef MAIN_FREEZE_TELL
  277. MAIN_FREEZE_TELL = postmaster
  278. .endif
  279. freeze_tell = MAIN_FREEZE_TELL
  280.  
  281.  
  282. # Define spool directory
  283. .ifndef SPOOLDIR
  284. SPOOLDIR = /var/spool/exim4
  285. .endif
  286. spool_directory = SPOOLDIR
  287.  
  288.  
  289. # trusted users can set envelope-from to arbitrary values
  290. .ifndef MAIN_TRUSTED_USERS
  291. MAIN_TRUSTED_USERS = uucp
  292. .endif
  293. trusted_users = MAIN_TRUSTED_USERS
  294. .ifdef MAIN_TRUSTED_GROUPS
  295. trusted_groups = MAIN_TRUSTED_GROUPS
  296. .endif
  297.  
  298.  
  299. # users in admin group can do many other things
  300. # admin_groups = <unset>
  301.  
  302.  
  303. # SMTP Banner. The example includes the Debian version in the SMTP dialog
  304. # MAIN_SMTP_BANNER = "${primary_hostname} ESMTP Exim ${version_number} (Debian package MAIN_PACKAGE_VERSION) ${tod_full}"
  305. # smtp_banner = $smtp_active_hostname ESMTP Exim $version_number $tod_full
  306.  
  307. smtp_banner = mysite.com
  308.  
  309. .ifdef MAIN_KEEP_ENVIRONMENT
  310. keep_environment = MAIN_KEEP_ENVIRONMENT
  311. .else
  312. # set option to empty value to avoid warning.
  313. keep_environment =
  314. .endif
  315. .ifdef MAIN_ADD_ENVIRONMENT
  316. add_environment = MAIN_ADD_ENVIRONMENT
  317. .endif
  318. #####################################################
  319. ### end main/02_exim4-config_options
  320. #####################################################
  321. #####################################################
  322. ### main/03_exim4-config_tlsoptions
  323. #####################################################
  324.  
  325. ### main/03_exim4-config_tlsoptions
  326. #################################
  327.  
  328. # TLS/SSL configuration for exim as an SMTP server.
  329. # See /usr/share/doc/exim4-base/README.Debian.gz for explanations.
  330.  
  331. .ifdef MAIN_TLS_ENABLE
  332. # Defines what hosts to 'advertise' STARTTLS functionality to. The
  333. # default, *, will advertise to all hosts that connect with EHLO.
  334. .ifndef MAIN_TLS_ADVERTISE_HOSTS
  335. MAIN_TLS_ADVERTISE_HOSTS = *
  336. .endif
  337. tls_advertise_hosts = MAIN_TLS_ADVERTISE_HOSTS
  338.  
  339.  
  340. # Full paths to Certificate and Private Key. The Private Key file
  341. # must be kept 'secret' and should be owned by root.Debian-exim mode
  342. # 640 (-rw-r-----). exim-gencert takes care of these prerequisites.
  343. # Normally, exim4 looks for certificate and key in different files:
  344. # MAIN_TLS_CERTIFICATE - path to certificate file,
  345. # CONFDIR/exim.crt if unset
  346. # MAIN_TLS_PRIVATEKEY - path to private key file
  347. # CONFDIR/exim.key if unset
  348. # You can also configure exim to look for certificate and key in the
  349. # same file, set MAIN_TLS_CERTKEY to that file to enable. This takes
  350. # precedence over all other settings regarding certificate and key file.
  351. .ifdef MAIN_TLS_CERTKEY
  352. tls_certificate = MAIN_TLS_CERTKEY
  353. .else
  354. .ifndef MAIN_TLS_CERTIFICATE
  355. MAIN_TLS_CERTIFICATE = CONFDIR/exim.crt
  356. .endif
  357. tls_certificate = MAIN_TLS_CERTIFICATE
  358.  
  359. .ifndef MAIN_TLS_PRIVATEKEY
  360. MAIN_TLS_PRIVATEKEY = CONFDIR/exim.key
  361. .endif
  362. tls_privatekey = MAIN_TLS_PRIVATEKEY
  363. .endif
  364.  
  365. # Pointer to the CA Certificates against which client certificates are
  366. # checked. This is controlled by the `tls_verify_hosts' and
  367. # `tls_try_verify_hosts' lists below.
  368. # If you want to check server certificates, you need to add an
  369. # tls_verify_certificates statement to the smtp transport.
  370. # /etc/ssl/certs/ca-certificates.crt is generated by
  371. # the "ca-certificates" package's update-ca-certificates(8) command.
  372. .ifndef MAIN_TLS_VERIFY_CERTIFICATES
  373. MAIN_TLS_VERIFY_CERTIFICATES = ${if exists{/etc/ssl/certs/ca-certificates.crt}\
  374. {/etc/ssl/certs/ca-certificates.crt}\
  375. {/dev/null}}
  376. .endif
  377. tls_verify_certificates = MAIN_TLS_VERIFY_CERTIFICATES
  378.  
  379.  
  380. # A list of hosts which are constrained by `tls_verify_certificates'. A host
  381. # that matches `tls_verify_host' must present a certificate that is
  382. # verifyable through `tls_verify_certificates' in order to be accepted as an
  383. # SMTP client. If it does not, the connection is aborted.
  384. .ifdef MAIN_TLS_VERIFY_HOSTS
  385. tls_verify_hosts = MAIN_TLS_VERIFY_HOSTS
  386. .endif
  387.  
  388. # A weaker form of checking: if a client matches `tls_try_verify_hosts' (but
  389. # not `tls_verify_hosts'), request a certificate and check it against
  390. # `tls_verify_certificates' but do not abort the connection if there is no
  391. # certificate or if the certificate presented does not match. (This
  392. # condition can be tested for in ACLs through `verify = certificate')
  393. # By default, this check is done for all hosts. It is known that some
  394. # clients (including incredimail's version downloadable in February
  395. # 2008) choke on this. To disable, set MAIN_TLS_TRY_VERIFY_HOSTS to an
  396. # empty value.
  397. .ifdef MAIN_TLS_TRY_VERIFY_HOSTS
  398. tls_try_verify_hosts = MAIN_TLS_TRY_VERIFY_HOSTS
  399. .endif
  400.  
  401. .ifdef _HAVE_GNUTLS
  402. tls_dhparam = historic
  403. .endif
  404.  
  405. .else
  406. # Don't advertise TLS if MAIN_TLS_ENABLE is not set.
  407. tls_advertise_hosts =
  408. .endif
  409. #####################################################
  410. ### end main/03_exim4-config_tlsoptions
  411. #####################################################
  412. #####################################################
  413. ### main/90_exim4-config_log_selector
  414. #####################################################
  415.  
  416. ### main/90_exim4-config_log_selector
  417. #################################
  418.  
  419. # uncomment this for debugging
  420. # MAIN_LOG_SELECTOR == MAIN_LOG_SELECTOR +all -subject -arguments
  421.  
  422. .ifdef MAIN_LOG_SELECTOR
  423. log_selector = MAIN_LOG_SELECTOR
  424. .endif
  425. #####################################################
  426. ### end main/90_exim4-config_log_selector
  427. #####################################################
  428. #####################################################
  429. ### acl/00_exim4-config_header
  430. #####################################################
  431.  
  432. ######################################################################
  433. # ACL CONFIGURATION #
  434. # Specifies access control lists for incoming SMTP mail #
  435. ######################################################################
  436. disable_ipv6 = true
  437. begin acl
  438.  
  439.  
  440. #####################################################
  441. ### end acl/00_exim4-config_header
  442. #####################################################
  443. #####################################################
  444. ### acl/20_exim4-config_local_deny_exceptions
  445. #####################################################
  446.  
  447. ### acl/20_exim4-config_local_deny_exceptions
  448. #################################
  449.  
  450. # This is used to determine whitelisted senders and hosts.
  451. # It checks for CONFDIR/host_local_deny_exceptions and
  452. # CONFDIR/sender_local_deny_exceptions.
  453. #
  454. # It is meant to be used from some other acl entry.
  455. #
  456. # See exim4-config_files(5) for details.
  457. #
  458. # If the files do not exist, the white list never matches, which is
  459. # the desired behaviour.
  460. #
  461. # The old file names CONFDIR/local_host_whitelist and
  462. # CONFDIR/local_sender_whitelist will continue to be honored for a
  463. # transition period. Their use is deprecated.
  464.  
  465. acl_local_deny_exceptions:
  466. accept
  467. hosts = ${if exists{CONFDIR/host_local_deny_exceptions}\
  468. {CONFDIR/host_local_deny_exceptions}\
  469. {}}
  470. accept
  471. senders = ${if exists{CONFDIR/sender_local_deny_exceptions}\
  472. {CONFDIR/sender_local_deny_exceptions}\
  473. {}}
  474. accept
  475. hosts = ${if exists{CONFDIR/local_host_whitelist}\
  476. {CONFDIR/local_host_whitelist}\
  477. {}}
  478. accept
  479. senders = ${if exists{CONFDIR/local_sender_whitelist}\
  480. {CONFDIR/local_sender_whitelist}\
  481. {}}
  482.  
  483. # This hook allows you to hook in your own ACLs without having to
  484. # modify this file. If you do it like we suggest, you'll end up with
  485. # a small performance penalty since there is an additional file being
  486. # accessed. This doesn't happen if you leave the macro unset.
  487. .ifdef LOCAL_DENY_EXCEPTIONS_LOCAL_ACL_FILE
  488. .include LOCAL_DENY_EXCEPTIONS_LOCAL_ACL_FILE
  489. .endif
  490.  
  491. # this is still supported for a transition period and is deprecated.
  492. .ifdef WHITELIST_LOCAL_DENY_LOCAL_ACL_FILE
  493. .include WHITELIST_LOCAL_DENY_LOCAL_ACL_FILE
  494. .endif
  495. #####################################################
  496. ### end acl/20_exim4-config_local_deny_exceptions
  497. #####################################################
  498. #####################################################
  499. ### acl/30_exim4-config_check_mail
  500. #####################################################
  501.  
  502. ### acl/30_exim4-config_check_mail
  503. #################################
  504.  
  505. # This access control list is used for every MAIL command in an incoming
  506. # SMTP message. The tests are run in order until the address is either
  507. # accepted or denied.
  508. #
  509. acl_check_mail:
  510.  
  511. accept
  512. #####################################################
  513. ### end acl/30_exim4-config_check_mail
  514. #####################################################
  515. #####################################################
  516. ### acl/30_exim4-config_check_rcpt
  517. #####################################################
  518.  
  519. ### acl/30_exim4-config_check_rcpt
  520. #################################
  521.  
  522. # define macros to be used below in this file to check recipient
  523. # local parts for strange characters. Documentation below.
  524. # This blocks local parts that begin with a dot or contain a quite
  525. # broad range of non-alphanumeric characters.
  526.  
  527. .ifndef CHECK_RCPT_LOCAL_LOCALPARTS
  528. CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] : ^.*[@%!/|`#&?]
  529. .endif
  530.  
  531. .ifndef CHECK_RCPT_REMOTE_LOCALPARTS
  532. CHECK_RCPT_REMOTE_LOCALPARTS = ^[./|] : ^.*[@%!`#&?] : ^.*/\\.\\./
  533. .endif
  534.  
  535. # This access control list is used for every RCPT command in an incoming
  536. # SMTP message. The tests are run in order until the address is either
  537. # accepted or denied.
  538. #
  539. acl_check_rcpt:
  540.  
  541. # Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
  542. # testing for an empty sending host field.
  543. accept
  544. hosts = :
  545. control = dkim_disable_verify
  546.  
  547. # Do not try to verify DKIM signatures of incoming mail if DC_minimaldns
  548. # or DISABLE_DKIM_VERIFY are set.
  549. .ifdef DC_minimaldns
  550. warn
  551. control = dkim_disable_verify
  552. .else
  553. .ifdef DISABLE_DKIM_VERIFY
  554. warn
  555. control = dkim_disable_verify
  556. .endif
  557. .endif
  558.  
  559. # The following section of the ACL is concerned with local parts that contain
  560. # certain non-alphanumeric characters. Dots in unusual places are
  561. # handled by this ACL as well.
  562. #
  563. # Non-alphanumeric characters other than dots are rarely found in genuine
  564. # local parts, but are often tried by people looking to circumvent
  565. # relaying restrictions. Therefore, although they are valid in local
  566. # parts, these rules disallow certain non-alphanumeric characters, as
  567. # a precaution.
  568. #
  569. # Empty components (two dots in a row) are not valid in RFC 2822, but Exim
  570. # allows them because they have been encountered. (Consider local parts
  571. # constructed as "firstinitial.secondinitial.familyname" when applied to
  572. # a name without a second initial.) However, a local part starting
  573. # with a dot or containing /../ can cause trouble if it is used as part of a
  574. # file name (e.g. for a mailing list). This is also true for local parts that
  575. # contain slashes. A pipe symbol can also be troublesome if the local part is
  576. # incorporated unthinkingly into a shell command line.
  577. #
  578. # These ACL components will block recipient addresses that are valid
  579. # from an RFC5322 point of view. We chose to have them blocked by
  580. # default for security reasons.
  581. #
  582. # If you feel that your site should have less strict recipient
  583. # checking, please feel free to change the default values of the macros
  584. # defined in main/01_exim4-config_listmacrosdefs or override them from a
  585. # local configuration file.
  586. #
  587. # Two different rules are used. The first one has a quite strict
  588. # default, and is applied to messages that are addressed to one of the
  589. # local domains handled by this host.
  590.  
  591. # The default value of CHECK_RCPT_LOCAL_LOCALPARTS is defined
  592. # at the top of this file.
  593. .ifdef CHECK_RCPT_LOCAL_LOCALPARTS
  594. deny
  595. domains = +local_domains
  596. local_parts = CHECK_RCPT_LOCAL_LOCALPARTS
  597. message = restricted characters in address
  598. .endif
  599.  
  600.  
  601. # The second rule applies to all other domains, and its default is
  602. # considerably less strict.
  603.  
  604. # The default value of CHECK_RCPT_REMOTE_LOCALPARTS is defined in
  605. # main/01_exim4-config_listmacrosdefs:
  606. # CHECK_RCPT_REMOTE_LOCALPARTS = ^[./|] : ^.*[@%!`#&?] : ^.*/\\.\\./
  607.  
  608. # It allows local users to send outgoing messages to sites
  609. # that use slashes and vertical bars in their local parts. It blocks
  610. # local parts that begin with a dot, slash, or vertical bar, but allows
  611. # these characters within the local part. However, the sequence /../ is
  612. # barred. The use of some other non-alphanumeric characters is blocked.
  613. # Single quotes might probably be dangerous as well, but they're
  614. # allowed by the default regexps to avoid rejecting mails to Ireland.
  615. # The motivation here is to prevent local users (or local users' malware)
  616. # from mounting certain kinds of attack on remote sites.
  617. .ifdef CHECK_RCPT_REMOTE_LOCALPARTS
  618. deny
  619. domains = !+local_domains
  620. local_parts = CHECK_RCPT_REMOTE_LOCALPARTS
  621. message = restricted characters in address
  622. .endif
  623.  
  624.  
  625. # Accept mail to postmaster in any local domain, regardless of the source,
  626. # and without verifying the sender.
  627. #
  628. accept
  629. .ifndef CHECK_RCPT_POSTMASTER
  630. local_parts = postmaster
  631. .else
  632. local_parts = CHECK_RCPT_POSTMASTER
  633. .endif
  634. domains = +local_domains : +relay_to_domains
  635.  
  636.  
  637. # Deny unless the sender address can be verified.
  638. #
  639. # This is disabled by default so that DNSless systems don't break. If
  640. # your system can do DNS lookups without delay or cost, you might want
  641. # to enable this feature.
  642. #
  643. # This feature does not work in smarthost and satellite setups as
  644. # with these setups all domains pass verification. See spec.txt section
  645. # "Access control lists" subsection "Address verification" with the added
  646. # information that a smarthost/satellite setup routes all non-local e-mail
  647. # to the smarthost.
  648. .ifdef CHECK_RCPT_VERIFY_SENDER
  649. deny
  650. message = Sender verification failed
  651. !acl = acl_local_deny_exceptions
  652. !verify = sender
  653. .endif
  654.  
  655. # Verify senders listed in local_sender_callout with a callout.
  656. #
  657. # In smarthost and satellite setups, this causes the callout to be
  658. # done to the smarthost. Verification will thus only be reliable if the
  659. # smarthost does reject illegal addresses in the SMTP dialog.
  660. deny
  661. !acl = acl_local_deny_exceptions
  662. senders = ${if exists{CONFDIR/local_sender_callout}\
  663. {CONFDIR/local_sender_callout}\
  664. {}}
  665. !verify = sender/callout
  666.  
  667.  
  668. # Accept if the message comes from one of the hosts for which we are an
  669. # outgoing relay. It is assumed that such hosts are most likely to be MUAs,
  670. # so we set control=submission to make Exim treat the message as a
  671. # submission. It will fix up various errors in the message, for example, the
  672. # lack of a Date: header line. If you are actually relaying out out from
  673. # MTAs, you may want to disable this. If you are handling both relaying from
  674. # MTAs and submissions from MUAs you should probably split them into two
  675. # lists, and handle them differently.
  676.  
  677. # Recipient verification is omitted here, because in many cases the clients
  678. # are dumb MUAs that don't cope well with SMTP error responses. If you are
  679. # actually relaying out from MTAs, you should probably add recipient
  680. # verification here.
  681.  
  682. # Note that, by putting this test before any DNS black list checks, you will
  683. # always accept from these hosts, even if they end up on a black list. The
  684. # assumption is that they are your friends, and if they get onto black
  685. # list, it is a mistake.
  686. accept
  687. hosts = +relay_from_hosts
  688. control = submission/sender_retain
  689. control = dkim_disable_verify
  690.  
  691.  
  692. # Accept if the message arrived over an authenticated connection, from
  693. # any host. Again, these messages are usually from MUAs, so recipient
  694. # verification is omitted, and submission mode is set. And again, we do this
  695. # check before any black list tests.
  696. accept
  697. authenticated = *
  698. control = submission/sender_retain
  699. control = dkim_disable_verify
  700.  
  701. # Insist that a HELO/EHLO was accepted.
  702.  
  703. require message = nice hosts say HELO first
  704. condition = ${if def:sender_helo_name}
  705.  
  706. # Insist that any other recipient address that we accept is either in one of
  707. # our local domains, or is in a domain for which we explicitly allow
  708. # relaying. Any other domain is rejected as being unacceptable for relaying.
  709. require
  710. message = relay not permitted
  711. domains = +local_domains : +relay_to_domains
  712.  
  713.  
  714. # We also require all accepted addresses to be verifiable. This check will
  715. # do local part verification for local domains, but only check the domain
  716. # for remote domains.
  717. require
  718. verify = recipient
  719.  
  720.  
  721. # Verify recipients listed in local_rcpt_callout with a callout.
  722. # This is especially handy for forwarding MX hosts (secondary MX or
  723. # mail hubs) of domains that receive a lot of spam to non-existent
  724. # addresses. The only way to check local parts for remote relay
  725. # domains is to use a callout (add /callout), but please read the
  726. # documentation about callouts before doing this.
  727. deny
  728. !acl = acl_local_deny_exceptions
  729. recipients = ${if exists{CONFDIR/local_rcpt_callout}\
  730. {CONFDIR/local_rcpt_callout}\
  731. {}}
  732. !verify = recipient/callout
  733.  
  734.  
  735. # CONFDIR/local_sender_blacklist holds a list of envelope senders that
  736. # should have their access denied to the local host. Incoming messages
  737. # with one of these senders are rejected at RCPT time.
  738. #
  739. # The explicit white lists are honored as well as negative items in
  740. # the black list. See exim4-config_files(5) for details.
  741. deny
  742. message = sender envelope address $sender_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
  743. log_message = sender envelope address is locally blacklisted.
  744. !acl = acl_local_deny_exceptions
  745. senders = ${if exists{CONFDIR/local_sender_blacklist}\
  746. {CONFDIR/local_sender_blacklist}\
  747. {}}
  748.  
  749.  
  750. # deny bad sites (IP address)
  751. # CONFDIR/local_host_blacklist holds a list of host names, IP addresses
  752. # and networks (CIDR notation) that should have their access denied to
  753. # The local host. Messages coming in from a listed host will have all
  754. # RCPT statements rejected.
  755. #
  756. # The explicit white lists are honored as well as negative items in
  757. # the black list. See exim4-config_files(5) for details.
  758. deny
  759. message = sender IP address $sender_host_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
  760. log_message = sender IP address is locally blacklisted.
  761. !acl = acl_local_deny_exceptions
  762. hosts = ${if exists{CONFDIR/local_host_blacklist}\
  763. {CONFDIR/local_host_blacklist}\
  764. {}}
  765.  
  766.  
  767. # Warn if the sender host does not have valid reverse DNS.
  768. #
  769. # If your system can do DNS lookups without delay or cost, you might want
  770. # to enable this.
  771. # If sender_host_address is defined, it's a remote call. If
  772. # sender_host_name is not defined, then reverse lookup failed. Use
  773. # this instead of !verify = reverse_host_lookup to catch deferrals
  774. # as well as outright failures.
  775. .ifdef CHECK_RCPT_REVERSE_DNS
  776. warn
  777. condition = ${if and{{def:sender_host_address}{!def:sender_host_name}}\
  778. {yes}{no}}
  779. add_header = X-Host-Lookup-Failed: Reverse DNS lookup failed for $sender_host_address (${if eq{$host_lookup_failed}{1}{failed}{deferred}})
  780. .endif
  781.  
  782.  
  783. # Use spfquery to perform a pair of SPF checks (for details, see
  784. # http://www.openspf.org/)
  785. #
  786. # This is quite costly in terms of DNS lookups (~6 lookups per mail). Do not
  787. # enable if that's an issue. Also note that if you enable this, you must
  788. # install "spf-tools-perl" which provides the spfquery command.
  789. # Missing spf-tools-perl will trigger the "Unexpected error in
  790. # SPF check" warning.
  791. .ifdef CHECK_RCPT_SPF
  792. deny
  793. message = [SPF] $sender_host_address is not allowed to send mail from \
  794. ${if def:sender_address_domain {$sender_address_domain}{$sender_helo_name}}. \
  795. Please see \
  796. http://www.openspf.org/Why?scope=${if def:sender_address_domain \
  797. {mfrom}{helo}};identity=${if def:sender_address_domain \
  798. {$sender_address}{$sender_helo_name}};ip=$sender_host_address
  799. log_message = SPF check failed.
  800. !acl = acl_local_deny_exceptions
  801. condition = ${run{/usr/bin/spfquery.mail-spf-perl --ip \
  802. ${quote:$sender_host_address} --identity \
  803. ${if def:sender_address_domain \
  804. {--scope mfrom --identity ${quote:$sender_address}}\
  805. {--scope helo --identity ${quote:$sender_helo_name}}}}\
  806. {no}{${if eq {$runrc}{1}{yes}{no}}}}
  807.  
  808. defer
  809. message = Temporary DNS error while checking SPF record. Try again later.
  810. !acl = acl_local_deny_exceptions
  811. condition = ${if eq {$runrc}{5}{yes}{no}}
  812.  
  813. warn
  814. condition = ${if <={$runrc}{6}{yes}{no}}
  815. add_header = Received-SPF: ${if eq {$runrc}{0}{pass}\
  816. {${if eq {$runrc}{2}{softfail}\
  817. {${if eq {$runrc}{3}{neutral}\
  818. {${if eq {$runrc}{4}{permerror}\
  819. {${if eq {$runrc}{6}{none}{error}}}}}}}}}\
  820. } client-ip=$sender_host_address; \
  821. ${if def:sender_address_domain \
  822. {envelope-from=${sender_address}; }{}}\
  823. helo=$sender_helo_name
  824.  
  825. warn
  826. log_message = Unexpected error in SPF check.
  827. condition = ${if >{$runrc}{6}{yes}{no}}
  828. .endif
  829.  
  830.  
  831. # Check against classic DNS "black" lists (DNSBLs) which list
  832. # sender IP addresses
  833. .ifdef CHECK_RCPT_IP_DNSBLS
  834. warn
  835. dnslists = CHECK_RCPT_IP_DNSBLS
  836. add_header = X-Warning: $sender_host_address is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
  837. log_message = $sender_host_address is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
  838. .endif
  839.  
  840.  
  841. # Check against DNSBLs which list sender domains, with an option to locally
  842. # whitelist certain domains that might be blacklisted.
  843. #
  844. # Note: If you define CHECK_RCPT_DOMAIN_DNSBLS, you must append
  845. # "/$sender_address_domain" after each domain. For example:
  846. # CHECK_RCPT_DOMAIN_DNSBLS = rhsbl.foo.org/$sender_address_domain \
  847. # : rhsbl.bar.org/$sender_address_domain
  848. .ifdef CHECK_RCPT_DOMAIN_DNSBLS
  849. warn
  850. !senders = ${if exists{CONFDIR/local_domain_dnsbl_whitelist}\
  851. {CONFDIR/local_domain_dnsbl_whitelist}\
  852. {}}
  853. dnslists = CHECK_RCPT_DOMAIN_DNSBLS
  854. add_header = X-Warning: $sender_address_domain is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
  855. log_message = $sender_address_domain is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
  856. .endif
  857.  
  858.  
  859. # This hook allows you to hook in your own ACLs without having to
  860. # modify this file. If you do it like we suggest, you'll end up with
  861. # a small performance penalty since there is an additional file being
  862. # accessed. This doesn't happen if you leave the macro unset.
  863. .ifdef CHECK_RCPT_LOCAL_ACL_FILE
  864. .include CHECK_RCPT_LOCAL_ACL_FILE
  865. .endif
  866.  
  867.  
  868. #############################################################################
  869. # This check is commented out because it is recognized that not every
  870. # sysadmin will want to do it. If you enable it, the check performs
  871. # Client SMTP Authorization (csa) checks on the sending host. These checks
  872. # do DNS lookups for SRV records. The CSA proposal is currently (May 2005)
  873. # an Internet draft. You can, of course, add additional conditions to this
  874. # ACL statement to restrict the CSA checks to certain hosts only.
  875. #
  876. # require verify = csa
  877. #############################################################################
  878.  
  879.  
  880. # Accept if the address is in a domain for which we are an incoming relay,
  881. # but again, only if the recipient can be verified.
  882.  
  883. accept
  884. domains = +relay_to_domains
  885. endpass
  886. verify = recipient
  887.  
  888.  
  889. # At this point, the address has passed all the checks that have been
  890. # configured, so we accept it unconditionally.
  891.  
  892. accept
  893. #####################################################
  894. ### end acl/30_exim4-config_check_rcpt
  895. #####################################################
  896. #####################################################
  897. ### acl/40_exim4-config_check_data
  898. #####################################################
  899.  
  900. ### acl/40_exim4-config_check_data
  901. #################################
  902.  
  903. # This ACL is used after the contents of a message have been received. This
  904. # is the ACL in which you can test a message's headers or body, and in
  905. # particular, this is where you can invoke external virus or spam scanners.
  906.  
  907. acl_check_data:
  908.  
  909. # Deny if the message contains an overlong line. Per the standards
  910. # we should never receive one such via SMTP.
  911. #
  912. .ifndef IGNORE_SMTP_LINE_LENGTH_LIMIT
  913. deny message = maximum allowed line length is 998 octets, \
  914. got $max_received_linelength
  915. condition = ${if > {$max_received_linelength}{998}}
  916. .endif
  917.  
  918. # Deny if the headers contain badly-formed addresses.
  919. #
  920. .ifndef NO_CHECK_DATA_VERIFY_HEADER_SYNTAX
  921. deny
  922. !acl = acl_local_deny_exceptions
  923. !verify = header_syntax
  924. message = header syntax
  925. log_message = header syntax ($acl_verify_message)
  926. .endif
  927.  
  928.  
  929. # require that there is a verifiable sender address in at least
  930. # one of the "Sender:", "Reply-To:", or "From:" header lines.
  931. .ifdef CHECK_DATA_VERIFY_HEADER_SENDER
  932. deny
  933. message = No verifiable sender address in message headers
  934. !acl = acl_local_deny_exceptions
  935. !verify = header_sender
  936. .endif
  937.  
  938.  
  939. # Deny if the message contains malware. Before enabling this check, you
  940. # must install a virus scanner and set the av_scanner option in the
  941. # main configuration.
  942. #
  943. # exim4-daemon-heavy must be used for this section to work.
  944. #
  945. # deny
  946. # malware = *
  947. # message = This message was detected as possible malware ($malware_name).
  948.  
  949.  
  950. # Add headers to a message if it is judged to be spam. Before enabling this,
  951. # you must install SpamAssassin. You may also need to set the spamd_address
  952. # option in the main configuration.
  953. #
  954. # exim4-daemon-heavy must be used for this section to work.
  955. #
  956. # Please note that this is only suiteable as an example. See
  957. # /usr/share/doc/exim4-base/README.Debian.gz
  958. #
  959. # See the exim docs and the exim wiki for more suitable examples.
  960. #
  961. # # Remove internal headers
  962. # warn
  963. # remove_header = X-Spam_score: X-Spam_score_int : X-Spam_bar : \
  964. # X-Spam_report
  965. #
  966. # warn
  967. # condition = ${if <{$message_size}{120k}{1}{0}}
  968. # # ":true" to add headers/acl variables even if not spam
  969. # spam = nobody:true
  970. # add_header = X-Spam_score: $spam_score
  971. # add_header = X-Spam_bar: $spam_bar
  972. # # Do not enable this unless you have shorted SpamAssassin's report
  973. # #add_header = X-Spam_report: $spam_report
  974. #
  975. # Reject spam messages (score >15.0).
  976. # This breaks mailing list and forward messages.
  977. # deny
  978. # message = Classified as spam (score $spam_score)
  979. # condition = ${if <{$message_size}{120k}{1}{0}}
  980. # condition = ${if >{$spam_score_int}{150}{true}{false}}
  981.  
  982.  
  983. # This hook allows you to hook in your own ACLs without having to
  984. # modify this file. If you do it like we suggest, you'll end up with
  985. # a small performance penalty since there is an additional file being
  986. # accessed. This doesn't happen if you leave the macro unset.
  987. .ifdef CHECK_DATA_LOCAL_ACL_FILE
  988. .include CHECK_DATA_LOCAL_ACL_FILE
  989. .endif
  990.  
  991.  
  992. # accept otherwise
  993. accept
  994. #####################################################
  995. ### end acl/40_exim4-config_check_data
  996. #####################################################
  997. #####################################################
  998. ### router/00_exim4-config_header
  999. #####################################################
  1000.  
  1001. ######################################################################
  1002. # ROUTERS CONFIGURATION #
  1003. # Specifies how addresses are handled #
  1004. ######################################################################
  1005. # THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT! #
  1006. # An address is passed to each router in turn until it is accepted. #
  1007. ######################################################################
  1008.  
  1009. begin routers
  1010.  
  1011. #####################################################
  1012. ### end router/00_exim4-config_header
  1013. #####################################################
  1014. #####################################################
  1015. ### router/100_exim4-config_domain_literal
  1016. #####################################################
  1017.  
  1018. ### router/100_exim4-config_domain_literal
  1019. #################################
  1020.  
  1021. # This router handles e-mail addresses in "domain literal" form like
  1022. # <user@[10.11.12.13]>. The RFCs require this facility, but it is disabled
  1023. # in the default config since it is rarely used and frequently abused.
  1024. # Domain literal support also needs to be enabled in the main config,
  1025. # which is automatically done if you use the enable macro
  1026. # MAIN_ALLOW_DOMAIN_LITERALS.
  1027.  
  1028. .ifdef MAIN_ALLOW_DOMAIN_LITERALS
  1029. domain_literal:
  1030. debug_print = "R: domain_literal for $local_part@$domain"
  1031. driver = ipliteral
  1032. domains = ! +local_domains
  1033. transport = remote_smtp
  1034. .endif
  1035. #####################################################
  1036. ### end router/100_exim4-config_domain_literal
  1037. #####################################################
  1038. #####################################################
  1039. ### router/150_exim4-config_hubbed_hosts
  1040. #####################################################
  1041.  
  1042. # router/150_exim4-config_hubbed_hosts
  1043. #################################
  1044.  
  1045. # route specific domains manually.
  1046. #
  1047. # see exim4-config_files(5) and spec.txt chapter 20.3 through 20.7 for
  1048. # more detailed documentation.
  1049.  
  1050. hubbed_hosts:
  1051. debug_print = "R: hubbed_hosts for $domain"
  1052. driver = manualroute
  1053. domains = "${if exists{CONFDIR/hubbed_hosts}\
  1054. {partial-lsearch;CONFDIR/hubbed_hosts}\
  1055. fail}"
  1056. same_domain_copy_routing = yes
  1057. route_data = ${lookup{$domain}partial-lsearch{CONFDIR/hubbed_hosts}}
  1058. transport = remote_smtp
  1059. #####################################################
  1060. ### end router/150_exim4-config_hubbed_hosts
  1061. #####################################################
  1062. #####################################################
  1063. ### router/200_exim4-config_primary
  1064. #####################################################
  1065.  
  1066. ### router/200_exim4-config_primary
  1067. #################################
  1068. # This file holds the primary router, responsible for nonlocal mails
  1069.  
  1070. .ifdef DCconfig_internet
  1071. # configtype=internet
  1072. #
  1073. # deliver mail to the recipient if recipient domain is a domain we
  1074. # relay for. We do not ignore any target hosts here since delivering to
  1075. # a site local or even a link local address might be wanted here, and if
  1076. # such an address has found its way into the MX record of such a domain,
  1077. # the local admin is probably in a place where that broken MX record
  1078. # could be fixed.
  1079.  
  1080. dnslookup_relay_to_domains:
  1081. debug_print = "R: dnslookup_relay_to_domains for $local_part@$domain"
  1082. driver = dnslookup
  1083. domains = ! +local_domains : +relay_to_domains
  1084. transport = remote_smtp
  1085. same_domain_copy_routing = yes
  1086. dnssec_request_domains = *
  1087. no_more
  1088.  
  1089. # deliver mail directly to the recipient. This router is only reached
  1090. # for domains that we do not relay for. Since we most probably can't
  1091. # have broken MX records pointing to site local or link local IP
  1092. # addresses fixed, we ignore target hosts pointing to these addresses.
  1093.  
  1094. dnslookup:
  1095. debug_print = "R: dnslookup for $local_part@$domain"
  1096. driver = dnslookup
  1097. domains = local_domains : !local_domains
  1098. transport = remote_smtp
  1099. same_domain_copy_routing = yes
  1100. # ignore private rfc1918 and APIPA addresses
  1101. ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8 : 192.168.0.0/16 :\
  1102. 172.16.0.0/12 : 10.0.0.0/8 : 169.254.0.0/16 :\
  1103. 255.255.255.255
  1104. dnssec_request_domains = *
  1105. no_more
  1106.  
  1107. .endif
  1108.  
  1109.  
  1110. .ifdef DCconfig_local
  1111. # configtype=local
  1112. #
  1113. # Stand-alone system, so generate an error for mail to a non-local domain
  1114. nonlocal:
  1115. debug_print = "R: nonlocal for $local_part@$domain"
  1116. driver = redirect
  1117. domains = ! +local_domains
  1118. allow_fail
  1119. data = :fail: Mailing to remote domains not supported
  1120. no_more
  1121.  
  1122. .endif
  1123.  
  1124.  
  1125. .ifdef DCconfig_smarthost DCconfig_satellite
  1126. # configtype=smarthost or configtype=satellite
  1127. #
  1128. # Send all non-local mail to a single other machine (smarthost).
  1129. #
  1130. # This means _ALL_ non-local mail goes to the smarthost. This will most
  1131. # probably not do what you want for domains that are listed in
  1132. # relay_domains. The most typical use for relay_domains is to control
  1133. # relaying for incoming e-mail on secondary MX hosts. In that case,
  1134. # it doesn't make sense to send the mail to the smarthost since the
  1135. # smarthost will probably send the message right back here, causing a
  1136. # loop.
  1137. #
  1138. # If you want to use a smarthost while being secondary MX for some
  1139. # domains, you'll need to copy the dnslookup_relay_to_domains router
  1140. # here so that mail to relay_domains is handled separately.
  1141.  
  1142. smarthost:
  1143. debug_print = "R: smarthost for $local_part@$domain"
  1144. driver = manualroute
  1145. domains = ! +local_domains
  1146. transport = remote_smtp_smarthost
  1147. route_list = * DCsmarthost byname
  1148. host_find_failed = ignore
  1149. same_domain_copy_routing = yes
  1150. no_more
  1151.  
  1152. .endif
  1153.  
  1154.  
  1155. # The "no_more" above means that all later routers are for
  1156. # domains in the local_domains list, i.e. just like Exim 3 directors.
  1157. #####################################################
  1158. ### end router/200_exim4-config_primary
  1159. #####################################################
  1160. #####################################################
  1161. ### router/300_exim4-config_real_local
  1162. #####################################################
  1163.  
  1164. ### router/300_exim4-config_real_local
  1165. #################################
  1166.  
  1167. # This router allows reaching a local user while avoiding local
  1168. # processing. This can be used to inform a user of a broken .forward
  1169. # file, for example. The userforward router does this.
  1170.  
  1171. COND_LOCAL_SUBMITTER = "\
  1172. ${if match_ip{$sender_host_address}{:@[]}\
  1173. {1}{0}\
  1174. }"
  1175.  
  1176. real_local:
  1177. debug_print = "R: real_local for $local_part@$domain"
  1178. driver = accept
  1179. domains = +local_domains
  1180. condition = COND_LOCAL_SUBMITTER
  1181. local_part_prefix = real-
  1182. check_local_user
  1183. transport = LOCAL_DELIVERY
  1184.  
  1185. #####################################################
  1186. ### end router/300_exim4-config_real_local
  1187. #####################################################
  1188. #####################################################
  1189. ### router/400_exim4-config_system_aliases
  1190. #####################################################
  1191.  
  1192. ### router/400_exim4-config_system_aliases
  1193. #################################
  1194.  
  1195. # This router handles aliasing using a traditional /etc/aliases file.
  1196. #
  1197. ##### NB You must ensure that /etc/aliases exists. It used to be the case
  1198. ##### NB that every Unix had that file, because it was the Sendmail default.
  1199. ##### NB These days, there are systems that don't have it. Your aliases
  1200. ##### NB file should at least contain an alias for "postmaster".
  1201. #
  1202. # This router handles the local part in a case-insensitive way which
  1203. # satisfies the RFCs requirement that postmaster be reachable regardless
  1204. # of case. If you decide to handle /etc/aliases in a caseful way, you
  1205. # need to make arrangements for a caseless postmaster.
  1206. #
  1207. # Delivery to arbitrary directories, files, and piping to programs in
  1208. # /etc/aliases is disabled per default.
  1209. # If that is a problem for you, see
  1210. # /usr/share/doc/exim4-base/README.Debian.gz
  1211. # for explanation and some workarounds.
  1212.  
  1213. system_aliases:
  1214. debug_print = "R: system_aliases for $local_part@$domain"
  1215. driver = redirect
  1216. domains = +local_domains
  1217. allow_fail
  1218. allow_defer
  1219. data = ${lookup{$local_part}lsearch{/etc/aliases}}
  1220. .ifdef SYSTEM_ALIASES_USER
  1221. user = SYSTEM_ALIASES_USER
  1222. .endif
  1223. .ifdef SYSTEM_ALIASES_GROUP
  1224. group = SYSTEM_ALIASES_GROUP
  1225. .endif
  1226. .ifdef SYSTEM_ALIASES_FILE_TRANSPORT
  1227. file_transport = SYSTEM_ALIASES_FILE_TRANSPORT
  1228. .endif
  1229. .ifdef SYSTEM_ALIASES_PIPE_TRANSPORT
  1230. pipe_transport = SYSTEM_ALIASES_PIPE_TRANSPORT
  1231. .endif
  1232. .ifdef SYSTEM_ALIASES_DIRECTORY_TRANSPORT
  1233. directory_transport = SYSTEM_ALIASES_DIRECTORY_TRANSPORT
  1234. .endif
  1235. #####################################################
  1236. ### end router/400_exim4-config_system_aliases
  1237. #####################################################
  1238. #####################################################
  1239. ### router/500_exim4-config_hubuser
  1240. #####################################################
  1241.  
  1242. ### router/500_exim4-config_hubuser
  1243. #################################
  1244.  
  1245. .ifdef DCconfig_satellite
  1246. # This router is only used for configtype=satellite.
  1247. # It takes care to route all mail targeted to <somelocaluser@this.machine>
  1248. # to the host where we read our mail
  1249. #
  1250. hub_user:
  1251. debug_print = "R: hub_user for $local_part@$domain"
  1252. driver = redirect
  1253. domains = +local_domains
  1254. data = ${local_part}@DCreadhost
  1255. check_local_user
  1256.  
  1257. # Grab the redirected mail and deliver it.
  1258. # This is a duplicate of the smarthost router, needed because
  1259. # DCreadhost might end up as part of +local_domains
  1260. hub_user_smarthost:
  1261. debug_print = "R: hub_user_smarthost for $local_part@$domain"
  1262. driver = manualroute
  1263. domains = DCreadhost
  1264. transport = remote_smtp_smarthost
  1265. route_list = * DCsmarthost byname
  1266. host_find_failed = ignore
  1267. same_domain_copy_routing = yes
  1268. check_local_user
  1269. .endif
  1270.  
  1271.  
  1272. #####################################################
  1273. ### end router/500_exim4-config_hubuser
  1274. #####################################################
  1275. #####################################################
  1276. ### router/600_exim4-config_userforward
  1277. #####################################################
  1278.  
  1279. ### router/600_exim4-config_userforward
  1280. #################################
  1281.  
  1282. # This router handles forwarding using traditional .forward files in users'
  1283. # home directories. It also allows mail filtering with a forward file
  1284. # starting with the string "# Exim filter" or "# Sieve filter".
  1285. #
  1286. # The no_verify setting means that this router is skipped when Exim is
  1287. # verifying addresses. Similarly, no_expn means that this router is skipped if
  1288. # Exim is processing an EXPN command.
  1289. #
  1290. # The check_ancestor option means that if the forward file generates an
  1291. # address that is an ancestor of the current one, the current one gets
  1292. # passed on instead. This covers the case where A is aliased to B and B
  1293. # has a .forward file pointing to A.
  1294. #
  1295. # The four transports specified at the end are those that are used when
  1296. # forwarding generates a direct delivery to a directory, or a file, or to a
  1297. # pipe, or sets up an auto-reply, respectively.
  1298. #
  1299. userforward:
  1300. debug_print = "R: userforward for $local_part@$domain"
  1301. driver = redirect
  1302. domains = +local_domains
  1303. check_local_user
  1304. file = $home/.forward
  1305. require_files = $local_part:$home/.forward
  1306. no_verify
  1307. no_expn
  1308. check_ancestor
  1309. allow_filter
  1310. forbid_smtp_code = true
  1311. directory_transport = address_directory
  1312. file_transport = address_file
  1313. pipe_transport = address_pipe
  1314. reply_transport = address_reply
  1315. skip_syntax_errors
  1316. syntax_errors_to = real-$local_part@$domain
  1317. syntax_errors_text = \
  1318. This is an automatically generated message. An error has\n\
  1319. been found in your .forward file. Details of the error are\n\
  1320. reported below. While this error persists, you will receive\n\
  1321. a copy of this message for every message that is addressed\n\
  1322. to you. If your .forward file is a filter file, or if it is\n\
  1323. a non-filter file containing no valid forwarding addresses,\n\
  1324. a copy of each incoming message will be put in your normal\n\
  1325. mailbox. If a non-filter file contains at least one valid\n\
  1326. forwarding address, forwarding to the valid addresses will\n\
  1327. happen, and those will be the only deliveries that occur.
  1328.  
  1329. #####################################################
  1330. ### end router/600_exim4-config_userforward
  1331. #####################################################
  1332. #####################################################
  1333. ### router/700_exim4-config_procmail
  1334. #####################################################
  1335.  
  1336. procmail:
  1337. debug_print = "R: procmail for $local_part@$domain"
  1338. driver = accept
  1339. domains = +local_domains
  1340. check_local_user
  1341. transport = procmail_pipe
  1342. # emulate OR with "if exists"-expansion
  1343. require_files = ${local_part}:\
  1344. ${if exists{/etc/procmailrc}\
  1345. {/etc/procmailrc}{${home}/.procmailrc}}:\
  1346. +/usr/bin/procmail
  1347. no_verify
  1348. no_expn
  1349.  
  1350. #####################################################
  1351. ### end router/700_exim4-config_procmail
  1352. #####################################################
  1353. #####################################################
  1354. ### router/800_exim4-config_maildrop
  1355. #####################################################
  1356.  
  1357. ### router/800_exim4-config_maildrop
  1358. #################################
  1359.  
  1360. maildrop:
  1361. debug_print = "R: maildrop for $local_part@$domain"
  1362. driver = accept
  1363. domains = +local_domains
  1364. check_local_user
  1365. transport = maildrop_pipe
  1366. require_files = ${local_part}:${home}/.mailfilter:+/usr/bin/maildrop
  1367. no_verify
  1368. no_expn
  1369.  
  1370. #####################################################
  1371. ### end router/800_exim4-config_maildrop
  1372. #####################################################
  1373. #####################################################
  1374. ### router/850_exim4-config_lowuid
  1375. #####################################################
  1376.  
  1377. ### router/850_exim4-config_lowuid
  1378. #################################
  1379.  
  1380. .ifndef FIRST_USER_ACCOUNT_UID
  1381. FIRST_USER_ACCOUNT_UID = 0
  1382. .endif
  1383.  
  1384. .ifndef DEFAULT_SYSTEM_ACCOUNT_ALIAS
  1385. DEFAULT_SYSTEM_ACCOUNT_ALIAS = :fail: no mail to system accounts
  1386. .endif
  1387.  
  1388. COND_SYSTEM_USER_AND_REMOTE_SUBMITTER = "\
  1389. ${if and{{! match_ip{$sender_host_address}{:@[]}}\
  1390. {<{$local_user_uid}{FIRST_USER_ACCOUNT_UID}}}\
  1391. {1}{0}\
  1392. }"
  1393.  
  1394. lowuid_aliases:
  1395. debug_print = "R: lowuid_aliases for $local_part@$domain (UID $local_user_uid)"
  1396. check_local_user
  1397. driver = redirect
  1398. allow_fail
  1399. domains = +local_domains
  1400. condition = COND_SYSTEM_USER_AND_REMOTE_SUBMITTER
  1401. data = ${if exists{CONFDIR/lowuid-aliases}\
  1402. {${lookup{$local_part}lsearch{CONFDIR/lowuid-aliases}\
  1403. {$value}{DEFAULT_SYSTEM_ACCOUNT_ALIAS}}}\
  1404. {DEFAULT_SYSTEM_ACCOUNT_ALIAS}}
  1405. #####################################################
  1406. ### end router/850_exim4-config_lowuid
  1407. #####################################################
  1408. #####################################################
  1409. ### router/900_exim4-config_local_user
  1410. #####################################################
  1411.  
  1412. ### router/900_exim4-config_local_user
  1413. #################################
  1414.  
  1415. # This router matches local user mailboxes. If the router fails, the error
  1416. # message is "Unknown user".
  1417.  
  1418. local_user:
  1419. debug_print = "R: local_user for $local_part@$domain"
  1420. driver = accept
  1421. domains = +local_domains
  1422. check_local_user
  1423. local_parts = ! root
  1424. transport = LOCAL_DELIVERY
  1425. cannot_route_message = Unknown user
  1426. #####################################################
  1427. ### end router/900_exim4-config_local_user
  1428. #####################################################
  1429. #####################################################
  1430. ### router/mmm_mail4root
  1431. #####################################################
  1432.  
  1433. ### router/mmm_mail4root
  1434. #################################
  1435. # deliver mail addressed to root to /var/mail/mail as user mail:mail
  1436. # if it was not redirected in /etc/aliases or by other means
  1437. # Exim cannot deliver as root since 4.24 (FIXED_NEVER_USERS)
  1438.  
  1439. mail4root:
  1440. debug_print = "R: mail4root for $local_part@$domain"
  1441. driver = redirect
  1442. domains = +local_domains
  1443. data = /var/mail/mail
  1444. file_transport = address_file
  1445. local_parts = root
  1446. user = mail
  1447. group = mail
  1448.  
  1449. #####################################################
  1450. ### end router/mmm_mail4root
  1451. #####################################################
  1452. #####################################################
  1453. ### transport/00_exim4-config_header
  1454. #####################################################
  1455.  
  1456. ######################################################################
  1457. # TRANSPORTS CONFIGURATION #
  1458. ######################################################################
  1459. # ORDER DOES NOT MATTER #
  1460. # Only one appropriate transport is called for each delivery. #
  1461. ######################################################################
  1462.  
  1463. # A transport is used only when referenced from a router that successfully
  1464. # handles an address.
  1465.  
  1466. begin transports
  1467.  
  1468. #####################################################
  1469. ### end transport/00_exim4-config_header
  1470. #####################################################
  1471. #####################################################
  1472. ### transport/10_exim4-config_transport-macros
  1473. #####################################################
  1474.  
  1475. ### transport/10_exim4-config_transport-macros
  1476. #################################
  1477.  
  1478. .ifdef HIDE_MAILNAME
  1479. REMOTE_SMTP_HEADERS_REWRITE=*@+local_domains $1@DCreadhost frs : *@ETC_MAILNAME $1@DCreadhost frs
  1480. REMOTE_SMTP_RETURN_PATH=${if match_domain{$sender_address_domain}{+local_domains}{${sender_address_local_part}@DCreadhost}{${if match_domain{$sender_address_domain}{ETC_MAILNAME}{${sender_address_local_part}@DCreadhost}fail}}}
  1481. .endif
  1482.  
  1483. .ifdef REMOTE_SMTP_HELO_FROM_DNS
  1484. .ifdef REMOTE_SMTP_HELO_DATA
  1485. REMOTE_SMTP_HELO_DATA==${lookup dnsdb {ptr=$sending_ip_address}{$value}{$primary_hostname}}
  1486. .else
  1487. REMOTE_SMTP_HELO_DATA=${lookup dnsdb {ptr=$sending_ip_address}{$value}{$primary_hostname}}
  1488. .endif
  1489. .endif
  1490. #####################################################
  1491. ### end transport/10_exim4-config_transport-macros
  1492. #####################################################
  1493. #####################################################
  1494. ### transport/30_exim4-config_address_file
  1495. #####################################################
  1496.  
  1497. # This transport is used for handling deliveries directly to files that are
  1498. # generated by aliasing or forwarding.
  1499. #
  1500. address_file:
  1501. debug_print = "T: address_file for $local_part@$domain"
  1502. driver = appendfile
  1503. delivery_date_add
  1504. envelope_to_add
  1505. return_path_add
  1506.  
  1507. #####################################################
  1508. ### end transport/30_exim4-config_address_file
  1509. #####################################################
  1510. #####################################################
  1511. ### transport/30_exim4-config_address_pipe
  1512. #####################################################
  1513.  
  1514. # This transport is used for handling pipe deliveries generated by
  1515. # .forward files. If the commands fails and produces any output on standard
  1516. # output or standard error streams, the output is returned to the sender
  1517. # of the message as a delivery error.
  1518. address_pipe:
  1519. debug_print = "T: address_pipe for $local_part@$domain"
  1520. driver = pipe
  1521. return_fail_output
  1522.  
  1523. #####################################################
  1524. ### end transport/30_exim4-config_address_pipe
  1525. #####################################################
  1526. #####################################################
  1527. ### transport/30_exim4-config_address_reply
  1528. #####################################################
  1529.  
  1530. # This transport is used for handling autoreplies generated by the filtering
  1531. # option of the userforward router.
  1532. #
  1533. address_reply:
  1534. debug_print = "T: autoreply for $local_part@$domain"
  1535. driver = autoreply
  1536.  
  1537. #####################################################
  1538. ### end transport/30_exim4-config_address_reply
  1539. #####################################################
  1540. #####################################################
  1541. ### transport/30_exim4-config_mail_spool
  1542. #####################################################
  1543.  
  1544. ### transport/30_exim4-config_mail_spool
  1545.  
  1546. # This transport is used for local delivery to user mailboxes in traditional
  1547. # BSD mailbox format.
  1548. #
  1549. mail_spool:
  1550. debug_print = "T: appendfile for $local_part@$domain"
  1551. driver = appendfile
  1552. file = /var/mail/$local_part
  1553. delivery_date_add
  1554. envelope_to_add
  1555. return_path_add
  1556. group = mail
  1557. mode = 0660
  1558. mode_fail_narrower = false
  1559.  
  1560. #####################################################
  1561. ### end transport/30_exim4-config_mail_spool
  1562. #####################################################
  1563. #####################################################
  1564. ### transport/30_exim4-config_maildir_home
  1565. #####################################################
  1566.  
  1567. ### transport/30_exim4-config_maildir_home
  1568. #################################
  1569.  
  1570. # Use this instead of mail_spool if you want to to deliver to Maildir in
  1571. # home-directory - change the definition of LOCAL_DELIVERY
  1572. #
  1573. maildir_home:
  1574. debug_print = "T: maildir_home for $local_part@$domain"
  1575. driver = appendfile
  1576. .ifdef MAILDIR_HOME_MAILDIR_LOCATION
  1577. directory = MAILDIR_HOME_MAILDIR_LOCATION
  1578. .else
  1579. directory = $home/Maildir
  1580. .endif
  1581. .ifdef MAILDIR_HOME_CREATE_DIRECTORY
  1582. create_directory
  1583. .endif
  1584. .ifdef MAILDIR_HOME_CREATE_FILE
  1585. create_file = MAILDIR_HOME_CREATE_FILE
  1586. .endif
  1587. delivery_date_add
  1588. envelope_to_add
  1589. return_path_add
  1590. maildir_format
  1591. .ifdef MAILDIR_HOME_DIRECTORY_MODE
  1592. directory_mode = MAILDIR_HOME_DIRECTORY_MODE
  1593. .else
  1594. directory_mode = 0700
  1595. .endif
  1596. .ifdef MAILDIR_HOME_MODE
  1597. mode = MAILDIR_HOME_MODE
  1598. .else
  1599. mode = 0600
  1600. .endif
  1601. mode_fail_narrower = false
  1602. # This transport always chdirs to $home before trying to deliver. If
  1603. # $home is not accessible, this chdir fails and prevents delivery.
  1604. # If you are in a setup where home directories might not be
  1605. # accessible, uncomment the current_directory line below.
  1606. # current_directory = /
  1607. #####################################################
  1608. ### end transport/30_exim4-config_maildir_home
  1609. #####################################################
  1610. #####################################################
  1611. ### transport/30_exim4-config_maildrop_pipe
  1612. #####################################################
  1613.  
  1614. maildrop_pipe:
  1615. debug_print = "T: maildrop_pipe for $local_part@$domain"
  1616. driver = pipe
  1617. path = "/bin:/usr/bin:/usr/local/bin"
  1618. command = "/usr/bin/maildrop"
  1619. message_prefix =
  1620. message_suffix =
  1621. return_path_add
  1622. delivery_date_add
  1623. envelope_to_add
  1624.  
  1625. #####################################################
  1626. ### end transport/30_exim4-config_maildrop_pipe
  1627. #####################################################
  1628. #####################################################
  1629. ### transport/30_exim4-config_procmail_pipe
  1630. #####################################################
  1631.  
  1632. procmail_pipe:
  1633. debug_print = "T: procmail_pipe for $local_part@$domain"
  1634. driver = pipe
  1635. path = "/bin:/usr/bin:/usr/local/bin"
  1636. command = "/usr/bin/procmail"
  1637. return_path_add
  1638. delivery_date_add
  1639. envelope_to_add
  1640.  
  1641. #####################################################
  1642. ### end transport/30_exim4-config_procmail_pipe
  1643. #####################################################
  1644. #####################################################
  1645. ### transport/30_exim4-config_remote_smtp
  1646. #####################################################
  1647.  
  1648. ### transport/30_exim4-config_remote_smtp
  1649. #################################
  1650. # This transport is used for delivering messages over SMTP connections.
  1651. # Refuse to send any message with over-long lines, which could have
  1652. # been received other than via SMTP. The use of message_size_limit to
  1653. # enforce this is a red herring.
  1654.  
  1655. IGNORE_SMTP_LINE_LENGTH_LIMIT = 1
  1656.  
  1657. DKIM_DOMAIN = ${lc:${domain:$h_from:}}
  1658. DKIM_FILE = /etc/exim4/dkim/${lc:${domain:$h_from:}}.key
  1659. DKIM_PRIVATE_KEY = ${if exists{DKIM_FILE}{DKIM_FILE}{0}}
  1660. DKIM_SELECTOR = main
  1661.  
  1662. remote_smtp:
  1663. debug_print = "T: remote_smtp for $local_part@$domain"
  1664. driver = smtp
  1665. .ifndef IGNORE_SMTP_LINE_LENGTH_LIMIT
  1666. message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}}
  1667. .endif
  1668. .ifdef REMOTE_SMTP_HOSTS_AVOID_TLS
  1669. hosts_avoid_tls = REMOTE_SMTP_HOSTS_AVOID_TLS
  1670. .endif
  1671. .ifdef REMOTE_SMTP_HEADERS_REWRITE
  1672. headers_rewrite = REMOTE_SMTP_HEADERS_REWRITE
  1673. .endif
  1674. .ifdef REMOTE_SMTP_RETURN_PATH
  1675. return_path = REMOTE_SMTP_RETURN_PATH
  1676. .endif
  1677. .ifdef REMOTE_SMTP_HELO_DATA
  1678. helo_data=REMOTE_SMTP_HELO_DATA
  1679. .endif
  1680. .ifdef DKIM_DOMAIN
  1681. dkim_domain = DKIM_DOMAIN
  1682. .endif
  1683. .ifdef DKIM_SELECTOR
  1684. dkim_selector = DKIM_SELECTOR
  1685. .endif
  1686. .ifdef DKIM_PRIVATE_KEY
  1687. dkim_private_key = DKIM_PRIVATE_KEY
  1688. .endif
  1689. .ifdef DKIM_CANON
  1690. dkim_canon = DKIM_CANON
  1691. .endif
  1692. .ifdef DKIM_STRICT
  1693. dkim_strict = DKIM_STRICT
  1694. .endif
  1695. .ifdef DKIM_SIGN_HEADERS
  1696. dkim_sign_headers = DKIM_SIGN_HEADERS
  1697. .endif
  1698. .ifdef TLS_DH_MIN_BITS
  1699. tls_dh_min_bits = TLS_DH_MIN_BITS
  1700. .endif
  1701. .ifdef REMOTE_SMTP_TLS_CERTIFICATE
  1702. tls_certificate = REMOTE_SMTP_TLS_CERTIFICATE
  1703. .endif
  1704. .ifdef REMOTE_SMTP_PRIVATEKEY
  1705. tls_privatekey = REMOTE_SMTP_PRIVATEKEY
  1706. .endif
  1707. .ifndef REMOTE_SMTP_DISABLE_DANE
  1708. dnssec_request_domains = *
  1709. hosts_try_dane = *
  1710. .endif
  1711. #####################################################
  1712. ### end transport/30_exim4-config_remote_smtp
  1713. #####################################################
  1714. #####################################################
  1715. ### transport/30_exim4-config_remote_smtp_smarthost
  1716. #####################################################
  1717.  
  1718. ### transport/30_exim4-config_remote_smtp_smarthost
  1719. #################################
  1720.  
  1721. # This transport is used for delivering messages over SMTP connections
  1722. # to a smarthost. The local host tries to authenticate.
  1723. # This transport is used for smarthost and satellite configurations.
  1724. # Refuse to send any messsage with over-long lines, which could have
  1725. # been received other than via SMTP. The use of message_size_limit to
  1726. # enforce this is a red herring.
  1727.  
  1728. remote_smtp_smarthost:
  1729. debug_print = "T: remote_smtp_smarthost for $local_part@$domain"
  1730. driver = smtp
  1731. multi_domain
  1732. .ifndef IGNORE_SMTP_LINE_LENGTH_LIMIT
  1733. message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}}
  1734. .endif
  1735. hosts_try_auth = <; ${if exists{CONFDIR/passwd.client} \
  1736. {\
  1737. ${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$host_address}}\
  1738. }\
  1739. {} \
  1740. }
  1741. .ifdef REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS
  1742. hosts_avoid_tls = REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS
  1743. .endif
  1744. .ifdef REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS
  1745. hosts_require_tls = REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS
  1746. .endif
  1747. .ifdef REMOTE_SMTP_HEADERS_REWRITE
  1748. headers_rewrite = REMOTE_SMTP_HEADERS_REWRITE
  1749. .endif
  1750. .ifdef REMOTE_SMTP_RETURN_PATH
  1751. return_path = REMOTE_SMTP_RETURN_PATH
  1752. .endif
  1753. .ifdef REMOTE_SMTP_HELO_DATA
  1754. helo_data=REMOTE_SMTP_HELO_DATA
  1755. .endif
  1756. .ifdef TLS_DH_MIN_BITS
  1757. tls_dh_min_bits = TLS_DH_MIN_BITS
  1758. .endif
  1759. .ifdef REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE
  1760. tls_certificate = REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE
  1761. .endif
  1762. .ifdef REMOTE_SMTP_SMARTHOST_PRIVATEKEY
  1763. tls_privatekey = REMOTE_SMTP_SMARTHOST_PRIVATEKEY
  1764. .endif
  1765. #####################################################
  1766. ### end transport/30_exim4-config_remote_smtp_smarthost
  1767. #####################################################
  1768. #####################################################
  1769. ### transport/35_exim4-config_address_directory
  1770. #####################################################
  1771. # This transport is used for handling file addresses generated by alias
  1772. # or .forward files if the path ends in "/", which causes it to be treated
  1773. # as a directory name rather than a file name.
  1774.  
  1775. address_directory:
  1776. debug_print = "T: address_directory for $local_part@$domain"
  1777. driver = appendfile
  1778. delivery_date_add
  1779. envelope_to_add
  1780. return_path_add
  1781. check_string = ""
  1782. escape_string = ""
  1783. maildir_format
  1784.  
  1785. #####################################################
  1786. ### end transport/35_exim4-config_address_directory
  1787. #####################################################
  1788. #####################################################
  1789. ### retry/00_exim4-config_header
  1790. #####################################################
  1791.  
  1792. ######################################################################
  1793. # RETRY CONFIGURATION #
  1794. ######################################################################
  1795.  
  1796. begin retry
  1797.  
  1798. #####################################################
  1799. ### end retry/00_exim4-config_header
  1800. #####################################################
  1801. #####################################################
  1802. ### retry/30_exim4-config
  1803. #####################################################
  1804.  
  1805. ### retry/30_exim4-config
  1806. #################################
  1807.  
  1808. # This single retry rule applies to all domains and all errors. It specifies
  1809. # retries every 15 minutes for 2 hours, then increasing retry intervals,
  1810. # starting at 1 hour and increasing each time by a factor of 1.5, up to 16
  1811. # hours, then retries every 6 hours until 4 days have passed since the first
  1812. # failed delivery.
  1813.  
  1814. # Please note that these rules only limit the frequency of retries, the
  1815. # effective retry-time depends on the frequency of queue-running, too.
  1816. # See QUEUEINTERVAL in /etc/default/exim4.
  1817.  
  1818. # Address or Domain Error Retries
  1819. # ----------------- ----- -------
  1820.  
  1821. * * F,2h,15m; G,16h,1h,1.5; F,4d,6h
  1822.  
  1823. #####################################################
  1824. ### end retry/30_exim4-config
  1825. #####################################################
  1826. #####################################################
  1827. ### rewrite/00_exim4-config_header
  1828. #####################################################
  1829.  
  1830. ######################################################################
  1831. # REWRITE CONFIGURATION #
  1832. ######################################################################
  1833.  
  1834. begin rewrite
  1835.  
  1836. #####################################################
  1837. ### end rewrite/00_exim4-config_header
  1838. #####################################################
  1839. #####################################################
  1840. ### rewrite/31_exim4-config_rewriting
  1841. #####################################################
  1842.  
  1843. ### rewrite/31_exim4-config_rewriting
  1844. #################################
  1845.  
  1846. # This rewriting rule is particularly useful for dialup users who
  1847. # don't have their own domain, but could be useful for anyone.
  1848. # It looks up the real address of all local users in a file
  1849. .ifndef NO_EAA_REWRITE_REWRITE
  1850. *@+local_domains "${lookup{${local_part}}lsearch{/etc/email-addresses}\
  1851. {$value}fail}" Ffrs
  1852. # identical rewriting rule for /etc/mailname
  1853. *@ETC_MAILNAME "${lookup{${local_part}}lsearch{/etc/email-addresses}\
  1854. {$value}fail}" Ffrs
  1855. .endif
  1856.  
  1857.  
  1858. #####################################################
  1859. ### end rewrite/31_exim4-config_rewriting
  1860. #####################################################
  1861. #####################################################
  1862. ### auth/00_exim4-config_header
  1863. #####################################################
  1864.  
  1865. ######################################################################
  1866. # AUTHENTICATION CONFIGURATION #
  1867. ######################################################################
  1868.  
  1869. begin authenticators
  1870.  
  1871.  
  1872. #####################################################
  1873. ### end auth/00_exim4-config_header
  1874. #####################################################
  1875. #####################################################
  1876. ### auth/30_exim4-config_examples
  1877. #####################################################
  1878.  
  1879. ### auth/30_exim4-config_examples
  1880. #################################
  1881.  
  1882. # The examples below are for server side authentication, when the
  1883. # local exim is SMTP server and clients authenticate to the local exim.
  1884.  
  1885. # They allow two styles of plain-text authentication against an
  1886. # CONFDIR/passwd file whose syntax is described in exim4_passwd(5).
  1887.  
  1888. # Hosts that are allowed to use AUTH are defined by the
  1889. # auth_advertise_hosts option in the main configuration. The default is
  1890. # "*", which allows authentication to all hosts over all kinds of
  1891. # connections if there is at least one authenticator defined here.
  1892. # Authenticators which rely on unencrypted clear text passwords don't
  1893. # advertise on unencrypted connections by default. Thus, it might be
  1894. # wise to set up TLS to allow encrypted connections. If TLS cannot be
  1895. # used for some reason, you can set AUTH_SERVER_ALLOW_NOTLS_PASSWORDS to
  1896. # advertise unencrypted clear text password based authenticators on all
  1897. # connections. As this is severely reducing security, using TLS is
  1898. # preferred over allowing clear text password based authenticators on
  1899. # unencrypted connections.
  1900.  
  1901. # PLAIN authentication has no server prompts. The client sends its
  1902. # credentials in one lump, containing an authorization ID (which we do not
  1903. # use), an authentication ID, and a password. The latter two appear as
  1904. # $auth2 and $auth3 in the configuration and should be checked against a
  1905. # valid username and password. In a real configuration you would typically
  1906. # use $auth2 as a lookup key, and compare $auth3 against the result of the
  1907. # lookup, perhaps using the crypteq{}{} condition.
  1908.  
  1909. # plain_server:
  1910. # driver = plaintext
  1911. # public_name = PLAIN
  1912. # server_condition = "${if crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
  1913. # server_set_id = $auth2
  1914. # server_prompts = :
  1915. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1916. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1917. # .endif
  1918.  
  1919. # LOGIN authentication has traditional prompts and responses. There is no
  1920. # authorization ID in this mechanism, so unlike PLAIN the username and
  1921. # password are $auth1 and $auth2. Apart from that you can use the same
  1922. # server_condition setting for both authenticators.
  1923.  
  1924. # login_server:
  1925. # driver = plaintext
  1926. # public_name = LOGIN
  1927. # server_prompts = "Username:: : Password::"
  1928. # server_condition = "${if crypteq{$auth2}{${extract{1}{:}{${lookup{$auth1}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
  1929. # server_set_id = $auth1
  1930. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1931. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1932. # .endif
  1933. #
  1934. # cram_md5_server:
  1935. # driver = cram_md5
  1936. # public_name = CRAM-MD5
  1937. # server_secret = ${extract{2}{:}{${lookup{$auth1}lsearch{CONFDIR/passwd}{$value}fail}}}
  1938. # server_set_id = $auth1
  1939.  
  1940. # Here is an example of CRAM-MD5 authentication against PostgreSQL:
  1941. #
  1942. # psqldb_auth_server:
  1943. # driver = cram_md5
  1944. # public_name = CRAM-MD5
  1945. # server_secret = ${lookup pgsql{SELECT pw FROM users WHERE username = '${quote_pgsql:$auth1}'}{$value}fail}
  1946. # server_set_id = $auth1
  1947.  
  1948. # Authenticate against local passwords using sasl2-bin
  1949. # Requires exim_uid to be a member of sasl group, see README.Debian.gz
  1950. # plain_saslauthd_server:
  1951. # driver = plaintext
  1952. # public_name = PLAIN
  1953. # server_condition = ${if saslauthd{{$auth2}{$auth3}}{1}{0}}
  1954. # server_set_id = $auth2
  1955. # server_prompts = :
  1956. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1957. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1958. # .endif
  1959. #
  1960. # login_saslauthd_server:
  1961. # driver = plaintext
  1962. # public_name = LOGIN
  1963. # server_prompts = "Username:: : Password::"
  1964. # # don't send system passwords over unencrypted connections
  1965. # server_condition = ${if saslauthd{{$auth1}{$auth2}}{1}{0}}
  1966. # server_set_id = $auth1
  1967. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1968. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1969. # .endif
  1970. #
  1971. # ntlm_sasl_server:
  1972. # driver = cyrus_sasl
  1973. # public_name = NTLM
  1974. # server_realm = <short main hostname>
  1975. # server_set_id = $auth1
  1976. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1977. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1978. # .endif
  1979. #
  1980. # digest_md5_sasl_server:
  1981. # driver = cyrus_sasl
  1982. # public_name = DIGEST-MD5
  1983. # server_realm = <short main hostname>
  1984. # server_set_id = $auth1
  1985. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1986. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1987. # .endif
  1988.  
  1989. # Authentcate against cyrus-sasl
  1990. # This is mainly untested, please report any problems to
  1991. # pkg-exim4-users@lists.alioth.debian.org.
  1992. # cram_md5_sasl_server:
  1993. # driver = cyrus_sasl
  1994. # public_name = CRAM-MD5
  1995. # server_realm = <short main hostname>
  1996. # server_set_id = $auth1
  1997. #
  1998. # plain_sasl_server:
  1999. # driver = cyrus_sasl
  2000. # public_name = PLAIN
  2001. # server_realm = <short main hostname>
  2002. # server_set_id = $auth1
  2003. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  2004. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  2005. # .endif
  2006. #
  2007. # login_sasl_server:
  2008. # driver = cyrus_sasl
  2009. # public_name = LOGIN
  2010. # server_realm = <short main hostname>
  2011. # server_set_id = $auth1
  2012. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  2013. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  2014. # .endif
  2015.  
  2016. # Authenticate against courier authdaemon
  2017.  
  2018. # This is now the (working!) example from
  2019. # http://www.exim.org/eximwiki/FAQ/Policy_controls/Q0730
  2020. # Possible pitfall: access rights on /var/run/courier/authdaemon/socket.
  2021. # plain_courier_authdaemon:
  2022. # driver = plaintext
  2023. # public_name = PLAIN
  2024. # server_condition = \
  2025. # ${extract {ADDRESS} \
  2026. # {${readsocket{/var/run/courier/authdaemon/socket} \
  2027. # {AUTH ${strlen:exim\nlogin\n$auth2\n$auth3\n}\nexim\nlogin\n$auth2\n$auth3\n} }} \
  2028. # {yes} \
  2029. # fail}
  2030. # server_set_id = $auth2
  2031. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  2032. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  2033. # .endif
  2034.  
  2035. # login_courier_authdaemon:
  2036. # driver = plaintext
  2037. # public_name = LOGIN
  2038. # server_prompts = Username:: : Password::
  2039. # server_condition = \
  2040. # ${extract {ADDRESS} \
  2041. # {${readsocket{/var/run/courier/authdaemon/socket} \
  2042. # {AUTH ${strlen:exim\nlogin\n$auth1\n$auth2\n}\nexim\nlogin\n$auth1\n$auth2\n} }} \
  2043. # {yes} \
  2044. # fail}
  2045. # server_set_id = $auth1
  2046. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  2047. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  2048. # .endif
  2049.  
  2050. # This one is a bad hack to support the broken version 4.xx of
  2051. # Microsoft Outlook Express which violates the RFCs by demanding
  2052. # "250-AUTH=" instead of "250-AUTH ".
  2053. # If your list of offered authenticators is other than PLAIN and LOGIN,
  2054. # you need to adapt the public_name line manually.
  2055. # It has to be the last authenticator to work and has not been tested
  2056. # well. Use at your own risk.
  2057. # See the thread entry point from
  2058. # http://www.exim.org/mail-archives/exim-users/Week-of-Mon-20050214/msg00213.html
  2059. # for the related discussion on the exim-users mailing list.
  2060. # Thanks to Fred Viles for this great work.
  2061.  
  2062. # support_broken_outlook_express_4_server:
  2063. # driver = plaintext
  2064. # public_name = "\r\n250-AUTH=PLAIN LOGIN"
  2065. # server_prompts = User Name : Password
  2066. # server_condition = no
  2067. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  2068. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  2069. # .endif
  2070.  
  2071. ##############
  2072. # See /usr/share/doc/exim4-base/README.Debian.gz
  2073. ##############
  2074.  
  2075. # These examples below are the equivalent for client side authentication.
  2076. # They get the passwords from CONFDIR/passwd.client, whose format is
  2077. # defined in exim4_passwd_client(5)
  2078.  
  2079. # Because AUTH PLAIN and AUTH LOGIN send the password in clear, we
  2080. # only allow these mechanisms over encrypted connections by default.
  2081. # You can set AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS to allow unencrypted
  2082. # clear text password authentication on all connections.
  2083.  
  2084. cram_md5:
  2085. driver = cram_md5
  2086. public_name = CRAM-MD5
  2087. client_name = ${extract{1}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}
  2088. client_secret = ${extract{2}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}
  2089.  
  2090. # this returns the matching line from passwd.client and doubles all ^
  2091. PASSWDLINE=${sg{\
  2092. ${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}\
  2093. }\
  2094. {\\N[\\^]\\N}\
  2095. {^^}\
  2096. }
  2097.  
  2098. plain:
  2099. driver = plaintext
  2100. public_name = PLAIN
  2101. .ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS
  2102. client_send = "<; ${if !eq{$tls_out_cipher}{}\
  2103. {^${extract{1}{:}{PASSWDLINE}}\
  2104. ^${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}\
  2105. }fail}"
  2106. .else
  2107. client_send = "<; ^${extract{1}{:}{PASSWDLINE}}\
  2108. ^${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}"
  2109. .endif
  2110.  
  2111. login:
  2112. driver = plaintext
  2113. public_name = LOGIN
  2114. .ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS
  2115. # Return empty string if not non-TLS AND looking up $host in passwd-file
  2116. # yields a non-empty string; fail otherwise.
  2117. client_send = "<; ${if and{\
  2118. {!eq{$tls_out_cipher}{}}\
  2119. {!eq{PASSWDLINE}{}}\
  2120. }\
  2121. {}fail}\
  2122. ; ${extract{1}{::}{PASSWDLINE}}\
  2123. ; ${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}"
  2124. .else
  2125. # Return empty string if looking up $host in passwd-file yields a
  2126. # non-empty string; fail otherwise.
  2127. client_send = "<; ${if !eq{PASSWDLINE}{}\
  2128. {}fail}\
  2129. ; ${extract{1}{::}{PASSWDLINE}}\
  2130. ; ${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}"
  2131. .endif
  2132. #####################################################
  2133. ### end auth/30_exim4-config_examples
  2134. #####################################################
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!