API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Oct 16th, 2017
514
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 70.85 KB | None | 0 0
raw download clone embed print report
  1. #!!# cPanel Exim 4 Config
  2.  
  3.  
  4. hostlist loopback = <; @[]; 127.0.0.0/8 ; 0.0.0.0 ; ::1 ; 0000:0000:0000:0000:0000:ffff:7f00:0000/8
  5.  
  6. hostlist senderverifybypass_hosts = net-iplsearch;/etc/senderverifybypasshosts
  7.  
  8. hostlist skipsmtpcheck_hosts = net-iplsearch;/etc/skipsmtpcheckhosts
  9.  
  10. hostlist spammeripblocks = net-iplsearch;/etc/spammeripblocks
  11.  
  12. hostlist backupmx_hosts = lsearch;/etc/backupmxhosts
  13.  
  14. hostlist trustedmailhosts = lsearch;/etc/trustedmailhosts
  15.  
  16. hostlist recent_authed_mail_ips = net-iplsearch;/etc/recent_authed_mail_ips
  17.  
  18. hostlist neighbor_netblocks = net-iplsearch;/etc/neighbor_netblocks
  19.  
  20. hostlist greylist_trusted_netblocks = net-iplsearch;/etc/greylist_trusted_netblocks
  21.  
  22. hostlist greylist_common_mail_providers = net-iplsearch;/etc/greylist_common_mail_providers
  23.  
  24. hostlist cpanel_mail_netblocks = net-iplsearch;/etc/cpanel_mail_netblocks
  25.  
  26. hostlist recent_recipient_mail_server_ips = net-iplsearch;/etc/recent_recipient_mail_server_ips
  27.  
  28. domainlist user_domains = ${if exists{/etc/userdomains} {lsearch;/etc/userdomains} fail}
  29.  
  30. domainlist local_domains = lsearch;/etc/localdomains
  31.  
  32. domainlist secondarymx_domains = lsearch;/etc/secondarymx
  33.  
  34. domainlist relay_domains = +local_domains : +secondarymx_domains
  35.  
  36. smtp_accept_queue_per_connection = 30
  37.  
  38. remote_max_parallel = 10
  39.  
  40. smtp_receive_timeout = 165s
  41.  
  42. ignore_bounce_errors_after = 1d
  43.  
  44. rfc1413_query_timeout = 0s
  45.  
  46. timeout_frozen_after = 5d
  47.  
  48. auto_thaw = 7d
  49.  
  50. callout_domain_negative_expire = 1h
  51.  
  52. callout_negative_expire = 1h
  53.  
  54. acl_not_smtp = acl_not_smtp
  55.  
  56. acl_smtp_connect = acl_smtp_connect
  57.  
  58. acl_smtp_data = acl_smtp_data
  59.  
  60. acl_smtp_helo = acl_smtp_helo
  61.  
  62. acl_smtp_mail = acl_smtp_mail
  63.  
  64. acl_smtp_quit = acl_smtp_quit
  65.  
  66. acl_smtp_notquit = acl_smtp_notquit
  67.  
  68. acl_smtp_rcpt = acl_smtp_rcpt
  69.  
  70. message_body_newlines = true
  71.  
  72. check_rfc2047_length = false
  73.  
  74. keep_environment = X-SOURCE : X-SOURCE-ARGS : X-SOURCE-DIR
  75.  
  76. add_environment = PATH=/usr/local/sbin::/usr/local/bin::/sbin::/bin::/usr/sbin::/usr/bin::/sbin::/bin
  77.  
  78. chunking_advertise_hosts = 198.51.100.1
  79.  
  80. deliver_queue_load_max = 24
  81.  
  82. queue_only_load = 48
  83.  
  84. daemon_smtp_ports = 587 : 465 : 25
  85.  
  86. tls_on_connect_ports = 465
  87.  
  88. system_filter_user = cpaneleximfilter
  89.  
  90. system_filter_group = cpaneleximfilter
  91.  
  92. tls_require_ciphers = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS
  93.  
  94. av_scanner = clamd:/var/clamd
  95.  
  96. timezone = America/Sao_Paulo
  97.  
  98. spamd_address = 127.0.0.1 783 retry=30s tmo=3m
  99.  
  100. tls_certificate = ${if and \
  101. { \
  102. {gt{$tls_in_sni}{}} \
  103. {!match{$tls_in_sni}{/}} \
  104. } \
  105. {${if exists {/var/cpanel/ssl/domain_tls/$tls_in_sni/combined} \
  106. {/var/cpanel/ssl/domain_tls/$tls_in_sni/combined} \
  107. {${if exists {${sg{/var/cpanel/ssl/domain_tls/$tls_in_sni/combined}{(.+/)[^.]+(.+/combined)}{\$1*\$2}}} \
  108. {${sg{/var/cpanel/ssl/domain_tls/$tls_in_sni/combined}{(.+/)[^.]+(.+/combined)}{\$1*\$2}}} \
  109. {/etc/exim.crt} \
  110. }} \
  111. }} \
  112. {/etc/exim.crt} \
  113. }
  114.  
  115.  
  116. tls_privatekey = ${if and \
  117. { \
  118. {gt{$tls_in_sni}{}} \
  119. {!match{$tls_in_sni}{/}} \
  120. } \
  121. {${if exists {/var/cpanel/ssl/domain_tls/$tls_in_sni/combined} \
  122. {/var/cpanel/ssl/domain_tls/$tls_in_sni/combined} \
  123. {${if exists {${sg{/var/cpanel/ssl/domain_tls/$tls_in_sni/combined}{(.+/)[^.]+(.+/combined)}{\$1*\$2}}} \
  124. {${sg{/var/cpanel/ssl/domain_tls/$tls_in_sni/combined}{(.+/)[^.]+(.+/combined)}{\$1*\$2}}} \
  125. {/etc/exim.key} \
  126. }} \
  127. }} \
  128. {/etc/exim.key} \
  129. }
  130.  
  131.  
  132. # +incoming_port, +smtp_connection, +all_parents are needed for cPanel email tracking.
  133. # -retry_defer, +subject, +arguments, +received_recipients are suggested settings that may be disabled.
  134. log_selector = +incoming_port +smtp_connection +all_parents -retry_defer +subject +arguments +received_recipients
  135.  
  136.  
  137. system_filter = /etc/cpanel_exim_system_filter
  138.  
  139.  
  140.  
  141.  
  142. #!!# These options specify the Access Control Lists (ACLs) that
  143. #!!# are used for incoming SMTP messages - after the RCPT and DATA
  144. #!!# commands, respectively.
  145.  
  146.  
  147. #!!# This setting defines a named domain list called
  148. #!!# local_domains, created from the old options that
  149. #!!# referred to local domains. It will be referenced
  150. #!!# later on by the syntax "+local_domains".
  151. #!!# Other domain and host lists may follow.
  152.  
  153.  
  154.  
  155. ######################################################################
  156. # Runtime configuration file for Exim #
  157. ######################################################################
  158.  
  159.  
  160. # This is a default configuration file which will operate correctly in
  161. # uncomplicated installations. Please see the manual for a complete list
  162. # of all the runtime configuration options that can be included in a
  163. # configuration file. There are many more than are mentioned here. The
  164. # manual is in the file doc/spec.txt in the Exim distribution as a plain
  165. # ASCII file. Other formats (PostScript, Texinfo, HTML) are available from
  166. # the Exim ftp sites. The manual is also online via the Exim web sites.
  167.  
  168.  
  169. # This file is divided into several parts, all but the last of which are
  170. # terminated by a line containing the word "end". The parts must appear
  171. # in the correct order, and all must be present (even if some of them are
  172. # in fact empty). Blank lines, and lines starting with # are ignored.
  173.  
  174.  
  175.  
  176. ######################################################################
  177. # MAIN CONFIGURATION SETTINGS #
  178. ######################################################################
  179.  
  180. perl_startup = do '/etc/exim.pl'
  181.  
  182. #dns_retry = 1
  183. #dns_retrans = 1s
  184.  
  185. # Specify your host's canonical name here. This should normally be the fully
  186. # qualified "official" name of your host. If this option is not set, the
  187. # uname() function is called to obtain the name.
  188.  
  189. smtp_banner = "${primary_hostname} ESMTP Exim ${version_number} \
  190. \#${compile_number} ${tod_full} \n\
  191. We do not authorize the use of this system to transport unsolicited, \n\
  192. and/or bulk e-mail."
  193.  
  194.  
  195. #nobody as the sender seems to annoy people
  196. untrusted_set_sender = *
  197. local_from_check = false
  198.  
  199.  
  200.  
  201. split_spool_directory = yes
  202.  
  203. smtp_connect_backlog = 50
  204. smtp_accept_max = 100
  205.  
  206. # primary_hostname =
  207.  
  208. # Specify the domain you want to be added to all unqualified addresses
  209. # here. An unqualified address is one that does not contain an "@" character
  210. # followed by a domain. For example, "caesar@rome.ex" is a fully qualified
  211. # address, but the string "caesar" (i.e. just a login name) is an unqualified
  212. # email address. Unqualified addresses are accepted only from local callers by
  213. # default. See the receiver_unqualified_{hosts,nets} options if you want
  214. # to permit unqualified addresses from remote sources. If this option is
  215. # not set, the primary_hostname value is used for qualification.
  216.  
  217. # qualify_domain =
  218.  
  219.  
  220. # If you want unqualified recipient addresses to be qualified with a different
  221. # domain to unqualified sender addresses, specify the recipient domain here.
  222. # If this option is not set, the qualify_domain value is used.
  223.  
  224. # qualify_recipient =
  225.  
  226.  
  227. # Specify your local domains as a colon-separated list here. If this option
  228. # is not set (i.e. not mentioned in the configuration file), the
  229. # qualify_recipient value is used as the only local domain. If you do not want
  230. # to do any local deliveries, uncomment the following line, but do not supply
  231. # any data for it. This sets local_domains to an empty string, which is not
  232. # the same as not mentioning it at all. An empty string specifies that there
  233. # are no local domains; not setting it at all causes the default value (the
  234. # setting of qualify_recipient) to be used.
  235.  
  236.  
  237.  
  238. #!!# message_filter renamed system_filter
  239. message_body_visible = 5000
  240.  
  241.  
  242. # Specify a set of options to control the behavior of OpenSSL. The default is to
  243. # disable SSLv2 and SSLv3 due to weaknesses in these protocols.
  244. openssl_options = +no_sslv2 +no_sslv3
  245.  
  246.  
  247. # If you want to accept mail addressed to your host's literal IP address, for
  248. # example, mail addressed to "user@[111.111.111.111]", then uncomment the
  249. # following line, or supply the literal domain(s) as part of "local_domains"
  250. # above.
  251.  
  252. # local_domains_include_host_literals
  253.  
  254.  
  255. # No local deliveries will ever be run under the uids of these users (a colon-
  256. # separated list). An attempt to do so gets changed so that it runs under the
  257. # uid of "nobody" instead. This is a paranoic safety catch. Note the default
  258. # setting means you cannot deliver mail addressed to root as if it were a
  259. # normal user. This isn't usually a problem, as most sites have an alias for
  260. # root that redirects such mail to a human administrator.
  261.  
  262. never_users = root
  263.  
  264.  
  265. # The use of your host as a mail relay by any host, including the local host
  266. # calling its own SMTP port, is locked out by default. If you want to permit
  267. # relaying from the local host, you should set
  268. #
  269. # host_accept_relay = localhost
  270. #
  271. # If you want to permit relaying through your host from certain hosts or IP
  272. # networks, you need to set the option appropriately, for example
  273. #
  274. #
  275. #
  276. # If you are an MX backup or gateway of some kind for some domains, you must
  277. # set relay_domains to match those domains. This will allow any host to
  278. # relay through your host to those domains.
  279. #
  280. # See the section of the manual entitled "Control of relaying" for more
  281. # information.
  282.  
  283. # The setting below causes Exim to do a reverse DNS lookup on all incoming
  284. # IP calls, in order to get the true host name. If you feel this is too
  285. # expensive, you can specify the networks for which a lookup is done, or
  286. # remove the setting entirely.
  287.  
  288. #host_lookup = 0.0.0.0/0
  289.  
  290.  
  291. # By default, Exim expects all envelope addresses to be fully qualified, that
  292. # is, they must contain both a local part and a domain. If you want to accept
  293. # unqualified addresses (just a local part) from certain hosts, you can specify
  294. # these hosts by setting one or both of
  295. #
  296. # receiver_unqualified_hosts =
  297. # sender_unqualified_hosts =
  298. #
  299. # to control sender and receiver addresses, respectively. When this is done,
  300. # unqualified addresses are qualified using the settings of qualify_domain
  301. # and/or qualify_recipient (see above).
  302.  
  303.  
  304. # Exim contains support for the Realtime Blocking List (RBL) that is being
  305. # maintained as part of the DNS. See http://maps.vix.com/rbl/ for background.
  306. # Uncommenting the first line below will make Exim reject mail from any
  307. # host whose IP address is blacklisted in the RBL at maps.vix.com. Some
  308. # others have followed the RBL lead and have produced other lists: DUL is
  309. # a list of dial-up addresses, and ORBS is a list of open relay systems. The
  310. # second line below checks all three lists.
  311.  
  312. # rbl_domains = rbl.maps.vix.com
  313. # rbl_domains = rbl.maps.vix.com
  314.  
  315.  
  316. # If you want Exim to support the "percent hack" for all your local domains,
  317. # uncomment the following line. This is the feature by which mail addressed
  318. # to x%y@z (where z is one of your local domains) is locally rerouted to
  319. # x@y and sent on. Otherwise x%y is treated as an ordinary local part.
  320.  
  321. # percent_hack_domains = *
  322.  
  323. #sender_host_accept = +include_unknown:*
  324. #sender_host_reject = +include_unknown:lsearch*;/etc/spammers
  325.  
  326.  
  327.  
  328.  
  329.  
  330. tls_advertise_hosts = *
  331.  
  332. helo_accept_junk_hosts = *
  333.  
  334. smtp_enforce_sync = false
  335.  
  336.  
  337. #!!#######################################################!!#
  338. #!!# This new section of the configuration contains ACLs #!!#
  339. #!!# (Access Control Lists) derived from the Exim 3 #!!#
  340. #!!# policy control options. #!!#
  341. #!!#######################################################!!#
  342.  
  343. #!!# These ACLs are crudely constructed from Exim 3 options.
  344. #!!# They are almost certainly not optimal. You should study
  345. #!!# them and rewrite as necessary.
  346.  
  347. begin acl
  348.  
  349.  
  350.  
  351. ########################################################################################
  352. # DO NOT ALTER THIS BLOCK
  353. ########################################################################################
  354. #
  355. # cPanel Default ACL Template Version: 10.92
  356. # Template: universal.dist
  357. #
  358. ########################################################################################
  359. # DO NOT ALTER THIS BLOCK
  360. ########################################################################################
  361.  
  362. acl_not_smtp:
  363.  
  364. #BEGIN ACL-OUTGOING-NOTSMTP-CHECKALL-BLOCK
  365. # BEGIN INSERT resolve_vhost_owner
  366. warn
  367. condition = ${if eq{$originator_uid}{${perl{user2uid}{nobody}}}{1}{0}}
  368. set acl_c_vhost_owner = ${perl{resolve_vhost_owner}}
  369.  
  370. # END INSERT resolve_vhost_owner
  371. # BEGIN INSERT end_default_outgoing_notsmtp_checkall
  372. accept
  373.  
  374. # END INSERT end_default_outgoing_notsmtp_checkall
  375.  
  376. #END ACL-OUTGOING-NOTSMTP-CHECKALL-BLOCK
  377.  
  378. #BEGIN ACL-NOT-SMTP-BLOCK
  379.  
  380. #END ACL-NOT-SMTP-BLOCK
  381.  
  382. acl_not_smtp_mime:
  383.  
  384. #BEGIN ACL-NOT-SMTP-MIME-BLOCK
  385.  
  386. #END ACL-NOT-SMTP-MIME-BLOCK
  387.  
  388. acl_not_smtp_start:
  389.  
  390. #BEGIN ACL-NOT-SMTP-START-BLOCK
  391.  
  392. #END ACL-NOT-SMTP-START-BLOCK
  393.  
  394. acl_smtp_auth:
  395.  
  396. #BEGIN ACL-SMTP-AUTH-BLOCK
  397.  
  398. #END ACL-SMTP-AUTH-BLOCK
  399.  
  400. acl_smtp_connect:
  401.  
  402. #BEGIN ACL-CONNECT-BLOCK
  403. # BEGIN INSERT delay_unknown_hosts
  404.  
  405.  
  406. warn
  407. !hosts = : +loopback : +neighbor_netblocks : +trustedmailhosts : +recent_authed_mail_ips : +backupmx_hosts : +skipsmtpcheck_hosts : +senderverifybypass_hosts : +greylist_trusted_netblocks : +cpanel_mail_netblocks
  408. #only rate limit port 25
  409. condition = ${if eq {$received_port}{25}{yes}{no}}
  410. delay = 20s
  411.  
  412.  
  413. # END INSERT delay_unknown_hosts
  414. # BEGIN INSERT ratelimit
  415.  
  416. accept
  417. hosts = : +loopback : +recent_authed_mail_ips : +backupmx_hosts
  418.  
  419. accept
  420. hosts = +trustedmailhosts
  421.  
  422. accept
  423. condition = ${if match_ip{$sender_host_address}{net-iplsearch;/etc/trustedmailhosts}{1}{0}}
  424.  
  425. defer
  426. #only rate limit port 25
  427. condition = ${if eq {$received_port}{25}{yes}{no}}
  428. message = The server has reached its limit for processing requests from your host. Please try again later.
  429. log_message = "Host is ratelimited ($sender_rate/$sender_rate_period max:$sender_rate_limit)"
  430. ratelimit = 1.2 / 1h / strict / per_conn / noupdate
  431.  
  432.  
  433. # END INSERT ratelimit
  434. # BEGIN INSERT slow_fail_block
  435. warn
  436. #only rate limit port 25
  437. condition = ${if eq {$received_port}{25}{yes}{no}}
  438. # host had a success in the last hour
  439. ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_accept_$sender_host_address
  440. set acl_m4 = 1
  441.  
  442. defer
  443. #only rate limit port 25
  444. condition = ${if eq {$received_port}{25}{yes}{no}}
  445. condition = ${if eq {${acl_m4}}{1}{0}{1}}
  446. log_message = "Host is ratelimited due to multiple failure only connections ($sender_rate/$sender_rate_period max:$sender_rate_limit)"
  447. ratelimit = 5 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_address
  448.  
  449.  
  450. # END INSERT slow_fail_block
  451. # BEGIN INSERT spammerlist
  452.  
  453.  
  454. drop
  455. message = Your host is not allowed to connect to this server.
  456. log_message = Host is banned
  457. hosts = +spammeripblocks
  458.  
  459.  
  460. # END INSERT spammerlist
  461.  
  462. #END ACL-CONNECT-BLOCK
  463.  
  464. #BEGIN ACL-CONNECT-POST-BLOCK
  465. # BEGIN INSERT default_connect_post
  466.  
  467. # do not change the comment in the line below, it is required for /usr/local/cpanel/bin/check_exim_config
  468. #acl_smtp_notquit is required for this to work (exim 4.68)
  469. accept
  470.  
  471.  
  472. # END INSERT default_connect_post
  473.  
  474. #END ACL-CONNECT-POST-BLOCK
  475.  
  476. acl_smtp_data:
  477.  
  478. # exiscan only
  479.  
  480. # exiscan only
  481.  
  482. #BEGIN ACL-OUTGOING-SMTP-CHECKALL-BLOCK
  483.  
  484. #END ACL-OUTGOING-SMTP-CHECKALL-BLOCK
  485.  
  486. #BEGIN ACL-CHECK-MESSAGE-PRE-BLOCK
  487. # BEGIN INSERT default_check_message_pre
  488. #
  489. # Enabling this will make the server non-rfc compliant
  490. # require verify = header_sender
  491. #
  492.  
  493. accept hosts = : +loopback : +recent_authed_mail_ips
  494.  
  495. accept
  496. authenticated = *
  497. hosts = *
  498.  
  499. accept
  500. condition = ${extract{size}{${stat:/etc/trustedmailhosts}}}
  501. hosts = +trustedmailhosts
  502.  
  503. accept
  504. condition = ${extract{size}{${stat:/etc/trustedmailhosts}}}
  505. condition = ${if match_ip{$sender_host_address}{net-iplsearch;/etc/trustedmailhosts}{1}{0}}
  506.  
  507.  
  508.  
  509. # END INSERT default_check_message_pre
  510.  
  511. #END ACL-CHECK-MESSAGE-PRE-BLOCK
  512.  
  513. #BEGIN ACL-PRE-SPAM-SCAN
  514. # BEGIN INSERT mailproviders
  515. # Research in Motion - Blackberry white list
  516. accept
  517. condition = ${if exists {/etc/mailproviders/rim/ips}{${if match_ip{$sender_host_address}{iplsearch;/etc/mailproviders/rim/ips}{1}{0}}}{0}}
  518.  
  519. # END INSERT mailproviders
  520.  
  521. #END ACL-PRE-SPAM-SCAN
  522.  
  523. #BEGIN ACL-SPAM-SCAN-BLOCK
  524. # BEGIN INSERT default_spam_scan
  525.  
  526. warn
  527. # Remove spam headers from outside sources
  528. remove_header = x-spam-subject : x-spam-status : x-spam-score : x-spam-bar : x-spam-report : x-spam-flag : x-ham-report
  529.  
  530.  
  531. warn
  532. condition = ${if eq {${acl_m0}}{1}{1}{0}}
  533. spam = ${acl_m1}/defer_ok
  534. # Always make sure cPanel support mail can get through
  535. !hosts = : +trustedmailhosts : +cpanel_mail_netblocks
  536. log_message = "SpamAssassin as ${acl_m1} detected message as spam ($spam_score)"
  537. add_header = X-Spam-Subject: ***SPAM*** $rh_subject
  538. add_header = X-Spam-Status: Yes, score=$spam_score
  539. add_header = X-Spam-Score: $spam_score_int
  540. add_header = X-Spam-Bar: $spam_bar
  541. add_header = X-Spam-Report: $spam_report
  542. add_header = X-Spam-Flag: YES
  543. set acl_m2 = 1
  544.  
  545. warn
  546. condition = ${if eq {$spam_score_int}{}{0}{${if <= {${spam_score_int}}{8000}{${if >= {${spam_score_int}}{50}{${perl{store_spam}{$sender_host_address}{$spam_score}}}{0}}}{0}}}}
  547.  
  548. warn
  549. condition = ${if eq {${acl_m0}}{1}{${if eq {${acl_m2}}{1}{0}{1}}}{0}}
  550. add_header = X-Spam-Status: No, score=$spam_score
  551. add_header = X-Spam-Score: $spam_score_int
  552. add_header = X-Spam-Bar: $spam_bar
  553. add_header = X-Ham-Report: $spam_report
  554. add_header = X-Spam-Flag: NO
  555. log_message = "SpamAssassin as ${acl_m1} detected message as NOT spam ($spam_score)"
  556.  
  557.  
  558.  
  559. # END INSERT default_spam_scan
  560.  
  561. #END ACL-SPAM-SCAN-BLOCK
  562.  
  563. # exiscan only
  564.  
  565. #BEGIN ACL-EXISCAN-BLOCK
  566. # BEGIN INSERT default_exiscan
  567.  
  568. deny message = This message contains a virus or other harmful content ($malware_name)
  569. malware = */defer_ok
  570.  
  571. warn log_message = Message has been scanned: no virus or other harmful content was found
  572.  
  573.  
  574. # END INSERT default_exiscan
  575.  
  576. #END ACL-EXISCAN-BLOCK
  577. # exiscan only
  578.  
  579. #BEGIN ACL-RATELIMIT-SPAM-BLOCK
  580.  
  581. #END ACL-RATELIMIT-SPAM-BLOCK
  582.  
  583. #BEGIN ACL-SPAM-BLOCK
  584.  
  585. #END ACL-SPAM-BLOCK
  586.  
  587. #BEGIN ACL-CHECK-MESSAGE-POST-BLOCK
  588. # BEGIN INSERT default_check_message_post
  589.  
  590. accept
  591.  
  592. # END INSERT default_check_message_post
  593.  
  594. #END ACL-CHECK-MESSAGE-POST-BLOCK
  595.  
  596. acl_smtp_etrn:
  597.  
  598. #BEGIN ACL-SMTP-ETRN-BLOCK
  599.  
  600. #END ACL-SMTP-ETRN-BLOCK
  601.  
  602. acl_smtp_helo:
  603.  
  604. #BEGIN ACL-SMTP-HELO-BLOCK
  605.  
  606. #END ACL-SMTP-HELO-BLOCK
  607.  
  608. #BEGIN ACL-SMTP-HELO-POST-BLOCK
  609. # BEGIN INSERT default_smtp_helo
  610.  
  611. accept
  612.  
  613.  
  614. # END INSERT default_smtp_helo
  615.  
  616. #END ACL-SMTP-HELO-POST-BLOCK
  617.  
  618. acl_smtp_mail:
  619.  
  620. #BEGIN ACL-MAIL-PRE-BLOCK
  621. # BEGIN INSERT default_mail_pre
  622.  
  623. # ignore authenticated hosts
  624. accept
  625. authenticated = *
  626.  
  627. warn
  628. condition = ${if match_ip{$sender_host_address}{+loopback}{${perl{identify_local_connection}{$sender_host_address}{$sender_host_port}{$received_ip_address}{$received_port}{1}}}{0}}
  629. set acl_c_authenticated_local_user = ${perl{get_identified_local_connection_user}}
  630.  
  631. accept
  632. hosts = : +loopback : +recent_authed_mail_ips
  633.  
  634.  
  635.  
  636. # END INSERT default_mail_pre
  637.  
  638. #END ACL-MAIL-PRE-BLOCK
  639.  
  640. #BEGIN ACL-MAIL-BLOCK
  641. # BEGIN INSERT requirehelo
  642.  
  643. deny
  644. condition = ${if eq{$sender_helo_name}{}}
  645. message = HELO required before MAIL
  646.  
  647.  
  648. # END INSERT requirehelo
  649. # BEGIN INSERT requirehelonoforge
  650.  
  651.  
  652. drop
  653. # if ($sender_helo_name eq $primary_hostname) {
  654. # if (defined $interface_address) {
  655. # return is_loopback($interface_address) ? 0 : 1; #ok from localhost
  656. # } else {
  657. # return 0; #exim -bs
  658. # }
  659. # } else {
  660. # return 0;
  661. # }
  662. condition = ${if eq{${lc:$sender_helo_name}}{${lc:$primary_hostname}}{${if def:interface_address {${if match_ip{$interface_address}{+loopback}{0}{1}}}{0}}}{0}}
  663. message = "REJECTED - Bad HELO - Host impersonating [$sender_helo_name]"
  664.  
  665.  
  666. drop
  667. condition = ${if eq{[$interface_address]}{$sender_helo_name}}
  668. message = "REJECTED - Interface: $interface_address is _my_ address"
  669.  
  670. # END INSERT requirehelonoforge
  671. # BEGIN INSERT requirehelosyntax
  672.  
  673. drop
  674. condition = ${if isip{$sender_helo_name}}
  675. message = Access denied - Invalid HELO name (See RFC2821 4.1.3)
  676.  
  677. drop
  678. # Required because "[IPv6:<address>]" will have no .s
  679. condition = ${if match{$sender_helo_name}{\N^\[\N}{no}{yes}}
  680. condition = ${if match{$sender_helo_name}{\N\.\N}{no}{yes}}
  681. message = Access denied - Invalid HELO name (See RFC2821 4.1.1.1)
  682.  
  683. drop
  684. condition = ${if match{$sender_helo_name}{\N\.$\N}}
  685. message = Access denied - Invalid HELO name (See RFC2821 4.1.1.1)
  686.  
  687. drop
  688. condition = ${if match{$sender_helo_name}{\N\.\.\N}}
  689. message = Access denied - Invalid HELO name (See RFC2821 4.1.1.1)
  690.  
  691. # END INSERT requirehelosyntax
  692.  
  693. #END ACL-MAIL-BLOCK
  694.  
  695. #BEGIN ACL-MAIL-POST-BLOCK
  696. # BEGIN INSERT default_mail_post
  697.  
  698. accept
  699.  
  700.  
  701. # END INSERT default_mail_post
  702.  
  703. #END ACL-MAIL-POST-BLOCK
  704.  
  705. acl_smtp_mailauth:
  706.  
  707. #BEGIN ACL-SMTP-MAILAUTH-BLOCK
  708.  
  709. #END ACL-SMTP-MAILAUTH-BLOCK
  710.  
  711. acl_smtp_mime:
  712.  
  713. #BEGIN ACL-SMTP-MIME-BLOCK
  714.  
  715. #END ACL-SMTP-MIME-BLOCK
  716.  
  717. acl_smtp_notquit:
  718.  
  719. #BEGIN ACL-NOTQUIT-BLOCK
  720. # BEGIN INSERT ratelimit
  721.  
  722. # ignore authenticated hosts
  723. accept authenticated = *
  724.  
  725. accept hosts = : +recent_authed_mail_ips : +loopback
  726.  
  727. warn
  728. #only rate limit port 25
  729. condition = ${if eq {$received_port}{25}{yes}{no}}
  730. condition = ${if match {$smtp_notquit_reason}{command}{yes}{no}}
  731. log_message = "Connection Ratelimit - $sender_fullhost because of notquit: $smtp_notquit_reason ($sender_rate/$sender_rate_period max:$sender_rate_limit)"
  732. ratelimit = 1.2 / 1h / strict / per_conn
  733.  
  734.  
  735. # END INSERT ratelimit
  736.  
  737. #END ACL-NOTQUIT-BLOCK
  738.  
  739. acl_smtp_predata:
  740.  
  741. #BEGIN ACL-SMTP-PREDATA-BLOCK
  742.  
  743. #END ACL-SMTP-PREDATA-BLOCK
  744.  
  745. acl_smtp_quit:
  746.  
  747. #BEGIN ACL-SMTP-QUIT-BLOCK
  748. # BEGIN INSERT slow_fail_block
  749.  
  750. warn
  751. log_message = "Detected session with all messages failed"
  752. condition = ${if >= {${eval:$rcpt_count}}{1}{${if == {${eval:$rcpt_fail_count}}{${eval:$rcpt_count}}{yes}{no}}}{no}}
  753. set acl_m6 = 1
  754.  
  755. warn
  756. condition = ${if eq {${acl_m6}}{1}{1}{0}}
  757. ratelimit = 0 / 1h / strict / per_conn / slow_fail_block_$sender_host_address
  758. log_message = "Increment slow_fail_block Ratelimit - $sender_fullhost because of all messages failed"
  759.  
  760. warn
  761. ratelimit = 1 / 1h / noupdate / per_conn / slow_fail_block_$sender_host_address
  762. condition = ${if >= {${eval:$rcpt_count}}{1}{${if < {${eval:$rcpt_fail_count}}{${eval:$rcpt_count}}{yes}{no}}}{no}}
  763. set acl_m5 = 1
  764. log_message = "Detected session with ok message that previous had all failed"
  765.  
  766. warn
  767. condition = ${if eq {${acl_m5}}{1}{1}{0}}
  768. ratelimit = 0 / 1h / strict / per_conn / slow_fail_accept_$sender_host_address
  769. log_message = "Decrement slow_fail_lock Ratelimit - $sender_fullhost because one message was successful"
  770.  
  771.  
  772.  
  773. # END INSERT slow_fail_block
  774.  
  775. #END ACL-SMTP-QUIT-BLOCK
  776.  
  777. acl_smtp_rcpt:
  778.  
  779. #BEGIN ACL-RATELIMIT-BLOCK
  780.  
  781. #END ACL-RATELIMIT-BLOCK
  782.  
  783. #BEGIN ACL-PRE-RECIPIENT-BLOCK
  784. # BEGIN INSERT delay_unknown_hosts
  785.  
  786.  
  787. warn
  788. !authenticated = *
  789. !hosts = : +loopback : +neighbor_netblocks : +trustedmailhosts : +recent_authed_mail_ips : +backupmx_hosts : +skipsmtpcheck_hosts : +senderverifybypass_hosts : +greylist_trusted_netblocks : +cpanel_mail_netblocks
  790. #only rate limit port 25
  791. condition = ${if eq {$received_port}{25}{yes}{no}}
  792. delay = 20s
  793.  
  794. # END INSERT delay_unknown_hosts
  795. # BEGIN INSERT dkim_disable
  796.  
  797. warn
  798. control = dkim_disable_verify
  799.  
  800.  
  801. # END INSERT dkim_disable
  802.  
  803. #END ACL-PRE-RECIPIENT-BLOCK
  804.  
  805. #BEGIN ACL-RECIPIENT-BLOCK
  806. # BEGIN INSERT default_recipient
  807. accept hosts = :
  808.  
  809. accept
  810. condition = ${extract{size}{${stat:/etc/skipsmtpcheckhosts}}}
  811. hosts = +skipsmtpcheck_hosts
  812.  
  813. # implemented for "suspend incoming email" feature
  814. deny
  815. domains = +local_domains
  816. condition = ${if exists {${extract{5}{::}{${lookup passwd{${lookup{$domain}lsearch{/etc/userdomains}{$value}}}{$value}}}}/etc/\.$local_part\@$domain\.suspended_incoming}}
  817. message = Mail to ${lc:$local_part@$domain} has been suspended
  818. log_message = Mail to ${lc:$local_part@$domain} has been suspended
  819.  
  820. # implemented for "suspend outgoing email" feature
  821. deny
  822. domains = ! +local_domains
  823. condition = ${perl{domain_has_outgoing_mail_suspended}{$sender_address_domain}}
  824. message = Outgoing mail from ${sender_address_domain} has been suspended
  825. log_message = Outgoing mail from ${sender_address_domain} has been suspended
  826.  
  827. # END INSERT default_recipient
  828.  
  829. #END ACL-RECIPIENT-BLOCK
  830. #mailman only
  831.  
  832. #BEGIN ACL-RECIPIENT-MAILMAN-BLOCK
  833. # BEGIN INSERT default_recipient_mailman
  834.  
  835. # Accept bounces to lists even if callbacks or other checks would fail
  836. warn message = X-WhitelistedRCPT-nohdrfromcallback: Yes
  837. condition = \
  838. ${if and {{match{$local_part}{(.*)-bounces\+.*}} \
  839. {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}/config.pck}}} \
  840. {yes}{no}}
  841.  
  842. accept condition = \
  843. ${if and {{match{$local_part}{(.*)-bounces\+.*}} \
  844. {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}/config.pck}}} \
  845. {yes}{no}}
  846.  
  847.  
  848. # Accept bounces to lists even if callbacks or other checks would fail
  849. warn message = X-WhitelistedRCPT-nohdrfromcallback: Yes
  850. condition = \
  851. ${if and {{match{$local_part}{(.*)-bounces\+.*}} \
  852. {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}_${lc:$domain}/config.pck}}} \
  853. {yes}{no}}
  854.  
  855. accept condition = \
  856. ${if and {{match{$local_part}{(.*)-bounces\+.*}} \
  857. {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}_${lc:$domain}/config.pck}}} \
  858. {yes}{no}}
  859.  
  860. #if it gets here it isn't mailman
  861.  
  862.  
  863. # END INSERT default_recipient_mailman
  864.  
  865. #END ACL-RECIPIENT-MAILMAN-BLOCK
  866. #mailman only
  867.  
  868. #BEGIN ACL-IDENTIFY-SENDER-BLOCK
  869. # BEGIN INSERT default_identify_sender
  870. # Accept authenticated connections when the connection comes from the main
  871. # account (foo@foo.com, where foo.com's user is foo). Otherwise, we end up
  872. # unintentionally rejecting mail if the user is set to :fail:.
  873. accept
  874. authenticated = *
  875. hosts = *
  876. condition = ${if eq{${lookup{$sender_address_domain}lsearch{/etc/userdomains}{$value}}}{$sender_address_local_part}{1}{0}}
  877.  
  878. # deny must be on the same line as hosts so it will get removed by buildeximconf if turned off
  879. deny hosts = ! +loopback : ! +senderverifybypass_hosts
  880. ! verify = sender
  881.  
  882. accept hosts = *
  883. authenticated = *
  884.  
  885. # if they used "pop before smtp" and its not bound for a localdomain we remember the recent_authed_mail_ips_domain
  886. warn
  887. domains = ! +local_domains
  888. hosts = ! +loopback
  889. hosts = +recent_authed_mail_ips
  890. set acl_c_recent_authed_mail_ips_text_entry = ${perl{get_recent_authed_mail_ips_text_entry}{1}}
  891. add_header = ${if exists{/etc/eximpopbeforesmtpwarning}{${perl{popbeforesmtpwarn}{$sender_host_address}}}{}}
  892.  
  893. # if they used "pop before smtp" then we just accept
  894. accept
  895. condition = ${if exists{/etc/popbeforesmtp}{1}{0}}
  896. hosts = ! +loopback
  897. hosts = +recent_authed_mail_ips
  898.  
  899. # we need to check alwaysrelay since we don't require recentauthedmailiptracker to be enabled
  900. warn
  901. hosts = ! +loopback
  902. condition = ${if or {{eq{$acl_c_recent_authed_mail_ips_text_entry}{}}{!exists{/etc/popbeforesmtp}}}{${if exists {/etc/alwaysrelay}{${lookup{$sender_host_address}iplsearch{/etc/alwaysrelay}{1}{0}}}{0}}}{0}}
  903. set acl_c_recent_authed_mail_ips_text_entry = ${perl{get_recent_authed_mail_ips_text_entry}{1}}
  904. set acl_c_alwaysrelay = 1
  905.  
  906. accept
  907. condition = $acl_c_alwaysrelay
  908.  
  909. #recipient verifications are now done after smtp auth and pop before smtp so the users get back bounces instead of
  910. # a clogged outbox in outlook
  911.  
  912. # If we skipped identifying the sender in acl_smtp_mail (ie !def:acl_c_authenticated_local_user)
  913. # We need to do it here before we can test the two drops
  914. warn
  915. condition = ${if def:acl_c_authenticated_local_user {0}{${if match_ip{$sender_host_address}{+loopback}{${perl{identify_local_connection}{$sender_host_address}{$sender_host_port}{$received_ip_address}{$received_port}{1}}}{0}}}}
  916. set acl_c_authenticated_local_user = ${perl{get_identified_local_connection_user}}
  917.  
  918. # drop connections to localhost that are from demo accounts (required for manual connections)
  919. drop
  920. condition = ${if eq{$acl_c_authenticated_local_user}{root}{0}{1}}
  921. condition = ${if and {{match_ip{$sender_host_address}{+loopback}} \
  922. {def:acl_c_authenticated_local_user}} \
  923. {${lookup{$acl_c_authenticated_local_user}lsearch{/etc/demousers}{yes}{no}}}{no}}
  924. message = Demo accounts may not send mail
  925.  
  926. # drop connections to localhost that fail auth (required for Horde)
  927. drop
  928. condition = ${if and {{match_ip{$sender_host_address}{+loopback}} \
  929. {def:authentication_failed}} \
  930. {$authentication_failed}{no}}
  931. message = Authentication failed
  932.  
  933. # we learned this in the acl_smtp_mail block
  934. accept
  935. condition = ${if def:acl_c_authenticated_local_user {yes}{no}}
  936.  
  937.  
  938.  
  939. # END INSERT default_identify_sender
  940. # BEGIN INSERT default_message_submission
  941.  
  942. # Reject unauthenticated relay on port 587
  943. drop
  944. condition = ${if eq{$received_port}{587}{1}{0}}
  945. message = SMTP AUTH is required for message submission on port 587
  946.  
  947. # END INSERT default_message_submission
  948.  
  949. #END ACL-IDENTIFY-SENDER-BLOCK
  950.  
  951.  
  952.  
  953. #BEGIN ACL-RECP-VERIFY-BLOCK
  954. # BEGIN INSERT default_recp_verify
  955. #recipient verifications are required for all messages that are not sent to the local machine #this was done at multiple users requests
  956. require verify = recipient
  957.  
  958.  
  959.  
  960. # END INSERT default_recp_verify
  961.  
  962. #END ACL-RECP-VERIFY-BLOCK
  963.  
  964. #BEGIN ACL-POST-RECP-VERIFY-BLOCK
  965. # BEGIN INSERT dictionary_attack
  966.  
  967.  
  968. warn
  969. log_message = "Detected Dictionary Attack (Let $rcpt_fail_count bad recipients though before engaging)"
  970. condition = ${if > {${eval:$rcpt_fail_count}}{4}{yes}{no}}
  971. set acl_m7 = 1
  972.  
  973. warn
  974. condition = ${if eq {${acl_m7}}{1}{1}{0}}
  975. ratelimit = 0 / 1h / strict / per_conn
  976. log_message = "Increment Connection Ratelimit - $sender_fullhost because of Dictionary Attack"
  977.  
  978. drop
  979. condition = ${if eq {${acl_m7}}{1}{1}{0}}
  980. message = "Number of failed recipients exceeded. Come back in a few hours."
  981.  
  982.  
  983. # END INSERT dictionary_attack
  984.  
  985. #END ACL-POST-RECP-VERIFY-BLOCK
  986.  
  987. #BEGIN ACL-TRUSTEDLIST-BLOCK
  988.  
  989. #END ACL-TRUSTEDLIST-BLOCK
  990.  
  991. #BEGIN ACL-RBL-BLOCK
  992.  
  993. #END ACL-RBL-BLOCK
  994.  
  995. #BEGIN ACL-MAILAUTH-BLOCK
  996.  
  997. #END ACL-MAILAUTH-BLOCK
  998.  
  999. #BEGIN ACL-GREYLISTING-BLOCK
  1000.  
  1001. #END ACL-GREYLISTING-BLOCK
  1002.  
  1003. #BEGIN ACL-RCPT-HARD-LIMIT-BLOCK
  1004.  
  1005. #END ACL-RCPT-HARD-LIMIT-BLOCK
  1006.  
  1007. #BEGIN ACL-RCPT-SOFT-LIMIT-BLOCK
  1008.  
  1009. #END ACL-RCPT-SOFT-LIMIT-BLOCK
  1010.  
  1011. #BEGIN ACL-SPAM-SCAN-CHECK-BLOCK
  1012. # BEGIN INSERT default_spam_scan_check
  1013.  
  1014. # The only problem with this setup is that if the message is for multiple users on the same server
  1015. # and they are on different unix accounts, the settings for the first recipient which has spamassassin enabled will be used.
  1016. # This shouldn't be a problem 99.9% of the time, however its a very small price to pay for a massive speed increase.
  1017.  
  1018.  
  1019. warn domains = ! ${primary_hostname} : +local_domains
  1020. condition = ${if <= {$message_size}{200K}{${if eq {${acl_m0}}{1}{0}{${if exists{/etc/global_spamassassin_enable}{1}{${if exists{${extract{5}{::}{${lookup passwd{${lookup{$domain}lsearch{/etc/userdomains}{$value}}}{$value}}}}/.spamassassinenable}{1}{0}}}}}}}{0}}
  1021. set acl_m0 = 1
  1022. set acl_m1 = ${lookup{$domain}lsearch{/etc/userdomains}{$value}}
  1023.  
  1024. warn domains = ${primary_hostname}
  1025. condition = ${if <= {$message_size}{200K}{${if eq {${acl_m0}}{1}{0}{${if exists{/etc/global_spamassassin_enable}{1}{${if exists{${extract{5}{::}{${lookup passwd{$local_part}{$value}}}}/.spamassassinenable}{1}{0}}}}}}}{0}}
  1026. set acl_m0 = 1
  1027. set acl_m1 = $local_part
  1028.  
  1029.  
  1030.  
  1031. # END INSERT default_spam_scan_check
  1032. # BEGIN INSERT spam_scan_secondarymx
  1033.  
  1034. # Support for scanning secondarymx domains
  1035.  
  1036. warn domains = ! +local_domains : +secondarymx_domains
  1037. condition = ${if <= {$message_size}{200K}{1}{0}}
  1038. set acl_m0 = 1
  1039. set acl_m1 = cpaneleximscanner
  1040.  
  1041.  
  1042.  
  1043. # END INSERT spam_scan_secondarymx
  1044.  
  1045. #END ACL-SPAM-SCAN-CHECK-BLOCK
  1046.  
  1047. #BEGIN ACL-POST-SPAM-SCAN-CHECK-BLOCK
  1048. # BEGIN INSERT delay_unknown_hosts
  1049.  
  1050.  
  1051. warn
  1052. #acl_m2 is spam = YES
  1053. condition = ${if eq {${acl_m2}}{1}{1}{0}}
  1054. !hosts = : +loopback : +neighbor_netblocks : +trustedmailhosts : +recent_authed_mail_ips : +backupmx_hosts : +skipsmtpcheck_hosts : +senderverifybypass_hosts : +greylist_trusted_netblocks : +cpanel_mail_netblocks
  1055. delay = 40s
  1056.  
  1057. # END INSERT delay_unknown_hosts
  1058. # BEGIN INSERT mailproviders
  1059. # Research in Motion - Blackberry white list
  1060. warn
  1061. condition = ${if exists {/etc/mailproviders/rim/ips}{${if match_ip{$sender_host_address}{iplsearch;/etc/mailproviders/rim/ips}{1}{0}}}{0}}
  1062. set acl_m0 = 0
  1063.  
  1064. # END INSERT mailproviders
  1065.  
  1066. #END ACL-POST-SPAM-SCAN-CHECK-BLOCK
  1067.  
  1068. #BEGIN ACL-RECIPIENT-POST-BLOCK
  1069. # BEGIN INSERT default_recipient_post
  1070.  
  1071.  
  1072.  
  1073. accept domains = +relay_domains
  1074.  
  1075. deny message = ${expand:${lookup{host_accept_relay}lsearch{/etc/eximrejects}{$value}}}
  1076. log_message = Rejected relay attempt: '$sender_host_address' From: '$sender_address' To: '$local_part@$domain'
  1077.  
  1078.  
  1079. # END INSERT default_recipient_post
  1080.  
  1081. #END ACL-RECIPIENT-POST-BLOCK
  1082.  
  1083. acl_smtp_starttls:
  1084.  
  1085. #BEGIN ACL-SMTP-STARTTLS-BLOCK
  1086.  
  1087. #END ACL-SMTP-STARTTLS-BLOCK
  1088.  
  1089. acl_smtp_vrfy:
  1090.  
  1091. #BEGIN ACL-SMTP-SMTP-VRFY-BLOCK
  1092.  
  1093. #END ACL-SMTP-SMTP-VRFY-BLOCK
  1094.  
  1095. acl_smtp_dkim:
  1096.  
  1097. #BEGIN ACL-SMTP-DKIM-BLOCK
  1098.  
  1099. #END ACL-SMTP-DKIM-BLOCK
  1100.  
  1101.  
  1102.  
  1103.  
  1104.  
  1105. begin authenticators
  1106.  
  1107.  
  1108. dovecot_plain:
  1109. driver = dovecot
  1110. public_name = PLAIN
  1111. server_socket = /var/run/dovecot/auth-client
  1112. server_set_id = $auth1
  1113. server_condition = ${if and {{!match {$auth1}{\N[/]\N}}{eq{${if match {$auth1}{\N[+%:@]\N}{${lookup{${extract{2}{+%:@}{$auth1}}}lsearch{/etc/demodomains}{yes}}}{${lookup{$auth1}lsearch{/etc/demousers}{yes}}}}}{}}}{true}{false}}
  1114. server_advertise_condition = ${if or {{def:tls_cipher}{match_ip{$sender_host_address}{+loopback}}}{1}{0}}
  1115.  
  1116.  
  1117.  
  1118. dovecot_login:
  1119. driver = dovecot
  1120. public_name = LOGIN
  1121. server_socket = /var/run/dovecot/auth-client
  1122. server_set_id = $auth1
  1123. server_condition = ${if and {{!match {$auth1}{\N[/]\N}}{eq{${if match {$auth1}{\N[+%:@]\N}{${lookup{${extract{2}{+%:@}{$auth1}}}lsearch{/etc/demodomains}{yes}}}{${lookup{$auth1}lsearch{/etc/demousers}{yes}}}}}{}}}{true}{false}}
  1124. server_advertise_condition = ${if or {{def:tls_cipher}{match_ip{$sender_host_address}{+loopback}}}{1}{0}}
  1125.  
  1126.  
  1127.  
  1128.  
  1129.  
  1130.  
  1131. ######################################################################
  1132. # REWRITE CONFIGURATION #
  1133. ######################################################################
  1134.  
  1135. # There are no rewriting specifications in this default configuration file.
  1136.  
  1137. begin rewrite
  1138.  
  1139.  
  1140.  
  1141.  
  1142. #!!#######################################################!!#
  1143. #!!# Here follow routers created from the old routers, #!!#
  1144. #!!# for handling non-local domains. #!!#
  1145. #!!#######################################################!!#
  1146.  
  1147. begin routers
  1148.  
  1149.  
  1150.  
  1151.  
  1152. ######################################################################
  1153. # ROUTERS CONFIGURATION #
  1154. # Specifies how remote addresses are handled #
  1155. ######################################################################
  1156. # ORDER DOES MATTER #
  1157. # A remote address is passed to each in turn until it is accepted. #
  1158. ######################################################################
  1159.  
  1160. # Remote addresses are those with a domain that does not match any item
  1161. # in the "local_domains" setting above.
  1162.  
  1163.  
  1164.  
  1165.  
  1166. deliver_local_outside_jail:
  1167. driver = manualroute
  1168. require_files = "+/jail_owner"
  1169. # users outside the jail will not be in /etc/passwd => We need to check if $local_part is in /jail_owner
  1170. # we can't just check to see if they exist
  1171. # because we still want to be able to mail root
  1172. domains = +local_domains
  1173. transport = remote_smtp
  1174. route_list = "* 127.0.0.1"
  1175. # self = send allows us to send outside the jail
  1176. # we make sure /home/virtfs does not exist before we get here
  1177. # to be safe
  1178. self = send
  1179.  
  1180.  
  1181.  
  1182.  
  1183. # The main routers handle traffic to the lists themselves and the suffixed ones
  1184. # handle mail to administrative aliases. We have to use a two step process
  1185. # because otherwise mail to a list such as foo-admin@example.tld will not be
  1186. # handled properly.
  1187.  
  1188. mailman_virtual_router:
  1189. driver = accept
  1190. domains = !$primary_hostname : +local_domains
  1191. require_files = /usr/local/cpanel/3rdparty/mailman/lists/${lc::$local_part}_${lc::$domain}/config.pck : /usr/local/cpanel/3rdparty/mailman/mail/mailman
  1192. transport = mailman_virtual_transport
  1193.  
  1194.  
  1195.  
  1196. mailman_virtual_router_suffixed:
  1197. driver = accept
  1198. require_files = /usr/local/cpanel/3rdparty/mailman/lists/${lc::$local_part}_${lc::$domain}/config.pck : /usr/local/cpanel/3rdparty/mailman/mail/mailman
  1199. domains = !$primary_hostname : +local_domains
  1200. local_part_suffix = -admin : \
  1201. -bounces : -bounces+* : \
  1202. -confirm : -confirm+* : \
  1203. -join : -leave : \
  1204. -owner : -request : \
  1205. -subscribe : -unsubscribe
  1206. transport = mailman_virtual_transport
  1207.  
  1208.  
  1209.  
  1210. mailman_virtual_router_nodns:
  1211. driver = accept
  1212. require_files = /usr/local/cpanel/3rdparty/mailman/lists/${lc::$local_part}/config.pck : /usr/local/cpanel/3rdparty/mailman/mail/mailman
  1213. condition = \
  1214. ${if or {{match{$local_part}{.*_.*}} \
  1215. {eq{$local_part}{mailman}}} \
  1216. {1}{0}}
  1217. domains = $primary_hostname
  1218. transport = mailman_virtual_transport_nodns
  1219.  
  1220.  
  1221.  
  1222. mailman_virtual_router_nodns_suffixed:
  1223. driver = accept
  1224. require_files = /usr/local/cpanel/3rdparty/mailman/lists/${lc::$local_part}/config.pck : /usr/local/cpanel/3rdparty/mailman/mail/mailman
  1225. condition = \
  1226. ${if or {{match{$local_part}{.*_.*}} \
  1227. {eq{$local_part}{mailman}}} \
  1228. {1}{0}}
  1229. local_part_suffix = -admin : \
  1230. -bounces : -bounces+* : \
  1231. -confirm : -confirm+* : \
  1232. -join : -leave : \
  1233. -owner : -request : \
  1234. -subscribe : -unsubscribe
  1235. domains = $primary_hostname
  1236. transport = mailman_virtual_transport_nodns
  1237.  
  1238. democheck:
  1239. driver = redirect
  1240. require_files = "+/etc/demouids"
  1241. condition = ${if >= {$originator_uid}{100}{1}{0}}
  1242. condition = "${extract{size}{${stat:/etc/demouids}}}"
  1243. condition = "${if eq {${lookup {$originator_uid} lsearch {/etc/demouids} {$value}}}{}{false}{true}}"
  1244. allow_fail
  1245. data = :fail: demo accounts are not permitted to relay email
  1246.  
  1247.  
  1248.  
  1249. # cPanel Mail Archiving is disabled
  1250.  
  1251.  
  1252.  
  1253.  
  1254.  
  1255.  
  1256.  
  1257. #
  1258. # Handles identification of messages, nobody and webspam and mail trap checks
  1259. # in check_mail_permissions and notifies if we are defering a message
  1260. #
  1261.  
  1262.  
  1263. boxtrapper_autowhitelist:
  1264. driver = accept
  1265. condition = ${if eq {$authenticated_id}{}{0}{${if eq {$sender_address}{$local_part@$domain}{0}{${if match{$received_protocol}{\N^e?smtps?a$\N}{${perl{checkbx_autowhitelist}{$authenticated_id}}}{${if eq{$received_protocol}{local}{${perl{checkbx_autowhitelist}{$sender_ident}}}{0}}}}}}}}
  1266. require_files = "+/usr/local/cpanel/bin/boxtrapper"
  1267. transport = boxtrapper_autowhitelist
  1268. no_verify
  1269. unseen
  1270.  
  1271. check_mail_permissions:
  1272. domains = ! +local_domains
  1273. condition = ${if eq {$authenticated_id}{root}{0}{1}}
  1274. ignore_target_hosts = +loopback : 64.94.110.0/24
  1275. driver = redirect
  1276. allow_filter
  1277. reply_transport = address_reply
  1278. user = mailnull
  1279. expn = false
  1280. condition = "${perl{check_mail_permissions}}"
  1281. data = "${perl{check_mail_permissions_results}}"
  1282.  
  1283.  
  1284. #
  1285. # discover_sender_information is not included
  1286. # because from_rewrites are not enabled
  1287. #
  1288.  
  1289.  
  1290. #
  1291. # If check_mail_permissions needs to defer or fail a message it is done here
  1292. #
  1293. enforce_mail_permissions:
  1294. domains = ! +local_domains
  1295. ignore_target_hosts = +loopback : 64.94.110.0/24
  1296. condition = ${if eq {$authenticated_id}{root}{0}{1}}
  1297. driver = redirect
  1298. allow_fail
  1299. allow_defer
  1300. expn = false
  1301. condition = "${perl{enforce_mail_permissions}}"
  1302. data = "${perl{enforce_mail_permissions_results}}"
  1303.  
  1304. #
  1305. # Increments max emails per hour if needed
  1306. #
  1307. increment_max_emails_per_hour_if_needed:
  1308. domains = ! +local_domains
  1309. ignore_target_hosts = +loopback : 64.94.110.0/24
  1310. condition = ${if eq {$authenticated_id}{root}{0}{1}}
  1311. driver = redirect
  1312. allow_fail
  1313. no_verify
  1314. one_time
  1315. expn = false
  1316. condition = "${perl{increment_max_emails_per_hour_if_needed}}"
  1317. data = ":unknown:"
  1318.  
  1319.  
  1320.  
  1321.  
  1322.  
  1323. #
  1324. # reject_forwarded_mail_marked_as_spam is not included
  1325. # because no_forward_outbound_spam and no_forward_outbound_spam_over_int
  1326. # are both disabled
  1327. #
  1328.  
  1329.  
  1330.  
  1331.  
  1332. #
  1333. # Lookup host router for remote smtp and ignores verisign site finder 'service'
  1334. # This matches lookup exactly except we look for X-Precedence and Precedence so
  1335. # we can determinte what is an auto responder message in the log.
  1336. # Note: there is nothing to
  1337. # prevent X-Precedence from being added to non-autoresponded messages so this is for
  1338. # logging reasons only
  1339. #
  1340. # Note: Boxtrapper sets Precedence to auto_reply
  1341. #
  1342. autoreply_dkim_lookuphost:
  1343. driver = dnslookup
  1344. domains = ! +local_domains
  1345. condition = "${if or {{match{$h_Precedence:}{auto}}{match{$h_X-Precedence:}{auto}}}{1}{0}}"
  1346. #ignore verisign to prevent waste of bandwidth
  1347. ignore_target_hosts = +loopback : 64.94.110.0/24
  1348. require_files = "+/var/cpanel/domain_keys/private/${lc::$sender_address_domain}"
  1349. headers_add = "${perl{mailtrapheaders}}"
  1350. transport = dkim_remote_smtp
  1351.  
  1352. #
  1353. # Lookup host router for remote smtp and ignores verisign site finder 'service' and uses domain keys
  1354. #
  1355.  
  1356.  
  1357. dkim_lookuphost:
  1358. driver = dnslookup
  1359. domains = ! +local_domains
  1360. #ignore verisign to prevent waste of bandwidth
  1361. ignore_target_hosts = +loopback : 64.94.110.0/24
  1362. require_files = "+/var/cpanel/domain_keys/private/${lc::$sender_address_domain}"
  1363. headers_add = "${perl{mailtrapheaders}}"
  1364. transport = dkim_remote_smtp
  1365.  
  1366. #
  1367. # Lookup host router for remote smtp and ignores verisign site finder 'service'
  1368. # This matches lookup exactly except we look for X-Precedence and Precedence so
  1369. # we can determinte what is an auto responder message in the log.
  1370. # Note: there is nothing to
  1371. # prevent X-Precedence from being added to non-autoresponded messages so this is for
  1372. # logging reasons only
  1373. #
  1374. # Note: Boxtrapper sets Precedence to auto_reply
  1375. #
  1376.  
  1377.  
  1378. autoreply_lookuphost:
  1379. driver = dnslookup
  1380. domains = ! +local_domains
  1381. condition = "${if or {{match{$h_Precedence:}{auto}}{match{$h_X-Precedence:}{auto}}}{1}{0}}"
  1382. #ignore verisign to prevent waste of bandwidth
  1383. ignore_target_hosts = +loopback : 64.94.110.0/24
  1384. headers_add = "${perl{mailtrapheaders}}"
  1385. transport = remote_smtp
  1386.  
  1387. #
  1388. # Lookup host router for remote smtp and ignores verisign site finder 'service'
  1389. #
  1390.  
  1391.  
  1392. lookuphost:
  1393. driver = dnslookup
  1394. domains = ! +local_domains
  1395. #ignore verisign to prevent waste of bandwidth
  1396. ignore_target_hosts = +loopback : 64.94.110.0/24
  1397. headers_add = "${perl{mailtrapheaders}}"
  1398. transport = remote_smtp
  1399.  
  1400.  
  1401. # This router routes to remote hosts over SMTP by explicit IP address,
  1402. # given as a "domain literal" in the form [nnn.nnn.nnn.nnn]. The RFCs
  1403. # require this facility, which is why it is enabled by default in Exim.
  1404. # If you want to lock it out, set forbid_domain_literals in the main
  1405. # configuration section above.
  1406.  
  1407.  
  1408. #
  1409. # Literal Transports .. ignores verisigns sitefinder service
  1410. #
  1411.  
  1412. literal:
  1413. driver = ipliteral
  1414. domains = ! +local_domains
  1415. ignore_target_hosts = +loopback : 64.94.110.0/24
  1416. headers_add = "${perl{mailtrapheaders}}"
  1417. transport = remote_smtp
  1418.  
  1419.  
  1420.  
  1421.  
  1422.  
  1423.  
  1424. #!!# This new router is put here to fail all domains that
  1425. #!!# were not in local_domains in the Exim 3 configuration.
  1426.  
  1427.  
  1428. #
  1429. # Trap Failures to Remote Domain
  1430. #
  1431.  
  1432. fail_remote_domains:
  1433. driver = redirect
  1434. domains = ! +local_domains : ! localhost : ! localhost.localdomain
  1435. allow_fail
  1436. data = ":fail: The mail server could not deliver mail to $local_part@$domain. The account or domain may not exist, they may be blacklisted, or missing the proper dns entries."
  1437.  
  1438.  
  1439.  
  1440.  
  1441.  
  1442.  
  1443. #!!#######################################################!!#
  1444. #!!# Here follow routers created from the old directors, #!!#
  1445. #!!# for handling local domains. #!!#
  1446. #!!#######################################################!!#
  1447.  
  1448. ######################################################################
  1449. # DIRECTORS CONFIGURATION #
  1450. # Specifies how local addresses are handled #
  1451. ######################################################################
  1452. # ORDER DOES MATTER #
  1453. # A local address is passed to each in turn until it is accepted. #
  1454. ######################################################################
  1455.  
  1456. # Local addresses are those with a domain that matches some item in the
  1457. # "local_domains" setting above, or those which are passed back from the
  1458. # routers because of a "self=local" setting (not used in this configuration).
  1459.  
  1460.  
  1461. # This director handles aliasing using a traditional /etc/aliases file.
  1462. # If any of your aliases expand to pipes or files, you will need to set
  1463. # up a user and a group for these deliveries to run under. You can do
  1464. # this by uncommenting the "user" option below (changing the user name
  1465. # as appropriate) and adding a "group" option if necessary. Alternatively, you
  1466. # can specify "user" on the transports that are used. Note that those
  1467. # listed below are the same as are used for .forward files; you might want
  1468. # to set up different ones for pipe and file deliveries from aliases.
  1469.  
  1470. #spam_filter:
  1471. # driver = forwardfile
  1472. # file = /etc/spam.filter
  1473. # no_check_local_user
  1474. # no_verify
  1475. # filter
  1476. # allow_system_actions
  1477.  
  1478.  
  1479.  
  1480.  
  1481.  
  1482.  
  1483.  
  1484.  
  1485.  
  1486.  
  1487.  
  1488.  
  1489. #
  1490. # Account level filtering for everything but the main account
  1491. #
  1492.  
  1493. central_filter:
  1494. driver = redirect
  1495. allow_filter
  1496. allow_fail
  1497. forbid_filter_run
  1498. forbid_filter_perl
  1499. forbid_filter_lookup
  1500. forbid_filter_readfile
  1501. forbid_filter_readsocket
  1502. no_check_local_user
  1503. domains = !$primary_hostname
  1504. require_files = "+/etc/vfilters/${domain}"
  1505. condition = "${extract{size}{${stat:/etc/vfilters/${domain}}}}"
  1506. file = /etc/vfilters/${domain}
  1507. file_transport = address_file
  1508. directory_transport = address_directory
  1509. pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch{/etc/userdomains}{$value}}}{$value}}}}}{\N(jail|no)shell\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}
  1510. reply_transport = address_reply
  1511. router_home_directory = ${extract{5}{::}{${lookup passwd{${lookup{$domain}lsearch{/etc/userdomains}{$value}}}{$value}}}}
  1512. user = "${lookup{$domain}lsearch{/etc/userdomains}{$value}}"
  1513. no_verify
  1514.  
  1515.  
  1516.  
  1517. #
  1518. # Account level filtering for the main account
  1519. #
  1520. # checks /etc/vfilters/maindomain if its a localuser (ie main acct)
  1521. #
  1522. mainacct_central_user_filter:
  1523. driver = redirect
  1524. allow_filter
  1525. allow_fail
  1526. forbid_filter_run
  1527. forbid_filter_perl
  1528. forbid_filter_lookup
  1529. forbid_filter_readfile
  1530. forbid_filter_readsocket
  1531. check_local_user
  1532. domains = $primary_hostname
  1533. condition = ${if eq {${lookup{$local_part}lsearch{/etc/domainusers}{$value}}}{}{0}{${if exists {/etc/vfilters/${lookup{$local_part}lsearch{/etc/domainusers}{$value}}}{${extract{size}{${stat:/etc/vfilters/${lookup{$local_part}lsearch{/etc/domainusers}{$value}}}}}}{0}}}}
  1534. file = "/etc/vfilters/${lookup{$local_part}lsearch{/etc/domainusers}{$value}}"
  1535. directory_transport = address_directory
  1536. file_transport = address_file
  1537. pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{$local_part}{$value}}}}}{\N(jail|no)shell\N}{jailed_address_pipe}{address_pipe}}}}
  1538. reply_transport = address_reply
  1539. user = $local_part
  1540. group = $local_part
  1541. retry_use_local_part
  1542. no_verify
  1543.  
  1544. #
  1545. # User Level Filtering for the main account
  1546. #
  1547.  
  1548.  
  1549. central_user_filter:
  1550. driver = redirect
  1551. allow_filter
  1552. allow_fail
  1553. forbid_filter_run
  1554. forbid_filter_perl
  1555. forbid_filter_lookup
  1556. forbid_filter_readfile
  1557. forbid_filter_readsocket
  1558. check_local_user
  1559. domains = $primary_hostname
  1560. require_files = "+${extract{5}{::}{${lookup passwd{$local_part}{$value}}}}/etc/filter"
  1561. condition = "${extract{size}{${stat:${extract{5}{::}{${lookup passwd{$local_part}{$value}}}}/etc/filter}}}"
  1562. file = "${extract{5}{::}{${lookup passwd{$local_part}{$value}}}}/etc/filter"
  1563. router_home_directory = ${extract{5}{::}{${lookup passwd{$local_part}{$value}}}}
  1564. directory_transport = address_directory
  1565. file_transport = address_file
  1566. pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{$local_part}{$value}}}}}{\N(jail|no)shell\N}{jailed_address_pipe}{address_pipe}}}}
  1567. reply_transport = address_reply
  1568. user = $local_part
  1569. group = $local_part
  1570. local_part_suffix = +*
  1571. local_part_suffix_optional
  1572. retry_use_local_part
  1573. no_verify
  1574.  
  1575. #
  1576. # User Level Filtering for virtual users
  1577. #
  1578.  
  1579.  
  1580. virtual_user_filter:
  1581. driver = redirect
  1582. allow_filter
  1583. allow_fail
  1584. forbid_filter_run
  1585. forbid_filter_perl
  1586. forbid_filter_lookup
  1587. forbid_filter_readfile
  1588. forbid_filter_readsocket
  1589. no_check_local_user
  1590. domains = !$primary_hostname
  1591. require_files = "+/etc/valiases/$domain:+${extract{5}{::}{${lookup passwd{${lookup{$domain}lsearch{/etc/userdomains}{$value}}}{$value}}}}/etc/$domain/$local_part/filter"
  1592. router_home_directory = ${extract{5}{::}{${lookup passwd{${lookup{$domain}lsearch{/etc/userdomains}{$value}}}{$value}}}}
  1593. condition = "${extract{size}{$home/etc/$domain/$local_part/filter}}}"
  1594. file = "$home/etc/$domain/$local_part/filter"
  1595. directory_transport = address_directory
  1596. file_transport = address_file
  1597. pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch{/etc/userdomains}{$value}}}{$value}}}}}{\N(jail|no)shell\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}
  1598. reply_transport = address_reply
  1599. user = "${lookup{$domain}lsearch{/etc/userdomains}{$value}}"
  1600. local_part_suffix = +*
  1601. local_part_suffix_optional
  1602. retry_use_local_part
  1603. no_verify
  1604.  
  1605.  
  1606.  
  1607.  
  1608.  
  1609.  
  1610. virtual_aliases_nostar:
  1611. driver = redirect
  1612. allow_defer
  1613. allow_fail
  1614. domains = !$primary_hostname
  1615. require_files = "+/etc/valiases/$domain"
  1616. user = "${lookup{$domain}lsearch{/etc/userdomains}{$value}}"
  1617. address_data = ${lookup{$local_part@$domain}lsearch{/etc/valiases/$domain}}
  1618. data = $address_data
  1619. file_transport = address_file
  1620. pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch{/etc/userdomains}{$value}}}{$value}}}}}{\N(jail|no)shell\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}
  1621. retry_use_local_part
  1622. unseen
  1623.  
  1624.  
  1625.  
  1626. virtual_user_overquota:
  1627. driver = redirect
  1628. domains = !$primary_hostname
  1629. require_files = "+/etc/valiases/$domain:+$home/etc/$domain"
  1630. user = "${lookup{$domain}lsearch{/etc/userdomains}{$value}}"
  1631. router_home_directory = ${extract{5}{::}{${lookup passwd{${lookup{$domain}lsearch{/etc/userdomains}{$value}}}{$value}}}}
  1632. condition = "${if exists {$home/etc/$domain/quota}{${if > {${lookup{$local_part}lsearch{$home/etc/$domain/quota}{$value}{0}}}{0}{${if match {${readsocket{/var/run/dovecot/quota-status}{request=smtpd_access_policy\nrecipient=${quote:$local_part}@${quote:$domain}\nsize=$message_size\n\n}{3s}{\n}{SOCKETFAIL}}}{action=5}{true}{false}}}{false}}}{false}}"
  1633. data = ":fail:Mailbox is full / Blocks limit exceeded / Inode limit exceeded"
  1634. verify_only
  1635. allow_fail
  1636.  
  1637.  
  1638.  
  1639.  
  1640.  
  1641.  
  1642.  
  1643. #
  1644. # Virtual User Spam Boxes
  1645. #
  1646.  
  1647. virtual_user_spam:
  1648. driver = redirect
  1649. domains = !$primary_hostname
  1650. condition = ${if match{$h_X-Spam-Status:}{\N^Yes\N}{true}{false}}
  1651. require_files = "+/etc/valiases/$domain:+${extract{5}{::}{${lookup passwd{${lookup{$domain}lsearch{/etc/userdomains}{$value}}}{$value}}}}/.spamassassinboxenable:+${extract{5}{::}{${lookup passwd{${lookup{$domain}lsearch{/etc/userdomains}{$value}}}{$value}}}}/mail/$domain/$local_part"
  1652. headers_remove="x-uidl"
  1653. data = "$local_part+spam@$domain"
  1654. redirect_router = virtual_user
  1655.  
  1656.  
  1657.  
  1658. virtual_boxtrapper_user:
  1659. driver = accept
  1660. domains = !$primary_hostname
  1661. require_files = "+/etc/valiases/$domain:+/usr/local/cpanel/bin/boxtrapper:+${extract{5}{::}{${lookup passwd{${lookup{$domain}lsearch{/etc/userdomains}{$value}}}{$value}}}}/etc/$domain/$local_part/.boxtrapperenable:+${extract{5}{::}{${lookup passwd{${lookup{$domain}lsearch{/etc/userdomains}{$value}}}{$value}}}}/mail/$domain/$local_part"
  1662. user = "${lookup{$domain}lsearch{/etc/userdomains}{$value}}"
  1663. router_home_directory = ${extract{5}{::}{${lookup passwd{${lookup{$domain}lsearch{/etc/userdomains}{$value}}}{$value}}}}
  1664. headers_remove="x-uidl"
  1665. transport = virtual_boxtrapper_userdelivery
  1666.  
  1667. virtual_user:
  1668. driver = accept
  1669. domains = !$primary_hostname
  1670. require_files = "+/etc/valiases/$domain:+${extract{5}{::}{${lookup passwd{${lookup{$domain}lsearch{/etc/userdomains}{$value}}}{$value}}}}/mail/$domain/$local_part"
  1671. router_home_directory = ${extract{5}{::}{${lookup passwd{${lookup{$domain}lsearch{/etc/userdomains}{$value}}}{$value}}}}
  1672. headers_remove="x-uidl"
  1673. local_part_suffix = +*
  1674. local_part_suffix_optional
  1675. user = mailnull
  1676. group = mail
  1677. transport = ${if forany {${addresses:$h_to:}:${addresses:$h_cc:}}{or {{eqi{${extract{1}{+}{${local_part:$item}}}@${domain:$item}}{$local_part@$domain}}{eqi{${extract{1}{+}{${local_part:$item}}}@${domain:$item}}{$original_local_part@$original_domain}}}}{dovecot_virtual_delivery}{dovecot_virtual_delivery_no_batch}}
  1678. #
  1679. # If the delivery address, original address (forwarded),
  1680. # or address with subaddress is shown on the To: or Cc:
  1681. # lines or the message has the List-Id: or Precedence:
  1682. # header we allow the message to be batched to
  1683. # dovecot LMTP via transport dovecot_virtual_delivery
  1684. #
  1685. # If it does match match the above we do not allow the message
  1686. # to be batched in order to ensure that the Envelope-To: header
  1687. # does not contain a user that was Bcc:ed so savvy recipients
  1688. # cannot see that another email was Bcc:ed in the header
  1689. # via transport dovecot_virtual_delivery_no_batch
  1690. #
  1691. # Note: match_address would be nice here but the second string
  1692. # is not expanded for security reasons
  1693. #
  1694.  
  1695.  
  1696.  
  1697.  
  1698. #
  1699. # has_alias_but_no_mailbox_discarded_to_prevent_loop required either of the following:
  1700. #
  1701. # 1. There is an active alias in the valias file
  1702. # 2. There is an active autoresponder and the * is set to :fail:
  1703. #
  1704. has_alias_but_no_mailbox_discarded_to_prevent_loop:
  1705. driver = redirect
  1706. domains = !$primary_hostname
  1707. require_files = "+/etc/valiases/$domain"
  1708. condition = ${lookup{$local_part@$domain}lsearch{/etc/valiases/$domain}{1}{0}}
  1709. condition = "${if forany{<, ${lookup{$local_part@$domain}lsearch{/etc/valiases/$domain}{$value}}}{!match{$item}{\N/autorespond\N}}{1}{${if match {${lookup{\N*\N}lsearch{/etc/valiases/$domain}{$value}}}{:fail:}{1}{0}}}}"
  1710. data=":blackhole:"
  1711. local_part_suffix = +*
  1712. local_part_suffix_optional
  1713. disable_logging = true
  1714.  
  1715.  
  1716.  
  1717.  
  1718.  
  1719.  
  1720.  
  1721. valias_domain_file:
  1722. driver = redirect
  1723. allow_defer
  1724. allow_fail
  1725. require_files = +/etc/vdomainaliases/$domain
  1726. condition = ${lookup {$domain} lsearch {/etc/vdomainaliases/$domain}{yes}{no} }
  1727. address_data = $local_part@${lookup {$domain} lsearch {/etc/vdomainaliases/$domain} }
  1728. data = $address_data
  1729.  
  1730. virtual_aliases:
  1731. driver = redirect
  1732. allow_defer
  1733. allow_fail
  1734. domains = !$primary_hostname
  1735. require_files = "+/etc/valiases/$domain"
  1736. user = "${lookup{$domain}lsearch{/etc/userdomains}{$value}}"
  1737. address_data = ${lookup{*}lsearch{/etc/valiases/$domain}}
  1738. data = $address_data
  1739. file_transport = address_file
  1740. pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_virtual_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{${lookup{$domain}lsearch{/etc/userdomains}{$value}}}{$value}}}}}{\N(jail|no)shell\N}{jailed_virtual_address_pipe}{virtual_address_pipe}}}}
  1741.  
  1742.  
  1743.  
  1744.  
  1745.  
  1746.  
  1747.  
  1748. # This director handles forwarding using traditional .forward files.
  1749. # If you want it also to allow mail filtering when a forward file
  1750. # starts with the string "# Exim filter", uncomment the "filter" option.
  1751. # The check_ancestor option means that if the forward file generates an
  1752. # address that is an ancestor of the current one, the current one gets
  1753. # passed on instead. This covers the case where A is aliased to B and B
  1754. # has a .forward file pointing to A. The three transports specified at the
  1755. # end are those that are used when forwarding generates a direct delivery
  1756. # to a file, or to a pipe, or sets up an auto-reply, respectively.
  1757.  
  1758. system_aliases:
  1759. driver = redirect
  1760. allow_defer
  1761. allow_fail
  1762. domains = $primary_hostname
  1763. address_data = ${lookup{$local_part}lsearch{/etc/aliases}}
  1764. data = $address_data
  1765. file_transport = address_file
  1766. pipe_transport = address_pipe
  1767. # user = exim
  1768.  
  1769.  
  1770. local_aliases:
  1771. driver = redirect
  1772. allow_defer
  1773. allow_fail
  1774. domains = $primary_hostname
  1775. address_data = ${lookup{$local_part}lsearch{/etc/localaliases}}
  1776. data = $address_data
  1777. file_transport = address_file
  1778. pipe_transport = address_pipe
  1779. check_local_user
  1780.  
  1781.  
  1782.  
  1783.  
  1784.  
  1785. userforward:
  1786. driver = redirect
  1787. allow_filter
  1788. allow_fail
  1789. forbid_filter_run
  1790. forbid_filter_perl
  1791. forbid_filter_lookup
  1792. forbid_filter_readfile
  1793. forbid_filter_readsocket
  1794. check_ancestor
  1795. check_local_user
  1796. domains = $primary_hostname
  1797. no_expn
  1798. require_files = "+$home/.forward"
  1799. condition = "${extract{size}{${stat:$home/.forward}}}"
  1800. file = $home/.forward
  1801. file_transport = address_file
  1802. pipe_transport = ${if forall{/bin/cagefs_enter:/usr/sbin/cagefsctl}{exists{$item}}{cagefs_address_pipe}{${if match{${extract{6}{:}{${lookup passwd{$local_part}{$value}}}}}{\N(jail|no)shell\N}{jailed_address_pipe}{address_pipe}}}}
  1803. reply_transport = address_reply
  1804. directory_transport = address_directory
  1805. user = $local_part
  1806. group = $local_part
  1807. no_verify
  1808.  
  1809.  
  1810.  
  1811.  
  1812. # srs is disabled
  1813.  
  1814.  
  1815.  
  1816.  
  1817.  
  1818.  
  1819. localuser_root:
  1820. driver = redirect
  1821. allow_fail
  1822. domains = $primary_hostname
  1823. check_local_user
  1824. condition = ${if eq {$local_part}{root}}
  1825. data = :fail: root cannot accept local mail deliveries
  1826.  
  1827.  
  1828.  
  1829. localuser_overquota:
  1830. driver = redirect
  1831. domains = $primary_hostname
  1832. check_local_user
  1833. condition = "${if match {${readsocket{/var/run/dovecot/quota-status}{request=smtpd_access_policy\nrecipient=${quote:$local_part}\nsize=$message_size\n\n}{3s}{\n}{SOCKETFAIL}}}{action=5}{true}{false}}"
  1834. data = ":fail:Mailbox is full / Blocks limit exceeded / Inode limit exceeded"
  1835. verify_only
  1836. allow_fail
  1837.  
  1838.  
  1839. #
  1840. # Optimized spambox router
  1841. #
  1842.  
  1843. localuser_spam:
  1844. driver = redirect
  1845. domains = $primary_hostname
  1846. require_files = "+$home/.spamassassinboxenable"
  1847. condition = ${if match{$h_X-Spam-Status:}{\N^Yes\N}{true}{false}}
  1848. # sets home,user,group
  1849. check_local_user
  1850. headers_remove="x-uidl"
  1851. data = "$local_part+spam"
  1852. redirect_router = localuser
  1853.  
  1854.  
  1855.  
  1856.  
  1857. boxtrapper_localuser:
  1858. driver = accept
  1859. require_files = "+/usr/local/cpanel/bin/boxtrapper:+$home/etc/.boxtrapperenable"
  1860. check_local_user
  1861. domains = $primary_hostname
  1862. transport = local_boxtrapper_delivery
  1863.  
  1864. localuser:
  1865. driver = accept
  1866. # sets home,user,group
  1867. check_local_user
  1868. domains = $primary_hostname
  1869. headers_remove="x-uidl"
  1870. local_part_suffix = +*
  1871. local_part_suffix_optional
  1872. user = mailnull
  1873. group = mail
  1874. transport = ${if forany {${addresses:$h_to:}:${addresses:$h_cc:}}{or {{eqi{${extract{1}{+}{${local_part:$item}}}@${domain:$item}}{$local_part@$domain}}{eqi{${extract{1}{+}{${local_part:$item}}}@${domain:$item}}{$original_local_part@$original_domain}}}}{dovecot_delivery}{dovecot_delivery_no_batch}}
  1875. #
  1876. # If the delivery address, original address (forwarded),
  1877. # or address with subaddress is shown on the To: or Cc:
  1878. # lines or the message has the List-Id: or Precedence:
  1879. # header we allow the message to be batched to
  1880. # dovecot LMTP via transport dovecot_virtual_delivery
  1881. #
  1882. # If it does match match the above we do not allow the message
  1883. # to be batched in order to ensure that the Envelope-To: header
  1884. # does not contain a user that was Bcc:ed so savvy recipients
  1885. # cannot see that another email was Bcc:ed in the header
  1886. # via transport dovecot_virtual_delivery_no_batch
  1887. #
  1888. # Note: match_address would be nice here but the second string
  1889. # is not expanded for security reasons
  1890. #
  1891.  
  1892. # This director matches local user mailboxes.
  1893.  
  1894.  
  1895.  
  1896.  
  1897.  
  1898.  
  1899.  
  1900. ######################################################################
  1901. # TRANSPORTS CONFIGURATION #
  1902. ######################################################################
  1903. # ORDER DOES NOT MATTER #
  1904. # Only one appropriate transport is called for each delivery. #
  1905. ######################################################################
  1906.  
  1907. # A transport is used only when referenced from a director or a router that
  1908. # successfully handles an address.
  1909.  
  1910.  
  1911. # This transport is used for delivering messages over SMTP connections.
  1912.  
  1913. begin transports
  1914.  
  1915.  
  1916.  
  1917.  
  1918.  
  1919.  
  1920. mailman_virtual_transport:
  1921. driver = pipe
  1922. command = /usr/local/cpanel/3rdparty/mailman/mail/mailman \
  1923. '${if def:local_part_suffix \
  1924. {${sg{$local_part_suffix}{-(\\w+)(\\+.*)?}{\$1}}} \
  1925. {post}}' \
  1926. ${lc:$local_part}_${lc:$domain}
  1927. current_directory = /usr/local/cpanel/3rdparty/mailman
  1928. home_directory = /usr/local/cpanel/3rdparty/mailman
  1929. user = mailman
  1930. group = mailman
  1931.  
  1932.  
  1933.  
  1934.  
  1935. mailman_virtual_transport_nodns:
  1936. driver = pipe
  1937. command = /usr/local/cpanel/3rdparty/mailman/mail/mailman \
  1938. '${if def:local_part_suffix \
  1939. {${sg{$local_part_suffix}{-(\\w+)(\\+.*)?}{\$1}}} \
  1940. {post}}' \
  1941. ${lc:$local_part}
  1942. current_directory = /usr/local/cpanel/3rdparty/mailman
  1943. home_directory = /usr/local/cpanel/3rdparty/mailman
  1944. user = mailman
  1945. group = mailman
  1946.  
  1947.  
  1948. remote_smtp:
  1949. driver = smtp
  1950. interface = <; ${if > {${extract{size}{${stat:/etc/mailips}}}}{0}{${lookup{${lc:$sender_address_domain}}lsearch{/etc/mailips}{$value}{${lookup{${lc:$original_domain}}lsearch{/etc/mailips}{$value}{${lookup{${perl{get_sender_from_uid}}}lsearch*{/etc/mailips}{$value}{}}}}}}}}
  1951. helo_data = ${if > {${extract{size}{${stat:/etc/mailhelo}}}}{0}{${lookup{${lc:$sender_address_domain}}lsearch{/etc/mailhelo}{$value}{${lookup{${lc:$original_domain}}lsearch{/etc/mailhelo}{$value}{${lookup{${perl{get_sender_from_uid}}}lsearch*{/etc/mailhelo}{$value}{$primary_hostname}}}}}}}{$primary_hostname}}
  1952. hosts_try_chunking = 198.51.100.1
  1953.  
  1954.  
  1955.  
  1956. dkim_remote_smtp:
  1957. driver = smtp
  1958. interface = <; ${if > {${extract{size}{${stat:/etc/mailips}}}}{0}{${lookup{${lc:$sender_address_domain}}lsearch{/etc/mailips}{$value}{${lookup{${lc:$original_domain}}lsearch{/etc/mailips}{$value}{${lookup{${perl{get_sender_from_uid}}}lsearch*{/etc/mailips}{$value}{}}}}}}}}
  1959. helo_data = ${if > {${extract{size}{${stat:/etc/mailhelo}}}}{0}{${lookup{${lc:$sender_address_domain}}lsearch{/etc/mailhelo}{$value}{${lookup{${lc:$original_domain}}lsearch{/etc/mailhelo}{$value}{${lookup{${perl{get_sender_from_uid}}}lsearch*{/etc/mailhelo}{$value}{$primary_hostname}}}}}}}{$primary_hostname}}
  1960. dkim_domain = ${lc:$sender_address_domain}
  1961. dkim_selector = default
  1962. dkim_private_key = "/var/cpanel/domain_keys/private/${dkim_domain}"
  1963. dkim_canon = relaxed
  1964. hosts_try_chunking = 198.51.100.1
  1965.  
  1966.  
  1967.  
  1968. # This transport is used for local delivery to user mailboxes. By default
  1969. # it will be run under the uid and gid of the local user, and requires
  1970. # the sticky bit to be set on the /var/mail directory. Some systems use
  1971. # the alternative approach of running mail deliveries under a particular
  1972. # group instead of using the sticky bit. The commented options below show
  1973. # how this can be done.
  1974.  
  1975.  
  1976.  
  1977.  
  1978.  
  1979.  
  1980. # This transport is used for handling pipe deliveries generated by alias
  1981. # or .forward files. If the pipe generates any standard output, it is returned
  1982. # to the sender of the message as a delivery error. Set return_fail_output
  1983. # instead of return_output if you want this to happen only when the pipe fails
  1984. # to complete normally. You can set different transports for aliases and
  1985. # forwards if you want to - see the references to address_pipe below.
  1986.  
  1987.  
  1988. address_directory:
  1989. driver = pipe
  1990. command = /usr/libexec/dovecot/dovecot-lda -f $sender_address -d ${perl{convert_address_directory_to_dovecot_lda_destination_username}} -m ${perl{convert_address_directory_to_dovecot_lda_mailbox}}
  1991. message_prefix =
  1992. message_suffix =
  1993. log_output
  1994. delivery_date_add
  1995. envelope_to_add
  1996. return_path_add
  1997. temp_errors = 64 : 69 : 70: 71 : 72 : 73 : 74 : 75 : 78
  1998.  
  1999. address_pipe:
  2000. driver = pipe
  2001. return_output
  2002.  
  2003. virtual_address_pipe:
  2004. driver = pipe
  2005. return_output
  2006.  
  2007. jailed_address_pipe:
  2008. driver = pipe
  2009. force_command
  2010. command = /usr/local/cpanel/bin/jailexec $address_pipe
  2011. return_output
  2012.  
  2013. jailed_virtual_address_pipe:
  2014. driver = pipe
  2015. force_command
  2016. command = /usr/local/cpanel/bin/jailexec $address_pipe
  2017. return_output
  2018.  
  2019. cagefs_address_pipe:
  2020. driver = pipe
  2021. force_command
  2022. command = /bin/cagefs_enter $address_pipe
  2023. return_output
  2024.  
  2025. cagefs_virtual_address_pipe:
  2026. driver = pipe
  2027. force_command
  2028. command = /bin/cagefs_enter $address_pipe
  2029. return_output
  2030.  
  2031.  
  2032. # This transport is used for handling deliveries directly to files that are
  2033. # generated by aliassing or forwarding.
  2034.  
  2035.  
  2036. address_file:
  2037. driver = pipe
  2038. command = /usr/libexec/dovecot/dovecot-lda -e -f $sender_address -d ${perl{convert_address_directory_to_dovecot_lda_destination_username}} -m ${perl{convert_address_directory_to_dovecot_lda_mailbox}}
  2039. message_prefix =
  2040. message_suffix =
  2041. log_output
  2042. delivery_date_add
  2043. envelope_to_add
  2044. return_path_add
  2045. temp_errors = 64 : 69 : 70: 71 : 72 : 73 : 74 : 75 : 78
  2046.  
  2047.  
  2048. # For email with a bcc:
  2049. dovecot_delivery_no_batch:
  2050. driver = lmtp
  2051. socket = /var/run/dovecot/lmtp
  2052. batch_max = 1
  2053. rcpt_include_affixes
  2054. delivery_date_add
  2055. envelope_to_add
  2056. return_path_add
  2057.  
  2058. # For email with a bcc:
  2059. dovecot_virtual_delivery_no_batch:
  2060. driver = lmtp
  2061. socket = /var/run/dovecot/lmtp
  2062. batch_max = 1
  2063. rcpt_include_affixes
  2064. delivery_date_add
  2065. envelope_to_add
  2066. return_path_add
  2067.  
  2068.  
  2069.  
  2070. boxtrapper_autowhitelist:
  2071. driver = pipe
  2072. headers_only
  2073. command = /usr/local/cpanel/bin/boxtrapper --autowhitelist "${authenticated_id}"
  2074. user = ${perl{getemailuser}{$authenticated_id}{$received_protocol}{$sender_ident}}
  2075. group = ${extract{3}{:}{${lookup passwd{${perl{getemailuser}{$authenticated_id}{$received_protocol}{$sender_ident}}}{$value}}}}
  2076. log_output = true
  2077. current_directory = "/tmp"
  2078. return_fail_output = true
  2079. return_path_add = false
  2080. temp_errors = 64 : 69 : 70: 71 : 72 : 73 : 74 : 75 : 78
  2081.  
  2082.  
  2083.  
  2084. local_boxtrapper_delivery:
  2085. driver = pipe
  2086. command = /usr/local/cpanel/bin/boxtrapper "${local_part}" $home
  2087. user = $local_part
  2088. group = ${extract{3}{:}{${lookup passwd{$local_part}{$value}}}}
  2089. log_output = true
  2090. current_directory = "/tmp"
  2091. return_fail_output = true
  2092. return_path_add = false
  2093. temp_errors = 64 : 69 : 70: 71 : 72 : 73 : 74 : 75 : 78
  2094.  
  2095.  
  2096.  
  2097. virtual_boxtrapper_userdelivery:
  2098. driver = pipe
  2099. command = /usr/local/cpanel/bin/boxtrapper "${local_part}@${domain}" $home
  2100. user = "${lookup{$domain}lsearch{/etc/userdomains}{$value}}"
  2101. log_output = true
  2102. current_directory = "/tmp"
  2103. return_fail_output = true
  2104. return_path_add = false
  2105. temp_errors = 64 : 69 : 70: 71 : 72 : 73 : 74 : 75 : 78
  2106.  
  2107. dovecot_delivery:
  2108. driver = lmtp
  2109. socket = /var/run/dovecot/lmtp
  2110. batch_max = 200
  2111. rcpt_include_affixes
  2112. delivery_date_add
  2113. envelope_to_add
  2114. return_path_add
  2115.  
  2116. dovecot_virtual_delivery:
  2117. driver = lmtp
  2118. socket = /var/run/dovecot/lmtp
  2119. batch_max = 200
  2120. rcpt_include_affixes
  2121. delivery_date_add
  2122. envelope_to_add
  2123. return_path_add
  2124.  
  2125. address_reply:
  2126. driver = autoreply
  2127.  
  2128.  
  2129.  
  2130. # cPanel Mail Archiving is disabled
  2131.  
  2132.  
  2133.  
  2134.  
  2135.  
  2136.  
  2137.  
  2138.  
  2139.  
  2140. ######################################################################
  2141. # RETRY CONFIGURATION #
  2142. ######################################################################
  2143.  
  2144. # This single retry rule applies to all domains and all errors. It specifies
  2145. # retries every 15 minutes for 2 hours, then increasing retry intervals,
  2146. # starting at 1 hour and increasing each time by a factor of 1.5, up to 16
  2147. # hours, then retries every 8 hours until 4 days have passed since the first
  2148. # failed delivery.
  2149.  
  2150. # Domain Error Retries
  2151. # ------ ----- -------
  2152.  
  2153.  
  2154. begin retry
  2155.  
  2156.  
  2157.  
  2158.  
  2159. * * F,2h,15m; G,16h,1h,1.5; F,4d,8h
  2160.  
  2161.  
  2162.  
  2163.  
  2164. # End of Exim 4 configuration
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!