API tools faq
paste
Advertisement
svxvcer

Untitled

svxvcer
Oct 22nd, 2021
255
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 79.26 KB | None | 0 0
raw download clone embed print report
  1. ######################################################################
  2. # Runtime configuration file for Exim 4 (Debian Packaging) #
  3. ######################################################################
  4.  
  5. ######################################################################
  6. # /etc/exim4/exim4.conf.template is only used with the non-split
  7. # configuration scheme.
  8. # /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs is only used
  9. # with the split configuration scheme.
  10. # If you find this comment anywhere else, somebody copied it there.
  11. # Documentation about the Debian exim4 configuration scheme can be
  12. # found in /usr/share/doc/exim4-base/README.Debian.gz.
  13. ######################################################################
  14.  
  15. ######################################################################
  16. # MAIN CONFIGURATION SETTINGS #
  17. ######################################################################
  18.  
  19. # Just for reference and scripts.
  20. # On Debian systems, the main binary is installed as exim4 to avoid
  21. # conflicts with the exim 3 packages.
  22. exim_path = /usr/sbin/exim4
  23.  
  24. # Macro defining the main configuration directory.
  25. # We do not use absolute paths.
  26. .ifndef CONFDIR
  27. CONFDIR = /etc/exim4
  28. .endif
  29.  
  30. # debconf-driven macro definitions get inserted after this line
  31. UPEX4CmacrosUPEX4C = 1
  32.  
  33. # Create domain and host lists for relay control
  34. # '@' refers to 'the name of the local host'
  35.  
  36. # List of domains considered local for exim. Domains not listed here
  37. # need to be deliverable remotely.
  38. domainlist local_domains = MAIN_LOCAL_DOMAINS
  39.  
  40. # List of recipient domains to relay _to_. Use this list if you're -
  41. # for example - fallback MX or mail gateway for domains.
  42. domainlist relay_to_domains = MAIN_RELAY_TO_DOMAINS
  43.  
  44. # List of sender networks (IP addresses) to _unconditionally_ relay
  45. # _for_. If you intend to be SMTP AUTH server, you do not need to enter
  46. # anything here.
  47. hostlist relay_from_hosts = MAIN_RELAY_NETS
  48.  
  49.  
  50. # Decide which domain to use to add to all unqualified addresses.
  51. # If MAIN_PRIMARY_HOSTNAME_AS_QUALIFY_DOMAIN is defined, the primary
  52. # hostname is used. If not, but MAIN_QUALIFY_DOMAIN is set, the value
  53. # of MAIN_QUALIFY_DOMAIN is used. If both macros are not defined,
  54. # the first line of /etc/mailname is used.
  55. .ifndef MAIN_PRIMARY_HOSTNAME_AS_QUALIFY_DOMAIN
  56. .ifndef MAIN_QUALIFY_DOMAIN
  57. qualify_domain = ETC_MAILNAME
  58. .else
  59. qualify_domain = MAIN_QUALIFY_DOMAIN
  60. .endif
  61. .endif
  62.  
  63. # listen on all all interfaces?
  64. .ifdef MAIN_LOCAL_INTERFACES
  65. local_interfaces = MAIN_LOCAL_INTERFACES
  66. .endif
  67.  
  68. .ifndef LOCAL_DELIVERY
  69. # The default transport, set in /etc/exim4/update-exim4.conf.conf,
  70. # defaulting to mail_spool. See CONFDIR/conf.d/transport/ for possibilities
  71. LOCAL_DELIVERY=mail_spool
  72. .endif
  73.  
  74. # The gecos field in /etc/passwd holds not only the name. see passwd(5).
  75. gecos_pattern = ^([^,:]*)
  76. gecos_name = $1
  77.  
  78. # always log tls_peerdn as we use TLS for outgoing connects by default
  79. .ifndef MAIN_LOG_SELECTOR
  80. MAIN_LOG_SELECTOR = +smtp_protocol_error +smtp_syntax_error +tls_certificate_verified +tls_peerdn
  81. .endif
  82. #####################################################
  83. ### end main/01_exim4-config_listmacrosdefs
  84. #####################################################
  85. #####################################################
  86. ### main/02_exim4-config_options
  87. #####################################################
  88.  
  89. ### main/02_exim4-config_options
  90. #################################
  91.  
  92.  
  93. # Defines the access control list that is run when an
  94. # SMTP MAIL command is received.
  95. #
  96. .ifndef MAIN_ACL_CHECK_MAIL
  97. MAIN_ACL_CHECK_MAIL = acl_check_mail
  98. .endif
  99. acl_smtp_mail = MAIN_ACL_CHECK_MAIL
  100.  
  101.  
  102. # Defines the access control list that is run when an
  103. # SMTP RCPT command is received.
  104. #
  105. .ifndef MAIN_ACL_CHECK_RCPT
  106. MAIN_ACL_CHECK_RCPT = acl_check_rcpt
  107. .endif
  108. acl_smtp_rcpt = MAIN_ACL_CHECK_RCPT
  109.  
  110.  
  111. # Defines the access control list that is run when an
  112. # SMTP DATA command is received.
  113. #
  114. .ifndef MAIN_ACL_CHECK_DATA
  115. MAIN_ACL_CHECK_DATA = acl_check_data
  116. .endif
  117. acl_smtp_data = MAIN_ACL_CHECK_DATA
  118.  
  119.  
  120. # Message size limit. The default (used when MESSAGE_SIZE_LIMIT
  121. # is unset) is 50 MB
  122. .ifdef MESSAGE_SIZE_LIMIT
  123. message_size_limit = MESSAGE_SIZE_LIMIT
  124. .endif
  125.  
  126.  
  127. # If you are running exim4-daemon-heavy or a custom version of Exim that
  128. # was compiled with the content-scanning extension, you can cause incoming
  129. # messages to be automatically scanned for viruses. You have to modify the
  130. # configuration in two places to set this up. The first of them is here,
  131. # where you define the interface to your scanner. This example is typical
  132. # for ClamAV; see the manual for details of what to set for other virus
  133. # scanners. The second modification is in the acl_check_data access
  134. # control list.
  135.  
  136. # av_scanner = clamd:/var/run/clamav/clamd.ctl
  137.  
  138.  
  139. # For spam scanning, there is a similar option that defines the interface to
  140. # SpamAssassin. You do not need to set this if you are using the default, which
  141. # is shown in this commented example. As for virus scanning, you must also
  142. # modify the acl_check_data access control list to enable spam scanning.
  143.  
  144. # spamd_address = 127.0.0.1 783
  145.  
  146. # Domain used to qualify unqualified recipient addresses
  147. # If this option is not set, the qualify_domain value is used.
  148. # qualify_recipient = <value of qualify_domain>
  149.  
  150.  
  151. # Allow Exim to recognize addresses of the form "user@[10.11.12.13]",
  152. # where the domain part is a "domain literal" (an IP address) instead
  153. # of a named domain. The RFCs require this facility, but it is disabled
  154. # in the default config since it is rarely used and frequently abused.
  155. # Domain literal support also needs a special router, which is automatically
  156. # enabled if you use the enable macro MAIN_ALLOW_DOMAIN_LITERALS.
  157. # Additionally, you might want to make your local IP addresses (or @[])
  158. # local domains.
  159. .ifdef MAIN_ALLOW_DOMAIN_LITERALS
  160. allow_domain_literals
  161. .endif
  162.  
  163.  
  164. # Do a reverse DNS lookup on all incoming IP calls, in order to get the
  165. # true host name. If you feel this is too expensive, the networks for
  166. # which a lookup is done can be listed here.
  167. .ifndef DC_minimaldns
  168. .ifndef MAIN_HOST_LOOKUP
  169. MAIN_HOST_LOOKUP = *
  170. .endif
  171. host_lookup = MAIN_HOST_LOOKUP
  172. .endif
  173.  
  174. # The setting below causes Exim to try to initialize the system resolver
  175. # library with DNSSEC support. It has no effect if your library lacks
  176. # DNSSEC support.
  177. dns_dnssec_ok = 1
  178.  
  179. # In a minimaldns setup, update-exim4.conf guesses the hostname and
  180. # dumps it here to avoid DNS lookups being done at Exim run time.
  181. .ifdef MAIN_HARDCODE_PRIMARY_HOSTNAME
  182. primary_hostname = MAIN_HARDCODE_PRIMARY_HOSTNAME
  183. .endif
  184.  
  185. # The settings below cause Exim to make RFC 1413 (ident) callbacks
  186. # for all incoming SMTP calls. You can limit the hosts to which these
  187. # calls are made, and/or change the timeout that is used. If you set
  188. # the timeout to zero, all RFC 1413 calls are disabled. RFC 1413 calls
  189. # are cheap and can provide useful information for tracing problem
  190. # messages, but some hosts and firewalls have problems with them.
  191. # This can result in a timeout instead of an immediate refused
  192. # connection, leading to delays on starting up SMTP sessions.
  193. # (The default was reduced from 30s to 5s for release 4.61. and to
  194. # disabled for release 4.86)
  195. #
  196. #rfc1413_hosts = *
  197. #rfc1413_query_timeout = 5s
  198.  
  199.  
  200. # Enable an efficiency feature. We advertise the feature; clients
  201. # may request to use it. For multi-recipient mails we then can
  202. # reject or accept per-user after the message is received.
  203. #
  204. prdr_enable = true
  205.  
  206. # When using an external relay tester (such as rt.njabl.org and/or the
  207. # currently defunct relay-test.mail-abuse.org, the test may be aborted
  208. # since exim complains about "too many nonmail commands". If you want
  209. # the test to complete, add the host from where "your" relay tester
  210. # connects from to the MAIN_SMTP_ACCEPT_MAX_NOMAIL_HOSTS macro.
  211. # Please note that a non-empty setting may cause extra DNS lookups to
  212. # happen, which is the reason why this option is commented out in the
  213. # default settings.
  214. # MAIN_SMTP_ACCEPT_MAX_NOMAIL_HOSTS = !rt.njabl.org
  215. .ifdef MAIN_SMTP_ACCEPT_MAX_NOMAIL_HOSTS
  216. smtp_accept_max_nonmail_hosts = MAIN_SMTP_ACCEPT_MAX_NOMAIL_HOSTS
  217. .endif
  218.  
  219. # By default, exim forces a Sender: header containing the local
  220. # account name at the local host name in all locally submitted messages
  221. # that don't have the local account name at the local host name in the
  222. # From: header, deletes any Sender: header present in the submitted
  223. # message and forces the envelope sender of all locally submitted
  224. # messages to the local account name at the local host name.
  225. # The following settings allow local users to specify their own envelope sender
  226. # in a locally submitted message. Sender: headers existing in a locally
  227. # submitted message are not removed, and no automatic Sender: headers
  228. # are added. These settings are fine for most hosts.
  229. # If you run exim on a classical multi-user systems where all users
  230. # have local mailboxes that can be reached via SMTP from the Internet
  231. # with the local FQDN as the domain part of the address, you might want
  232. # to disable the following three lines for traceability reasons.
  233. .ifndef MAIN_FORCE_SENDER
  234. local_from_check = false
  235. local_sender_retain = true
  236. untrusted_set_sender = *
  237. .endif
  238.  
  239.  
  240. # By default, Exim expects all envelope addresses to be fully qualified, that
  241. # is, they must contain both a local part and a domain. Configure exim
  242. # to accept unqualified addresses from certain hosts. When this is done,
  243. # unqualified addresses are qualified using the settings of qualify_domain
  244. # and/or qualify_recipient (see above).
  245. # sender_unqualified_hosts = <unset>
  246. # recipient_unqualified_hosts = <unset>
  247.  
  248.  
  249. # Configure Exim to support the "percent hack" for certain domains.
  250. # The "percent hack" is the feature by which mail addressed to x%y@z
  251. # (where z is one of the domains listed) is locally rerouted to x@y
  252. # and sent on. If z is not one of the "percent hack" domains, x%y is
  253. # treated as an ordinary local part. The percent hack is rarely needed
  254. # nowadays but frequently abused. You should not enable it unless you
  255. # are sure that you really need it.
  256. # percent_hack_domains = <unset>
  257.  
  258.  
  259. # Bounce handling
  260. .ifndef MAIN_IGNORE_BOUNCE_ERRORS_AFTER
  261. MAIN_IGNORE_BOUNCE_ERRORS_AFTER = 2d
  262. .endif
  263. ignore_bounce_errors_after = MAIN_IGNORE_BOUNCE_ERRORS_AFTER
  264.  
  265. .ifndef MAIN_TIMEOUT_FROZEN_AFTER
  266. MAIN_TIMEOUT_FROZEN_AFTER = 7d
  267. .endif
  268. timeout_frozen_after = MAIN_TIMEOUT_FROZEN_AFTER
  269.  
  270. .ifndef MAIN_FREEZE_TELL
  271. MAIN_FREEZE_TELL = postmaster
  272. .endif
  273. freeze_tell = MAIN_FREEZE_TELL
  274.  
  275.  
  276. # Define spool directory
  277. .ifndef SPOOLDIR
  278. SPOOLDIR = /var/spool/exim4
  279. .endif
  280. spool_directory = SPOOLDIR
  281.  
  282.  
  283. # trusted users can set envelope-from to arbitrary values
  284. .ifndef MAIN_TRUSTED_USERS
  285. MAIN_TRUSTED_USERS = uucp
  286. .endif
  287. trusted_users = MAIN_TRUSTED_USERS
  288. .ifdef MAIN_TRUSTED_GROUPS
  289. trusted_groups = MAIN_TRUSTED_GROUPS
  290. .endif
  291.  
  292.  
  293. # users in admin group can do many other things
  294. # admin_groups = <unset>
  295.  
  296.  
  297. # SMTP Banner. The example includes the Debian version in the SMTP dialog
  298. # MAIN_SMTP_BANNER = "${primary_hostname} ESMTP Exim ${version_number} (Debian package MAIN_PACKAGE_VERSION) ${tod_full}"
  299. # smtp_banner = $smtp_active_hostname ESMTP Exim $version_number $tod_full
  300.  
  301. .ifdef MAIN_KEEP_ENVIRONMENT
  302. keep_environment = MAIN_KEEP_ENVIRONMENT
  303. .else
  304. # set option to empty value to avoid warning.
  305. keep_environment =
  306. .endif
  307. .ifdef MAIN_ADD_ENVIRONMENT
  308. add_environment = MAIN_ADD_ENVIRONMENT
  309. .endif
  310. #####################################################
  311. ### end main/02_exim4-config_options
  312. #####################################################
  313. #####################################################
  314. ### main/03_exim4-config_tlsoptions
  315. #####################################################
  316.  
  317. ### main/03_exim4-config_tlsoptions
  318. #################################
  319.  
  320. # TLS/SSL configuration for exim as an SMTP server.
  321. # See /usr/share/doc/exim4-base/README.Debian.gz for explanations.
  322.  
  323. .ifdef MAIN_TLS_ENABLE
  324. # Defines what hosts to 'advertise' STARTTLS functionality to. The
  325. # default, *, will advertise to all hosts that connect with EHLO.
  326. .ifndef MAIN_TLS_ADVERTISE_HOSTS
  327. MAIN_TLS_ADVERTISE_HOSTS = *
  328. .endif
  329. tls_advertise_hosts = MAIN_TLS_ADVERTISE_HOSTS
  330.  
  331.  
  332. # Full paths to Certificate and Private Key. The Private Key file
  333. # must be kept 'secret' and should be owned by root.Debian-exim mode
  334. # 640 (-rw-r-----). exim-gencert takes care of these prerequisites.
  335. # Normally, exim4 looks for certificate and key in different files:
  336. # MAIN_TLS_CERTIFICATE - path to certificate file,
  337. # CONFDIR/exim.crt if unset
  338. # MAIN_TLS_PRIVATEKEY - path to private key file
  339. # CONFDIR/exim.key if unset
  340. # You can also configure exim to look for certificate and key in the
  341. # same file, set MAIN_TLS_CERTKEY to that file to enable. This takes
  342. # precedence over all other settings regarding certificate and key file.
  343. .ifdef MAIN_TLS_CERTKEY
  344. tls_certificate = /usr/local/vesta/ssl/mail.crt
  345. .else
  346. .ifndef MAIN_TLS_CERTIFICATE
  347. MAIN_TLS_CERTIFICATE = CONFDIR/exim.crt
  348. .endif
  349. tls_certificate = /usr/local/vesta/ssl/mail.crt
  350.  
  351. .ifndef MAIN_TLS_PRIVATEKEY
  352. MAIN_TLS_PRIVATEKEY = CONFDIR/exim.key
  353. .endif
  354. tls_privatekey = /usr/local/vesta/ssl/mail.key
  355. .endif
  356.  
  357. # Pointer to the CA Certificates against which client certificates are
  358. # checked. This is controlled by the `tls_verify_hosts' and
  359. # `tls_try_verify_hosts' lists below.
  360. # If you want to check server certificates, you need to add an
  361. # tls_verify_certificates statement to the smtp transport.
  362. # /etc/ssl/certs/ca-certificates.crt is generated by
  363. # the "ca-certificates" package's update-ca-certificates(8) command.
  364. .ifndef MAIN_TLS_VERIFY_CERTIFICATES
  365. MAIN_TLS_VERIFY_CERTIFICATES = ${if exists{/etc/ssl/certs/ca-certificates.crt}\
  366. {/etc/ssl/certs/ca-certificates.crt}\
  367. {/dev/null}}
  368. .endif
  369. tls_verify_certificates = MAIN_TLS_VERIFY_CERTIFICATES
  370.  
  371.  
  372. # A list of hosts which are constrained by `tls_verify_certificates'. A host
  373. # that matches `tls_verify_host' must present a certificate that is
  374. # verifyable through `tls_verify_certificates' in order to be accepted as an
  375. # SMTP client. If it does not, the connection is aborted.
  376. .ifdef MAIN_TLS_VERIFY_HOSTS
  377. tls_verify_hosts = MAIN_TLS_VERIFY_HOSTS
  378. .endif
  379.  
  380. # A weaker form of checking: if a client matches `tls_try_verify_hosts' (but
  381. # not `tls_verify_hosts'), request a certificate and check it against
  382. # `tls_verify_certificates' but do not abort the connection if there is no
  383. # certificate or if the certificate presented does not match. (This
  384. # condition can be tested for in ACLs through `verify = certificate')
  385. # By default, this check is done for all hosts. It is known that some
  386. # clients (including incredimail's version downloadable in February
  387. # 2008) choke on this. To disable, set MAIN_TLS_TRY_VERIFY_HOSTS to an
  388. # empty value.
  389. .ifdef MAIN_TLS_TRY_VERIFY_HOSTS
  390. tls_try_verify_hosts = MAIN_TLS_TRY_VERIFY_HOSTS
  391. .endif
  392.  
  393. .ifdef _HAVE_GNUTLS
  394. tls_dhparam = historic
  395. .endif
  396.  
  397. .else
  398. # Don't advertise TLS if MAIN_TLS_ENABLE is not set.
  399. tls_advertise_hosts =
  400. .endif
  401. #####################################################
  402. ### end main/03_exim4-config_tlsoptions
  403. #####################################################
  404. #####################################################
  405. ### main/90_exim4-config_log_selector
  406. #####################################################
  407.  
  408. ### main/90_exim4-config_log_selector
  409. #################################
  410.  
  411. # uncomment this for debugging
  412. # MAIN_LOG_SELECTOR == MAIN_LOG_SELECTOR +all -subject -arguments
  413.  
  414. .ifdef MAIN_LOG_SELECTOR
  415. log_selector = MAIN_LOG_SELECTOR
  416. .endif
  417. #####################################################
  418. ### end main/90_exim4-config_log_selector
  419. #####################################################
  420. #####################################################
  421. ### acl/00_exim4-config_header
  422. #####################################################
  423.  
  424. ######################################################################
  425. # ACL CONFIGURATION #
  426. # Specifies access control lists for incoming SMTP mail #
  427. ######################################################################
  428. begin acl
  429.  
  430.  
  431. #####################################################
  432. ### end acl/00_exim4-config_header
  433. #####################################################
  434. #####################################################
  435. ### acl/20_exim4-config_local_deny_exceptions
  436. #####################################################
  437.  
  438. ### acl/20_exim4-config_local_deny_exceptions
  439. #################################
  440.  
  441. # This is used to determine whitelisted senders and hosts.
  442. # It checks for CONFDIR/host_local_deny_exceptions and
  443. # CONFDIR/sender_local_deny_exceptions.
  444. #
  445. # It is meant to be used from some other acl entry.
  446. #
  447. # See exim4-config_files(5) for details.
  448. #
  449. # If the files do not exist, the white list never matches, which is
  450. # the desired behaviour.
  451. #
  452. # The old file names CONFDIR/local_host_whitelist and
  453. # CONFDIR/local_sender_whitelist will continue to be honored for a
  454. # transition period. Their use is deprecated.
  455.  
  456. acl_local_deny_exceptions:
  457. accept
  458. hosts = ${if exists{CONFDIR/host_local_deny_exceptions}\
  459. {CONFDIR/host_local_deny_exceptions}\
  460. {}}
  461. accept
  462. senders = ${if exists{CONFDIR/sender_local_deny_exceptions}\
  463. {CONFDIR/sender_local_deny_exceptions}\
  464. {}}
  465. accept
  466. hosts = ${if exists{CONFDIR/local_host_whitelist}\
  467. {CONFDIR/local_host_whitelist}\
  468. {}}
  469. accept
  470. senders = ${if exists{CONFDIR/local_sender_whitelist}\
  471. {CONFDIR/local_sender_whitelist}\
  472. {}}
  473.  
  474. # This hook allows you to hook in your own ACLs without having to
  475. # modify this file. If you do it like we suggest, you'll end up with
  476. # a small performance penalty since there is an additional file being
  477. # accessed. This doesn't happen if you leave the macro unset.
  478. .ifdef LOCAL_DENY_EXCEPTIONS_LOCAL_ACL_FILE
  479. .include LOCAL_DENY_EXCEPTIONS_LOCAL_ACL_FILE
  480. .endif
  481.  
  482. # this is still supported for a transition period and is deprecated.
  483. .ifdef WHITELIST_LOCAL_DENY_LOCAL_ACL_FILE
  484. .include WHITELIST_LOCAL_DENY_LOCAL_ACL_FILE
  485. .endif
  486. #####################################################
  487. ### end acl/20_exim4-config_local_deny_exceptions
  488. #####################################################
  489. #####################################################
  490. ### acl/30_exim4-config_check_mail
  491. #####################################################
  492.  
  493. ### acl/30_exim4-config_check_mail
  494. #################################
  495.  
  496. # This access control list is used for every MAIL command in an incoming
  497. # SMTP message. The tests are run in order until the address is either
  498. # accepted or denied.
  499. #
  500. acl_check_mail:
  501.  
  502. accept
  503. #####################################################
  504. ### end acl/30_exim4-config_check_mail
  505. #####################################################
  506. #####################################################
  507. ### acl/30_exim4-config_check_rcpt
  508. #####################################################
  509.  
  510. ### acl/30_exim4-config_check_rcpt
  511. #################################
  512.  
  513. # define macros to be used below in this file to check recipient
  514. # local parts for strange characters. Documentation below.
  515. # This blocks local parts that begin with a dot or contain a quite
  516. # broad range of non-alphanumeric characters.
  517.  
  518. .ifndef CHECK_RCPT_LOCAL_LOCALPARTS
  519. CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] : ^.*[@%!/|`#&?]
  520. .endif
  521.  
  522. .ifndef CHECK_RCPT_REMOTE_LOCALPARTS
  523. CHECK_RCPT_REMOTE_LOCALPARTS = ^[./|] : ^.*[@%!`#&?] : ^.*/\\.\\./
  524. .endif
  525.  
  526. # This access control list is used for every RCPT command in an incoming
  527. # SMTP message. The tests are run in order until the address is either
  528. # accepted or denied.
  529. #
  530. acl_check_rcpt:
  531.  
  532. # Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
  533. # testing for an empty sending host field.
  534. accept
  535. hosts = :
  536. control = dkim_disable_verify
  537.  
  538. # Do not try to verify DKIM signatures of incoming mail if DC_minimaldns
  539. # or DISABLE_DKIM_VERIFY are set.
  540. .ifdef DC_minimaldns
  541. warn
  542. control = dkim_disable_verify
  543. .else
  544. .ifdef DISABLE_DKIM_VERIFY
  545. warn
  546. control = dkim_disable_verify
  547. .endif
  548. .endif
  549.  
  550. # The following section of the ACL is concerned with local parts that contain
  551. # certain non-alphanumeric characters. Dots in unusual places are
  552. # handled by this ACL as well.
  553. #
  554. # Non-alphanumeric characters other than dots are rarely found in genuine
  555. # local parts, but are often tried by people looking to circumvent
  556. # relaying restrictions. Therefore, although they are valid in local
  557. # parts, these rules disallow certain non-alphanumeric characters, as
  558. # a precaution.
  559. #
  560. # Empty components (two dots in a row) are not valid in RFC 2822, but Exim
  561. # allows them because they have been encountered. (Consider local parts
  562. # constructed as "firstinitial.secondinitial.familyname" when applied to
  563. # a name without a second initial.) However, a local part starting
  564. # with a dot or containing /../ can cause trouble if it is used as part of a
  565. # file name (e.g. for a mailing list). This is also true for local parts that
  566. # contain slashes. A pipe symbol can also be troublesome if the local part is
  567. # incorporated unthinkingly into a shell command line.
  568. #
  569. # These ACL components will block recipient addresses that are valid
  570. # from an RFC5322 point of view. We chose to have them blocked by
  571. # default for security reasons.
  572. #
  573. # If you feel that your site should have less strict recipient
  574. # checking, please feel free to change the default values of the macros
  575. # defined in main/01_exim4-config_listmacrosdefs or override them from a
  576. # local configuration file.
  577. #
  578. # Two different rules are used. The first one has a quite strict
  579. # default, and is applied to messages that are addressed to one of the
  580. # local domains handled by this host.
  581.  
  582. # The default value of CHECK_RCPT_LOCAL_LOCALPARTS is defined
  583. # at the top of this file.
  584. .ifdef CHECK_RCPT_LOCAL_LOCALPARTS
  585. deny
  586. domains = +local_domains
  587. local_parts = CHECK_RCPT_LOCAL_LOCALPARTS
  588. message = restricted characters in address
  589. .endif
  590.  
  591.  
  592. # The second rule applies to all other domains, and its default is
  593. # considerably less strict.
  594.  
  595. # The default value of CHECK_RCPT_REMOTE_LOCALPARTS is defined in
  596. # main/01_exim4-config_listmacrosdefs:
  597. # CHECK_RCPT_REMOTE_LOCALPARTS = ^[./|] : ^.*[@%!`#&?] : ^.*/\\.\\./
  598.  
  599. # It allows local users to send outgoing messages to sites
  600. # that use slashes and vertical bars in their local parts. It blocks
  601. # local parts that begin with a dot, slash, or vertical bar, but allows
  602. # these characters within the local part. However, the sequence /../ is
  603. # barred. The use of some other non-alphanumeric characters is blocked.
  604. # Single quotes might probably be dangerous as well, but they're
  605. # allowed by the default regexps to avoid rejecting mails to Ireland.
  606. # The motivation here is to prevent local users (or local users' malware)
  607. # from mounting certain kinds of attack on remote sites.
  608. .ifdef CHECK_RCPT_REMOTE_LOCALPARTS
  609. deny
  610. domains = !+local_domains
  611. local_parts = CHECK_RCPT_REMOTE_LOCALPARTS
  612. message = restricted characters in address
  613. .endif
  614.  
  615.  
  616. # Accept mail to postmaster in any local domain, regardless of the source,
  617. # and without verifying the sender.
  618. #
  619. accept
  620. .ifndef CHECK_RCPT_POSTMASTER
  621. local_parts = postmaster
  622. .else
  623. local_parts = CHECK_RCPT_POSTMASTER
  624. .endif
  625. domains = +local_domains : +relay_to_domains
  626.  
  627.  
  628. # Deny unless the sender address can be verified.
  629. #
  630. # This is disabled by default so that DNSless systems don't break. If
  631. # your system can do DNS lookups without delay or cost, you might want
  632. # to enable this feature.
  633. #
  634. # This feature does not work in smarthost and satellite setups as
  635. # with these setups all domains pass verification. See spec.txt section
  636. # "Access control lists" subsection "Address verification" with the added
  637. # information that a smarthost/satellite setup routes all non-local e-mail
  638. # to the smarthost.
  639. .ifdef CHECK_RCPT_VERIFY_SENDER
  640. deny
  641. message = Sender verification failed
  642. !acl = acl_local_deny_exceptions
  643. !verify = sender
  644. .endif
  645.  
  646. # Verify senders listed in local_sender_callout with a callout.
  647. #
  648. # In smarthost and satellite setups, this causes the callout to be
  649. # done to the smarthost. Verification will thus only be reliable if the
  650. # smarthost does reject illegal addresses in the SMTP dialog.
  651. deny
  652. !acl = acl_local_deny_exceptions
  653. senders = ${if exists{CONFDIR/local_sender_callout}\
  654. {CONFDIR/local_sender_callout}\
  655. {}}
  656. !verify = sender/callout
  657.  
  658.  
  659. # Accept if the message comes from one of the hosts for which we are an
  660. # outgoing relay. It is assumed that such hosts are most likely to be MUAs,
  661. # so we set control=submission to make Exim treat the message as a
  662. # submission. It will fix up various errors in the message, for example, the
  663. # lack of a Date: header line. If you are actually relaying out out from
  664. # MTAs, you may want to disable this. If you are handling both relaying from
  665. # MTAs and submissions from MUAs you should probably split them into two
  666. # lists, and handle them differently.
  667.  
  668. # Recipient verification is omitted here, because in many cases the clients
  669. # are dumb MUAs that don't cope well with SMTP error responses. If you are
  670. # actually relaying out from MTAs, you should probably add recipient
  671. # verification here.
  672.  
  673. # Note that, by putting this test before any DNS black list checks, you will
  674. # always accept from these hosts, even if they end up on a black list. The
  675. # assumption is that they are your friends, and if they get onto black
  676. # list, it is a mistake.
  677. accept
  678. hosts = +relay_from_hosts
  679. control = submission/sender_retain
  680. control = dkim_disable_verify
  681.  
  682.  
  683. # Accept if the message arrived over an authenticated connection, from
  684. # any host. Again, these messages are usually from MUAs, so recipient
  685. # verification is omitted, and submission mode is set. And again, we do this
  686. # check before any black list tests.
  687. accept
  688. authenticated = *
  689. control = submission/sender_retain
  690. control = dkim_disable_verify
  691.  
  692. # Insist that a HELO/EHLO was accepted.
  693.  
  694. require message = nice hosts say HELO first
  695. condition = ${if def:sender_helo_name}
  696.  
  697. # Insist that any other recipient address that we accept is either in one of
  698. # our local domains, or is in a domain for which we explicitly allow
  699. # relaying. Any other domain is rejected as being unacceptable for relaying.
  700. require
  701. message = relay not permitted
  702. domains = +local_domains : +relay_to_domains
  703.  
  704.  
  705. # We also require all accepted addresses to be verifiable. This check will
  706. # do local part verification for local domains, but only check the domain
  707. # for remote domains.
  708. require
  709. verify = recipient
  710.  
  711.  
  712. # Verify recipients listed in local_rcpt_callout with a callout.
  713. # This is especially handy for forwarding MX hosts (secondary MX or
  714. # mail hubs) of domains that receive a lot of spam to non-existent
  715. # addresses. The only way to check local parts for remote relay
  716. # domains is to use a callout (add /callout), but please read the
  717. # documentation about callouts before doing this.
  718. deny
  719. !acl = acl_local_deny_exceptions
  720. recipients = ${if exists{CONFDIR/local_rcpt_callout}\
  721. {CONFDIR/local_rcpt_callout}\
  722. {}}
  723. !verify = recipient/callout
  724.  
  725.  
  726. # CONFDIR/local_sender_blacklist holds a list of envelope senders that
  727. # should have their access denied to the local host. Incoming messages
  728. # with one of these senders are rejected at RCPT time.
  729. #
  730. # The explicit white lists are honored as well as negative items in
  731. # the black list. See exim4-config_files(5) for details.
  732. deny
  733. message = sender envelope address $sender_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
  734. log_message = sender envelope address is locally blacklisted.
  735. !acl = acl_local_deny_exceptions
  736. senders = ${if exists{CONFDIR/local_sender_blacklist}\
  737. {CONFDIR/local_sender_blacklist}\
  738. {}}
  739.  
  740.  
  741. # deny bad sites (IP address)
  742. # CONFDIR/local_host_blacklist holds a list of host names, IP addresses
  743. # and networks (CIDR notation) that should have their access denied to
  744. # The local host. Messages coming in from a listed host will have all
  745. # RCPT statements rejected.
  746. #
  747. # The explicit white lists are honored as well as negative items in
  748. # the black list. See exim4-config_files(5) for details.
  749. deny
  750. message = sender IP address $sender_host_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
  751. log_message = sender IP address is locally blacklisted.
  752. !acl = acl_local_deny_exceptions
  753. hosts = ${if exists{CONFDIR/local_host_blacklist}\
  754. {CONFDIR/local_host_blacklist}\
  755. {}}
  756.  
  757.  
  758. # Warn if the sender host does not have valid reverse DNS.
  759. #
  760. # If your system can do DNS lookups without delay or cost, you might want
  761. # to enable this.
  762. # If sender_host_address is defined, it's a remote call. If
  763. # sender_host_name is not defined, then reverse lookup failed. Use
  764. # this instead of !verify = reverse_host_lookup to catch deferrals
  765. # as well as outright failures.
  766. .ifdef CHECK_RCPT_REVERSE_DNS
  767. warn
  768. condition = ${if and{{def:sender_host_address}{!def:sender_host_name}}\
  769. {yes}{no}}
  770. add_header = X-Host-Lookup-Failed: Reverse DNS lookup failed for $sender_host_address (${if eq{$host_lookup_failed}{1}{failed}{deferred}})
  771. .endif
  772.  
  773.  
  774. # Use spfquery to perform a pair of SPF checks (for details, see
  775. # http://www.openspf.org/)
  776. #
  777. # This is quite costly in terms of DNS lookups (~6 lookups per mail). Do not
  778. # enable if that's an issue. Also note that if you enable this, you must
  779. # install "spf-tools-perl" which provides the spfquery command.
  780. # Missing spf-tools-perl will trigger the "Unexpected error in
  781. # SPF check" warning.
  782. .ifdef CHECK_RCPT_SPF
  783. deny
  784. message = [SPF] $sender_host_address is not allowed to send mail from \
  785. ${if def:sender_address_domain {$sender_address_domain}{$sender_helo_name}}. \
  786. Please see \
  787. http://www.openspf.org/Why?scope=${if def:sender_address_domain \
  788. {mfrom}{helo}};identity=${if def:sender_address_domain \
  789. {$sender_address}{$sender_helo_name}};ip=$sender_host_address
  790. log_message = SPF check failed.
  791. !acl = acl_local_deny_exceptions
  792. condition = ${run{/usr/bin/spfquery.mail-spf-perl --ip \
  793. ${quote:$sender_host_address} --identity \
  794. ${if def:sender_address_domain \
  795. {--scope mfrom --identity ${quote:$sender_address}}\
  796. {--scope helo --identity ${quote:$sender_helo_name}}}}\
  797. {no}{${if eq {$runrc}{1}{yes}{no}}}}
  798.  
  799. defer
  800. message = Temporary DNS error while checking SPF record. Try again later.
  801. !acl = acl_local_deny_exceptions
  802. condition = ${if eq {$runrc}{5}{yes}{no}}
  803.  
  804. warn
  805. condition = ${if <={$runrc}{6}{yes}{no}}
  806. add_header = Received-SPF: ${if eq {$runrc}{0}{pass}\
  807. {${if eq {$runrc}{2}{softfail}\
  808. {${if eq {$runrc}{3}{neutral}\
  809. {${if eq {$runrc}{4}{permerror}\
  810. {${if eq {$runrc}{6}{none}{error}}}}}}}}}\
  811. } client-ip=$sender_host_address; \
  812. ${if def:sender_address_domain \
  813. {envelope-from=${sender_address}; }{}}\
  814. helo=$sender_helo_name
  815.  
  816. warn
  817. log_message = Unexpected error in SPF check.
  818. condition = ${if >{$runrc}{6}{yes}{no}}
  819. .endif
  820.  
  821.  
  822. # Check against classic DNS "black" lists (DNSBLs) which list
  823. # sender IP addresses
  824. .ifdef CHECK_RCPT_IP_DNSBLS
  825. warn
  826. dnslists = CHECK_RCPT_IP_DNSBLS
  827. add_header = X-Warning: $sender_host_address is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
  828. log_message = $sender_host_address is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
  829. .endif
  830.  
  831.  
  832. # Check against DNSBLs which list sender domains, with an option to locally
  833. # whitelist certain domains that might be blacklisted.
  834. #
  835. # Note: If you define CHECK_RCPT_DOMAIN_DNSBLS, you must append
  836. # "/$sender_address_domain" after each domain. For example:
  837. # CHECK_RCPT_DOMAIN_DNSBLS = rhsbl.foo.org/$sender_address_domain \
  838. # : rhsbl.bar.org/$sender_address_domain
  839. .ifdef CHECK_RCPT_DOMAIN_DNSBLS
  840. warn
  841. !senders = ${if exists{CONFDIR/local_domain_dnsbl_whitelist}\
  842. {CONFDIR/local_domain_dnsbl_whitelist}\
  843. {}}
  844. dnslists = CHECK_RCPT_DOMAIN_DNSBLS
  845. add_header = X-Warning: $sender_address_domain is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
  846. log_message = $sender_address_domain is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
  847. .endif
  848.  
  849.  
  850. # This hook allows you to hook in your own ACLs without having to
  851. # modify this file. If you do it like we suggest, you'll end up with
  852. # a small performance penalty since there is an additional file being
  853. # accessed. This doesn't happen if you leave the macro unset.
  854. .ifdef CHECK_RCPT_LOCAL_ACL_FILE
  855. .include CHECK_RCPT_LOCAL_ACL_FILE
  856. .endif
  857.  
  858.  
  859. #############################################################################
  860. # This check is commented out because it is recognized that not every
  861. # sysadmin will want to do it. If you enable it, the check performs
  862. # Client SMTP Authorization (csa) checks on the sending host. These checks
  863. # do DNS lookups for SRV records. The CSA proposal is currently (May 2005)
  864. # an Internet draft. You can, of course, add additional conditions to this
  865. # ACL statement to restrict the CSA checks to certain hosts only.
  866. #
  867. # require verify = csa
  868. #############################################################################
  869.  
  870.  
  871. # Accept if the address is in a domain for which we are an incoming relay,
  872. # but again, only if the recipient can be verified.
  873.  
  874. accept
  875. domains = +relay_to_domains
  876. endpass
  877. verify = recipient
  878.  
  879.  
  880. # At this point, the address has passed all the checks that have been
  881. # configured, so we accept it unconditionally.
  882.  
  883. accept
  884. #####################################################
  885. ### end acl/30_exim4-config_check_rcpt
  886. #####################################################
  887. #####################################################
  888. ### acl/40_exim4-config_check_data
  889. #####################################################
  890.  
  891. ### acl/40_exim4-config_check_data
  892. #################################
  893.  
  894. # This ACL is used after the contents of a message have been received. This
  895. # is the ACL in which you can test a message's headers or body, and in
  896. # particular, this is where you can invoke external virus or spam scanners.
  897.  
  898. acl_check_data:
  899.  
  900. # Deny if the message contains an overlong line. Per the standards
  901. # we should never receive one such via SMTP.
  902. #
  903. .ifndef IGNORE_SMTP_LINE_LENGTH_LIMIT
  904. deny message = maximum allowed line length is 998 octets, \
  905. got $max_received_linelength
  906. condition = ${if > {$max_received_linelength}{998}}
  907. .endif
  908.  
  909. # Deny if the headers contain badly-formed addresses.
  910. #
  911. .ifndef NO_CHECK_DATA_VERIFY_HEADER_SYNTAX
  912. deny
  913. !acl = acl_local_deny_exceptions
  914. !verify = header_syntax
  915. message = header syntax
  916. log_message = header syntax ($acl_verify_message)
  917. .endif
  918.  
  919.  
  920. # require that there is a verifiable sender address in at least
  921. # one of the "Sender:", "Reply-To:", or "From:" header lines.
  922. .ifdef CHECK_DATA_VERIFY_HEADER_SENDER
  923. deny
  924. message = No verifiable sender address in message headers
  925. !acl = acl_local_deny_exceptions
  926. !verify = header_sender
  927. .endif
  928.  
  929.  
  930. # Deny if the message contains malware. Before enabling this check, you
  931. # must install a virus scanner and set the av_scanner option in the
  932. # main configuration.
  933. #
  934. # exim4-daemon-heavy must be used for this section to work.
  935. #
  936. # deny
  937. # malware = *
  938. # message = This message was detected as possible malware ($malware_name).
  939.  
  940.  
  941. # Add headers to a message if it is judged to be spam. Before enabling this,
  942. # you must install SpamAssassin. You may also need to set the spamd_address
  943. # option in the main configuration.
  944. #
  945. # exim4-daemon-heavy must be used for this section to work.
  946. #
  947. # Please note that this is only suiteable as an example. See
  948. # /usr/share/doc/exim4-base/README.Debian.gz
  949. #
  950. # See the exim docs and the exim wiki for more suitable examples.
  951. #
  952. # # Remove internal headers
  953. # warn
  954. # remove_header = X-Spam_score: X-Spam_score_int : X-Spam_bar : \
  955. # X-Spam_report
  956. #
  957. # warn
  958. # condition = ${if <{$message_size}{120k}{1}{0}}
  959. # # ":true" to add headers/acl variables even if not spam
  960. # spam = nobody:true
  961. # add_header = X-Spam_score: $spam_score
  962. # add_header = X-Spam_bar: $spam_bar
  963. # # Do not enable this unless you have shorted SpamAssassin's report
  964. # #add_header = X-Spam_report: $spam_report
  965. #
  966. # Reject spam messages (score >15.0).
  967. # This breaks mailing list and forward messages.
  968. # deny
  969. # message = Classified as spam (score $spam_score)
  970. # condition = ${if <{$message_size}{120k}{1}{0}}
  971. # condition = ${if >{$spam_score_int}{150}{true}{false}}
  972.  
  973.  
  974. # This hook allows you to hook in your own ACLs without having to
  975. # modify this file. If you do it like we suggest, you'll end up with
  976. # a small performance penalty since there is an additional file being
  977. # accessed. This doesn't happen if you leave the macro unset.
  978. .ifdef CHECK_DATA_LOCAL_ACL_FILE
  979. .include CHECK_DATA_LOCAL_ACL_FILE
  980. .endif
  981.  
  982.  
  983. # accept otherwise
  984. accept
  985. #####################################################
  986. ### end acl/40_exim4-config_check_data
  987. #####################################################
  988. #####################################################
  989. ### router/00_exim4-config_header
  990. #####################################################
  991.  
  992. ######################################################################
  993. # ROUTERS CONFIGURATION #
  994. # Specifies how addresses are handled #
  995. ######################################################################
  996. # THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT! #
  997. # An address is passed to each router in turn until it is accepted. #
  998. ######################################################################
  999.  
  1000. begin routers
  1001.  
  1002. #####################################################
  1003. ### end router/00_exim4-config_header
  1004. #####################################################
  1005. #####################################################
  1006. ### router/100_exim4-config_domain_literal
  1007. #####################################################
  1008.  
  1009. ### router/100_exim4-config_domain_literal
  1010. #################################
  1011.  
  1012. # This router handles e-mail addresses in "domain literal" form like
  1013. # <user@[10.11.12.13]>. The RFCs require this facility, but it is disabled
  1014. # in the default config since it is rarely used and frequently abused.
  1015. # Domain literal support also needs to be enabled in the main config,
  1016. # which is automatically done if you use the enable macro
  1017. # MAIN_ALLOW_DOMAIN_LITERALS.
  1018.  
  1019. .ifdef MAIN_ALLOW_DOMAIN_LITERALS
  1020. domain_literal:
  1021. debug_print = "R: domain_literal for $local_part@$domain"
  1022. driver = ipliteral
  1023. domains = ! +local_domains
  1024. transport = remote_smtp
  1025. .endif
  1026. #####################################################
  1027. ### end router/100_exim4-config_domain_literal
  1028. #####################################################
  1029. #####################################################
  1030. ### router/150_exim4-config_hubbed_hosts
  1031. #####################################################
  1032.  
  1033. # router/150_exim4-config_hubbed_hosts
  1034. #################################
  1035.  
  1036. # route specific domains manually.
  1037. #
  1038. # see exim4-config_files(5) and spec.txt chapter 20.3 through 20.7 for
  1039. # more detailed documentation.
  1040.  
  1041. hubbed_hosts:
  1042. debug_print = "R: hubbed_hosts for $domain"
  1043. driver = manualroute
  1044. domains = "${if exists{CONFDIR/hubbed_hosts}\
  1045. {partial-lsearch;CONFDIR/hubbed_hosts}\
  1046. fail}"
  1047. same_domain_copy_routing = yes
  1048. route_data = ${lookup{$domain}partial-lsearch{CONFDIR/hubbed_hosts}}
  1049. transport = remote_smtp
  1050. #####################################################
  1051. ### end router/150_exim4-config_hubbed_hosts
  1052. #####################################################
  1053. #####################################################
  1054. ### router/200_exim4-config_primary
  1055. #####################################################
  1056.  
  1057. ### router/200_exim4-config_primary
  1058. #################################
  1059. # This file holds the primary router, responsible for nonlocal mails
  1060.  
  1061. .ifdef DCconfig_internet
  1062. # configtype=internet
  1063. #
  1064. # deliver mail to the recipient if recipient domain is a domain we
  1065. # relay for. We do not ignore any target hosts here since delivering to
  1066. # a site local or even a link local address might be wanted here, and if
  1067. # such an address has found its way into the MX record of such a domain,
  1068. # the local admin is probably in a place where that broken MX record
  1069. # could be fixed.
  1070.  
  1071. dnslookup_relay_to_domains:
  1072. debug_print = "R: dnslookup_relay_to_domains for $local_part@$domain"
  1073. driver = dnslookup
  1074. domains = ! +local_domains : +relay_to_domains
  1075. transport = remote_smtp
  1076. same_domain_copy_routing = yes
  1077. dnssec_request_domains = *
  1078. no_more
  1079.  
  1080. # deliver mail directly to the recipient. This router is only reached
  1081. # for domains that we do not relay for. Since we most probably can't
  1082. # have broken MX records pointing to site local or link local IP
  1083. # addresses fixed, we ignore target hosts pointing to these addresses.
  1084.  
  1085. dnslookup:
  1086. debug_print = "R: dnslookup for $local_part@$domain"
  1087. driver = dnslookup
  1088. domains = ! +local_domains
  1089. transport = remote_smtp
  1090. same_domain_copy_routing = yes
  1091. # ignore private rfc1918 and APIPA addresses
  1092. ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8 : 192.168.0.0/16 :\
  1093. 172.16.0.0/12 : 10.0.0.0/8 : 169.254.0.0/16 :\
  1094. 255.255.255.255
  1095. dnssec_request_domains = *
  1096. no_more
  1097.  
  1098. .endif
  1099.  
  1100.  
  1101. .ifdef DCconfig_local
  1102. # configtype=local
  1103. #
  1104. # Stand-alone system, so generate an error for mail to a non-local domain
  1105. nonlocal:
  1106. debug_print = "R: nonlocal for $local_part@$domain"
  1107. driver = redirect
  1108. domains = ! +local_domains
  1109. allow_fail
  1110. data = :fail: Mailing to remote domains not supported
  1111. no_more
  1112.  
  1113. .endif
  1114.  
  1115.  
  1116. .ifdef DCconfig_smarthost DCconfig_satellite
  1117. # configtype=smarthost or configtype=satellite
  1118. #
  1119. # Send all non-local mail to a single other machine (smarthost).
  1120. #
  1121. # This means _ALL_ non-local mail goes to the smarthost. This will most
  1122. # probably not do what you want for domains that are listed in
  1123. # relay_domains. The most typical use for relay_domains is to control
  1124. # relaying for incoming e-mail on secondary MX hosts. In that case,
  1125. # it doesn't make sense to send the mail to the smarthost since the
  1126. # smarthost will probably send the message right back here, causing a
  1127. # loop.
  1128. #
  1129. # If you want to use a smarthost while being secondary MX for some
  1130. # domains, you'll need to copy the dnslookup_relay_to_domains router
  1131. # here so that mail to relay_domains is handled separately.
  1132.  
  1133. smarthost:
  1134. debug_print = "R: smarthost for $local_part@$domain"
  1135. driver = manualroute
  1136. domains = ! +local_domains
  1137. transport = remote_smtp_smarthost
  1138. route_list = * DCsmarthost byname
  1139. host_find_failed = ignore
  1140. same_domain_copy_routing = yes
  1141. no_more
  1142.  
  1143. .endif
  1144.  
  1145.  
  1146. # The "no_more" above means that all later routers are for
  1147. # domains in the local_domains list, i.e. just like Exim 3 directors.
  1148. #####################################################
  1149. ### end router/200_exim4-config_primary
  1150. #####################################################
  1151. #####################################################
  1152. ### router/300_exim4-config_real_local
  1153. #####################################################
  1154.  
  1155. ### router/300_exim4-config_real_local
  1156. #################################
  1157.  
  1158. # This router allows reaching a local user while avoiding local
  1159. # processing. This can be used to inform a user of a broken .forward
  1160. # file, for example. The userforward router does this.
  1161.  
  1162. COND_LOCAL_SUBMITTER = "\
  1163. ${if match_ip{$sender_host_address}{:@[]}\
  1164. {1}{0}\
  1165. }"
  1166.  
  1167. real_local:
  1168. debug_print = "R: real_local for $local_part@$domain"
  1169. driver = accept
  1170. domains = +local_domains
  1171. condition = COND_LOCAL_SUBMITTER
  1172. local_part_prefix = real-
  1173. check_local_user
  1174. transport = LOCAL_DELIVERY
  1175.  
  1176. #####################################################
  1177. ### end router/300_exim4-config_real_local
  1178. #####################################################
  1179. #####################################################
  1180. ### router/400_exim4-config_system_aliases
  1181. #####################################################
  1182.  
  1183. ### router/400_exim4-config_system_aliases
  1184. #################################
  1185.  
  1186. # This router handles aliasing using a traditional /etc/aliases file.
  1187. #
  1188. ##### NB You must ensure that /etc/aliases exists. It used to be the case
  1189. ##### NB that every Unix had that file, because it was the Sendmail default.
  1190. ##### NB These days, there are systems that don't have it. Your aliases
  1191. ##### NB file should at least contain an alias for "postmaster".
  1192. #
  1193. # This router handles the local part in a case-insensitive way which
  1194. # satisfies the RFCs requirement that postmaster be reachable regardless
  1195. # of case. If you decide to handle /etc/aliases in a caseful way, you
  1196. # need to make arrangements for a caseless postmaster.
  1197. #
  1198. # Delivery to arbitrary directories, files, and piping to programs in
  1199. # /etc/aliases is disabled per default.
  1200. # If that is a problem for you, see
  1201. # /usr/share/doc/exim4-base/README.Debian.gz
  1202. # for explanation and some workarounds.
  1203.  
  1204. system_aliases:
  1205. debug_print = "R: system_aliases for $local_part@$domain"
  1206. driver = redirect
  1207. domains = +local_domains
  1208. allow_fail
  1209. allow_defer
  1210. data = ${lookup{$local_part}lsearch{/etc/aliases}}
  1211. .ifdef SYSTEM_ALIASES_USER
  1212. user = SYSTEM_ALIASES_USER
  1213. .endif
  1214. .ifdef SYSTEM_ALIASES_GROUP
  1215. group = SYSTEM_ALIASES_GROUP
  1216. .endif
  1217. .ifdef SYSTEM_ALIASES_FILE_TRANSPORT
  1218. file_transport = SYSTEM_ALIASES_FILE_TRANSPORT
  1219. .endif
  1220. .ifdef SYSTEM_ALIASES_PIPE_TRANSPORT
  1221. pipe_transport = SYSTEM_ALIASES_PIPE_TRANSPORT
  1222. .endif
  1223. .ifdef SYSTEM_ALIASES_DIRECTORY_TRANSPORT
  1224. directory_transport = SYSTEM_ALIASES_DIRECTORY_TRANSPORT
  1225. .endif
  1226. #####################################################
  1227. ### end router/400_exim4-config_system_aliases
  1228. #####################################################
  1229. #####################################################
  1230. ### router/500_exim4-config_hubuser
  1231. #####################################################
  1232.  
  1233. ### router/500_exim4-config_hubuser
  1234. #################################
  1235.  
  1236. .ifdef DCconfig_satellite
  1237. # This router is only used for configtype=satellite.
  1238. # It takes care to route all mail targeted to <somelocaluser@this.machine>
  1239. # to the host where we read our mail
  1240. #
  1241. hub_user:
  1242. debug_print = "R: hub_user for $local_part@$domain"
  1243. driver = redirect
  1244. domains = +local_domains
  1245. data = ${local_part}@DCreadhost
  1246. check_local_user
  1247.  
  1248. # Grab the redirected mail and deliver it.
  1249. # This is a duplicate of the smarthost router, needed because
  1250. # DCreadhost might end up as part of +local_domains
  1251. hub_user_smarthost:
  1252. debug_print = "R: hub_user_smarthost for $local_part@$domain"
  1253. driver = manualroute
  1254. domains = DCreadhost
  1255. transport = remote_smtp_smarthost
  1256. route_list = * DCsmarthost byname
  1257. host_find_failed = ignore
  1258. same_domain_copy_routing = yes
  1259. check_local_user
  1260. .endif
  1261.  
  1262.  
  1263. #####################################################
  1264. ### end router/500_exim4-config_hubuser
  1265. #####################################################
  1266. #####################################################
  1267. ### router/600_exim4-config_userforward
  1268. #####################################################
  1269.  
  1270. ### router/600_exim4-config_userforward
  1271. #################################
  1272.  
  1273. # This router handles forwarding using traditional .forward files in users'
  1274. # home directories. It also allows mail filtering with a forward file
  1275. # starting with the string "# Exim filter" or "# Sieve filter".
  1276. #
  1277. # The no_verify setting means that this router is skipped when Exim is
  1278. # verifying addresses. Similarly, no_expn means that this router is skipped if
  1279. # Exim is processing an EXPN command.
  1280. #
  1281. # The check_ancestor option means that if the forward file generates an
  1282. # address that is an ancestor of the current one, the current one gets
  1283. # passed on instead. This covers the case where A is aliased to B and B
  1284. # has a .forward file pointing to A.
  1285. #
  1286. # The four transports specified at the end are those that are used when
  1287. # forwarding generates a direct delivery to a directory, or a file, or to a
  1288. # pipe, or sets up an auto-reply, respectively.
  1289. #
  1290. userforward:
  1291. debug_print = "R: userforward for $local_part@$domain"
  1292. driver = redirect
  1293. domains = +local_domains
  1294. check_local_user
  1295. file = $home/.forward
  1296. require_files = $local_part:$home/.forward
  1297. no_verify
  1298. no_expn
  1299. check_ancestor
  1300. allow_filter
  1301. forbid_smtp_code = true
  1302. directory_transport = address_directory
  1303. file_transport = address_file
  1304. pipe_transport = address_pipe
  1305. reply_transport = address_reply
  1306. skip_syntax_errors
  1307. syntax_errors_to = real-$local_part@$domain
  1308. syntax_errors_text = \
  1309. This is an automatically generated message. An error has\n\
  1310. been found in your .forward file. Details of the error are\n\
  1311. reported below. While this error persists, you will receive\n\
  1312. a copy of this message for every message that is addressed\n\
  1313. to you. If your .forward file is a filter file, or if it is\n\
  1314. a non-filter file containing no valid forwarding addresses,\n\
  1315. a copy of each incoming message will be put in your normal\n\
  1316. mailbox. If a non-filter file contains at least one valid\n\
  1317. forwarding address, forwarding to the valid addresses will\n\
  1318. happen, and those will be the only deliveries that occur.
  1319.  
  1320. #####################################################
  1321. ### end router/600_exim4-config_userforward
  1322. #####################################################
  1323. #####################################################
  1324. ### router/700_exim4-config_procmail
  1325. #####################################################
  1326.  
  1327. procmail:
  1328. debug_print = "R: procmail for $local_part@$domain"
  1329. driver = accept
  1330. domains = +local_domains
  1331. check_local_user
  1332. transport = procmail_pipe
  1333. # emulate OR with "if exists"-expansion
  1334. require_files = ${local_part}:\
  1335. ${if exists{/etc/procmailrc}\
  1336. {/etc/procmailrc}{${home}/.procmailrc}}:\
  1337. +/usr/bin/procmail
  1338. no_verify
  1339. no_expn
  1340.  
  1341. #####################################################
  1342. ### end router/700_exim4-config_procmail
  1343. #####################################################
  1344. #####################################################
  1345. ### router/800_exim4-config_maildrop
  1346. #####################################################
  1347.  
  1348. ### router/800_exim4-config_maildrop
  1349. #################################
  1350.  
  1351. maildrop:
  1352. debug_print = "R: maildrop for $local_part@$domain"
  1353. driver = accept
  1354. domains = +local_domains
  1355. check_local_user
  1356. transport = maildrop_pipe
  1357. require_files = ${local_part}:${home}/.mailfilter:+/usr/bin/maildrop
  1358. no_verify
  1359. no_expn
  1360.  
  1361. #####################################################
  1362. ### end router/800_exim4-config_maildrop
  1363. #####################################################
  1364. #####################################################
  1365. ### router/850_exim4-config_lowuid
  1366. #####################################################
  1367.  
  1368. ### router/850_exim4-config_lowuid
  1369. #################################
  1370.  
  1371. .ifndef FIRST_USER_ACCOUNT_UID
  1372. FIRST_USER_ACCOUNT_UID = 0
  1373. .endif
  1374.  
  1375. .ifndef DEFAULT_SYSTEM_ACCOUNT_ALIAS
  1376. DEFAULT_SYSTEM_ACCOUNT_ALIAS = :fail: no mail to system accounts
  1377. .endif
  1378.  
  1379. COND_SYSTEM_USER_AND_REMOTE_SUBMITTER = "\
  1380. ${if and{{! match_ip{$sender_host_address}{:@[]}}\
  1381. {<{$local_user_uid}{FIRST_USER_ACCOUNT_UID}}}\
  1382. {1}{0}\
  1383. }"
  1384.  
  1385. lowuid_aliases:
  1386. debug_print = "R: lowuid_aliases for $local_part@$domain (UID $local_user_uid)"
  1387. check_local_user
  1388. driver = redirect
  1389. allow_fail
  1390. domains = +local_domains
  1391. condition = COND_SYSTEM_USER_AND_REMOTE_SUBMITTER
  1392. data = ${if exists{CONFDIR/lowuid-aliases}\
  1393. {${lookup{$local_part}lsearch{CONFDIR/lowuid-aliases}\
  1394. {$value}{DEFAULT_SYSTEM_ACCOUNT_ALIAS}}}\
  1395. {DEFAULT_SYSTEM_ACCOUNT_ALIAS}}
  1396. #####################################################
  1397. ### end router/850_exim4-config_lowuid
  1398. #####################################################
  1399. #####################################################
  1400. ### router/900_exim4-config_local_user
  1401. #####################################################
  1402.  
  1403. ### router/900_exim4-config_local_user
  1404. #################################
  1405.  
  1406. # This router matches local user mailboxes. If the router fails, the error
  1407. # message is "Unknown user".
  1408.  
  1409. local_user:
  1410. debug_print = "R: local_user for $local_part@$domain"
  1411. driver = accept
  1412. domains = +local_domains
  1413. check_local_user
  1414. local_parts = ! root
  1415. transport = LOCAL_DELIVERY
  1416. cannot_route_message = Unknown user
  1417. #####################################################
  1418. ### end router/900_exim4-config_local_user
  1419. #####################################################
  1420. #####################################################
  1421. ### router/mmm_mail4root
  1422. #####################################################
  1423.  
  1424. ### router/mmm_mail4root
  1425. #################################
  1426. # deliver mail addressed to root to /var/mail/mail as user mail:mail
  1427. # if it was not redirected in /etc/aliases or by other means
  1428. # Exim cannot deliver as root since 4.24 (FIXED_NEVER_USERS)
  1429.  
  1430. mail4root:
  1431. debug_print = "R: mail4root for $local_part@$domain"
  1432. driver = redirect
  1433. domains = +local_domains
  1434. data = /var/mail/mail
  1435. file_transport = address_file
  1436. local_parts = root
  1437. user = mail
  1438. group = mail
  1439.  
  1440. #####################################################
  1441. ### end router/mmm_mail4root
  1442. #####################################################
  1443. #####################################################
  1444. ### transport/00_exim4-config_header
  1445. #####################################################
  1446.  
  1447. ######################################################################
  1448. # TRANSPORTS CONFIGURATION #
  1449. ######################################################################
  1450. # ORDER DOES NOT MATTER #
  1451. # Only one appropriate transport is called for each delivery. #
  1452. ######################################################################
  1453.  
  1454. # A transport is used only when referenced from a router that successfully
  1455. # handles an address.
  1456.  
  1457. begin transports
  1458.  
  1459. #####################################################
  1460. ### end transport/00_exim4-config_header
  1461. #####################################################
  1462. #####################################################
  1463. ### transport/10_exim4-config_transport-macros
  1464. #####################################################
  1465.  
  1466. ### transport/10_exim4-config_transport-macros
  1467. #################################
  1468.  
  1469. .ifdef HIDE_MAILNAME
  1470. REMOTE_SMTP_HEADERS_REWRITE=*@+local_domains $1@DCreadhost frs : *@ETC_MAILNAME $1@DCreadhost frs
  1471. REMOTE_SMTP_RETURN_PATH=${if match_domain{$sender_address_domain}{+local_domains}{${sender_address_local_part}@DCreadhost}{${if match_domain{$sender_address_domain}{ETC_MAILNAME}{${sender_address_local_part}@DCreadhost}fail}}}
  1472. .endif
  1473.  
  1474. .ifdef REMOTE_SMTP_HELO_FROM_DNS
  1475. .ifdef REMOTE_SMTP_HELO_DATA
  1476. REMOTE_SMTP_HELO_DATA==${lookup dnsdb {ptr=$sending_ip_address}{$value}{$primary_hostname}}
  1477. .else
  1478. REMOTE_SMTP_HELO_DATA=${lookup dnsdb {ptr=$sending_ip_address}{$value}{$primary_hostname}}
  1479. .endif
  1480. .endif
  1481. #####################################################
  1482. ### end transport/10_exim4-config_transport-macros
  1483. #####################################################
  1484. #####################################################
  1485. ### transport/30_exim4-config_address_file
  1486. #####################################################
  1487.  
  1488. # This transport is used for handling deliveries directly to files that are
  1489. # generated by aliasing or forwarding.
  1490. #
  1491. address_file:
  1492. debug_print = "T: address_file for $local_part@$domain"
  1493. driver = appendfile
  1494. delivery_date_add
  1495. envelope_to_add
  1496. return_path_add
  1497.  
  1498. #####################################################
  1499. ### end transport/30_exim4-config_address_file
  1500. #####################################################
  1501. #####################################################
  1502. ### transport/30_exim4-config_address_pipe
  1503. #####################################################
  1504.  
  1505. # This transport is used for handling pipe deliveries generated by
  1506. # .forward files. If the commands fails and produces any output on standard
  1507. # output or standard error streams, the output is returned to the sender
  1508. # of the message as a delivery error.
  1509. address_pipe:
  1510. debug_print = "T: address_pipe for $local_part@$domain"
  1511. driver = pipe
  1512. return_fail_output
  1513.  
  1514. #####################################################
  1515. ### end transport/30_exim4-config_address_pipe
  1516. #####################################################
  1517. #####################################################
  1518. ### transport/30_exim4-config_address_reply
  1519. #####################################################
  1520.  
  1521. # This transport is used for handling autoreplies generated by the filtering
  1522. # option of the userforward router.
  1523. #
  1524. address_reply:
  1525. debug_print = "T: autoreply for $local_part@$domain"
  1526. driver = autoreply
  1527.  
  1528. #####################################################
  1529. ### end transport/30_exim4-config_address_reply
  1530. #####################################################
  1531. #####################################################
  1532. ### transport/30_exim4-config_mail_spool
  1533. #####################################################
  1534.  
  1535. ### transport/30_exim4-config_mail_spool
  1536.  
  1537. # This transport is used for local delivery to user mailboxes in traditional
  1538. # BSD mailbox format.
  1539. #
  1540. mail_spool:
  1541. debug_print = "T: appendfile for $local_part@$domain"
  1542. driver = appendfile
  1543. file = /var/mail/$local_part
  1544. delivery_date_add
  1545. envelope_to_add
  1546. return_path_add
  1547. group = mail
  1548. mode = 0660
  1549. mode_fail_narrower = false
  1550.  
  1551. #####################################################
  1552. ### end transport/30_exim4-config_mail_spool
  1553. #####################################################
  1554. #####################################################
  1555. ### transport/30_exim4-config_maildir_home
  1556. #####################################################
  1557.  
  1558. ### transport/30_exim4-config_maildir_home
  1559. #################################
  1560.  
  1561. # Use this instead of mail_spool if you want to to deliver to Maildir in
  1562. # home-directory - change the definition of LOCAL_DELIVERY
  1563. #
  1564. maildir_home:
  1565. debug_print = "T: maildir_home for $local_part@$domain"
  1566. driver = appendfile
  1567. .ifdef MAILDIR_HOME_MAILDIR_LOCATION
  1568. directory = MAILDIR_HOME_MAILDIR_LOCATION
  1569. .else
  1570. directory = $home/Maildir
  1571. .endif
  1572. .ifdef MAILDIR_HOME_CREATE_DIRECTORY
  1573. create_directory
  1574. .endif
  1575. .ifdef MAILDIR_HOME_CREATE_FILE
  1576. create_file = MAILDIR_HOME_CREATE_FILE
  1577. .endif
  1578. delivery_date_add
  1579. envelope_to_add
  1580. return_path_add
  1581. maildir_format
  1582. .ifdef MAILDIR_HOME_DIRECTORY_MODE
  1583. directory_mode = MAILDIR_HOME_DIRECTORY_MODE
  1584. .else
  1585. directory_mode = 0700
  1586. .endif
  1587. .ifdef MAILDIR_HOME_MODE
  1588. mode = MAILDIR_HOME_MODE
  1589. .else
  1590. mode = 0600
  1591. .endif
  1592. mode_fail_narrower = false
  1593. # This transport always chdirs to $home before trying to deliver. If
  1594. # $home is not accessible, this chdir fails and prevents delivery.
  1595. # If you are in a setup where home directories might not be
  1596. # accessible, uncomment the current_directory line below.
  1597. # current_directory = /
  1598. #####################################################
  1599. ### end transport/30_exim4-config_maildir_home
  1600. #####################################################
  1601. #####################################################
  1602. ### transport/30_exim4-config_maildrop_pipe
  1603. #####################################################
  1604.  
  1605. maildrop_pipe:
  1606. debug_print = "T: maildrop_pipe for $local_part@$domain"
  1607. driver = pipe
  1608. path = "/bin:/usr/bin:/usr/local/bin"
  1609. command = "/usr/bin/maildrop"
  1610. message_prefix =
  1611. message_suffix =
  1612. return_path_add
  1613. delivery_date_add
  1614. envelope_to_add
  1615.  
  1616. #####################################################
  1617. ### end transport/30_exim4-config_maildrop_pipe
  1618. #####################################################
  1619. #####################################################
  1620. ### transport/30_exim4-config_procmail_pipe
  1621. #####################################################
  1622.  
  1623. procmail_pipe:
  1624. debug_print = "T: procmail_pipe for $local_part@$domain"
  1625. driver = pipe
  1626. path = "/bin:/usr/bin:/usr/local/bin"
  1627. command = "/usr/bin/procmail"
  1628. return_path_add
  1629. delivery_date_add
  1630. envelope_to_add
  1631.  
  1632. #####################################################
  1633. ### end transport/30_exim4-config_procmail_pipe
  1634. #####################################################
  1635. #####################################################
  1636. ### transport/30_exim4-config_remote_smtp
  1637. #####################################################
  1638.  
  1639. ### transport/30_exim4-config_remote_smtp
  1640. #################################
  1641. # This transport is used for delivering messages over SMTP connections.
  1642. # Refuse to send any message with over-long lines, which could have
  1643. # been received other than via SMTP. The use of message_size_limit to
  1644. # enforce this is a red herring.
  1645.  
  1646. remote_smtp:
  1647. debug_print = "T: remote_smtp for $local_part@$domain"
  1648. driver = smtp
  1649. .ifndef IGNORE_SMTP_LINE_LENGTH_LIMIT
  1650. message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}}
  1651. .endif
  1652. .ifdef REMOTE_SMTP_HOSTS_AVOID_TLS
  1653. hosts_avoid_tls = REMOTE_SMTP_HOSTS_AVOID_TLS
  1654. .endif
  1655. .ifdef REMOTE_SMTP_HEADERS_REWRITE
  1656. headers_rewrite = REMOTE_SMTP_HEADERS_REWRITE
  1657. .endif
  1658. .ifdef REMOTE_SMTP_RETURN_PATH
  1659. return_path = REMOTE_SMTP_RETURN_PATH
  1660. .endif
  1661. .ifdef REMOTE_SMTP_HELO_DATA
  1662. helo_data=REMOTE_SMTP_HELO_DATA
  1663. .endif
  1664. .ifdef DKIM_DOMAIN
  1665. dkim_domain = DKIM_DOMAIN
  1666. .endif
  1667. .ifdef DKIM_SELECTOR
  1668. dkim_selector = DKIM_SELECTOR
  1669. .endif
  1670. .ifdef DKIM_PRIVATE_KEY
  1671. dkim_private_key = DKIM_PRIVATE_KEY
  1672. .endif
  1673. .ifdef DKIM_CANON
  1674. dkim_canon = DKIM_CANON
  1675. .endif
  1676. .ifdef DKIM_STRICT
  1677. dkim_strict = DKIM_STRICT
  1678. .endif
  1679. .ifdef DKIM_SIGN_HEADERS
  1680. dkim_sign_headers = DKIM_SIGN_HEADERS
  1681. .endif
  1682. .ifdef TLS_DH_MIN_BITS
  1683. tls_dh_min_bits = TLS_DH_MIN_BITS
  1684. .endif
  1685. .ifdef REMOTE_SMTP_TLS_CERTIFICATE
  1686. tls_certificate = /usr/local/vesta/ssl/mail.crt
  1687. .endif
  1688. .ifdef REMOTE_SMTP_PRIVATEKEY
  1689. tls_privatekey = /usr/local/vesta/ssl/mail.key
  1690. .endif
  1691. .ifndef REMOTE_SMTP_DISABLE_DANE
  1692. dnssec_request_domains = *
  1693. hosts_try_dane = *
  1694. .endif
  1695. #####################################################
  1696. ### end transport/30_exim4-config_remote_smtp
  1697. #####################################################
  1698. #####################################################
  1699. ### transport/30_exim4-config_remote_smtp_smarthost
  1700. #####################################################
  1701.  
  1702. ### transport/30_exim4-config_remote_smtp_smarthost
  1703. #################################
  1704.  
  1705. # This transport is used for delivering messages over SMTP connections
  1706. # to a smarthost. The local host tries to authenticate.
  1707. # This transport is used for smarthost and satellite configurations.
  1708. # Refuse to send any messsage with over-long lines, which could have
  1709. # been received other than via SMTP. The use of message_size_limit to
  1710. # enforce this is a red herring.
  1711.  
  1712. remote_smtp_smarthost:
  1713. debug_print = "T: remote_smtp_smarthost for $local_part@$domain"
  1714. driver = smtp
  1715. multi_domain
  1716. .ifndef IGNORE_SMTP_LINE_LENGTH_LIMIT
  1717. message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}}
  1718. .endif
  1719. hosts_try_auth = <; ${if exists{CONFDIR/passwd.client} \
  1720. {\
  1721. ${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$host_address}}\
  1722. }\
  1723. {} \
  1724. }
  1725. .ifdef REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS
  1726. hosts_avoid_tls = REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS
  1727. .endif
  1728. .ifdef REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS
  1729. hosts_require_tls = REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS
  1730. .endif
  1731. .ifdef REMOTE_SMTP_HEADERS_REWRITE
  1732. headers_rewrite = REMOTE_SMTP_HEADERS_REWRITE
  1733. .endif
  1734. .ifdef REMOTE_SMTP_RETURN_PATH
  1735. return_path = REMOTE_SMTP_RETURN_PATH
  1736. .endif
  1737. .ifdef REMOTE_SMTP_HELO_DATA
  1738. helo_data=REMOTE_SMTP_HELO_DATA
  1739. .endif
  1740. .ifdef TLS_DH_MIN_BITS
  1741. tls_dh_min_bits = TLS_DH_MIN_BITS
  1742. .endif
  1743. .ifdef REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE
  1744. tls_certificate = /usr/local/vesta/ssl/mail.crt
  1745. .endif
  1746. .ifdef REMOTE_SMTP_SMARTHOST_PRIVATEKEY
  1747. tls_privatekey = /usr/local/vesta/ssl/mail.key
  1748. .endif
  1749. #####################################################
  1750. ### end transport/30_exim4-config_remote_smtp_smarthost
  1751. #####################################################
  1752. #####################################################
  1753. ### transport/35_exim4-config_address_directory
  1754. #####################################################
  1755. # This transport is used for handling file addresses generated by alias
  1756. # or .forward files if the path ends in "/", which causes it to be treated
  1757. # as a directory name rather than a file name.
  1758.  
  1759. address_directory:
  1760. debug_print = "T: address_directory for $local_part@$domain"
  1761. driver = appendfile
  1762. delivery_date_add
  1763. envelope_to_add
  1764. return_path_add
  1765. check_string = ""
  1766. escape_string = ""
  1767. maildir_format
  1768.  
  1769. #####################################################
  1770. ### end transport/35_exim4-config_address_directory
  1771. #####################################################
  1772. #####################################################
  1773. ### retry/00_exim4-config_header
  1774. #####################################################
  1775.  
  1776. ######################################################################
  1777. # RETRY CONFIGURATION #
  1778. ######################################################################
  1779.  
  1780. begin retry
  1781.  
  1782. #####################################################
  1783. ### end retry/00_exim4-config_header
  1784. #####################################################
  1785. #####################################################
  1786. ### retry/30_exim4-config
  1787. #####################################################
  1788.  
  1789. ### retry/30_exim4-config
  1790. #################################
  1791.  
  1792. # This single retry rule applies to all domains and all errors. It specifies
  1793. # retries every 15 minutes for 2 hours, then increasing retry intervals,
  1794. # starting at 1 hour and increasing each time by a factor of 1.5, up to 16
  1795. # hours, then retries every 6 hours until 4 days have passed since the first
  1796. # failed delivery.
  1797.  
  1798. # Please note that these rules only limit the frequency of retries, the
  1799. # effective retry-time depends on the frequency of queue-running, too.
  1800. # See QUEUEINTERVAL in /etc/default/exim4.
  1801.  
  1802. # Address or Domain Error Retries
  1803. # ----------------- ----- -------
  1804.  
  1805. * * F,2h,15m; G,16h,1h,1.5; F,4d,6h
  1806.  
  1807. #####################################################
  1808. ### end retry/30_exim4-config
  1809. #####################################################
  1810. #####################################################
  1811. ### rewrite/00_exim4-config_header
  1812. #####################################################
  1813.  
  1814. ######################################################################
  1815. # REWRITE CONFIGURATION #
  1816. ######################################################################
  1817.  
  1818. begin rewrite
  1819.  
  1820. #####################################################
  1821. ### end rewrite/00_exim4-config_header
  1822. #####################################################
  1823. #####################################################
  1824. ### rewrite/31_exim4-config_rewriting
  1825. #####################################################
  1826.  
  1827. ### rewrite/31_exim4-config_rewriting
  1828. #################################
  1829.  
  1830. # This rewriting rule is particularly useful for dialup users who
  1831. # don't have their own domain, but could be useful for anyone.
  1832. # It looks up the real address of all local users in a file
  1833. .ifndef NO_EAA_REWRITE_REWRITE
  1834. *@+local_domains "${lookup{${local_part}}lsearch{/etc/email-addresses}\
  1835. {$value}fail}" Ffrs
  1836. # identical rewriting rule for /etc/mailname
  1837. *@ETC_MAILNAME "${lookup{${local_part}}lsearch{/etc/email-addresses}\
  1838. {$value}fail}" Ffrs
  1839. .endif
  1840.  
  1841.  
  1842. #####################################################
  1843. ### end rewrite/31_exim4-config_rewriting
  1844. #####################################################
  1845. #####################################################
  1846. ### auth/00_exim4-config_header
  1847. #####################################################
  1848.  
  1849. ######################################################################
  1850. # AUTHENTICATION CONFIGURATION #
  1851. ######################################################################
  1852.  
  1853. begin authenticators
  1854.  
  1855.  
  1856. #####################################################
  1857. ### end auth/00_exim4-config_header
  1858. #####################################################
  1859. #####################################################
  1860. ### auth/30_exim4-config_examples
  1861. #####################################################
  1862.  
  1863. ### auth/30_exim4-config_examples
  1864. #################################
  1865.  
  1866. # The examples below are for server side authentication, when the
  1867. # local exim is SMTP server and clients authenticate to the local exim.
  1868.  
  1869. # They allow two styles of plain-text authentication against an
  1870. # CONFDIR/passwd file whose syntax is described in exim4_passwd(5).
  1871.  
  1872. # Hosts that are allowed to use AUTH are defined by the
  1873. # auth_advertise_hosts option in the main configuration. The default is
  1874. # "*", which allows authentication to all hosts over all kinds of
  1875. # connections if there is at least one authenticator defined here.
  1876. # Authenticators which rely on unencrypted clear text passwords don't
  1877. # advertise on unencrypted connections by default. Thus, it might be
  1878. # wise to set up TLS to allow encrypted connections. If TLS cannot be
  1879. # used for some reason, you can set AUTH_SERVER_ALLOW_NOTLS_PASSWORDS to
  1880. # advertise unencrypted clear text password based authenticators on all
  1881. # connections. As this is severely reducing security, using TLS is
  1882. # preferred over allowing clear text password based authenticators on
  1883. # unencrypted connections.
  1884.  
  1885. # PLAIN authentication has no server prompts. The client sends its
  1886. # credentials in one lump, containing an authorization ID (which we do not
  1887. # use), an authentication ID, and a password. The latter two appear as
  1888. # $auth2 and $auth3 in the configuration and should be checked against a
  1889. # valid username and password. In a real configuration you would typically
  1890. # use $auth2 as a lookup key, and compare $auth3 against the result of the
  1891. # lookup, perhaps using the crypteq{}{} condition.
  1892.  
  1893. # plain_server:
  1894. # driver = plaintext
  1895. # public_name = PLAIN
  1896. # server_condition = "${if crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
  1897. # server_set_id = $auth2
  1898. # server_prompts = :
  1899. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1900. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1901. # .endif
  1902.  
  1903. # LOGIN authentication has traditional prompts and responses. There is no
  1904. # authorization ID in this mechanism, so unlike PLAIN the username and
  1905. # password are $auth1 and $auth2. Apart from that you can use the same
  1906. # server_condition setting for both authenticators.
  1907.  
  1908. # login_server:
  1909. # driver = plaintext
  1910. # public_name = LOGIN
  1911. # server_prompts = "Username:: : Password::"
  1912. # server_condition = "${if crypteq{$auth2}{${extract{1}{:}{${lookup{$auth1}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
  1913. # server_set_id = $auth1
  1914. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1915. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1916. # .endif
  1917. #
  1918. # cram_md5_server:
  1919. # driver = cram_md5
  1920. # public_name = CRAM-MD5
  1921. # server_secret = ${extract{2}{:}{${lookup{$auth1}lsearch{CONFDIR/passwd}{$value}fail}}}
  1922. # server_set_id = $auth1
  1923.  
  1924. # Here is an example of CRAM-MD5 authentication against PostgreSQL:
  1925. #
  1926. # psqldb_auth_server:
  1927. # driver = cram_md5
  1928. # public_name = CRAM-MD5
  1929. # server_secret = ${lookup pgsql{SELECT pw FROM users WHERE username = '${quote_pgsql:$auth1}'}{$value}fail}
  1930. # server_set_id = $auth1
  1931.  
  1932. # Authenticate against local passwords using sasl2-bin
  1933. # Requires exim_uid to be a member of sasl group, see README.Debian.gz
  1934. # plain_saslauthd_server:
  1935. # driver = plaintext
  1936. # public_name = PLAIN
  1937. # server_condition = ${if saslauthd{{$auth2}{$auth3}}{1}{0}}
  1938. # server_set_id = $auth2
  1939. # server_prompts = :
  1940. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1941. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1942. # .endif
  1943. #
  1944. # login_saslauthd_server:
  1945. # driver = plaintext
  1946. # public_name = LOGIN
  1947. # server_prompts = "Username:: : Password::"
  1948. # # don't send system passwords over unencrypted connections
  1949. # server_condition = ${if saslauthd{{$auth1}{$auth2}}{1}{0}}
  1950. # server_set_id = $auth1
  1951. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1952. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1953. # .endif
  1954. #
  1955. # ntlm_sasl_server:
  1956. # driver = cyrus_sasl
  1957. # public_name = NTLM
  1958. # server_realm = <short main hostname>
  1959. # server_set_id = $auth1
  1960. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1961. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1962. # .endif
  1963. #
  1964. # digest_md5_sasl_server:
  1965. # driver = cyrus_sasl
  1966. # public_name = DIGEST-MD5
  1967. # server_realm = <short main hostname>
  1968. # server_set_id = $auth1
  1969. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1970. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1971. # .endif
  1972.  
  1973. # Authentcate against cyrus-sasl
  1974. # This is mainly untested, please report any problems to
  1975. # pkg-exim4-users@lists.alioth.debian.org.
  1976. # cram_md5_sasl_server:
  1977. # driver = cyrus_sasl
  1978. # public_name = CRAM-MD5
  1979. # server_realm = <short main hostname>
  1980. # server_set_id = $auth1
  1981. #
  1982. # plain_sasl_server:
  1983. # driver = cyrus_sasl
  1984. # public_name = PLAIN
  1985. # server_realm = <short main hostname>
  1986. # server_set_id = $auth1
  1987. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1988. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1989. # .endif
  1990. #
  1991. # login_sasl_server:
  1992. # driver = cyrus_sasl
  1993. # public_name = LOGIN
  1994. # server_realm = <short main hostname>
  1995. # server_set_id = $auth1
  1996. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  1997. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  1998. # .endif
  1999.  
  2000. # Authenticate against courier authdaemon
  2001.  
  2002. # This is now the (working!) example from
  2003. # http://www.exim.org/eximwiki/FAQ/Policy_controls/Q0730
  2004. # Possible pitfall: access rights on /var/run/courier/authdaemon/socket.
  2005. # plain_courier_authdaemon:
  2006. # driver = plaintext
  2007. # public_name = PLAIN
  2008. # server_condition = \
  2009. # ${extract {ADDRESS} \
  2010. # {${readsocket{/var/run/courier/authdaemon/socket} \
  2011. # {AUTH ${strlen:exim\nlogin\n$auth2\n$auth3\n}\nexim\nlogin\n$auth2\n$auth3\n} }} \
  2012. # {yes} \
  2013. # fail}
  2014. # server_set_id = $auth2
  2015. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  2016. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  2017. # .endif
  2018.  
  2019. # login_courier_authdaemon:
  2020. # driver = plaintext
  2021. # public_name = LOGIN
  2022. # server_prompts = Username:: : Password::
  2023. # server_condition = \
  2024. # ${extract {ADDRESS} \
  2025. # {${readsocket{/var/run/courier/authdaemon/socket} \
  2026. # {AUTH ${strlen:exim\nlogin\n$auth1\n$auth2\n}\nexim\nlogin\n$auth1\n$auth2\n} }} \
  2027. # {yes} \
  2028. # fail}
  2029. # server_set_id = $auth1
  2030. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  2031. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  2032. # .endif
  2033.  
  2034. # This one is a bad hack to support the broken version 4.xx of
  2035. # Microsoft Outlook Express which violates the RFCs by demanding
  2036. # "250-AUTH=" instead of "250-AUTH ".
  2037. # If your list of offered authenticators is other than PLAIN and LOGIN,
  2038. # you need to adapt the public_name line manually.
  2039. # It has to be the last authenticator to work and has not been tested
  2040. # well. Use at your own risk.
  2041. # See the thread entry point from
  2042. # http://www.exim.org/mail-archives/exim-users/Week-of-Mon-20050214/msg00213.html
  2043. # for the related discussion on the exim-users mailing list.
  2044. # Thanks to Fred Viles for this great work.
  2045.  
  2046. # support_broken_outlook_express_4_server:
  2047. # driver = plaintext
  2048. # public_name = "\r\n250-AUTH=PLAIN LOGIN"
  2049. # server_prompts = User Name : Password
  2050. # server_condition = no
  2051. # .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  2052. # server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
  2053. # .endif
  2054.  
  2055. ##############
  2056. # See /usr/share/doc/exim4-base/README.Debian.gz
  2057. ##############
  2058.  
  2059. # These examples below are the equivalent for client side authentication.
  2060. # They get the passwords from CONFDIR/passwd.client, whose format is
  2061. # defined in exim4_passwd_client(5)
  2062.  
  2063. # Because AUTH PLAIN and AUTH LOGIN send the password in clear, we
  2064. # only allow these mechanisms over encrypted connections by default.
  2065. # You can set AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS to allow unencrypted
  2066. # clear text password authentication on all connections.
  2067.  
  2068. cram_md5:
  2069. driver = cram_md5
  2070. public_name = CRAM-MD5
  2071. client_name = ${extract{1}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}
  2072. client_secret = ${extract{2}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}
  2073.  
  2074. # this returns the matching line from passwd.client and doubles all ^
  2075. PASSWDLINE=${sg{\
  2076. ${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}\
  2077. }\
  2078. {\\N[\\^]\\N}\
  2079. {^^}\
  2080. }
  2081.  
  2082. plain:
  2083. driver = plaintext
  2084. public_name = PLAIN
  2085. .ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS
  2086. client_send = "<; ${if !eq{$tls_out_cipher}{}\
  2087. {^${extract{1}{:}{PASSWDLINE}}\
  2088. ^${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}\
  2089. }fail}"
  2090. .else
  2091. client_send = "<; ^${extract{1}{:}{PASSWDLINE}}\
  2092. ^${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}"
  2093. .endif
  2094.  
  2095. login:
  2096. driver = plaintext
  2097. public_name = LOGIN
  2098. .ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS
  2099. # Return empty string if not non-TLS AND looking up $host in passwd-file
  2100. # yields a non-empty string; fail otherwise.
  2101. client_send = "<; ${if and{\
  2102. {!eq{$tls_out_cipher}{}}\
  2103. {!eq{PASSWDLINE}{}}\
  2104. }\
  2105. {}fail}\
  2106. ; ${extract{1}{::}{PASSWDLINE}}\
  2107. ; ${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}"
  2108. .else
  2109. # Return empty string if looking up $host in passwd-file yields a
  2110. # non-empty string; fail otherwise.
  2111. client_send = "<; ${if !eq{PASSWDLINE}{}\
  2112. {}fail}\
  2113. ; ${extract{1}{::}{PASSWDLINE}}\
  2114. ; ${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}"
  2115. .endif
  2116. #####################################################
  2117. ### end auth/30_exim4-config_examples
  2118. #####################################################
  2119.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!