3 ### Basic settings for distorted.org.uk Exim configuration
5 ### (c) 2012 Mark Wooding
8 ###----- Licensing notice ---------------------------------------------------
10 ### This program is free software; you can redistribute it and/or modify
11 ### it under the terms of the GNU General Public License as published by
12 ### the Free Software Foundation; either version 2 of the License, or
13 ### (at your option) any later version.
15 ### This program is distributed in the hope that it will be useful,
16 ### but WITHOUT ANY WARRANTY; without even the implied warranty of
17 ### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 ### GNU General Public License for more details.
20 ### You should have received a copy of the GNU General Public License
21 ### along with this program; if not, write to the Free Software Foundation,
22 ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
24 ###--------------------------------------------------------------------------
27 SECTION(global, priv)m4_dnl
28 admin_groups = CONF_admin_groups
29 prod_requires_admin = false
31 SECTION(global, logging)m4_dnl
32 log_file_path = : syslog
37 syslog_duplication = false
38 syslog_timestamp = false
40 SECTION(global, daemon)m4_dnl
41 local_interfaces = <; CONF_interfaces
42 extra_local_interfaces = <; 0.0.0.0 ; ::
44 SECTION(global, resource)m4_dnl
45 deliver_queue_load_max = 8
48 smtp_accept_queue = 32
49 smtp_accept_reserve = 4
50 smtp_load_reserve = 10
51 smtp_reserve_hosts = +trusted
53 SECTION(global, policy)m4_dnl
56 SECTION(global, users)m4_dnl
58 gecos_pattern = ([^,:]*)
60 SECTION(global, incoming)m4_dnl
61 received_header_text = Received: \
62 ${if def:sender_rcvhost \
63 {from $sender_rcvhost\
64 ${if def:sender_helo_name \
65 { (helo=$sender_helo_name)}}\n\t} \
66 {${if def:sender_ident \
67 {from ${quote_local_part:$sender_ident} }}}}\
68 by $primary_hostname \
69 (Exim $version_number)\
70 ${if def:tls_cipher {\n\t} { }}\
71 ${if def:received_protocol \
72 {with $received_protocol \
73 ${if def:tls_cipher {(cipher=$tls_cipher)}}}}\n\t\
74 ${if def:sender_address \
75 {(envelope-from $sender_address\
76 ${if def:authenticated_id \
77 {; auth=$authenticated_id}})\n\t}}\
79 ${if def:received_for {\n\tfor $received_for}}
81 SECTION(global, smtp)m4_dnl
82 smtp_return_error_details = true
83 accept_8bitmime = true
85 SECTION(global, process)m4_dnl
86 extract_addresses_remove_arguments = false
87 headers_charset = utf-8
88 qualify_domain = CONF_master_domain
90 SECTION(global, bounce)m4_dnl
91 delay_warning = 1h : 24h : 2d
94 ###--------------------------------------------------------------------------
95 ### Access control lists.
97 SECTION(global, acl-after)
98 SECTION(global, acl)m4_dnl
100 SECTION(acl, misc)m4_dnl
102 ## Check that the caller's claimed identity is actually plausible.
103 ## This seems like it's a fairly effective filter on spamminess, but
104 ## it's too blunt a tool. Rather than reject, add a warning header.
105 ## Only we can't do this the easy way, so save it up for use in MAIL.
106 ## Also, we're liable to get a subsequent HELO (e.g., after STARTTLS)
107 ## and we should only care about the most recent one.
108 warn set acl_c_helo_warning = false
110 ${if exists {CONF_sysconf_dir/helo.conf} \
111 {${lookup {$sender_helo_name} \
113 {CONF_sysconf_dir/helo.conf} \
115 {$sender_host_address} \
118 set acl_c_helo_warning = true
122 SECTION(global, acl)m4_dnl
123 acl_not_smtp_start = not_smtp_start
124 SECTION(acl, misc)m4_dnl
126 ## Record the user's name.
127 warn set acl_c_user = $sender_ident
132 SECTION(global, acl)m4_dnl
134 SECTION(acl, mail)m4_dnl
137 ## If we stashed a warning header about HELO from earlier, we should
139 warn condition = $acl_c_helo_warning
140 add_header = :after_received:X-Distorted-Warning: \
142 Client's HELO doesn't match its IP address.\n\t\
143 HELO name=$sender_helo_name, \
144 address=$sender_host_address
146 ## Always allow the empty sender, so that we can receive bounces.
149 ## Ensure that the sender is routable. This is important to prevent
150 ## undeliverable bounces.
151 require message = Invalid sender; \
152 ($sender_verify_failure; $acl_verify_message)
155 ## If this is directly from a client then hack on it for a while.
156 warn condition = ${if eq{$acl_c_mode}{submission}}
159 ## Insist that a local client connect through TLS.
160 deny message = Hosts within CONF_master_domain must use TLS
161 !condition = ${if eq{$acl_c_mode}{submission}}
165 ## Check that a submitted message's sender address is allowable.
166 require acl = mail_check_auth
168 SECTION(acl, mail-tail)m4_dnl
172 SECTION(global, acl)m4_dnl
173 acl_smtp_connect = connect
174 SECTION(acl, connect)m4_dnl
176 SECTION(acl, connect-tail)m4_dnl
177 ## Configure variables according to the submission mode.
178 warn acl = check_submission
184 ## See whether this message needs hacking on.
185 accept !hosts = +localnet
186 !condition = ${if ={$received_port}{CONF_submission_port}}
187 set acl_c_mode = relay
189 ## Remember to apply submission controls.
190 warn set acl_c_mode = submission
195 SECTION(global, acl)m4_dnl
197 SECTION(acl, rcpt)m4_dnl
200 ## Reject if the client isn't allowed to relay and the recipient
201 ## isn't in one of our known domains.
202 deny message = Relaying not permitted
203 !hosts = CONF_relay_clients
207 ## Ensure that the recipient is routable.
208 require message = Invalid recipient \
209 ($recipient_verify_failure; $acl_verify_message)
212 SECTION(acl, rcpt-tail)m4_dnl
213 ## Everything checks out OK: let this one go through.
216 SECTION(global, acl)m4_dnl
218 SECTION(acl, data)m4_dnl
221 SECTION(acl, data-tail)m4_dnl
224 SECTION(global, acl)m4_dnl
225 acl_smtp_expn = expn_vrfy
226 acl_smtp_vrfy = expn_vrfy
229 accept hosts = +trusted
230 deny message = Suck it and see
233 ###--------------------------------------------------------------------------
234 ### Verification of sender address.
236 SECTION(acl, misc)m4_dnl
239 ## If this isn't a submission then it doesn't need checking.
240 accept condition = ${if !eq{$acl_c_mode}{submission}}
242 ## If the caller hasn't formally authenticated, but this is a
243 ## loopback connection, then we can trust identd to tell us the right
244 ## answer. So we should stash the right name somewhere consistent.
245 warn set acl_c_user = $authenticated_id
248 set acl_c_user = $sender_ident
250 ## User must be authenticated.
251 deny message = Sender not authenticated
255 ## Make sure that the local part is one that the authenticated sender
256 ## is allowed to claim.
257 deny message = Sender address forbidden to calling user
258 !condition = ${LOOKUP_DOMAIN($sender_address_domain,
259 {${if and {{match_local_part \
263 {$sender_address_local_part} \
265 {${if and {{match_local_part \
266 {$sender_address_local_part} \
268 {or {{eq {$sender_address_domain} \
271 {$sender_address_domain} \
278 ###--------------------------------------------------------------------------
279 ### Common options for forwarding routers.
281 ## We're pretty permissive here.
282 m4_define(<:FILTER_BASE:>,
290 forbid_blackhole = false
291 check_ancestor = true:>)
293 ## Common options for forwarding routers at verification time.
294 m4_define(<:FILTER_VERIFY:>,
296 user = CONF_filter_user
297 forbid_filter_dlfunc = true
298 forbid_filter_logwrite = true
299 forbid_filter_perl = true
300 forbid_filter_readsocket = true
301 forbid_filter_run = true
302 file_transport = dummy
303 directory_transport = dummy
304 pipe_transport = dummy
305 reply_transport = dummy:>)
307 ## Transports for redirection filters.
308 m4_define(<:FILTER_TRANSPORTS:>,
309 <:file_transport = mailbox
310 directory_transport = maildir
311 pipe_transport = pipe
312 reply_transport = reply:>)
314 m4_define(<:FILTER_ROUTER:>,
321 FILTER_TRANSPORTS<::>$4:>)
324 ###--------------------------------------------------------------------------
325 ### Some standard transports.
327 m4_define(<:USER_DELIVERY:>,
328 <:delivery_date_add = true
329 envelope_to_add = true
330 return_path_add = true:>)
332 SECTION(transports)m4_dnl
333 ## A standard transport for remote delivery. Try to do TLS, and don't worry
334 ## too much if it's not very secure: the alternative is sending in plaintext
338 tls_require_ciphers = CONF_acceptable_ciphers
339 tls_dh_min_bits = 1020
340 tls_tempfail_tryclear = true
342 ## Transport to a local SMTP server; use TLS and perform client
346 hosts_require_tls = *
347 tls_certificate = CONF_sysconf_dir/client.cert
348 tls_privatekey = CONF_sysconf_dir/client.key
349 tls_verify_certificates = CONF_ca_dir/ca.cert
350 tls_require_ciphers = CONF_good_ciphers
351 tls_dh_min_bits = 2046
352 tls_tempfail_tryclear = false
353 authenticated_sender = ${if def:authenticated_id \
354 {$authenticated_id@CONF_master_domain} \
357 ## A standard transport for local delivery.
360 file = /var/mail/$local_part
363 mode_fail_narrower = false
366 ## Transports for user filters.
374 maildir_format = true
380 path = ${if and {{def:home} {exists{$home/bin}}} {$home/bin:} {}}\
381 /usr/local/bin:/usr/local/sbin:\
382 /usr/bin:/usr/sbin:/bin:/sbin
385 return_fail_output = true
388 ## A special dummy transport for use during address verification.
394 ###--------------------------------------------------------------------------
395 ### Retry configuration.
397 SECTION(retry, default)m4_dnl
400 F,2h,15m; G,16h,2h,1.5; F,4d,6h
403 ###----- That's all, folks --------------------------------------------------