mdw@git.distorted.org.uk Git - exim-config/blob - base.m4

   1 ### -*-m4-*-
   2 ###
   3 ### Basic settings for distorted.org.uk Exim configuration
   4 ###
   5 ### (c) 2012 Mark Wooding
   6 ###
   7
   8 ###----- Licensing notice ---------------------------------------------------
   9 ###
  10 ### This program is free software; you can redistribute it and/or modify
  11 ### it under the terms of the GNU General Public License as published by
  12 ### the Free Software Foundation; either version 2 of the License, or
  13 ### (at your option) any later version.
  14 ###
  15 ### This program is distributed in the hope that it will be useful,
  16 ### but WITHOUT ANY WARRANTY; without even the implied warranty of
  17 ### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18 ### GNU General Public License for more details.
  19 ###
  20 ### You should have received a copy of the GNU General Public License
  21 ### along with this program; if not, write to the Free Software Foundation,
  22 ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  23
  24 ###--------------------------------------------------------------------------
  25 ### Global settings.
  26
  27 SECTION(global, priv)m4_dnl
  28 admin_groups = CONF_admin_groups
  29 trusted_groups = CONF_trusted_groups
  30 prod_requires_admin = false
  31
  32 SECTION(global, logging)m4_dnl
  33 log_file_path = : syslog
  34 log_selector = \
  35         +smtp_confirmation \
  36         +tls_peerdn
  37 log_timezone = true
  38 syslog_duplication = false
  39 syslog_timestamp = false
  40
  41 SECTION(global, daemon)m4_dnl
  42 local_interfaces = <; CONF_interfaces
  43 extra_local_interfaces = <; 0.0.0.0 ; ::0
  44
  45 SECTION(global, resource)m4_dnl
  46 deliver_queue_load_max = 8
  47 queue_only_load = 12
  48 smtp_accept_max = 16
  49 smtp_accept_queue = 32
  50 smtp_accept_reserve = 4
  51 smtp_load_reserve = 10
  52 smtp_reserve_hosts = +trusted
  53
  54 SECTION(global, policy)m4_dnl
  55 host_lookup = *
  56
  57 SECTION(global, users)m4_dnl
  58 gecos_name = $1
  59 gecos_pattern = ([^,:]*)
  60
  61 SECTION(global, incoming)m4_dnl
  62 rfc1413_hosts = *
  63 rfc1413_query_timeout = 10s
  64 received_header_text = Received: \
  65         ${if def:sender_rcvhost \
  66              {from $sender_rcvhost\n\t} \
  67              {${if def:sender_ident \
  68                    {from ${quote_local_part:$sender_ident} }}}}\
  69         by $primary_hostname \
  70         (Exim $version_number)\
  71         ${if def:tls_cipher {\n\t} { }}\
  72         ${if def:received_protocol \
  73              {with $received_protocol \
  74               ${if def:tls_cipher {(cipher=$tls_cipher)}}}}\n\t\
  75         ${if def:sender_address \
  76              {(envelope-from $sender_address\
  77               ${if def:authenticated_id \
  78                    {; auth=${quote_local_part:$authenticated_id}} \
  79                    {${if and {{def:authenticated_sender} \
  80                               {match_address{$authenticated_sender} \
  81                                             {*@CONF_master_domain}}} \
  82                          {; auth=${quote_local_part:\
  83                                     ${local_part:\
  84                                       $authenticated_sender}}}}}})\n\t}}\
  85         id $message_exim_id\
  86         ${if def:received_for {\n\tfor $received_for}}
  87
  88 SECTION(global, smtp)m4_dnl
  89 smtp_return_error_details = true
  90 accept_8bitmime = true
  91 chunking_advertise_hosts =
  92
  93 SECTION(global, env)m4_dnl
  94 keep_environment =
  95
  96 SECTION(global, process)m4_dnl
  97 extract_addresses_remove_arguments = false
  98 headers_charset = utf-8
  99 qualify_domain = CONF_master_domain
 100 untrusted_set_sender = *
 101 local_from_check = false
 102 local_sender_retain = true
 103
 104 SECTION(global, bounce)m4_dnl
 105 delay_warning = 1h : 24h : 2d
 106
 107 SECTION(global, tls)m4_dnl
 108 tls_certificate = CONF_certlist
 109 tls_privatekey = CONF_sysconf_dir/server.key
 110 tls_advertise_hosts = ${if exists {CONF_sysconf_dir/server.key} {*}{}}
 111 tls_dhparam = CONF_ca_dir/dh-param-2048.pem
 112 tls_require_ciphers = ${if or {{={$received_port}{CONF_submission_port}} \
 113                                {match_ip {$sender_host_address}{+trusted}}} \
 114                            {CONF_good_ciphers} \
 115                            {CONF_acceptable_ciphers}}
 116 tls_verify_certificates = CONF_ca_dir/ca.cert
 117 tls_verify_hosts = ${if eq{$acl_c_mode}{submission} {} {+allnets}}
 118
 119 DIVERT(null)
 120 ###--------------------------------------------------------------------------
 121 ### Access control lists.
 122
 123 SECTION(global, acl-after)
 124 SECTION(global, acl)m4_dnl
 125 acl_smtp_helo = helo
 126 SECTION(acl, misc)m4_dnl
 127 helo:
 128         ## Don't worry if this is local submission.  MUAs won't necessarily
 129         ## have a clear idea of their hostnames.  (For some reason.)
 130         accept   condition = ${if !eq{$acl_c_mode}{submission}}
 131
 132         ## Check that the caller's claimed identity is actually plausible.
 133         ## This seems like it's a fairly effective filter on spamminess, but
 134         ## it's too blunt a tool.  Rather than reject, add a warning header.
 135         ## Only we can't do this the easy way, so save it up for use in MAIL.
 136         ## Also, we're liable to get a subsequent HELO (e.g., after STARTTLS)
 137         ## and we should only care about the most recent one.
 138         warn     set acl_c_helo_warning = false
 139                 !condition = \
 140                         ${if and {{match_ip {$sender_host_address} \
 141                                             {<; 127.0.0.0/8 ; ::1}} \
 142                                   {match_domain {$sender_helo_name} \
 143                                                 {localhost : +thishost}}}}
 144                 !condition = \
 145                         ${if exists {CONF_sysconf_dir/helo.conf} \
 146                              {${lookup {$sender_helo_name} \
 147                                        partial0-lsearch \
 148                                        {CONF_sysconf_dir/helo.conf} \
 149                                        {${if match_ip \
 150                                              {$sender_host_address} \
 151                                              {<; $value}}}}}}
 152                 !verify = helo
 153                  set acl_c_helo_warning = true
 154
 155         accept
 156
 157 SECTION(global, acl)m4_dnl
 158 acl_not_smtp_start = not_smtp_start
 159 SECTION(acl, misc)m4_dnl
 160 not_smtp_start:
 161         ## Record the user's name.
 162         warn     set acl_c_user = $sender_ident
 163                  set acl_m_user = $sender_ident
 164
 165         ## Done.
 166         accept
 167
 168 SECTION(global, acl)m4_dnl
 169 acl_smtp_mail = mail
 170 SECTION(acl, mail)m4_dnl
 171 mail:
 172
 173         ## If we stashed a warning header about HELO from earlier, we should
 174         ## add it now.  Only don't bother if the client has authenticated
 175         ## successfully for submission (because we can't expect mobile
 176         ## clients to be properly set up knowing their names), or it's one of
 177         ## our own satellites (because they're either properly set up anyway,
 178         ## or satellites using us as a smarthost).
 179         warn     condition = $acl_c_helo_warning
 180                 !condition = ${if eq{$acl_c_mode}{submission}}
 181                 !hosts = +allnets
 182                  WARNING_HEADER(BADHELO,
 183                                 <:Client's HELO doesn't match its IP address.\n\t\
 184                                   helo-name=$sender_helo_name \
 185                                   address=$sender_host_address:>)
 186
 187         ## Always allow the empty sender, so that we can receive bounces.
 188         accept   senders = :
 189
 190         ## Ensure that the sender looks valid.
 191         require  acl = mail_check_sender
 192
 193         ## If this is directly from a client then hack on it for a while.
 194         warn     condition = ${if eq{$acl_c_mode}{submission}}
 195                  control = submission/sender_retain
 196
 197         ## Insist that a local client connect through TLS.
 198         deny     message = Hosts within CONF_master_domain must use TLS
 199                 !condition = ${if eq{$acl_c_mode}{submission}}
 200                  hosts = +allnets
 201                 !encrypted = *
 202
 203         ## Check that a submitted message's sender address is allowable.
 204         require  acl = mail_check_auth
 205
 206 SECTION(acl, mail-tail)m4_dnl
 207         ## And we're done.
 208         accept
 209
 210 SECTION(acl, misc)m4_dnl
 211 mail_check_sender:
 212
 213         ## See whether there's a special exception for this sender domain.
 214         accept   senders = ${LOOKUP_DOMAIN($sender_address_domain,
 215                              {KV(senders, {$value}{})},
 216                              {})}
 217
 218         ## Ensure that the sender is routable.  This is important to prevent
 219         ## undeliverable bounces.
 220         require  message = Invalid sender; \
 221                         ($sender_verify_failure; $acl_verify_message)
 222                  verify = sender
 223
 224         ## We're good, then.
 225         accept
 226
 227 SECTION(global, acl)m4_dnl
 228 acl_smtp_connect = connect
 229 SECTION(acl, connect)m4_dnl
 230 connect:
 231 SECTION(acl, connect-tail)m4_dnl
 232         ## Configure variables according to the submission mode.
 233         warn     acl = check_submission
 234
 235         ## Done.
 236         accept
 237
 238 check_submission:
 239         ## See whether this message needs hacking on.
 240         accept  !hosts = +thishost
 241                 !condition = ${if ={$received_port}{CONF_submission_port}}
 242                  set acl_c_mode = relay
 243
 244         ## Remember to apply submission controls.
 245         warn     set acl_c_mode = submission
 246
 247         ## Done.
 248         accept
 249
 250 SECTION(global, acl)m4_dnl
 251 acl_smtp_rcpt = rcpt
 252 SECTION(acl, rcpt)m4_dnl
 253 rcpt:
 254
 255         ## Reject if the client isn't allowed to relay and the recipient
 256         ## isn't in one of our known domains.
 257         require  message = Relaying not permitted
 258                  acl = check_relay
 259
 260         ## Ensure that the recipient is routable.
 261         require  message = Invalid recipient \
 262                         ($recipient_verify_failure; $acl_verify_message)
 263                  verify = recipient
 264
 265 SECTION(acl, misc)m4_dnl
 266 check_relay:
 267         ## Accept either if the client is allowed to relay through us, or if
 268         ## we're the correct place to send this mail.
 269
 270         ## Known clients and authenticated users are OK.
 271         accept   hosts = CONF_relay_clients
 272         accept   authenticated = *
 273
 274         ## Known domains are OK.
 275         accept   domains = +public
 276
 277         ## Finally, domains in our table are OK, unless they say they aren't.
 278         accept   domains = \
 279                  ${if exists{CONF_sysconf_dir/domains.conf} \
 280                      {partial0-lsearch; CONF_sysconf_dir/domains.conf}}
 281                  condition = DOMKV(service, {$value}{true})
 282
 283         ## Nope, that's not allowed.
 284         deny
 285
 286 SECTION(acl, rcpt-tail)m4_dnl
 287         ## Everything checks out OK: let this one go through.
 288         accept
 289
 290 SECTION(global, acl)m4_dnl
 291 acl_smtp_data = data
 292 SECTION(acl, data)m4_dnl
 293 data:
 294         ## Don't accept messages with overly-long lines.
 295         deny     message = line length exceeds SMTP permitted maximum: \
 296                         $max_received_linelength > 998
 297                  condition = ${if >{$max_received_linelength}{998}}
 298
 299 SECTION(acl, data-tail)m4_dnl
 300         accept
 301
 302 SECTION(global, acl)m4_dnl
 303 acl_smtp_expn = expn_vrfy
 304 acl_smtp_vrfy = expn_vrfy
 305 SECTION(acl, misc)m4_dnl
 306 expn_vrfy:
 307         accept   hosts = +trusted
 308         deny     message = Suck it and see
 309
 310 DIVERT(null)
 311 ###--------------------------------------------------------------------------
 312 ### Verification of sender address.
 313
 314 SECTION(acl, misc)m4_dnl
 315 mail_check_auth:
 316
 317         ## If this isn't a submission then it doesn't need checking.
 318         accept   condition = ${if !eq{$acl_c_mode}{submission}}
 319
 320         ## If the caller hasn't formally authenticated, but this is a
 321         ## loopback connection, then we can trust identd to tell us the right
 322         ## answer.  So we should stash the right name somewhere consistent.
 323         warn     set acl_c_user = $authenticated_id
 324                  hosts = +thishost
 325                 !authenticated = *
 326                  condition = ${if def:sender_ident}
 327                  set acl_c_user = $sender_ident
 328
 329         ## User must be authenticated by now.
 330         deny     message = Sender not authenticated
 331                  condition = ${if !def:acl_c_user}
 332
 333         ## Set the per-message authentication flag, since we now know that
 334         ## there's a sensible value.
 335         warn     set acl_m_user = $acl_c_user
 336
 337         ## All done.
 338         accept
 339
 340 DIVERT(null)
 341 ###--------------------------------------------------------------------------
 342 ### Common options for forwarding routers.
 343
 344 ## We're pretty permissive here.
 345 m4_define(<:FILTER_BASE:>,
 346         <:driver = redirect
 347         modemask = 002
 348         check_owner = false
 349         check_group = false
 350         allow_filter = true
 351         allow_defer = true
 352         allow_fail = true
 353         forbid_blackhole = false
 354         check_ancestor = true:>)
 355
 356 ## Common options for forwarding routers at verification time.
 357 m4_define(<:FILTER_VERIFY:>,
 358         <:verify_only = true
 359         user = CONF_filter_user
 360         forbid_filter_dlfunc = true
 361         forbid_filter_logwrite = true
 362         forbid_filter_perl = true
 363         forbid_filter_readsocket = true
 364         forbid_filter_run = true
 365         file_transport = dummy
 366         directory_transport = dummy
 367         pipe_transport = dummy
 368         reply_transport = dummy:>)
 369
 370 ## Transports for redirection filters.
 371 m4_define(<:FILTER_TRANSPORTS:>,
 372         <:file_transport = mailbox
 373         directory_transport = maildir
 374         pipe_transport = pipe
 375         reply_transport = reply:>)
 376
 377 m4_define(<:FILTER_ROUTER:>,
 378 <:$1_vrf:
 379         $2
 380         FILTER_VERIFY<::>$3
 381 $1:
 382         $2
 383         verify = no
 384         FILTER_TRANSPORTS<::>$4:>)
 385
 386 DIVERT(null)
 387 ###--------------------------------------------------------------------------
 388 ### Common routers.
 389
 390 SECTION(routers, alias)m4_dnl
 391 ## Look up the local part in the address map.
 392 alias:
 393         driver = redirect
 394         allow_fail = true
 395         allow_defer = true
 396         user = CONF_filter_user
 397         FILTER_TRANSPORTS
 398         local_parts = nwildlsearch; CONF_alias_file
 399         data = ${expand:$local_part_data}
 400 SECTION(routers, alias-opts)m4_dnl
 401
 402 DIVERT(null)
 403 ###--------------------------------------------------------------------------
 404 ### Some standard transports.
 405
 406 m4_define(<:USER_DELIVERY:>,
 407         <:delivery_date_add = true
 408         envelope_to_add = true
 409         return_path_add = true:>)
 410
 411 m4_define(<:APPLY_HEADER_CHANGES:>,
 412         <:headers_add = m4_ifelse(<:$1:>, <::>,
 413                 <:$acl_m_hdradd:>,
 414                 <:${if def:acl_m_hdradd{$acl_m_hdradd\n}}\
 415                 $1:>)
 416         headers_remove = m4_ifelse(<:$2:>, <::>,
 417                 <:$acl_m_hdrrm:>,
 418                 <:${if def:acl_m_hdrrm{$acl_m_hdrrm:}}\
 419                 $2:>):>)
 420
 421 m4_define(<:SMTP_DELIVERY:>,
 422         <:## Prevent sending messages with overly long lines.  The use of
 423         ## `message_size_limit' here is somewhat misleading.
 424         message_size_limit = ${if >{$max_received_linelength}{998}{1}{0}}:>)
 425
 426 SECTION(transports)m4_dnl
 427 ## A standard transport for remote delivery.  By default, try to do TLS, and
 428 ## don't worry too much if it's not very secure: the alternative is sending
 429 ## in plaintext anyway.  But all of this can be overridden from the
 430 ## `domains.conf' file.  Annoyingly, the `tls_dh_min_bits' setting isn't
 431 ## expanded before use, so we can't set it the obvious way.  Instead, encode
 432 ## it into the transport name.  This is very unpleasant, of course.
 433 smtp:
 434         driver = smtp
 435         APPLY_HEADER_CHANGES
 436         tls_require_ciphers = CONF_acceptable_ciphers
 437         tls_dh_min_bits = 508
 438         tls_tempfail_tryclear = true
 439
 440 m4_define(<:SMTP_TRANS_DHBITS:>,
 441         <:driver = smtp
 442         SMTP_DELIVERY
 443         APPLY_HEADER_CHANGES
 444         hosts_try_auth = *
 445         hosts_require_tls = DOMKV(tls-peer-ca, {*}{})
 446         hosts_require_auth = \
 447                 ${if bool {DOMKV(require-auth, {$value}{false})} {*}{}}
 448         tls_certificate = DOMKV(tls-certificate, {${expand:$value}}fail)
 449         tls_privatekey = DOMKV(tls-private-key, {${expand:$value}}fail)
 450         tls_verify_certificates = DOMKV(tls-peer-ca, {${expand:$value}}fail)
 451         tls_require_ciphers = \
 452                 DOMKV(tls-ciphers,
 453                       {${extract {${expand:$value}} \
 454                                  { good = CONF_good_ciphers \
 455                                    any = CONF_acceptable_ciphers } \
 456                                  {$value} \
 457                                  {${expand:$value}}}} \
 458                       {CONF_acceptable_ciphers})
 459         tls_dh_min_bits = $1
 460         tls_tempfail_tryclear = true:>)m4_dnl
 461 smtp_dhbits_512:
 462         SMTP_TRANS_DHBITS(508)
 463 smtp_dhbits_768:
 464         SMTP_TRANS_DHBITS(764)
 465 smtp_dhbits_1024:
 466         SMTP_TRANS_DHBITS(1020)
 467 smtp_dhbits_2048:
 468         SMTP_TRANS_DHBITS(2044)
 469
 470 ## Transport to a local SMTP server; use TLS and perform client
 471 ## authentication.
 472 smtp_local:
 473         driver = smtp
 474         SMTP_DELIVERY
 475         APPLY_HEADER_CHANGES
 476         hosts_require_tls = *
 477         tls_certificate = CONF_sysconf_dir/client.certlist
 478         tls_privatekey = CONF_sysconf_dir/client.key
 479         tls_verify_certificates = CONF_ca_dir/ca.cert
 480         tls_require_ciphers = CONF_good_ciphers
 481         tls_dh_min_bits = 2046
 482         tls_tempfail_tryclear = false
 483         authenticated_sender_force = true
 484         authenticated_sender = \
 485                 ${if def:acl_m_user {$acl_m_user@CONF_master_domain} \
 486                      {${if def:authenticated_sender {$authenticated_sender} \
 487                            fail}}}
 488
 489 ## A standard transport for local delivery.
 490 deliver:
 491         driver = appendfile
 492         APPLY_HEADER_CHANGES
 493         file = /var/mail/$local_part
 494         group = mail
 495         mode = 0600
 496         mode_fail_narrower = false
 497         USER_DELIVERY
 498
 499 ## Transports for user filters.
 500 mailbox:
 501         driver = appendfile
 502         APPLY_HEADER_CHANGES
 503         initgroups = true
 504         USER_DELIVERY
 505
 506 maildir:
 507         driver = appendfile
 508         APPLY_HEADER_CHANGES
 509         maildir_format = true
 510         initgroups = true
 511         USER_DELIVERY
 512
 513 pipe:
 514         driver = pipe
 515         APPLY_HEADER_CHANGES
 516         path = ${if and {{def:home} {exists{$home/bin}}} {$home/bin:} {}}\
 517                 /usr/local/bin:/usr/local/sbin:\
 518                 /usr/bin:/usr/sbin:/bin:/sbin
 519         initgroups = true
 520         umask = 002
 521         return_fail_output = true
 522         log_output = true
 523
 524 ## A special dummy transport for use during address verification.
 525 dummy:
 526         driver = appendfile
 527         file = /dev/null
 528
 529 DIVERT(null)
 530 ###--------------------------------------------------------------------------
 531 ### Retry configuration.
 532
 533 SECTION(retry, default)m4_dnl
 534 ## Default.
 535 *                                       * \
 536         F,2h,15m; G,16h,2h,1.5; F,4d,6h
 537
 538 DIVERT(null)
 539 ###----- That's all, folks --------------------------------------------------