projects
/
mirror
/
dsa-puppet.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
eximconf: add more RBL config to the default options setup
[mirror/dsa-puppet.git]
/
modules
/
exim
/
templates
/
eximconf.erb
diff --git
a/modules/exim/templates/eximconf.erb
b/modules/exim/templates/eximconf.erb
index
a11e8d5
..
f55c0f7
100644
(file)
--- a/
modules/exim/templates/eximconf.erb
+++ b/
modules/exim/templates/eximconf.erb
@@
-45,8
+45,12
@@
# From /var/lib/misc / UD:
#
# From /var/lib/misc / UD:
#
-# mail-forward.cdb - aliases for @d.o
-# user-forward.cdb - aliases for @thishost.d.o
+# mail-forward.db - aliases for @d.o
+# user-forward.db - aliases for @thishost.d.o
+#
+# Note that the BDB files generated by ud-ldap use keys that are not
+# null-terminated, so Exim needs to use the "dbmnz" lookup type, rather
+# than "dbm".
# Exim's wildcard mechanism is a bit odd in that to say "any address in
# debian.org including debian.org" you must use two patterns,
# Exim's wildcard mechanism is a bit odd in that to say "any address in
# debian.org including debian.org" you must use two patterns,
@@
-302,6
+306,7
@@
GREYLIST_LOCAL_PARTS = ${if match_domain{$domain}{+virtual_domains}\
{${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/grey_users}}}{$local_part}{}}}{}}}\
{${lookup{$local_part}lsearch{/etc/exim4/grey_users}{$local_part}{}}}} : \
${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-greylist}{$local_part}{}}
{${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/grey_users}}}{$local_part}{}}}{}}}\
{${lookup{$local_part}lsearch{/etc/exim4/grey_users}{$local_part}{}}}} : \
${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-greylist}{$local_part}{}}
+HAS_DEFAULT_OPTIONS = ${if eq{${lookup{$local_part}dbmnz{/var/lib/misc/$primary_hostname/default-mail-options.db}{$value}{TRUE}}}{TRUE}}
<%- if @is_rtmaster -%>
# This subject rewrite is embedded in double-quoted strings. As such, some of
# the items need more escaping than usual, otherwise \N becomes simply "N" and
<%- if @is_rtmaster -%>
# This subject rewrite is embedded in double-quoted strings. As such, some of
# the items need more escaping than usual, otherwise \N becomes simply "N" and
@@
-414,27
+419,27
@@
acl_getprofile:
accept condition = ${if !eq {$acl_m_rprf}{}}
warn domains = +virtual_domains
accept condition = ${if !eq {$acl_m_rprf}{}}
warn domains = +virtual_domains
- condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction.
c
db}}}}
- condition = ${if eq{${lookup{$local_part}
cdb{${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction.c
db}}}{$value}{}}}{markup}}
+ condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction.db}}}}
+ condition = ${if eq{${lookup{$local_part}
dbmnz{${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction.
db}}}{$value}{}}}{markup}}
set acl_m_rprf = markup
accept condition = ${if !eq {$acl_m_rprf}{}}
warn domains = +virtual_domains
set acl_m_rprf = markup
accept condition = ${if !eq {$acl_m_rprf}{}}
warn domains = +virtual_domains
- condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction.
c
db}}}}
- condition = ${if eq{${lookup{$local_part}
cdb{${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction.c
db}}}{$value}{}}}{blackhole}}
+ condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction.db}}}}
+ condition = ${if eq{${lookup{$local_part}
dbmnz{${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction.
db}}}{$value}{}}}{blackhole}}
set acl_m_rprf = blackhole
accept condition = ${if !eq {$acl_m_rprf}{}}
warn domains = +local_domains
set acl_m_rprf = blackhole
accept condition = ${if !eq {$acl_m_rprf}{}}
warn domains = +local_domains
- condition = ${if eq{${lookup{$local_part}
cdb{/var/lib/misc/${primary_hostname}/mail-contentinspectionaction.c
db}{$value}{}}}{markup}}
+ condition = ${if eq{${lookup{$local_part}
dbmnz{/var/lib/misc/${primary_hostname}/mail-contentinspectionaction.
db}{$value}{}}}{markup}}
set acl_m_rprf = markup
accept condition = ${if !eq {$acl_m_rprf}{}}
warn domains = +local_domains
set acl_m_rprf = markup
accept condition = ${if !eq {$acl_m_rprf}{}}
warn domains = +local_domains
- condition = ${if eq{${lookup{$local_part}
cdb{/var/lib/misc/${primary_hostname}/mail-contentinspectionaction.c
db}{$value}{}}}{blackhole}}
+ condition = ${if eq{${lookup{$local_part}
dbmnz{/var/lib/misc/${primary_hostname}/mail-contentinspectionaction.
db}{$value}{}}}{blackhole}}
set acl_m_rprf = blackhole
accept condition = ${if !eq {$acl_m_rprf}{}}
set acl_m_rprf = blackhole
accept condition = ${if !eq {$acl_m_rprf}{}}
@@
-596,6
+601,14
@@
check_recipient:
message = Different profile, please retry
log_message = Only one profile at a time, please
message = Different profile, please retry
log_message = Only one profile at a time, please
+ # Set a flag to indicate whether the current recipient
+ # has explicitly requested greylisting
+ warn set acl_m_grey_recip = 0
+
+ warn local_parts = GREYLIST_LOCAL_PARTS
+ domains = +handled_domains
+ set acl_m_grey_recip = 1
+
# Defer after too many bad RCPT TO's. Legit MTAs will retry later.
# This is a rough pass at preventing address harvesting or other mail blasts.
# Defer after too many bad RCPT TO's. Legit MTAs will retry later.
# This is a rough pass at preventing address harvesting or other mail blasts.
@@
-769,27
+782,25
@@
check_recipient:
<%- end -%>
<%- if @is_rtmaster -%>
warn condition = ${if eq{$acl_m_prf}{RTMail}}
<%- end -%>
<%- if @is_rtmaster -%>
warn condition = ${if eq{$acl_m_prf}{RTMail}}
- set acl_m12 = ${if def:acl_m12 {$acl_m12} {${if or{{match{$local_part}{\N[^+]+\+\d+\N}}{match{$local_part}{\N[^+]+\+new\N}}{match{$local_part}{3520}}{match{$local_part}{3645}}} {RTMailRecipientHasSubaddress}}}}
- # temporary hack because weasel screwed up and gave people an rt-3520@ address, which doesn't really work normally. and rt-3645
- #set acl_m12 = ${if def:acl_m12 {$acl_m12} {${if or{{match{$local_part}{\N[^+]+\+\d+\N}}{match{$local_part}{\N[^+]+\+new\N}}} {RTMailRecipientHasSubaddress}}}}
-
+ set acl_m12 = ${if def:acl_m12 {$acl_m12} {${if or{{match{$local_part}{\N[^+]+\+\d+\N}}{match{$local_part}{\N[^+]+\+new\N}}} {RTMailRecipientHasSubaddress}}}}
<%- end -%>
<%- if has_variable?("greylistd") && @greylistd -%>
defer
message = $sender_host_address is not yet authorized to deliver mail from <$sender_address> to <$local_part@$domain>.
log_message = greylisted.
<%- end -%>
<%- if has_variable?("greylistd") && @greylistd -%>
defer
message = $sender_host_address is not yet authorized to deliver mail from <$sender_address> to <$local_part@$domain>.
log_message = greylisted.
-
local_parts = ${if match_domain{$domain}{+virtual_domains}
\
-
{${if exists {${extract{directory}{VDOMAINDATA}{${value}/grey_users}}}
\
-
{${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/grey_users}}}{$local_part}{}}}{}}}
\
-
{${lookup{$local_part}lsearch{/etc/exim4/grey_users}{$local_part}{}} :
\
-
${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-greylist}{$local_part}{}}}
}
+
condition = ${if or {
\
+
{eq{$acl_m_grey_recip}{1}}
\
+
{bool_lax{HAS_DEFAULT_OPTIONS}}
\
+
}
\
+
}
!senders = :
!hosts = : +debianhosts : WHITELIST : \
${if exists {/etc/greylistd/whitelist-hosts}\
{/etc/greylistd/whitelist-hosts}{}} : \
${if exists {/var/lib/greylistd/whitelist-hosts}\
{/var/lib/greylistd/whitelist-hosts}{}}
!senders = :
!hosts = : +debianhosts : WHITELIST : \
${if exists {/etc/greylistd/whitelist-hosts}\
{/etc/greylistd/whitelist-hosts}{}} : \
${if exists {/var/lib/greylistd/whitelist-hosts}\
{/var/lib/greylistd/whitelist-hosts}{}}
+ !dnslists = list.dnswl.org&0.0.0.3
condition = ${if !eq {$acl_m_prf}{PopconMail}}
!authenticated = *
domains = +handled_domains
condition = ${if !eq {$acl_m_prf}{PopconMail}}
!authenticated = *
domains = +handled_domains
@@
-806,6
+817,7
@@
check_recipient:
warn
!senders = :
!hosts = : +debianhosts : WHITELIST
warn
!senders = :
!hosts = : +debianhosts : WHITELIST
+ !dnslists = list.dnswl.org&0.0.0.3
condition = ${if !eq {$acl_m_prf}{PopconMail}}
condition = ${if ! def:acl_m_grey}
set acl_m_grey = $pid.$tod_epoch.$sender_host_port
condition = ${if !eq {$acl_m_prf}{PopconMail}}
condition = ${if ! def:acl_m_grey}
set acl_m_grey = $pid.$tod_epoch.$sender_host_port
@@
-814,10
+826,15
@@
check_recipient:
defer
!senders = :
!hosts = : +debianhosts : WHITELIST
defer
!senders = :
!hosts = : +debianhosts : WHITELIST
+ !dnslists = list.dnswl.org&0.0.0.3
condition = ${if !eq {$acl_m_prf}{PopconMail}}
!authenticated = *
domains = +handled_domains
condition = ${if !eq {$acl_m_prf}{PopconMail}}
!authenticated = *
domains = +handled_domains
- local_parts = GREYLIST_LOCAL_PARTS
+ condition = ${if or { \
+ {eq{$acl_m_grey_recip}{1}} \
+ {bool_lax{HAS_DEFAULT_OPTIONS}} \
+ } \
+ }
set acl_m_pgr = request=smtpd_access_policy\n\
protocol_state=RCPT\n\
protocol_name=${uc:$received_protocol}\n\
set acl_m_pgr = request=smtpd_access_policy\n\
protocol_state=RCPT\n\
protocol_name=${uc:$received_protocol}\n\
@@
-839,10
+856,15
@@
check_recipient:
warn
!senders = :
!hosts = : +debianhosts : WHITELIST
warn
!senders = :
!hosts = : +debianhosts : WHITELIST
+ !dnslists = list.dnswl.org&0.0.0.3
condition = ${if !eq {$acl_m_prf}{PopconMail}}
!authenticated = *
domains = +handled_domains
condition = ${if !eq {$acl_m_prf}{PopconMail}}
!authenticated = *
domains = +handled_domains
- local_parts = GREYLIST_LOCAL_PARTS
+ condition = ${if or { \
+ {eq{$acl_m_grey_recip}{1}} \
+ {bool_lax{HAS_DEFAULT_OPTIONS}} \
+ } \
+ }
condition = ${if eq{${uc:${substr_0_7:$acl_m_pgr}}}{PREPEND}}
message = ${sg{$acl_m_pgr}{\N^\w+\s*\N}{}}
condition = ${if eq{${uc:${substr_0_7:$acl_m_pgr}}}{PREPEND}}
message = ${sg{$acl_m_pgr}{\N^\w+\s*\N}{}}
@@
-873,6
+895,12
@@
check_recipient:
domains = +handled_domains
!hosts = +debianhosts : WHITELIST
domains = +handled_domains
!hosts = +debianhosts : WHITELIST
+ deny message = host $sender_host_address is listed in $dnslist_domain; see $dnslist_text
+ condition = ${if bool_lax{HAS_DEFAULT_OPTIONS}}
+ dnslists = relays.dnsbl.sorbs.net
+ domains = +handled_domains
+ !hosts = +debianhosts : WHITELIST
+
<%- end -%>
deny message = domain $sender_address_domain is listed in $dnslist_domain; see $dnslist_text
dnslists = ${if match_domain{$domain}{+virtual_domains}\
<%- end -%>
deny message = domain $sender_address_domain is listed in $dnslist_domain; see $dnslist_text
dnslists = ${if match_domain{$domain}{+virtual_domains}\
@@
-1082,8
+1110,8
@@
check_message:
begin rewrite
\N^buildd_(.*)@fasolo\.debian\.org$\N buildd_$1@buildd.debian.org T
begin rewrite
\N^buildd_(.*)@fasolo\.debian\.org$\N buildd_$1@buildd.debian.org T
-*@debian.org ${lookup{$1}
cdb{/var/lib/misc/${primary_hostname}/mail-forward.c
db}{$value}fail} T
-*@people.debian.org ${lookup{$1}
cdb{/var/lib/misc/${primary_hostname}/mail-forward.c
db}{$value}fail} T
+*@debian.org ${lookup{$1}
dbmnz{/var/lib/misc/${primary_hostname}/mail-forward.
db}{$value}fail} T
+*@people.debian.org ${lookup{$1}
dbmnz{/var/lib/misc/${primary_hostname}/mail-forward.
db}{$value}fail} T
#*@${primary_hostname} "${if exists{/etc/exim4/email-addresses}{${lookup{$1}lsearch{/etc/exim4/email-addresses}{$value}fail}}fail}" fFs
#*@${primary_hostname} "${if exists{/etc/exim4/email-addresses}{${lookup{$1}lsearch{/etc/exim4/email-addresses}{$value}fail}}fail}" fFs
@@
-1338,9
+1366,9
@@
ldap_aliases:
driver = redirect
allow_defer
allow_fail
driver = redirect
allow_defer
allow_fail
- data = ${if exists{/var/lib/misc/$primary_hostname/user-forward.
c
db}\
- {${lookup{$local_part}
cdb
\
- {/var/lib/misc/$primary_hostname/user-forward.
c
db}}}}
+ data = ${if exists{/var/lib/misc/$primary_hostname/user-forward.db}\
+ {${lookup{$local_part}
dbmnz
\
+ {/var/lib/misc/$primary_hostname/user-forward.db}}}}
domains = +local_domains
file_transport = address_file
local_part_suffix = -*
domains = +local_domains
file_transport = address_file
local_part_suffix = -*
@@
-1497,17
+1525,17
@@
virt_users:
group = ${extract{group}{VDOMAINDATA}}
# Manually construct the forwarding address, preserving the
# local_part_suffix if the remote host is master.
group = ${extract{group}{VDOMAINDATA}}
# Manually construct the forwarding address, preserving the
# local_part_suffix if the remote host is master.
- data = ${if and {{exists{${extract{directory}{VDOMAINDATA}{${value}/mail-forward.
c
db}}}}\
- {! eq {${lookup{$local_part}
cdb
\
- {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.
c
db}}}}}\
+ data = ${if and {{exists{${extract{directory}{VDOMAINDATA}{${value}/mail-forward.db}}}}\
+ {! eq {${lookup{$local_part}
dbmnz
\
+ {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.db}}}}}\
{}}}\
{}}}\
- {${local_part:${lookup{$local_part}
cdb
\
- {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.
c
db}}}}}\
- ${if eq {${domain:${lookup{$local_part}
cdb
\
- {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.
c
db}}}}}}{master.debian.org}{$local_part_suffix} {}}\
+ {${local_part:${lookup{$local_part}
dbmnz
\
+ {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.db}}}}}\
+ ${if eq {${domain:${lookup{$local_part}
dbmnz
\
+ {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.db}}}}}}{master.debian.org}{$local_part_suffix} {}}\
@\
@\
- ${domain:${lookup{$local_part}
cdb
\
- {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.
c
db}}}}}}}
+ ${domain:${lookup{$local_part}
dbmnz
\
+ {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.db}}}}}}}
domains = +virtual_domains
file_transport = address_file
headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
domains = +virtual_domains
file_transport = address_file
headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"