# The configuration file uses a set of rules to generate an
# acceptable mail environment for debian.org machines. It deviates
-# considerably from what could be considered a standard exim configuration.
+# considerably from what could be considered a standard Exim configuration.
# This configuration file brings in the necessary information from
-# other databases stored in /etc/exim/ and the files distributed by ud-ldap
+# other databases stored in /etc/exim4/ and the files distributed by ud-ldap
# This file is independent of the local host, it should not be changed
# per machine. primary_hostname is used in all places that require per-host
# settings.
-# The configuration files in /etc/exim are as follows:
+# The configuration files in /etc/exim4 are as follows:
# locals - This is a list of domains that are considered local. A local
-# domain is essential one that deliveries to /var/mail
+# domain is essentially one for which deliveries to /var/mail
# will be attempted. The users available for local delivery
-# comes from /etc/passwd and /etc/aliases. Wildcards are not
+# come from /etc/passwd and /etc/aliases. Wildcards are not
# permitted.
# virtualdomains - This is a list of all virtual domains. A virtual domain
# is much like a local domain, execpt that the delivery location
# and allowed set of users is controlled by a virtual domain
# alias file and not /etc/passwd. Wildcards are permitted
# relayhosts - Hostnames that can send any arbitarily addressed mail to
-# us. This is primarily only usefull for emergancy 'queue
+# us. This is primarily only useful for emergency 'queue
# flushing' operations, but should be populated with a list
# of trusted machines. Wildcards are not permitted
# bsmtp_domains - Domains that we deliver locally via bsmtp
# elsewhere. This is designed for use with small volume or
# restricted machines that need to use a smarthost for mail
# traffic. We will relay for them based on ssl cert validation
-# but we need to teach exim how to route the mail to them. This is
+# but we need to teach Exim how to route the mail to them. This is
# that list.
<%- end -%>
# Further details can be found in each of the files.
-# Usefull exim commands:
+# Useful Exim commands:
# exim4 -qf - Try sending all messages right now, including frozen ones
-# exim4 -bt foo@blah - Write what exim would do if it saw the address
+# exim4 -bt foo@blah - Write what Exim would do if it saw the address
# Great for testing virtual domains and forward files
# Special Features for users:
# Heuristic check (none bad enough to cause a hard reject, but in aggregate
# will trigger things like rcpt to rate limiting or possibly a reject if
-# enough hits are triggered.
+# enough hits are triggered).
#
# value is stored in acl_c_scr
# MAIN CONFIGURATION SETTINGS #
######################################################################
-<%- if scope.lookupvar('site::nodeinfo').has_key?('heavy_exim') and scope.lookupvar('site::nodeinfo')['heavy_exim'] -%>
+<%- if @heavy -%>
perl_startup = do '/etc/exim4/exim_surbl.pl'
<%- end -%>
acl_smtp_helo = check_helo
acl_smtp_rcpt = ${if ={$interface_port}{587} {check_submission}{check_recipient}}
acl_smtp_data = check_message
-<%- if scope.lookupvar('site::nodeinfo').has_key?('heavy_exim') and scope.lookupvar('site::nodeinfo')['heavy_exim'] -%>
+<%- if @heavy -%>
acl_smtp_mime = acl_check_mime
<%- end -%>
acl_smtp_predata = acl_check_predata
# Some operating systems use the "gecos" field in the system password file
# to hold other information in addition to users' real names. Exim looks up
# this field when it is creating "sender" and "from" headers. If these options
-# are set, exim uses "gecos_pattern" to parse the gecos field, and then
+# are set, Exim uses "gecos_pattern" to parse the gecos field, and then
# expands "gecos_name" as the user's name. $1 etc refer to sub-fields matched
# by the pattern.
gecos_pattern = ^([^,:]*)
gecos_name = $1
-# This tells exim to immediately discard error messages (ie double bounces).
+# This tells Exim to immediately discard error messages (ie double bounces).
ignore_bounce_errors_after = 0s
auto_thaw = 1d
timeout_frozen_after=14d
message_size_limit = 100M
message_logs = false
smtp_accept_max_per_host = ${if match_ip {$sender_host_address}{+debianhosts}{0}{7}}
-<%- if scope.lookupvar('site::nodeinfo').has_key?('heavy_exim') and scope.lookupvar('site::nodeinfo')['heavy_exim'] -%>
+<%- if @heavy -%>
smtp_accept_max = 300
smtp_accept_queue = 200
smtp_accept_queue_per_connection = 50
delay_warning =
-<%- if scope.lookupvar('site::nodeinfo').has_key?('heavy_exim') and scope.lookupvar('site::nodeinfo')['heavy_exim'] -%>
+<%- if @heavy -%>
message_body_visible = 5000
queue_run_max = 50
deliver_queue_load_max = 50
ports = []
out = "daemon_smtp_ports = "
ports << 25
+if @mail_port # if we have an overridden mail_port
+ ports << @mail_port
+end
if @is_bugsmx
ports << 587
end
-if not scope.lookupvar('site::nodeinfo')['mail_port'].to_s.empty?
- ports << scope.lookupvar('site::nodeinfo')['mail_port']
-end
-
if @is_mailrelay
- ports << scope.lookupvar('site::nodeinfo')['smarthost_port']
+ ports << @smarthost_port
end
out += ports.uniq.sort.join(" : ")
tls_advertise_hosts = *
smtp_enforce_sync = true
-log_selector = +tls_cipher +tls_peerdn +queue_time +deliver_time +smtp_connection +smtp_incomplete_transaction +smtp_confirmation
+log_selector = +tls_cipher +tls_peerdn +queue_time +deliver_time +smtp_connection +smtp_incomplete_transaction +smtp_confirmation +smtp_protocol_error
received_header_text = Received: ${if def:sender_rcvhost {from $sender_rcvhost\n\t}\
{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)\n\t}}}}\
{${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/grey_users}}}{$local_part}{}}}{}}}\
{${lookup{$local_part}lsearch{/etc/exim4/grey_users}{$local_part}{}}}} : \
${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-greylist}{$local_part}{}}
+<%- if @is_rtmaster -%>
RT_QUEUE_MAP = /srv/rt.debian.org/mail/rt_queue_map
+<%- end -%>
keep_environment =
add_environment =
accept verify = certificate
<%- end -%>
-<%- if scope.lookupvar('site::nodeinfo')['smarthost'].empty? -%>
+<%- unless @use_smarthost -%>
# These are in HELO acl so that they are only run once. They increment a counter,
# so we don't want it to increment per rcpt to.
<%- end -%>
# Defer after too many bad RCPT TO's. Legit MTAs will retry later.
- # This is a rough pass at preventing addres harvesting or other mail blasts.
+ # This is a rough pass at preventing address harvesting or other mail blasts.
defer log_message = Too many bad recipients ${eval:$rcpt_fail_count} out of $rcpt_count
message = Too many bad recipients, try again later
deny domains = !+handled_domains
local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
-# forwards mail to @d.o address, even if it's a bounce from master, no reply
-# from source address; rejecting all mail now.
- deny recipients = mendoza@debian.org
- hosts = 65.110.39.147 : 64.39.31.15
- message = <mendoza@kenny.linuxsis.net> cannot forward here while mailer-daemon mail is not caught
-
deny condition = ${lookup{$sender_address_local_part}lsearch{/etc/exim4/localusers}{true}}
sender_domains= +local_domains
hosts = !+debianhosts
# sadly. etch's version attempts to hold the socket open, since that's what
# postfix expects. Exim, on the other hand, expects the remote side to close
# the socket when it's finished sending data, so it see each transaction as
- # an incomplete read. I'm sure there's a way we could force exim to do
+ # an incomplete read. I'm sure there's a way we could force Exim to do
# something sick and clever to force either the interpretation or the socket
# closure, but I'm fairly sure it's now worth it, since the backport of
# policyd-weight is trivial.
accept local_parts = +postmasterish
domains = +virtual_domains : +bsmtp_domains
-<%- if scope.lookupvar('site::nodeinfo')['smarthost'].empty? -%>
+<%- unless @use_smarthost -%>
deny message = host $sender_host_address is listed in $dnslist_domain; see $dnslist_text
dnslists = ${if match_domain{$domain}{+virtual_domains}\
{${if exists {${extract{directory}{VDOMAINDATA}{${value}/rbllist}}}\
domains = +handled_domains
!hosts = +debianhosts : WHITELIST
-<%- if scope.lookupvar('site::nodeinfo')['smarthost'].empty? -%>
+<%- unless @use_smarthost -%>
deny domains = +handled_domains
local_parts = ${if match_domain{$domain}{+virtual_domains}\
{${if exists {${extract{directory}{VDOMAINDATA}{${value}/callout_users}}}\
deny message = relay not permitted
-<%- if scope.lookupvar('site::nodeinfo').has_key?('heavy_exim') and scope.lookupvar('site::nodeinfo')['heavy_exim'] -%>
+<%- if @heavy -%>
acl_check_mime:
accept verify = certificate
#!!# ACL that is used after the DATA command
check_message:
- # Some people put from hostmaster@something.debian.org in the From
+ # Some people put from postmaster@something.debian.org in the From
# header. Take their crack pipe away.
drop condition = ${if match{${lc:$h_From:}}{\Npostmaster@([^.]+\.)?debian\.org\N}}
<%- end -%>
<%- if @is_packagesqamaster -%>
- deny !hosts = +debianhosts : 5.153.231.21
+ deny !hosts = +debianhosts
condition = ${if eq {$acl_m_prf}{PTSMail}}
condition = ${if def:h_X-PTS-Approved:{false}{true}}
message = messages to the PTS require an X-PTS-Approved header
message = X-malware detected: $malware_name
<%- end -%>
-<%- if scope.lookupvar('site::nodeinfo').has_key?('heavy_exim') and scope.lookupvar('site::nodeinfo')['heavy_exim'] -%>
+<%- if @heavy -%>
discard condition = ${if <{$message_size}{256000}}
condition = ${if eq {$acl_m_prf}{blackhole}}
set acl_m_srb = ${perl{surblspamcheck}}
*@debian.org ${lookup{$1}cdb{/var/lib/misc/${primary_hostname}/mail-forward.cdb}{$value}fail} T
*@people.debian.org ${lookup{$1}cdb{/var/lib/misc/${primary_hostname}/mail-forward.cdb}{$value}fail} T
#*@${primary_hostname} "${if exists{/etc/exim4/email-addresses}{${lookup{$1}lsearch{/etc/exim4/email-addresses}{$value}fail}}fail}" fFs
-m68k@buildd.debian.org m68k-build@nocrew.org Ttrbc
#!!#######################################################!!#
transport = remote_smtp
ignore_target_hosts = +reservedaddrs
-<%=
-out = ""
-if not scope.lookupvar('site::nodeinfo')['smarthost'].empty?
-out = "
+<%- if @use_smarthost -%>
smarthost:
- debug_print = \"R: smarthost for $local_part@$domain\"
+ debug_print = "R: smarthost for $local_part@$domain"
driver = manualroute
domains = !+handled_domains
transport = remote_smtp_smarthost
- route_list = * #{scope.lookupvar('site::nodeinfo')['smarthost']}
+ route_list = * <%= @smarthost %>
host_find_failed = defer
same_domain_copy_routing = yes
no_more
-"
-end
-out
-%>
+<%- end -%>
# This router routes to remote hosts over SMTP using a DNS lookup.
# Ignore reserved network responses, including localhost.
# current one gets passed on instead. This covers the case where A is
# aliased to B and B has a .forward file pointing to A.
-# For standard debian setup of one group per user, it is acceptable---normal
+# For standard Debian setup of one group per user, it is acceptable---normal
# even---for .forward to be group writable. If you have everyone in one
-# group, you should comment out the "modemask" line. Without it, the exim
+# group, you should comment out the "modemask" line. Without it, the Exim
# default of 022 will apply, which is probably what you want.
userforward_verify:
router_home_directory = ${lookup passwd{$local_part}{${extract{5}{:}{$value}}}fail}
verify_only
-# This is a senmailesque alias file lookup
+# This is a sendmailesque alias file lookup
virt_aliases:
debug_print = "R: virt_aliases for $local_part@$domain"
driver = redirect
headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?i)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}"
<%- end -%>
-# exim4 fails the router if it can't change to the user/group for delivery
-# during verification. So we have to seperate the cases of verifying
+# Exim fails the router if it can't change to the user/group for delivery
+# during verification. So we have to separate the cases of verifying
# the virts, and delivering to them. blah.
virt_direct_verify:
begin transports
-# This transport is used for local delivery to user mailboxes. On debian
+# This transport is used for local delivery to user mailboxes. On Debian
# systems group mail is used so we can write to the /var/mail
# directory. (The alternative, which most other unixes use, is to deliver
# as the user's own group, into a sticky-bitted directory)
tls_certificate = /etc/exim4/ssl/thishost.crt
tls_privatekey = /etc/exim4/ssl/thishost.key
-<%=
-out = ""
-if not scope.lookupvar('site::nodeinfo')['smarthost'].empty?
-out = '
+<%- if @use_smarthost -%>
remote_smtp_smarthost:
debug_print = "T: remote_smtp_smarthost for $local_part@$domain"
driver = smtp
delay_after_cutoff = false
- port = '
- out += scope.lookupvar('site::nodeinfo')['smarthost_port'].to_s + "\n"
- out += ' tls_tempfail_tryclear = false
- hosts_require_tls = ' + scope.lookupvar('site::nodeinfo')['smarthost'] + '
+ port = <%= @smarthost_port %>
+ tls_tempfail_tryclear = false
+ hosts_require_tls = <%= @smarthost %>
tls_certificate = /etc/exim4/ssl/thishost.crt
tls_privatekey = /etc/exim4/ssl/thishost.key
-'
-end
-out
-%>
+<%- end -%>
# Send the message to procmail
procmail_pipe:
driver = pipe
projects / mirror / dsa-puppet.git / blobdiff