X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;ds=sidebyside;f=modules%2Fexim%2Ftemplates%2Feximconf.erb;h=6398331cb22af3b3c542ca6fbf0e3ffe34e9dfc0;hb=aac6cc661fa82e19aebf81f27a59b6b068ff5859;hp=1441c9b6a67c66c1a3a07954192c5d40c883bf43;hpb=c888c37605afc9df975cb77e237a054af392163a;p=mirror%2Fdsa-puppet.git
diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb
index 1441c9b6a..6398331cb 100644
--- a/modules/exim/templates/eximconf.erb
+++ b/modules/exim/templates/eximconf.erb
@@ -107,7 +107,7 @@ allow_domain_literals = true
# local_domains. It will be referenced
# later on by the syntax "+local_domains".
# Other domain and host lists may follow.
-# @ is the local FQDN, @[] matches the IP adress of any local interface.
+# @ is the local FQDN, @[] matches the IP address of any local interface.
domainlist local_domains = @ : \
@[] : \
@@ -810,7 +810,7 @@ check_recipient:
log_message = greylisted.
condition = ${if or { \
{eq{$acl_m_grey_recip}{1}} \
- {bool_lax{HAS_DEFAULT_OPTIONS}} \
+ {bool_lax{$acl_m_defopt}} \
} \
}
!senders = :
@@ -851,7 +851,7 @@ check_recipient:
domains = +handled_domains
condition = ${if or { \
{eq{$acl_m_grey_recip}{1}} \
- {bool_lax{HAS_DEFAULT_OPTIONS}} \
+ {bool_lax{$acl_m_defopt}} \
} \
}
set acl_m_pgr = request=smtpd_access_policy\n\
@@ -881,7 +881,7 @@ check_recipient:
domains = +handled_domains
condition = ${if or { \
{eq{$acl_m_grey_recip}{1}} \
- {bool_lax{HAS_DEFAULT_OPTIONS}} \
+ {bool_lax{$acl_m_defopt}} \
} \
}
condition = ${if eq{${uc:${substr_0_7:$acl_m_pgr}}}{PREPEND}}
@@ -900,46 +900,46 @@ check_recipient:
domains = +virtual_domains : +bsmtp_domains
<%- unless @use_smarthost -%>
- deny message = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
+ deny message = host $sender_host_address is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
+ domains = +handled_domains
+ !hosts = +debianhosts : WHITELIST
dnslists = ${if match_domain{$domain}{+virtual_domains}\
{${if exists {${extract{directory}{VDOMAINDATA}{${value}/rbllist}}}\
{${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/rbllist}}}{$value}{}}}{}}}\
{${lookup{$local_part}lsearch{/etc/exim4/rbllist}{$value}{}}}} : \
${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-rbl}{$value}{}}
- domains = +handled_domains
- !hosts = +debianhosts : WHITELIST
- deny message = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
- dnslists = noserver.dnsbl.sorbs.net
+ deny message = host $sender_host_address is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
domains = +handled_domains
!hosts = +debianhosts : WHITELIST
+ dnslists = noserver.dnsbl.sorbs.net
- deny message = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
- condition = ${if bool_lax{HAS_DEFAULT_OPTIONS}}
- dnslists = relays.dnsbl.sorbs.net : xbl.spamhaus.org
+ deny message = host $sender_host_address is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
+ condition = ${if bool_lax{$acl_m_defopt}}
domains = +handled_domains
!hosts = +debianhosts : WHITELIST
+ dnslists = relays.dnsbl.sorbs.net : xbl.spamhaus.org
<%- end -%>
- deny message = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
+ deny message = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
+ domains = +handled_domains
+ !hosts = +debianhosts : WHITELIST
dnslists = ${if match_domain{$domain}{+virtual_domains}\
{${if exists {${extract{directory}{VDOMAINDATA}{${value}/rhsbllist}}}\
{${expand:${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/rhsbllist}}}{$value}{}}}}{}}}\
{${expand:${lookup{$local_part}lsearch{/etc/exim4/rhsbllist}{$value}{}}}}} : \
${expand:${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-rhsbl}{$value}{}}}
- domains = +handled_domains
- !hosts = +debianhosts : WHITELIST
- deny message = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
- dnslists = nomail.rhsbl.sorbs.net/$sender_address_domain
+ deny message = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
domains = +handled_domains
!hosts = +debianhosts : WHITELIST
+ dnslists = nomail.rhsbl.sorbs.net/$sender_address_domain
- deny message = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
- condition = ${if bool_lax{HAS_DEFAULT_OPTIONS}}
- dnslists = dbl.spamhaus.org/$sender_address_domain
+ deny message = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
+ condition = ${if bool_lax{$acl_m_defopt}}
domains = +handled_domains
!hosts = +debianhosts : WHITELIST
+ dnslists = dbl.spamhaus.org/$sender_address_domain
<%- unless @use_smarthost -%>
deny domains = +handled_domains
@@ -1020,6 +1020,10 @@ check_message:
# header. Take their crack pipe away.
drop condition = ${if match{${lc:$h_From:}}{\Npostmaster@([^.]+\.)?debian\.org\N}}
+ # If the sending system says the mail is spam, believe them
+ deny condition = ${if eqi {$h_X-Spam-Status:}{YES}}
+ message = Incoming spam flags
+
<%- if @is_rtmaster -%>
deny condition = ${if eq {$acl_m_prf}{RTMail}}
condition = ${if and{{!match {${lc:$rh_Subject:}} {debian rt}} \
@@ -1056,7 +1060,7 @@ check_message:
# postfix's strict_7bit_headers option, but only checks a few common problem
# headers, as there doesn't appear to be an easy way to check them all.
deny
- condition = ${if or {{match {$rh_Subject:}{[\200-\377]}}\
+ condition = ${if or {{match {$rh_Subject:}{[\200-\377]}}\
{match {$rh_To:}{[\200-\377]}}\
{match {$rh_From:}{[\200-\377]}}\
{match {$rh_Cc:}{[\200-\377]}}}}
@@ -1068,28 +1072,31 @@ check_message:
condition = ${if !eq {$acl_m_prf}{PopconMail}}
message = Your mailer is not RFC 2047 compliant: message rejected
- discard condition = ${if eq {$acl_m_prf}{blackhole}}
- condition = ${if bool_lax{$acl_m_defopt}}
+ deny condition = ${if match {$rh_Received:}{\N from [^ ]+\.example\.com \N}}
+ log_message = Implausible Received header
+ message = Header problem: message rejected
+
+ warn condition = ${if bool_lax{$acl_m_defopt}}
condition = ${if or {\
{match {$message_body}{Wenn Sie zukünftig keine weiteren Informationen erhalten möchten,
unwissentlich oder unbeabsichtigt in den Verteiler aufgenommen wurden,}} \
+ {match {$message_body}{\N(?i)Dear Beneficiary.*You have been selected.*Thousand United States Dollars\N}} \
+ {match {$message_body}{\N(?i)receiving sum of money into your account for safe keeping\N}} \
+ {match {$message_body}{\N(?i)I got your e-mail address through an internet marketing firm\N}} \
+ {match {$message_body}{\N(?i)De conformidad con lo establecido en la Ley 34/2002 Lssice le comunicamos que este escrito procede de Search Task\N}} \
}\
}
+ set acl_m_content = 1
+
+ discard condition = ${if eq {$acl_m_prf}{blackhole}}
+ condition = ${if eq {$acl_m_content}{1}}
log_message = Discarded suspicious content for $recipients
deny condition = ${if !eq {$acl_m_prf}{markup}}
- condition = ${if bool_lax{$acl_m_defopt}}
- condition = ${if or {\
- {match {$message_body}{Wenn Sie zukünftig keine weiteren Informationen erhalten möchten,
unwissentlich oder unbeabsichtigt in den Verteiler aufgenommen wurden,}} \
- }\
- }
+ condition = ${if eq {$acl_m_content}{1}}
message = Rejected due to suspicious content
warn condition = ${if eq {$acl_m_prf}{markup}}
- condition = ${if bool_lax{$acl_m_defopt}}
- condition = ${if or {\
- {match {$message_body}{Wenn Sie zukünftig keine weiteren Informationen erhalten möchten,
unwissentlich oder unbeabsichtigt in den Verteiler aufgenommen wurden,}} \
- }\
- }
+ condition = ${if eq {$acl_m_content}{1}}
add_header = X-debian-content-warning: yes
<%- if has_variable?("clamd") && @clamd -%>