X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fexim%2Ftemplates%2Feximconf.erb;h=0bfe9bdc83bb18697355ff5377572899ae41c2cd;hb=b5249bd3292990afe0418a45410101dead763153;hp=0dcf064749ea09d985a2a48f32a518cb1f961d93;hpb=51240803ddfc669caf6e522192a6eed81a600b38;p=mirror%2Fdsa-puppet.git diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb index 0dcf06474..0bfe9bdc8 100644 --- a/modules/exim/templates/eximconf.erb +++ b/modules/exim/templates/eximconf.erb @@ -35,6 +35,7 @@ # us. This is primarily only usefull for emergancy 'queue # flushing' operations, but should be populated with a list # of trusted machines. Wildcards are not permitted +# bsmtp_domains - Domains that we deliver locally via bsmtp <%= out = "" if nodeinfo['mailrelay'] @@ -131,10 +132,14 @@ domainlist virtual_domains = partial-lsearch;/etc/exim4/virtualdomains domainlist submission_domains = ${if exists {/etc/exim4/submission-domains}{/etc/exim4/submission-domains}{}} -domainlist handled_domains = +local_domains : +virtual_domains +domainlist bsmtp_domains = ${if exists {/etc/exim4/bsmtp}{partial-lsearch;/etc/exim4/bsmtp}{}} + +domainlist handled_domains = +local_domains : +virtual_domains : +bsmtp_domains localpartlist local_only_users = lsearch;/etc/exim4/localusers +localpartlist postmasterish = postmaster : abuse : hostmaster : root + # Domains we relay for; that is domains that aren't considered local but we # accept mail for them. domainlist rcpthosts = partial-lsearch;/etc/exim4/rcpthosts @@ -193,10 +198,16 @@ timeout_frozen_after=14d message_size_limit = 100M message_logs = false -smtp_accept_max = 300 smtp_accept_max_per_host = ${if match_ip {$sender_host_address}{+debianhosts}{0}{7}} +<% if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? %> +smtp_accept_max = 300 smtp_accept_queue = 200 smtp_accept_queue_per_connection = 50 +<% else %> +smtp_accept_max = 30 +smtp_accept_queue = 20 +smtp_accept_queue_per_connection = 10 +<% end %> smtp_accept_reserve = 25 smtp_reserve_hosts = +debianhosts @@ -206,9 +217,15 @@ check_spool_space = 20M delay_warning = +<% if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? %> queue_run_max = 50 deliver_queue_load_max = 50 queue_only_load = 15 +<% else %> +queue_run_max = 5 +deliver_queue_load_max = 10 +queue_only_load = 5 +<% end %> queue_list_requires_admin = false <%= out = "" @@ -312,7 +329,7 @@ end out %> <%= -out = "" +out = '' if nodeinfo['packagesmaster'] out = ' warn domains = packages.debian.org @@ -324,6 +341,7 @@ end out %> <%= +out = '' if nodeinfo['packagesqamaster'] out=' warn recipients = owner@packages.qa.debian.org : postmaster@packages.qa.debian.org @@ -351,6 +369,34 @@ out accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}} + warn domains = +virtual_domains + condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction}}}} + condition = ${if eq{${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction}}}{$value}{}}}{markup}} + log_message = $local_part@$domain: markup + set acl_m_rprf = markup + + accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}} + + warn condition = ${if eq{${lookup{$local_part}cdb{/var/lib/misc/${primary_hostname}/mail-contentinspectionaction.cdb}{$value}{}}}{markup}} + log_message = $local_part@$domain: markup + set acl_m_rprf = markup + + accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}} + + warn condition = ${if eq{${lookup{$local_part}cdb{/var/lib/misc/${primary_hostname}/mail-contentinspectionaction.cdb}{$value}{}}}{blackhole}} + log_message = $local_part@$domain: blackhole + set acl_m_rprf = blackhole + + accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}} + + warn domains = +virtual_domains + condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction}}}} + condition = ${if eq{${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction}}}{$value}{}}}{blackhole}} + log_message = $local_part@$domain: blackhole + set acl_m_rprf = blackhole + + accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}} + warn set acl_m_rprf = normal accept @@ -609,12 +655,22 @@ out=' end out %> - +<%= +out='' +if nodeinfo['packagesmaster'] + out=' + warn condition = ${if eq {$acl_m_prf}{PackagesMail}} + condition = ${if eq {$sender_address}{$local_part@$domain}} + message = X-Packages-FromTo-Same: yes +' +end +out +%> deny condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} !verify = sender defer !hosts = +debianhosts - condition = ${if >{${eval:$acl_c_scr}}{0}} + condition = ${if >{${eval:$acl_c_scr+0}}{0}} ratelimit = 10 / 60m / per_rcpt / $sender_host_address message = slow down (no reverse dns, mismatched ehlo, dialup, or in blacklists) <%= @@ -763,9 +819,13 @@ end out %> - accept local_parts = postmaster + accept local_parts = +postmasterish domains = +handled_domains : +rcpthosts + deny hosts = ${if exists{/etc/exim4/host_blacklist}{/etc/exim4/host_blacklist}{}} + message = I'm terribly sorry, but it seems you have been blacklisted + log_message = blacklisted IP + deny log_message = <$sender_address> is blacklisted senders = ${if exists{/etc/exim4/blacklist}{/etc/exim4/blacklist}{}} message = We have blacklisted <$sender_address>. Please stop mailing us @@ -831,6 +891,20 @@ if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? out=' acl_check_mime: + discard condition = ${if <{$message_size}{256000}} + condition = ${if eq {$acl_m_prf}{blackhole}} + set acl_m_srb = ${perl{surblspamcheck}} + condition = ${if eq{$acl_m_srb}{false}{no}{yes}} + log_message = discarded surbl message for $recipients + + warn condition = ${if <{$message_size}{256000}} + condition = ${if eq {$acl_m_prf}{markup}} + set acl_m_srb = ${perl{surblspamcheck}} + condition = ${if eq{$acl_m_srb}{false}{no}{yes}} + message = X-Surbl-Hit: $primary_hostname: $acl_m_srb + + accept condition = ${if eq {$acl_m_prf}{markup}} + deny condition = ${if <{$message_size}{256000}} set acl_m_srb = ${perl{surblspamcheck}} condition = ${if eq{$acl_m_srb}{false}{no}{yes}} @@ -844,7 +918,7 @@ out %> acl_check_predata: - deny condition = ${if eq{$acl_m_lcl}{localonly}} + deny condition = ${if eq{$acl_m_prf}{localonly}} message = mail for $acl_m_lrc is only accepted internally accept @@ -852,9 +926,6 @@ acl_check_predata: #!!# ACL that is used after the DATA command check_message: - require verify = header_syntax - message = Invalid syntax in the header - <%= out='' if nodeinfo['rtmaster'] @@ -880,9 +951,6 @@ if nodeinfo['packagesqamaster'] end out %> - deny condition = ${if match {$message_body}{\Nhttp:\/\/[a-z\.-]+\/video1?.exe\N}} - message = Blackisted URI found in body - deny condition = ${if eq {$acl_m_prf}{DBSignedMail}} condition = ${if and {{!match {$message_body}{PGP MESSAGE}} \ {!match {$message_body}{PGP SIGNED MESSAGE}} \ @@ -893,6 +961,11 @@ out } message = Mail to this address needs to be PGP-signed + accept verify = certificate + + require verify = header_syntax + message = Invalid syntax in the header + # RFC 822 and 2822 say that headers must be ASCII. This kinda emulates # postfix's strict_7bit_headers option, but only checks a few common problem # headers, as there doesn't appear to be an easy way to check them all. @@ -911,10 +984,20 @@ out out = "" if has_variable?("clamd") && clamd == "true" out = ' - deny + discard condition = ${if eq {$acl_m_prf}{blackhole}} + demime = * + malware = */defer_ok + log_message = discarded malware message for $recipients + + deny condition = ${if eq {$acl_m_prf}{markup}{no}{yes}} demime = * malware = */defer_ok message = malware detected: $malware_name: message rejected + + warn condition = ${if eq {$acl_m_prf}{markup}} + demime = * + malware = */defer_ok + message = X-malware detected: $malware_name ' end out @@ -923,6 +1006,20 @@ out out='' if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? out=' + discard condition = ${if <{$message_size}{256000}} + condition = ${if eq {$acl_m_prf}{blackhole}} + set acl_m_srb = ${perl{surblspamcheck}} + condition = ${if eq{$acl_m_srb}{false}{no}{yes}} + log_message = discarded surbl message for $recipients + + warn condition = ${if <{$message_size}{256000}} + condition = ${if eq {$acl_m_prf}{markup}} + set acl_m_srb = ${perl{surblspamcheck}} + condition = ${if eq{$acl_m_srb}{false}{no}{yes}} + message = X-Surbl-Hit: $primary_hostname: $acl_m_srb + + accept condition = ${if eq {$acl_m_prf}{markup}} + deny condition = ${if <{$message_size}{256000}} set acl_m_srb = ${perl{surblspamcheck}} condition = ${if eq{$acl_m_srb}{false}{no}{yes}} @@ -949,7 +1046,7 @@ if nodeinfo['packagesmaster'] !hosts = +debianhosts condition = ${if <{$message_size}{256000}} spam = pkg_user : true - condition = ${if >{$spam_score_int}{65}} + condition = ${if >{$spam_score_int}{59}} ' end out @@ -1009,7 +1106,7 @@ out bsmtp: debug_print = "R: bsmtp for $local_part@$domain" driver = manualroute - domains = !+local_domains + domains = +bsmtp_domains require_files = /etc/exim4/bsmtp route_list = * ${extract{file}{\ ${lookup{$domain}partial-lsearch{/etc/exim4/bsmtp}\ @@ -1054,6 +1151,17 @@ dnslookup: ignore_target_hosts = +reservedaddrs no_more +postmasterish: + debug_print = "R: postmasterish for $local_part@$domain" + driver = redirect + verify = false + unseen = true + expn = true + local_parts = +postmasterish + domains = +handled_domains + data = debian-admin@debian.org + headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}" + # This router handles aliasing using a traditional /etc/aliases file. # If any of your aliases expand to pipes or files, you will need to set # up a user and a group for these deliveries to run under. You can do @@ -1567,7 +1675,6 @@ out begin retry debian.org * F,2h,10m; G,16h,2h,1.5; F,14d,8h -* * senders=: F,2h,10m * rcpt_4xx F,2h,5m; F,4h,10m; F,4d,15m * * F,2h,15m; G,16h,2h,1.5; F,4d,8h