X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fexim%2Ftemplates%2Feximconf.erb;h=16516ac7188bdf4bdb653c2ede389eb5e4830c05;hb=3e4f1b98fe7e14837b9d5ae23dfd41adc302d001;hp=10038ade479680e123e5f9fb057cf7cd6950d24a;hpb=4525f6c21ab0a6d9ab7f77e792296ae42c510918;p=mirror%2Fdsa-puppet.git

diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb
index 10038ade4..16516ac71 100644
--- a/modules/exim/templates/eximconf.erb
+++ b/modules/exim/templates/eximconf.erb
@@ -266,6 +266,7 @@ tls_advertise_hosts = *
 smtp_enforce_sync = true
 
 log_selector = \
+               +subject \
                +tls_cipher \
                +tls_peerdn \
                +queue_time \
@@ -601,6 +602,14 @@ check_recipient:
           message       = Different profile, please retry
           log_message   = Only one profile at a time, please
 
+  # Set a flag to indicate whether the current recipient
+  # has explicitly requested greylisting
+  warn    set acl_m_grey_recip = 0
+
+  warn    local_parts          = GREYLIST_LOCAL_PARTS
+          domains              = +handled_domains
+          set acl_m_grey_recip = 1
+
   # Defer after too many bad RCPT TO's.  Legit MTAs will retry later.
   # This is a rough pass at preventing address harvesting or other mail blasts.
 
@@ -692,6 +701,12 @@ check_recipient:
           condition     = ${lookup{$sender_address_local_part}lsearch{${extract{directory}{VSENDERDOMAINDATA}{${value}/neversenders}}}{true}}
 	  message       = no mail should ever come from <$sender_address>
 
+  deny    domains       = +virtual_domains
+          senders       = :
+          condition     = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/neversenders}}}}
+          condition     = ${lookup{$local_part}lsearch{${extract{directory}{VDOMAINDATA}{${value}/neversenders}}}{true}}
+          message       = <$local_part@$domain> does not send mail; rejecting bogus NDR
+
   warn    condition     = ${if eq{$acl_m_prf}{localonly}}
           set acl_m_lrc = ${if eq{$acl_m_lrc}{}{$local_part@$domain}{$acl_m_lrc, $local_part@$domain}}
 
@@ -781,13 +796,18 @@ check_recipient:
   defer
     message  = $sender_host_address is not yet authorized to deliver mail from <$sender_address> to <$local_part@$domain>.
     log_message = greylisted.
-    local_parts    = GREYLIST_LOCAL_PARTS
+    condition      = ${if or { \
+                                 {eq{$acl_m_grey_recip}{1}} \
+                                 {bool_lax{HAS_DEFAULT_OPTIONS}} \
+                             } \
+                      }
     !senders       = :
     !hosts         = : +debianhosts : WHITELIST : \
                      ${if exists {/etc/greylistd/whitelist-hosts}\
                                  {/etc/greylistd/whitelist-hosts}{}} : \
                      ${if exists {/var/lib/greylistd/whitelist-hosts}\
                                  {/var/lib/greylistd/whitelist-hosts}{}} 
+    !dnslists      = list.dnswl.org&0.0.0.3
     condition      = ${if !eq {$acl_m_prf}{PopconMail}}
     !authenticated = *
     domains        = +handled_domains
@@ -804,6 +824,7 @@ check_recipient:
   warn
     !senders       = :
     !hosts         = : +debianhosts : WHITELIST
+    !dnslists      = list.dnswl.org&0.0.0.3
     condition      = ${if !eq {$acl_m_prf}{PopconMail}}
     condition      = ${if ! def:acl_m_grey}
     set acl_m_grey = $pid.$tod_epoch.$sender_host_port
@@ -812,10 +833,15 @@ check_recipient:
   defer
     !senders       = :
     !hosts         = : +debianhosts : WHITELIST
+    !dnslists      = list.dnswl.org&0.0.0.3
     condition      = ${if !eq {$acl_m_prf}{PopconMail}}
     !authenticated = *
     domains        = +handled_domains
-    local_parts    = GREYLIST_LOCAL_PARTS
+    condition      = ${if or { \
+                                 {eq{$acl_m_grey_recip}{1}} \
+                                 {bool_lax{HAS_DEFAULT_OPTIONS}} \
+                             } \
+                      }
     set acl_m_pgr  = request=smtpd_access_policy\n\
                      protocol_state=RCPT\n\
                      protocol_name=${uc:$received_protocol}\n\
@@ -837,10 +863,15 @@ check_recipient:
  warn
     !senders       = :
     !hosts         = : +debianhosts : WHITELIST
+    !dnslists      = list.dnswl.org&0.0.0.3
     condition      = ${if !eq {$acl_m_prf}{PopconMail}}
     !authenticated = *
     domains        = +handled_domains
-    local_parts    = GREYLIST_LOCAL_PARTS
+    condition      = ${if or { \
+                                 {eq{$acl_m_grey_recip}{1}} \
+                                 {bool_lax{HAS_DEFAULT_OPTIONS}} \
+                             } \
+                      }
     condition      = ${if eq{${uc:${substr_0_7:$acl_m_pgr}}}{PREPEND}}
     message        = ${sg{$acl_m_pgr}{\N^\w+\s*\N}{}}
 
@@ -857,7 +888,7 @@ check_recipient:
           domains       = +virtual_domains : +bsmtp_domains
 
 <%- unless @use_smarthost -%>
-  deny    message  = host $sender_host_address is listed in $dnslist_domain; see $dnslist_text
+  deny    message  = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
           dnslists = ${if match_domain{$domain}{+virtual_domains}\
 		     {${if exists {${extract{directory}{VDOMAINDATA}{${value}/rbllist}}}\
 		     {${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/rbllist}}}{$value}{}}}{}}}\
@@ -866,13 +897,19 @@ check_recipient:
 	  domains       = +handled_domains
 	  !hosts        = +debianhosts : WHITELIST
 
-  deny    message  = host $sender_host_address is listed in $dnslist_domain; see $dnslist_text
+  deny    message  = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
           dnslists = noserver.dnsbl.sorbs.net
           domains  = +handled_domains
           !hosts   = +debianhosts : WHITELIST
 
+  deny    message   = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
+          condition = ${if bool_lax{HAS_DEFAULT_OPTIONS}}
+          dnslists  = relays.dnsbl.sorbs.net : xbl.spamhaus.org
+          domains   = +handled_domains
+          !hosts    = +debianhosts : WHITELIST
+
 <%- end -%>
-  deny    message  = domain $sender_address_domain is listed in $dnslist_domain; see $dnslist_text
+  deny    message  = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
           dnslists = ${if match_domain{$domain}{+virtual_domains}\
 		     {${if exists {${extract{directory}{VDOMAINDATA}{${value}/rhsbllist}}}\
 		     {${expand:${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/rhsbllist}}}{$value}{}}}}{}}}\
@@ -881,11 +918,17 @@ check_recipient:
 	  domains       = +handled_domains
 	  !hosts        = +debianhosts : WHITELIST
 
-  deny    message  = domain $sender_address_domain is listed in $dnslist_domain; see $dnslist_text
+  deny    message  = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
           dnslists = nomail.rhsbl.sorbs.net/$sender_address_domain
           domains  = +handled_domains
           !hosts   = +debianhosts : WHITELIST
 
+  deny    message   = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
+          condition = ${if bool_lax{HAS_DEFAULT_OPTIONS}}
+          dnslists  = dbl.spamhaus.org/$sender_address_domain
+          domains   = +handled_domains
+          !hosts    = +debianhosts : WHITELIST
+
 <%- unless @use_smarthost -%>
   deny    domains  = +handled_domains
           local_parts = ${if match_domain{$domain}{+virtual_domains}\