X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fexim%2Ftemplates%2Feximconf.erb;h=26727a34b9266be7224ea924f089e43b4c22f3a2;hb=326750ee6caa3feb06ac4f16412cc07edf94bce1;hp=57067c6f75f3b51fdc21ca498d10d1bdb29971f8;hpb=2b9cbadfcb9b2f3b9a59f2920037985e80be65af;p=mirror%2Fdsa-puppet.git diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb index 57067c6f7..26727a34b 100644 --- a/modules/exim/templates/eximconf.erb +++ b/modules/exim/templates/eximconf.erb @@ -203,12 +203,13 @@ smtp_accept_max_per_host = ${if match_ip {$sender_host_address}{+debianhosts}{0} smtp_accept_max = 300 smtp_accept_queue = 200 smtp_accept_queue_per_connection = 50 +smtp_accept_reserve = 25 <% else %> smtp_accept_max = 30 smtp_accept_queue = 20 smtp_accept_queue_per_connection = 10 +smtp_accept_reserve = 5 <% end %> -smtp_accept_reserve = 25 smtp_reserve_hosts = +debianhosts split_spool_directory = true @@ -555,10 +556,18 @@ end out %> + warn acl = acl_getprofile + condition = ${if eq{$acl_m_prf}{}} + set acl_m_prf = $acl_m_rprf + + defer condition = ${if eq{$acl_m_prf}{$acl_m_rprf}{no}{yes}} + log_message = Only one profile at a time, please + # Defer after too many bad RCPT TO's. Legit MTAs will retry later. # This is a rough pass at preventing addres harvesting or other mail blasts. defer log_message = Too many bad recipients ${eval:$rcpt_fail_count} out of $rcpt_count + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} message = Too many bad recipients, try again later !hosts = +debianhosts condition = ${if > {${eval:$rcpt_fail_count}}{3}{yes}{no}} @@ -566,12 +575,14 @@ out # Dump spambots that are so stupid they say helo as our IP address drop !hosts = +debianhosts + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} condition = ${if eq {$sender_helo_name}{$interface_address}{yes}{no}} message = HELO mismatch Forged HELO for ($sender_helo_name) # Also for spambots that say helo as us or one of our domains drop !hosts = +debianhosts + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} condition = ${if match_domain{$sender_helo_name}{$primary_hostname:+handled_domains}} condition = ${if !match{$sender_host_name}{${rxquote:$sender_helo_name}\N$\N}} message = HELO mismatch Forged HELO for ($sender_helo_name) @@ -586,6 +597,7 @@ out # say helo as a name in the list but we can't look them up defer !hosts = +debianhosts + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} condition = ${if eq{$acl_m_frg}{}{no}{yes}} condition = ${if eq{$sender_host_name}{}{yes}{no}} condition = ${if eq{$host_lookup_failed}{1}{no}{yes}} @@ -594,6 +606,7 @@ out # If DNS works, go ahead and reject them drop !hosts = +debianhosts + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} condition = ${if and { {!eq{$acl_m_frg}{}}{!match{$sender_host_name}{${rxquote:$acl_m_frg}\N$\N}}}{yes}{no}} message = HELO mismatch Forged HELO for ($sender_helo_name) @@ -634,13 +647,6 @@ out condition = ${if match_local_part {$sender_address_local_part}{${extract{directory}{VDOMAINDATA}{${value}/neversenders}}}{1}{0}} message = no mail should ever come from <$sender_address> - warn acl = acl_getprofile - condition = ${if eq{$acl_m_prf}{}} - set acl_m_prf = $acl_m_rprf - - defer condition = ${if eq{$acl_m_prf}{$acl_m_rprf}{no}{yes}} - log_message = Only one profile at a time, please - warn condition = ${if eq{$acl_m_prf}{localonly}} set acl_m_lrc = ${if eq{$acl_m_lrc}{}{$local_part@$domain}{$acl_m_lrc, $local_part@$domain}} @@ -670,6 +676,7 @@ out !verify = sender defer !hosts = +debianhosts + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} condition = ${if >{${eval:$acl_c_scr+0}}{0}} ratelimit = 10 / 60m / per_rcpt / $sender_host_address message = slow down (no reverse dns, mismatched ehlo, dialup, or in blacklists) @@ -686,6 +693,7 @@ out = ' # closure, but I\'m fairly sure it\'s now worth it, since the backport of # policyd-weight is trivial. warn !hosts = +debianhosts + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} set acl_m_pw = ${readsocket{inet:127.0.0.1:12525}\ {request=smtpd_access_policy\n\ protocol_state=RCPT\n\ @@ -703,31 +711,37 @@ out = ' # Defer on socket error defer !hosts = +debianhosts + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} condition = ${if eq{$acl_m_pw}{socket failure}{yes}{no}} message = Cannot connect to policyd-weight. Please try again later. # Set proposed action to $acl_m_act and message to $acl_m_mes warn !hosts = +debianhosts + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} set acl_m_mes = ${extract{action}{$acl_m_pw}} set acl_m_act = ${sg{$acl_m_pw}{\Naction=[^ ]+ (.*)\n\n\N}{\$1}} # Add X-policyd-weight header line to message warn !hosts = +debianhosts + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} message = $acl_m_mes condition = ${if eq{$acl_m_act}{PREPEND}{yes}{no}} # Write log message, if policyd-weight can\'t run checks warn !hosts = +debianhosts + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} log_message = policyd-weight message: $acl_m_mes condition = ${if eq{$acl_m_act}{DUNNO}{yes}{no}} # Deny mails which policyd-weight thinks are spam deny !hosts = +debianhosts + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} message = policyd-weight said: $acl_m_mes condition = ${if eq{$acl_m_act}{550}{yes}{no}} # Defer messages when policyd-weight suggests so. defer !hosts = +debianhosts + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} message = policyd-weight said: $acl_m_mes condition = ${if eq{$acl_m_act}{450}{yes}{no}} ' @@ -762,6 +776,7 @@ if has_variable?("greylistd") && greylistd == "true" {/etc/greylistd/whitelist-hosts}{}} : \ ${if exists {/var/lib/greylistd/whitelist-hosts}\ {/var/lib/greylistd/whitelist-hosts}{}} + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} !authenticated = * domains = +handled_domains : +rcpthosts condition = ${readsocket{/var/run/greylistd/socket}\ @@ -778,6 +793,7 @@ elsif has_variable?("postgrey") && postgrey == "true" warn !senders = : !hosts = : +debianhosts : WHITELIST + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} condition = ${if def:acl_m_grey {no}{yes}} set acl_m_grey = $pid.$tod_epoch.$sender_host_port @@ -785,6 +801,7 @@ elsif has_variable?("postgrey") && postgrey == "true" defer !senders = : !hosts = : +debianhosts : WHITELIST + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} !authenticated = * domains = +handled_domains : +rcpthosts local_parts = GREYLIST_LOCAL_PARTS @@ -809,6 +826,7 @@ elsif has_variable?("postgrey") && postgrey == "true" warn !senders = : !hosts = : +debianhosts : WHITELIST + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} !authenticated = * domains = +handled_domains : +rcpthosts local_parts = GREYLIST_LOCAL_PARTS @@ -897,20 +915,20 @@ acl_check_mime: condition = ${if eq{$acl_m_srb}{false}{no}{yes}} log_message = discarded surbl message for $recipients - warn condition = ${if <{$message_size}{256000}} - condition = ${if eq {$acl_m_prf}{markup}} - set acl_m_srb = ${perl{surblspamcheck}} - condition = ${if eq{$acl_m_srb}{false}{no}{yes}} - message = X-Surbl-Hit: $primary_hostname: $acl_m_srb - - accept condition = ${if eq {$acl_m_prf}{markup}} - deny condition = ${if <{$message_size}{256000}} + condition = ${if eq {$acl_m_prf}{markup}{no}{yes}} + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} set acl_m_srb = ${perl{surblspamcheck}} condition = ${if eq{$acl_m_srb}{false}{no}{yes}} log_message = $acl_m_srb message = $acl_m_srb + warn condition = ${if <{$message_size}{256000}} + condition = ${if eq {$acl_m_prf}{markup}} + set acl_m_srb = ${perl{surblspamcheck}} + condition = ${if eq{$acl_m_srb}{false}{no}{yes}} + message = X-Surbl-Hit: $primary_hostname: $acl_m_srb + accept ' end @@ -918,7 +936,7 @@ out %> acl_check_predata: - deny condition = ${if eq{$acl_m_lcl}{localonly}} + deny condition = ${if eq{$acl_m_prf}{localonly}} message = mail for $acl_m_lrc is only accepted internally accept @@ -926,9 +944,6 @@ acl_check_predata: #!!# ACL that is used after the DATA command check_message: - require verify = header_syntax - message = Invalid syntax in the header - <%= out='' if nodeinfo['rtmaster'] @@ -964,6 +979,12 @@ out } message = Mail to this address needs to be PGP-signed + accept verify = certificate + + deny condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} + !verify = header_syntax + message = Invalid syntax in the header + # RFC 822 and 2822 say that headers must be ASCII. This kinda emulates # postfix's strict_7bit_headers option, but only checks a few common problem # headers, as there doesn't appear to be an easy way to check them all. @@ -972,10 +993,12 @@ out {match {$rh_To:}{[\200-\377]}}\ {match {$rh_From:}{[\200-\377]}}\ {match {$rh_Cc:}{[\200-\377]}}}{true}{false}} + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} message = improper use of 8-bit data in message header: message rejected deny condition = ${if match {$rh_Subject:}{[^[:print:]]\{8\}}{true}{false}} + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} message = Your mailer is not RFC 2047 compliant: message rejected <%= @@ -988,6 +1011,7 @@ out = ' log_message = discarded malware message for $recipients deny condition = ${if eq {$acl_m_prf}{markup}{no}{yes}} + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} demime = * malware = */defer_ok message = malware detected: $malware_name: message rejected @@ -1010,19 +1034,20 @@ out=' condition = ${if eq{$acl_m_srb}{false}{no}{yes}} log_message = discarded surbl message for $recipients + deny condition = ${if <{$message_size}{256000}} + condition = ${if eq {$acl_m_prf}{markup}{no}{yes}} + condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} + set acl_m_srb = ${perl{surblspamcheck}} + condition = ${if eq{$acl_m_srb}{false}{no}{yes}} + log_message = $acl_m_srb + message = $acl_m_srb + warn condition = ${if <{$message_size}{256000}} condition = ${if eq {$acl_m_prf}{markup}} set acl_m_srb = ${perl{surblspamcheck}} condition = ${if eq{$acl_m_srb}{false}{no}{yes}} message = X-Surbl-Hit: $primary_hostname: $acl_m_srb - accept condition = ${if eq {$acl_m_prf}{markup}} - - deny condition = ${if <{$message_size}{256000}} - set acl_m_srb = ${perl{surblspamcheck}} - condition = ${if eq{$acl_m_srb}{false}{no}{yes}} - log_message = $acl_m_srb - message = $acl_m_srb ' end out @@ -1130,7 +1155,11 @@ smarthost: driver = manualroute domains = !+handled_domains transport = remote_smtp_smarthost - route_list = * ' + nodeinfo['smarthost'] + ' + route_list = * ' + nodeinfo['smarthost'] + if nodeinfo['smarthost'] == 'mailout.debian.org' + out += '/MX' + end + out += ' host_find_failed = defer same_domain_copy_routing = yes no_more