X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fexim%2Ftemplates%2Feximconf.erb;h=97b96cb6652af61c63f2a4f0c47bea5a8f93a25a;hb=99c219736c3c52f933f120c4411ef8e984f5f9d1;hp=1eeb96f4748442d4e300dab847385f54d836cab0;hpb=cc00d4b9d930ef9810d46fd78adc85390cd3f8ec;p=mirror%2Fdsa-puppet.git diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb index 1eeb96f47..97b96cb66 100644 --- a/modules/exim/templates/eximconf.erb +++ b/modules/exim/templates/eximconf.erb @@ -76,7 +76,7 @@ # MAIN CONFIGURATION SETTINGS # ###################################################################### -<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%> +<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%> perl_startup = do '/etc/exim4/exim_surbl.pl' <%- end -%> @@ -87,7 +87,7 @@ perl_startup = do '/etc/exim4/exim_surbl.pl' acl_smtp_helo = check_helo acl_smtp_rcpt = ${if ={$interface_port}{587} {check_submission}{check_recipient}} acl_smtp_data = check_message -<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%> +<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%> acl_smtp_mime = acl_check_mime <%- end -%> acl_smtp_predata = acl_check_predata @@ -119,7 +119,7 @@ localpartlist local_only_users = lsearch;/etc/exim4/localusers localpartlist postmasterish = postmaster : abuse : hostmaster -hostlist debianhosts = : 127.0.0.1 : /var/lib/misc/thishost/debianhosts +hostlist debianhosts = <; ; 127.0.0.1 ; ::1 ; /var/lib/misc/thishost/debianhosts ; 89.16.166.49 ; 82.195.75.76 ; 2001:41b8:202:deb:bab5:0:52c3:4b4c hostlist reservedaddrs = <%= nodeinfo['reservedaddrs'] %> @@ -169,7 +169,7 @@ timeout_frozen_after=14d message_size_limit = 100M message_logs = false smtp_accept_max_per_host = ${if match_ip {$sender_host_address}{+debianhosts}{0}{7}} -<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%> +<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%> smtp_accept_max = 300 smtp_accept_queue = 200 smtp_accept_queue_per_connection = 50 @@ -188,7 +188,7 @@ check_spool_space = 20M delay_warning = -<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%> +<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%> message_body_visible = 5000 queue_run_max = 50 deliver_queue_load_max = 50 @@ -289,6 +289,13 @@ acl_getprofile: hosts = !+debianhosts set acl_m_rprf = localonly +<%- if nodeinfo['mailrelay'] -%> + warn local_parts = +local_only_users + domains = +mailhubdomains + hosts = !+debianhosts + set acl_m_rprf = localonly + +<%- end -%> accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}} <%- if nodeinfo['rtmaster'] -%> @@ -520,16 +527,17 @@ check_recipient: accept verify = certificate <%- end -%> - accept hosts = : 127.0.0.1 : @ + accept hosts = <; ::1 ; 127.0.0.1 ; @ warn acl = acl_getprofile condition = ${if eq{$acl_m_prf}{}} set acl_m_prf = $acl_m_rprf defer condition = ${if eq{$acl_m_prf}{$acl_m_rprf}{no}{yes}} + message = Different profile, please retry log_message = Only one profile at a time, please # Defer after too many bad RCPT TO's. Legit MTAs will retry later. - # This is a rough pass at preventing addres harvesting or other mail blasts. + # This is a rough pass at preventing address harvesting or other mail blasts. defer log_message = Too many bad recipients ${eval:$rcpt_fail_count} out of $rcpt_count !acl = acl_spamlovers @@ -628,12 +636,6 @@ check_recipient: warn condition = ${if eq{$acl_m_prf}{localonly}} set acl_m_lrc = ${if eq{$acl_m_lrc}{}{$local_part@$domain}{$acl_m_lrc, $local_part@$domain}} -<%- if 0 == 1 -%> - deny message = address $sender_host_address is listed in $dnslist_domain; $dnslist_text - hosts = !+debianhosts - dnslists = rbl.debian.net : rbl.debian.net/$sender_address_domain - -<%- end -%> <%- if nodeinfo['packagesmaster'] -%> warn condition = ${if eq {$acl_m_prf}{PackagesMail}} condition = ${if eq {$sender_address}{$local_part@$domain}} @@ -714,7 +716,10 @@ check_recipient: <%- end -%> <%- if nodeinfo['rtmaster'] -%> warn condition = ${if eq{$acl_m_prf}{RTMail}} - set acl_m12 = ${if def:acl_m12 {$acl_m12} {${if or{{match{$local_part}{\N[^+]+\+\d+\N}}{match{$local_part}{\N[^+]+\+new\N}}} {RTMailRecipientHasSubaddress}}}} + set acl_m12 = ${if def:acl_m12 {$acl_m12} {${if or{{match{$local_part}{\N[^+]+\+\d+\N}}{match{$local_part}{\N[^+]+\+new\N}}{match{$local_part}{3520}}} {RTMailRecipientHasSubaddress}}}} + # temporary hack because weasel screwed up and gave people an rt-3520@ address, which doesn't really work normally. + #set acl_m12 = ${if def:acl_m12 {$acl_m12} {${if or{{match{$local_part}{\N[^+]+\+\d+\N}}{match{$local_part}{\N[^+]+\+new\N}}} {RTMailRecipientHasSubaddress}}}} + <%- end -%> <%- if has_variable?("greylistd") && greylistd == "true" -%> @@ -847,9 +852,12 @@ check_recipient: deny message = relay not permitted -<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%> +<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%> acl_check_mime: + accept verify = certificate + accept hosts = +debianhosts + discard condition = ${if <{$message_size}{256000}} condition = ${if eq {$acl_m_prf}{blackhole}} set acl_m_srb = ${perl{surblspamcheck}} @@ -882,6 +890,11 @@ acl_check_predata: #!!# ACL that is used after the DATA command check_message: + + # Some people put from hostmaster@something.debian.org in the From + # header. Take their crack pipe away. + drop condition = ${if match{${lc:$h_From:}}{\Npostmaster@([^.]+\.)?debian\.org\N}} + <%- if nodeinfo['rtmaster'] -%> deny condition = ${if eq {$acl_m_prf}{RTMail}} condition = ${if and{{!match {${lc:$rh_Subject:}} {debian rt}} \ @@ -907,7 +920,8 @@ check_message: } message = Mail to this address needs to be PGP-signed - accept verify = certificate + accept verify = certificate + accept hosts = +debianhosts deny condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}} !verify = header_syntax @@ -947,7 +961,7 @@ check_message: message = X-malware detected: $malware_name <%- end -%> -<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%> +<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%> discard condition = ${if <{$message_size}{256000}} condition = ${if eq {$acl_m_prf}{blackhole}} set acl_m_srb = ${perl{surblspamcheck}} @@ -999,7 +1013,6 @@ check_message: begin rewrite \N^buildd_(.*)@franck\.debian\.org$\N buildd_$1@buildd.debian.org T -\N^buildd_(.*)@klecker\.debian\.org$\N buildd_$1@buildd.debian.org T *@debian.org ${lookup{$1}cdb{/var/lib/misc/${primary_hostname}/mail-forward.cdb}{$value}fail} T *@people.debian.org ${lookup{$1}cdb{/var/lib/misc/${primary_hostname}/mail-forward.cdb}{$value}fail} T #*@${primary_hostname} "${if exists{/etc/exim4/email-addresses}{${lookup{$1}lsearch{/etc/exim4/email-addresses}{$value}fail}}fail}" fFs @@ -1133,7 +1146,11 @@ userforward_verify: user = Debian-exim no_check_local_user directory_transport = address_directory +<%- if fqdn == "master.debian.org" -%> + domains = +local_domains : debian.org +<%- else -%> domains = +local_domains +<%- end -%> # filter - I have disabled filtering to force users to use .forward-foo files # or procmail. This will make it easier to move mailers in the future # @@ -1157,13 +1174,66 @@ userforward_verify: router_home_directory = ${lookup passwd{$local_part}{${extract{5}{:}{$value}}}fail} verify_only +# This is a senmailesque alias file lookup +virt_aliases: + debug_print = "R: virt_aliases for $local_part@$domain" + driver = redirect + allow_defer + allow_fail + data = ${if exists{\ + ${extract{directory}{VDOMAINDATA}{${value}/aliases}}}\ + {${lookup{$local_part}lsearch*{\ + ${extract{directory}{VDOMAINDATA}{$value/aliases}}\ + }}}} + directory_transport = address_directory + domains = +virtual_domains + file_transport = ${if eq {${extract{group_writable}{VDOMAINDATA}}}{true}{address_file_group}{address_file}} + cannot_route_message = Unknown user + group = ${extract{group}{VDOMAINDATA}} + headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}" + pipe_transport = address_pipe + qualify_preserve_domain + retry_use_local_part + transport_current_directory = ${extract{directory}{VDOMAINDATA}} + transport_home_directory = ${extract{directory}{VDOMAINDATA}} + user = ${extract{user}{VDOMAINDATA}} + +# No direct match, so try doing a regex match if there's an +# aliases.regex +virt_aliases_regex: + debug_print = "R: virt_aliases_regex for $local_part$local_part_suffix@$domain" + driver = redirect + allow_defer + allow_fail + data = ${if exists{\ + ${extract{directory}{VDOMAINDATA}{${value}/aliases.regex}}}\ + {${lookup{$local_part}nwildlsearch*{\ + ${extract{directory}{VDOMAINDATA}{$value/aliases.regex}}\ + }}}} + directory_transport = address_directory + domains = +virtual_domains + file_transport = ${if eq {${extract{group_writable}{VDOMAINDATA}}}{true}{address_file_group}{address_file}} + cannot_route_message = Unknown user + group = ${extract{group}{VDOMAINDATA}} + headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}" + pipe_transport = address_pipe + qualify_preserve_domain + retry_use_local_part + transport_current_directory = ${extract{directory}{VDOMAINDATA}} + transport_home_directory = ${extract{directory}{VDOMAINDATA}} + user = ${extract{user}{VDOMAINDATA}} + userforward: debug_print = "R: userforward for $local_part${local_part_suffix}@$domain" driver = redirect check_ancestor check_local_user directory_transport = address_directory +<%- if fqdn == "master.debian.org" -%> + domains = +local_domains : debian.org +<%- else -%> domains = +local_domains +<%- end -%> # filter - I have disabled filtering to force users to use .forward-foo files # or procmail. This will make it easier to move mailers in the future # @@ -1191,7 +1261,11 @@ procmail: debug_print = "R: procmail for $local_part@$domain" driver = accept check_local_user +<%- if fqdn == "master.debian.org" -%> + domains = +local_domains : debian.org +<%- else -%> domains = +local_domains +<%- end -%> headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}" local_part_suffix = -* local_part_suffix_optional @@ -1265,7 +1339,8 @@ rt_force_new_verbose: local_part_suffix = +new pipe_transport = rt_pipe data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}" - headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}" + headers_remove = Subject + headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?i)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}" # FIXME: figure out how to generalize this approach so that all of the following would work # - rt+NNNN@rt.debian.org : attach correspondence to ticket (verbose) @@ -1281,7 +1356,8 @@ rt_force_new_quiesce: local_part_suffix = +new-quiesce pipe_transport = rt_pipe data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}" - headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nX-RT-Mode: quiesce" + headers_remove = Subject + headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nX-RT-Mode: quiesce\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?i)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}" rt_otherwise: debug_print = "R: rt for $local_part@$domain" @@ -1293,7 +1369,8 @@ rt_otherwise: local_part_suffix_optional pipe_transport = rt_pipe data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --extension ticket --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}" - headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}" + headers_remove = Subject + headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?i)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}" <%- end -%> @@ -1323,30 +1400,6 @@ virt_direct_verify: transport_current_directory = ${extract{directory}{VDOMAINDATA}} verify_only -# This is a senmailesque alias file lookup -virt_aliases: - debug_print = "R: virt_aliases for $local_part@$domain" - driver = redirect - allow_defer - allow_fail - data = ${if exists{\ - ${extract{directory}{VDOMAINDATA}{${value}/aliases}}}\ - {${lookup{$local_part}lsearch*{\ - ${extract{directory}{VDOMAINDATA}{$value/aliases}}\ - }}}} - directory_transport = address_directory - domains = +virtual_domains - file_transport = ${if eq {${extract{group_writable}{VDOMAINDATA}}}{true}{address_file_group}{address_file}} - cannot_route_message = Unknown user - group = ${extract{group}{VDOMAINDATA}} - headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}" - pipe_transport = address_pipe - qualify_preserve_domain - retry_use_local_part - transport_current_directory = ${extract{directory}{VDOMAINDATA}} - transport_home_directory = ${extract{directory}{VDOMAINDATA}} - user = ${extract{user}{VDOMAINDATA}} - # This is a qmailesque deliver into a directory of .forward files virt_direct: debug_print = "R: virt_direct for $local_part@$domain" @@ -1541,7 +1594,7 @@ out # Send the message to procmail procmail_pipe: driver = pipe - command = /usr/bin/procmail -a ${substr_1:${local_part_suffix}}} + command = /usr/bin/procmail -a ${substr_1:${local_part_suffix}} return_path_add user = ${local_part}