X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fexim%2Ftemplates%2Feximconf.erb;h=be53a54890708b9d6f106df1804851e44e1c4957;hb=4f011cbc16fddc4f475bf40ae11e3407bd4ac1dc;hp=2fa12c9f45a67823955600a0324cfd386148b819;hpb=f8b10b0e0516ad8e0e0f2cf1ed7ab9fb73922b97;p=mirror%2Fdsa-puppet.git diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb index 2fa12c9f4..be53a5489 100644 --- a/modules/exim/templates/eximconf.erb +++ b/modules/exim/templates/eximconf.erb @@ -266,6 +266,7 @@ tls_advertise_hosts = * smtp_enforce_sync = true log_selector = \ + +subject \ +tls_cipher \ +tls_peerdn \ +queue_time \ @@ -306,6 +307,7 @@ GREYLIST_LOCAL_PARTS = ${if match_domain{$domain}{+virtual_domains}\ {${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/grey_users}}}{$local_part}{}}}{}}}\ {${lookup{$local_part}lsearch{/etc/exim4/grey_users}{$local_part}{}}}} : \ ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-greylist}{$local_part}{}} +HAS_DEFAULT_OPTIONS = ${if eq{${lookup{$local_part}dbmnz{/var/lib/misc/$primary_hostname/default-mail-options.db}{$value}{TRUE}}}{TRUE}} <%- if @is_rtmaster -%> # This subject rewrite is embedded in double-quoted strings. As such, some of # the items need more escaping than usual, otherwise \N becomes simply "N" and @@ -600,6 +602,14 @@ check_recipient: message = Different profile, please retry log_message = Only one profile at a time, please + # Set a flag to indicate whether the current recipient + # has explicitly requested greylisting + warn set acl_m_grey_recip = 0 + + warn local_parts = GREYLIST_LOCAL_PARTS + domains = +handled_domains + set acl_m_grey_recip = 1 + # Defer after too many bad RCPT TO's. Legit MTAs will retry later. # This is a rough pass at preventing address harvesting or other mail blasts. @@ -691,6 +701,12 @@ check_recipient: condition = ${lookup{$sender_address_local_part}lsearch{${extract{directory}{VSENDERDOMAINDATA}{${value}/neversenders}}}{true}} message = no mail should ever come from <$sender_address> + deny domains = +virtual_domains + senders = : + condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/neversenders}}}} + condition = ${lookup{$local_part}lsearch{${extract{directory}{VDOMAINDATA}{${value}/neversenders}}}{true}} + message = <$local_part@$domain> does not send mail; rejecting bogus NDR + warn condition = ${if eq{$acl_m_prf}{localonly}} set acl_m_lrc = ${if eq{$acl_m_lrc}{}{$local_part@$domain}{$acl_m_lrc, $local_part@$domain}} @@ -773,27 +789,25 @@ check_recipient: <%- end -%> <%- if @is_rtmaster -%> warn condition = ${if eq{$acl_m_prf}{RTMail}} - set acl_m12 = ${if def:acl_m12 {$acl_m12} {${if or{{match{$local_part}{\N[^+]+\+\d+\N}}{match{$local_part}{\N[^+]+\+new\N}}{match{$local_part}{3520}}{match{$local_part}{3645}}} {RTMailRecipientHasSubaddress}}}} - # temporary hack because weasel screwed up and gave people an rt-3520@ address, which doesn't really work normally. and rt-3645 - #set acl_m12 = ${if def:acl_m12 {$acl_m12} {${if or{{match{$local_part}{\N[^+]+\+\d+\N}}{match{$local_part}{\N[^+]+\+new\N}}} {RTMailRecipientHasSubaddress}}}} - + set acl_m12 = ${if def:acl_m12 {$acl_m12} {${if or{{match{$local_part}{\N[^+]+\+\d+\N}}{match{$local_part}{\N[^+]+\+new\N}}} {RTMailRecipientHasSubaddress}}}} <%- end -%> <%- if has_variable?("greylistd") && @greylistd -%> defer message = $sender_host_address is not yet authorized to deliver mail from <$sender_address> to <$local_part@$domain>. log_message = greylisted. - local_parts = ${if match_domain{$domain}{+virtual_domains}\ - {${if exists {${extract{directory}{VDOMAINDATA}{${value}/grey_users}}}\ - {${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/grey_users}}}{$local_part}{}}}{}}}\ - {${lookup{$local_part}lsearch{/etc/exim4/grey_users}{$local_part}{}} : \ - ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-greylist}{$local_part}{}}}} + condition = ${if or { \ + {eq{$acl_m_grey_recip}{1}} \ + {bool_lax{HAS_DEFAULT_OPTIONS}} \ + } \ + } !senders = : !hosts = : +debianhosts : WHITELIST : \ ${if exists {/etc/greylistd/whitelist-hosts}\ {/etc/greylistd/whitelist-hosts}{}} : \ ${if exists {/var/lib/greylistd/whitelist-hosts}\ {/var/lib/greylistd/whitelist-hosts}{}} + !dnslists = list.dnswl.org&0.0.0.3 condition = ${if !eq {$acl_m_prf}{PopconMail}} !authenticated = * domains = +handled_domains @@ -810,6 +824,7 @@ check_recipient: warn !senders = : !hosts = : +debianhosts : WHITELIST + !dnslists = list.dnswl.org&0.0.0.3 condition = ${if !eq {$acl_m_prf}{PopconMail}} condition = ${if ! def:acl_m_grey} set acl_m_grey = $pid.$tod_epoch.$sender_host_port @@ -818,10 +833,15 @@ check_recipient: defer !senders = : !hosts = : +debianhosts : WHITELIST + !dnslists = list.dnswl.org&0.0.0.3 condition = ${if !eq {$acl_m_prf}{PopconMail}} !authenticated = * domains = +handled_domains - local_parts = GREYLIST_LOCAL_PARTS + condition = ${if or { \ + {eq{$acl_m_grey_recip}{1}} \ + {bool_lax{HAS_DEFAULT_OPTIONS}} \ + } \ + } set acl_m_pgr = request=smtpd_access_policy\n\ protocol_state=RCPT\n\ protocol_name=${uc:$received_protocol}\n\ @@ -843,10 +863,15 @@ check_recipient: warn !senders = : !hosts = : +debianhosts : WHITELIST + !dnslists = list.dnswl.org&0.0.0.3 condition = ${if !eq {$acl_m_prf}{PopconMail}} !authenticated = * domains = +handled_domains - local_parts = GREYLIST_LOCAL_PARTS + condition = ${if or { \ + {eq{$acl_m_grey_recip}{1}} \ + {bool_lax{HAS_DEFAULT_OPTIONS}} \ + } \ + } condition = ${if eq{${uc:${substr_0_7:$acl_m_pgr}}}{PREPEND}} message = ${sg{$acl_m_pgr}{\N^\w+\s*\N}{}} @@ -863,7 +888,7 @@ check_recipient: domains = +virtual_domains : +bsmtp_domains <%- unless @use_smarthost -%> - deny message = host $sender_host_address is listed in $dnslist_domain; see $dnslist_text + deny message = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text dnslists = ${if match_domain{$domain}{+virtual_domains}\ {${if exists {${extract{directory}{VDOMAINDATA}{${value}/rbllist}}}\ {${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/rbllist}}}{$value}{}}}{}}}\ @@ -872,13 +897,19 @@ check_recipient: domains = +handled_domains !hosts = +debianhosts : WHITELIST - deny message = host $sender_host_address is listed in $dnslist_domain; see $dnslist_text + deny message = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text dnslists = noserver.dnsbl.sorbs.net domains = +handled_domains !hosts = +debianhosts : WHITELIST + deny message = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text + condition = ${if bool_lax{HAS_DEFAULT_OPTIONS}} + dnslists = relays.dnsbl.sorbs.net : xbl.spamhaus.org + domains = +handled_domains + !hosts = +debianhosts : WHITELIST + <%- end -%> - deny message = domain $sender_address_domain is listed in $dnslist_domain; see $dnslist_text + deny message = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text dnslists = ${if match_domain{$domain}{+virtual_domains}\ {${if exists {${extract{directory}{VDOMAINDATA}{${value}/rhsbllist}}}\ {${expand:${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/rhsbllist}}}{$value}{}}}}{}}}\ @@ -887,11 +918,17 @@ check_recipient: domains = +handled_domains !hosts = +debianhosts : WHITELIST - deny message = domain $sender_address_domain is listed in $dnslist_domain; see $dnslist_text + deny message = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text dnslists = nomail.rhsbl.sorbs.net/$sender_address_domain domains = +handled_domains !hosts = +debianhosts : WHITELIST + deny message = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text + condition = ${if bool_lax{HAS_DEFAULT_OPTIONS}} + dnslists = dbl.spamhaus.org/$sender_address_domain + domains = +handled_domains + !hosts = +debianhosts : WHITELIST + <%- unless @use_smarthost -%> deny domains = +handled_domains local_parts = ${if match_domain{$domain}{+virtual_domains}\ @@ -1447,7 +1484,11 @@ virt_direct_verify: modemask = 002 directory_transport = address_directory domains = +virtual_domains +<%- if @is_trackermaster -%> + local_part_suffix = +* +<%- else -%> local_part_suffix = -* +<%- end -%> local_part_suffix_optional file = $home/.forward-\ ${if exists {${home}/.forward-${local_part}}{${local_part}}\ @@ -1477,7 +1518,11 @@ virt_direct: group = ${extract{group}{VDOMAINDATA}} headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}" modemask = 002 +<%- if @is_trackermaster -%> + local_part_suffix = +* +<%- else -%> local_part_suffix = -* +<%- end -%> local_part_suffix_optional pipe_transport = address_pipe reply_transport = address_reply