From: Adam D. Barratt <adam@adam-barratt.org.uk>
Date: Fri, 27 Sep 2019 06:59:21 +0000 (+0100)
Subject: Merge branch 'salsa' into fordsa
X-Git-Url: https://git.adam-barratt.org.uk/?a=commitdiff_plain;h=e36aaa15b6e11c42c1f2fd23c28acbaae55a0355;hp=13164b84ef451d8a09a1f2435fa35e4d9d16c9f7;p=mirror%2Fdsa-puppet.git

Merge branch 'salsa' into fordsa
---

diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb
index 49ca251ca..26ac9778c 100644
--- a/modules/exim/templates/eximconf.erb
+++ b/modules/exim/templates/eximconf.erb
@@ -132,6 +132,11 @@ hostlist debianhosts = <; ; 127.0.0.1 ; ::1 ; /var/lib/misc/thishost/debianhosts
 
 hostlist reservedaddrs = 0.0.0.0/8 : 127.0.0.0/8 : 10.0.0.0/8 : 169.254.0.0/16 : 172.16.0.0/12 : 192.0.0.0/24 : 192.168.0.0/16 : 224.0.0.0/4 : 240.0.0.0/5 : 248.0.0.0/5
 
+domainlist google_mxen = aspmx.l.google.com : gmail-smtp-in.l.google.com : \
+                         *.aspmx.l.google.com : *.gmail-smtp-in.l.google.com
+
+domainlist single_domain_mx = +google_mxen
+
 <%- if @is_mailrelay -%>
 # Domains we relay for; that is domains that aren't considered local but we 
 # accept mail for them.
@@ -149,7 +154,7 @@ tls_crl = /etc/exim4/ssl/ca.crl
 # expensive, you can specify the networks for which a lookup is done, or
 # remove the setting entirely.
 host_lookup = *
-# dns_ipv4_lookup = !localhost (disabled upon sgrans request, zobel, 2010-03-16)
+dns_ipv4_lookup = +google_mxen
 
 # If this option is set, then any process that is running as one of the
 # listed users may pass a message to Exim and specify the sender's
@@ -173,6 +178,13 @@ local_from_check = false
 gecos_pattern = ^([^,:]*)
 gecos_name = $1
 
+# Do *not* include the body of the original message in a bounce
+# The combinaton of bounce_return_message and bounce_return_body
+# allows us to return only the headers within a bounce
+
+bounce_return_message = true
+bounce_return_body    = false
+
 # This tells Exim to immediately discard error messages (ie double bounces).
 ignore_bounce_errors_after = 0s
 auto_thaw = 1d
@@ -249,7 +261,20 @@ pipelining_advertise_hosts = !*
 tls_advertise_hosts = *
 smtp_enforce_sync = true
 
-log_selector = +tls_cipher +tls_peerdn +queue_time +deliver_time +smtp_connection +smtp_incomplete_transaction +smtp_confirmation +smtp_protocol_error
+log_selector = \
+               +tls_cipher \
+               +tls_peerdn \
+               +queue_time \
+               +queue_time_overall \
+               +deliver_time \
+               +received_recipients \
+               +unknown_in_list \
+               +smtp_connection \
+               +smtp_incomplete_transaction \
+               +smtp_confirmation \
+               +smtp_syntax_error \
+               +smtp_no_mail \
+               +smtp_protocol_error
 
 received_header_text = Received: ${if def:sender_rcvhost {from $sender_rcvhost\n\t}\
                                  {${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)\n\t}}}}\
@@ -1055,9 +1080,13 @@ begin routers
 
 <%- if @is_mailrelay -%>
 relay_manualroute:
+  debug_print = "R: relay_manualroute for $local_part@$domain"
   driver = manualroute
   domains = +mailhubdomains
-  transport = remote_smtp
+  transport = ${if forany{${lookup dnsdb{>: mxh=$domain}}}\
+                  {match_domain{$item}{+single_domain_mx}}\
+                  {remote_smtp_single_domain}{remote_smtp}\
+               }
   route_data = ${lookup{$domain}lsearch{/etc/exim4/manualroute}}
   require_files = /etc/exim4/manualroute
 
@@ -1100,7 +1129,10 @@ dnslookup:
   debug_print = "R: dnslookup for $local_part@$domain"
   driver = dnslookup
   domains = !+handled_domains
-  transport = remote_smtp
+  transport = ${if forany{${lookup dnsdb{>: mxh=$domain}}}\
+                  {match_domain{$item}{+single_domain_mx}}\
+                  {remote_smtp_single_domain}{remote_smtp}\
+               }
   ignore_target_hosts = +reservedaddrs
   no_more
 
@@ -1485,6 +1517,7 @@ begin transports
 # directory. (The alternative, which most other unixes use, is to deliver
 # as the user's own group, into a sticky-bitted directory)
 local_delivery:
+  debug_print = "T: local_delivery for $local_part@$domain"
   driver = appendfile
   file = /var/mail/${local_part}
   group = mail
@@ -1501,6 +1534,7 @@ local_delivery:
 # want this to happen only when the pipe fails to complete normally.
 
 address_pipe:
+  debug_print = "T: address_pipe for $local_part@$domain"
   driver = pipe
   current_directory = ${home}
   environment = "EXTENSION=${substr_1:${local_part_suffix}}:\
@@ -1515,10 +1549,12 @@ address_pipe:
 # mentioned elsewhere in this configuration file.
 
 address_file:
+  debug_print = "T: address_file for $local_part@$domain"
   driver = appendfile
   return_path_add
 
 address_file_group:
+  debug_print = "T: address_file_group for $local_part@$domain"
   driver = appendfile
   return_path_add
   mode = 0660
@@ -1541,6 +1577,7 @@ address_file_group:
 # are passed to address_directory.
 
 address_directory:
+  debug_print = "T: address_directory for $local_part@$domain"
   driver = appendfile
   check_string = 
   maildir_format
@@ -1552,14 +1589,25 @@ address_directory:
 # option of the forwardfile director. It has a conventional name, since it
 # is not actually mentioned elsewhere in this configuration file.
 address_reply:
+  debug_print = "T: address_reply for $local_part@$domain"
   driver = autoreply
 
 # This transport is used for delivering messages over SMTP connections.
 
 remote_smtp:
+  debug_print = "T: remote_smtp for $local_part@$domain"
+  driver = smtp
+  connect_timeout = 15s
+  delay_after_cutoff = false
+  tls_certificate = /etc/exim4/ssl/thishost.crt
+  tls_privatekey = /etc/exim4/ssl/thishost.key
+
+remote_smtp_single_domain:
+  debug_print = "T: remote_smtp_single_domain for $local_part@$domain"
   driver = smtp
   connect_timeout = 15s
   delay_after_cutoff = false
+  no_multi_domain
   tls_certificate = /etc/exim4/ssl/thishost.crt
   tls_privatekey = /etc/exim4/ssl/thishost.key
 
@@ -1576,12 +1624,14 @@ remote_smtp_smarthost:
 <%- end -%>
 # Send the message to procmail
 procmail_pipe:
+  debug_print = "T: procmail_pipe for $local_part@$domain"
   driver = pipe
   command = /usr/bin/procmail -a ${substr_1:${local_part_suffix}}
   return_path_add
   user = ${local_part}
 
 bsmtp:
+  debug_print = "T: bsmtp for $local_part@$domain"
   driver = appendfile
   batch_max = 100
   file = ${host}
@@ -1595,6 +1645,7 @@ bsmtp:
 
 <%- if @is_bugsmx -%>
 bugs_pipe:
+  debug_print = "T: bugs_pipe for $local_part@$domain"
   driver = pipe
   command = /srv/bugs.debian.org/mail/run-procmail
   environment = "EXTENSION=${substr_1:${local_part_suffix}}:\
diff --git a/modules/fail2ban/files/filter/dsa-exim.conf b/modules/fail2ban/files/filter/dsa-exim.conf
index 7e43af9e2..64c8c1eb6 100644
--- a/modules/fail2ban/files/filter/dsa-exim.conf
+++ b/modules/fail2ban/files/filter/dsa-exim.conf
@@ -4,4 +4,9 @@
 before = exim-common.conf
 
 [Definition]
-failregex = ^%(pid)s SMTP protocol error in "AUTH LOGIN" .* \[<HOST>\] AUTH command used when not advertised$
+failregex = ^%(pid)s SMTP protocol error in "(?i:AUTH LOGIN)" .* \[<HOST>\] AUTH command used when not advertised$
+            ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$
+            ^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[<HOST>\](:\d+)?( I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
+            ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user|Unrouteable address|Invalid local part)\s*$
+            ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$
+            ^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands \(last was "\S+"\)\s*$