From: Adam D. Barratt Date: Sat, 28 Sep 2019 14:22:21 +0000 (+0100) Subject: Merge branch 'salsa' into fordsa X-Git-Url: https://git.adam-barratt.org.uk/?a=commitdiff_plain;h=refs%2Fheads%2Ffordsaold;hp=58ef097e74c5b218f1eb8052b0e52861456e95db;p=mirror%2Fdsa-puppet.git Merge branch 'salsa' into fordsa --- diff --git a/modules/exim/files/common/blacklist b/modules/exim/files/common/blacklist index 6af7a5afb..ca7c86e10 100644 --- a/modules/exim/files/common/blacklist +++ b/modules/exim/files/common/blacklist @@ -33,3 +33,7 @@ hatemshaheen21@yahoo.com *@mpsmobile.de double-bounce@healthtorpedo.com *@qq.com +info@ubagroup.com +^.*@([a-z]+\.){2}\.monster$ +^bounce-[0-9-]+@mta1[0-9]{2}\.arxmail\.fr$ +files@wetransfer.com diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb index 49ca251ca..953548da1 100644 --- a/modules/exim/templates/eximconf.erb +++ b/modules/exim/templates/eximconf.erb @@ -132,6 +132,11 @@ hostlist debianhosts = <; ; 127.0.0.1 ; ::1 ; /var/lib/misc/thishost/debianhosts hostlist reservedaddrs = 0.0.0.0/8 : 127.0.0.0/8 : 10.0.0.0/8 : 169.254.0.0/16 : 172.16.0.0/12 : 192.0.0.0/24 : 192.168.0.0/16 : 224.0.0.0/4 : 240.0.0.0/5 : 248.0.0.0/5 +domainlist google_mxen = aspmx.l.google.com : gmail-smtp-in.l.google.com : \ + *.aspmx.l.google.com : *.gmail-smtp-in.l.google.com + +domainlist single_domain_mx = +google_mxen + <%- if @is_mailrelay -%> # Domains we relay for; that is domains that aren't considered local but we # accept mail for them. @@ -149,7 +154,7 @@ tls_crl = /etc/exim4/ssl/ca.crl # expensive, you can specify the networks for which a lookup is done, or # remove the setting entirely. host_lookup = * -# dns_ipv4_lookup = !localhost (disabled upon sgrans request, zobel, 2010-03-16) +dns_ipv4_lookup = +google_mxen # If this option is set, then any process that is running as one of the # listed users may pass a message to Exim and specify the sender's @@ -173,6 +178,13 @@ local_from_check = false gecos_pattern = ^([^,:]*) gecos_name = $1 +# Do *not* include the body of the original message in a bounce +# The combinaton of bounce_return_message and bounce_return_body +# allows us to return only the headers within a bounce + +bounce_return_message = true +bounce_return_body = false + # This tells Exim to immediately discard error messages (ie double bounces). ignore_bounce_errors_after = 0s auto_thaw = 1d @@ -249,7 +261,23 @@ pipelining_advertise_hosts = !* tls_advertise_hosts = * smtp_enforce_sync = true -log_selector = +tls_cipher +tls_peerdn +queue_time +deliver_time +smtp_connection +smtp_incomplete_transaction +smtp_confirmation +smtp_protocol_error +log_selector = \ + +tls_cipher \ + +tls_peerdn \ + +queue_time \ + +queue_time_overall \ + +deliver_time \ + +received_recipients \ + +sender_on_delivery \ + +return_path_on_delivery \ + +incoming_port \ + +unknown_in_list \ + +smtp_connection \ + +smtp_incomplete_transaction \ + +smtp_confirmation \ + +smtp_syntax_error \ + +smtp_no_mail \ + +smtp_protocol_error received_header_text = Received: ${if def:sender_rcvhost {from $sender_rcvhost\n\t}\ {${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)\n\t}}}}\ @@ -642,7 +670,7 @@ check_recipient: hosts = !+debianhosts message = mail from <$sender_address> not allowed externally - deny condition = ${if match_domain{$sender_address_domain}{+virtual_domains}} + deny sender_domains= +virtual_domains condition = ${if exists {${extract{directory}{VSENDERDOMAINDATA}{${value}/neversenders}}}} condition = ${lookup{$sender_address_local_part}lsearch{${extract{directory}{VSENDERDOMAINDATA}{${value}/neversenders}}}{true}} message = no mail should ever come from <$sender_address> @@ -659,6 +687,12 @@ check_recipient: deny condition = ${if !eq {$acl_m_prf}{PopconMail}} !verify = sender + warn !hosts = +debianhosts + condition = ${if !eq {$acl_m_prf}{PopconMail}} + condition = ${if >{${eval:$acl_c_scr+0}}{0}} + ratelimit = 10 / 60m / per_rcpt / strict / $sender_host_address + log_message = Sender rate $sender_rate / $sender_rate_period (limit: $sender_rate_limit) + defer !hosts = +debianhosts condition = ${if !eq {$acl_m_prf}{PopconMail}} condition = ${if >{${eval:$acl_c_scr+0}}{0}} @@ -777,11 +811,7 @@ check_recipient: protocol_name=${uc:$received_protocol}\n\ instance=${acl_m_grey}\n\ helo_name=${sender_helo_name}\n\ -<%- if scope.call_function('versioncmp', [@lsbmajdistrelease, '8']) <= 0 -%> - client_address=${substr_-3:${mask:$sender_host_address/24}}\n\ -<%- else -%> client_address=${sender_host_address}\n\ -<%- end -%> client_name=${sender_host_name}\n\ sender=${sender_address}\n\ recipient=$local_part@$domain\n\n @@ -957,24 +987,15 @@ check_message: <%- if has_variable?("clamd") && @clamd -%> discard condition = ${if eq {$acl_m_prf}{blackhole}} - <%- if scope.call_function('versioncmp', [@lsbmajdistrelease, '8']) <= 0 -%> - demime = * - <%- end -%> malware = */defer_ok log_message = discarded malware message for $recipients deny condition = ${if !eq {$acl_m_prf}{markup}} condition = ${if !eq {$acl_m_prf}{PopconMail}} - <%- if scope.call_function('versioncmp', [@lsbmajdistrelease, '8']) <= 0 -%> - demime = * - <%- end -%> malware = */defer_ok message = malware detected: $malware_name: message rejected warn condition = ${if eq {$acl_m_prf}{markup}} - <%- if scope.call_function('versioncmp', [@lsbmajdistrelease, '8']) <= 0 -%> - demime = * - <%- end -%> malware = */defer_ok message = X-malware detected: $malware_name @@ -1055,9 +1076,13 @@ begin routers <%- if @is_mailrelay -%> relay_manualroute: + debug_print = "R: relay_manualroute for $local_part@$domain" driver = manualroute domains = +mailhubdomains - transport = remote_smtp + transport = ${if forany{${lookup dnsdb{>: mxh=$domain}}}\ + {match_domain{$item}{+single_domain_mx}}\ + {remote_smtp_single_domain}{remote_smtp}\ + } route_data = ${lookup{$domain}lsearch{/etc/exim4/manualroute}} require_files = /etc/exim4/manualroute @@ -1100,7 +1125,10 @@ dnslookup: debug_print = "R: dnslookup for $local_part@$domain" driver = dnslookup domains = !+handled_domains - transport = remote_smtp + transport = ${if forany{${lookup dnsdb{>: mxh=$domain}}}\ + {match_domain{$item}{+single_domain_mx}}\ + {remote_smtp_single_domain}{remote_smtp}\ + } ignore_target_hosts = +reservedaddrs no_more @@ -1485,6 +1513,7 @@ begin transports # directory. (The alternative, which most other unixes use, is to deliver # as the user's own group, into a sticky-bitted directory) local_delivery: + debug_print = "T: local_delivery for $local_part@$domain" driver = appendfile file = /var/mail/${local_part} group = mail @@ -1501,6 +1530,7 @@ local_delivery: # want this to happen only when the pipe fails to complete normally. address_pipe: + debug_print = "T: address_pipe for $local_part@$domain" driver = pipe current_directory = ${home} environment = "EXTENSION=${substr_1:${local_part_suffix}}:\ @@ -1515,10 +1545,12 @@ address_pipe: # mentioned elsewhere in this configuration file. address_file: + debug_print = "T: address_file for $local_part@$domain" driver = appendfile return_path_add address_file_group: + debug_print = "T: address_file_group for $local_part@$domain" driver = appendfile return_path_add mode = 0660 @@ -1541,6 +1573,7 @@ address_file_group: # are passed to address_directory. address_directory: + debug_print = "T: address_directory for $local_part@$domain" driver = appendfile check_string = maildir_format @@ -1552,14 +1585,25 @@ address_directory: # option of the forwardfile director. It has a conventional name, since it # is not actually mentioned elsewhere in this configuration file. address_reply: + debug_print = "T: address_reply for $local_part@$domain" driver = autoreply # This transport is used for delivering messages over SMTP connections. remote_smtp: + debug_print = "T: remote_smtp for $local_part@$domain" + driver = smtp + connect_timeout = 15s + delay_after_cutoff = false + tls_certificate = /etc/exim4/ssl/thishost.crt + tls_privatekey = /etc/exim4/ssl/thishost.key + +remote_smtp_single_domain: + debug_print = "T: remote_smtp_single_domain for $local_part@$domain" driver = smtp connect_timeout = 15s delay_after_cutoff = false + no_multi_domain tls_certificate = /etc/exim4/ssl/thishost.crt tls_privatekey = /etc/exim4/ssl/thishost.key @@ -1576,12 +1620,14 @@ remote_smtp_smarthost: <%- end -%> # Send the message to procmail procmail_pipe: + debug_print = "T: procmail_pipe for $local_part@$domain" driver = pipe command = /usr/bin/procmail -a ${substr_1:${local_part_suffix}} return_path_add user = ${local_part} bsmtp: + debug_print = "T: bsmtp for $local_part@$domain" driver = appendfile batch_max = 100 file = ${host} @@ -1595,6 +1641,7 @@ bsmtp: <%- if @is_bugsmx -%> bugs_pipe: + debug_print = "T: bugs_pipe for $local_part@$domain" driver = pipe command = /srv/bugs.debian.org/mail/run-procmail environment = "EXTENSION=${substr_1:${local_part_suffix}}:\ diff --git a/modules/fail2ban/files/filter/dsa-exim-strict.conf b/modules/fail2ban/files/filter/dsa-exim-strict.conf new file mode 100644 index 000000000..33310abc1 --- /dev/null +++ b/modules/fail2ban/files/filter/dsa-exim-strict.conf @@ -0,0 +1,7 @@ +# + +[INCLUDES] +before = exim-common.conf + +[Definition] +failregex = ^%(pid)s SMTP protocol error in "(?i:AUTH LOGIN)" .* \[\] AUTH command used when not advertised$ diff --git a/modules/fail2ban/files/filter/dsa-exim.conf b/modules/fail2ban/files/filter/dsa-exim.conf index 7e43af9e2..84f921e09 100644 --- a/modules/fail2ban/files/filter/dsa-exim.conf +++ b/modules/fail2ban/files/filter/dsa-exim.conf @@ -4,4 +4,8 @@ before = exim-common.conf [Definition] -failregex = ^%(pid)s SMTP protocol error in "AUTH LOGIN" .* \[\] AUTH command used when not advertised$ +failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$ + ^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[\](:\d+)?( I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$ + ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user|Unrouteable address|Invalid local part)\s*$ + ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$ + ^%(pid)s SMTP call from \S+ \[\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands \(last was "\S+"\)\s*$ diff --git a/modules/fail2ban/files/jail/dsa-exim-strict.conf b/modules/fail2ban/files/jail/dsa-exim-strict.conf new file mode 100644 index 000000000..3030e4908 --- /dev/null +++ b/modules/fail2ban/files/jail/dsa-exim-strict.conf @@ -0,0 +1,8 @@ +[dsa-exim-strict] +enabled = true +filter = dsa-exim-strict +port = smtp,ssmtp,submission +logpath = /var/log/exim4/mainlog +maxretry = 1 +findtime = 3600 +bantime = 10800 diff --git a/modules/fail2ban/files/jail/dsa-exim.conf b/modules/fail2ban/files/jail/dsa-exim.conf index fcf9a5ec8..412c028f3 100644 --- a/modules/fail2ban/files/jail/dsa-exim.conf +++ b/modules/fail2ban/files/jail/dsa-exim.conf @@ -3,6 +3,6 @@ enabled = true filter = dsa-exim port = smtp,ssmtp,submission logpath = /var/log/exim4/mainlog -maxretry = 1 -findtime = 3600 +maxretry = 6 +findtime = 900 bantime = 10800 diff --git a/modules/fail2ban/manifests/exim.pp b/modules/fail2ban/manifests/exim.pp index f1b34ddfa..96c9561f8 100644 --- a/modules/fail2ban/manifests/exim.pp +++ b/modules/fail2ban/manifests/exim.pp @@ -7,4 +7,12 @@ class fail2ban::exim inherits fail2ban { source => 'puppet:///modules/fail2ban/jail/dsa-exim.conf', notify => Service['fail2ban'], } + file { '/etc/fail2ban/filter.d/dsa-exim-strict.conf': + source => 'puppet:///modules/fail2ban/filter/dsa-exim-strict.conf', + notify => Service['fail2ban'], + } + file { '/etc/fail2ban/jail.d/dsa-exim-strict.conf': + source => 'puppet:///modules/fail2ban/jail/dsa-exim-strict.conf', + notify => Service['fail2ban'], + } }