3 ### Basic settings for distorted.org.uk Exim configuration
5 ### (c) 2012 Mark Wooding
8 ###----- Licensing notice ---------------------------------------------------
10 ### This program is free software; you can redistribute it and/or modify
11 ### it under the terms of the GNU General Public License as published by
12 ### the Free Software Foundation; either version 2 of the License, or
13 ### (at your option) any later version.
15 ### This program is distributed in the hope that it will be useful,
16 ### but WITHOUT ANY WARRANTY; without even the implied warranty of
17 ### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 ### GNU General Public License for more details.
20 ### You should have received a copy of the GNU General Public License
21 ### along with this program; if not, write to the Free Software Foundation,
22 ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
24 ###--------------------------------------------------------------------------
27 SECTION(global, priv)m4_dnl
28 admin_groups = CONF_admin_groups
29 trusted_groups = CONF_trusted_groups
30 prod_requires_admin = false
32 SECTION(global, logging)m4_dnl
33 log_file_path = : syslog
38 syslog_duplication = false
39 syslog_timestamp = false
41 SECTION(global, daemon)m4_dnl
42 local_interfaces = <; CONF_interfaces
43 extra_local_interfaces = <; 0.0.0.0 ; ::0
45 SECTION(global, resource)m4_dnl
46 deliver_queue_load_max = 8
49 smtp_accept_queue = 32
50 smtp_accept_reserve = 4
51 smtp_load_reserve = 10
52 smtp_reserve_hosts = +trusted
54 SECTION(global, policy)m4_dnl
57 SECTION(global, users)m4_dnl
59 gecos_pattern = ([^,:]*)
61 SECTION(global, incoming)m4_dnl
63 rfc1413_query_timeout = 10s
64 received_header_text = Received: \
65 ${if def:sender_rcvhost \
66 {from $sender_rcvhost\n\t} \
67 {${if def:sender_ident \
68 {from ${quote_local_part:$sender_ident} }}}}\
69 by $primary_hostname \
70 (Exim $version_number)\
71 ${if def:tls_cipher {\n\t} { }}\
72 ${if def:received_protocol \
73 {with $received_protocol \
74 ${if def:tls_cipher {(cipher=$tls_cipher)}}}}\n\t\
75 ${if def:sender_address \
76 {(envelope-from $sender_address\
77 ${if def:authenticated_id \
78 {; auth=${quote_local_part:$authenticated_id}} \
79 {${if and {{def:authenticated_sender} \
80 {match_address{$authenticated_sender} \
81 {*@CONF_master_domain}}} \
82 {; auth=${quote_local_part:\
84 $authenticated_sender}}}}}})\n\t}}\
86 ${if def:received_for {\n\tfor $received_for}}
88 SECTION(global, smtp)m4_dnl
89 smtp_return_error_details = true
90 accept_8bitmime = true
91 chunking_advertise_hosts =
93 SECTION(global, env)m4_dnl
96 SECTION(global, process)m4_dnl
97 extract_addresses_remove_arguments = false
98 headers_charset = utf-8
99 qualify_domain = CONF_master_domain
100 untrusted_set_sender = *
101 local_from_check = false
102 local_sender_retain = true
104 SECTION(global, bounce)m4_dnl
105 delay_warning = 1h : 24h : 2d
107 SECTION(global, tls)m4_dnl
108 tls_certificate = CONF_certlist
109 tls_privatekey = CONF_sysconf_dir/server.key
110 tls_advertise_hosts = ${if exists {CONF_sysconf_dir/server.key} {*}{}}
111 tls_dhparam = CONF_ca_dir/dh-param-2048.pem
112 tls_require_ciphers = ${if or {{={$received_port}{CONF_submission_port}} \
113 {match_ip {$sender_host_address}{+trusted}}} \
114 {CONF_good_ciphers} \
115 {CONF_acceptable_ciphers}}
116 tls_verify_certificates = CONF_ca_dir/ca.cert
117 tls_verify_hosts = ${if eq{$acl_c_mode}{submission} {} {+allnets}}
120 ###--------------------------------------------------------------------------
121 ### Access control lists.
123 SECTION(global, acl-after)
124 SECTION(global, acl)m4_dnl
126 SECTION(acl, misc)m4_dnl
128 ## Don't worry if this is local submission. MUAs won't necessarily
129 ## have a clear idea of their hostnames. (For some reason.)
130 accept condition = ${if !eq{$acl_c_mode}{submission}}
132 ## Check that the caller's claimed identity is actually plausible.
133 ## This seems like it's a fairly effective filter on spamminess, but
134 ## it's too blunt a tool. Rather than reject, add a warning header.
135 ## Only we can't do this the easy way, so save it up for use in MAIL.
136 ## Also, we're liable to get a subsequent HELO (e.g., after STARTTLS)
137 ## and we should only care about the most recent one.
138 warn set acl_c_helo_warning = false
140 ${if and {{match_ip {$sender_host_address} \
141 {<; 127.0.0.0/8 ; ::1}} \
142 {match_domain {$sender_helo_name} \
143 {localhost : +thishost}}}}
145 ${if exists {CONF_sysconf_dir/helo.conf} \
146 {${lookup {$sender_helo_name} \
148 {CONF_sysconf_dir/helo.conf} \
150 {$sender_host_address} \
153 set acl_c_helo_warning = true
157 SECTION(global, acl)m4_dnl
158 acl_not_smtp_start = not_smtp_start
159 SECTION(acl, misc)m4_dnl
161 ## Record the user's name.
162 warn set acl_c_user = $sender_ident
163 set acl_m_user = $sender_ident
168 SECTION(global, acl)m4_dnl
170 SECTION(acl, mail)m4_dnl
173 ## If we stashed a warning header about HELO from earlier, we should
174 ## add it now. Only don't bother if the client has authenticated
175 ## successfully for submission (because we can't expect mobile
176 ## clients to be properly set up knowing their names), or it's one of
177 ## our own satellites (because they're either properly set up anyway,
178 ## or satellites using us as a smarthost).
179 warn condition = $acl_c_helo_warning
180 !condition = ${if eq{$acl_c_mode}{submission}}
182 WARNING_HEADER(BADHELO,
183 <:Client's HELO doesn't match its IP address.\n\t\
184 helo-name=$sender_helo_name \
185 address=$sender_host_address:>)
187 ## Always allow the empty sender, so that we can receive bounces.
190 ## Ensure that the sender looks valid.
191 require acl = mail_check_sender
193 ## If this is directly from a client then hack on it for a while.
194 warn condition = ${if eq{$acl_c_mode}{submission}}
195 control = submission/sender_retain
197 ## Insist that a local client connect through TLS.
198 deny message = Hosts within CONF_master_domain must use TLS
199 !condition = ${if eq{$acl_c_mode}{submission}}
203 ## Check that a submitted message's sender address is allowable.
204 require acl = mail_check_auth
206 SECTION(acl, mail-tail)m4_dnl
210 SECTION(acl, misc)m4_dnl
213 ## See whether there's a special exception for this sender domain.
214 accept senders = ${LOOKUP_DOMAIN($sender_address_domain,
215 {KV(senders, {$value}{})},
218 ## Ensure that the sender is routable. This is important to prevent
219 ## undeliverable bounces.
220 require message = Invalid sender; \
221 ($sender_verify_failure; $acl_verify_message)
227 SECTION(global, acl)m4_dnl
228 acl_smtp_connect = connect
229 SECTION(acl, connect)m4_dnl
231 SECTION(acl, connect-tail)m4_dnl
232 ## Configure variables according to the submission mode.
233 warn acl = check_submission
239 ## See whether this message needs hacking on.
240 accept !hosts = +thishost
241 !condition = ${if ={$received_port}{CONF_submission_port}}
242 set acl_c_mode = relay
244 ## Remember to apply submission controls.
245 warn set acl_c_mode = submission
246 control = no_enforce_sync
251 SECTION(global, acl)m4_dnl
253 SECTION(acl, rcpt)m4_dnl
256 ## Reject if the client isn't allowed to relay and the recipient
257 ## isn't in one of our known domains.
258 require message = Relaying not permitted
261 ## Ensure that the recipient is routable.
262 require message = Invalid recipient \
263 ($recipient_verify_failure; $acl_verify_message)
266 SECTION(acl, misc)m4_dnl
268 ## Accept either if the client is allowed to relay through us, or if
269 ## we're the correct place to send this mail.
271 ## Known clients and authenticated users are OK.
272 accept hosts = CONF_relay_clients
273 accept authenticated = *
275 ## Known domains are OK.
276 accept domains = +public
278 ## Finally, domains in our table are OK, unless they say they aren't.
280 ${if exists{CONF_sysconf_dir/domains.conf} \
281 {partial0-lsearch; CONF_sysconf_dir/domains.conf}}
282 condition = DOMKV(service, {$value}{true})
284 ## Nope, that's not allowed.
287 SECTION(acl, rcpt-tail)m4_dnl
288 ## Everything checks out OK: let this one go through.
291 SECTION(global, acl)m4_dnl
293 SECTION(acl, data)m4_dnl
295 ## Don't accept messages with overly-long lines.
296 deny message = line length exceeds SMTP permitted maximum: \
297 $max_received_linelength > 998
298 condition = ${if >{$max_received_linelength}{998}}
300 SECTION(acl, data-tail)m4_dnl
303 SECTION(global, acl)m4_dnl
304 acl_smtp_expn = expn_vrfy
305 acl_smtp_vrfy = expn_vrfy
306 SECTION(acl, misc)m4_dnl
308 accept hosts = +trusted
309 deny message = Suck it and see
312 ###--------------------------------------------------------------------------
313 ### Verification of sender address.
315 SECTION(acl, misc)m4_dnl
318 ## If this isn't a submission then it doesn't need checking.
319 accept condition = ${if !eq{$acl_c_mode}{submission}}
321 ## If the caller hasn't formally authenticated, but this is a
322 ## loopback connection, then we can trust identd to tell us the right
323 ## answer. So we should stash the right name somewhere consistent.
324 warn set acl_c_user = $authenticated_id
327 condition = ${if def:sender_ident}
328 set acl_c_user = $sender_ident
330 ## User must be authenticated by now.
331 deny message = Sender not authenticated
332 condition = ${if !def:acl_c_user}
334 ## Set the per-message authentication flag, since we now know that
335 ## there's a sensible value.
336 warn set acl_m_user = $acl_c_user
342 ###--------------------------------------------------------------------------
343 ### Common options for forwarding routers.
345 ## We're pretty permissive here.
346 m4_define(<:FILTER_BASE:>,
354 forbid_blackhole = false
355 check_ancestor = true:>)
357 ## Common options for forwarding routers at verification time.
358 m4_define(<:FILTER_VERIFY:>,
360 user = CONF_filter_user
361 forbid_filter_dlfunc = true
362 forbid_filter_logwrite = true
363 forbid_filter_perl = true
364 forbid_filter_readsocket = true
365 forbid_filter_run = true
366 file_transport = dummy
367 directory_transport = dummy
368 pipe_transport = dummy
369 reply_transport = dummy:>)
371 ## Transports for redirection filters.
372 m4_define(<:FILTER_TRANSPORTS:>,
373 <:file_transport = mailbox
374 directory_transport = maildir
375 pipe_transport = pipe
376 reply_transport = reply:>)
378 m4_define(<:FILTER_ROUTER:>,
385 FILTER_TRANSPORTS<::>$4:>)
388 ###--------------------------------------------------------------------------
391 SECTION(routers, alias)m4_dnl
392 ## Look up the local part in the address map.
397 user = CONF_filter_user
399 local_parts = nwildlsearch; CONF_alias_file
400 data = ${expand:$local_part_data}
401 SECTION(routers, alias-opts)m4_dnl
404 ###--------------------------------------------------------------------------
405 ### Some standard transports.
407 m4_define(<:USER_DELIVERY:>,
408 <:delivery_date_add = true
409 envelope_to_add = true
410 return_path_add = true:>)
412 m4_define(<:APPLY_HEADER_CHANGES:>,
413 <:headers_add = m4_ifelse(<:$1:>, <::>,
415 <:${if def:acl_m_hdradd{$acl_m_hdradd\n}}\
417 headers_remove = m4_ifelse(<:$2:>, <::>,
419 <:${if def:acl_m_hdrrm{$acl_m_hdrrm:}}\
422 m4_define(<:SMTP_DELIVERY:>,
423 <:## Prevent sending messages with overly long lines. The use of
424 ## `message_size_limit' here is somewhat misleading.
425 message_size_limit = ${if >{$max_received_linelength}{998}{1}{0}}:>)
427 SECTION(transports)m4_dnl
428 ## A standard transport for remote delivery. By default, try to do TLS, and
429 ## don't worry too much if it's not very secure: the alternative is sending
430 ## in plaintext anyway. But all of this can be overridden from the
431 ## `domains.conf' file. Annoyingly, the `tls_dh_min_bits' setting isn't
432 ## expanded before use, so we can't set it the obvious way. Instead, encode
433 ## it into the transport name. This is very unpleasant, of course.
437 tls_require_ciphers = CONF_acceptable_ciphers
438 tls_dh_min_bits = 508
439 tls_tempfail_tryclear = true
441 m4_define(<:SMTP_TRANS_DHBITS:>,
446 hosts_require_tls = DOMKV(tls-peer-ca, {*}{})
447 hosts_require_auth = \
448 ${if bool {DOMKV(require-auth, {$value}{false})} {*}{}}
449 tls_certificate = DOMKV(tls-certificate, {${expand:$value}}fail)
450 tls_privatekey = DOMKV(tls-private-key, {${expand:$value}}fail)
451 tls_verify_certificates = DOMKV(tls-peer-ca, {${expand:$value}}fail)
452 tls_require_ciphers = \
454 {${extract {${expand:$value}} \
455 { good = CONF_good_ciphers \
456 any = CONF_acceptable_ciphers } \
458 {${expand:$value}}}} \
459 {CONF_acceptable_ciphers})
461 tls_tempfail_tryclear = true:>)m4_dnl
463 SMTP_TRANS_DHBITS(508)
465 SMTP_TRANS_DHBITS(764)
467 SMTP_TRANS_DHBITS(1020)
469 SMTP_TRANS_DHBITS(2044)
471 ## Transport to a local SMTP server; use TLS and perform client
477 hosts_require_tls = *
478 tls_certificate = CONF_sysconf_dir/client.certlist
479 tls_privatekey = CONF_sysconf_dir/client.key
480 tls_verify_certificates = CONF_ca_dir/ca.cert
481 tls_require_ciphers = CONF_good_ciphers
482 tls_dh_min_bits = 2046
483 tls_tempfail_tryclear = false
484 authenticated_sender_force = true
485 authenticated_sender = \
486 ${if def:acl_m_user {$acl_m_user@CONF_master_domain} \
487 {${if def:authenticated_sender {$authenticated_sender} \
490 ## A standard transport for local delivery.
494 file = /var/mail/$local_part
497 mode_fail_narrower = false
500 ## Transports for user filters.
510 maildir_format = true
517 path = ${if and {{def:home} {exists{$home/bin}}} {$home/bin:} {}}\
518 /usr/local/bin:/usr/local/sbin:\
519 /usr/bin:/usr/sbin:/bin:/sbin
522 return_fail_output = true
525 ## A special dummy transport for use during address verification.
531 ###--------------------------------------------------------------------------
532 ### Retry configuration.
534 SECTION(retry, default)m4_dnl
535 ## Be persistent when sending to the site relay. It ought to work, but
536 ## particularly satellites such as laptops often encounter annoying temporary
537 ## failures due to network unavailability, and the usual gradual policy can
538 ## leave mail building up for no good reason.
544 F,2h,15m; G,16h,2h,1.5; F,4d,6h
547 ###----- That's all, folks --------------------------------------------------