3 ### Basic settings for distorted.org.uk Exim configuration
5 ### (c) 2012 Mark Wooding
8 ###----- Licensing notice ---------------------------------------------------
10 ### This program is free software; you can redistribute it and/or modify
11 ### it under the terms of the GNU General Public License as published by
12 ### the Free Software Foundation; either version 2 of the License, or
13 ### (at your option) any later version.
15 ### This program is distributed in the hope that it will be useful,
16 ### but WITHOUT ANY WARRANTY; without even the implied warranty of
17 ### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 ### GNU General Public License for more details.
20 ### You should have received a copy of the GNU General Public License
21 ### along with this program; if not, write to the Free Software Foundation,
22 ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
24 ###--------------------------------------------------------------------------
27 SECTION(global, priv)m4_dnl
28 admin_groups = CONF_admin_groups
29 trusted_groups = CONF_trusted_groups
30 prod_requires_admin = false
32 SECTION(global, logging)m4_dnl
33 log_file_path = : syslog
38 syslog_duplication = false
39 syslog_timestamp = false
41 SECTION(global, daemon)m4_dnl
42 local_interfaces = <; CONF_interfaces
43 extra_local_interfaces = <; 0.0.0.0 ; ::0
45 SECTION(global, resource)m4_dnl
46 deliver_queue_load_max = 8
47 message_size_limit = 500M
50 smtp_accept_queue = 32
51 smtp_accept_reserve = 4
52 smtp_load_reserve = 10
53 smtp_reserve_hosts = +trusted
55 SECTION(global, policy)m4_dnl
58 SECTION(global, users)m4_dnl
60 gecos_pattern = ([^,:]*)
62 SECTION(global, incoming)m4_dnl
64 rfc1413_query_timeout = 10s
65 received_header_text = Received: \
66 ${if def:sender_rcvhost \
67 {from $sender_rcvhost\n\t} \
68 {${if def:sender_ident \
69 {from ${quote_local_part:$sender_ident} }}}}\
70 by $primary_hostname \
71 (Exim $version_number)\
72 ${if def:tls_cipher {\n\t} { }}\
73 ${if def:received_protocol \
74 {with $received_protocol \
75 ${if def:tls_cipher {(cipher=$tls_cipher)}}}}\n\t\
76 ${if def:sender_address \
77 {(envelope-from $sender_address\
78 ${if def:authenticated_id \
79 {; auth=${quote_local_part:$authenticated_id}} \
80 {${if and {{def:authenticated_sender} \
81 {match_address{$authenticated_sender} \
82 {*@CONF_master_domain}}} \
83 {; auth=${quote_local_part:\
85 $authenticated_sender}}}}}})\n\t}}\
87 ${if def:received_for {\n\tfor $received_for}}
89 SECTION(global, smtp)m4_dnl
90 smtp_return_error_details = true
91 accept_8bitmime = true
92 chunking_advertise_hosts =
94 SECTION(global, env)m4_dnl
97 SECTION(global, process)m4_dnl
98 extract_addresses_remove_arguments = false
99 headers_charset = utf-8
100 qualify_domain = CONF_master_domain
101 untrusted_set_sender = *
102 local_from_check = false
103 local_sender_retain = true
105 SECTION(global, bounce)m4_dnl
106 delay_warning = 1h : 24h : 2d
108 SECTION(global, tls)m4_dnl
109 tls_certificate = CONF_certlist
110 tls_privatekey = CONF_sysconf_dir/server.key
111 tls_advertise_hosts = ${if exists {CONF_sysconf_dir/server.key} {*}{}}
112 tls_dhparam = CONF_ca_dir/dh-param-2048.pem
113 tls_require_ciphers = ${if or {{={$received_port}{CONF_submission_port}} \
114 {match_ip {$sender_host_address}{+trusted}}} \
115 {CONF_good_ciphers} \
116 {CONF_acceptable_ciphers}}
117 tls_verify_certificates = CONF_ca_dir/ca.cert
118 tls_verify_hosts = ${if eq{$acl_c_mode}{submission} {} {+allnets}}
121 ###--------------------------------------------------------------------------
122 ### Access control lists.
124 SECTION(global, acl-after)
125 SECTION(global, acl)m4_dnl
127 SECTION(acl, misc)m4_dnl
129 ## Don't worry if this is local submission. MUAs won't necessarily
130 ## have a clear idea of their hostnames. (For some reason.)
131 accept condition = ${if !eq{$acl_c_mode}{submission}}
133 ## Check that the caller's claimed identity is actually plausible.
134 ## This seems like it's a fairly effective filter on spamminess, but
135 ## it's too blunt a tool. Rather than reject, add a warning header.
136 ## Only we can't do this the easy way, so save it up for use in MAIL.
137 ## Also, we're liable to get a subsequent HELO (e.g., after STARTTLS)
138 ## and we should only care about the most recent one.
139 warn set acl_c_helo_warning = false
141 ${if and {{match_ip {$sender_host_address} \
142 {<; 127.0.0.0/8 ; ::1}} \
143 {match_domain {$sender_helo_name} \
144 {localhost : +thishost}}}}
146 ${if exists {CONF_sysconf_dir/helo.conf} \
147 {${lookup {$sender_helo_name} \
149 {CONF_sysconf_dir/helo.conf} \
151 {$sender_host_address} \
154 set acl_c_helo_warning = true
158 SECTION(global, acl)m4_dnl
159 acl_not_smtp_start = not_smtp_start
160 SECTION(acl, misc)m4_dnl
162 ## Record the user's name.
163 warn set acl_c_user = $sender_ident
164 set acl_m_user = $sender_ident
169 SECTION(global, acl)m4_dnl
171 SECTION(acl, mail)m4_dnl
174 ## If we stashed a warning header about HELO from earlier, we should
175 ## add it now. Only don't bother if the client has authenticated
176 ## successfully for submission (because we can't expect mobile
177 ## clients to be properly set up knowing their names), or it's one of
178 ## our own satellites (because they're either properly set up anyway,
179 ## or satellites using us as a smarthost).
180 warn condition = $acl_c_helo_warning
181 !condition = ${if eq{$acl_c_mode}{submission}}
183 WARNING_HEADER(BADHELO,
184 <:Client's HELO doesn't match its IP address.\n\t\
185 helo-name=$sender_helo_name \
186 address=$sender_host_address:>)
188 ## Always allow the empty sender, so that we can receive bounces.
191 ## Ensure that the sender looks valid.
192 require acl = mail_check_sender
194 ## If this is directly from a client then hack on it for a while.
195 warn condition = ${if eq{$acl_c_mode}{submission}}
196 control = submission/sender_retain
198 ## Insist that a local client connect through TLS.
199 deny message = Hosts within CONF_master_domain must use TLS
200 !condition = ${if eq{$acl_c_mode}{submission}}
204 ## Check that a submitted message's sender address is allowable.
205 require acl = mail_check_auth
207 SECTION(acl, mail-tail)m4_dnl
211 SECTION(acl, misc)m4_dnl
214 ## See whether there's a special exception for this sender domain.
215 accept senders = ${LOOKUP_DOMAIN($sender_address_domain,
216 {KV(senders, {$value}{})},
219 ## Ensure that the sender is routable. This is important to prevent
220 ## undeliverable bounces.
221 require message = Invalid sender; \
222 ($sender_verify_failure; $acl_verify_message)
228 SECTION(global, acl)m4_dnl
229 acl_smtp_connect = connect
230 SECTION(acl, connect)m4_dnl
232 SECTION(acl, connect-tail)m4_dnl
233 ## Configure variables according to the submission mode.
234 warn acl = check_submission
240 ## See whether this message needs hacking on.
241 accept !hosts = +thishost
242 !condition = ${if ={$received_port}{CONF_submission_port}}
243 set acl_c_mode = relay
245 ## Remember to apply submission controls.
246 warn set acl_c_mode = submission
247 control = no_enforce_sync
252 SECTION(global, acl)m4_dnl
254 SECTION(acl, rcpt)m4_dnl
257 ## Reject if the client isn't allowed to relay and the recipient
258 ## isn't in one of our known domains.
259 require message = Relaying not permitted
262 ## Ensure that the recipient is routable.
263 require message = Invalid recipient \
264 ($recipient_verify_failure; $acl_verify_message)
267 SECTION(acl, misc)m4_dnl
269 ## Accept either if the client is allowed to relay through us, or if
270 ## we're the correct place to send this mail.
272 ## Known clients and authenticated users are OK.
273 accept hosts = CONF_relay_clients
274 accept authenticated = *
276 ## Known domains are OK.
277 accept domains = +public
279 ## Finally, domains in our table are OK, unless they say they aren't.
281 ${if exists{CONF_sysconf_dir/domains.conf} \
282 {partial0-lsearch; CONF_sysconf_dir/domains.conf}}
283 condition = DOMKV(service, {$value}{true})
285 ## Nope, that's not allowed.
288 SECTION(acl, rcpt-tail)m4_dnl
289 ## Everything checks out OK: let this one go through.
292 SECTION(global, acl)m4_dnl
294 SECTION(acl, data)m4_dnl
296 ## Don't accept messages with overly-long lines.
297 deny message = line length exceeds SMTP permitted maximum: \
298 $max_received_linelength > 998
299 condition = ${if >{$max_received_linelength}{998}}
301 SECTION(acl, data-tail)m4_dnl
304 SECTION(global, acl)m4_dnl
305 acl_smtp_expn = expn_vrfy
306 acl_smtp_vrfy = expn_vrfy
307 SECTION(acl, misc)m4_dnl
309 accept hosts = +trusted
310 deny message = Suck it and see
313 ###--------------------------------------------------------------------------
314 ### Verification of sender address.
316 SECTION(acl, misc)m4_dnl
319 ## If this isn't a submission then it doesn't need checking.
320 accept condition = ${if !eq{$acl_c_mode}{submission}}
322 ## If the caller hasn't formally authenticated, but this is a
323 ## loopback connection, then we can trust identd to tell us the right
324 ## answer. So we should stash the right name somewhere consistent.
325 warn set acl_c_user = $authenticated_id
328 condition = ${if def:sender_ident}
329 set acl_c_user = $sender_ident
331 ## User must be authenticated by now.
332 deny message = Sender not authenticated
333 condition = ${if !def:acl_c_user}
335 ## Set the per-message authentication flag, since we now know that
336 ## there's a sensible value.
337 warn set acl_m_user = $acl_c_user
343 ###--------------------------------------------------------------------------
344 ### Common options for forwarding routers.
346 ## We're pretty permissive here.
347 m4_define(<:FILTER_BASE:>,
355 forbid_blackhole = false
356 check_ancestor = true:>)
358 ## Common options for forwarding routers at verification time.
359 m4_define(<:FILTER_VERIFY:>,
361 user = CONF_filter_user
362 forbid_filter_dlfunc = true
363 forbid_filter_logwrite = true
364 forbid_filter_perl = true
365 forbid_filter_readsocket = true
366 forbid_filter_run = true
367 file_transport = dummy
368 directory_transport = dummy
369 pipe_transport = dummy
370 reply_transport = dummy:>)
372 ## Transports for redirection filters.
373 m4_define(<:FILTER_TRANSPORTS:>,
374 <:file_transport = mailbox
375 directory_transport = maildir
376 pipe_transport = pipe
377 reply_transport = reply:>)
379 m4_define(<:FILTER_ROUTER:>,
386 FILTER_TRANSPORTS<::>$4:>)
389 ###--------------------------------------------------------------------------
392 SECTION(routers, alias)m4_dnl
393 ## Look up the local part in the address map.
398 user = CONF_filter_user
400 local_parts = nwildlsearch; CONF_alias_file
401 data = ${expand:$local_part_data}
402 SECTION(routers, alias-opts)m4_dnl
405 ###--------------------------------------------------------------------------
406 ### Some standard transports.
408 m4_define(<:USER_DELIVERY:>,
409 <:delivery_date_add = true
410 envelope_to_add = true
411 return_path_add = true:>)
413 m4_define(<:APPLY_HEADER_CHANGES:>,
414 <:headers_add = m4_ifelse(<:$1:>, <::>,
416 <:${if def:acl_m_hdradd{$acl_m_hdradd\n}}\
418 headers_remove = m4_ifelse(<:$2:>, <::>,
420 <:${if def:acl_m_hdrrm{$acl_m_hdrrm:}}\
423 m4_define(<:SMTP_DELIVERY:>,
424 <:## Prevent sending messages with overly long lines. The use of
425 ## `message_size_limit' here is somewhat misleading.
426 message_size_limit = ${if >{$max_received_linelength}{998}{1}{0}}:>)
428 SECTION(transports)m4_dnl
429 ## A standard transport for remote delivery. By default, try to do TLS, and
430 ## don't worry too much if it's not very secure: the alternative is sending
431 ## in plaintext anyway. But all of this can be overridden from the
432 ## `domains.conf' file. Annoyingly, the `tls_dh_min_bits' setting isn't
433 ## expanded before use, so we can't set it the obvious way. Instead, encode
434 ## it into the transport name. This is very unpleasant, of course.
438 tls_require_ciphers = CONF_acceptable_ciphers
439 tls_dh_min_bits = 508
440 tls_tempfail_tryclear = true
442 m4_define(<:SMTP_TRANS_DHBITS:>,
447 hosts_require_tls = DOMKV(tls-peer-ca, {*}{})
448 hosts_require_auth = \
449 ${if bool {DOMKV(require-auth, {$value}{false})} {*}{}}
450 tls_certificate = DOMKV(tls-certificate, {${expand:$value}}fail)
451 tls_privatekey = DOMKV(tls-private-key, {${expand:$value}}fail)
452 tls_verify_certificates = DOMKV(tls-peer-ca, {${expand:$value}}fail)
453 tls_require_ciphers = \
455 {${extract {${expand:$value}} \
456 { good = CONF_good_ciphers \
457 any = CONF_acceptable_ciphers } \
459 {${expand:$value}}}} \
460 {CONF_acceptable_ciphers})
462 tls_tempfail_tryclear = true:>)m4_dnl
464 SMTP_TRANS_DHBITS(508)
466 SMTP_TRANS_DHBITS(764)
468 SMTP_TRANS_DHBITS(1020)
470 SMTP_TRANS_DHBITS(2044)
472 ## Transport to a local SMTP server; use TLS and perform client
478 hosts_require_tls = *
479 tls_certificate = CONF_sysconf_dir/client.certlist
480 tls_privatekey = CONF_sysconf_dir/client.key
481 tls_verify_certificates = CONF_ca_dir/ca.cert
482 tls_require_ciphers = CONF_good_ciphers
483 tls_dh_min_bits = 2046
484 tls_tempfail_tryclear = false
485 authenticated_sender_force = true
486 authenticated_sender = \
487 ${if def:acl_m_user {$acl_m_user@CONF_master_domain} \
488 {${if def:authenticated_sender {$authenticated_sender} \
491 ## A standard transport for local delivery.
495 file = /var/mail/$local_part
498 mode_fail_narrower = false
501 ## Transports for user filters.
511 maildir_format = true
518 path = ${if and {{def:home} {exists{$home/bin}}} {$home/bin:} {}}\
519 /usr/local/bin:/usr/local/sbin:\
520 /usr/bin:/usr/sbin:/bin:/sbin
523 return_fail_output = true
526 ## A special dummy transport for use during address verification.
532 ###--------------------------------------------------------------------------
533 ### Retry configuration.
535 SECTION(retry, default)m4_dnl
536 ## Be persistent when sending to the site relay. It ought to work, but
537 ## particularly satellites such as laptops often encounter annoying temporary
538 ## failures due to network unavailability, and the usual gradual policy can
539 ## leave mail building up for no good reason.
545 F,2h,15m; G,16h,2h,1.5; F,4d,6h
548 ###----- That's all, folks --------------------------------------------------