3 ### Transmission to remote hosts for distorted.org.uk Exim configuration.
5 ### (c) 2012 Mark Wooding
8 ###----- Licensing notice ---------------------------------------------------
10 ### This program is free software; you can redistribute it and/or modify
11 ### it under the terms of the GNU General Public License as published by
12 ### the Free Software Foundation; either version 2 of the License, or
13 ### (at your option) any later version.
15 ### This program is distributed in the hope that it will be useful,
16 ### but WITHOUT ANY WARRANTY; without even the implied warranty of
17 ### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 ### GNU General Public License for more details.
20 ### You should have received a copy of the GNU General Public License
21 ### along with this program; if not, write to the Free Software Foundation,
22 ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
24 ###--------------------------------------------------------------------------
25 ### Listen for incoming connections.
27 SECTION(global, daemon)m4_dnl
28 daemon_smtp_ports = CONF_smtp_port : CONF_submission_port
30 SECTION(global, tls)m4_dnl
31 tls_certificate = CONF_sysconf_dir/server.cert
32 tls_privatekey = CONF_sysconf_dir/server.key
33 tls_advertise_hosts = *
34 tls_dhparam = CONF_ca_dir/dh-param-2048.pem
35 tls_require_ciphers = ${if or {{={$received_port}{CONF_submission_port}} \
36 {match_ip {$sender_host_address}{+trusted}}} \
38 {CONF_acceptable_ciphers}}
39 tls_verify_certificates = CONF_ca_dir/ca.cert
40 tls_verify_hosts = ${if eq{$acl_c_mode}{submission} {} {+allnets}}
43 ###--------------------------------------------------------------------------
44 ### Check source addresses for apparently local senders.
46 SECTION(acl, mail-hooks)m4_dnl
47 ## Check that a submitted message's sender address is allowable.
48 require acl = mail_client_addr
50 ## Insist that a local client connect through TLS.
51 deny message = Hosts within CONF_master_domain must use TLS
52 !condition = ${if eq{$acl_c_mode}{submission}}
56 SECTION(acl, misc)m4_dnl
59 ## If this is a message submission then that's handled elsewhere.
60 accept condition = ${if eq{$acl_c_mode}{submission}}
62 ## Make sure that the sender matches the client address. I feel like
63 ## I want to reject these, but that will break stuff. For example,
64 ## if I send mail to an externally hosted address which is really a
65 ## distribution list containing some local address, then we'll
66 ## (approximately legitimately) receive mail with an apparently-local
67 ## sender from a remote host.
68 warn !hosts = ${LOOKUP_DOMAIN($sender_address_domain,
69 {KV(hosts, {$value}{+allnets})},
70 {${if match_domain {$sender_address_domain} \
72 {+allnets}{! +allnets}}})}
73 add_header = :after_received:X-Distorted-Warning: \
75 Apparently local sender, but received from remote \
77 sender=$sender_address, \
78 host=$sender_host_address
84 ###--------------------------------------------------------------------------
85 ### The obvious trivial router.
87 SECTION(routers, remote)m4_dnl
88 ## Send mail on to a host in our own network. We must apply extra security.
91 domains = ! +known : *.CONF_master_domain
93 transport = smtp_local
96 ## Send mail on to unknown hosts.
105 ###----- That's all, folks --------------------------------------------------