-# $Cambridge: exim/exim-src/src/configure.default,v 1.14 2009/10/16 07:46:13 tom Exp $
+# DO NOT EDIT - This file is being maintained by Chef
######################################################################
# Runtime configuration file for Exim #
tls_advertise_hosts = <; !127.0.0.1 ; !::1
+# Configured TLS cipher selection.
+
+tls_require_ciphers = NORMAL:%LATEST_RECORD_VERSION:-VERS-SSL3.0
+
# Specify the location of the Exim server's TLS certificate and private key.
# The private key must not be encrypted (password protected). You can put
# the certificate and private key in the same file, in which case you only
# need the first setting, or in separate files, in which case you need both
# options.
-tls_certificate = /etc/ssl/certs/openstreetmap.pem
-tls_privatekey = /etc/ssl/private/openstreetmap.key
+tls_certificate = /etc/ssl/certs/exim.pem
+tls_privatekey = /etc/ssl/private/exim.key
# In order to support roaming users who wish to send email from anywhere,
# you may want to make Exim listen on other ports as well as port 25, in
trusted_users = <%= node[:exim][:trusted_users].join(" : ") %>
+# Don't keep any environment when starting programs - this is the
+# default but setting it stops exim warning
+
+keep_environment =
+
+
######################################################################
# ACL CONFIGURATION #
# testing for an empty sending host field.
accept hosts = :
-<% if node[:lsb][:release].to_i >= 10.04 -%>
control = dkim_disable_verify
-<% end -%>
#############################################################################
# The following section of the ACL is concerned with local parts that contain
deny message = Restricted characters in address
domains = !+local_domains
- local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
+ local_parts = ^[./|] : ^.*[@!] : ^.*/\\.\\./
#############################################################################
+ # Block bounces to selected addresses
+
+ deny local_parts = root:postmaster:webmaster:abuse:support
+ senders = :
+
+ # Block blacklisted senders
+
+ deny senders = lsearch*@;/etc/exim4/blocked-senders
+ message = Rejected because $sender_address is blacklisted\nQueries to postmaster@$qualify_domain
+ !hosts = +relay_from_hosts
+
# Accept mail to postmaster in any local domain, regardless of the source,
# and without verifying the sender.
# Deny incoming mail unless the sender address can be verified.
deny !hosts = +relay_from_hosts
- !verify = sender/callout/defer_ok
+ !verify = sender
# Accept if the message comes from one of the hosts for which we are an
# outgoing relay. It is assumed that such hosts are most likely to be MUAs,
accept hosts = +relay_from_hosts
control = submission
-<% if node[:lsb][:release].to_i >= 10.04 -%>
control = dkim_disable_verify
-<% end -%>
# Accept if the message arrived over an authenticated connection, from
# any host. Again, these messages are usually from MUAs, so recipient
accept authenticated = *
control = submission
-<% if node[:lsb][:release].to_i >= 10.04 -%>
control = dkim_disable_verify
-<% end -%>
# Insist that any other recipient address that we accept is either in one of
# our local domains, or is in a domain for which we explicitly allow
message = This message scored $spam_score SpamAssassin points.
<% end -%>
+ # Deny spammy messages with headers of the form:
+ # X-PHP-Originating-Script: <digits>:<name>.php
+ # X-PHP-Originating-Script: <digits>:<name>.class.php
+ deny condition = ${if match {$h_X-PHP-Originating-Script:}{^[0-9]+:[A-Za-z]+(\\.class)?\\.php\$}}
+ !hosts = +relay_from_hosts
+ message = This message failed local spam checks.
+
# Accept the message.
accept
system_aliases:
driver = redirect
- domains = +local_domains
+ domains = !noreply.openstreetmap.org : +local_domains
allow_fail
allow_defer
data = ${lookup{$local_part}lsearch{/etc/aliases}}
<% end -%>
<% if details[:local_parts] -%>
local_parts = <%= details[:local_parts].join(" : ") %>
+ local_part_suffix = +*
+ local_part_suffix_optional
<% end -%>
<% if details[:host] -%>
<% if details[:host].kind_of?(Array) -%>
remote_smtp:
driver = smtp
+ multi_domain = false
+ tls_require_ciphers = NORMAL:%LATEST_RECORD_VERSION:-VERS-SSL3.0
# This transport is used for handling pipe deliveries generated by alias or
group = Debian-exim
<% node[:exim][:routes].each do |name,details| -%>
-<% if details[:command] -%>
+<% if details[:command] or details[:file] or details[:maildir] -%>
# This transport handles mail for <%= details[:comment] -%>.
<%= name -%>:
+<% if details[:command] -%>
driver = pipe
command = <%= details[:command] %>
+ home_directory = <%= details[:home_directory] %>
+ path = <%= details[:path] || "/bin:/usr/bin" %>
+ return_fail_output
+<% else -%>
+ driver = appendfile
+<% if details[:file] -%>
+ file = <%= details[:file] %>
+<% elsif details[:maildir] -%>
+ directory = <%= details[:maildir] %>
+ maildir_format
+<% end -%>
+ envelope_to_add
+ return_path_add
+ mode = 0660
+<% end -%>
user = <%= details[:user] %>
<% if details[:group] -%>
group = <%= details[:group] %>
<% end -%>
- home_directory = <%= details[:home_directory] %>
- return_output
-
<% end -%>
<% end -%>
# There are no rewriting specifications in this default configuration file.
begin rewrite
+*@<%= node[:fqdn] %> "${if !match {${lookup{$1}lsearch{/etc/aliases}{$value}}}{@} {$1@openstreetmap.org}fail}" Eh
+<% node[:exim][:rewrites].each do |rewrite| -%>
+<%= rewrite[:pattern] %> <%= rewrite[:replacement] %> <%= rewrite[:flags] %>
+<% end -%>
projects / chef.git / blobdiff