X-Git-Url: https://git.openstreetmap.org/chef.git/blobdiff_plain/4c35cca55478f6c0f76b2620a8beb22e18fb2278..5e24e241c48aae55fe5a81b73a832922ae700824:/cookbooks/exim/templates/default/exim4.conf.erb

diff --git a/cookbooks/exim/templates/default/exim4.conf.erb b/cookbooks/exim/templates/default/exim4.conf.erb
index 52816e7fa..f37dad240 100644
--- a/cookbooks/exim/templates/default/exim4.conf.erb
+++ b/cookbooks/exim/templates/default/exim4.conf.erb
@@ -306,6 +306,12 @@ log_selector = +all -skip_delivery
 trusted_users = <%= node[:exim][:trusted_users].join(" : ") %>
 
 
+# Don't keep any environment when starting programs - this is the
+# default but setting it stops exim warning
+
+keep_environment =
+
+
 
 ######################################################################
 #                       ACL CONFIGURATION                            #
@@ -371,9 +377,19 @@ acl_check_rcpt:
 
   deny    message       = Restricted characters in address
           domains       = !+local_domains
-          local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
+          local_parts   = ^[./|] : ^.*[@!] : ^.*/\\.\\./
   #############################################################################
 
+  # Block bounces to selected addresses
+
+  deny    local_parts   = root:postmaster:webmaster:abuse:support
+          senders       = :
+
+  # Block sender of spam backscatter
+
+  deny    senders       = www-data@www.easyticket.de:*@email.realestate.co.nz:sipdentistry@mail.mediaworksonline.com:www-data@*.consoglobe.com:lina-noreply@jobstreet.com:apache@704210-web2.tristatecamera.com:webmaster@openstreetmap.org
+          !hosts        = +relay_from_hosts
+
   # Accept mail to postmaster in any local domain, regardless of the source,
   # and without verifying the sender.
 
@@ -385,10 +401,6 @@ acl_check_rcpt:
   deny   !hosts         = +relay_from_hosts
          !verify        = sender
 
-  deny   !hosts         = +relay_from_hosts
-         !senders       = lsearch*@;/etc/exim4/callout_exempt_senders
-         !verify        = sender/callout/defer_ok
-
   # Accept if the message comes from one of the hosts for which we are an
   # outgoing relay. It is assumed that such hosts are most likely to be MUAs,
   # so we set control=submission to make Exim treat the message as a
@@ -491,6 +503,12 @@ acl_check_data:
           message    = This message scored $spam_score SpamAssassin points.
 
 <% end -%>
+  # Deny spammy messages with headers of the form:
+  #   X-PHP-Originating-Script: <digits>:SendMail.class.php
+  #   X-PHP-Originating-Script: <digits>:ExtendedMail.class.php
+  deny    condition  = ${if match {$h_X-PHP-Originating-Script:}{^[0-9]+:(Send|Extended)Mail\\.class\\.php\$}}
+          message    = This message failed local spam checks.
+
   # Accept the message.
 
   accept
@@ -529,7 +547,7 @@ begin routers
 
 system_aliases:
   driver = redirect
-  domains = +local_domains
+  domains = !noreply.openstreetmap.org : +local_domains
   allow_fail
   allow_defer
   data = ${lookup{$local_part}lsearch{/etc/aliases}}
@@ -575,6 +593,8 @@ noreply:
 <% end -%>
 <% if details[:local_parts] -%>
   local_parts = <%= details[:local_parts].join(" : ") %>
+  local_part_suffix = +*
+  local_part_suffix_optional
 <% end -%>
 <% if details[:host] -%>
 <% if details[:host].kind_of?(Array) -%>
@@ -705,6 +725,7 @@ noreply:
   driver = pipe
   command = <%= details[:command] %>
   home_directory = <%= details[:home_directory] %>
+  path = <%= details[:path] || "/bin:/usr/bin" %>
   return_output
 <% else -%>
   driver = appendfile
@@ -758,6 +779,9 @@ begin retry
 # There are no rewriting specifications in this default configuration file.
 
 begin rewrite
+<% node[:exim][:rewrites].each do |rewrite| -%>
+<%= rewrite[:pattern] %> <%= rewrite[:replacement] %> <%= rewrite[:flags] %>
+<% end -%>