X-Git-Url: https://git.openstreetmap.org/chef.git/blobdiff_plain/81f360d7c6892ac17aeec7686bc8d22eb02cac71..524a7ce279b8975ebe0dfb61f8f9f637e5f04b0f:/cookbooks/exim/templates/default/exim4.conf.erb

diff --git a/cookbooks/exim/templates/default/exim4.conf.erb b/cookbooks/exim/templates/default/exim4.conf.erb
index 939b2abcd..0c99c2ce7 100644
--- a/cookbooks/exim/templates/default/exim4.conf.erb
+++ b/cookbooks/exim/templates/default/exim4.conf.erb
@@ -146,6 +146,10 @@ spamd_address = 127.0.0.1 783
 
 tls_advertise_hosts = <; !127.0.0.1 ; !::1
 
+# Configured TLS cipher selection.
+
+tls_require_ciphers = NORMAL:%LATEST_RECORD_VERSION:-ARCFOUR-128:-MD5:-SHA1:-VERS-SSL3.0
+
 # Specify the location of the Exim server's TLS certificate and private key.
 # The private key must not be encrypted (password protected). You can put
 # the certificate and private key in the same file, in which case you only
@@ -657,6 +661,8 @@ begin transports
 
 remote_smtp:
   driver = smtp
+  multi_domain = false
+  tls_require_ciphers = NORMAL:%LATEST_RECORD_VERSION:-ARCFOUR-128:-MD5:-SHA1:-VERS-SSL3.0
 
 
 # This transport is used for handling pipe deliveries generated by alias or
@@ -775,7 +781,7 @@ begin retry
 # There are no rewriting specifications in this default configuration file.
 
 begin rewrite
-*@<%= node[:fqdn] %> $1@openstreetmap.org E
+*@<%= node[:fqdn] %> "${if !match {${lookup{$1}lsearch{/etc/aliases}{$value}}}{@} {$1@openstreetmap.org}fail}" Eh
 <% node[:exim][:rewrites].each do |rewrite| -%>
 <%= rewrite[:pattern] %> <%= rewrite[:replacement] %> <%= rewrite[:flags] %>
 <% end -%>