X-Git-Url: https://git.openstreetmap.org/chef.git/blobdiff_plain/faf8ae12e85eabb050b0f5eceb2cb67ad1de5261..68eb1cf48d7fee98a751c04c57ac58c80764d230:/cookbooks/exim/templates/default/exim4.conf.erb diff --git a/cookbooks/exim/templates/default/exim4.conf.erb b/cookbooks/exim/templates/default/exim4.conf.erb index c1a842c5b..ec423cc7e 100644 --- a/cookbooks/exim/templates/default/exim4.conf.erb +++ b/cookbooks/exim/templates/default/exim4.conf.erb @@ -1,4 +1,4 @@ -# $Cambridge: exim/exim-src/src/configure.default,v 1.14 2009/10/16 07:46:13 tom Exp $ +# DO NOT EDIT - This file is being maintained by Chef ###################################################################### # Runtime configuration file for Exim # @@ -152,8 +152,8 @@ tls_advertise_hosts = <; !127.0.0.1 ; !::1 # need the first setting, or in separate files, in which case you need both # options. -tls_certificate = /etc/ssl/certs/openstreetmap.pem -tls_privatekey = /etc/ssl/private/openstreetmap.key +tls_certificate = /etc/ssl/certs/exim.pem +tls_privatekey = /etc/ssl/private/exim.key # In order to support roaming users who wish to send email from anywhere, # you may want to make Exim listen on other ports as well as port 25, in @@ -306,6 +306,12 @@ log_selector = +all -skip_delivery trusted_users = <%= node[:exim][:trusted_users].join(" : ") %> +# Don't keep any environment when starting programs - this is the +# default but setting it stops exim warning + +keep_environment = + + ###################################################################### # ACL CONFIGURATION # @@ -324,9 +330,7 @@ acl_check_rcpt: # testing for an empty sending host field. accept hosts = : -<% if node[:lsb][:release].to_i >= 10.04 -%> control = dkim_disable_verify -<% end -%> ############################################################################# # The following section of the ACL is concerned with local parts that contain @@ -371,9 +375,19 @@ acl_check_rcpt: deny message = Restricted characters in address domains = !+local_domains - local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./ + local_parts = ^[./|] : ^.*[@!] : ^.*/\\.\\./ ############################################################################# + # Block bounces to selected addresses + + deny local_parts = root:postmaster:webmaster:abuse:support + senders = : + + # Block sender of spam backscatter + + deny senders = www-data@www.easyticket.de:*@email.realestate.co.nz:sipdentistry@mail.mediaworksonline.com:www-data@*.consoglobe.com:lina-noreply@jobstreet.com:apache@704210-web2.tristatecamera.com:webmaster@openstreetmap.org:noreply@pring.co.uk + !hosts = +relay_from_hosts + # Accept mail to postmaster in any local domain, regardless of the source, # and without verifying the sender. @@ -383,7 +397,7 @@ acl_check_rcpt: # Deny incoming mail unless the sender address can be verified. deny !hosts = +relay_from_hosts - !verify = sender/callout/defer_ok + !verify = sender # Accept if the message comes from one of the hosts for which we are an # outgoing relay. It is assumed that such hosts are most likely to be MUAs, @@ -406,9 +420,7 @@ acl_check_rcpt: accept hosts = +relay_from_hosts control = submission -<% if node[:lsb][:release].to_i >= 10.04 -%> control = dkim_disable_verify -<% end -%> # Accept if the message arrived over an authenticated connection, from # any host. Again, these messages are usually from MUAs, so recipient @@ -417,9 +429,7 @@ acl_check_rcpt: accept authenticated = * control = submission -<% if node[:lsb][:release].to_i >= 10.04 -%> control = dkim_disable_verify -<% end -%> # Insist that any other recipient address that we accept is either in one of # our local domains, or is in a domain for which we explicitly allow @@ -487,6 +497,13 @@ acl_check_data: message = This message scored $spam_score SpamAssassin points. <% end -%> + # Deny spammy messages with headers of the form: + # X-PHP-Originating-Script: :.php + # X-PHP-Originating-Script: :.class.php + deny condition = ${if match {$h_X-PHP-Originating-Script:}{^[0-9]+:[A-Za-z]+(\\.class)?\\.php\$}} + !hosts = +relay_from_hosts + message = This message failed local spam checks. + # Accept the message. accept @@ -525,7 +542,7 @@ begin routers system_aliases: driver = redirect - domains = +local_domains + domains = !noreply.openstreetmap.org : +local_domains allow_fail allow_defer data = ${lookup{$local_part}lsearch{/etc/aliases}} @@ -571,6 +588,8 @@ noreply: <% end -%> <% if details[:local_parts] -%> local_parts = <%= details[:local_parts].join(" : ") %> + local_part_suffix = +* + local_part_suffix_optional <% end -%> <% if details[:host] -%> <% if details[:host].kind_of?(Array) -%> @@ -693,19 +712,32 @@ noreply: group = Debian-exim <% node[:exim][:routes].each do |name,details| -%> -<% if details[:command] -%> +<% if details[:command] or details[:file] or details[:maildir] -%> # This transport handles mail for <%= details[:comment] -%>. <%= name -%>: +<% if details[:command] -%> driver = pipe command = <%= details[:command] %> + home_directory = <%= details[:home_directory] %> + path = <%= details[:path] || "/bin:/usr/bin" %> + return_output +<% else -%> + driver = appendfile +<% if details[:file] -%> + file = <%= details[:file] %> +<% elsif details[:maildir] -%> + directory = <%= details[:maildir] %> + maildir_format +<% end -%> + envelope_to_add + return_path_add + mode = 0660 +<% end -%> user = <%= details[:user] %> <% if details[:group] -%> group = <%= details[:group] %> <% end -%> - home_directory = <%= details[:home_directory] %> - return_output - <% end -%> <% end -%> @@ -742,6 +774,9 @@ begin retry # There are no rewriting specifications in this default configuration file. begin rewrite +<% node[:exim][:rewrites].each do |rewrite| -%> +<%= rewrite[:pattern] %> <%= rewrite[:replacement] %> <%= rewrite[:flags] %> +<% end -%>