Use callout verification for domains we are relaying to

[chef.git] / cookbooks / exim / templates / default / exim4.conf.erb

diff --git a/cookbooks/exim/templates/default/exim4.conf.erb b/cookbooks/exim/templates/default/exim4.conf.erb
index 2d1d96e1288751dac4ed8ae2073abe63f089dc9f..635682e2ea2407aaa6d9df50897b3a3ba58de8dc 100644 (file)
--- a/cookbooks/exim/templates/default/exim4.conf.erb
+++ b/cookbooks/exim/templates/default/exim4.conf.erb
@@ -364,6 +364,11 @@ queue_only = true
 queue_run_max = <%= node[:exim][:queue_run_max] %>
 
 
+# Maximum number of simultaneous SMTP connections
+
+smtp_accept_max = <%= node[:exim][:smtp_accept_max] %>
+
+
 
 ######################################################################
 #                       ACL CONFIGURATION                            #
@@ -441,6 +446,10 @@ acl_check_rcpt:
           message       = Rejected because $sender_address is blacklisted\nQueries to postmaster@$qualify_domain
           !hosts        = +relay_from_hosts
 
+  deny    sender_domains= partial-lsearch;/etc/exim4/blocked-sender-domains
+          message       = Rejected because $sender_address is blacklisted\nQueries to postmaster@$qualify_domain
+          !hosts        = +relay_from_hosts
+
   # Accept mail to postmaster in any local domain, regardless of the source,
   # and without verifying the sender.
 
@@ -497,7 +506,11 @@ acl_check_rcpt:
   # relay domains is to use a callout (add /callout), but please read the
   # documentation about callouts before doing this.
 
-  require verify = recipient
+  deny    domains = +relay_to_domains
+         !verify  = recipient/callout=use_sender
+
+  deny    domains = !+relay_to_domains
+         !verify  = recipient
 
 <% if node[:exim][:dns_blacklists] -%>
   # Deny any messages from hosts in certain blacklists.
@@ -720,6 +733,7 @@ remote_smtp:
 
 signed_smtp:
   driver = smtp
+  connect_timeout = 1m
   dkim_domain = ${lookup{${domain:$h_from:}}partial-lsearch{/etc/exim4/dkim-domains}{$value}}
   dkim_selector = ${lookup{$dkim_domain}lsearch{/etc/exim4/dkim-selectors}{$value}}
   dkim_private_key = /etc/exim4/dkim-keys/${dkim_domain}
@@ -779,7 +793,7 @@ noreply:
   to = $sender_address
   subject = Re: $header_subject:
   headers = MIME-Version: 1.0\nContent-Type: text/plain; charset=utf-8
-  file = /etc/exim4/noreply/$local_part_data
+  file = ${lookup{$local_part}dsearch,filter=file,ret=full{/etc/exim4/noreply}}
   user = Debian-exim
   group = Debian-exim