Merge remote-tracking branch 'github/pull/183'

[chef.git] / cookbooks / exim / templates / default / exim4.conf.erb

diff --git a/cookbooks/exim/templates/default/exim4.conf.erb b/cookbooks/exim/templates/default/exim4.conf.erb
index 3b33facf7fd5941edc1562b8d2f2f191b72dd018..a00aefd8c05230d96d6830c7df5196c6695c8390 100644 (file)
--- a/cookbooks/exim/templates/default/exim4.conf.erb
+++ b/cookbooks/exim/templates/default/exim4.conf.erb
@@ -306,6 +306,12 @@ log_selector = +all -skip_delivery
 trusted_users = <%= node[:exim][:trusted_users].join(" : ") %>
 
 
 trusted_users = <%= node[:exim][:trusted_users].join(" : ") %>
 
 

+# Don't keep any environment when starting programs - this is the
+# default but setting it stops exim warning
+
+keep_environment =
+
+

 
 ######################################################################
 #                       ACL CONFIGURATION                            #
 
 ######################################################################
 #                       ACL CONFIGURATION                            #


@@ -324,9 +330,7 @@ acl_check_rcpt:
   # testing for an empty sending host field.
 
   accept  hosts = :
   # testing for an empty sending host field.
 
   accept  hosts = :

-<% if node[:lsb][:release].to_i >= 10.04 -%>

           control = dkim_disable_verify
           control = dkim_disable_verify

-<% end -%>

 
   #############################################################################
   # The following section of the ACL is concerned with local parts that contain
 
   #############################################################################
   # The following section of the ACL is concerned with local parts that contain


@@ -371,9 +375,20 @@ acl_check_rcpt:
 
   deny    message       = Restricted characters in address
           domains       = !+local_domains
 
   deny    message       = Restricted characters in address
           domains       = !+local_domains

-          local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
+          local_parts   = ^[./|] : ^.*[@!] : ^.*/\\.\\./

   #############################################################################
 
   #############################################################################
 

+  # Block bounces to selected addresses
+
+  deny    local_parts   = root:postmaster:webmaster:abuse:support
+          senders       = :
+
+  # Block blacklisted senders
+
+  deny    senders       = lsearch*@;/etc/exim4/blocked-senders
+          message       = Rejected because $sender_address is blacklisted\nQueries to postmaster@$qualify_domain
+          !hosts        = +relay_from_hosts
+

   # Accept mail to postmaster in any local domain, regardless of the source,
   # and without verifying the sender.
 
   # Accept mail to postmaster in any local domain, regardless of the source,
   # and without verifying the sender.
 


@@ -385,10 +400,6 @@ acl_check_rcpt:
   deny   !hosts         = +relay_from_hosts
          !verify        = sender
 
   deny   !hosts         = +relay_from_hosts
          !verify        = sender
 

-  deny   !hosts         = +relay_from_hosts
-         !senders       = lsearch*@;/etc/exim4/callout_exempt_senders
-         !verify        = sender/callout/defer_ok
-

   # Accept if the message comes from one of the hosts for which we are an
   # outgoing relay. It is assumed that such hosts are most likely to be MUAs,
   # so we set control=submission to make Exim treat the message as a
   # Accept if the message comes from one of the hosts for which we are an
   # outgoing relay. It is assumed that such hosts are most likely to be MUAs,
   # so we set control=submission to make Exim treat the message as a


@@ -410,9 +421,7 @@ acl_check_rcpt:
 
   accept  hosts         = +relay_from_hosts
           control       = submission
 
   accept  hosts         = +relay_from_hosts
           control       = submission

-<% if node[:lsb][:release].to_i >= 10.04 -%>

           control       = dkim_disable_verify
           control       = dkim_disable_verify

-<% end -%>

 
   # Accept if the message arrived over an authenticated connection, from
   # any host. Again, these messages are usually from MUAs, so recipient
 
   # Accept if the message arrived over an authenticated connection, from
   # any host. Again, these messages are usually from MUAs, so recipient


@@ -421,9 +430,7 @@ acl_check_rcpt:
 
   accept  authenticated = *
           control       = submission
 
   accept  authenticated = *
           control       = submission

-<% if node[:lsb][:release].to_i >= 10.04 -%>

           control       = dkim_disable_verify
           control       = dkim_disable_verify

-<% end -%>

 
   # Insist that any other recipient address that we accept is either in one of
   # our local domains, or is in a domain for which we explicitly allow
 
   # Insist that any other recipient address that we accept is either in one of
   # our local domains, or is in a domain for which we explicitly allow


@@ -491,6 +498,13 @@ acl_check_data:
           message    = This message scored $spam_score SpamAssassin points.
 
 <% end -%>
           message    = This message scored $spam_score SpamAssassin points.
 
 <% end -%>

+  # Deny spammy messages with headers of the form:
+  #   X-PHP-Originating-Script: <digits>:<name>.php
+  #   X-PHP-Originating-Script: <digits>:<name>.class.php
+  deny    condition  = ${if match {$h_X-PHP-Originating-Script:}{^[0-9]+:[A-Za-z]+(\\.class)?\\.php\$}}
+         !hosts      = +relay_from_hosts
+          message    = This message failed local spam checks.
+

   # Accept the message.
 
   accept
   # Accept the message.
 
   accept


@@ -529,7 +543,7 @@ begin routers
 
 system_aliases:
   driver = redirect
 
 system_aliases:
   driver = redirect

-  domains = +local_domains
+  domains = !noreply.openstreetmap.org : +local_domains

   allow_fail
   allow_defer
   data = ${lookup{$local_part}lsearch{/etc/aliases}}
   allow_fail
   allow_defer
   data = ${lookup{$local_part}lsearch{/etc/aliases}}


@@ -575,6 +589,8 @@ noreply:
 <% end -%>
 <% if details[:local_parts] -%>
   local_parts = <%= details[:local_parts].join(" : ") %>
 <% end -%>
 <% if details[:local_parts] -%>
   local_parts = <%= details[:local_parts].join(" : ") %>

+  local_part_suffix = +*
+  local_part_suffix_optional

 <% end -%>
 <% if details[:host] -%>
 <% if details[:host].kind_of?(Array) -%>
 <% end -%>
 <% if details[:host] -%>
 <% if details[:host].kind_of?(Array) -%>


@@ -641,6 +657,7 @@ begin transports
 
 remote_smtp:
   driver = smtp
 
 remote_smtp:
   driver = smtp

+  multi_domain = false

 
 
 # This transport is used for handling pipe deliveries generated by alias or
 
 
 # This transport is used for handling pipe deliveries generated by alias or


@@ -697,19 +714,32 @@ noreply:
   group = Debian-exim
 
 <% node[:exim][:routes].each do |name,details| -%>
   group = Debian-exim
 
 <% node[:exim][:routes].each do |name,details| -%>

-<% if details[:command] -%>
+<% if details[:command] or details[:file] or details[:maildir] -%>

 # This transport handles mail for <%= details[:comment] -%>.
 
 <%= name -%>:
 # This transport handles mail for <%= details[:comment] -%>.
 
 <%= name -%>:

+<% if details[:command] -%>

   driver = pipe
   command = <%= details[:command] %>
   driver = pipe
   command = <%= details[:command] %>

+  home_directory = <%= details[:home_directory] %>
+  path = <%= details[:path] || "/bin:/usr/bin" %>
+  return_fail_output
+<% else -%>
+  driver = appendfile
+<% if details[:file] -%>
+  file = <%= details[:file] %>
+<% elsif details[:maildir] -%>
+  directory = <%= details[:maildir] %>
+  maildir_format
+<% end -%>
+  envelope_to_add
+  return_path_add
+  mode = 0660
+<% end -%>

   user = <%= details[:user] %>
 <% if details[:group] -%>
   group = <%= details[:group] %>
 <% end -%>
   user = <%= details[:user] %>
 <% if details[:group] -%>
   group = <%= details[:group] %>
 <% end -%>

-  home_directory = <%= details[:home_directory] %>
-  return_output
-

 
 <% end -%>
 <% end -%>
 
 <% end -%>
 <% end -%>


@@ -746,6 +776,10 @@ begin retry
 # There are no rewriting specifications in this default configuration file.
 
 begin rewrite
 # There are no rewriting specifications in this default configuration file.
 
 begin rewrite

+*@<%= node[:fqdn] %> "${if !match {${lookup{$1}lsearch{/etc/aliases}{$value}}}{@} {$1@openstreetmap.org}fail}" Eh
+<% node[:exim][:rewrites].each do |rewrite| -%>
+<%= rewrite[:pattern] %> <%= rewrite[:replacement] %> <%= rewrite[:flags] %>
+<% end -%>