X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/5a2d9e3b4b867fac5c6dabedecc70a3bde328902..8d4ee517d61bfcce851e66872fcd762e9a5f751c:/cookbooks/exim/templates/default/exim4.conf.erb diff --git a/cookbooks/exim/templates/default/exim4.conf.erb b/cookbooks/exim/templates/default/exim4.conf.erb index 530b105d4..e0224872e 100644 --- a/cookbooks/exim/templates/default/exim4.conf.erb +++ b/cookbooks/exim/templates/default/exim4.conf.erb @@ -146,6 +146,10 @@ spamd_address = 127.0.0.1 783 tls_advertise_hosts = <; !127.0.0.1 ; !::1 +# Configured TLS cipher selection. + +tls_require_ciphers = NORMAL:-VERS-SSL3.0:-CIPHER-ALL:-SHA1:-MD5:+SHA1:+AES-256-GCM:+AES-256-CBC:+CAMELLIA-256-CBC:+AES-128-GCM:+AES-128-CBC:+CAMELLIA-128-CBC:%SERVER_PRECEDENCE + # Specify the location of the Exim server's TLS certificate and private key. # The private key must not be encrypted (password protected). You can put # the certificate and private key in the same file, in which case you only @@ -383,9 +387,10 @@ acl_check_rcpt: deny local_parts = root:postmaster:webmaster:abuse:support senders = : - # Block sender of spam backscatter + # Block blacklisted senders - deny senders = www-data@www.easyticket.de:*@email.realestate.co.nz:sipdentistry@mail.mediaworksonline.com:www-data@*.consoglobe.com:lina-noreply@jobstreet.com:apache@704210-web2.tristatecamera.com:webmaster@openstreetmap.org:noreply@pring.co.uk:admin@honeygame.com + deny senders = lsearch*@;/etc/exim4/blocked-senders + message = Rejected because $sender_address is blacklisted\nQueries to postmaster@$qualify_domain !hosts = +relay_from_hosts # Accept mail to postmaster in any local domain, regardless of the source, @@ -656,6 +661,8 @@ begin transports remote_smtp: driver = smtp + multi_domain = false + tls_require_ciphers = NORMAL:-VERS-SSL3.0:-CIPHER-ALL:-SHA1:-MD5:+SHA1:+AES-256-GCM:+AES-256-CBC:+CAMELLIA-256-CBC:+AES-128-GCM:+AES-128-CBC:+CAMELLIA-128-CBC:%SERVER_PRECEDENCE # This transport is used for handling pipe deliveries generated by alias or @@ -774,6 +781,7 @@ begin retry # There are no rewriting specifications in this default configuration file. begin rewrite +*@<%= node[:fqdn] %> "${if !match {${lookup{$1}lsearch{/etc/aliases}{$value}}}{@} {$1@openstreetmap.org}fail}" Eh <% node[:exim][:rewrites].each do |rewrite| -%> <%= rewrite[:pattern] %> <%= rewrite[:replacement] %> <%= rewrite[:flags] %> <% end -%>