X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/68eb1cf48d7fee98a751c04c57ac58c80764d230..f6059322a706366a4dfd2e0d8d582d63f2a97e91:/cookbooks/exim/templates/default/exim4.conf.erb?ds=sidebyside diff --git a/cookbooks/exim/templates/default/exim4.conf.erb b/cookbooks/exim/templates/default/exim4.conf.erb index ec423cc7e..7e89a1e93 100644 --- a/cookbooks/exim/templates/default/exim4.conf.erb +++ b/cookbooks/exim/templates/default/exim4.conf.erb @@ -146,14 +146,23 @@ spamd_address = 127.0.0.1 783 tls_advertise_hosts = <; !127.0.0.1 ; !::1 +# Configured TLS cipher selection. + +tls_require_ciphers = <%= node[:ssl][:gnutls_ciphers] %>:%SERVER_PRECEDENCE + # Specify the location of the Exim server's TLS certificate and private key. # The private key must not be encrypted (password protected). You can put # the certificate and private key in the same file, in which case you only # need the first setting, or in separate files, in which case you need both # options. +<% if node[:exim][:certificate_names] -%> +tls_certificate = /etc/ssl/certs/<%= node[:exim][:certificate_names].first %>.pem +tls_privatekey = /etc/ssl/private/<%= node[:exim][:certificate_names].first %>.key +<% else -%> tls_certificate = /etc/ssl/certs/exim.pem tls_privatekey = /etc/ssl/private/exim.key +<% end -%> # In order to support roaming users who wish to send email from anywhere, # you may want to make Exim listen on other ports as well as port 25, in @@ -383,9 +392,10 @@ acl_check_rcpt: deny local_parts = root:postmaster:webmaster:abuse:support senders = : - # Block sender of spam backscatter + # Block blacklisted senders - deny senders = www-data@www.easyticket.de:*@email.realestate.co.nz:sipdentistry@mail.mediaworksonline.com:www-data@*.consoglobe.com:lina-noreply@jobstreet.com:apache@704210-web2.tristatecamera.com:webmaster@openstreetmap.org:noreply@pring.co.uk + deny senders = lsearch*@;/etc/exim4/blocked-senders + message = Rejected because $sender_address is blacklisted\nQueries to postmaster@$qualify_domain !hosts = +relay_from_hosts # Accept mail to postmaster in any local domain, regardless of the source, @@ -484,9 +494,8 @@ acl_check_data: # Deny if the message contains a virus. Before enabling this check, you # must install a virus scanner and set the av_scanner option above. # - deny demime = * - malware = * - message = This message contains a virus ($malware_name). + deny malware = * + message = This message was detected as possible malware ($malware_name). <% end -%> <% if File.exist?("/var/run/spamd.pid") -%> @@ -656,6 +665,8 @@ begin transports remote_smtp: driver = smtp + multi_domain = false + tls_require_ciphers = <%= node[:ssl][:gnutls_ciphers] %>:%LATEST_RECORD_VERSION # This transport is used for handling pipe deliveries generated by alias or @@ -721,7 +732,7 @@ noreply: command = <%= details[:command] %> home_directory = <%= details[:home_directory] %> path = <%= details[:path] || "/bin:/usr/bin" %> - return_output + return_fail_output <% else -%> driver = appendfile <% if details[:file] -%> @@ -774,6 +785,7 @@ begin retry # There are no rewriting specifications in this default configuration file. begin rewrite +*@<%= node[:fqdn] %> "${if !match {${lookup{$1}lsearch{/etc/aliases}{$value}}}{@} {$1@openstreetmap.org}fail}" Eh <% node[:exim][:rewrites].each do |rewrite| -%> <%= rewrite[:pattern] %> <%= rewrite[:replacement] %> <%= rewrite[:flags] %> <% end -%>