X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/ec8cf91536c685f3bb66d526d0f75ebaf662c6cc..f6059322a706366a4dfd2e0d8d582d63f2a97e91:/cookbooks/exim/templates/default/exim4.conf.erb diff --git a/cookbooks/exim/templates/default/exim4.conf.erb b/cookbooks/exim/templates/default/exim4.conf.erb index f02b4193f..7e89a1e93 100644 --- a/cookbooks/exim/templates/default/exim4.conf.erb +++ b/cookbooks/exim/templates/default/exim4.conf.erb @@ -146,14 +146,23 @@ spamd_address = 127.0.0.1 783 tls_advertise_hosts = <; !127.0.0.1 ; !::1 +# Configured TLS cipher selection. + +tls_require_ciphers = <%= node[:ssl][:gnutls_ciphers] %>:%SERVER_PRECEDENCE + # Specify the location of the Exim server's TLS certificate and private key. # The private key must not be encrypted (password protected). You can put # the certificate and private key in the same file, in which case you only # need the first setting, or in separate files, in which case you need both # options. +<% if node[:exim][:certificate_names] -%> +tls_certificate = /etc/ssl/certs/<%= node[:exim][:certificate_names].first %>.pem +tls_privatekey = /etc/ssl/private/<%= node[:exim][:certificate_names].first %>.key +<% else -%> tls_certificate = /etc/ssl/certs/exim.pem tls_privatekey = /etc/ssl/private/exim.key +<% end -%> # In order to support roaming users who wish to send email from anywhere, # you may want to make Exim listen on other ports as well as port 25, in @@ -330,9 +339,7 @@ acl_check_rcpt: # testing for an empty sending host field. accept hosts = : -<% if node[:lsb][:release].to_i >= 10.04 -%> control = dkim_disable_verify -<% end -%> ############################################################################# # The following section of the ACL is concerned with local parts that contain @@ -385,9 +392,11 @@ acl_check_rcpt: deny local_parts = root:postmaster:webmaster:abuse:support senders = : - # Block sender of spam backscatter + # Block blacklisted senders - deny senders = www-data@www.easyticket.de:*@email.realestate.co.nz:sipdentistry@mail.mediaworksonline.com + deny senders = lsearch*@;/etc/exim4/blocked-senders + message = Rejected because $sender_address is blacklisted\nQueries to postmaster@$qualify_domain + !hosts = +relay_from_hosts # Accept mail to postmaster in any local domain, regardless of the source, # and without verifying the sender. @@ -421,9 +430,7 @@ acl_check_rcpt: accept hosts = +relay_from_hosts control = submission -<% if node[:lsb][:release].to_i >= 10.04 -%> control = dkim_disable_verify -<% end -%> # Accept if the message arrived over an authenticated connection, from # any host. Again, these messages are usually from MUAs, so recipient @@ -432,9 +439,7 @@ acl_check_rcpt: accept authenticated = * control = submission -<% if node[:lsb][:release].to_i >= 10.04 -%> control = dkim_disable_verify -<% end -%> # Insist that any other recipient address that we accept is either in one of # our local domains, or is in a domain for which we explicitly allow @@ -489,9 +494,8 @@ acl_check_data: # Deny if the message contains a virus. Before enabling this check, you # must install a virus scanner and set the av_scanner option above. # - deny demime = * - malware = * - message = This message contains a virus ($malware_name). + deny malware = * + message = This message was detected as possible malware ($malware_name). <% end -%> <% if File.exist?("/var/run/spamd.pid") -%> @@ -502,6 +506,13 @@ acl_check_data: message = This message scored $spam_score SpamAssassin points. <% end -%> + # Deny spammy messages with headers of the form: + # X-PHP-Originating-Script: :.php + # X-PHP-Originating-Script: :.class.php + deny condition = ${if match {$h_X-PHP-Originating-Script:}{^[0-9]+:[A-Za-z]+(\\.class)?\\.php\$}} + !hosts = +relay_from_hosts + message = This message failed local spam checks. + # Accept the message. accept @@ -654,6 +665,8 @@ begin transports remote_smtp: driver = smtp + multi_domain = false + tls_require_ciphers = <%= node[:ssl][:gnutls_ciphers] %>:%LATEST_RECORD_VERSION # This transport is used for handling pipe deliveries generated by alias or @@ -719,7 +732,7 @@ noreply: command = <%= details[:command] %> home_directory = <%= details[:home_directory] %> path = <%= details[:path] || "/bin:/usr/bin" %> - return_output + return_fail_output <% else -%> driver = appendfile <% if details[:file] -%> @@ -772,6 +785,7 @@ begin retry # There are no rewriting specifications in this default configuration file. begin rewrite +*@<%= node[:fqdn] %> "${if !match {${lookup{$1}lsearch{/etc/aliases}{$value}}}{@} {$1@openstreetmap.org}fail}" Eh <% node[:exim][:rewrites].each do |rewrite| -%> <%= rewrite[:pattern] %> <%= rewrite[:replacement] %> <%= rewrite[:flags] %> <% end -%>