X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/f214d9e00ae0539817a258325889c2a637bfc6ec..aa1fc7ef4a4508984711d96be2beed4d2a78fd9b:/cookbooks/exim/templates/default/exim4.conf.erb

diff --git a/cookbooks/exim/templates/default/exim4.conf.erb b/cookbooks/exim/templates/default/exim4.conf.erb
index 2430e17be..7e89a1e93 100644
--- a/cookbooks/exim/templates/default/exim4.conf.erb
+++ b/cookbooks/exim/templates/default/exim4.conf.erb
@@ -146,14 +146,23 @@ spamd_address = 127.0.0.1 783
 
 tls_advertise_hosts = <; !127.0.0.1 ; !::1
 
+# Configured TLS cipher selection.
+
+tls_require_ciphers = <%= node[:ssl][:gnutls_ciphers] %>:%SERVER_PRECEDENCE
+
 # Specify the location of the Exim server's TLS certificate and private key.
 # The private key must not be encrypted (password protected). You can put
 # the certificate and private key in the same file, in which case you only
 # need the first setting, or in separate files, in which case you need both
 # options.
 
+<% if node[:exim][:certificate_names] -%>
+tls_certificate = /etc/ssl/certs/<%= node[:exim][:certificate_names].first %>.pem
+tls_privatekey = /etc/ssl/private/<%= node[:exim][:certificate_names].first %>.key
+<% else -%>
 tls_certificate = /etc/ssl/certs/exim.pem
 tls_privatekey = /etc/ssl/private/exim.key
+<% end -%>
 
 # In order to support roaming users who wish to send email from anywhere,
 # you may want to make Exim listen on other ports as well as port 25, in
@@ -383,9 +392,10 @@ acl_check_rcpt:
   deny    local_parts   = root:postmaster:webmaster:abuse:support
           senders       = :
 
-  # Block sender of spam backscatter
+  # Block blacklisted senders
 
-  deny    senders       = www-data@www.easyticket.de:*@email.realestate.co.nz:sipdentistry@mail.mediaworksonline.com:www-data@*.consoglobe.com:lina-noreply@jobstreet.com:apache@704210-web2.tristatecamera.com:webmaster@openstreetmap.org
+  deny    senders       = lsearch*@;/etc/exim4/blocked-senders
+          message       = Rejected because $sender_address is blacklisted\nQueries to postmaster@$qualify_domain
           !hosts        = +relay_from_hosts
 
   # Accept mail to postmaster in any local domain, regardless of the source,
@@ -484,9 +494,8 @@ acl_check_data:
   # Deny if the message contains a virus. Before enabling this check, you
   # must install a virus scanner and set the av_scanner option above.
   #
-  deny    demime     = *
-          malware    = *
-          message    = This message contains a virus ($malware_name).
+  deny    malware    = *
+          message    = This message was detected as possible malware ($malware_name).
 
 <% end -%>
 <% if File.exist?("/var/run/spamd.pid") -%>
@@ -498,11 +507,10 @@ acl_check_data:
 
 <% end -%>
   # Deny spammy messages with headers of the form:
-  #   X-PHP-Originating-Script: <digits>:SendMail.php
-  #   X-PHP-Originating-Script: <digits>:SendMail.class.php
-  #   X-PHP-Originating-Script: <digits>:ExtendedMail.php
-  #   X-PHP-Originating-Script: <digits>:ExtendedMail.class.php
-  deny    condition  = ${if match {$h_X-PHP-Originating-Script:}{^[0-9]+:(Send|Extended)Mail(\\.class)?\\.php\$}}
+  #   X-PHP-Originating-Script: <digits>:<name>.php
+  #   X-PHP-Originating-Script: <digits>:<name>.class.php
+  deny    condition  = ${if match {$h_X-PHP-Originating-Script:}{^[0-9]+:[A-Za-z]+(\\.class)?\\.php\$}}
+         !hosts      = +relay_from_hosts
           message    = This message failed local spam checks.
 
   # Accept the message.
@@ -657,6 +665,8 @@ begin transports
 
 remote_smtp:
   driver = smtp
+  multi_domain = false
+  tls_require_ciphers = <%= node[:ssl][:gnutls_ciphers] %>:%LATEST_RECORD_VERSION
 
 
 # This transport is used for handling pipe deliveries generated by alias or
@@ -722,7 +732,7 @@ noreply:
   command = <%= details[:command] %>
   home_directory = <%= details[:home_directory] %>
   path = <%= details[:path] || "/bin:/usr/bin" %>
-  return_output
+  return_fail_output
 <% else -%>
   driver = appendfile
 <% if details[:file] -%>
@@ -775,6 +785,7 @@ begin retry
 # There are no rewriting specifications in this default configuration file.
 
 begin rewrite
+*@<%= node[:fqdn] %> "${if !match {${lookup{$1}lsearch{/etc/aliases}{$value}}}{@} {$1@openstreetmap.org}fail}" Eh
 <% node[:exim][:rewrites].each do |rewrite| -%>
 <%= rewrite[:pattern] %> <%= rewrite[:replacement] %> <%= rewrite[:flags] %>
 <% end -%>