Hi gurus,
I have a little question/problem about refusing emails with IP sender.
My mainlog file contains such informations about refusing mails:
2001-11-12 20:17:49 connection from [64.94.217.100] refused (failed to
find host name from IP address)
I've found some infos on the net and some tips in the exim's faqs but
nothing changed. Can somebody tell me what is wrong with my
configuration (attached). Most of answers regardig IP lookup and
reverse dns lookups were incorporated to the config e.g.
local_domains_include_host_literals = true
local_domains_include_host = true
forbid_domain_literals = false
allow_mx_to_ip = true
kill_ip_options = false
refuse_ip_options = false
#host_lookup = 0.0.0.0/0
sender_verify = false
sender_try_verify = false
sender_verify_reject = false
sender_verify_fixup = false
(exim-3.33)
I'm out of ideas what's wrong, how to track the source of problem ?
Any suggestion ?
Thank You
mIro
############ IMPORTANT ########## IMPORTANT ########### IMPORTANT ############
# #
# Whenever you change Exim's configuration file, you *must* remember to HUP #
# the Exim daemon, because it will not pick up the new configuration until #
# until you do this. It is usually a good idea to test a new configuration #
# for syntactic correctness (e.g. using "exim -C /config/file -bV") first. #
# #
############ IMPORTANT ########## IMPORTANT ########### IMPORTANT ############
# This file is divided into several parts, all but the last of which are
# terminated by a line containing the word "end". The parts must appear
# in the correct order, and all must be present (even if some of them are
# in fact empty). Blank lines, and lines starting with # are ignored.
######################################################################
# MAIN CONFIGURATION SETTINGS #
######################################################################
#from 3.33
primary_hostname = .ekut.sk
# Specify the domain you want to be added to all unqualified addresses
# here. Unqualified addresses are accepted only from local callers by
# default. See the receiver_unqualified_{hosts,nets} options if you want
# to permit unqualified addresses from remote sources. If this option is
# not set, the primary_hostname value is used for qualification.
qualify_domain = noruen.ekut.sk
# If you want unqualified recipient addresses to be qualified with a different
# domain to unqualified sender addresses, specify the recipient domain here.
# If this option is not set, the qualify_domain value is used.
# qualify_recipient =
# Specify your local domains as a colon-separated list here. If this option
# is not set (i.e. not mentioned in the configuration file), the
# qualify_recipient value is used as the only local domain. If you do not want
# to do any local deliveries, uncomment the following line, but do not supply
# any data for it. This sets local_domains to an empty string, which is not
# the same as not mentioning it at all. An empty string specifies that there
# are no local domains; not setting it at all causes the default value (the
# setting of qualify_recipient) to be used.
local_domains = localhost:noruen-ai.ekut.sk:noruen-ai.ekut.sk:noruen-ai:noruen:n:noruen.ekut.sk:147.232.24.11
# Allow mail addressed to our hostname, or to our IP address.
local_domains_include_host = true
# If you want to accept mail addressed to your host's literal IP address, for
# example, mail addressed to "user@???", then uncomment the
# following line, or supply the literal domain(s) as part of "local_domains"
# above. You also need to comment "forbid_domain_literals" below. This is not
# recommended for today's Internet.
local_domains_include_host_literals = true
# The following line prevents Exim from recognizing addresses of the form
# "user@???" that is, with a "domain literal" (an IP address)
# instead of a named domain. The RFCs still require this form, but it makes
# little sense to permit mail to be sent to specific hosts by their IP address
# in the modern Internet, and this ancient format has been used by those
# seeking to abuse hosts by using them for unwanted relaying. If you really
# do want to support domain literals, remove the following line, and see
# also the "domain_literal" router below.
forbid_domain_literals = false
# It appears that more and more DNS zones are breaking the rules and putting
# IP addresses on the right hand side of MX records. Exim follows the rules and
# rejects this, giving an error message that explains the mis-configuration.
# However, some other MTAs support this practice, so to avoid `Why can't Exim do
# this?' complaints, allow_mx_to_ip exists, in order to enable this
# heinous activity. It is not recommended, except when you have no other choice.
allow_mx_to_ip = true
kill_ip_options = false
refuse_ip_options = false
# Domains we relay for; that is domains that aren't considered local but we
# accept mail for them.
#relay_domains = ekut.sk
# If this is uncommented, we accept and relay mail for all domains we are
# in the DNS as an MX for.
#relay_domains_include_local_mx = true
# No local deliveries will ever be run under the uids of these users (a colon-
# separated list). An attempt to do so gets changed so that it runs under the
# uid of "nobody" instead. This is a paranoic safety catch. Note the default
# setting means you cannot deliver mail addressed to root as if it were a
# normal user. This isn't usually a problem, as most sites have an alias for
# root that redirects such mail to a human administrator.
#never_users = root
# The setting below causes Exim to do a reverse DNS lookup on all incoming
# IP calls, in order to get the true host name. If you feel this is too
# expensive, you can specify the networks for which a lookup is done, or
# remove the setting entirely.
#host_lookup = 0.0.0.0/0
host_reject = *.launch.2clk.net
# The setting below would, if uncommented, cause Exim to check the syntax of
# all the headers that are supposed to contain email addresses (To:, From:,
# etc). This reduces the level of bounced bounces considerably.
# headers_check_syntax
# Exim contains support for the Realtime Blocking List (RBL) that is being
# maintained as part of the DNS. See http://maps.vix.com/rbl/ for
# background. Uncommenting the following line will make Exim reject mail
# from any host whose IP address is blacklisted in the RBL at maps.vix.com.
#rbl_domains = rbl.maps.vix.com
#rbl_reject_recipients = false
#rbl_warn_header = true
# The setting below allows your host to be used as a mail relay only by
# localhost: it locks out the use of your host as a mail relay by any
# other host. See the section of the manual entitled "Control of relaying"
# for more info.
host_accept_relay = localhost:127.0.0.1:noruen.ekut.sk:noruen-ai.ekut.sk
# If you want Exim to support the "percent hack" for all your local domains,
# uncomment the following line. This is the feature by which mail addressed
# to x%y@z (where z is one of your local domains) is locally rerouted to
# x@y and sent on. Otherwise x%y is treated as an ordinary local part
#percent_hack_domains=*
# If this option is set, then any process that is running as one of the
# listed users may pass a message to Exim and specify the sender's
# address using the "-f" command line option, without Exim's adding a
# "Sender" header.
trusted_users = mail:www-data
# If this option is true, the SMTP command VRFY is supported on incoming
# SMTP connections; otherwise it is not.
#smtp_verify = true
smtp_verify = false
# By default, Exim does not make any checks, other than syntactic ones, on
# incoming addresses during the SMTP dialogue. This reduces delays in SMTP
# transactions, but it does mean that you might accept messages with unknown
# recipients, and/or bad senders.
# Uncomment this line if you want incoming recipient addresses to be verified
# during the SMTP dialogue. Unknown recipients are then rejected at this stage,
# and the generation of a failure message is the job of the sending host.
# receiver_verify
# Uncomment this line if you want incoming sender addresses (return-paths) to
# be verified during the SMTP dialogue. Verification can normally only check
# that the domain exists.
sender_verify = false
sender_try_verify = false
sender_verify_reject = false
sender_verify_fixup = true
# Some operating systems use the "gecos" field in the system password file
# to hold other information in addition to users' real names. Exim looks up
# this field when it is creating "sender" and "from" headers. If these options
# are set, exim uses "gecos_pattern" to parse the gecos field, and then
# expands "gecos_name" as the user's name. $1 etc refer to sub-fields matched
# by the pattern.
gecos_pattern = ^([^,:]*)
gecos_name = $1
# This sets the maximum number of messages that will be accepted in one
# connection. The default is 10, which is probably enough for most purposes,
# but is too low on dialup SMTP systems, which often have many more mails
# queued for them when they connect.
smtp_accept_queue_per_connection = 100
check_spool_space = 1M
# Send a mail to the postmaster when a message is frozen. There are many
# reasons this could happen; one is if exim cannot deliver a mail with no
# return address (normally a bounce) another that may be common on dialup
# systems is if a DNS lookup of a smarthost fails. Read the documentation
# for more details: you might like to look at the auto_thaw option
freeze_tell_mailmaster = true
auto_thaw = 3d
# This option cancels (removes) frozen messages that are older than a week.
timeout_frozen_after = 7d
# This string defines the contents of the \`Received' message header that
# is added to each message, except for the timestamp, which is automatically
# added on at the end, preceded by a semicolon. The string is expanded each
# time it is used.
received_header_text = "Received: \
${if def:sender_rcvhost {from ${sender_rcvhost}\n\t}\
{${if def:sender_ident {from ${sender_ident} }}\
${if def:sender_helo_name {(helo=${sender_helo_name})\n\t}}}}\
by ${primary_hostname} \
${if def:received_protocol {with ${received_protocol}}} \
(Exim ${version_number} #${compile_number} (Debian))\n\t\
id ${message_id}\
${if def:received_for {\n\tfor <$received_for>}}"
end
######################################################################
# TRANSPORTS CONFIGURATION #
######################################################################
# ORDER DOES NOT MATTER #
# Only one appropriate transport is called for each delivery. #
######################################################################
# This transport is used for local delivery to user mailboxes. On debian
# systems group mail is used so we can write to the /var/spool/mail
# directory. (The alternative, which most other unixes use, is to deliver
# as the user's own group, into a sticky-bitted directory)
local_delivery:
driver = appendfile
group = mail
mode = 0660
mode_fail_narrower = false
envelope_to_add = true
file = /var/spool/mail/${local_part}
#exim 3.33 definuje aj return_path_add
# This transport is used for handling pipe addresses generated by
# alias or .forward files. If the pipe generates any standard output,
# it is returned to the sender of the message as a delivery error. Set
# return_fail_output instead if you want this to happen only when the
# pipe fails to complete normally.
address_pipe:
driver = pipe
return_output
prefix =
# This transport is used for handling file addresses generated by alias
# or .forward files.
address_file:
driver = appendfile
# This transport is used for handling file addresses generated by alias
# or .forward files if the path ends in "/", which causes it to be treated
# as a directory name rather than a file name. Each message is then delivered
# to a unique file in the directory. If instead you want all such deliveries to
# be in the "maildir" format that is used by some other mail software,
# uncomment the final option below. If this is done, the directory specified
# in the .forward or alias file is the base maildir directory.
#
# Should you want to be able to specify either maildir or non-maildir
# directory-style deliveries, then you must set up yet another transport,
# called address_directory2. This is used if the path ends in "//" so should
# be the one used for maildir, as the double slash suggests another level
# of directory. In the absence of address_directory2, paths ending in //
# are passed to address_directory.
address_directory:
driver = appendfile
no_from_hack
prefix = ""
suffix = ""
# maildir_format
# This transport is used for handling autoreplies generated by the filtering
# option of the forwardfile director.
address_reply:
driver = autoreply
# This transport is used for procmail
procmail_pipe:
driver = pipe
command = "/usr/bin/procmail -d ${local_part}"
return_path_add
delivery_date_add
envelope_to_add
check_string = "From "
escape_string = ">From "
user = $local_part
group = mail
# This transport is used for delivering messages over SMTP connections.
remote_smtp:
driver = smtp
end
######################################################################
# DIRECTORS CONFIGURATION #
# Specifies how local addresses are handled #
######################################################################
# ORDER DOES MATTER #
# A local address is passed to each in turn until it is accepted. #
######################################################################
# This allows local delivery to be forced, avoiding alias files and
# forwarding.
real_local:
prefix = real-
driver = localuser
transport = local_delivery
# This director handles aliasing using a traditional /etc/aliases file.
# If any of your aliases expand to pipes or files, you will need to set
# up a user and a group for these deliveries to run under. You can do
# this by uncommenting the "user" option below (changing the user name
# as appropriate) and adding a "group" option if necessary.
system_aliases:
driver = aliasfile
file_transport = address_file
pipe_transport = address_pipe
file = /etc/aliasy/+main
search_type = lsearch
user = mail
group = mail
freeze_missing_include = true
# Uncomment the above line if you are running smartlist
# This director runs procmail for users who have a .procmailrc file
procmail:
driver = localuser
transport = procmail_pipe
require_files = ${local_part}:+${home}:+${home}/.procmailrc:+/usr/bin/procmail
no_verify
# This director handles forwarding using traditional .forward files.
# It also allows mail filtering when a forward file starts with the
# string "# Exim filter": to disable filtering, uncomment the "filter"
# option. The check_ancestor option means that if the forward file
# generates an address that is an ancestor of the current one, the
# current one gets passed on instead. This covers the case where A is
# aliased to B and B has a .forward file pointing to A.
# For standard debian setup of one group per user, it is acceptable---normal
# even---for .forward to be group writable. If you have everyone in one
# group, you should comment out the "modemask" line. Without it, the exim
# default of 022 will apply, which is probably what you want.
userforward:
driver = forwardfile
file_transport = address_file
pipe_transport = address_pipe
reply_transport = address_reply
no_verify
check_ancestor
file = .forward
modemask = 002
filter
# This director matches local user mailboxes.
localuser:
driver = localuser
transport = local_delivery
end
######################################################################
# ROUTERS CONFIGURATION #
# Specifies how remote addresses are handled #
######################################################################
# ORDER DOES MATTER #
# A remote address is passed to each in turn until it is accepted. #
######################################################################
# Remote addresses are those with a domain that does not match any item
# in the "local_domains" setting above.
# This router routes to remote hosts over SMTP using a DNS lookup with
# default options.
lookuphost:
driver = lookuphost
transport = remote_smtp
# This router routes to remote hosts over SMTP by explicit IP address,
# given as a "domain literal" in the form [nnn.nnn.nnn.nnn]. The RFCs
# require this facility, which is why it is enabled by default in Exim.
# If you want to lock it out, set forbid_domain_literals in the main
# configuration section above.
literal:
driver = ipliteral
transport = remote_smtp
#From 3.33
# This router routes to remote hosts over SMTP by explicit IP address,
# when an email address is given in "domain literal" form, for example,
# <user@???>. The RFCs require this facility. However, it is
# little-known these days, and has been exploited by evil people seeking
# to abuse SMTP relays. Consequently it is commented out in the default
# configuration. If you uncomment this router, you also need to comment out
# "forbid_domain_literals" above, so that Exim can recognize the syntax of
# domain literal addresses.
domain_literal:
driver = ipliteral
transport = remote_smtp
end
######################################################################
# RETRY CONFIGURATION #
######################################################################
# This single retry rule applies to all domains and all errors. It specifies
# retries every 15 minutes for 2 hours, then increasing retry intervals,
# starting at 2 hours and increasing each time by a factor of 1.5, up to 16
# hours, then retries every 8 hours until 4 days have passed since the first
# failed delivery.
# Domain Error Retries
# ------ ----- -------
* * F,2h,15m; G,16h,2h,1.5; F,4d,8h
end
######################################################################
# REWRITE CONFIGURATION #
######################################################################
# There are no rewriting specifications in this default configuration file.
# This rewriting rule is particularly useful for dialup users who
# don't have their own domain, but could be useful for anyone.
# It looks up the real address of all local users in a file
*@noruen-ai.ekut.sk ${lookup{$1}lsearch{/etc/email-addresses}\
{$value}fail} bcfrF
# End of Exim configuration file
