On Saturday 14 June 2008 16:45:12 Dave Evans wrote:
> It sounds like you're missing "require verify = recipient" in your "RCPT"
> ACL. See http://wiki.exim.org/FAQ/Policy_controls/Q0744 and many other
> places.
nope thats in the config.
also the bounce says "einkauf@??? retry timeout exceeded".
that user exists.
it might be connected to the weird spam handling. I'm supposed to deliver spam
to a special mailbox and this email was flaged as spam by my local SA.
spam_router:
no_verify
check_local_user
condition = "${if def:h_X-Spam-Flag: }"
driver = accept
transport = spam_delivery
spam_delivery:
driver = appendfile
file = /var/mail/catchall
delivery_date_add
envelope_to_add
return_path_add
group = mail
mode = 0660
I attached the full config aswell.
> If that doesn't help, what does "grep 1K7WOo-0003PK-82 main.log" show on
> your server?
./mainlog:2008-06-14 16:06:34 1K7WOo-0003PK-82 <= <> R=1K64UQ-0001VB-F6 U=exim
P=local S=6230
./mainlog:2008-06-14 16:06:34 1K7WOo-0003PK-82 => adolescences@???
R=dnslookup T=remote_smtp H=mailserver.brake-eng.com [213.171.216.1]
./mainlog:2008-06-14 16:06:34 1K7WOo-0003PK-82 Completed
--
best regards/Mit freundlichen Grüßen
Arvid Ephraim Picciani
########### IMPORTANT ########## IMPORTANT ########### IMPORTANT ###########
# #
# Whenever you change Exim's configuration file, you *must* remember to #
# HUP the Exim daemon, because it will not pick up the new configuration #
# until you do. However, any other Exim processes that are started, for #
# example, a process started by an MUA in order to send a message, will #
# see the new configuration as soon as it is in place. #
# #
# You do not need to HUP the daemon for changes in auxiliary files that #
# are referenced from this file. They are read every time they are used. #
# #
# It is usually a good idea to test a new configuration for syntactic #
# correctness before installing it (for example, by running the command #
# "exim -C /config/file.new -bV"). #
# #
########### IMPORTANT ########## IMPORTANT ########### IMPORTANT ###########
######################################################################
# MAIN CONFIGURATION SETTINGS #
######################################################################
exim_user = exim
exim_group = exim
domainlist local_domains = @ : lsearch;/etc/mail/domains
hostlist relay_from_hosts = 127.0.0.1
acl_smtp_rcpt = acl_check_rcpt
acl_smtp_data = acl_check_data
#av_scanner = clamd:/tmp/clamd
spamd_address = 127.0.0.1 783
#tls_advertise_hosts = *
#tls_certificate = /etc/keys/server.crt
#tls_privatekey = /etc/keys/server.key
qualify_domain = hh-l.de
never_users = root
host_lookup = *
ignore_bounce_errors_after = 2d
timeout_frozen_after = 7d
######################################################################
# ACL CONFIGURATION #
# Specifies access control lists for incoming SMTP mail #
######################################################################
begin acl
# This access control list is used for every RCPT command in an incoming
# SMTP message. The tests are run in order until the address is either
# accepted or denied.
acl_check_rcpt:
# Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
# testing for an empty sending host field.
accept hosts = :
# RFC 2822 abuse incomming
deny message = Restricted characters in address
domains = +local_domains
local_parts = ^[.] : ^.*[@%!/|]
# RFC 2822 abuse outgoing
deny message = Restricted characters in address.
domains = !+local_domains
local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
# Accept mail to postmaster in any local domain, regardless of the source,
# and without verifying the sender.
accept local_parts = postmaster
domains = +local_domains
# Deny unless the sender address can be verified.
require verify = sender
# accept if we relay for the client (host based)
accept hosts = +relay_from_hosts
control = submission
# accept if we relay for the client (auth based. propably a MUA)
accept authenticated = *
control = submission/sender_retain
# deny relay to everyone else (except they want to relay to a local user)
require message = relay not permitted
domains = +local_domains
# we want a valid recipient please
require verify = recipient
#deny zombie machines
deny
dnslists = sbl-xbl.spamhaus.org
message = $sender_host_address is listed in $dnslist_domain\
${if def:dnslist_text { ($dnslist_text)}}
# tested all. now accept
accept
# This is the ACL in which you can test a message's headers or body.
acl_check_data:
# ClamAv scan
# deny malware = *
# message = This message contains a virus ($malware_name).
accept
######################################################################
# ROUTERS CONFIGURATION #
# Specifies how addresses are handled #
######################################################################
# THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT! #
# An address is passed to each router in turn until it is accepted. #
######################################################################
begin routers
dnslookup:
driver = dnslookup
domains = ! +local_domains
transport = remote_smtp
ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
no_more
system_aliases:
driver = redirect
allow_fail
allow_defer
data = ${lookup{$local_part@$domain}wildlsearch{/etc/mail/aliases}}
# user = exim
file_transport = address_file
pipe_transport = address_pipe
system_aliases_plain:
driver = redirect
allow_fail
allow_defer
data = ${lookup{$local_part}lsearch{/etc/mail/aliases}}
# user = exim
file_transport = address_file
pipe_transport = address_pipe
spam_router:
no_verify
check_local_user
condition = "${if def:h_X-Spam-Flag: }"
driver = accept
transport = spam_delivery
spamcheck_router:
no_verify
check_local_user
# When to scan a message :
# - it isn't already flagged as spam
# - it isn't already scanned
condition = "${if and { {!def:h_X-Spam-Flag:} {!eq {$received_protocol}{spam-scanned}}} {1}{0}}"
driver = accept
transport = spamcheck
userforward:
driver = redirect
check_local_user
file = $home/.forward
allow_filter
no_verify
no_expn
check_ancestor
file_transport = address_file
pipe_transport = address_pipe
reply_transport = address_reply
directory_transport = address_directory
localuser:
driver = accept
check_local_user
transport = local_delivery
cannot_route_message = Unknown user
######################################################################
# TRANSPORTS CONFIGURATION #
######################################################################
# ORDER DOES NOT MATTER #
# Only one appropriate transport is called for each delivery. #
######################################################################
# A transport is used only when referenced from a router that successfully
# handles an address.
begin transports
# This transport is used for delivering messages over SMTP connections.
remote_smtp:
driver = smtp
# This transport is used for local delivery to user mailboxes in traditional
# BSD mailbox format. By default it will be run under the uid and gid of the
# local user, and requires the sticky bit to be set on the /var/mail directory.
# Some systems use the alternative approach of running mail deliveries under a
# particular group instead of using the sticky bit. The commented options below
# show how this can be done.
local_delivery:
driver = appendfile
file = /var/mail/$local_part
delivery_date_add
envelope_to_add
return_path_add
group = mail
mode = 0660
spam_delivery:
driver = appendfile
file = /var/mail/catchall
delivery_date_add
envelope_to_add
return_path_add
group = mail
mode = 0660
# Maildir delivery
#local_delivery:
# driver = appendfile
# group = $local_part
# mode = 0660
# mode_fail_narrower = false
# envelope_to_add = true
# return_path_add = true
# directory=${home}/Maildir
# maildir_format = true
# This transport is used for handling pipe deliveries generated by alias or
# .forward files. If the pipe generates any standard output, it is returned
# to the sender of the message as a delivery error. Set return_fail_output
# instead of return_output if you want this to happen only when the pipe fails
# to complete normally. You can set different transports for aliases and
# forwards if you want to - see the references to address_pipe in the routers
# section above.
address_pipe:
driver = pipe
return_output
# This transport is used for handling deliveries directly to files that are
# generated by aliasing or forwarding.
address_file:
driver = appendfile
delivery_date_add
envelope_to_add
return_path_add
#or to directories (aka maildirs)
address_directory:
driver = appendfile
maildir_format
delivery_date_add
envelope_to_add
return_path_add
# This transport is used for handling autoreplies generated by the filtering
# option of the userforward router.
address_reply:
driver = autoreply
spamcheck:
debug_print = "T: spamassassin_pipe for $local_part@$domain"
driver = pipe
command = /usr/sbin/exim -oMr spam-scanned -bS
use_bsmtp
transport_filter = /usr/bin/spamc
home_directory = "/tmp"
current_directory = "/tmp"
user = exim
group = exim
return_fail_output
message_prefix =
message_suffix =
######################################################################
# RETRY CONFIGURATION #
######################################################################
begin retry
# This single retry rule applies to all domains and all errors. It specifies
# retries every 15 minutes for 2 hours, then increasing retry intervals,
# starting at 1 hour and increasing each time by a factor of 1.5, up to 16
# hours, then retries every 6 hours until 4 days have passed since the first
# failed delivery.
# WARNING: If you do not have any retry rules at all (this section of the
# configuration is non-existent or empty), Exim will not do any retries of
# messages that fail to get delivered at the first attempt. The effect will
# be to treat temporary errors as permanent. Therefore, DO NOT remove this
# retry rule unless you really don't want any retries.
# Address or Domain Error Retries
# ----------------- ----- -------
* * F,2h,15m; G,16h,1h,1.5; F,4d,6h
######################################################################
# REWRITE CONFIGURATION #
######################################################################
# There are no rewriting specifications in this default configuration file.
begin rewrite
######################################################################
# AUTHENTICATION CONFIGURATION #
######################################################################
# The following authenticators support plaintext username/password
# authentication using the standard PLAIN mechanism and the traditional
# but non-standard LOGIN mechanism, with Exim acting as the server.
# PLAIN and LOGIN are enough to support most MUA software.
#
# These authenticators are not complete: you need to change the
# server_condition settings to specify how passwords are verified.
# They are set up to offer authentication to the client only if the
# connection is encrypted with TLS, so you also need to add support
# for TLS. See the global configuration options section at the start
# of this file for more about TLS.
#
# The default RCPT ACL checks for successful authentication, and will accept
# messages from authenticated users from anywhere on the Internet.
begin authenticators
# PLAIN authentication has no server prompts. The client sends its
# credentials in one lump, containing an authorization ID (which we do not
# use), an authentication ID, and a password. The latter two appear as
# $auth2 and $auth3 in the configuration and should be checked against a
# valid username and password. In a real configuration you would typically
# use $auth2 as a lookup key, and compare $auth3 against the result of the
# lookup, perhaps using the crypteq{}{} condition.
#PLAIN:
# driver = plaintext
# server_set_id = $auth2
# server_prompts = :
# server_condition = Authentication is not yet configured
# server_advertise_condition = ${if def:tls_cipher }
# LOGIN authentication has traditional prompts and responses. There is no
# authorization ID in this mechanism, so unlike PLAIN the username and
# password are $auth1 and $auth2. Apart from that you can use the same
# server_condition setting for both authenticators.
#LOGIN:
# driver = plaintext
# server_set_id = $auth1
# server_prompts = <| Username: | Password:
# server_condition = Authentication is not yet configured
# server_advertise_condition = ${if def:tls_cipher }
plain:
driver = plaintext
public_name = PLAIN
server_prompts = :
server_condition = "${if pam{$2:$3}{1}{0}}"
server_set_id = $2
login:
driver = plaintext
public_name = LOGIN
server_prompts = "Username:: : Password::"
server_condition = "${if pam{$1:$2}{1}{0}}"
server_set_id = $1
######################################################################
# CONFIGURATION FOR local_scan() #
######################################################################
# If you have built Exim to include a local_scan() function that contains
# tables for private options, you can define those options here. Remember to
# uncomment the "begin" line. It is commented by default because it provokes
# an error with Exim binaries that are not built with LOCAL_SCAN_HAS_OPTIONS
# set in the Local/Makefile.
#begin local_scan
# End of Exim configuration file
