Re: [exim] SSL/TLS

Page principale
Supprimer ce message
Répondre à ce message
Auteur: The Doctor
Date:  
À: Dave Lugo
CC: exim-users
Sujet: Re: [exim] SSL/TLS
On Fri, Nov 02, 2012 at 11:22:03AM -0400, Dave Lugo wrote:
> On Fri, 2 Nov 2012, The Doctor wrote:
>>
>> I do not want to send the whole thing with comment;
>>
>> How do I get rid of the comments?
>>
>
> grep -v -e ^# -e ^[[:space:]]# /path/to/config/file
>



Thank you.

My configure file is


----------------------------- Begin -------------------------




primary_hostname = doctor.nl2k.ab.ca

local_interfaces = 0.0.0.0.25 : 0.0.0.0.465 : 0.0.0.0.587

domainlist local_domains = @:secure.nl2k.ab.ca:mail.nl2k.ab.ca:mail.nk.ca:nk.ca:nl2k.ca:nl2k.ab.ca:doctor.nl2k.ab.ca:lsearch;/usr/exim/vdom3

domainlist relay_to_domains =
hostlist relay_from_hosts = 204.209.81.0/24 : 127.0.0.1 : 208.118.93.0/24: 208.118.94.0/24

trusted_users = exim : majordomo

acl_smtp_rcpt = acl_check_rcpt
acl_smtp_data = acl_check_data

av_scanner = clamd:127.0.0.1 3310

spamd_address = 127.0.0.1 783

tls_advertise_hosts = *

tls_certificate = /usr/exim/ca.crt
tls_privatekey = /usr/exim/ca.key

daemon_smtp_ports = 25 : 465 : 587
tls_on_connect_ports = 465

tls_require_ciphers = ${if == {$received_port} {25}\
{DEFAULT}{ ALL : !SSLv2 : !LOW : !aNULL : !eNULL : !3DES : @STRENGTH}}

never_users = root

host_lookup = *

rfc1413_hosts = *
rfc1413_query_timeout = 5s

ignore_bounce_errors_after = 2h

timeout_frozen_after = 6h

auto_thaw = 1m

#MailScanner

spool_directory = /var/spool/exim.in
log_file_path = /var/log/exim.in_%slog
process_log_path = /var/spool/exim.in/exim-process.info

queue_only = true

queue_only_override = false

begin acl

acl_check_rcpt:


  accept  hosts = :
          control = dkim_disable_verify



  deny    message       = Restricted characters in address
          domains       = +local_domains
          local_parts   = ^[.] : ^.*[@%!/|]



  deny    message       = Restricted characters in address
          domains       = !+local_domains
          local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./


  accept  local_parts   = postmaster
          domains       = +local_domains



  require verify        = sender



deny
    condition = ${if eq{$sender_helo_name}{}}
    message   = HELO required before MAIL




drop  message   = "REJECTED - Bad HELO - Host impersonating [$sender_helo_name]"
      condition = ${if match{$sender_helo_name}{$primary_hostname}}




  drop condition = ${if eq{[$interface_address]}{$sender_helo_name}}
       message   = $interface_address is _my_ address


   drop    message     = Bad helo name
           condition   = ${if  \
                            and{    \
                                {isip {$sender_helo_name}}  \
                                {match_ip{$sender_helo_name}{@[]}}  \
                            }{yes}{no}  \
                        }



warn    domains = +local_domains
                !verify = recipient
                set acl_c0 = ${eval: $acl_c0+1}
                delay = ${eval: ($acl_c0 - 1) * 60}s



drop    message = Legitimate bounces are never sent to more than one recipient.
        senders = : postmaster@*
        condition = ${if >{$recipients_count}{0}{true}{false}}



  accept  hosts         = +relay_from_hosts
          control       = submission
          control       = dkim_disable_verify


  accept  authenticated = *
          control       = submission
          control       = dkim_disable_verify


  require message = relay not permitted
          domains = +local_domains : +relay_to_domains


# We also require all accepted addresses to be verifiable. This check will
# do local part verification for local domains, but only check the domain
# for remote domains. The only way to check local parts for the remote
# relay domains is to use a callout (add /callout), but please read the
# documentation about callouts before doing this.

# require verify = recipient



  deny    message       = Rejected sender
          domains       = dhl.com
          local_parts   = adminsu*


  deny    message       = Rejected sender
          domains       = *.com
          local_parts   = postmail-*


  deny    message       = Rejected sender
          domains       = usa.com
          local_parts   = express.deli*


  deny    message       = Rejected sender
          domains       = gmail.com
          local_parts   = emarketing2*




accept



acl_check_data:


  accept authenticated = *
     set acl_m_authenticated = 1  


accept hosts = :

   deny    malware    = *
           message    = This message contains a virus ($malware_name).


  # test reject spam at high scores (> 41)
  drop message = This message is denied by policy : $spam_score spam points
       spam = nobody:true
       condition = ${if > {$spam_score_int}{409}{1}{0}}



   warn    spam       = nobody
           message = Subject: {SPAM?} $rh_subject:
           add_header = X-Spam_score: $spam_score\n\
                        X-Spam_score_int: $spam_score_int\n\
                        X-Spam_bar: $spam_bar\n\
                        X-Spam_report: $spam_report



deny
    !hosts = +relay_from_hosts
    message = This message was considered to be spam
    spam = www:true
    condition = ${if >{$spam_score_int}{409}{1}{0}} 



# Accept the message.

accept


begin routers

check_dnslookup:
driver = dnslookup
domains = ! +local_domains
ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
verify_only
no_more

check_system_aliases:
driver = redirect
allow_fail
allow_defer
data = ${lookup{$local_part}lsearch{/etc/aliases}}
verify_only

check_localuser:
driver = accept
check_local_user
verify_only

failed_address_router:
driver = accept
verify_only
fail_verify

domains_virtual:
  domains       = +local_domains
  driver = redirect
  data=${lookup{$local_part@$domain}dbm{/usr/exim/virtemail}}


domains_virtual_others:
  domains       = +local_domains
  driver = redirect
  data=${lookup{@$domain}dbm{/usr/exim/virtemail}}


defer_router:
        driver = redirect
        allow_defer
        data = :defer: All deliveries are deferred
        verify = false


dnslookup:
driver = dnslookup
domains = ! +local_domains
transport = remote_smtp
ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
no_more

system_aliases:
driver = redirect
allow_fail
allow_defer
data = ${lookup{$local_part}lsearch{/etc/aliases}}
file_transport = address_file
pipe_transport = address_pipe

userforward:
driver = redirect
check_local_user
file = $home/.forward
allow_filter
no_verify
no_expn
check_ancestor
file_transport = address_file
pipe_transport = address_pipe
reply_transport = address_reply

localuser:
driver = accept
check_local_user
transport = local_delivery
cannot_route_message = Unknown user

procmail:
driver = accept
check_local_user
require_files = $home/.procmailrc
transport = procmail_pipe


lists:
driver = redirect
file = /usr/home/majordomo/lists/$local_part
forbid_pipe
forbid_file
errors_to = $local_part-request@???
user = majordomo
no_more

begin transports

remote_smtp:
driver = smtp
hosts_avoid_tls = *

procmail_pipe:
driver = pipe
command = /usr/bin/procmail -d $local_part
return_path_add
delivery_date_add
envelope_to_add
check_string = "From "
escape_string = ">From "
umask = 077
user = $local_part
group = mail

local_delivery:
driver = appendfile
file = /var/mail/$local_part
delivery_date_add
envelope_to_add
return_path_add
group = mail
mode = 0600

address_pipe:
driver = pipe
return_output

address_file:
driver = appendfile
delivery_date_add
envelope_to_add
return_path_add

address_reply:
driver = autoreply

begin retry


*                      *           F,1h,15m; G,10h,1h,1.5; F,7d,1h
127.0.0.1              *           F,1h,1m; G,2h,10m,1.5; F,5h,10m
204.209.81.1              *           F,1h,1m; G,2h,10m,1.5; F,3h,10m
204.209.81.3              *           F,1h,1m; G,2h,10m,1.5; F,5h,10m


begin rewrite

begin authenticators

PLAIN:
  driver                     = plaintext
  public_name                = PLAIN
  server_set_id              = $auth2
  server_prompts             = :
  server_condition           = ${if saslauthd{{$2}{$3}}{1}{0}}
  server_advertise_condition = ${if def:tls_cipher }



LOGIN:
  driver                     = plaintext
  public_name                = LOGIN
  server_set_id              = $auth1
 server_prompts             = <| Username: | Password:
 server_condition           = ${if saslauthd{{$1}{$2}}{1}{0}}
  server_advertise_condition = ${if def:tls_cipher }


--------------------------- END ---------------------------


And my MAkefile is

------------------------------------------ BEGIN ---------------





BIN_DIRECTORY=/usr/exim/bin

CONFIGURE_FILE=/usr/exim/configure:/usr/exim/configure.out

EXIM_USER=exim

EXIM_GROUP=exim

SPOOL_DIRECTORY=/var/spool/exim

ROUTER_ACCEPT=yes
ROUTER_DNSLOOKUP=yes
ROUTER_IPLITERAL=yes
ROUTER_MANUALROUTE=yes
ROUTER_QUERYPROGRAM=yes
ROUTER_REDIRECT=yes

TRANSPORT_APPENDFILE=yes
TRANSPORT_AUTOREPLY=yes
TRANSPORT_PIPE=yes
TRANSPORT_SMTP=yes

SUPPORT_MAILDIR=yes
SUPPORT_MAILSTORE=yes
SUPPORT_MBX=yes

CFLAGS_DYNAMIC=-shared -rdynamic -fPIC

LOOKUP_DBM=yes
LOOKUP_LSEARCH=yes
LOOKUP_DNSDB=yes

LOOKUP_CDB=yes
LOOKUP_DSEARCH=yes
LOOKUP_PASSWD=yes

PCRE_LIBS=-lpcre

WITH_CONTENT_SCAN=yes

WITH_OLD_CLAMAV_STREAM=no

EXPERIMENTAL_SPF=yes
CFLAGS += -I/usr/include -I/usr/contrib/include
LDFLAGS += -lspf2


EXPERIMENTAL_SRS=yes
CFLAGS += -I/usr/local/include
LDFLAGS += -lsrs_alt

FIXED_NEVER_USERS=root

TRUSTED_CONFIG_LIST=/usr/exim/trusted_configs

WHITELIST_D_MACROS=TLS:SPOOL

AUTH_CRAM_MD5=yes
AUTH_CYRUS_SASL=yes
AUTH_DOVECOT=yes
AUTH_PLAINTEXT=yes
AUTH_SPA=yes

AUTH_LIBS=-L/usr/contrib/lib -lsasl2

HEADERS_CHARSET="ISO-8859-1"

HAVE_ICONV=yes
CFLAGS=-O -I/usr/include
EXTRALIBS_EXIM=-L/usr/lib -liconv

SUPPORT_TLS=yes

TLS_LIBS=-L/usr/contrib/openssl/lib -lssl -lcrypto

INFO_DIRECTORY=/usr/share/info

LOG_FILE_PATH=syslog:/var/log/exim_%slog

SYSLOG_LOG_PID=yes

EXICYCLOG_MAX=10

COMPRESS_COMMAND=/usr/contrib/bin/gzip
COMPRESS_SUFFIX=gz

ZCAT_COMMAND=/usr/bin/zcat

EXPAND_DLFUNC=yes

CYRUS_PWCHECK_SOCKET=/var/pwcheck/pwcheck

CYRUS_SASLAUTHD_SOCKET=/var/state/saslauthd/mux

SYSTEM_ALIASES_FILE=/etc/aliases

USE_READLINE=yes

TMPDIR="/tmp"
------------------------ END ----------------


So I did a test with gmail to and from.

I was able to send , but I did get my e-mail back from gmail to LAN.

> -- 
> --------------------------------------------------------
>  Dave Lugo     dlugo@???      No spam, thanks.
>  Are you the police?  . . .  No ma'am, we're sysadmins.
> --------------------------------------------------------

>
> --
> ## List details at https://lists.exim.org/mailman/listinfo/exim-users
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/


-- 
Member - Liberal International    This is doctor@??? Ici doctor@???
God,Queen and country!Never Satan President Republic!Beware AntiChrist rising! 
http://www.fullyfollow.me/rootnl2k  
USA petition to dissolve the Republic and vote to disoolve it in November 2012