Hi,
I have EXIM version 4.94 #2 built 24-Jan-2021 02:57:31 on a Gentoo
server. The config file worked for pre-tainted Exim.
Config includes:-
begin transports
remote_smtp:
driver = smtp
message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}}
dnssec_request_domains = *
hosts_try_dane = *
return_path = ${address:$reply_address}
dkim_domain = ${lc:${domain_data:$h_from:}}
dkim_selector = ${substr_2_4:$tod_zulu}
dkim_private_key = ${if
exists{/etc/exim/dkim/${lc:${domain_data:$h_from:}}-${substr_2_4:$tod_zulu}.pem}{/etc/exim/dkim/${lc:${domain_data:$h_from:}}-${substr_2_4:$tod_zulu}.pem}{0}}
dkim_canon=relaxed
/etc/exim contains the director 'dkim' with various files.... this
basically allows me to have many DKIM-ed domains and to roll the DKIM
signatures appropriately.
All my users are in a MySQL Database - if that helps with
de-tainting.... although I did think using "domain_data" was the correct
way to go. This user use port 587 with a username/password (from MySQL)
in order to hand over the email to EXIM for delivery.
# ls -l
total 216
drwxr-xr-x 2 root root 16384 Jan 24 17:28 dkim
-rw-r--r-- 1 root root 45830 Jan 24 18:01 exim.conf
# ls -l dkim
...
-rw-r--r-- 1 root root 891 Jan 24 17:28 posix.co.za-2101.pem
-rw-r--r-- 1 root root 272 Jan 24 17:28 posix.co.za-2101.pub
Error from the log look like....
2021-01-24 18:02:55 SMTP connection from [197.185.109.217]:35388
I=[192.96.24.20]:587 (TCP/IP connection count = 1)
2021-01-24 18:02:55 1l3hqp-005HHq-Fl <=
"mje@??? H=([160.124.48.164])
[197.185.109.217]:35388 I=[192.96.24.20]:587 P=esmtpsa
X=TLS1.3:TLS_AES_128_GCM_SHA256:128 CV=no A=PLAIN:mje@???
S=14670 id=a4b55a63-19dd-7584-88f1-f2bfcc13d9f2@??? T="test via
auth"
2021-01-24 18:02:55 SMTP connection from ([160.124.48.164])
[197.185.109.217]:35388 I=[192.96.24.20]:587 closed by QUIT
2021-01-24 18:02:56 1l3hqp-005HHq-Fl Tainted filename
'/etc/exim/dkim/posix.co.za-2101.pem'
2021-01-24 18:02:56 1l3hqp-005HHq-Fl unable to open file for reading:
/etc/exim/dkim/posix.co.za-2101.pem
2021-01-24 18:02:56 1l3hqp-005HHq-Fl => mje@??? R=dnslookup
T=remote_smtp H=mail.vweb.co.za [2001:42a0::16] I=[2001:42a0::20]
X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=yes K C="250- 14187 byte chunk,
total 14923\\n250 OK id=1l3hqq-00HQK7-3l"
2021-01-24 18:02:56 1l3hqp-005HHq-Fl Completed
... so mail is delivered but the DKIM signing does not happen. How do I
fix this. The whole "Tainted" subject still leaves me feeling dazed and
confused.
--
Mark James ELKINS - Posix Systems - (South) Africa
mje@??? Tel: +27.826010496 <tel:+27826010496>
For fast, reliable, low cost Internet in ZA:
https://ftth.posix.co.za
<
https://ftth.posix.co.za>
