Exim - Revision history

Leo: Added categories

2020-06-14T23:46:30Z

Added categories

← Older revision		Revision as of 23:46, 14 June 2020
Line 554:		Line 554:
	* https://www.exim.org/exim-html-current/doc/html/spec_html/ch-the_default_configuration_file.html		* https://www.exim.org/exim-html-current/doc/html/spec_html/ch-the_default_configuration_file.html
	* https://www.exim.org/exim-html-current/doc/html/spec_html/ch-file_and_database_lookups.html		* https://www.exim.org/exim-html-current/doc/html/spec_html/ch-file_and_database_lookups.html

			{{Navbox Linux}}[[Category:Linux]]
			[[Category:LinuxUtilities]]
			[[Category:Networking]]

Leo: /* Routers */

2019-09-26T02:14:57Z

Routers

← Older revision		Revision as of 02:14, 26 September 2019
Line 307:		Line 307:
	The section after is to deliver emails destined to remote hosts or fail them otherwise.		The section after is to deliver emails destined to remote hosts or fail them otherwise.
	{{highlight\|lang=text\|code=		{{highlight\|lang=text\|code=
			<nowiki>
	# requires perl sender_domain_can_dkim_sign to check if dkim should be used		# requires perl sender_domain_can_dkim_sign to check if dkim should be used
	#		#
Line 396:		Line 397:
	allow_fail		allow_fail
	data = ":fail: The mail server could not deliver mail to $local_part@$domain. The account or domain may not exist, they may be blacklisted, or missing the proper dns entries."		data = ":fail: The mail server could not deliver mail to $local_part@$domain. The account or domain may not exist, they may be blacklisted, or missing the proper dns entries."
			</nowiki>
	}}		}}

Leo: /* Routers */

2019-09-26T02:12:57Z

Routers

@@ Line 236: / Line 236: @@
 ; data
 : The contents of data are expanded, and then used as the list of forwarding items, or as a set of filtering instructions. If the expansion is forced to fail, or the result is an empty string or a string that has no effect (consists entirely of comments), the router declines.
 cPanel implements a {{code|check_mail_permissions}} redirect router that ensures the user can receive/send messages based on a variety of conditions. These conditions are checked with the {{code|check_mail_permissions}} Perl function and is defined as:
@@ Line 302: / Line 303: @@
 * enforce_mail_permissions_results returns enforce_mail_permissions_data. If something is set, the enforcement router will do it.
 * Increment max emails per hour by calling increment_max_emails_per_hour_if_needed, which appends '1' to a file at /var/cpanel/email_send_limits/track/$domain/$h.$d.$m.$y
 === Transports ===

Leo: formatting and cleanup

2019-09-24T04:53:15Z

formatting and cleanup

← Older revision		Revision as of 04:53, 24 September 2019
Line 10:		Line 10:
	Lines can be commented out using {{code\|#}}.		Lines can be commented out using {{code\|#}}.

	Main configuration settings are values that are defined in the file as {{code\|1=foo = bar}}.		Main configuration settings are values that are defined in the file as {{code\|1=foo = bar}}.

			To find out what a particular setting is, search the index: https://www.exim.org/exim-html-current/doc/html/spec_html/ch-option_index.html

	=== Macros ===		=== Macros ===
			Macros define a constant or string expansion which you can use later in the configuration file. These are written in all upper case.

	=== Main Configuration ===		=== Main Configuration ===
	~~See:~~
	* https://www.exim.org/exim-html-current/doc/html/spec_html/ch-option_index.html
	* https://www.exim.org/exim-html-current/doc/html/spec_html/ch-main_configuration.html#SECTalomo		* https://www.exim.org/exim-html-current/doc/html/spec_html/ch-main_configuration.html#SECTalomo

Line 73:		Line 74:
	; keep_environment		; keep_environment
	: Environment variables to import. eg. {{code\|^LDAP}}		: Environment variables to import. eg. {{code\|^LDAP}}

	; qualify_domain		; qualify_domain
	: Used to construct a complete email address from local login names, for messages from local processes. Defaults to {{code\|primary_hostname}} if not set.		: Used to construct a complete email address from local login names, for messages from local processes. Defaults to {{code\|primary_hostname}} if not set.
	; primary_hostname		; primary_hostname
	: The FQDN, otherwise if unset, Exim uses the uname system function to obtain the hostname		: The FQDN, otherwise if unset, Exim uses the uname system function to obtain the hostname

	; allow_domain_literals		; allow_domain_literals
	: To allow addresses of from {{code\|username@[10.1.1.1]}} rather than domain name. Typically disabled nowadays		: To allow addresses of from {{code\|username@[10.1.1.1]}} rather than domain name. Typically disabled nowadays
	; never_users		; never_users
	: Local message deliveries are normally run in processes that are setuid to the recipient. This list of users define which deliveries should not run as. Users that are on this list will have their delivery deferred. Build option with {{code\|FIXED_NEVER_USERS }} also defines a set of users that cannot be overridden.		: Local message deliveries are normally run in processes that are setuid to the recipient. This list of users define which deliveries should not run as. Users that are on this list will have their delivery deferred. Build option with {{code\|FIXED_NEVER_USERS }} also defines a set of users that cannot be overridden.

	; deliver_queue_load_max		; deliver_queue_load_max
	: Defers delivery if system load exceeds the fixed point value.		: Defers delivery if system load exceeds the fixed point value.
Line 96:		Line 94:
	; check_rfc2047_length		; check_rfc2047_length
	: RFC 2047 allows for a line length of 76 characters. If set to true, any messages that violate this standard will fail. Set to false for better compatibility.		: RFC 2047 allows for a line length of 76 characters. If set to true, any messages that violate this standard will fail. Set to false for better compatibility.

	; rfc1413_hosts, rfc1413_query_timeout		; rfc1413_hosts, rfc1413_query_timeout
	: RFC 1413 deals with ident callbacks. Few hosts offer this service. Setting the timeout to 0 seconds will prevent ident callbacks for all incoming SMTP connections.		: RFC 1413 deals with ident callbacks. Few hosts offer this service. Setting the timeout to 0 seconds will prevent ident callbacks for all incoming SMTP connections.
Line 102:		Line 99:
	; domainlist local_domains = @		; domainlist local_domains = @
	: identify domains that are to be delivered on the local host. The {{code\|@}} is a special form of entry which means "the name of the local host"		: identify domains that are to be delivered on the local host. The {{code\|@}} is a special form of entry which means "the name of the local host"

	; domainlist relay_to_domains =		; domainlist relay_to_domains =
	: Lists domains that allows this server to relay to. Default is empty and no relaying is permitted		: Lists domains that allows this server to relay to. Default is empty and no relaying is permitted

	; hostlist relay_from_hosts		; hostlist relay_from_hosts
	: List of domains or IPs to permit relaying from. Default is the IP address of the loopback device.		: List of domains or IPs to permit relaying from. Default is the IP address of the loopback device.
Line 451:		Line 446:


			== See Also ==
			Search for any configuration term on the index:
			* https://www.exim.org/exim-html-current/doc/html/spec_html/ch-option_index.html

			Other Stuff:

	~~== See Also ==~~
	* https://www.exim.org/exim-html-current/doc/html/spec_html/ch-the_default_configuration_file.html		* https://www.exim.org/exim-html-current/doc/html/spec_html/ch-the_default_configuration_file.html
	* https://www.exim.org/exim-html-current/doc/html/spec_html/ch-file_and_database_lookups.html		* https://www.exim.org/exim-html-current/doc/html/spec_html/ch-file_and_database_lookups.html

Leo: /* Authenticators */

2019-09-24T04:43:35Z

Authenticators

@@ Line 408: / Line 408: @@
 === Authenticators ===
 {{highlight|lang=text|code=
 <nowiki>

Leo: /* Routers */

2019-09-23T23:03:43Z

Routers

@@ Line 245: / Line 245: @@
 {{highlight|lang=text|code=
 <nowiki>
 check_mail_permissions:
      domains = ! +local_domains
@@ Line 256: / Line 257: @@
      condition = "${perl{check_mail_permissions}}"
      data = "${perl{check_mail_permissions_results}}"
 </nowiki>
 }}
@@ Line 273: / Line 304: @@
 *** outgoing mail for the sender is on hold. enforce_mail_permissions_data = :defer: $domain outgoing mail hold
 *** outgoing mail for the sender is suspended. enforce_mail_permissions_data = :fail: $domain outgoing mail suspended
-** Send notifications if user exceeds daily limit
+** Send notifications if user exceeds daily limit by making /var/cpanel/email_send_limits/daily_notify/$domain.
-** Increment max emails per hour by calling increment_max_emails_per_hour, which appends '1' to a file at /var/cpanel/email_send_limits/track/$doomain/$h.$d.$m.$y
+* enforce_mail_permissions_results returns enforce_mail_permissions_data. If something is set, the enforcement router will do it.
+* Increment max emails per hour by calling increment_max_emails_per_hour_if_needed, which appends '1' to a file at /var/cpanel/email_send_limits/track/$domain/$h.$d.$m.$y
 === Transports ===

Leo: /* Routers */

2019-09-23T22:43:37Z

Routers

← Older revision		Revision as of 22:43, 23 September 2019
Line 234:		Line 234:
	If a router is unable to lookup a MX record, the message is to be deferred unless the {{code\|pass_on_timeout}} is defined.		If a router is unable to lookup a MX record, the message is to be deferred unless the {{code\|pass_on_timeout}} is defined.

			All routers, regardless of the type supports
			; condition
			: The string is expanded, and if the result is a forced failure, or an empty string, or one of the strings “0” or “no” or “false” (checked without regard to the case of the letters), the router is skipped, and the address is offered to the next one.

			Specifically for redirect routers:
			; data
			: The contents of data are expanded, and then used as the list of forwarding items, or as a set of filtering instructions. If the expansion is forced to fail, or the result is an empty string or a string that has no effect (consists entirely of comments), the router declines.

			cPanel implements a {{code\|check_mail_permissions}} redirect router that ensures the user can receive/send messages based on a variety of conditions. These conditions are checked with the {{code\|check_mail_permissions}} Perl function and is defined as:
			{{highlight\|lang=text\|code=
			<nowiki>
			check_mail_permissions:
			domains = ! +local_domains
			condition = ${if eq {$authenticated_id}{root}{0}{1}}
			ignore_target_hosts = +loopback : 64.94.110.0/24
			driver = redirect
			allow_filter
			reply_transport = address_reply
			user = mailnull
			expn = false
			condition = "${perl{check_mail_permissions}}"
			data = "${perl{check_mail_permissions_results}}"
			</nowiki>
			}}

			Breaking down what this actually does...
			* Perl code {{code\|check_mail_permissions}} will:
			** return 'yes' if user has their incoming/outgoing email suspended. check_mail_permissions_results will include a message and reason for a bounce message.
			** return 'no' if any of these conditions occur:
			*** uid == mailtrap or nobody, enforce_mail_permissions_data = :fail: cannot relay mail as $uid
			*** uid is a demo user, enforce_mail_permissions_data = :fail: is a demo user
			*** domain is empty and sender is nobody, enforce_mail_permissions_data = :fail: mail sent by nobody rejected
			*** file '/var/cpanel/email_send_limits/max_deferfail_$domain' exists with deferfail values. enforce_mail_permissions_data = :fail: domain exceeds max defers per hour
			*** maximum emails by this domain per hour exceeds some defined limit.
			**** if beyond the cutoff, reject. enforce_mail_permissions_data = :fail: domain has exceeded max emails per hour
			**** if below the cutoff, defer. enforce_mail_permissions_data = :defer: domain exceeds max emails per hour
			*** outgoing mail is suspended for $domain. enforce_mail_permissions_data = :fail: domain has outgoing mail suspended
			*** outgoing mail for the sender is on hold. enforce_mail_permissions_data = :defer: $domain outgoing mail hold
			*** outgoing mail for the sender is suspended. enforce_mail_permissions_data = :fail: $domain outgoing mail suspended
			** Send notifications if user exceeds daily limit
			** Increment max emails per hour by calling increment_max_emails_per_hour, which appends '1' to a file at /var/cpanel/email_send_limits/track/$doomain/$h.$d.$m.$y

			will fail if any of the following conditions are met:
			* Authenticated_id == root
			* {{code\|check_mail_permissions}} returns a 'no'
			#
			# {{code\|domains = ! +local_domains}}: Exclude local domains
			# condition = ${if eq {$authenticated_id}{root}{0}{1}}

	=== Transports ===		=== Transports ===

Leo: Reorganized content

2019-09-23T19:54:53Z

Reorganized content

Show changes

Leo at 19:18, 23 September 2019

2019-09-23T19:18:44Z

@@ Line 73: / Line 73: @@
 ; acl_smtp_data
 : Used after the content of the message have been received
 === Security ===

Leo at 18:14, 23 September 2019

2019-09-23T18:14:11Z

← Older revision		Revision as of 18:14, 23 September 2019
Line 12:		Line 12:
	Main configuration settings are values that are defined in the file as {{code\|1=foo = bar}}.		Main configuration settings are values that are defined in the file as {{code\|1=foo = bar}}.



			=== Lists ===
	There are named lists which are defined by the type of list followed by the name of the list and they come in the form of {{code\|1=list-type list-name = list-values}}.		There are named lists which are defined by the type of list followed by the name of the list and they come in the form of {{code\|1=list-type list-name = list-values}}.
	There are 4 types of named lists:		There are 4 types of named lists:
Line 104:		Line 107:
	{/etc/exim.key} \		{/etc/exim.key} \
	}		}

			tls_advertise_hosts = *
			tls_on_connect_ports = 465
			tls_require_ciphers = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
	</nowiki>		</nowiki>
	}}		}}
Line 109:		Line 116:

	=== Common Settings ===		=== Common Settings ===
			https://www.exim.org/exim-html-current/doc/html/spec_html/ch-option_index.html
			https://www.exim.org/exim-html-current/doc/html/spec_html/ch-main_configuration.html#SECTalomo

	TODO: Define the meaning of the following configuration items		TODO: Define the meaning of the following configuration items
	{{highlight\|lang=text\|code=		{{highlight\|lang=text\|code=
	add_environment = PATH=/usr/local/sbin::/usr/local/bin::/sbin::/bin::/usr/sbin::/usr/bin::/sbin::/bin		add_environment = PATH=/usr/local/sbin::/usr/local/bin::/sbin::/bin::/usr/sbin::/usr/bin::/sbin::/bin
			keep_environment = X-SOURCE : X-SOURCE-ARGS : X-SOURCE-DIR

	addresslist secondarymx = *@partial-lsearch;/etc/secondarymx		addresslist secondarymx = *@partial-lsearch;/etc/secondarymx
	auto_thaw = 7d		auto_thaw = 7d
Line 118:		Line 130:
	check_rfc2047_length = false		check_rfc2047_length = false
	chunking_advertise_hosts = 198.51.100.1		chunking_advertise_hosts = 198.51.100.1

	daemon_smtp_ports = 25 : 465 : 587		daemon_smtp_ports = 25 : 465 : 587
			tls_on_connect_ports = 465

			never_users = root
	deliver_queue_load_max = 3		deliver_queue_load_max = 3

	helo_accept_junk_hosts = *		helo_accept_junk_hosts = *
	ignore_bounce_errors_after = 1d		ignore_bounce_errors_after = 1d
	~~keep_environment~~ = ~~X-SOURCE : X-SOURCE-ARGS : X-SOURCE-DIR~~		timeout_frozen_after = 5d
			split_spool_directory = yes

	local_from_check = false		local_from_check = false
	log_selector = +incoming_port +smtp_connection +all_parents +retry_defer +subject +arguments +received_recipients		log_selector = +incoming_port +smtp_connection +all_parents +retry_defer +subject +arguments +received_recipients
	message_body_newlines = true		message_body_newlines = true
	message_body_visible = 5000		message_body_visible = 5000
	~~never_users = root~~
	openssl_options = +no_sslv2 +no_sslv3 +no_tlsv1 +no_tlsv1_1		openssl_options = +no_sslv2 +no_sslv3 +no_tlsv1 +no_tlsv1_1
	queue_only_load = 6		queue_only_load = 6
Line 139:		Line 157:
	smtputf8_advertise_hosts = :		smtputf8_advertise_hosts = :
	spamd_address = 127.0.0.1 783 retry=30s tmo=3m		spamd_address = 127.0.0.1 783 retry=30s tmo=3m
	~~split_spool_directory = yes~~
	system_filter = /etc/cpanel_exim_system_filter		system_filter = /etc/cpanel_exim_system_filter
	system_filter_group = cpaneleximfilter		system_filter_group = cpaneleximfilter
	system_filter_user = cpaneleximfilter		system_filter_user = cpaneleximfilter
	~~timeout_frozen_after = 5d~~
	timezone = America/Los_Angeles		timezone = America/Los_Angeles

	tls_advertise_hosts = *		tls_advertise_hosts = *
	~~tls_on_connect_ports = 465~~
	tls_require_ciphers = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256		tls_require_ciphers = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
	untrusted_set_sender = *		untrusted_set_sender = *
Line 152:		Line 170:
	}}		}}

			; add_environment
			: Environment variables to set
			; keep_environment
			: Environment variables to import. eg. {{code\|^LDAP}}

			; qualify_domain
			: Used to construct a complete email address from local login names, for messages from local processes. Defaults to {{code\|primary_hostname}} if not set.
	; primary_hostname		; primary_hostname
	: The FQDN, otherwise if unset, Exim uses the uname system function to obtain the hostname		: The FQDN, otherwise if unset, Exim uses the uname system function to obtain the hostname

			; allow_domain_literals
			: To allow addresses of from {{code\|username@[10.1.1.1]}} rather than domain name. Typically disabled nowadays
			; never_users
			: Local message deliveries are normally run in processes that are setuid to the recipient. This list of users define which deliveries should not run as. Users that are on this list will have their delivery deferred. Build option with {{code\|FIXED_NEVER_USERS }} also defines a set of users that cannot be overridden.

			; deliver_queue_load_max
			: Defers delivery if system load exceeds the fixed point value.
			; helo_accept_junk_hosts
			: Accepts malformed HELO or ELHO commands for incoming SMTP mail to accomodate SMTP clients that send syntactic junk.
			; ignore_bounce_errors_after
			: Number of days until failing bounce messages are discarded
			; timeout_frozen_after
			: Number of days before any frozen messages (when a bouncing message encounters a permanent failure) are discarded.
			; split_spool_directory
			: Exim queues are stored in the spool directory. Large queues should have the directory split to avoid file system degradation from many files in one directory.
			; check_rfc2047_length
			: RFC 2047 allows for a line length of 76 characters. If set to true, any messages that violate this standard will fail. Set to false for better compatibility.

			; rfc1413_hosts, rfc1413_query_timeout
			: RFC 1413 deals with ident callbacks. Few hosts offer this service. Setting the timeout to 0 seconds will prevent ident callbacks for all incoming SMTP connections.

	; domainlist local_domains = @		; domainlist local_domains = @