Exim konfiguracja po instalacji

Zabieramy się za konfiguracje naszego EXIMA:
##########################################################
# Runtime configuration file for Exim #
##########################################################
##########################################################
# MAIN CONFIGURATION SETTINGS #
##########################################################
# nazwa naszego Hosta
primary_hostname = domena.pl

# Obsługa wielu domen, ustawiamy aktywna domenę, adresy IP na których nasłuchuje EXIM

local_interfaces = 127.0.0.1 : IP1 : IP2

smtp_active_hostname = ${lookup{$interface_address}lsearch{/etc/exim/domeny_ip}{$value}{$primary_hostname}}

smtp_banner = „$smtp_active_hostname ESMTP $tod_full”

# Ustawiamy nagłowek wiadmości zależny od aktywnej domeny

message_id_header_domain = $smtp_active_hostname

# Tutaj wpisujemy domeny jakie mamy i nasz EXIM bedzie obsługiwał
domainlist local_domains = domena.pl : domena1.pl : domena2.pl
domainlist relay_to_domains =
# Którym hostom pozwalamay na relaying, poniżej mamy sieć lokalną z
maską 24-bitowa
hostlist relay_from_hosts = 127.0.0.1 : 192.168.0.0/24

#Porty nasłuchiwania

daemon_smtp_ports = 25 : 465 : 587
tls_on_connect_ports = 465
smtp_accept_max = 400

# Limit wielkości wiadomości

message_size_limit = 100M

# ustawienia dla list ACL
acl_smtp_data = acl_check_data
# nasz Clamav

av_scanner = clamd:/var/run/clamdav/clamd

acl_smtp_rcpt = acl_check_rcpt

acl_smtp_auth = acl_check_auth

LIM = 100
PERIOD = 1h
WARNTO = abuse@tax-net.pl
EXIMBINARY = /usr/local/exim/bin/exim -f root
SHELL = /bin/sh

acl_smtp_quit = acl_check_quit
acl_smtp_notquit = acl_check_notquit
acl_smtp_mail = acl_check_mail
acl_smtp_connect = acl_check_connect

# filtr tematów wiadomości
system_filter = /etc/exim/filtr_tematow
message_body_visible = 5000
system_filter_file_transport = address_file
system_filter_reply_transport = address_pipe
never_users = root : nobody
# Zadanie lookupu od hosta
host_lookup = *
# Żądanie odpowiedzi od sendera wg, standardu rfs 1413

smtp_enforce_sync = false

rfc1413_hosts = *
rfc1413_query_timeout = 30s

sender_unqualified_hosts = 192.168.0.0/24

# Po dwóch dniach usuwa błedne wiadomości
ignore_bounce_errors_after = 2d
# Ustawienia dla TLS
tls_advertise_hosts = *
tls_certificate = /etc/exim/cert/exim.crt
tls_privatekey = /etc/exim/cert/exim.key
tls_dhparam = /etc/exim/cert/dhparam.pem
# po 3 dniach usuwa wiadmosci frozen ze spool
timeout_frozen_after = 3d
check_log_space = 3M
#######################################################
# ACL CONFIGURATION #
# Specifies access control lists for incoming SMTP mail #
#######################################################

{loadposition Adsense}
# Listy ACL
begin acl
acl_check_data:
# zabraniamy na przesyłanie plików com,vbs,bat,pif,scr
#wiadomo dlaczego
deny message = $found_extension files are not accepted here
demime = com:vbs:bat:pif:scr
deny message = Niedozwolony zalacznik MIME ($demime_reason)
demime = *
condition = ${if >{$demime_errorlevel}{2}{1}{0}}
# po znalezieniu wirusa przez Clamav zostaje nam ślad w logu
deny message = Wiadomosc zawiera wirusa {$malware_name}
malware = *
accept
# Autoryzacja
acl_check_auth:

drop  message = authentication is allowed only once per message in order to slow down bruteforce cracking
set acl_m_auth = ${eval10:0$acl_m_auth+1}
condition = ${if >{$acl_m_auth}{2}}
delay = 22s

drop  message = blacklisted for bruteforce cracking attempt
set acl_c_authnomail = ${eval10:0$acl_c_authnomail+1}
condition = ${if >{$acl_c_authnomail}{4}}
continue = ${run{SHELL -c „echo $sender_host_address >>/var/spool/exim/blacklists/blocked_IPs;N{N echo Subject: $sender_host_address blocked; echo; echo for bruteforce auth cracking attempt.; N}N | EXIMBINARY WARNTO”}}

accept

accept encrypted = *
accept hosts = *
accept condition = ${if eq{${substr_0_5:$smtp_command_argument}}(PLAIN}{yes}{no}}
accept condition = ${if eq{${substr_0_8:$smtp_command_argument}}{LOGIN}{yes}{no}}

acl_check_quit:
warn  condition = ${if def:authentication_failed}
condition = $authentication_failed
logwrite = :reject: quit after authentication failed: ${sg{$sender_rcvhost}{N[nt]+N}{�40}}
ratelimit = 7 / 5m / strict / per_conn
continue = ${run{SHELL -c „echo $sender_host_address >>/var/spool/exim/blacklists/blocked_IPs;N{N echo Subject: $sender_host_address blocked; echo; echo for bruteforce auth cracking attempt.;N}N | EXIMBINARY WARNTO”}}

acl_check_notquit:
warn  condition = ${if def:authentication_failed}
condition = $authentication_failed
logwrite = :reject: $smtp_notquit_reason after authentication failed: ${sg{$sender_rcvhost}{N[nt]+N}{�40}}
condition = ${if eq{$smtp_notquit_reason}{connection-lost}}
ratelimit = 7 / 5m / strict / per_conn
continue = ${run{SHELL -c „echo $sender_host_address >>/var/spool/exim/blacklists/blocked_IPs;N{N echo Subject: $sender_host_address blocked; echo; echo for bruteforce auth cracking attempt.;N}N | EXIMBINARY WARNTO”}}

acl_check_mail:
accept set acl_c_authnomail = 0

acl_check_connect:
drop  message = $sender_host_address locally blacklisted for a bruteforce auth (login+password) cracking attempt
condition = ${if exists{/var/spool/exim/blacklists/blocked_IPs}}
condition = ${lookup{$sender_host_address}lsearch{/var/spool/exim/blacklists/blocked_IPs}{1}{0}}
accept
acl_check_rcpt:

# Greylisting

defer  log_message = Greylistowany host $sender_host_address
domains     = +local_domains
!authenticated = *
verify      = recipient/callout=20s,use_sender,defer_ok
set acl_m0  = request=smtpd_access_policynprotocol_state=RCPTnprotocol_
name=${uc:$received_protocol}nhelo_name=$sender_helo_namenclient_address=$send
er_host_addressnclient_name=$sender_host_namensender=$sender_addressnrecipien
t=$local_part@$domainnn
set acl_m0  = ${sg{${readsocket{/var/run/postgrey/postgrey}{$acl_m0}{5s}{
}{action=DUNNO}}}{action=}{}}
message     = ${sg{$acl_m0}{^\w+\s*}{}}
condition   = ${if eq{${uc:${substr{0}{5}{$acl_m0}}}}{DEFER}{true}{false}}

# Biała lista – używajac systemu RBL (czarnych list ) zdarza się że
# umieszczone na nich są hosty z których otrzymujemy wiadomości, np.
# o2.pl, onet.pl, a także hosty uslugodawców internetu np. orange.pl.
# Użytkownicy nie mogż wtedy korzystać z poczty za pośrednictwem połączeń
# od operatorów komórkowych, dodajemy więc do tej listy zaufane hosty,
# lub domeny, jeden/judna w wierszu w formacie IP, IP/maska, *.domena
accept hosts = /etc/exim/listy_acl/bialalista :
deny local_parts = ^.*[@%!/|] : ^\.
require verify = sender

drop    message          = „No you are Me or OURS (HELO was $sender_helo_name and equal my local domains or my domains relay)”
condition     = ${if match_domain{$sender_helo_name}{+local_domains:+relay_to_domains}{yes}{no}}
delay          = 45s

drop   message        = No you are not Me or OURS (HELO was $sender_helo_name and the subdomain is my domain ${extract{-3}{.}{$sender_helo_name}}.${extract{-2}{.}{$sender_helo_name}}.${extract{-1}{.}{$sender_helo_name}})
condition      = ${if match_domain{${extract{-3}{.}{$sender_helo_name}}.${extract{-2}{.}{$sender_helo_name}}.${extract{-1}{.}{$sender_helo_name}}}{+local_domains:+relay_to_domains}{yes}{no}}
delay          = 45s

drop   message        = No you are not ME or OURS (HELO was $sender_helo_name and equal my interface hostname)
condition      = ${if !def:interface_address {no}{yes}}
condition      = ${if match_ip{$interface_address}{${lookup dnsdb{>: defer_never,a=$sender_helo_name}}}{yes}{no}}
delay          = 45s
# Dodatkowa opcja – mamy pewną grupę userów w domenie np.
# domena.pl i chcemy wyslać do wszystkich wiadomość, można poprostu
# dodac odbiorców w programie pocztowym, ale można też zrobić alias do
# np. wszyscy@domena.pl, poniższy wpis powoduje to że do
# wszyscy@domena.pl może tylko wyslać osoba która znajduje się na liście
# wszyscy@domena.pl, zabezpiecza to przez masowym docieraniem spamu na
# konta użytkowników
deny
message = „Nie jestes uprawniony aby wyslac poczte na ten adres”
condition = ${if exists{/etc/exim/${local_part}@${domain}}{1}{0}}
senders = ! /etc/exim/${local_part}@${domain}
# Definicja własnej Czarnej listy
deny
message = „Tych klientow nie obslugujemy”
hosts = /etc/exim/listy_acl/czarnalista :

# SPF (Sender Policy Framework)

deny
message       = $sender_host_address nie ma pozwolenia by wysyłać poczte  od $sender_address_domain
log_message   = Brak SPF
spf           = fail

# Ustawienia RBL, najbardziej extremalna z tej listy jest
# sbl-xbl.smaphaus.org, na niej jest o2.pl onet.pl
deny
message = rejected because $sender_host_address jest na czarnej liscie $dnslist_domainn$dnslist_text
dnslists = bl.spamcop.net : sbl-xbl.spamhaus.org : relays.ordb.org : dnsbl.njabl.org : dnsbl.sorbs.net
#
warn message = X-Warning: $sender_host_address is in a black list at $dnslist_domain
dnslists = dialups.mail-abuse.org
############################################################
# Bez komentarza, wiadomo o co chodzi
accept domains = +local_domains
endpass
message = nieznany uzytkownik
verify = recipient
accept domains = +relay_to_domains
endpass
message = nieznany adres
verify = recipient
accept hosts = !@[] : +relay_from_hosts
set acl_m_user = $sender_host_address
condition = ${if exists{/var/spool/exim/blacklists/blocked_relay_users}}
condition = ${lookup{$acl_m_user}lsearch{/var/spool/exim/blacklists/blocked_relay_users}{1}{0}}
control = freeze/no_tell
control = submission/sender_retain/domain=
add_header = X-Relayed-From: $acl_m_user

accept hosts = !@[] : +relay_from_hosts
!verify = recipient/defer_ok/callout=10s,defer_ok,use_sender
ratelimit = LIM / PERIOD / per_rcpt / relayuser-$acl_m_user
continue = ${run{SHELL -c „echo $acl_m_user >>/var/spool/exim/blacklists/blocked_relay_users; N{N echo Subject: relay user $acl_m_user blocked; echo; echo because has sent mail to LIM invalid recipients during PERIOD.; N}N | EXIMBINARY WARNTO”}}
control = freeze/no_tell
control = submission/sender_retain/domain=
add_header = X-Relayed-From: $acl_m_user

accept  hosts         = +relay_from_hosts
control = submission/sender_retain/domain=
# Akceptujemy tylko autoryzowanych użytkownikow
accept authenticated = *
set acl_m_user = $authenticated_id
condition = ${if exists{$spool_directory/blocked_authenticated_users}}
condition = ${lookup{$acl_m_user}lsearch{/var/spool/exim/blacklists/blocked_authenticated_users}{1}{0}}
control = freeze/no_tell
control = submission/sender_retain/domain=
add_header = X-Authenticated-As: $acl_m_user

accept authenticated = *
!verify = recipient/defer_ok/callout=10s,defer_ok,use_sender
ratelimit = LIM / PERIOD / per_rcpt / user-$acl_m_user
continue = ${run{SHELL -c „echo $acl_m_user >>/var/spool/exim/blacklists/blocked_authenticated_users; N{N echo Subject: user $acl_m_user blocked; echo; echo because has sent mail to LIM invalid recipients during PERIOD.; N}N | EXIMBINARY WARNTO”}}
control = freeze/no_tell
control = submission/sender_retain/domain=
add_header = X-Authenticated-As: $acl_m_user

accept authenticated = *
control = submission/sender_retain/domain=
# Jeżeli wysyłający ma złe hasło lub login to w przypadku np. Outlook
# Express w monicie blędu pokaże mu sie tekst ponizej
deny
message = authentication PLAIN or LOGIN required – relay not permitted
###########################################################
# ROUTERS CONFIGURATION #
# Specifies how addresses are handled #
############################################################
# THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT! #
# An address is passed to each router in turn until it is accepted. #
############################################################

begin routers

#bogofilter

bogo_router:
domains = +local_domains
no_verify
condition = ${if !eq {$received_protocol}{bogodone} {1}{0}}
driver = accept
transport = bogo_transport

dnslookup:
driver = dnslookup
domains = ! +local_domains
transport = remote_smtp
ignore_target_hosts = 127.0.0.0/8
no_more
# Ustawienia aliasów, celowo ustawiony plik aliasów ma
# format $domain, z tego powodu ze jezeli nasz Exim obsługuje
# kilka domen musimy rozgraniczyc konta userów do danej domeny
system_aliases:
driver = redirect
allow_fail
allow_defer
data = ${lookup{$local_part}lsearch{/etc/exim/$domain}}
file_transport = address_file
pipe_transport = address_pipe
# Ustawienia dla pliku .forward w katalogu użytkownika
userforward:
driver = redirect
check_local_user
file = $home/.forward
no_verify
no_expn
check_ancestor
file_transport = address_file
pipe_transport = address_pipe
reply_transport = address_reply
# vacation – automatyczna odpowiedź
uservacation:

driver = accept require files = /var/mail/vacation/${local_part}/vacation.msg
condition = ${if or {{match {$h_precedence:} {(?i)junk|bulk|list}} {eq {sender_address} {}}} {no} {yes}}
senders = ” ! ^.*-request@.*:
! ^.*@list*.*:
! ^owner-.*@.*:
! ^postmaster@.*:
! ^listmaster@.*:
! ^mailer-daemon@.*
! ^root@.*”
no_expn
transport = vacation_reply
unseen
no_verify
# Lokalne skrzynki pocztowe
localuser:
driver = accept
check_local_user
transport = local_delivery
############################################################
# TRANSPORTS CONFIGURATION #
############################################################
# ORDER DOES NOT MATTER #
# Only one appropriate transport is called for each delivery. #
############################################################
begin transports
# Ustawienia transportu wiadomości, dodamy tu sobie stopkę z informacją
# że poczta byla skanowana antyvirem
# do tego celu świetnie nadaje się maly programik altermime, opis
# konfiguracji w dalszej częsci

#Transport Bogofilter

bogo_transport:
driver = pipe
command = /usr/local/exim/bin/exim -oMr bogodone -bS
use_bsmtp = true
headers_add = X-Bogofilterd: true
transport_filter = /usr/local/bin/bogofilter -d /var/spool/bogofilter -l -p -e -u
return_fail_output = true
group = eximgrp
user = exim
home_directory = „/tmp/bogofilter”
current_directory = „/tmp/bogofilter”
log_output = true
return_path_add = false

remote_smtp:
debug_print = „T: remote_smtp for @local_part@$domain”
driver = smtp

interface = „${lookup{$sender_address_domain}lsearch{/etc/exim/ip_domeny}{$value}}”
helo_data = „${lookup{$interface_address}lsearch{/etc/exim/domeny_ip}{$value}}”
transport_filter = /usr/local/bin/sh.stopka $sender_address
# gdzie trafiają moje maile ? odpowiedz poniżej wraz z dopisaniem stopki.
local_delivery:
driver = appendfile
transport_filter = /usr/local/bin/sh.stopka $sender_address
file = /var/mail/$local_part
delivery_date_add
envelope_to_add
return_path_add
group = users
# dalsze ustawienia pliku .forward
address_pipe:
driver = pipe
return_output
address_file:
driver = appendfile
delivery_date_add
envelope_to_add
return_path_add
address_reply:
driver = autoreply
# transport dla vacation
vacation_reply:
driver = autoreply
file = /var/mail/vacation/$local_part/vacation.msg
file_expand
from = System Automatycznej Odpowiedzi <$original_local_part@orginal_domain>
log = /var/mail/vacation/$local_part/vacation.db
once_repeat = 7d
subject = ${if def:h_Subject: {Re: ${quote:${escape:${length_50:$h_Subject:}}} (autoreply)} {Informacja} }
text = ”
Witaj $h_fromnn
Ta wiadomosc zostala wygenerowana automatycznien
Tekst ponizej zawiera informacje od uzytkownika:n
===================================================nn

to = „$sender_address”
#############################################################
# RETRY CONFIGURATION #
#############################################################
# Te ustawienia powodują że np. jeżeli padł jakiś serwer odbiorcy do
# którego piszesz to po czasie jaki tu jest ustawiony wiadomość będzie
# powtórnie wysłana
begin retry
# Domain Error Retries
# —— —– ——-
* * F,2h,15m; G,16h,1h,1.5; F,4d,6h
##############################################################
# REWRITE CONFIGURATION #
##############################################################
# There are no rewriting specifications in this default configuration file.
begin rewrite
##############################################################
# AUTHENTICATION CONFIGURATION #
##############################################################
# Ustawienia autoryzacji pwcheck.
begin authenticators
fixed_plain:
driver = plaintext
public_name = PLAIN
server_prompts = :
server_condition = ${if pwcheck{$2:$3}{1}{0}}
server_set_id = $2
login:
driver = plaintext
public_name = LOGIN
server_prompts = „Username:: : Password::”
server_condition = ${if pwcheck{$1:$2}{1}{0}}
server_set_id = $1
# I to by bylo na tyle pozostaje generacja certyfikatów dla TLS
openssl req -new -x509 -days 365 -nodes -out /etc/exim/cert/exim.crt -keyout /etc/exim/exim.key 
openssl dhparam -out /etc/exim/dhparam.pem 1024

Korzystając z serwisu zgadzasz się na korzystanie z plików cookie. Więcej informacji

Aby zapewnić Tobie najwyższy poziom realizacji usługi, opcje ciasteczek na tej stronie są ustawione na "zezwalaj na pliki cookies". Kontynuując przeglądanie strony bez zmiany ustawień lub klikając przycisk "Akceptuję" zgadzasz się na ich wykorzystanie.

Zamknij