X-Git-Url: https://vcs.fsf.org/?a=blobdiff_plain;f=src%2Fsrc%2Fconfigure.default;h=5b6f11af0f3ee7263b8e4f9fbc5a649185dfe13c;hb=328895cc07b8caf8c18003569431a02129989289;hp=0a10ee9b94e67f2e126656e008960209298e2c53;hpb=5de37277102d8c5afce49171c75ced28af2363fe;p=exim.git diff --git a/src/src/configure.default b/src/src/configure.default index 0a10ee9b9..5b6f11af0 100644 --- a/src/src/configure.default +++ b/src/src/configure.default @@ -1,4 +1,4 @@ -# $Cambridge: exim/src/src/configure.default,v 1.4 2005/10/11 09:30:41 ph10 Exp $ +# $Cambridge: exim/src/src/configure.default,v 1.11 2006/09/26 13:51:00 ph10 Exp $ ###################################################################### # Runtime configuration file for Exim # @@ -61,9 +61,9 @@ domainlist relay_to_domains = hostlist relay_from_hosts = 127.0.0.1 # Most straightforward access control requirements can be obtained by -# appropriate settings of the above options. In more complicated situations, you -# may need to modify the Access Control List (ACL) which appears later in this -# file. +# appropriate settings of the above options. In more complicated situations, +# you may need to modify the Access Control Lists (ACLs) which appear later in +# this file. # The first setting specifies your local domains, for example: # @@ -130,6 +130,40 @@ acl_smtp_data = acl_check_data # spamd_address = 127.0.0.1 783 +# If Exim is compiled with support for TLS, you may want to enable the +# following options so that Exim allows clients to make encrypted +# connections. In the authenticators section below, there are template +# configurations for plaintext username/password authentication. This kind +# of authentication is only safe when used within a TLS connection, so the +# authenticators will only work if the following TLS settings are turned on +# as well. + +# Allow any client to use TLS. + +# tls_advertise_hosts = * + +# Specify the location of the Exim server's TLS certificate and private key. +# The private key must not be encrypted (password protected). You can put +# the certificate and private key in the same file, in which case you only +# need the first setting, or in separate files, in which case you need both +# options. + +# tls_certificate = /etc/ssl/exim.crt +# tls_privatekey = /etc/ssl/exim.pem + +# In order to support roaming users who wish to send email from anywhere, +# you may want to make Exim listen on other ports as well as port 25, in +# case these users need to send email from a network that blocks port 25. +# The standard port for this purpose is port 587, the "message submission" +# port. See RFC 4409 for details. Microsoft MUAs cannot be configured to +# talk the message submission protocol correctly, so if you need to support +# them you should also allow TLS-on-connect on the traditional but +# non-standard port 465. + +# daemon_smtp_ports = 25 : 465 : 587 +# tls_on_connect_ports = 465 + + # Specify the domain you want to be added to all unqualified addresses # here. An unqualified address is one that does not contain an "@" character # followed by a domain. For example, "caesar@rome.example" is a fully qualified @@ -161,14 +195,15 @@ acl_smtp_data = acl_check_data # allow_domain_literals -# No deliveries will ever be run under the uids of these users (a colon- -# separated list). An attempt to do so causes a panic error to be logged, and -# the delivery to be deferred. This is a paranoic safety catch. There is an -# even stronger safety catch in the form of the FIXED_NEVER_USERS setting -# in the configuration for building Exim. The list of users that it specifies -# is built into the binary, and cannot be changed. The option below just adds -# additional users to the list. The default for FIXED_NEVER_USERS is "root", -# but just to be absolutely sure, the default here is also "root". +# No deliveries will ever be run under the uids of users specified by +# never_users (a colon-separated list). An attempt to do so causes a panic +# error to be logged, and the delivery to be deferred. This is a paranoic +# safety catch. There is an even stronger safety catch in the form of the +# FIXED_NEVER_USERS setting in the configuration for building Exim. The list of +# users that it specifies is built into the binary, and cannot be changed. The +# option below just adds additional users to the list. The default for +# FIXED_NEVER_USERS is "root", but just to be absolutely sure, the default here +# is also "root". # Note that the default setting means you cannot deliver mail addressed to root # as if it were a normal user. This isn't usually a problem, as most sites have @@ -192,10 +227,11 @@ host_lookup = * # are disabled. RFC 1413 calls are cheap and can provide useful information # for tracing problem messages, but some hosts and firewalls have problems # with them. This can result in a timeout instead of an immediate refused -# connection, leading to delays on starting up an SMTP session. +# connection, leading to delays on starting up SMTP sessions. (The default was +# reduced from 30s to 5s for release 4.61.) rfc1413_hosts = * -rfc1413_query_timeout = 30s +rfc1413_query_timeout = 5s # By default, Exim expects all envelope addresses to be fully qualified, that @@ -240,6 +276,21 @@ ignore_bounce_errors_after = 2d timeout_frozen_after = 7d +# By default, messages that are waiting on Exim's queue are all held in a +# single directory called "input" which it itself within Exim's spool +# directory. (The default spool directory is specified when Exim is built, and +# is often /var/spool/exim/.) Exim works best when its queue is kept short, but +# there are circumstances where this is not always possible. If you uncomment +# the setting below, messages on the queue are held in 62 subdirectories of +# "input" instead of all in the same directory. The subdirectories are called +# 0, 1, ... A, B, ... a, b, ... z. This has two benefits: (1) If your file +# system degrades with many files in one directory, this is less likely to +# happen; (2) Exim can process the queue one subdirectory at a time instead of +# all at once, which can give better performance with large queues. + +# split_spool_directory = true + + ###################################################################### # ACL CONFIGURATION # @@ -279,21 +330,26 @@ acl_check_rcpt: # # Two different rules are used. The first one is stricter, and is applied to # messages that are addressed to one of the local domains handled by this - # host. It blocks local parts that begin with a dot or contain @ % ! / or |. - # If you have local accounts that include these characters, you will have to - # modify this rule. + # host. The line "domains = +local_domains" restricts it to domains that are + # defined by the "domainlist local_domains" setting above. The rule blocks + # local parts that begin with a dot or contain @ % ! / or |. If you have + # local accounts that include these characters, you will have to modify this + # rule. deny message = Restricted characters in address domains = +local_domains local_parts = ^[.] : ^.*[@%!/|] - # The second rule applies to all other domains, and is less strict. This - # allows your own users to send outgoing messages to sites that use slashes - # and vertical bars in their local parts. It blocks local parts that begin - # with a dot, slash, or vertical bar, but allows these characters within the - # local part. However, the sequence /../ is barred. The use of @ % and ! is - # blocked, as before. The motivation here is to prevent your users (or - # your users' viruses) from mounting certain kinds of attack on remote sites. + # The second rule applies to all other domains, and is less strict. The line + # "domains = !+local_domains" restricts it to domains that are NOT defined by + # the "domainlist local_domains" setting above. The exclamation mark is a + # negating operator. This rule allows your own users to send outgoing + # messages to sites that use slashes and vertical bars in their local parts. + # It blocks local parts that begin with a dot, slash, or vertical bar, but + # allows these characters within the local part. However, the sequence /../ + # is barred. The use of @ % and ! is blocked, as before. The motivation here + # is to prevent your users (or your users' viruses) from mounting certain + # kinds of attack on remote sites. deny message = Restricted characters in address domains = !+local_domains @@ -311,22 +367,49 @@ acl_check_rcpt: require verify = sender # Accept if the message comes from one of the hosts for which we are an - # outgoing relay. Recipient verification is omitted here, because in many - # cases the clients are dumb MUAs that don't cope well with SMTP error - # responses. If you are actually relaying out from MTAs, you should probably - # add recipient verification here. Note that, by putting this test before - # any DNS black list checks, you will always accept from these hosts, even - # if they end up on a black list. The assumption is that they are your - # friends, and if they get onto a black list, it is a mistake. + # outgoing relay. It is assumed that such hosts are most likely to be MUAs, + # so we set control=submission to make Exim treat the message as a + # submission. It will fix up various errors in the message, for example, the + # lack of a Date: header line. If you are actually relaying out out from + # MTAs, you may want to disable this. If you are handling both relaying from + # MTAs and submissions from MUAs you should probably split them into two + # lists, and handle them differently. + + # Recipient verification is omitted here, because in many cases the clients + # are dumb MUAs that don't cope well with SMTP error responses. If you are + # actually relaying out from MTAs, you should probably add recipient + # verification here. + + # Note that, by putting this test before any DNS black list checks, you will + # always accept from these hosts, even if they end up on a black list. The + # assumption is that they are your friends, and if they get onto a black + # list, it is a mistake. accept hosts = +relay_from_hosts + control = submission # Accept if the message arrived over an authenticated connection, from # any host. Again, these messages are usually from MUAs, so recipient - # verification is omitted. And again, we do this check before any black list - # tests. + # verification is omitted, and submission mode is set. And again, we do this + # check before any black list tests. accept authenticated = * + control = submission + + # Insist that any other recipient address that we accept is either in one of + # our local domains, or is in a domain for which we explicitly allow + # relaying. Any other domain is rejected as being unacceptable for relaying. + + require message = relay not permitted + domains = +local_domains : +relay_domains + + # We also require all accepted addresses to be verifiable. This check will + # do local part verification for local domains, but only check the domain + # for remote domains. The only way to check local parts for the remote + # relay domains is to use a callout (add /callout), but please read the + # documentation about callouts before doing this. + + require verify = recipient ############################################################################# # There are no default checks on DNS black lists because the domains that @@ -337,9 +420,9 @@ acl_check_rcpt: # deny message = rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text # dnslists = black.list.example # - # warn message = X-Warning: $sender_host_address is in a black list at $dnslist_domain + # warn dnslists = black.list.example + # add_header = X-Warning: $sender_host_address is in a black list at $dnslist_domain # log_message = found in $dnslist_domain - # dnslists = black.list.example ############################################################################# ############################################################################# @@ -353,26 +436,10 @@ acl_check_rcpt: # require verify = csa ############################################################################# - # Accept if the address is in a local domain, but only if the recipient can - # be verified. Otherwise deny. The "endpass" line is the border between - # passing on to the next ACL statement (if tests above it fail) or denying - # access (if tests below it fail). - - accept domains = +local_domains - endpass - verify = recipient - - # Accept if the address is in a domain for which we are an incoming relay, - # but again, only if the recipient can be verified. + # At this point, the address has passed all the checks that have been + # configured, so we accept it unconditionally. - accept domains = +relay_to_domains - endpass - verify = recipient - - # Reaching the end of the ACL causes a "deny", but we might as well give - # an explicit message. - - deny message = relay not permitted + accept # This ACL is used after the contents of a message have been received. This @@ -388,18 +455,18 @@ acl_check_data: # Deny if the message contains a virus. Before enabling this check, you # must install a virus scanner and set the av_scanner option above. # - # deny malware = * - # message = This message contains a virus ($malware_name). + # deny malware = * + # message = This message contains a virus ($malware_name). # Add headers to a message if it is judged to be spam. Before enabling this, # you must install SpamAssassin. You may also need to set the spamd_address # option above. # - # warn spam = nobody - # message = X-Spam_score: $spam_score\n\ - # X-Spam_score_int: $spam_score_int\n\ - # X-Spam_bar: $spam_bar\n\ - # X-Spam_report: $spam_report + # warn spam = nobody + # add_header = X-Spam_score: $spam_score\n\ + # X-Spam_score_int: $spam_score_int\n\ + # X-Spam_bar: $spam_bar\n\ + # X-Spam_report: $spam_report # Accept the message. @@ -433,12 +500,17 @@ begin routers # This router routes addresses that are not in local domains by doing a DNS -# lookup on the domain name. Any domain that resolves to 0.0.0.0 or to a -# loopback interface address (127.0.0.0/8) is treated as if it had no DNS -# entry. Note that 0.0.0.0 is the same as 0.0.0.0/32, which is commonly treated -# as the local host inside the network stack. It is not 0.0.0.0/0, the default -# route. If the DNS lookup fails, no further routers are tried because of -# the no_more setting, and consequently the address is unrouteable. +# lookup on the domain name. The exclamation mark that appears in "domains = ! +# +local_domains" is a negating operator, that is, it can be read as "not". The +# recipient's domain must not be one of those defined by "domainlist +# local_domains" above for this router to be used. +# +# If the router is used, any domain that resolves to 0.0.0.0 or to a loopback +# interface address (127.0.0.0/8) is treated as if it had no DNS entry. Note +# that 0.0.0.0 is the same as 0.0.0.0/32, which is commonly treated as the +# local host inside the network stack. It is not 0.0.0.0/0, the default route. +# If the DNS lookup fails, no further routers are tried because of the no_more +# setting, and consequently the address is unrouteable. dnslookup: driver = dnslookup @@ -448,7 +520,8 @@ dnslookup: no_more -# The remaining routers handle addresses in the local domain(s). +# The remaining routers handle addresses in the local domain(s), that is those +# domains that are defined by "domainlist local_domains" above. # This router handles aliasing using a linearly searched alias file with the @@ -638,10 +711,49 @@ begin rewrite # AUTHENTICATION CONFIGURATION # ###################################################################### -# There are no authenticator specifications in this default configuration file. +# The following authenticators support plaintext username/password +# authentication using the standard PLAIN mechanism and the traditional +# but non-standard LOGIN mechanism, with Exim acting as the server. +# PLAIN and LOGIN are enough to support most MUA software. +# +# These authenticators are not complete: you need to change the +# server_condition settings to specify how passwords are verified. +# They are set up to offer authentication to the client only if the +# connection is encrypted with TLS, so you also need to add support +# for TLS. See the global configuration options section at the start +# of this file for more about TLS. +# +# The default RCPT ACL checks for successful authentication, and will accept +# messages from authenticated users from anywhere on the Internet. begin authenticators +# PLAIN authentication has no server prompts. The client sends its +# credentials in one lump, containing an authorization ID (which we do not +# use), an authentication ID, and a password. The latter two appear as +# $auth2 and $auth3 in the configuration and should be checked against a +# valid username and password. In a real configuration you would typically +# use $auth2 as a lookup key, and compare $auth3 against the result of the +# lookup, perhaps using the crypteq{}{} condition. + +#PLAIN: +# driver = plaintext +# server_set_id = $auth2 +# server_prompts = : +# server_condition = Authentication is not yet configured +# server_advertise_condition = ${if def:tls_cipher } + +# LOGIN authentication has traditional prompts and responses. There is no +# authorization ID in this mechanism, so unlike PLAIN the username and +# password are $auth1 and $auth2. Apart from that you can use the same +# server_condition setting for both authenticators. + +#LOGIN: +# driver = plaintext +# server_set_id = $auth1 +# server_prompts = <| Username: | Password: +# server_condition = Authentication is not yet configured +# server_advertise_condition = ${if def:tls_cipher } ######################################################################