» FAQ по Exim MTA

DarkHost
Молодой человек, человечество действительно еще не овладело способностью к телепатии, поэтому прикрепляю [more=конфиг]
# Specify your host's canonical name here. This should normally be the fully
# qualified "official" name of your host. If this option is not set, the
# uname() function is called to obtain the name. In many cases this does
# the right thing and you need not set anything explicitly.

# primary_hostname = domain.ru

# The next three settings create two lists of domains and one list of hosts.
# These lists are referred to later in this configuration using the syntax
# +local_domains, +relay_to_domains, and +relay_from_hosts, respectively. They
# are all colon-separated lists:

domainlist local_domains = @ : domain.ru
domainlist relay_to_domains =
hostlist relay_from_hosts = 127.0.0.1

# Most straightforward access control requirements can be obtained by
# appropriate settings of the above options. In more complicated situations,
# you may need to modify the Access Control List (ACL) which appears later in
# this file.

# The first setting specifies your local domains, for example:
#
# domainlist local_domains = my.first.domain : my.second.domain
#
# You can use "@" to mean "the name of the local host", as in the default
# setting above. This is the name that is specified by primary_hostname,
# as specified above (or defaulted). If you do not want to do any local
# deliveries, remove the "@" from the setting above. If you want to accept mail
# addressed to your host's literal IP address, for example, mail addressed to
# "user@[192.168.23.44]", you can add "@[]" as an item in the local domains
# list. You also need to uncomment "allow_domain_literals" below. This is not
# recommended for today's Internet.

# The second setting specifies domains for which your host is an incoming relay.
# If you are not doing any relaying, you should leave the list empty. However,
# if your host is an MX backup or gateway of some kind for some domains, you
# must set relay_to_domains to match those domains. For example:
#
# domainlist relay_to_domains = *.myco.com : my.friend.org
#
# This will allow any host to relay through your host to those domains.
# See the section of the manual entitled "Control of relaying" for more
# information.

# The third setting specifies hosts that can use your host as an outgoing relay
# to any other host on the Internet. Such a setting commonly refers to a
# complete local network as well as the localhost. For example:
#
# hostlist relay_from_hosts = 127.0.0.1 : 192.168.0.0/16
#
# The "/16" is a bit mask (CIDR notation), not a number of hosts. Note that you
# have to include 127.0.0.1 if you want to allow processes on your host to send
# SMTP mail by using the loopback address. A number of MUAs use this method of
# sending mail.

# All three of these lists may contain many different kinds of item, including
# wildcarded names, regular expressions, and file lookups. See the reference
# manual for details. The lists above are used in the access control lists for
# checking incoming messages. The names of these ACLs are defined here:

acl_smtp_rcpt = acl_check_rcpt
acl_smtp_data = acl_check_data

# You should not change those settings until you understand how ACLs work.


# If you are running a version of Exim that was compiled with the content-
# scanning extension, you can cause incoming messages to be automatically
# scanned for viruses. You have to modify the configuration in two places to
# set this up. The first of them is here, where you define the interface to
# your scanner. This example is typical for ClamAV; see the manual for details
# of what to set for other virus scanners. The second modification is in the
# acl_check_data access control list (see below).

# av_scanner = clamd:/tmp/clamd


# For spam scanning, there is a similar option that defines the interface to
# SpamAssassin. You do not need to set this if you are using the default, which
# is shown in this commented example. As for virus scanning, you must also
# modify the acl_check_data access control list to enable spam scanning.

# spamd_address = 127.0.0.1 783


# Specify the domain you want to be added to all unqualified addresses
# here. An unqualified address is one that does not contain an "@" character
# followed by a domain. For example, "caesar@rome.example" is a fully qualified
# address, but the string "caesar" (i.e. just a login name) is an unqualified
# email address. Unqualified addresses are accepted only from local callers by
# default. See the recipient_unqualified_hosts option if you want to permit
# unqualified addresses from remote sources. If this option is not set, the
# primary_hostname value is used for qualification.

# qualify_domain =


# If you want unqualified recipient addresses to be qualified with a different
# domain to unqualified sender addresses, specify the recipient domain here.
# If this option is not set, the qualify_domain value is used.

# qualify_recipient =


# The following line must be uncommented if you want Exim to recognize
# addresses of the form "user@[10.11.12.13]" that is, with a "domain literal"
# (an IP address) instead of a named domain. The RFCs still require this form,
# but it makes little sense to permit mail to be sent to specific hosts by
# their IP address in the modern Internet. This ancient format has been used
# by those seeking to abuse hosts by using them for unwanted relaying. If you
# really do want to support domain literals, uncomment the following line, and
# see also the "domain_literal" router below.

# allow_domain_literals


# No deliveries will ever be run under the uids of these users (a colon-
# separated list). An attempt to do so causes a panic error to be logged, and
# the delivery to be deferred. This is a paranoic safety catch. There is an
# even stronger safety catch in the form of the FIXED_NEVER_USERS setting
# in the configuration for building Exim. The list of users that it specifies
# is built into the binary, and cannot be changed. The option below just adds
# additional users to the list. The default for FIXED_NEVER_USERS is "root",
# but just to be absolutely sure, the default here is also "root".

# Note that the default setting means you cannot deliver mail addressed to root
# as if it were a normal user. This isn't usually a problem, as most sites have
# an alias for root that redirects such mail to a human administrator.

never_users = root


# The setting below causes Exim to do a reverse DNS lookup on all incoming
# IP calls, in order to get the true host name. If you feel this is too
# expensive, you can specify the networks for which a lookup is done, or
# remove the setting entirely.

host_lookup = *


# The settings below, which are actually the same as the defaults in the
# code, cause Exim to make RFC 1413 (ident) callbacks for all incoming SMTP
# calls. You can limit the hosts to which these calls are made, and/or change
# the timeout that is used. If you set the timeout to zero, all RFC 1413 calls
# are disabled. RFC 1413 calls are cheap and can provide useful information
# for tracing problem messages, but some hosts and firewalls have problems
# with them. This can result in a timeout instead of an immediate refused
# connection, leading to delays on starting up SMTP sessions. (The default was
# reduced from 30s to 5s for release 4.61.)

rfc1413_hosts = *
rfc1413_query_timeout = 5s


# By default, Exim expects all envelope addresses to be fully qualified, that
# is, they must contain both a local part and a domain. If you want to accept
# unqualified addresses (just a local part) from certain hosts, you can specify
# these hosts by setting one or both of
#
# sender_unqualified_hosts =
# recipient_unqualified_hosts =
#
# to control sender and recipient addresses, respectively. When this is done,
# unqualified addresses are qualified using the settings of qualify_domain
# and/or qualify_recipient (see above).


# If you want Exim to support the "percent hack" for certain domains,
# uncomment the following line and provide a list of domains. The "percent
# hack" is the feature by which mail addressed to x%y@z (where z is one of
# the domains listed) is locally rerouted to x@y and sent on. If z is not one
# of the "percent hack" domains, x%y is treated as an ordinary local part. This
# hack is rarely needed nowadays; you should not enable it unless you are sure
# that you really need it.
#
# percent_hack_domains =
#
# As well as setting this option you will also need to remove the test
# for local parts containing % in the ACL definition below.


# When Exim can neither deliver a message nor return it to sender, it "freezes"
# the delivery error message (aka "bounce message"). There are also other
# circumstances in which messages get frozen. They will stay on the queue for
# ever unless one of the following options is set.

# This option unfreezes frozen bounce messages after two days, tries
# once more to deliver them, and ignores any delivery failures.

ignore_bounce_errors_after = 2d

# This option cancels (removes) frozen messages that are older than a week.

timeout_frozen_after = 7d



######################################################################
# ACL CONFIGURATION #
# Specifies access control lists for incoming SMTP mail #
######################################################################

begin acl

# This access control list is used for every RCPT command in an incoming
# SMTP message. The tests are run in order until the address is either
# accepted or denied.

acl_check_rcpt:

# Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
# testing for an empty sending host field.

accept hosts = :

#############################################################################
# The following section of the ACL is concerned with local parts that contain
# @ or % or ! or / or | or dots in unusual places.
#
# The characters other than dots are rarely found in genuine local parts, but
# are often tried by people looking to circumvent relaying restrictions.
# Therefore, although they are valid in local parts, these rules lock them
# out, as a precaution.
#
# Empty components (two dots in a row) are not valid in RFC 2822, but Exim
# allows them because they have been encountered. (Consider local parts
# constructed as "firstinitial.secondinitial.familyname" when applied to
# someone like me, who has no second initial.) However, a local part starting
# with a dot or containing /../ can cause trouble if it is used as part of a
# file name (e.g. for a mailing list). This is also true for local parts that
# contain slashes. A pipe symbol can also be troublesome if the local part is
# incorporated unthinkingly into a shell command line.
#
# Two different rules are used. The first one is stricter, and is applied to
# messages that are addressed to one of the local domains handled by this
# host. The line "domains = +local_domains" restricts it to domains that are
# defined by the "domainlist local_domains" setting above. The rule blocks
# local parts that begin with a dot or contain @ % ! / or |. If you have
# local accounts that include these characters, you will have to modify this
# rule.

deny message = Restricted characters in address
domains = +local_domains
local_parts = ^[.] : ^.*[@%!/|]

# The second rule applies to all other domains, and is less strict. The line
# "domains = !+local_domains" restricts it to domains that are NOT defined by
# the "domainlist local_domains" setting above. The exclamation mark is a
# negating operator. This rule allows your own users to send outgoing
# messages to sites that use slashes and vertical bars in their local parts.
# It blocks local parts that begin with a dot, slash, or vertical bar, but
# allows these characters within the local part. However, the sequence /../
# is barred. The use of @ % and ! is blocked, as before. The motivation here
# is to prevent your users (or your users' viruses) from mounting certain
# kinds of attack on remote sites.

deny message = Restricted characters in address
domains = !+local_domains
local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
#############################################################################

# Accept mail to postmaster in any local domain, regardless of the source,
# and without verifying the sender.

accept local_parts = postmaster
domains = +local_domains

# Deny unless the sender address can be verified.

require verify = sender

# Accept if the message comes from one of the hosts for which we are an
# outgoing relay. It is assumed that such hosts are most likely to be MUAs,
# so we set control=submission to make Exim treat the message as a
# submission. It will fix up various errors in the message, for example, the
# lack of a Date: header line. If you are actually relaying out out from
# MTAs, you may want to disable this. If you are handling both relaying from
# MTAs and submissions from MUAs you should probably split them into two
# lists, and handle them differently.

# Recipient verification is omitted here, because in many cases the clients
# are dumb MUAs that don't cope well with SMTP error responses. If you are
# actually relaying out from MTAs, you should probably add recipient
# verification here.

# Note that, by putting this test before any DNS black list checks, you will
# always accept from these hosts, even if they end up on a black list. The
# assumption is that they are your friends, and if they get onto a black
# list, it is a mistake.

accept hosts = +relay_from_hosts
control = submission

# Accept if the message arrived over an authenticated connection, from
# any host. Again, these messages are usually from MUAs, so recipient
# verification is omitted, and submission mode is set. And again, we do this
# check before any black list tests.

accept authenticated = *
control = submission

#############################################################################
# There are no default checks on DNS black lists because the domains that
# contain these lists are changing all the time. However, here are two
# examples of how you can get Exim to perform a DNS black list lookup at this
# point. The first one denies, whereas the second just warns.
#
# deny message = rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text
# dnslists = black.list.example
#
# warn message = X-Warning: $sender_host_address is in a black list at $dnslist_domain
# log_message = found in $dnslist_domain
# dnslists = black.list.example
#############################################################################

#############################################################################
# This check is commented out because it is recognized that not every
# sysadmin will want to do it. If you enable it, the check performs
# Client SMTP Authorization (csa) checks on the sending host. These checks
# do DNS lookups for SRV records. The CSA proposal is currently (May 2005)
# an Internet draft. You can, of course, add additional conditions to this
# ACL statement to restrict the CSA checks to certain hosts only.
#
# require verify = csa
#############################################################################

# Accept if the address is in a local domain, but only if the recipient can
# be verified. Otherwise deny. The "endpass" line is the border between
# passing on to the next ACL statement (if tests above it fail) or denying
# access (if tests below it fail).

accept domains = +local_domains
endpass
verify = recipient

# Accept if the address is in a domain for which we are an incoming relay,
# but again, only if the recipient can be verified.

accept domains = +relay_to_domains
endpass
verify = recipient

# Reaching the end of the ACL causes a "deny", but we might as well give
# an explicit message.

deny message = relay not permitted


# This ACL is used after the contents of a message have been received. This
# is the ACL in which you can test a message's headers or body, and in
# particular, this is where you can invoke external virus or spam scanners.
# Some suggested ways of configuring these tests are shown below, commented
# out. Without any tests, this ACL accepts all messages. If you want to use
# such tests, you must ensure that Exim is compiled with the content-scanning
# extension (WITH_CONTENT_SCAN=yes in Local/Makefile).

acl_check_data:

# Deny if the message contains a virus. Before enabling this check, you
# must install a virus scanner and set the av_scanner option above.
#
# deny malware = *
# message = This message contains a virus ($malware_name).

# Add headers to a message if it is judged to be spam. Before enabling this,
# you must install SpamAssassin. You may also need to set the spamd_address
# option above.
#
# warn spam = nobody
# message = X-Spam_score: $spam_score\n\
# X-Spam_score_int: $spam_score_int\n\
# X-Spam_bar: $spam_bar\n\
# X-Spam_report: $spam_report

# Accept the message.

accept



######################################################################
# ROUTERS CONFIGURATION #
# Specifies how addresses are handled #
######################################################################
# THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT! #
# An address is passed to each router in turn until it is accepted. #
######################################################################

begin routers

# This router routes to remote hosts over SMTP by explicit IP address,
# when an email address is given in "domain literal" form, for example,
# <user@[192.168.35.64]>. The RFCs require this facility. However, it is
# little-known these days, and has been exploited by evil people seeking
# to abuse SMTP relays. Consequently it is commented out in the default
# configuration. If you uncomment this router, you also need to uncomment
# allow_domain_literals above, so that Exim can recognize the syntax of
# domain literal addresses.

# domain_literal:
# driver = ipliteral
# domains = ! +local_domains
# transport = remote_smtp


# This router routes addresses that are not in local domains by doing a DNS
# lookup on the domain name. The exclamation mark that appears in "domains = !
# +local_domains" is a negating operator, that is, it can be read as "not". The
# recipient's domain must not be one of those defined by "domainlist
# local_domains" above for this router to be used.
#
# If the router is used, any domain that resolves to 0.0.0.0 or to a loopback
# interface address (127.0.0.0/8) is treated as if it had no DNS entry. Note
# that 0.0.0.0 is the same as 0.0.0.0/32, which is commonly treated as the
# local host inside the network stack. It is not 0.0.0.0/0, the default route.
# If the DNS lookup fails, no further routers are tried because of the no_more
# setting, and consequently the address is unrouteable.

dnslookup:
driver = dnslookup
domains = ! +local_domains
transport = remote_smtp
ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
no_more


# The remaining routers handle addresses in the local domain(s), that is those
# domains that are defined by "domainlist local_domains" above.


# This router handles aliasing using a linearly searched alias file with the
# name /etc/mail/aliases. When this configuration is installed automatically,
# the name gets inserted into this file from whatever is set in Exim's
# build-time configuration. The default path is the traditional /etc/aliases.
# If you install this configuration by hand, you need to specify the correct
# path in the "data" setting below.
#
##### NB You must ensure that the alias file exists. It used to be the case
##### NB that every Unix had that file, because it was the Sendmail default.
##### NB These days, there are systems that don't have it. Your aliases
##### NB file should at least contain an alias for "postmaster".
#
# If any of your aliases expand to pipes or files, you will need to set
# up a user and a group for these deliveries to run under. You can do
# this by uncommenting the "user" option below (changing the user name
# as appropriate) and adding a "group" option if necessary. Alternatively, you
# can specify "user" on the transports that are used. Note that the transports
# listed below are the same as are used for .forward files; you might want
# to set up different ones for pipe and file deliveries from aliases.

system_aliases:
driver = redirect
allow_fail
allow_defer
data = ${lookup{$local_part}lsearch{/etc/mail/aliases}}
# user = exim
file_transport = address_file
pipe_transport = address_pipe


# This router handles forwarding using traditional .forward files in users'
# home directories. If you want it also to allow mail filtering when a forward
# file starts with the string "# Exim filter" or "# Sieve filter", uncomment
# the "allow_filter" option.

# If you want this router to treat local parts with suffixes introduced by "-"
# or "+" characters as if the suffixes did not exist, uncomment the two local_
# part_suffix options. Then, for example, xxxx-foo@your.domain will be treated
# in the same way as xxxx@your.domain by this router. You probably want to make
# the same change to the localuser router.

# The no_verify setting means that this router is skipped when Exim is
# verifying addresses. Similarly, no_expn means that this router is skipped if
# Exim is processing an EXPN command.

# The check_ancestor option means that if the forward file generates an
# address that is an ancestor of the current one, the current one gets
# passed on instead. This covers the case where A is aliased to B and B
# has a .forward file pointing to A.

# The three transports specified at the end are those that are used when
# forwarding generates a direct delivery to a file, or to a pipe, or sets
# up an auto-reply, respectively.

userforward:
driver = redirect
check_local_user
# local_part_suffix = +* : -*
# local_part_suffix_optional
file = $home/.forward
# allow_filter
no_verify
no_expn
check_ancestor
file_transport = address_file
pipe_transport = address_pipe
reply_transport = address_reply


# This router matches local user mailboxes. If the router fails, the error
# message is "Unknown user".

# If you want this router to treat local parts with suffixes introduced by "-"
# or "+" characters as if the suffixes did not exist, uncomment the two local_
# part_suffix options. Then, for example, xxxx-foo@your.domain will be treated
# in the same way as xxxx@your.domain by this router.

localuser:
driver = accept
check_local_user
# local_part_suffix = +* : -*
# local_part_suffix_optional
transport = local_delivery
cannot_route_message = Unknown user



######################################################################
# TRANSPORTS CONFIGURATION #
######################################################################
# ORDER DOES NOT MATTER #
# Only one appropriate transport is called for each delivery. #
######################################################################

# A transport is used only when referenced from a router that successfully
# handles an address.

begin transports


# This transport is used for delivering messages over SMTP connections.

remote_smtp:
driver = smtp


# This transport is used for local delivery to user mailboxes in traditional
# BSD mailbox format. By default it will be run under the uid and gid of the
# local user, and requires the sticky bit to be set on the /var/mail directory.
# Some systems use the alternative approach of running mail deliveries under a
# particular group instead of using the sticky bit. The commented options below
# show how this can be done.

local_delivery:
driver = appendfile
# file = /var/mail/$local_part
directory = /home/$local_part/.maildir
maildir_format
delivery_date_add
envelope_to_add
return_path_add
# group = mail
# mode = 0660


# This transport is used for handling pipe deliveries generated by alias or
# .forward files. If the pipe generates any standard output, it is returned
# to the sender of the message as a delivery error. Set return_fail_output
# instead of return_output if you want this to happen only when the pipe fails
# to complete normally. You can set different transports for aliases and
# forwards if you want to - see the references to address_pipe in the routers
# section above.

address_pipe:
driver = pipe
return_output


# This transport is used for handling deliveries directly to files that are
# generated by aliasing or forwarding.

address_file:
driver = appendfile
delivery_date_add
envelope_to_add
return_path_add


# This transport is used for handling autoreplies generated by the filtering
# option of the userforward router.

address_reply:
driver = autoreply



######################################################################
# RETRY CONFIGURATION #
######################################################################

begin retry

# This single retry rule applies to all domains and all errors. It specifies
# retries every 15 minutes for 2 hours, then increasing retry intervals,
# starting at 1 hour and increasing each time by a factor of 1.5, up to 16
# hours, then retries every 6 hours until 4 days have passed since the first
# failed delivery.

# Address or Domain Error Retries
# ----------------- ----- -------

* * F,2h,15m; G,16h,1h,1.5; F,4d,6h



######################################################################
# REWRITE CONFIGURATION #
######################################################################

# There are no rewriting specifications in this default configuration file.

begin rewrite



######################################################################
# AUTHENTICATION CONFIGURATION #
######################################################################

# There are no authenticator specifications in this default configuration file.

begin authenticators
plain:
driver = plaintext
public_name = PLAIN
server_prompts = :
server_condition = ${if pam{$auth2:${sg{$auth3}{:}{::}}}}
server_set_id = $auth2

login:
driver = plaintext
public_name = LOGIN
server_prompts = Username:: : Password::
server_condition = ${if pam{$auth1:${sg{$auth2}{:}{::}}}}
server_set_id = $auth1

######################################################################
# CONFIGURATION FOR local_scan() #
######################################################################

# If you have built Exim to include a local_scan() function that contains
# tables for private options, you can define those options here. Remember to
# uncomment the "begin" line. It is commented by default because it provokes
# an error with Exim binaries that are not built with LOCAL_SCAN_HAS_OPTIONS
# set in the Local/Makefile.

# begin local_scan


# End of Exim configuration file
[/more]

я его почти не правил... так что все настройки по дефолту.

Всем привет! Пршу помочь советом.

Пытаюсь прикрутить к EXIM Dovecot без БД. Смотрел документацию dovecot, но так толком и не нарыл ничего по этому поводу, точней нарыл, но пока немного путаюсь в облии информации
.
Как лучше слкадывать почту, через deliver dovecot'a, посредством exim, или без разницы?
Как правильно в экзиме забирать имя пользователя из файла формата: "user:{CRAM-MD5}passwrd".
Спасибо.

ashgdw

Цитата:

Как лучше слкадывать почту, через deliver dovecot'a, посредством exim, или без разницы?

без разницы, я предпочитаю самим экзимом.

Вроде как экзим не поддерживает MD5

тут ранее обсуждалось, как не проверять на вирусы исходящую почту, мне же нужно проверять на вирусы всю почту и входящую и исходящую и внутри сети и везде. И слать отчеты и отправителю и получателю. Сейчас проверяет только входящую и из вне, а отчеты шлет только отправителю:

Код:
acl_smtp_data = acl_check_data
av_scanner = clamd:/var/run/clamav/clamd
acl_check_data:
deny malware = *
message = "In e-mail found VIRUS - $malware_name"

привет всем!кто посоветует бесплатный антиспам?Gentoo+dovecot+exim

Доброго времени
использовал инструкции от ginger + от лисяры + свое маленько
не суть
Exim обрабатывает около 20 виртуальных доменов
хотелось бы знать можно ли сделать что бы exim писал логи для каждого из виртуальных доменов в свой файл
ИМХО очень неудобно искать в общей куче нужные записи..
заранее благодарен.

Добавлено:
dzzzr2007
spamassassin

Цитата:

можно ли сделать что бы exim писал логи для каждого из виртуальных доменов в свой файл

Можно попробовать.

Код: log_file_path = $acl_m1
acl_check_rcpt:

warn condition = ${if eq{$domain}{domain1.ru}{1}{0}}
set acl_m1 = /var/log/exim/domain1.ru/exim-%s-%D.log

warn condition = ${if eq{$domain}{domain2.ru}{1}{0}}
set acl_m1 = /var/log/exim/domain2.ru/exim-%s-%D.log

DarkHost
Спасибо
а вот еще вопросик
как организовать черные и белые листы с хранением их в mysql желательно для каждого пользователя

кто знает как выдернуть статистку по доменам получателей из логов exim (т.е. то куда мы больше всего отправляем)?

Подскажите, как отключить EXIM на прием внешней входящей почты, за исключением нескольких доменов (и что бы выдавал соответственно спамерам, что почтового сервера не существует)

Уже сервер спамом, тыканьем вешают китайцы, турки, индусы и т.д.

Поставил file2ban так за день несколько тысяч IP уже в бане по eximУ только.

Fedora8 + Directadmin

Вопрос такой, какием методом элоны давыдовны можно сделать следующие:
Необходимо все входящие письма созранять в базу,а уж потом проверять на спам и вирусы.
Поначалу пытался реализовать через переменную $message_body но она держала только 500 символов, потом увеличил её значение чтобы примерно получилось 10 мегов. но это не прокатило, опять письмо не полностью! Как бы вы сделали? любой метод. Но будет лучше есил экзимом.

Подскажите плиз, это нормально, что припроверке на реальность адреса получателя, он дает серверу последовательность:
HELO <primary host name>
MAIL FROM:<>
RCPT TO:<the address to be tested>

поскольку MAIL FROM пустой, то некоторые сервера ессесно посылают нафиг,
хотя в доке написано, что должен подставлять адрес отправителя.
exim-4.20

howto
Exilog попробуйте

Цитата:

Подскажите плиз, это нормально, что припроверке на реальность адреса получателя, он дает серверу последовательность:
HELO <primary host name>
MAIL FROM:<>
RCPT TO:<the address to be tested>

поскольку MAIL FROM пустой, то некоторые сервера ессесно посылают нафиг,
хотя в доке написано, что должен подставлять адрес отправителя.
exim-4.20

Ничего не понял. Постарайтесь сформулировать свой вопрос правильно.

Sam Slash
dbmail

есть такой ACL, проверяет в том числе и существование адреса получателя:

check_recipient:
accept hosts = :
deny hosts = *
encrypted = *
!encrypted = *
accept recipients = postmaster@* : *-admin@*
warn hosts = +rbl_hosts
message = X-Warning: $sender_host_address is listed at $dnslist_domain
dnslists = relays.mail-abuse.org
require verify = sender
deny message = Mailbox does not exist
!verify = recipient/defer_ok/callout=30s/callout_defer_ok
accept domains = +local_domains
accept domains = +relay_domains
accept hosts = +relay_hosts
accept hosts = +auth_relay_hosts
endpass
message = authentication required
authenticated = *
deny message = relay not permitted
deny hosts = +auth_hosts
message = authentication required
authenticated = *

так вот некоторые сервера не принимают почту, ответ сервера:
550 #5.1.0 Rejected by bounce verification
или

F=<user@domain.ru> rejected RCPT <user1@domain1.ru>: response to "MAIL FROM:<>" from relay2.domain1.ru was: 550 We do not relay

проверял телнетом данные сервера, так вот если MAIL FROM оставить пустым, то получаю вот такие отлупы.
Если убрать из ACL
deny message = Mailbox does not exist
!verify = recipient/defer_ok/callout=30s/callout_defer_ok
то все нормально, но тогда сервер при получении писем на несущ. юзеров отправляет этим спаммерам ответы, сильно набивает очередь и напрягает спамфильтр

RER1 пасиб. пробовал.
к сожалению не нанел там отчетов по серверам получателей

в mail access monitor нашел то что нужно было.

Как полученое письмо сохранить перед проверкой на вирус и спам? а потом проверить и уже отдать пользователю. чтобы в случае чего достать пользователю.

Sam Slash насколько я понимаю вам нужно перекомпилировать exim с опцией local_scan... Почитайте об этой опции в доках exim'a.

ВСЕМ!
Один из внешних спам листов забанил большую кучу IP.
Рекомендую забанить в конфиге Exim'a, если есть, в пункте
deny message = host is listed in $dnslist_domain
# relays.orbd.org : \
# opm.blitzed.org : \
# proxies.blackholes.easynet.nl

" так как вся AS Голден Телеком занесена в блеклист, то и эти IP адреса Вы увидите в блеклисте Uceprotect, как и абсолютно все адреса нашей компании.

Наша компания тщательно расследует все получаемые нами жалобы на нежелательную деятельность из своих сетей.

К сожалению, работа "черных списков", равно как и отдельные политики приема почты, принятые в той или иной компании, никоим образом нам не подконтрольны.

В результате, решение о нежелательности почты с тех или иных IP адресов, используемых нашими клиентами, может быть принято администраторами сторонних систем безо всякого дополнительного уведомления.

Следует отметить, что политика работы того или иного ресурса в сети Интернет является зоной компетенции только и исключительно администраторов данного ресурса и никак не может быть нами определена, гарантирована или являться показателем качества предоставляемых нами услуг.

К сожалению, мы лишь можем постараться оперативно связаться с администратором сервера или блеклиста для обсуждения причин блокировки и возможности ее снятия.

Политика блеклиста Useprotect - очень жесткая, по сравнению с другими: заносится не конкретный IP адрес, не сеть, а вся AS провайдера. При всем этом, они готовы мгновенно вынести нас из блеклиста, заплати мы им 250 евро.

Переписки с администратором блеклиста пока не дала желаемых результатов. Нам не ясен принцип занесения IP адресов в эти списки, а администратор не дает внятных комментариев. В качестве варианта решения проблемы Useprotect предложил принудить наших клиентов использовать в качестве сервера исходящей почты - наш, заблокировав всем клиентам соответсвующий порт - что просто неприемлемо. Кроме того, просмотр IP сетей, заявленных Useprotect, как принадлежащих AS3216, выявил наличие сети /20, принадлежащей другой AS."


Добавлено:
Возможно другие сети неупомянутые мною, но используемые Вами также проверяют по списку Useprotect...
http://www.uceprotect.net/en/rblcheck.php

неприемлемо зарезать в сети исходящий 25 порт и пустить всех через смартхост???
это называется "мы жлобимся на нормальную почтовую систему, и позволяем своим клиентам срать на весь интернет, а когда на нас ругаются - мы обижаемся и рекомендуем всем не проверять блеклисты, ибо они бяки"

З.Ы. в ГТ всё, совсем всё, через ж... ничего личного - чисто наблюдения тысяч тех, кто имеет счастье столкнуться с этим internet trouble provider. по ним давно, кроме блоклиста на всю сеть, плачет ковровое бомбометание.

exim 4.69 достаточно давно работает хорошо для одиночного домена. Сейчас потребовалось на него повесить еще несколько доменов, конфиг следующий:
----------------------------------
primary_hostname = domain1.ru
domainlist local_domains = domain1.ru:domain2.ru
domainlist relay_to_domains = domain1.ru:domain2.ru
...
begin routers

system_aliases:
driver = redirect
allow_fail
allow_defer
data = ${lookup mysql{SELECT `goto` FROM `alias` WHERE \
`address`='${$local_part}' AND domain='${domain}'}}
mysqluser:
driver = accept
condition = ${if eq{}{${lookup mysql{SELECT `maildir` FROM `mailbox` \
WHERE `username`='${local_part}' AND domain='${domain}' AND active = '1'}}}{no}{yes}}
transport = mysql_delivery
...
begin transports
mysql_delivery:
driver = appendfile
check_string = ""
create_directory
delivery_date_add
directory = ${lookup mysql{SELECT CONCAT('/var/mail/exim/', `maildir`) \
FROM `mailbox` WHERE `username`='${local_part}' AND domain='${domain}' AND active = '1'}}
directory_mode = 770
envelope_to_add
user = mailnull
group = mail
maildir_format
maildir_tag = ,S=$message_size
message_prefix = ""
message_suffix = ""
mode = 0700
quota = ${lookup mysql{SELECT quota/1024/1000 FROM mailbox \
WHERE username='${local_part}' AND domain='${domain}' AND active = '1'}{${value}M}}
quota_size_regex = S=(\d+)$
quota_warn_threshold = 75%
...
auth_plain:
driver = plaintext
public_name = PLAIN
server_condition = ${if crypteq{$3} \
{${lookup mysql{SELECT ENCRYPT(`password`) FROM `mailbox` \
WHERE `username` = '${quote_mysql:${local_part:$2}}' \
AND domain = '${quote_mysql:${domain:$1}}' \
AND active = '1'}{$value}{*}}}{yes}{no}}
server_prompts = :
server_set_id = $2

auth_login:
driver = plaintext
public_name = LOGIN
server_condition = ${if crypteq{$2} {${lookup mysql{SELECT ENCRYPT(`password`) \
FROM `mailbox` WHERE `username` = '${quote_mysql:${local_part:$1}}' \
AND domain = '${quote_mysql:${domain:$1}}' \
AND active = '1'}{$value}{*}}}{yes}{no}}
server_prompts = Username:: : Password::
server_set_id = $1

auth_cram_md5:
driver = cram_md5
public_name = CRAM-MD5
server_secret = ${lookup mysql{SELECT `password` FROM `mailbox` \
WHERE `username` = '${quote_mysql:${local_part:$1}}' \
AND domain = '${quote_mysql:${domain:$1}}' \
AND active = '1'}{$value}fail}
server_set_id = $1
---------------------------------------------------

# exim -bt rounce@domain2.ru
rounce@domain1.ru
<-- rounce@domain1.ru
<-- rounce@domain2.ru
router = mysqluser, transport = mysql_delivery

И если отправлять письмо, то оно приходит по адресу rounce@domain1.ru.
Если отправлять на пользователя, которого не существует в domain1, то
#exim -bt test@domain2.ru
test@domain1.ru is undeliverable: Unknown user
<-- test@domain2.ru

Насколько я понял, exim подменяет domain2 на primary_hostname. Как можно убрать этот эффект?

Друзья!

Есть проблема такого вида: есть компьютер (NS), на который приходит почта. Обыкновенная почта по smtp перекладывается на другой сервер, откуда её уже берут пользователи.

Почта UUCP обрабатывается на NS, откуда по модемам её качают пользователи.

Сейчас почта обрабатывается sendmail'ом, и это беда: он не справляется с потоками спама, перестаёт отвечать на запросы по 25-му порту. (Сразу скажу, что DNSBL, ограничение по количеству соединений, grey-list практически не помогают: спам отсеивают, но количество соединений всё равно превышает допустимое.)

Очень хочется поставить туда exim, но не знаю, как прикрутить UUCP.

Нет ли у кого-нибудь идей на эту тему?..

ну могу только посочувствовать - экзим вряд-ли поможет в данном случае.

Надо начинать блокировать в фаерволе спам-сети. А проверка на спам и отказ в принятии сообщений только усугубляет ситуацию - на это все тратится время.

Попробуйте в сендмейле увеличить количество одновременных соединений, если машина вытягивает.

А можно ли заставить exim класть почту на другую локальную машину, если для этой машины MX другой? Поясню: MX собирает почту для сервера ALPHA, потом на него передаёт. SMTP --- отдельная машина, с которой отправляется почта. Но если почта отправляется на пользователю ALPHA с машины из локальной сети через SMTP, то письмо всё равно попадает на MX, Можно ли заставить SMTP класть письма для пользователей ALPHA непосредственно, минуя MX?

smartroute это называется

Добавлено:
ссори - перепутал

обычно называют транспорт mailertable а driver - manualroute. По ним поищи чуть - найдешь

Уважаемые эксперты!
Подскажите можно ли настроить dovecot без использования mysql?

И ещё один вопрос:
поставил dovecot из rmp, система FC7

попытался настроить dovecot.conf
получился вот такой файл:
#########
base_dir = /var/run/dovecot/
protocols = imap pop3
listen = *
disable_plaintext_auth = no
shutdown_clients = yes
log_path = /var/log/dovecot.log
info_log_path = /var/log/dovecot.log
log_timestamp = "%b %d %H:%M:%S "
syslog_facility = mail
ssl_disable = yes
login_dir = /var/run/dovecot/login
login_chroot = yes
login_user = dovecot
login_process_size = 64
login_process_per_connection = no
login_max_processes_count = 128
login_greeting = Dovecot ready!!!
login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c
login_log_format = %$: %s
mail_location = maildir:/var/spool/mail/%d/%u
mail_debug = yes
first_valid_uid = 1000
last_valid_uid = 5000
first_valid_gid = 1000
last_valid_gid = 5000

protocol imap {
login_executable = /usr/libexec/dovecot/imap-login
mail_executable = /usr/libexec/dovecot/imap
mail_plugin_dir = /usr/lib/dovecot/imap
imap_client_workarounds = outlook-idle
}

protocol pop3 {
login_executable = /usr/libexec/dovecot/pop3-login
mail_executable = /usr/libexec/dovecot/pop3
pop3_uidl_format = %08Xu%08Xv
mail_plugin_dir = /usr/lib/dovecot/pop3
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
}

protocol lda {
postmaster_address = test@test.org
hostname = test.org
mail_plugin_dir = /usr/lib/dovecot/lda
sendmail_path = /usr/lib/sendmail
auth_socket_path = /var/run/dovecot/auth-master
}

auth_executable = /usr/libexec/dovecot/dovecot-auth
auth_verbose = yes
auth_debug = yes
auth_debug_passwords = yes
auth default {
mechanisms = plain login
passdb passwd-file {
args = /usr/local/etc/dovecot.passdb
}
userdb passwd-file {
args = /usr/local/etc/dovecot.passdb
}
user = root
socket listen {
master {
path = /var/run/dovecot/auth-master
mode = 0600
user = mailnull
}
}
#########
Файл dovecot.passdb:
test:2fUUJ4GnRsKiM
#########
Потом пытаюсь подключиться и вот что получается:

# telnet test.org 110
Trying 127.0.0.1...
Connected to test.org.
Escape character is '^]'.
+OK Dovecot ready and even works!!!
user test
+OK
pass test
-ERR [IN-USE] Internal login failure. Refer to server log for more information.
Connection closed by foreign host.

#########
Вот что пишет в log

dovecot: Jun 14 13:20:04 Info: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=12.192.6.19 rip=192.168.0.1 resp=AGJvYgByb290MDk=
dovecot: Jun 14 13:20:04 Info: auth(default): passwd-file(test,192.168.0.1): lookup: user=test file=/usr/local/etc/dovecot.passdb
dovecot: Jun 14 13:20:04 Info: auth(default): client out: OK 1 user=test
dovecot: Jun 14 13:20:04 Info: auth(default): master in: REQUEST 4 14505 1
dovecot: Jun 14 13:20:04 Error: Logins with UID 0 not permitted (user test)
dovecot: Jun 14 13:20:04 Info: auth(default): passwd-file(test,192.168.0.1): lookup: user=test file=/usr/local/etc/dovecot.passdb
dovecot: Jun 14 13:20:04 Info: auth(default): master out: USER 4 test uid=0 gid=0
dovecot: Jun 14 13:20:04 Info: pop3-login: Internal login failure: user=<bob>, method=PLAIN, rip=192.168.0.1, lip=12.192.6.19
##########

Помогите пожалуйста!!!!!!
И если можно объясните почему так?????

genultrovich

Цитата:

Уважаемые эксперты!
Подскажите можно ли настроить dovecot без использования mysql?

http://wiki.dovecot.org/AuthDatabase/PasswdFile


у меня в текстовом файле хранятся записи. Если не осилишь - пиши в ПМ, сброшу конфиги

За подсказку огромное спасибо!!!
Авторизация более-менее работает, но появился другой затык!
При отправки письма The Bat думает примерно секунд 40 и выдаёт такое сообщение:

#########
Отправка почты - писем в очереди: 1
Соединение с SMTP сервером прошло удачно
Аутентификация (программный CRAM-MD5)...
Сервер сообщает об ошибке: 5.7.0 authentication failed
ВНИМАНИЕ: не удалось обнаружить на сервере подходящих алгоритмов аутентификации
Отправка письма для test@test.org
#########

после чего он думает ещё 2 минуты и 20 секунд и отправляет письмо!!!
И ко всему прочему обработка (т.е. письмо отправляется, а получаю его много позже!) больших файлов (10 мегабайт) занимает где-то минут 10!!! Мне кажется это не совсем нормально!!!
Не подскажите с чем это связано?

Причем когда подключаюсь через телнет, после ввода строки mail from: test@test.org интервал задержки примерно тот же 3 минуты!!!
т.е. где-то, я так понимаю мой SMTP, тормозит, а вот где не пойму??!!

Цитата:

Авторизация более-менее работает, но появился другой затык!
При отправки письма The Bat думает примерно секунд 40 и выдаёт такое сообщение:

ты аутентификацию прикручивал что-ли ?


Цитата:

Причем когда подключаюсь через телнет, после ввода строки mail from: test@test.org интервал задержки примерно тот же 3 минуты!!!

может это :

rfc1413_hosts = !*

Ну и с днс-ом что ?


Вообще конечно лучше конфиг приатач под тег [no][more][/no]

Нет, не прикручивал, я почту настраиваю первый раз.

конфиг чего?

и где посмотреть rfc1413_hosts = !*