Merge branch 'debian'

[hcoop/debian/exim4.git] / debian / debconf / conf.d / acl / 30_exim4-config_check_rcpt

diff --git a/debian/debconf/conf.d/acl/30_exim4-config_check_rcpt b/debian/debconf/conf.d/acl/30_exim4-config_check_rcpt
index 4949587..b8bde1e 100644 (file)
--- a/debian/debconf/conf.d/acl/30_exim4-config_check_rcpt
+++ b/debian/debconf/conf.d/acl/30_exim4-config_check_rcpt
@@ -2,6 +2,19 @@
 ### acl/30_exim4-config_check_rcpt
 #################################
 
+# define macros to be used below in this file to check recipient
+# local parts for strange characters. Documentation below.
+# This blocks local parts that begin with a dot or contain a quite
+# broad range of non-alphanumeric characters.
+
+.ifndef CHECK_RCPT_LOCAL_LOCALPARTS
+CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] : ^.*[@%!/|`#&?]
+.endif
+
+.ifndef CHECK_RCPT_REMOTE_LOCALPARTS
+CHECK_RCPT_REMOTE_LOCALPARTS = ^[./|] : ^.*[@%!`#&?] : ^.*/\\.\\./
+.endif
+
 # This access control list is used for every RCPT command in an incoming
 # SMTP message. The tests are run in order until the address is either
 # accepted or denied.
@@ -46,7 +59,7 @@ acl_check_rcpt:
   # incorporated unthinkingly into a shell command line.
   #
   # These ACL components will block recipient addresses that are valid
-  # from an RFC2822 point of view. We chose to have them blocked by
+  # from an RFC5322 point of view. We chose to have them blocked by
   # default for security reasons.
   #
   # If you feel that your site should have less strict recipient
@@ -58,11 +71,8 @@ acl_check_rcpt:
   # default, and is applied to messages that are addressed to one of the
   # local domains handled by this host.
 
-  # The default value of CHECK_RCPT_LOCAL_LOCALPARTS is defined in
-  # main/01_exim4-config_listmacrosdefs:
-  # CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] : ^.*[@%!/|`#&?]
-  # This blocks local parts that begin with a dot or contain a quite
-  # broad range of non-alphanumeric characters.
+  # The default value of CHECK_RCPT_LOCAL_LOCALPARTS is defined
+  # at the top of this file.
   .ifdef CHECK_RCPT_LOCAL_LOCALPARTS
   deny
     domains = +local_domains
@@ -114,9 +124,10 @@ acl_check_rcpt:
   # to enable this feature.
   #
   # This feature does not work in smarthost and satellite setups as
-  # with these setups all domains pass verification. See spec.txt chapter
-  # 39.31 with the added information that a smarthost/satellite setup
-  # routes all non-local e-mail to the smarthost.
+  # with these setups all domains pass verification. See spec.txt section
+  # "Access control lists" subsection "Address verification" with the added
+  # information that a smarthost/satellite setup routes all non-local e-mail
+  # to the smarthost.
   .ifdef CHECK_RCPT_VERIFY_SENDER
   deny
     message = Sender verification failed
@@ -170,6 +181,10 @@ acl_check_rcpt:
     control = submission/sender_retain
     control = dkim_disable_verify
 
+  # Insist that a HELO/EHLO was accepted.
+
+  require message      = nice hosts say HELO first
+          condition    = ${if def:sender_helo_name}
 
   # Insist that any other recipient address that we accept is either in one of
   # our local domains, or is in a domain for which we explicitly allow
@@ -208,6 +223,7 @@ acl_check_rcpt:
   # the black list. See exim4-config_files(5) for details.
   deny
     message = sender envelope address $sender_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
+    log_message = sender envelope address is locally blacklisted.
     !acl = acl_local_deny_exceptions
     senders = ${if exists{CONFDIR/local_sender_blacklist}\
                    {CONFDIR/local_sender_blacklist}\
@@ -224,6 +240,7 @@ acl_check_rcpt:
   # the black list. See exim4-config_files(5) for details.
   deny
     message = sender IP address $sender_host_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
+    log_message = sender IP address is locally blacklisted.
     !acl = acl_local_deny_exceptions
     hosts = ${if exists{CONFDIR/local_host_blacklist}\
                  {CONFDIR/local_host_blacklist}\