debian/debconf/conf.d/acl/30_exim4-config_check_rcpt

   1
   2 ### acl/30_exim4-config_check_rcpt
   3 #################################
   4
   5 # This access control list is used for every RCPT command in an incoming
   6 # SMTP message. The tests are run in order until the address is either
   7 # accepted or denied.
   8 #
   9 acl_check_rcpt:
  10
  11   # Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
  12   # testing for an empty sending host field.
  13   accept
  14     hosts = :
  15     control = dkim_disable_verify
  16
  17   # Do not try to verify DKIM signatures of incoming mail if DC_minimaldns
  18   # or DISABLE_DKIM_VERIFY are set.
  19 .ifdef DC_minimaldns
  20   warn
  21     control = dkim_disable_verify
  22 .else
  23 .ifdef DISABLE_DKIM_VERIFY
  24   warn
  25     control = dkim_disable_verify
  26 .endif
  27 .endif
  28
  29   # The following section of the ACL is concerned with local parts that contain
  30   # certain non-alphanumeric characters. Dots in unusual places are
  31   # handled by this ACL as well.
  32   #
  33   # Non-alphanumeric characters other than dots are rarely found in genuine
  34   # local parts, but are often tried by people looking to circumvent
  35   # relaying restrictions. Therefore, although they are valid in local
  36   # parts, these rules disallow certain non-alphanumeric characters, as
  37   # a precaution.
  38   #
  39   # Empty components (two dots in a row) are not valid in RFC 2822, but Exim
  40   # allows them because they have been encountered. (Consider local parts
  41   # constructed as "firstinitial.secondinitial.familyname" when applied to
  42   # a name without a second initial.) However, a local part starting
  43   # with a dot or containing /../ can cause trouble if it is used as part of a
  44   # file name (e.g. for a mailing list). This is also true for local parts that
  45   # contain slashes. A pipe symbol can also be troublesome if the local part is
  46   # incorporated unthinkingly into a shell command line.
  47   #
  48   # These ACL components will block recipient addresses that are valid
  49   # from an RFC2822 point of view. We chose to have them blocked by
  50   # default for security reasons.
  51   #
  52   # If you feel that your site should have less strict recipient
  53   # checking, please feel free to change the default values of the macros
  54   # defined in main/01_exim4-config_listmacrosdefs or override them from a
  55   # local configuration file.
  56   #
  57   # Two different rules are used. The first one has a quite strict
  58   # default, and is applied to messages that are addressed to one of the
  59   # local domains handled by this host.
  60
  61   # The default value of CHECK_RCPT_LOCAL_LOCALPARTS is defined in
  62   # main/01_exim4-config_listmacrosdefs:
  63   # CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] : ^.*[@%!/|`#&?]
  64   # This blocks local parts that begin with a dot or contain a quite
  65   # broad range of non-alphanumeric characters.
  66   .ifdef CHECK_RCPT_LOCAL_LOCALPARTS
  67   deny
  68     domains = +local_domains
  69     local_parts = CHECK_RCPT_LOCAL_LOCALPARTS
  70     message = restricted characters in address
  71   .endif
  72
  73
  74   # The second rule applies to all other domains, and its default is
  75   # considerably less strict.
  76
  77   # The default value of CHECK_RCPT_REMOTE_LOCALPARTS is defined in
  78   # main/01_exim4-config_listmacrosdefs:
  79   # CHECK_RCPT_REMOTE_LOCALPARTS = ^[./|] : ^.*[@%!`#&?] : ^.*/\\.\\./
  80
  81   # It allows local users to send outgoing messages to sites
  82   # that use slashes and vertical bars in their local parts. It blocks
  83   # local parts that begin with a dot, slash, or vertical bar, but allows
  84   # these characters within the local part. However, the sequence /../ is
  85   # barred. The use of some other non-alphanumeric characters is blocked.
  86   # Single quotes might probably be dangerous as well, but they're
  87   # allowed by the default regexps to avoid rejecting mails to Ireland.
  88   # The motivation here is to prevent local users (or local users' malware)
  89   # from mounting certain kinds of attack on remote sites.
  90   .ifdef CHECK_RCPT_REMOTE_LOCALPARTS
  91   deny
  92     domains = !+local_domains
  93     local_parts = CHECK_RCPT_REMOTE_LOCALPARTS
  94     message = restricted characters in address
  95   .endif
  96
  97
  98   # Accept mail to postmaster in any local domain, regardless of the source,
  99   # and without verifying the sender.
 100   #
 101   accept
 102     .ifndef CHECK_RCPT_POSTMASTER
 103     local_parts = postmaster
 104     .else
 105     local_parts = CHECK_RCPT_POSTMASTER
 106     .endif
 107     domains = +local_domains : +relay_to_domains
 108
 109
 110   # Deny unless the sender address can be verified.
 111   #
 112   # This is disabled by default so that DNSless systems don't break. If
 113   # your system can do DNS lookups without delay or cost, you might want
 114   # to enable this feature.
 115   #
 116   # This feature does not work in smarthost and satellite setups as
 117   # with these setups all domains pass verification. See spec.txt section
 118   # "Access control lists" subsection "Address verification" with the added
 119   # information that a smarthost/satellite setup routes all non-local e-mail
 120   # to the smarthost.
 121   .ifdef CHECK_RCPT_VERIFY_SENDER
 122   deny
 123     message = Sender verification failed
 124     !acl = acl_local_deny_exceptions
 125     !verify = sender
 126   .endif
 127
 128   # Verify senders listed in local_sender_callout with a callout.
 129   #
 130   # In smarthost and satellite setups, this causes the callout to be
 131   # done to the smarthost. Verification will thus only be reliable if the
 132   # smarthost does reject illegal addresses in the SMTP dialog.
 133   deny
 134     !acl = acl_local_deny_exceptions
 135     senders = ${if exists{CONFDIR/local_sender_callout}\
 136                          {CONFDIR/local_sender_callout}\
 137                    {}}
 138     !verify = sender/callout
 139
 140
 141   # Accept if the message comes from one of the hosts for which we are an
 142   # outgoing relay. It is assumed that such hosts are most likely to be MUAs,
 143   # so we set control=submission to make Exim treat the message as a
 144   # submission. It will fix up various errors in the message, for example, the
 145   # lack of a Date: header line. If you are actually relaying out out from
 146   # MTAs, you may want to disable this. If you are handling both relaying from
 147   # MTAs and submissions from MUAs you should probably split them into two
 148   # lists, and handle them differently.
 149
 150   # Recipient verification is omitted here, because in many cases the clients
 151   # are dumb MUAs that don't cope well with SMTP error responses. If you are
 152   # actually relaying out from MTAs, you should probably add recipient
 153   # verification here.
 154
 155   # Note that, by putting this test before any DNS black list checks, you will
 156   # always accept from these hosts, even if they end up on a black list. The
 157   # assumption is that they are your friends, and if they get onto black
 158   # list, it is a mistake.
 159   accept
 160     hosts = +relay_from_hosts
 161     control = submission/sender_retain
 162     control = dkim_disable_verify
 163
 164
 165   # Accept if the message arrived over an authenticated connection, from
 166   # any host. Again, these messages are usually from MUAs, so recipient
 167   # verification is omitted, and submission mode is set. And again, we do this
 168   # check before any black list tests.
 169   accept
 170     authenticated = *
 171     control = submission/sender_retain
 172     control = dkim_disable_verify
 173
 174   # Insist that a HELO/EHLO was accepted.
 175
 176   require message       = nice hosts say HELO first
 177           condition     = ${if def:sender_helo_name}
 178
 179   # Insist that any other recipient address that we accept is either in one of
 180   # our local domains, or is in a domain for which we explicitly allow
 181   # relaying. Any other domain is rejected as being unacceptable for relaying.
 182   require
 183     message = relay not permitted
 184     domains = +local_domains : +relay_to_domains
 185
 186
 187   # We also require all accepted addresses to be verifiable. This check will
 188   # do local part verification for local domains, but only check the domain
 189   # for remote domains.
 190   require
 191     verify = recipient
 192
 193
 194   # Verify recipients listed in local_rcpt_callout with a callout.
 195   # This is especially handy for forwarding MX hosts (secondary MX or
 196   # mail hubs) of domains that receive a lot of spam to non-existent
 197   # addresses.  The only way to check local parts for remote relay
 198   # domains is to use a callout (add /callout), but please read the
 199   # documentation about callouts before doing this.
 200   deny
 201     !acl = acl_local_deny_exceptions
 202     recipients = ${if exists{CONFDIR/local_rcpt_callout}\
 203                             {CONFDIR/local_rcpt_callout}\
 204                       {}}
 205     !verify = recipient/callout
 206
 207
 208   # CONFDIR/local_sender_blacklist holds a list of envelope senders that
 209   # should have their access denied to the local host. Incoming messages
 210   # with one of these senders are rejected at RCPT time.
 211   #
 212   # The explicit white lists are honored as well as negative items in
 213   # the black list. See exim4-config_files(5) for details.
 214   deny
 215     message = sender envelope address $sender_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
 216     !acl = acl_local_deny_exceptions
 217     senders = ${if exists{CONFDIR/local_sender_blacklist}\
 218                    {CONFDIR/local_sender_blacklist}\
 219                    {}}
 220
 221
 222   # deny bad sites (IP address)
 223   # CONFDIR/local_host_blacklist holds a list of host names, IP addresses
 224   # and networks (CIDR notation)  that should have their access denied to
 225   # The local host. Messages coming in from a listed host will have all
 226   # RCPT statements rejected.
 227   #
 228   # The explicit white lists are honored as well as negative items in
 229   # the black list. See exim4-config_files(5) for details.
 230   deny
 231     message = sender IP address $sender_host_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
 232     !acl = acl_local_deny_exceptions
 233     hosts = ${if exists{CONFDIR/local_host_blacklist}\
 234                  {CONFDIR/local_host_blacklist}\
 235                  {}}
 236
 237
 238   # Warn if the sender host does not have valid reverse DNS.
 239   #
 240   # If your system can do DNS lookups without delay or cost, you might want
 241   # to enable this.
 242   # If sender_host_address is defined, it's a remote call.  If
 243   # sender_host_name is not defined, then reverse lookup failed.  Use
 244   # this instead of !verify = reverse_host_lookup to catch deferrals
 245   # as well as outright failures.
 246   .ifdef CHECK_RCPT_REVERSE_DNS
 247   warn
 248     condition = ${if and{{def:sender_host_address}{!def:sender_host_name}}\
 249                       {yes}{no}}
 250     add_header = X-Host-Lookup-Failed: Reverse DNS lookup failed for $sender_host_address (${if eq{$host_lookup_failed}{1}{failed}{deferred}})
 251   .endif
 252
 253
 254   # Use spfquery to perform a pair of SPF checks (for details, see
 255   # http://www.openspf.org/)
 256   #
 257   # This is quite costly in terms of DNS lookups (~6 lookups per mail).  Do not
 258   # enable if that's an issue.  Also note that if you enable this, you must
 259   # install "spf-tools-perl" which provides the spfquery command.
 260   # Missing spf-tools-perl will trigger the "Unexpected error in
 261   # SPF check" warning.
 262   .ifdef CHECK_RCPT_SPF
 263   deny
 264     message = [SPF] $sender_host_address is not allowed to send mail from \
 265               ${if def:sender_address_domain {$sender_address_domain}{$sender_helo_name}}.  \
 266               Please see \
 267               http://www.openspf.org/Why?scope=${if def:sender_address_domain \
 268               {mfrom}{helo}};identity=${if def:sender_address_domain \
 269               {$sender_address}{$sender_helo_name}};ip=$sender_host_address
 270     log_message = SPF check failed.
 271     !acl = acl_local_deny_exceptions
 272     condition = ${run{/usr/bin/spfquery.mail-spf-perl --ip \
 273                    ${quote:$sender_host_address} --identity \
 274                    ${if def:sender_address_domain \
 275                        {--scope mfrom  --identity ${quote:$sender_address}}\
 276                        {--scope helo --identity ${quote:$sender_helo_name}}}}\
 277                    {no}{${if eq {$runrc}{1}{yes}{no}}}}
 278
 279   defer
 280     message = Temporary DNS error while checking SPF record.  Try again later.
 281     !acl = acl_local_deny_exceptions
 282     condition = ${if eq {$runrc}{5}{yes}{no}}
 283
 284   warn
 285     condition = ${if <={$runrc}{6}{yes}{no}}
 286     add_header = Received-SPF: ${if eq {$runrc}{0}{pass}\
 287                                 {${if eq {$runrc}{2}{softfail}\
 288                                  {${if eq {$runrc}{3}{neutral}\
 289                                   {${if eq {$runrc}{4}{permerror}\
 290                                    {${if eq {$runrc}{6}{none}{error}}}}}}}}}\
 291                                 } client-ip=$sender_host_address; \
 292                                 ${if def:sender_address_domain \
 293                                    {envelope-from=${sender_address}; }{}}\
 294                                 helo=$sender_helo_name
 295
 296   warn
 297     log_message = Unexpected error in SPF check.
 298     condition = ${if >{$runrc}{6}{yes}{no}}
 299   .endif
 300
 301
 302   # Check against classic DNS "black" lists (DNSBLs) which list
 303   # sender IP addresses
 304   .ifdef CHECK_RCPT_IP_DNSBLS
 305   warn
 306     dnslists = CHECK_RCPT_IP_DNSBLS
 307     add_header = X-Warning: $sender_host_address is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
 308     log_message = $sender_host_address is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
 309   .endif
 310
 311
 312   # Check against DNSBLs which list sender domains, with an option to locally
 313   # whitelist certain domains that might be blacklisted.
 314   #
 315   # Note: If you define CHECK_RCPT_DOMAIN_DNSBLS, you must append
 316   # "/$sender_address_domain" after each domain.  For example:
 317   # CHECK_RCPT_DOMAIN_DNSBLS = rhsbl.foo.org/$sender_address_domain \
 318   #                            : rhsbl.bar.org/$sender_address_domain
 319   .ifdef CHECK_RCPT_DOMAIN_DNSBLS
 320   warn
 321     !senders = ${if exists{CONFDIR/local_domain_dnsbl_whitelist}\
 322                     {CONFDIR/local_domain_dnsbl_whitelist}\
 323                     {}}
 324     dnslists = CHECK_RCPT_DOMAIN_DNSBLS
 325     add_header = X-Warning: $sender_address_domain is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
 326     log_message = $sender_address_domain is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
 327   .endif
 328
 329
 330   # This hook allows you to hook in your own ACLs without having to
 331   # modify this file. If you do it like we suggest, you'll end up with
 332   # a small performance penalty since there is an additional file being
 333   # accessed. This doesn't happen if you leave the macro unset.
 334   .ifdef CHECK_RCPT_LOCAL_ACL_FILE
 335   .include CHECK_RCPT_LOCAL_ACL_FILE
 336   .endif
 337
 338
 339   #############################################################################
 340   # This check is commented out because it is recognized that not every
 341   # sysadmin will want to do it. If you enable it, the check performs
 342   # Client SMTP Authorization (csa) checks on the sending host. These checks
 343   # do DNS lookups for SRV records. The CSA proposal is currently (May 2005)
 344   # an Internet draft. You can, of course, add additional conditions to this
 345   # ACL statement to restrict the CSA checks to certain hosts only.
 346   #
 347   # require verify = csa
 348   #############################################################################
 349
 350
 351   # Accept if the address is in a domain for which we are an incoming relay,
 352   # but again, only if the recipient can be verified.
 353
 354   accept
 355     domains = +relay_to_domains
 356     endpass
 357     verify = recipient
 358
 359
 360   # At this point, the address has passed all the checks that have been
 361   # configured, so we accept it unconditionally.
 362
 363   accept