conf.d/acl/30_exim4-config_check_rcpt

   1
   2 ### acl/30_exim4-config_check_rcpt
   3 #################################
   4
   5 # This access control list is used for every RCPT command in an incoming
   6 # SMTP message. The tests are run in order until the address is either
   7 # accepted or denied.
   8 #
   9 acl_check_rcpt:
  10
  11   # Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
  12   # testing for an empty sending host field.
  13   accept
  14     hosts = :
  15
  16
  17   # The following section of the ACL is concerned with local parts that contain
  18   # certain non-alphanumeric characters. Dots in unusual places are
  19   # handled by this ACL as well.
  20   #
  21   # Non-alphanumeric characters other than dots are rarely found in genuine
  22   # local parts, but are often tried by people looking to circumvent
  23   # relaying restrictions. Therefore, although they are valid in local
  24   # parts, these rules disallow certain non-alphanumeric characters, as
  25   # a precaution.
  26   #
  27   # Empty components (two dots in a row) are not valid in RFC 2822, but Exim
  28   # allows them because they have been encountered. (Consider local parts
  29   # constructed as "firstinitial.secondinitial.familyname" when applied to
  30   # a name without a second initial.) However, a local part starting
  31   # with a dot or containing /../ can cause trouble if it is used as part of a
  32   # file name (e.g. for a mailing list). This is also true for local parts that
  33   # contain slashes. A pipe symbol can also be troublesome if the local part is
  34   # incorporated unthinkingly into a shell command line.
  35   #
  36   # These ACL components will block recipient addresses that are valid
  37   # from an RFC2822 point of view. We chose to have them blocked by
  38   # default for security reasons.
  39   #
  40   # If you feel that your site should have less strict recipient
  41   # checking, please feel free to change the default values of the macros
  42   # defined in main/01_exim4-config_listmacrosdefs or override them from a
  43   # local configuration file.
  44   #
  45   # Two different rules are used. The first one has a quite strict
  46   # default, and is applied to messages that are addressed to one of the
  47   # local domains handled by this host.
  48
  49   # The default value of CHECK_RCPT_LOCAL_LOCALPARTS is defined in
  50   # main/01_exim4-config_listmacrosdefs:
  51   # CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] : ^.*[@%!/|`#&?]
  52   # This blocks local parts that begin with a dot or contain a quite
  53   # broad range of non-alphanumeric characters.
  54   .ifdef CHECK_RCPT_LOCAL_LOCALPARTS
  55   deny
  56     domains = +local_domains
  57     local_parts = CHECK_RCPT_LOCAL_LOCALPARTS
  58     message = restricted characters in address
  59   .endif
  60
  61
  62   # The second rule applies to all other domains, and its default is
  63   # considerably less strict.
  64
  65   # The default value of CHECK_RCPT_REMOTE_LOCALPARTS is defined in
  66   # main/01_exim4-config_listmacrosdefs:
  67   # CHECK_RCPT_REMOTE_LOCALPARTS = ^[./|] : ^.*[@%!`#&?] : ^.*/\\.\\./
  68
  69   # It allows local users to send outgoing messages to sites
  70   # that use slashes and vertical bars in their local parts. It blocks
  71   # local parts that begin with a dot, slash, or vertical bar, but allows
  72   # these characters within the local part. However, the sequence /../ is
  73   # barred. The use of some other non-alphanumeric characters is blocked.
  74   # Single quotes might probably be dangerous as well, but they're
  75   # allowed by the default regexps to avoid rejecting mails to Ireland.
  76   # The motivation here is to prevent local users (or local users' malware)
  77   # from mounting certain kinds of attack on remote sites.
  78   .ifdef CHECK_RCPT_REMOTE_LOCALPARTS
  79   deny
  80     domains = !+local_domains
  81     local_parts = CHECK_RCPT_REMOTE_LOCALPARTS
  82     message = restricted characters in address
  83   .endif
  84
  85
  86   # Accept mail to postmaster in any local domain, regardless of the source,
  87   # and without verifying the sender.
  88   #
  89   accept
  90     .ifndef CHECK_RCPT_POSTMASTER
  91     local_parts = postmaster
  92     .else
  93     local_parts = CHECK_RCPT_POSTMASTER
  94     .endif
  95     domains = +local_domains : +relay_to_domains
  96
  97
  98   # Deny unless the sender address can be verified.
  99   #
 100   # This is disabled by default so that DNSless systems don't break. If
 101   # your system can do DNS lookups without delay or cost, you might want
 102   # to enable this feature.
 103   #
 104   # This feature does not work in smarthost and satellite setups as
 105   # with these setups all domains pass verification. See spec.txt chapter
 106   # 39.31 with the added information that a smarthost/satellite setup
 107   # routes all non-local e-mail to the smarthost.
 108   .ifdef CHECK_RCPT_VERIFY_SENDER
 109   deny
 110     message = Sender verification failed
 111     !acl = acl_whitelist_local_deny
 112     !verify = sender
 113   .endif
 114
 115   # hcoop-change: Add recommended lines from
 116   # /usr/share/doc/mailman/README.EXIM.gz so that bounce messages
 117   # get through, even if they are from a malformed address
 118
 119   # Accept bounces to lists even if callbacks or other checks would fail
 120   warn
 121     message = X-WhitelistedRCPT-nohdrfromcallback: Yes
 122     condition = ${if and {{match{$local_part}{(.*)-bounces\+.*}} \
 123                           {exists {MAILMAN_LISTCHK}}} \
 124                      {yes}{no}}
 125
 126   accept
 127     condition = ${if and {{match{$local_part}{(.*)-bounces\+.*}} \
 128                           {exists {MAILMAN_LISTCHK}}} \
 129                      {yes}{no}}
 130
 131   # Verify senders listed in local_sender_callout with a callout.
 132   #
 133   # In smarthost and satellite setups, this causes the callout to be
 134   # done to the smarthost. Verification will thus only be reliable if the
 135   # smarthost does reject illegal addresses in the SMTP dialog.
 136   deny
 137     !acl = acl_whitelist_local_deny
 138     senders = ${if exists{CONFDIR/local_sender_callout}\
 139                          {CONFDIR/local_sender_callout}\
 140                    {}}
 141     !verify = sender/callout
 142
 143
 144   # Accept if the message comes from one of the hosts for which we are an
 145   # outgoing relay. It is assumed that such hosts are most likely to be MUAs,
 146   # so we set control=submission to make Exim treat the message as a
 147   # submission. It will fix up various errors in the message, for example, the
 148   # lack of a Date: header line. If you are actually relaying out out from
 149   # MTAs, you may want to disable this. If you are handling both relaying from
 150   # MTAs and submissions from MUAs you should probably split them into two
 151   # lists, and handle them differently.
 152
 153   # Recipient verification is omitted here, because in many cases the clients
 154   # are dumb MUAs that don't cope well with SMTP error responses. If you are
 155   # actually relaying out from MTAs, you should probably add recipient
 156   # verification here.
 157
 158   # Note that, by putting this test before any DNS black list checks, you will
 159   # always accept from these hosts, even if they end up on a black list. The
 160   # assumption is that they are your friends, and if they get onto black
 161   # list, it is a mistake.
 162   accept
 163     hosts = +relay_from_hosts
 164     control = submission/sender_retain
 165
 166
 167   # Accept if the message arrived over an authenticated connection, from
 168   # any host. Again, these messages are usually from MUAs, so recipient
 169   # verification is omitted, and submission mode is set. And again, we do this
 170   # check before any black list tests.
 171   accept
 172     authenticated = *
 173     control = submission/sender_retain
 174
 175
 176   # Insist that any other recipient address that we accept is either in one of
 177   # our local domains, or is in a domain for which we explicitly allow
 178   # relaying. Any other domain is rejected as being unacceptable for relaying.
 179   require
 180     message = relay not permitted
 181     domains = +local_domains : +relay_to_domains
 182
 183
 184   # We also require all accepted addresses to be verifiable. This check will
 185   # do local part verification for local domains, but only check the domain
 186   # for remote domains.
 187   require
 188     verify = recipient
 189
 190
 191   # Verify recipients listed in local_rcpt_callout with a callout.
 192   # This is especially handy for forwarding MX hosts (secondary MX or
 193   # mail hubs) of domains that receive a lot of spam to non-existent
 194   # addresses.  The only way to check local parts for remote relay
 195   # domains is to use a callout (add /callout), but please read the
 196   # documentation about callouts before doing this.
 197   deny
 198     !acl = acl_whitelist_local_deny
 199     recipients = ${if exists{CONFDIR/local_rcpt_callout}\
 200                             {CONFDIR/local_rcpt_callout}\
 201                       {}}
 202     !verify = recipient/callout
 203
 204
 205   # CONFDIR/local_sender_blacklist holds a list of envelope senders that
 206   # should have their access denied to the local host. Incoming messages
 207   # with one of these senders are rejected at RCPT time.
 208   #
 209   # The explicit white lists are honored as well as negative items in
 210   # the black list. See exim4-config_files(5) for details.
 211   deny
 212     message = sender envelope address $sender_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
 213     !acl = acl_whitelist_local_deny
 214     senders = ${if exists{CONFDIR/local_sender_blacklist}\
 215                    {CONFDIR/local_sender_blacklist}\
 216                    {}}
 217
 218
 219   # deny bad sites (IP address)
 220   # CONFDIR/local_host_blacklist holds a list of host names, IP addresses
 221   # and networks (CIDR notation)  that should have their access denied to
 222   # The local host. Messages coming in from a listed host will have all
 223   # RCPT statements rejected.
 224   #
 225   # The explicit white lists are honored as well as negative items in
 226   # the black list. See /usr/share/doc/exim4-config/default_acl for details.
 227   deny
 228     message = sender IP address $sender_host_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
 229     !acl = acl_whitelist_local_deny
 230     hosts = ${if exists{CONFDIR/local_host_blacklist}\
 231                  {CONFDIR/local_host_blacklist}\
 232                  {}}
 233
 234
 235   # Warn if the sender host does not have valid reverse DNS.
 236   #
 237   # If your system can do DNS lookups without delay or cost, you might want
 238   # to enable this.
 239   # If sender_host_address is defined, it's a remote call.  If
 240   # sender_host_name is not defined, then reverse lookup failed.  Use
 241   # this instead of !verify = reverse_host_lookup to catch deferrals
 242   # as well as outright failures.
 243   .ifdef CHECK_RCPT_REVERSE_DNS
 244   warn
 245     message = X-Host-Lookup-Failed: Reverse DNS lookup failed for $sender_host_address (${if eq{$host_lookup_failed}{1}{failed}{deferred}})
 246      condition = ${if and{{def:sender_host_address}{!def:sender_host_name}}\
 247                       {yes}{no}}
 248   .endif
 249
 250
 251   # Use spfquery to perform a pair of SPF checks (for details, see
 252   # http://www.openspf.org/)
 253   #
 254   # This is quite costly in terms of DNS lookups (~6 lookups per mail).  Do not
 255   # enable if that's an issue.  Also note that if you enable this, you must
 256   # install "libmail-spf-query-perl" which provides the spfquery command.
 257   # Missing libmail-spf-query-perl will trigger the "Unexpected error in
 258   # SPF check" warning.
 259   .ifdef CHECK_RCPT_SPF
 260   deny
 261     message = [SPF] $sender_host_address is not allowed to send mail from ${if def:sender_address_domain {$sender_address_domain}{$sender_helo_name}}.  \
 262               Please see http://www.openspf.org/why.html?sender=$sender_address&ip=$sender_host_address
 263     log_message = SPF check failed.
 264     condition = ${run{/usr/bin/spfquery --ip \"$sender_host_address\" --mail-from \"$sender_address\" --helo \"$sender_helo_name\"}\
 265                      {no}{${if eq {$runrc}{1}{yes}{no}}}}
 266
 267   defer
 268     message = Temporary DNS error while checking SPF record.  Try again later.
 269     condition = ${if eq {$runrc}{5}{yes}{no}}
 270
 271   warn
 272     message = Received-SPF: ${if eq {$runrc}{0}{pass}{${if eq {$runrc}{2}{softfail}\
 273                                  {${if eq {$runrc}{3}{neutral}{${if eq {$runrc}{4}{unknown}{${if eq {$runrc}{6}{none}{error}}}}}}}}}}
 274     condition = ${if <={$runrc}{6}{yes}{no}}
 275
 276   warn
 277     log_message = Unexpected error in SPF check.
 278     condition = ${if >{$runrc}{6}{yes}{no}}
 279
 280   # Support for best-guess (see http://www.openspf.org/developers-guide.html)
 281   warn
 282     message = X-SPF-Guess: ${run{/usr/bin/spfquery --ip \"$sender_host_address\" --mail-from \"$sender_address\" \ --helo \"$sender_helo_name\" --guess true}\
 283                                 {pass}{${if eq {$runrc}{2}{softfail}{${if eq {$runrc}{3}{neutral}{${if eq {$runrc}{4}{unknown}\
 284                                 {${if eq {$runrc}{6}{none}{error}}}}}}}}}}
 285     condition = ${if <={$runrc}{6}{yes}{no}}
 286
 287   defer
 288     message = Temporary DNS error while checking SPF record.  Try again later.
 289     condition = ${if eq {$runrc}{5}{yes}{no}}
 290   .endif
 291
 292
 293   # Check against classic DNS "black" lists (DNSBLs) which list
 294   # sender IP addresses
 295   .ifdef CHECK_RCPT_IP_DNSBLS
 296   warn
 297     message = X-Warning: $sender_host_address is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
 298     log_message = $sender_host_address is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
 299     dnslists = CHECK_RCPT_IP_DNSBLS
 300   .endif
 301
 302
 303   # Check against DNSBLs which list sender domains, with an option to locally
 304   # whitelist certain domains that might be blacklisted.
 305   #
 306   # Note: If you define CHECK_RCPT_DOMAIN_DNSBLS, you must append
 307   # "/$sender_address_domain" after each domain.  For example:
 308   # CHECK_RCPT_DOMAIN_DNSBLS = rhsbl.foo.org/$sender_address_domain \
 309   #                            : rhsbl.bar.org/$sender_address_domain
 310   .ifdef CHECK_RCPT_DOMAIN_DNSBLS
 311   warn
 312     message = X-Warning: $sender_address_domain is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
 313     log_message = $sender_address_domain is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
 314     !senders = ${if exists{CONFDIR/local_domain_dnsbl_whitelist}\
 315                     {CONFDIR/local_domain_dnsbl_whitelist}\
 316                     {}}
 317     dnslists = CHECK_RCPT_DOMAIN_DNSBLS
 318   .endif
 319
 320
 321   # This hook allows you to hook in your own ACLs without having to
 322   # modify this file. If you do it like we suggest, you'll end up with
 323   # a small performance penalty since there is an additional file being
 324   # accessed. This doesn't happen if you leave the macro unset.
 325   .ifdef CHECK_RCPT_LOCAL_ACL_FILE
 326   .include CHECK_RCPT_LOCAL_ACL_FILE
 327   .endif
 328
 329
 330   #############################################################################
 331   # This check is commented out because it is recognized that not every
 332   # sysadmin will want to do it. If you enable it, the check performs
 333   # Client SMTP Authorization (csa) checks on the sending host. These checks
 334   # do DNS lookups for SRV records. The CSA proposal is currently (May 2005)
 335   # an Internet draft. You can, of course, add additional conditions to this
 336   # ACL statement to restrict the CSA checks to certain hosts only.
 337   #
 338   # require verify = csa
 339   #############################################################################
 340
 341
 342   # Accept if the address is in a domain for which we are an incoming relay,
 343   # but again, only if the recipient can be verified.
 344
 345   accept
 346     domains = +relay_to_domains
 347     endpass
 348     verify = recipient
 349
 350
 351   # At this point, the address has passed all the checks that have been
 352   # configured, so we accept it unconditionally.
 353
 354   accept