Exim ACL Config

[jan_philip]

Hi.

Ich versuche mich seit geraumer Zeit an einer vernünftigen exim.conf (exiscan). Beim verschicken von eMails dauert es etwas (~10 sekunden). Ich habe nun sämtliche (anti-)Spamoptionen herausgenommen und SpamAssassin deaktiviert und nun dauert es noch ca 5-6 Sekunden bis die Mail verschickt wird. Wenn ich nun HELO etc herausnehme geht wieder ratze-fatz. Ich denke, ich hab irgendwo einen logischen Fehler im Aufbau...kann mir jmd da helfen, zumal auch wirklich großer Spam durch die RBLs nicht vernünftig abgehalten wird? Ich benutze exim mit exiscan in Verbindung mit mySQL.



system_filter = /etc/exim/system_filter.exim
message_body_visible = 5000
system_filter_file_transport = address_file
system_filter_pipe_transport = address_pipe
system_filter_reply_transport = address_reply

tls_advertise_hosts = *
tls_certificate = /etc/ssl/certs/rsa.pem
tls_privatekey = /etc/ssl/certs/rsa-key.pem
tls_dhparam = /etc/ssl/certs/dhparam.pem

hide mysql_servers = localhost/webspace/root/PASSWORD

primary_hostname = my-domain.com

domainlist local_domains = @:${lookup mysql {SELECT userid FROM domains WHERE userid="${quote_mysql:${domain}}" }}

domainlist relay_to_domains =
hostlist relay_from_hosts = 127.0.0.1
hostlist auth_relay_hosts = *
hostlist auth_over_tls_hosts = *

smtp_enforce_sync = false

acl_smtp_rcpt = acl_check_rcpt

acl_smtp_data = acl_check_content

pipelining_advertise_hosts = : *

av_scanner = clamd:127.0.0.1 3310

#spamd_address = 127.0.0.1 783

never_users = root

host_lookup = *

rfc1413_hosts = *
rfc1413_query_timeout = 30s

ignore_bounce_errors_after = 2d

timeout_frozen_after = 7d

###

helo_allow_chars = _

helo_try_verify_hosts = *

###


smtp_accept_max = 100
smtp_accept_queue_per_connection = 1000
smtp_accept_max_per_connection = 1000
#extract_addresses_remove_arguments = false
message_size_limit = 10M


# Add verbose received-header:
received_header_text = Received: \
${if def:sender_fullhost {from ${sender_fullhost}\
${if def:sender_ident {(${sender_ident})}}}\
{${if def:sender_ident {from ${sender_ident} }}}}\
by ${primary_hostname}\
${if def:received_protocol {with ${received_protocol}}}\
${if def:tls_cipher {(tls_cipher ${tls_cipher})}}\
${if def:tls_peerdn {(tls_peerdn ${tls_peerdn})}}\
(Exim ${version_number} #${compile_number} (Gentoo Linux))\
id ${message_id}


################################################## ####################
# ACL CONFIGURATION #
# Specifies access control lists for incoming SMTP mail #
################################################## ####################

begin acl

#########

acl_check_rcpt:

accept hosts = :

local_parts = postmaster:abuse

deny local_parts = ^.*[@%!/|] : ^\\.

accept local_parts = postmaster
domains = +local_domains

require verify = sender

deny message = Your host is listed in Blacklist
log_message = found in Blacklist
dnslists = nomail.rhsbl.sorbs.net:sbl-xbl.spamhaus.org:list.dsbl.org:relays.ordb.org:ix. dnsbl.manitu.net

accept domains = +local_domains
endpass
message = unknown user
verify = recipient

accept domains = +relay_to_domains
endpass
message = unrouteable address
verify = recipient

accept hosts = 127.0.0.1:+relay_from_hosts

accept authenticated = *

defer message = only one recipient at a time
condition = ${if def:acl_m0 {1}{0}}

accept domains = +local_domains
endpass
message = unknown user
verify = recipient
set acl_m0 = $local_part@$domain

accept domains = +relay_to_domains
endpass
message = unrouteable address
verify = recipient
set acl_m0 = $domain

deny message = relay not permitted

###

# Using our address as HELO
deny message = Rejected mail: Forged HELO
condition = ${if eq{$sender_helo_name}{12.12.12.12}{yes}{no}}

## 12.12.12.12 = IP Adress

deny message = Rejected mail: Forged HELO
condition = ${if eq{$sender_helo_name}{my-domain.com}{yes}{no}}

# No HELO at all

deny message = Rejected mail: No HELO/EHLO received
condition = ${if eq{$sender_helo_name}{}{yes}{no}}

# Forged HELO (IP address in HELO does not match actual IP address)

deny message = Rejected mail: Forged HELO
condition = ${if isip{$sender_helo_name}{yes}{no}}
condition = ${if eq{$sender_helo_name}{$sender_host_address}{no}{ye s}}

###

acl_check_content:

# First unpack MIME containers and reject serious errors.
deny message = This message contains a MIME error ($demime_reason)
demime = *
condition = ${if >{$demime_errorlevel}{2}{1}{0}}

# Reject typically wormish file extensions. There is almost no
# sense in sending such files by email.
deny message = This message contains an unwanted file extension ($found_extension).
demime = bat:btm:cmd:com:cpl:dll:exe:lnk:msi:pif:prf:reg:sc r:vbs:url


deny message = Hiding of file extensions is not allowed!
log_message = Dangerous extension (CLSID hidden)
regex = ^(?i)Content-Disposition::(.*?)filename=\\s*"+((\{[a-hA-H0-9-]{25,}\})|((.*?)\\s{10,}(.*?)))"+\$


# Reject virus infested messages.
deny message = This message contains malware ($malware_name)
demime = *
malware = */defer_ok

# Reject messages containing "viagra" in all kinds of whitespace/case combinations
# WARNING: this is an example !
deny message = This message matches a blacklisted regular expression ($regex_match_string)
regex = [Vv] *[IiìíîïÌÍÎÏ1\¡] *[Aaàáâã\@ÀÁÂÃÄŪ] *[Gg] *[Rr] *[Aaàáâã\@ÀÁÂÃÄŪ]

###

# HELO verification failed: add a header, and write to the logfile
warn message = X-My-HELO: invalid
log_message = HELO argument does not match calling host
!verify = helo

###

accept


################################################## ####################
# ROUTERS CONFIGURATION #
# Specifies how addresses are handled #
################################################## ####################
# THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT! #
# An address is passed to each router in turn until it is accepted. #
################################################## ####################

begin routers



dnslookup:
driver = dnslookup
domains = ! +local_domains
transport = remote_smtp
ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
no_more


system_aliases:
driver = redirect
allow_fail
allow_defer
data = ${lookup{$local_part}lsearch{/etc/mail/aliases}}
# user = exim
file_transport = address_file
pipe_transport = address_pipe

mail_aliases:
driver = redirect
data = ${lookup mysql{ SELECT alias FROM alias WHERE address='${quote_mysql:${local_part}@${domain}}' }}
qualify_preserve_domain
file_transport = address_file
pipe_transport = address_pipe


virtual_user:
driver = redirect
allow_fail
allow_defer
data = ${lookup mysql{ SELECT maildir FROM users WHERE id='${quote_mysql:${local_part}@${domain}}' }}
# directory_transport = address_directory
file_transport = address_file
pipe_transport = address_pipe


mysql_catch_all:
driver = redirect
allow_fail
allow_defer
data = ${lookup mysql{ SELECT alias FROM alias WHERE address='*@$domain' }{$value}fail}
file_transport = address_file
pipe_transport = address_pipe


mysqluser:
driver = accept
condition = ${if eq{} {${lookup mysql {SELECT username FROM users WHERE username='$local_part' AND domainname='$domain' AND status='1'}}}{no}{yes}}
transport = local_delivery

mysql_aliases:
driver = redirect
file_transport = address_file
pipe_transport = address_pipe
data = ${lookup mysql{SELECT sendto FROM aliases \
WHERE (username='$local_part' AND domainname='$domain') \
OR (username='*' AND domainname='$domain')}}

mysql_autorespond:
driver = accept
condition = ${if eq{} {${lookup mysql{SELECT autoresponder \
FROM users WHERE autoresponder='yes' \
AND username='$local_part' \
AND domainname='$domain' AND status='1'}}}{no}{yes}}
no_verify
no_expn
unseen
transport = address_mysql

################################################## ####################
# TRANSPORTS CONFIGURATION #
################################################## ####################
# ORDER DOES NOT MATTER #
# Only one appropriate transport is called for each delivery. #
################################################## ####################


begin transports


# This transport is used for delivering messages over SMTP connections.

remote_smtp:
driver = smtp



local_delivery:
driver = appendfile
create_directory
directory_mode = 700
headers_remove = "Bcc"
delivery_date_add
envelope_to_add
return_path_add
user = mail
group = mail
mode = 660
directory = /var/spool/mail
maildir_format
mode_fail_narrower = false


quota = ${lookup mysql{SELECT quota FROM users WHERE username='$local_part' \
AND domainname='$domain'}{$value}{100M}}


quota_warn_threshold = ${lookup mysql{SELECT quotawarn FROM users \
WHERE username='$local_part' \
AND domainname='$domain'}{$value}{80%}}

address_pipe:
driver = pipe
return_output


address_file:
driver = appendfile
delivery_date_add
envelope_to_add
return_path_add


address_directory:
driver = appendfile
delivery_date_add
envelope_to_add
return_path_add
maildir_format

address_mysql:
driver = autoreply
reply_to = "${local_part}@${domain}"
to = ${sender_address}
subject = ${lookup mysql{SELECT arsubject FROM users WHERE \
username='$local_part' AND domainname='$domain'}{$value} \
{Automatic reply from ${local_part}@${domain}}}
text = ${lookup mysql{SELECT artext FROM users WHERE \
username='$local_part' AND domainname='$domain'}{$value}}




address_reply:
driver = autoreply

################################################## ####################
# RETRY CONFIGURATION #
################################################## ####################

begin retry

# This single retry rule applies to all domains and all errors. It specifies
# retries every 15 minutes for 2 hours, then increasing retry intervals,
# starting at 1 hour and increasing each time by a factor of 1.5, up to 16
# hours, then retries every 6 hours until 4 days have passed since the first
# failed delivery.

# Domain Error Retries
# ------ ----- -------

* * F,2h,15m; G,16h,1h,1.5; F,4d,6h

################################################## ####################
# REWRITE CONFIGURATION #
################################################## ####################

# There are no rewriting specifications in this default configuration file.

begin rewrite


################################################## ####################
# AUTHENTICATION CONFIGURATION #
################################################## ####################

# There are no authenticator specifications in this default configuration file.

begin authenticators


plain:
driver = plaintext
public_name = PLAIN
server_condition = ${lookup mysql{SELECT if(count(*), "1", "0") FROM users WHERE id='$2'}}
server_set_id = $2

login:
driver = plaintext
public_name = LOGIN
server_prompts = "Username:: : Password::"
server_condition = ${lookup mysql {SELECT if(count(*), "1", "0") FROM users WHERE pfid='$1'}}
server_set_id = $1



################################################## ####################
# CONFIGURATION FOR local_scan() #
################################################## ####################

# If you have built Exim to include a local_scan() function that contains
# tables for private options, you can define those options here. Remember to
# uncomment the "begin" line. It is commented by default because it provokes
# an error with Exim binaries that are not built with LOCAL_SCAN_HAS_OPTIONS
# set in the Local/Makefile.

# begin local_scan


# End of Exim configuration file

---

[Roger Wilco]

Schreib zunächst 100 mal "Ich werde in Zukunft den CODE-Tag benutzen". :ugly:

Nimm mal das helo_try_verify_hosts = * raus. Durch die ganzen DNS-Abfragen wird der Versand/Empfang der Mails verzögert. Wenn das auch nichts bringt, schau mal mit "exim -bh 127.0.0.1" an welcher Stelle der Versand genau hängt.

[jan_philip]

web / # exim -bh 127.0.0.1

**** SMTP testing session as if from host 127.0.0.1
**** but without any ident (RFC 1413) callback.
**** This is not for real!

>>> host in hosts_connection_nolog? no (option unset)
>>> host in host_lookup? yes (matched "*")
>>> looking up host name for 127.0.0.1
>>> IP address lookup yielded ns.abovenet.de
>>> gethostbyname looked up these IP addresses:
>>> name=ns.abovenet.de address=216.200.116.12
>>> checking addresses for ns.abovenet.de
>>> 216.200.116.12
>>> no IP address for ns.abovenet.de matched 127.0.0.1
>>> 127.0.0.1 does not match any IP address for ns.abovenet.de
>>> host in host_reject_connection? no (option unset)
>>> host in sender_unqualified_hosts? no (option unset)
>>> host in recipient_unqualified_hosts? no (option unset)
>>> host in helo_verify_hosts? no (option unset)
>>> host in helo_try_verify_hosts? no (option unset)
>>> host in helo_accept_junk_hosts? no (option unset)


Hab jetzt mal folgendes gemacht (das Verschicken geht mittelmäßig schnell). Frag mich, ob die config auch wirklich gut ist...




system_filter = /etc/exim/system_filter.exim
message_body_visible = 5000
system_filter_file_transport = address_file
system_filter_pipe_transport = address_pipe
system_filter_reply_transport = address_reply

tls_advertise_hosts = *
tls_certificate = /etc/ssl/certs/rsa.pem
tls_privatekey = /etc/ssl/certs/rsa-key.pem
tls_dhparam = /etc/ssl/certs/dhparam.pem

hide mysql_servers = localhost/webspace/root/PASSWORD

primary_hostname = my-domain.com

domainlist local_domains = @:${lookup mysql {SELECT userid FROM domains WHERE userid="${quote_mysql:${domain}}" }}

domainlist relay_to_domains =
hostlist relay_from_hosts = 127.0.0.1
hostlist auth_relay_hosts = *
hostlist auth_over_tls_hosts = *

smtp_enforce_sync = false

acl_smtp_rcpt = acl_check_rcpt

acl_smtp_data = acl_check_content

acl_smtp_auth = acl_check_auth

pipelining_advertise_hosts = :

av_scanner = clamd:127.0.0.1 3310

spamd_address = 127.0.0.1 783

never_users = root

host_lookup = *

rfc1413_hosts = *
rfc1413_query_timeout = 0s

ignore_bounce_errors_after = 2d

timeout_frozen_after = 7d

helo_allow_chars = _
#helo_try_verify_hosts = *


smtp_accept_max = 100
smtp_accept_queue_per_connection = 1000
smtp_accept_max_per_connection = 1000
message_size_limit = 10M


# Add verbose received-header:
received_header_text = Received: \
${if def:sender_fullhost {from ${sender_fullhost}\
${if def:sender_ident {(${sender_ident})}}}\
{${if def:sender_ident {from ${sender_ident} }}}}\
by ${primary_hostname}\
${if def:received_protocol {with ${received_protocol}}}\
${if def:tls_cipher {(tls_cipher ${tls_cipher})}}\
${if def:tls_peerdn {(tls_peerdn ${tls_peerdn})}}\
(Exim ${version_number} #${compile_number} (Gentoo Linux))\
id ${message_id}


################################################## ####################
# ACL CONFIGURATION #
# Specifies access control lists for incoming SMTP mail #
################################################## ####################

begin acl

###

acl_check_rcpt:

accept hosts = :

accept hosts = +relay_from_hosts

accept authenticated = *

deny message = Rejected mail: Forged HELO
condition = ${if eq{$sender_helo_name}{MYIP}{yes}{no}}

deny message = Rejected mail: Forged HELO
condition = ${if eq{$sender_helo_name}{my-domain.com}{yes}{no}}

deny message = Rejected mail: No HELO/EHLO received
condition = ${if eq{$sender_helo_name}{}{yes}{no}}

deny message = Rejected mail: Forged HELO
condition = ${if isip{$sender_helo_name}{yes}{no}}
condition = ${if eq{$sender_helo_name}{$sender_host_address}{no}{ye s}}

deny local_parts = ^.*[@%!/|] : ^\\.

accept local_parts = postmaster
domains = +local_domains

require verify = sender/defer_ok


deny message = Your host is listed in Blacklist
log_message = found in Blacklist
dnslists = nomail.rhsbl.sorbs.net:sbl-xbl.spamhaus.org:list.dsbl.org:relays.ordb.org:ix. dnsbl.manitu.net

accept domains = +local_domains
endpass
verify = recipient

deny message = Rejected recipient: relay not permitted

###

acl_check_auth:

# Accept if the message arrived over an authenticated connection, from
# any host. Again, these messages are usually from MUAs, so recipient
# verification is omitted.

accept encrypted = *

deny message = Rejected authentication: Encryption required

###

acl_check_content:

deny message = This message contains a MIME error ($demime_reason)
demime = *
condition = ${if >{$demime_errorlevel}{2}{1}{0}}

deny message = This message contains an unwanted file extension ($found_extension).
demime = bat:btm:cmd:com:cpl:dll:exe:lnk:msi:pif:prf:reg:sc r:vbs:url

deny message = Hiding of file extensions is not allowed!
log_message = Dangerous extension (CLSID hidden)
regex = ^(?i)Content-Disposition::(.*?)filename=\\s*"+((\{[a-hA-H0-9-]{25,}\})|((.*?)\\s{10,}(.*?)))"+\$

deny message = This message contains malware ($malware_name)
demime = *
malware = */defer_ok

deny message = This message matches a blacklisted regular expression ($regex_match_string)
regex = [Vv] *[IiìíîïÌÍÎÏ1\¡] *[Aaàáâã\@ÀÁÂÃÄŪ] *[Gg] *[Rr] *[Aaàáâã\@ÀÁÂÃÄŪ]

# more words :-) PLEASE!!!

warn message = X-My-HELO: invalid
log_message = HELO argument does not match calling host
!verify = helo


# Always add X-Spam-Score and X-Spam-Report headers, using SA system-wide settings
# (user "nobody"), no matter if over threshold or not.
warn message = X-Spam-Score: $spam_score ($spam_bar)
spam = nobody:true
warn message = X-Spam-Report: $spam_report
spam = nobody:true

# Add X-Spam-Flag if spam is over system-wide threshold
warn message = X-Spam-Flag: YES
spam = nobody

# Reject spam messages with score over 5, using an extra condition.
deny message = This message scored $spam_score points. Congratulations!
spam = nobody:true
condition = ${if >{$spam_score_int}{50}{1}{0}}

warn message = Subject: ***SPAM*** $h_subject
spam = nobody
condition = ${if >{$spam_score_int}{30}{1}{0}}


###

accept