Date: Thu, 22 May 2003 00:59:38 -0700 (PDT) From: Louis Erickson Subject: amavisd-new and Exim 4.x. ... Second, I wanted to share with you an improved way to run amavisd-new with Exim. Exim is my preferred MTA these days, and I've figured out an improvement on the system which Martijn Grendelman has provided. As Mr. Grendelman did and as is typical for me, I'm going to go in great and exhausting detail. In a nutshell, the problem we had to solve was to keep Exim from passing invalid RCPT TO lines to amavisd-new, because the second Exim instance would cause amavisd to reject the whole message instead of just the single recipient. Mr. Grendelman tries to solve that problem by having each router that will perform a local delivery pass the message through amavisd. He admits this has a flaw with routers which can be used to redirect mail to another address or to feed the message to a pipe or append it to a file. The standard redirect router can do this while parsing /etc/aliases, and that made his solution unworkable in my configuration. His work did clarify the problem, and get me thinking about other ways to solve it. I would have never found the solution I did without his suggestions. After thinking about it for a while and reading the Exim documentation, I was able to turn the problem around backwards. I figured out a way to get amavisd in the process for every local delivery, only for validated addresses. Single invalid addresses are ignored, regardless of the router or transport which handles them. Rather than trying to add code to each router that can deliver, I added routers to validate the addresses the same way the real delivery routers would. If one router accepts the address it is given to amavis. If no routers accept the address it will fail before amavis gets it. To do this I put copies of any router that can do local delivery before the amavis router. Those copies are set to verify_only, and will only be used for RCPT checking. As they are verify_only they have no transport set and will never deliver a message, only check RCPTs. They have the identical conditions and drivers as the corresponding delivery routers. Each address check router is set to pass a successfully validated address to the amavis router. Between those and the amavis router, I put in a verify_only router which will always fail. This is what scrubs out invalid addresses before they get to amavis. This router is skipped by the pass_router settings on the address check routers. After that, I have the amavis router, pretty much exactly as suggested in the Exim README, and the normal local delivery routers which will eventually handle the messages. The default configuration file contains the following routers, in the following order - order is important: domain_literal # Deliver directly to [xx.xx.xx.xx] addresses - not local dnslookup # Deliver to remote smtp sites - not local system_aliases # Deliver to /etc/aliases - may be local! userforward # Handle .forward files - may be local! localuser # Deliver to local mailboxes - local! When the configuration I'm using is done, it would have: check_domain_literal # Verify addresses pre-amavisd check_dnslookup # Verify addresses pre-amavisd check_system_aliases # Verify addresses pre-amavisd check_localuser # Verify addresses pre-amavisd failed_address_router # Always fails! amavis # Deliver to amavisd-new on 127.0.0.1:10024 domain_literal # Deliver directly to [xx.xx.xx.xx] addresses dnslookup # Deliver to remote smtp sites system_aliases # Deliver to /etc/aliases userforward # Handle .forward files localuser # Deliver to local mailboxes Note that there is no check_userforward because userforward cannot fail an address, as it is set for no_verify. The configuration I usually run has at least three other routers in it to handle my virtual domains. There is an amavis transport, also pretty much out of the Exim README. It is very simple and just forwards the messages to 127.0.0.1 on port 10024. They say a picture is worth a thousand words, and I've tried to draw one above. I think an example is probably also worth a thousand words, and I've modified the stock Exim configuration file to include amavisd-new. Note that you can't quite just drop this in and go; you'll have to set the primary_hostname value correctly. Look for mail.example.com and change it. Please note that I have NOT tested the sample configuration file I'm sending you! It's a modification of the default file to show what I'm discussing. I made sure Exim would accept it as a valid file, but I can't install it on my local machine here because of the other features I need. I believe it works, but I have NOT actually tested it. My configuration never runs amavisd for remote smtp deliveries, as I'm only using SpamAssassin, and I have several other routers. My customers would be grumpy if I shut off all their virtual domains. =) I'm happy to try and explain any of this that isn't clear, or to help others understand what I've done and how to do it to their configuration. This should be a general solution which can be applied to any Exim configuration. Please feel free to edit my message and/or to distribute it and the sample file as you see fit. Thanks again for all your work! -- Louis Erickson - lerickson@rdwarf.net - http://www.rdwarf.com/~wwonko/ Content-type: TEXT/PLAIN; charset=US-ASCII; name="exim-configure.amavisd" ###################################################################### # Runtime configuration file for Exim # # modified for amavisd-new # ###################################################################### # This is a default configuration file which will operate correctly in # uncomplicated installations. Please see the manual for a complete list # of all the runtime configuration options that can be included in a # configuration file. There are many more than are mentioned here. The # manual is in the file doc/spec.txt in the Exim distribution as a plain # ASCII file. Other formats (PostScript, Texinfo, HTML, PDF) are available # from the Exim ftp sites. The manual is also online at the Exim web sites. # This file is divided into several parts, all but the first of which are # headed by a line starting with the word "begin". Only those parts that # are required need to be present. Blank lines, and lines starting with # # are ignored. ########### IMPORTANT ########## IMPORTANT ########### IMPORTANT ########### # # # Whenever you change Exim's configuration file, you *must* remember to # # HUP the Exim daemon, because it will not pick up the new configuration # # until you do. However, any other Exim processes that are started, for # # example, a process started by an MUA in order to send a message, will # # see the new configuration as soon as it is in place. # # # # You do not need to HUP the daemon for changes in auxiliary files that # # are referenced from this file. They are read every time they are used. # # # # It is usually a good idea to test a new configuration for syntactic # # correctness before installing it (for example, by running the command # # "exim -C /config/file.new -bV"). # # # ########### IMPORTANT ########## IMPORTANT ########### IMPORTANT ########### ###################################################################### # MAIN CONFIGURATION SETTINGS # ###################################################################### # Specify your host's canonical name here. This should normally be the fully # qualified "official" name of your host. If this option is not set, the # uname() function is called to obtain the name. In many cases this does # the right thing and you need not set anything explicitly. # Note that you MUST set the primary hostname when listening on multiple # interfaces. I can't remember why. primary_hostname = mail.example.com # Listen on every interface on the system on the standard port 25, and # also allow connections on port 10025 from just the loopback. local_interfaces = 0.0.0.0.25 : 127.0.0.1.10025 # The next three settings create two lists of domains and one list of hosts. # These lists are referred to later in this configuration using the syntax # +local_domains, +relay_to_domains, and +relay_from_hosts, respectively. They # are all colon-separated lists: domainlist local_domains = @ domainlist relay_to_domains = hostlist relay_from_hosts = 127.0.0.1 # Most straightforward access control requirements can be obtained by # appropriate settings of the above options. In more complicated situations, you # may need to modify the Access Control List (ACL) which appears later in this # file. # The first setting specifies your local domains, for example: # # domainlist local_domains = my.first.domain : my.second.domain # # You can use "@" to mean "the name of the local host", as in the default # setting above. This is the name that is specified by primary_hostname, # as specified above (or defaulted). If you do not want to do any local # deliveries, remove the "@" from the setting above. If you want to accept mail # addressed to your host's literal IP address, for example, mail addressed to # "user@[192.168.23.44]", you can add "@[]" as an item in the local domains # list. You also need to uncomment "allow_domain_literals" below. This is not # recommended for today's Internet. # The second setting specifies domains for which your host is an incoming relay. # If you are not doing any relaying, you should leave the list empty. However, # if your host is an MX backup or gateway of some kind for some domains, you # must set relay_to_domains to match those domains. For example: # # domainlist relay_to_domains = *.myco.com : my.friend.org # # This will allow any host to relay through your host to those domains. # See the section of the manual entitled "Control of relaying" for more # information. # The third setting specifies hosts that can use your host as an outgoing relay # to any other host on the Internet. Such a setting commonly refers to a # complete local network as well as the localhost. For example: # # hostlist relay_from_hosts = 127.0.0.1 : 192.168.0.0/16 # # The "/16" is a bit mask (CIDR notation), not a number of hosts. Note that you # have to include 127.0.0.1 if you want to allow processes on your host to send # SMTP mail by using the loopback address. A number of MUAs use this method of # sending mail. # All three of these lists may contain many different kinds of item, including # wildcarded names, regular expressions, and file lookups. See the reference # manual for details. The lists above are used in the access control list for # incoming messages. The name of this ACL is defined here: acl_smtp_rcpt = acl_check_rcpt # You should not change that setting until you understand how ACLs work. # Specify the domain you want to be added to all unqualified addresses # here. An unqualified address is one that does not contain an "@" character # followed by a domain. For example, "caesar@rome.example" is a fully qualified # address, but the string "caesar" (i.e. just a login name) is an unqualified # email address. Unqualified addresses are accepted only from local callers by # default. See the recipient_unqualified_hosts option if you want to permit # unqualified addresses from remote sources. If this option is not set, the # primary_hostname value is used for qualification. # qualify_domain = # If you want unqualified recipient addresses to be qualified with a different # domain to unqualified sender addresses, specify the recipient domain here. # If this option is not set, the qualify_domain value is used. # qualify_recipient = # The following line must be uncommented if you want Exim to recognize # addresses of the form "user@[10.11.12.13]" that is, with a "domain literal" # (an IP address) instead of a named domain. The RFCs still require this form, # but it makes little sense to permit mail to be sent to specific hosts by # their IP address in the modern Internet. This ancient format has been used # by those seeking to abuse hosts by using them for unwanted relaying. If you # really do want to support domain literals, uncomment the following line, and # see also the "domain_literal" router below. # allow_domain_literals # No deliveries will ever be run under the uids of these users (a colon- # separated list). An attempt to do so causes a panic error to be logged, and # the delivery to be deferred. This is a paranoic safety catch. Note that the # default setting means you cannot deliver mail addressed to root as if it # were a normal user. This isn't usually a problem, as most sites have an alias # for root that redirects such mail to a human administrator. never_users = root # The setting below causes Exim to do a reverse DNS lookup on all incoming # IP calls, in order to get the true host name. If you feel this is too # expensive, you can specify the networks for which a lookup is done, or # remove the setting entirely. host_lookup = * # The settings below, which are actually the same as the defaults in the # code, cause Exim to make RFC 1413 (ident) callbacks for all incoming SMTP # calls. You can limit the hosts to which these calls are made, and/or change # the timeout that is used. If you set the timeout to zero, all RFC 1413 calls # are disabled. RFC 1413 calls are cheap and can provide useful information # for tracing problem messages, but some hosts and firewalls have problems # with them. This can result in a timeout instead of an immediate refused # connection, leading to delays on starting up an SMTP session. rfc1413_hosts = * rfc1413_query_timeout = 30s # By default, Exim expects all envelope addresses to be fully qualified, that # is, they must contain both a local part and a domain. If you want to accept # unqualified addresses (just a local part) from certain hosts, you can specify # these hosts by setting one or both of # # sender_unqualified_hosts = # recipient_unqualified_hosts = # # to control sender and recipient addresses, respectively. When this is done, # unqualified addresses are qualified using the settings of qualify_domain # and/or qualify_recipient (see above). # If you want Exim to support the "percent hack" for certain domains, # uncomment the following line and provide a list of domains. The "percent # hack" is the feature by which mail addressed to x%y@z (where z is one of # the domains listed) is locally rerouted to x@y and sent on. If z is not one # of the "percent hack" domains, x%y is treated as an ordinary local part. This # hack is rarely needed nowadays; you should not enable it unless you are sure # that you really need it. # # percent_hack_domains = # # As well as setting this option you will also need to remove the test # for local parts containing % in the ACL definition below. # When Exim can neither deliver a message nor return it to sender, it "freezes" # the delivery error message (aka "bounce message"). There are also other # circumstances in which messages get frozen. They will stay on the queue for # ever unless one of the following options is set. # This option unfreezes frozen bounce messages after two days, tries # once more to deliver them, and ignores any delivery failures. ignore_bounce_errors_after = 2d # This option cancels (removes) frozen messages that are older than a week. timeout_frozen_after = 7d ###################################################################### # ACL CONFIGURATION # # Specifies access control lists for incoming SMTP mail # ###################################################################### begin acl # This access control list is used for every RCPT command in an incoming # SMTP message. The tests are run in order until the address is either # accepted or denied. acl_check_rcpt: # Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by # testing for an empty sending host field. accept hosts = : # Deny if the local part contains @ or % or / or | or !. These are rarely # found in genuine local parts, but are often tried by people looking to # circumvent relaying restrictions. # Also deny if the local part starts with a dot. Empty components aren't # strictly legal in RFC 2822, but Exim allows them because this is common. # However, actually starting with a dot may cause trouble if the local part # is used as a file name (e.g. for a mailing list). deny local_parts = ^.*[@%!/|] : ^\\. # Accept mail to postmaster in any local domain, regardless of the source, # and without verifying the sender. accept local_parts = postmaster domains = +local_domains # Deny unless the sender address can be verified. require verify = sender ############################################################################# # There are no checks on DNS "black" lists because the domains that contain # these lists are changing all the time. However, here are two examples of # how you could get Exim to perform a DNS black list lookup at this point. # The first one denies, while the second just warns. # # deny message = rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text # dnslists = black.list.example # # warn message = X-Warning: $sender_host_address is in a black list at $dnslist_domain # log_message = found in $dnslist_domain # dnslists = black.list.example ############################################################################# # Accept if the address is in a local domain, but only if the recipient can # be verified. Otherwise deny. The "endpass" line is the border between # passing on to the next ACL statement (if tests above it fail) or denying # access (if tests below it fail). accept domains = +local_domains endpass message = unknown user verify = recipient # Accept if the address is in a domain for which we are relaying, but again, # only if the recipient can be verified. accept domains = +relay_to_domains endpass message = unrouteable address verify = recipient # If control reaches this point, the domain is neither in +local_domains # nor in +relay_to_domains. # Accept if the message comes from one of the hosts for which we are an # outgoing relay. Recipient verification is omitted here, because in many # cases the clients are dumb MUAs that don't cope well with SMTP error # responses. If you are actually relaying out from MTAs, you should probably # add recipient verification here. accept hosts = +relay_from_hosts # Accept if the message arrived over an authenticated connection, from # any host. Again, these messages are usually from MUAs, so recipient # verification is omitted. accept authenticated = * # Reaching the end of the ACL causes a "deny", but we might as well give # an explicit message. deny message = relay not permitted ###################################################################### # ROUTERS CONFIGURATION # # Specifies how addresses are handled # ###################################################################### # THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT! # # An address is passed to each router in turn until it is accepted. # ###################################################################### begin routers # Before we'll deliver any message, we want to pass the message # through amavisd-new. amavisd-new causes the rejection of the whole # message if any of the recipients fail when it tries to redeliver the # message later. Since this is not desirable behavior, we need to check # all local recipients before we try to route through amavisd, so it won't # see any invalid users. # To do this, each router which validates users below has a corresponding # entry here, with the same criteria as below. Instead of actually # specifying the transport and delivering the mail the router is marked # for use for address verification only, and simply passes off routing # to the amavis router if it accepts a user. If no routers verify a # user, control will reach a router which always fails, and that user # will be refused prior to delivery to amavis. # If a message would be delivered with the domain literal [xx.yy.zz.nn] # notation, accept it. Note that this is mostly used these days by # junk mailers to send things you don't want. The default configuration # leaves it commented out, despite that not being RFC compliant. # Remove the comments here and on the domain_literal router below to # use it. # check_domain_literal: # driver = ipliteral # domains = ! +local_domains # verify_only # pass_router = amavis # This router routes addresses that are not in local domains by doing a DNS # lookup on the domain name. Any domain that resolves to 0.0.0.0 or to a # loopback interface address (127.0.0.0/8) is treated as if it had no DNS # entry. Note that 0.0.0.0 is the same as 0.0.0.0/32, which is commonly treated # as the local host inside the network stack. It is not 0.0.0.0/0, the default # route. If the DNS lookup fails, no further routers are tried because of # the no_more setting, and consequently the address is unrouteable. check_dnslookup: driver = dnslookup domains = ! +local_domains ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8 verify_only pass_router = amavis no_more # The remaining routers check addresses in the local domain(s). # The system_aliases router allows delivery from a standard aliases file, # often called /etc/aliases. To check it, use the same transports and # flags, but set verify_only and pass_router. No transports are needed. check_system_aliases: driver = redirect allow_fail allow_defer data = ${lookup{$local_part}lsearch{/etc/aliases}} verify_only pass_router = amavis # There is no check_userforward because that router is not used during # address verification, and therefore won't ever refuse an address. # It uses no_verify, which is the opposite of the verify_only we're using # to check for valid users. # The localuser router delivers to local system mailboxes, of various kinds. # To check it, the check_localuser router uses the same settings and driver, # but doesn't use any of the other settings and is verify_only. check_localuser: driver = accept check_local_user verify_only pass_router = amavis # If we've run the gamut of the check routers and gotten here then none of # those routers will deliver this address. To prevent it from trying to # be delivered, this router will fail to verify any address. failed_address_router: driver = accept verify_only fail_verify # The verify routers have passed processing to the amavis router, or been # skipped because they're verify_only. This means we should now actually # try and virus scan a message. If the message has come in on port 10025 # has been scanned already, or is a bounce message, this router will accept # the message and process it with the amavis transport. Otherwise, # routing continues with the 'normal' delivery methods below. amavis: driver = manualroute # Do NOT run if received via 10025/tcp or if already spam-scanned # or if bounce message ($sender_address="") condition = "${if or {{eq {$interface_port}{10025}} \ {eq {$received_protocol}{spam-scanned}} \ {eq {$sender_address}{}} \ }{0}{1}}" transport = amavis route_list = "* localhost byname" self = send # This router routes to remote hosts over SMTP by explicit IP address, # when an email address is given in "domain literal" form, for example, # . The RFCs require this facility. However, it is # little-known these days, and has been exploited by evil people seeking # to abuse SMTP relays. Consequently it is commented out in the default # configuration. If you uncomment this router, you also need to uncomment # allow_domain_literals above, so that Exim can recognize the syntax of # domain literal addresses. # domain_literal: # driver = ipliteral # domains = ! +local_domains # transport = remote_smtp # This router routes addresses that are not in local domains by doing a DNS # lookup on the domain name. Any domain that resolves to 0.0.0.0 or to a # loopback interface address (127.0.0.0/8) is treated as if it had no DNS # entry. Note that 0.0.0.0 is the same as 0.0.0.0/32, which is commonly treated # as the local host inside the network stack. It is not 0.0.0.0/0, the default # route. If the DNS lookup fails, no further routers are tried because of # the no_more setting, and consequently the address is unrouteable. dnslookup: driver = dnslookup domains = ! +local_domains transport = remote_smtp ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8 no_more # The remaining routers deliver to addresses in the local domain(s). # This router handles aliasing using a linearly searched alias file with the # name /etc/aliases. When this configuration is installed automatically, # the name gets inserted into this file from whatever is set in Exim's # build-time configuration. The default path is the traditional /etc/aliases. # If you install this configuration by hand, you need to specify the correct # path in the "data" setting below. # ##### NB You must ensure that the alias file exists. It used to be the case ##### NB that every Unix had that file, because it was the Sendmail default. ##### NB These days, there are systems that don't have it. Your aliases ##### NB file should at least contain an alias for "postmaster". # # If any of your aliases expand to pipes or files, you will need to set # up a user and a group for these deliveries to run under. You can do # this by uncommenting the "user" option below (changing the user name # as appropriate) and adding a "group" option if necessary. Alternatively, you # can specify "user" on the transports that are used. Note that the transports # listed below are the same as are used for .forward files; you might want # to set up different ones for pipe and file deliveries from aliases. system_aliases: driver = redirect allow_fail allow_defer data = ${lookup{$local_part}lsearch{/etc/aliases}} # user = exim file_transport = address_file pipe_transport = address_pipe # This router handles forwarding using traditional .forward files in users' # home directories. If you want it also to allow mail filtering when a forward # file starts with the string "# Exim filter", uncomment the "allow_filter" # option. # The no_verify setting means that this router is skipped when Exim is # verifying addresses. Similarly, no_expn means that this router is skipped if # Exim is processing an EXPN command. # The check_ancestor option means that if the forward file generates an # address that is an ancestor of the current one, the current one gets # passed on instead. This covers the case where A is aliased to B and B # has a .forward file pointing to A. # The three transports specified at the end are those that are used when # forwarding generates a direct delivery to a file, or to a pipe, or sets # up an auto-reply, respectively. userforward: driver = redirect check_local_user file = $home/.forward no_verify no_expn check_ancestor # allow_filter file_transport = address_file pipe_transport = address_pipe reply_transport = address_reply # This router matches local user mailboxes. localuser: driver = accept check_local_user transport = local_delivery ###################################################################### # TRANSPORTS CONFIGURATION # ###################################################################### # ORDER DOES NOT MATTER # # Only one appropriate transport is called for each delivery. # ###################################################################### # A transport is used only when referenced from a router that successfully # handles an address. begin transports # This transport is used for delivering messages over SMTP connections. remote_smtp: driver = smtp # This is the SMTP transport used to deliver messages to amavisd-new. # It is a simple smtp transport, delivering to the localhost on a specific # port. amavis: driver = smtp port = 10024 allow_localhost # This transport is used for local delivery to user mailboxes in traditional # BSD mailbox format. By default it will be run under the uid and gid of the # local user, and requires the sticky bit to be set on the /var/mail directory. # Some systems use the alternative approach of running mail deliveries under a # particular group instead of using the sticky bit. The commented options below # show how this can be done. local_delivery: driver = appendfile file = /var/mail/$local_part delivery_date_add envelope_to_add return_path_add # group = mail # mode = 0660 # This transport is used for handling pipe deliveries generated by alias or # .forward files. If the pipe generates any standard output, it is returned # to the sender of the message as a delivery error. Set return_fail_output # instead of return_output if you want this to happen only when the pipe fails # to complete normally. You can set different transports for aliases and # forwards if you want to - see the references to address_pipe in the routers # section above. address_pipe: driver = pipe return_output # This transport is used for handling deliveries directly to files that are # generated by aliasing or forwarding. address_file: driver = appendfile delivery_date_add envelope_to_add return_path_add # This transport is used for handling autoreplies generated by the filtering # option of the userforward router. address_reply: driver = autoreply ###################################################################### # RETRY CONFIGURATION # ###################################################################### begin retry # This single retry rule applies to all domains and all errors. It specifies # retries every 15 minutes for 2 hours, then increasing retry intervals, # starting at 1 hour and increasing each time by a factor of 1.5, up to 16 # hours, then retries every 6 hours until 4 days have passed since the first # failed delivery. # Domain Error Retries # ------ ----- ------- * * F,2h,15m; G,16h,1h,1.5; F,4d,6h ###################################################################### # REWRITE CONFIGURATION # ###################################################################### # There are no rewriting specifications in this default configuration file. begin rewrite ###################################################################### # AUTHENTICATION CONFIGURATION # ###################################################################### # There are no authenticator specifications in this default configuration file. begin authenticators ###################################################################### # CONFIGURATION FOR local_scan() # ###################################################################### # If you have built Exim to include a local_scan() function that contains # tables for private options, you can define those options here. Remember to # uncomment the "begin" line. It is commented by default because it provokes # an error with Exim binaries that are not built with LOCAL_SCAN_HAS_OPTIONS # set in the Local/Makefile. # begin local_scan # End of Exim configuration file