Blog di Casadamico

Opzioni di compilazione di Exim

Nel caso di un server FreeBSD, installare il port /usr/ports/mail/exim-sa-exim con le opzioni:

• AUTH_DOVECOT=on “Enable Dovecot authentication mechanisms”
• CONTENT_SCAN=on “Enable exiscan email content scanner”
• DAEMON=on “Install scripts to run as a daemon”
• DNSDB=on “Enable DNS-style lookups”
• EMBEDDED_PERL=on “Enable embedded Perl interpreter”
• ICONV=on “Enable header charset conversion”
• LMTP=on “RFC2033 SMTP over command pipe transport”
• LSEARCH=on “Enable wildcarded-file lookups”
• MAILDIR=on “Enable Maildir mailbox format”
• OLD_DEMIME=on “Enable old, deprecated demime ACL”
• SA_EXIM=on “SA-Exim support”
• SUID=on “Install the exim binary suid root”

inserendo in /etc/make.conf:

#Exim
AUTH_DOVECOT=yo
CONTENT_SCAN=yo
DAEMON=yo
DNSDB=yo
EMBEDDED_PERL=yo
ICONV=yo
LMTP=yo
LSEARCH=yo
MAILDIR=yo
OLD_DEMIME=yo
SA_EXIM=yo
SUID=yo

Configurazione Principale

Il file /usr/local/etc/exim/configure:

# Configurazione generale

av_scanner = clamd:127.0.0.1 3310

primary_hostname = a.mx.t.contactlab.it
qualify_domain = t.contactlab.it
smtp_banner = $smtp_active_hostname ESMTP
never_users = root
local_interfaces = <; 127.0.0.1; 172.16.16.130
hostlist relay_from_hosts = 127.0.0.1 : 172.16.7.0/24
domainlist local_domains = @ : localhost : t.contactlab.it
domainlist relay_to_domains = /usr/local/etc/exim/domains
host_lookup = *
rfc1413_hosts = *
rfc1413_query_timeout = 0s
message_size_limit = 10M
return_size_limit = 100K
smtp_accept_queue = 1500
smtp_accept_max = 1500
smtp_accept_max_per_host = 1500
smtp_accept_queue_per_connection = 1500
smtp_accept_reserve = 100
smtp_reserve_hosts = 127.0.0.1
queue_run_max = 32
ignore_bounce_errors_after = 10d
timeout_frozen_after = 10d
remote_max_parallel = 8
log_selector = \
+delivery_size \
+sender_on_delivery \
+received_recipients \
+received_sender \
+smtp_confirmation \
+subject \
+smtp_incomplete_transaction \
-dnslist_defer \
-host_lookup_failed \
-queue_run \
-rejected_header \
-retry_defer \
-skip_delivery
syslog_duplication = false 

# ACL
acl_smtp_helo = acl_check_helo
acl_smtp_rcpt = acl_check_rcpt
acl_smtp_data = acl_smtp_data 

begin acl
acl_check_helo:
  # accetta se arriva da pipe local (no tcpip)
  accept hosts = :
  # accetta se arriva da un host lecito
  accept hosts = +relay_from_hosts
  # droppa se ricevo un ip come HELO
  drop condition = ${if match{$sender_helo_name}{^[0-9]\.[0-9]\.[0-9]\.[0-9]}{yes}{no}}
    message = Dropped IP-Only or IP-starting helo
  # helo non valido (RFC2821 4.1.3)
  drop condition = ${if isip{$sender_helo_name}}
    message = Access denied - Invalid HELO name (See RFC2821 4.1.3)
  # helo non fqdn
  drop condition = ${if match{$sender_helo_name}{\N^\[\N}{no}{yes}}
    condition = ${if match{$sender_helo_name}{\N\.\N}{no}{yes}}
    message = Access denied - Invalid HELO name (See RFC2821 4.1.1.1)
  drop condition = ${if match{$sender_helo_name}{\N\.$\N}}
    message = Access denied - Invalid HELO name (See RFC2821 4.1.1.1)
  drop condition = ${if match{$sender_helo_name}{\N\.\.\N}}
    message = Access denied - Invalid HELO name (See RFC2821 4.1.1.1)
  # helo col mio hostname
  drop message = "REJECTED - Bad HELO - Host impersonating [$sender_helo_name]"
    condition = ${if match{$sender_helo_name}{$primary_hostname}{yes}{no}}
  # helo con uno dei domini gestiti da me
  drop message = "REJECTED - Bad HELO - Host impersonating [$sender_helo_name]"
    condition = ${if match_domain{$sender_helo_name}{+local_domains}{true}{false}}
  # rate limit, max 1000 email per ora da un host
  defer message = Sender rate exceeds $sender_rate_limit messages per $sender_rate_period
    ratelimit = 1000 / 1h / per_conn / leaky / $sender_host_address
  accept 

acl_check_rcpt:
  warn message = X-SA-Do-Not-Rej: Yes
  local_parts = postmaster
  warn message = X-SA-Do-Not-Run: Yes
  hosts = +relay_from_hosts   

  # accetta se arriva da pipe locale (no tcpip)
  accept hosts  =:
  # nega il relay se l'indirizzo comincia con un .
  deny local_parts = ^.*[@%!/|] : ^\\.
  # i messaggi bounce da postmaster@ sono inviate solo ad un indirizzo
  drop message = Legitimate bounces are never sent to more than one recipient
    senders = : postmaster@*
    condition = ${if >{$recipient_count}{1}{true}{false}}
  # cancella se ci sono piu' di 5 destinazioni fallite
  drop message = REJECTED - Too many failed recipients
    log_message = REJECTED - Too many failed recipients - count = $rcpt_fail_count
    condition = ${if >{${eval:$rcpt_fail_count}}{5}{yes}{no}}
    !verify = recipient/callout=2m,defer_ok,use_sender

  # accetta tutte le mail per postmaster locali
  accept local_parts = postmaster
    domains = +local_domains

  # accetta le mail per i domini locali, dopo aver verificato il recipient
  accept domains = +local_domains
    endpass
    verify = recipient

  # accetta il relay to domains, verificando il recipient (e il sender)
  accept domains = +relay_to_domains
    endpass
    message = cannot verify sender
    verify = sender/no_details/defer_ok
    message = relay to $local_part@$domain not allowed
    verify = recipient/no_details/callout=use_postmaster,defer_ok

  # accetta se il relay e' consentito
  accept hosts = +relay_from_hosts

  # nega il resto
  deny message = relay not permitted

acl_smtp_data:
  # blocca se sia il soggetto che il testo sono vuoti
  deny message = REJECTED - No Subject nor body
    !condition = ${if def:h_Subject:}
    condition = ${if <{$body_linecount}{1}{true}{false}}
  accept hosts = +relay_from_hosts
  deny message = This message contains malformed MIME ($demime_reason)
    demime = *
    condition = ${if >{$demime_errorlevel}{2}}

  deny message = Mail contains blacklisted attachment (.$found_extension)
    demime = bat:com:exe:pif:prf:scr:vbs

  warn message = X-Spam-Score: $spam_score ($spam_bar)
    spam = mailnull:true
  warn message = X-Spam-Report: $spam_report
    spam = mailnull:true
  warn message = X-Spam-Flag: YES
    spam = mailnull:true
    condition = ${if >{$spam_score_int}{50}}

  deny message = This message scored $spam_score spam points.
    spam = mailnull:true
    condition = ${if >{$spam_score_int}{100}}

  deny message = This message contains a virus or other harmful content
    malware = *

  accept

begin routers
  redirect:
    driver = redirect
    data = ${lookup{$local_part@$domain}lsearch{/usr/local/etc/exim/mail-redirect}}

  internal:
    driver = manualroute
    domains = +relay_to_domains
    transport = remote_smtp
    route_data = ${lookup{$domain}partial-lsearch{/usr/local/etc/exim/remote-servers}}
    no_more

  external_gw:
    driver = dnslookup
    transport = remote_smtp
    domains = ! +local_domains
    no_more

  system_aliases:
    driver = redirect
    allow_fail
    allow_defer
    data = ${lookup{$local_part}lsearch{/etc/aliases}}
    user = mailnull
    group = mail
    local_part_suffix = +*
    local_part_suffix_optional
    headers_remove = Delivered-To
    headers_add = "Delivered-To: $local_part$local_part_suffix@$domain\n\
                X-Mail-Suffix: $local_part_suffix"
    file_transport = address_file
    pipe_transport = address_pipe

begin transports
  address_pipe:
    driver = pipe
    return_output

  address_file:
    driver = appendfile
    delivery_date_add
    envelope_to_add
    return_path_add

  address_reply:
    driver = autoreply

  remote_smtp:
    driver = smtp

begin retry
  *     *       F,5h,5m; G,16h,1h,1.5; F,4d,6h

Configurazione sistema

Il file /usr/local/etc/exim/domain è il file che specifica i domini per i quali accettiamo le email:

dominio1.tld
dominio2.tld

Il file /usr/local/etc/exim/remote-servers è il file che specifica gli mx per i domini per i quali accettiamo le email:

dominio1.tld: a.mx.dominio1.tld:b.mx.dominio1.tld
dominio2.tld: a.mx.dominio2.tld:b.mx.dominio2.tld

Il file /usr/local/etc/exim/mail-redirect è il file che specifica eventuali redirect:

abuse@dominio1.tld:web@dominio2.tld
postmaster@dominio2.tld:info@dominio1.tld

Aggiungere nel file /etc/newsyslog.conf:

/var/log/exim/mainlog     mailnull:mail 640  7     *    @T00  ZN
/var/log/exim/paniclog    mailnull:mail 640  7     *    @T00  ZN
/var/log/exim/rejectlog   mailnull:mail 640  7     *    @T00  ZN

Aggiungere nel file /etc/periodic.conf:

daily_status_include_submit_mailq="NO"
daily_clean_hoststat_enable="NO"

Aggiungere nel file /etc/rc.conf:

sendmail_enable="NONE"

Aggiungere nel file /etc/rc.conf.local:

exim_enable="YES"

FreeBSD 8 ha sostituito il vetusto device sio col più nuovo device uart (prestazioni migliori su device multiseriali).

Recentemente ho comprato delle schede MOXA multiseriali PCI Express mod. CP-168EL (qui il pdf).

Purtroppo facendo il boot di FreeBSD non venivano riconosciute le diverse porte /dev/ttyu*, e questo perché occorre caricare puc e uart entrambi come moduli o averli inseriti entrambi nel file di configurazione del kernel.