forum.lissyara.su

Код: Выделить всё

#!!# ACL that is used after the RCPT command
check_recipient:
  # Exim 3 had no checking on -bs messages, so for compatibility
  # we accept if the source is local SMTP (i.e. not over TCP/IP).
  # We do this by testing for an empty sending host field.
# Log all senders' rates
    warn ratelimit = 0 / 1h / strict
    log_message = Sender rate $sender_rate / $sender_rate_period

  accept  hosts = :

  accept hosts = +skipsmtpcheck_hosts


  # Accept bounces to lists even if callbacks or other checks would fail
  warn     message      = X-WhitelistedRCPT-nohdrfromcallback: Yes
           condition    = \
           ${if and {{match{$local_part}{(.*)-bounces\+.*}} \
                     {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}/config.pck}}} \
                {yes}{no}}

  accept   condition    = \
           ${if and {{match{$local_part}{(.*)-bounces\+.*}} \
                     {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}/config.pck}}} \
                {yes}{no}}


  # Accept bounces to lists even if callbacks or other checks would fail
  warn     message      = X-WhitelistedRCPT-nohdrfromcallback: Yes
           condition    = \
           ${if and {{match{$local_part}{(.*)-bounces\+.*}} \
                     {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}_${lc:$domain}/config.pck}}} \
                {yes}{no}}

  accept   condition    = \
           ${if and {{match{$local_part}{(.*)-bounces\+.*}} \
                     {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}_${lc:$domain}/config.pck}}} \
                {yes}{no}}

  #if it gets here it isn't mailman
# deny must be on the same line as hosts so it will get removed by buildeximconf if turned off
   deny  hosts = ! +senderverifybypass_hosts
        ! verify = sender/callout=60s

  accept  hosts = *
          authenticated = *


  #if they poped before smtp we just accept
  accept  condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/relayhosts}{1}{${if eq{$sender_host_address}{127.0.0.1}{1}{0}}}}
          add_header = ${if exists{/etc/eximpopbeforesmtpwarning}{${perl{popbeforesmtpwarn}{$sender_host_address}}{}}
  
  accept  hosts = +relay_hosts
          add_header = ${if exists{/etc/eximpopbeforesmtpwarning}{${perl{popbeforesmtpwarn}{$sender_host_address}}{}}

   #recipient verifications are now done after smtp auth and pop before smtp so the users get back bounces instead of 
   # a clogged outbox in outlook

 deny message = JunkMail rejected - $sender_fullhost is in an RBL, see $dnslist_text
     dnslists = zen.spamhaus.org : bl.spamcop.net
     hosts = +backupmx_hosts  

 warn 
     dnslists = zen.spamhaus.org : bl.spamcop.net
     set acl_m8 = 1
     set acl_m9 = "JunkMail rejected - $sender_fullhost is in an RBL, see $dnslist_text"
     

 warn
    condition = ${if eq {${acl_m8}}{1}{1}{0}}
    ratelimit = 0 / 1h / strict / per_conn
    log_message = "Increment Connection Ratelimit - $sender_fullhost because of RBL match"

 drop
    condition = ${if eq {${acl_m8}}{1}{1}{0}}
    message = ${acl_m9}



  warn
    log_message = "Detected Dictionary Attack (Let $rcpt_fail_count bad recipients though before engaging)"
    condition = ${if > {${eval:$rcpt_fail_count}}{4}{yes}{no}}
    set acl_m7 = 1

  warn
    condition = ${if eq {${acl_m7}}{1}{1}{0}}
    ratelimit = 0 / 1h / strict / per_conn
    log_message = "Increment Connection Ratelimit - $sender_fullhost because of Dictionary Attack"

  drop 
    condition = ${if eq {${acl_m7}}{1}{1}{0}}
    message = "Number of failed recipients exceeded.  Come back in a few hours."



#recipient verifications are required for all messages that are not sent to the local machine
  #this was done at multiple users requests
  require verify = recipient
    message = "The recipient cannot be verified.  Please check all recipients of this message to verify they are valid.  Details: $acl_verify_message"



# The only problem with this setup is that if the message is for multiple users on the same server
# and they are on different unix accounts, the settings for the first recipient which has spamassassin enabled will be used.
# This shouldn't be a problem 99.9% of the time, however its a very small price to pay for a massive speed increase.
  warn  domains = ! ${primary_hostname} : +local_domains
         condition = ${if <= {$message_size}{200K}{${if eq {${acl_m0}}{1}{0}{${if exists{/etc/global_spamassassin_enable}{1}{${if exists{${extract{5}{:}{${lookup{${lookup{$domain}lsearch*{/etc/userdomains}{$value}}}lsearch{/etc/passwd}{$value}}}}/.spamassassinenable}{1}{0}}}}}}}{0}}
         set acl_m0    = 1
         set acl_m1    = ${lookup{$domain}lsearch*{/etc/userdomains}{$value}}

  warn  domains = ${primary_hostname}
          condition = ${if <= {$message_size}{200K}{${if eq {${acl_m0}}{1}{0}{${if exists{/etc/global_spamassassin_enable}{1}{${if exists{${extract{5}{:}{${lookup{$local_part}lsearch{/etc/passwd}{$value}}}}/.spamassassinenable}{1}{0}}}}}}}{0}}
          set acl_m0    = 1
          set acl_m1    = $local_part


  accept  domains = +relay_domains

  deny    message = $sender_fullhost is currently not permitted to \
                        relay through this server. Perhaps you \
                        have not logged into the pop/imap server in the \
                        last 30 minutes or do not have SMTP Authentication turned on in your email client.

Код: Выделить всё

220-server2.*****.ru ESMTP Exim 4.69 #0 Sat, 13 Sep 2008 19:12:22 +0400
220-We do not authorize the use of this system to transport unsolicited,
220 and/or bulk e-mail.
helo mail.system-admin.ru
250 server2.******.ru Hello mail.system-admin.ru [193.19.134.96]
mail from:<>
250 OK
rcpt to:<******@rambler.ru>
250 Accepted
quit
221 server2.*****.ru closing connection

Код: Выделить всё

  accept  hosts = *
          authenticated = *

Код: Выделить всё

  accept  authenticated = *