The OpenNET Project / Index page

[ новости /+++ | форум | wiki | теги | ]

форумы  помощь  поиск  регистрация  майллист  вход/выход  слежка  RSS
"SMTP авторизация в Exim'е"
Вариант для распечатки  
Пред. тема | След. тема 
Форумы OpenNET: Виртуальная конференция (Public)
Изначальное сообщение [ Отслеживать ]

"SMTP авторизация в Exim'е"  
Сообщение от satelit on 25-Май-06, 05:47 
Доброго дня всем, начальство требует приделать к почте авторизацию на отправку сообщений, а у меня что-то не получается, может кто глянет что не так, почтовик Exim, вот кусок конфига:

acl_smtp_auth = acl_check_aut
- - - - . . . - - - -
acl_check_auth:
accept
    encrypted = *
accept
    condition = ${if eq{${uc:$smtp_command_argument}}{CRAM-MD5}}
deny
    message   = TLS encryption or CRAM-MD5 required

Пробовал вообще закомментировать весь раздел acl_check_auth, а ему без разницы, как принимал сообщения без авторизации, так и принимает.

Спасибо

Высказать мнение | Ответить | Правка | Cообщить модератору

 Оглавление

Сообщения по теме [Сортировка по времени | RSS]


1. "SMTP авторизация в Exim'е"  
Сообщение от pastorius (ok) on 25-Май-06, 06:49 
>Доброго дня всем, начальство требует приделать к почте авторизацию на отправку сообщений,
>а у меня что-то не получается, может кто глянет что не
>так, почтовик Exim, вот кусок конфига:
>
>acl_smtp_auth = acl_check_aut
>- - - - . . . - - - -
>acl_check_auth:
>accept
>    encrypted = *
>accept
>    condition = ${if eq{${uc:$smtp_command_argument}}{CRAM-MD5}}
>deny
>    message   = TLS encryption or CRAM-MD5
>required
>
>Пробовал вообще закомментировать весь раздел acl_check_auth, а ему без разницы, как принимал
>сообщения без авторизации, так и принимает.
>
>Спасибо


Аутентификаторы настроены?
Что выдаёт exim -bV ?

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

2. "SMTP авторизация в Exim'е"  
Сообщение от satelit on 25-Май-06, 07:30 
>
>Аутентификаторы настроены?
>Что выдаёт exim -bV ?

briz / # exim -bV
Exim version 4.60 #5 built 15-May-2006 20:09:41
Copyright (c) University of Cambridge 2005
Berkeley DB: Sleepycat Software: Berkeley DB 4.2.52: (December  3, 2003)
Support for: crypteq iconv() Perl OpenSSL move_frozen_messages Content_Scanning Old_Demime
Lookups: lsearch wildlsearch nwildlsearch iplsearch dbm dbmnz dnsdb mysql passwd
Authenticators: cram_md5 cyrus_sasl plaintext
Routers: accept dnslookup ipliteral manualroute queryprogram redirect
Transports: appendfile/maildir autoreply pipe smtp
Fixed never_users: 0
Configuration file is /etc/exim/configure

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

3. "SMTP авторизация в Exim'е"  
Сообщение от pastorius (ok) on 25-Май-06, 07:40 
>>
>>Аутентификаторы настроены?
>>Что выдаёт exim -bV ?
>
>briz / # exim -bV
>Exim version 4.60 #5 built 15-May-2006 20:09:41
>Copyright (c) University of Cambridge 2005
>Berkeley DB: Sleepycat Software: Berkeley DB 4.2.52: (December  3, 2003)
>Support for: crypteq iconv() Perl OpenSSL move_frozen_messages Content_Scanning Old_Demime
>Lookups: lsearch wildlsearch nwildlsearch iplsearch dbm dbmnz dnsdb mysql passwd
>Authenticators: cram_md5 cyrus_sasl plaintext
>Routers: accept dnslookup ipliteral manualroute queryprogram redirect
>Transports: appendfile/maildir autoreply pipe smtp
>Fixed never_users: 0
>Configuration file is /etc/exim/configure


/etc/exim/configure в студию!

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

4. "SMTP авторизация в Exim'е"  
Сообщение от satelit on 25-Май-06, 07:52 
>/etc/exim/configure в студию!


######################################################################
#                    MAIN CONFIGURATION SETTINGS                     #
######################################################################


primary_hostname = open.statist.komstat.alt.ru


qualify_domain = komstat.local

domainlist local_domains =  ${lookup mysql{SELECT domain FROM domains WHERE domain='${domain}' AND (type='LOCAL' OR type='VIRTUAL')}}
domainlist relay_to_domains = ${lookup mysql{SELECT domain FROM domains WHERE domain='${domain}' AND type='RELAY'}}
hostlist   relay_from_hosts = 127.0.0.1 : 192.168.0.0/16

SPAMHELO = /etc/exim/spam_helo

acl_smtp_auth = acl_check_auth
acl_smtp_connect = acl_check_connect
acl_smtp_helo = acl_check_helo
acl_smtp_rcpt = acl_check_rcpt
acl_smtp_data = acl_check_data
acl_smtp_mime = acl_check_mime

av_scanner = drweb:127.0.0.1 3000
#spamd_address = 127.0.0.1 783

never_users = root:daemon:bin

rfc1413_hosts = *
rfc1413_query_timeout = 0s

ignore_bounce_errors_after = 2d

timeout_frozen_after = 1d
message_size_limit = 50M
split_spool_directory = true
remote_max_parallel = 15

log_file_path = /var/log/exim/exim_%s.log
#log_selector = +all_parents +delivery_size +lost_incoming_connection +sender_on_delivery +received_recipients +received_sender +smtp_confirmation +smtp_syntax_error +smtp_protocol_error -queue_run
log_selector = +all

hide mysql_servers = 127.0.0.1/mail/postfix/postfix
smtp_accept_queue_per_connection = 1000
smtp_accept_max = 100

######################################################################
#                       ACL CONFIGURATION                            #
#         Specifies access control lists for incoming SMTP mail      #
######################################################################

begin acl

acl_check_connect:

warn
    set acl_c1    = ${lookup dnsdb{ptr=$sender_host_address}{$value}fail}
    hosts    = ! +relay_from_hosts
warn
    set acl_c2    = ${lookup{$acl_c1}nwildlsearch{SPAMHELO}{$value}fail}
    hosts    = ! +relay_from_hosts

accept

acl_check_helo:
accept

acl_check_auth:
accept
    encrypted = *
accept
    condition = ${if eq{${uc:$smtp_command_argument}}{CRAM-MD5}}
deny
    message   = TLS encryption or CRAM-MD5 required

acl_check_rcpt:

accept  hosts = :


deny    condition = ${if def:acl_c2{yes}{no}}
    hosts = ! +relay_from_hosts
    message = ptr blocked by postmaster: $acl_c2

warn    set acl_m0=${lookup{$sender_helo_name}nwildlsearch{SPAMHELO}{$value}fail}

deny    condition = ${if def:acl_m0{yes}{no}}
    hosts = ! +relay_from_hosts
    message = helo blocked by postmaster: $acl_m0

deny    message         = Restricted characters in address
        domains         = !+local_domains
        local_parts     = ^[./|] : ^.*[@%!] : ^.*/\\.\\./

accept  local_parts   = postmaster
        domains       = +local_domains

require verify        = sender

accept  domains         = +local_domains
        endpass
        message         = unknown user
        verify          = recipient

accept  domains = +relay_to_domains
        endpass
        message = unrouteable address
        verify  = recipient

###################################################################
#               Verify header of letter                           #
#       HELO,sender,header_syntax,host,name                       #
#       If condition is spam then delay delivery is more          #
###################################################################

deny    message         = HELO/EHLO required by SMTP RFC
        !hosts          = +relay_from_hosts
        condition       = ${if eq{$sender_helo_name}{}{yes}{no}}

warn
        set acl_m0 = 0s

warn
        hosts = !+relay_from_hosts:!195.14.56.0/24:!192.168.0.0/16
        set acl_m0 = 30s

warn
        condition = ${if and {{match{$sender_host_name}{\N^[-a-z]*\d{0,3}[-a-z]*\.?[-a-z]*\d{0,3}[-a-z]*\.\w+$\N}}{!eq{$acl_c0}{outblaze_helo}}}{yes}{no}}
        set acl_m0 = 1s

warn
        condition = ${if and {{match{$sender_helo_name}{\N^\w*\.\w{3}$\N}}{eq{$acl_c1}{}}}{yes}{no}}
        set acl_m0 = 99s

warn
        condition = ${if and {{!match{$sender_host_name}{\N.+.outblaze.com$\N}}{eq{$acl_c0}{outblaze_helo}}}{yes}{no}}
        set acl_m0 = 99s

warn
        condition = ${if and {{!match{$sender_host_name}{\N.+.outblaze.com$\N}}{eq{$acl_c2}{outblaze_domain}}}{yes}{no}}
        set acl_m0 = 99s

warn
        condition = ${if or {{eq{$sender_address}{}}{eq{$acl_m1}{0s}}} {yes}{no}}
        set acl_m0 = 0s

warn
        logwrite = Delay $acl_m0 for $sender_host_name [$sender_host_address] with HELO=$sender_helo_name. Mail from $sender_address to $local_part@$domain.
        set acl_m1 = 0s
        delay = $acl_m0

accept  hosts         = +relay_from_hosts
accept  authenticated = *
control = submission/sender_retain
deny    message       = relay not permitted

acl_check_mime:

deny   message         = Your message contain deny file extention!
       condition       = ${if match {${lc:$mime_filename}}{\N(\.exe|\.cpl|\.pif|\.bat|\.scr|\.lnk|\.com|\.reg|\.dll|\.bin|\.cmd|\.chm|\.hlp|\.ocx|\.sys|\.sh|\.url|\.pl|\.vb|\.vbe|\.vbs|\.rc|\.uu|\.mim|\.pif|\.hta)$\N}{1}{0}}

accept

acl_check_data:

#################################################################################
#               Scan data                                                #
#################################################################################
deny    message = Your address is blocked!
        senders = ${lookup mysql{SELECT sender FROM wrong_sender WHERE sender='${quote_mysql:$sender_address}' OR sender='*@${quote_mysql:$sender_address_domain}'}}
#################################################################################
#               DrWeb Ativirus Configuration                                    #
#       This work if av_scanner option is on only                               #
#################################################################################
deny    malware         = *
        message         = This message contains a virus ($malware_name).
#################################################################################
#################################################################################
#               SpamAssassin Configuration                                      #
#       Ignoring "Relay_from_hosts" and "Local_domains"                         #
#################################################################################
warn    message         = X-Spam-Report: $spam_report\nX-Spam-Score:$spam_score\nX-Spam-Score-Int:$spam_score_int
        condition       = ${if <{$message_size}{200k}{1}{0}}
        ! hosts         = +relay_from_hosts
        spam            = spamd:true

deny    message         = We don't need your spam!
        !hosts          = +relay_from_hosts
        condition       = ${if >{$spam_score_int}{100}{1}{0}}
#################################################################################
accept

######################################################################
#                      ROUTERS CONFIGURATION                         #
#               Specifies how addresses are handled                  #
######################################################################
#     THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT!       #
# An address is passed to each router in turn until it is accepted.  #
######################################################################

begin routers

dnslookup:
    driver = dnslookup
    domains = ! +local_domains
    transport = remote_smtp
    ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
    no_more

spamd_router:
    no_verify
    driver = redirect
    condition = ${if and{{!eq{} {${lookup mysql{SELECT home FROM users WHERE id='${local_part}' AND mbox_host='${domain}' AND active='Y'}}}}{and{{def:spam_score_int}{>{$spam_score_int}{55}}}}}{1}{0}}
    data = spamtrap

system_aliases:
    driver = redirect
    allow_fail
    allow_defer
    data = ${lookup mysql{SELECT recipients FROM aliases WHERE local_part='${local_part}' AND domain='${domain}'}}
    file_transport = address_file
    pipe_transport = address_pipe

mysqluser:
    driver = accept
    condition = ${if eq{} {${lookup mysql{SELECT home FROM users WHERE id='${local_part}' AND mbox_host='${domain}' AND active='Y'}}}{no}{yes}}
    transport = mysql_delivery
    cannot_route_message = Unknown or unactive user

######################################################################
#                      TRANSPORTS CONFIGURATION                      #
######################################################################
#                       ORDER DOES NOT MATTER                        #
#     Only one appropriate transport is called for each delivery.    #
######################################################################

begin transports

remote_smtp:
  driver = smtp

mysql_delivery:
    driver = appendfile
    check_string = ""
    create_directory
    delivery_date_add
    directory = ${lookup mysql{SELECT CONCAT(home, "/Maildir") FROM users WHERE id='${local_part}' AND mbox_host='${domain}'}}
    directory_mode = 770
#    create_directory
    envelope_to_add
    user = _exim
    group = _exim
    maildir_format
    maildir_tag = ,S=$message_size
    message_prefix = ""
    message_suffix = ""
    mode = 0640
    quota = ${lookup mysql{SELECT quota FROM users WHERE id='${local_part}' AND mbox_host='${domain}'} {${value}M}}
    quota_size_regex = S= (\d+)$
    quota_warn_threshold = 75%
    return_path_add

address_pipe:
  driver = pipe
  return_output

address_file:
  driver = appendfile
  delivery_date_add
  envelope_to_add
  return_path_add

address_reply:
  driver = autoreply

######################################################################
#                      RETRY CONFIGURATION                           #
######################################################################

begin retry

# This single retry rule applies to all domains and all errors. It specifies
# retries every 15 minutes for 2 hours, then increasing retry intervals,
# starting at 1 hour and increasing each time by a factor of 1.5, up to 16
# hours, then retries every 6 hours until 4 days have passed since the first
# failed delivery.

# Address or Domain    Error       Retries
# -----------------    -----       -------

*                      *           F,2h,15m; G,16h,1h,1.5; F,4d,6h


######################################################################
#                      REWRITE CONFIGURATION                         #
######################################################################

# There are no rewriting specifications in this default configuration file.

begin rewrite

######################################################################
#                   AUTHENTICATION CONFIGURATION                     #
######################################################################

# There are no authenticator specifications in this default configuration file.

begin authenticators

auth_plain:
  driver = plaintext
  public_name = PLAIN
  server_condition = ${lookup mysql{SELECT id FROM users WHERE id='${quote_mysql:${local_part:$2}}' AND mbox_host='${quote_mysql:${domain:$2}}' AND passwd='${quote_mysql:$3}' AND active='Y'} {yes} {no}}
  server_prompts = :
  server_set_id = $2

auth_login:
  driver = plaintext
  public_name = LOGIN
  server_condition = ${lookup mysql{SELECT id FROM users WHERE id='${quote_mysql:${local_part:$1}}' AND mbox_host='${quote_mysql:${domain:$1}}' AND passwd='${quote_mysql:$2}' AND active='Y'} {yes} {no}}
  server_prompts = Username:: : Password::
  server_set_id = $1

auth_cram_md5:
  driver = cram_md5
  public_name = CRAM-MD5
  server_secret = ${lookup mysql{SELECT passwd FROM users WHERE id='${quote_mysql:${local_part:$1}}' AND mbox_host='${quote_mysql:${domain:$1}}' AND active='Y'} {yes} {no}}
  server_set_id = $1

######################################################################
#                   CONFIGURATION FOR local_scan()                   #
######################################################################

# If you have built Exim to include a local_scan() function that contains
# tables for private options, you can define those options here. Remember to
# uncomment the "begin" line. It is commented by default because it provokes
# an error with Exim binaries that are not built with LOCAL_SCAN_HAS_OPTIONS
# set in the Local/Makefile.

# begin local_scan


# End of Exim configuration file

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

7. "SMTP авторизация в Exim'е"  
Сообщение от pastorius (ok) on 25-Май-06, 08:25 
>Authenticators: cram_md5 cyrus_sasl plaintext

Попробуй копнуть в эту сторону http://exim.org/exim-html-4.62/doc/html/spec_html/ch36.html
Saslauthd установлен и настроен на smtp аутентификацию?

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

9. "SMTP авторизация в Exim'е"  
Сообщение от satelit on 25-Май-06, 08:31 
>>Authenticators: cram_md5 cyrus_sasl plaintext
>
>Попробуй копнуть в эту сторону http://exim.org/exim-html-4.62/doc/html/spec_html/ch36.html
>Saslauthd установлен и настроен на smtp аутентификацию?

Мне достаточно и PLAIN авторизации, чтобы брал логин и пароль из базы.

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

20. "SMTP авторизация в Exim'е"  
Сообщение от satelit on 29-Май-06, 05:42 
>>Authenticators: cram_md5 cyrus_sasl plaintext
>
>Попробуй копнуть в эту сторону http://exim.org/exim-html-4.62/doc/html/spec_html/ch36.html
>Saslauthd установлен и настроен на smtp аутентификацию?

А можно поподробней?

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

5. "SMTP авторизация в Exim'е"  
Сообщение от Александр (??) on 25-Май-06, 08:18 
>Доброго дня всем, начальство требует приделать к почте авторизацию на отправку сообщений,
>а у меня что-то не получается, может кто глянет что не

может, я не прав, но под авторизацией я понимаю указание логина и пароля

для этого в конфиге exim существует раздел AUTHENTICATION CONFIGURATIONS
вот кусок конфига (из http://www.opennet.ru/base/net/exim_setup.txt.html)

        begin authenticators

        auth_plain:
           driver = plaintext
           public_name = PLAIN
           server_condition = ${lookup mysql{SELECT id FROM users \
                         WHERE id = '${quote_mysql:${local_part:$2}}' \
                         AND mbox_host = '${quote_mysql:${domain:$2}}' \
                         AND passwd = '${quote_mysql:$3}' \
                         AND active = 'Y'}{yes}{no}}
           server_prompts = :
           server_set_id = $2

        auth_login:
           driver = plaintext
           public_name = LOGIN
           server_condition = ${lookup mysql{SELECT id FROM users \
                         WHERE id = '${quote_mysql:${local_part:$1}}' \
                         AND mbox_host = '${quote_mysql:${domain:$1}}' \
                         AND passwd = '${quote_mysql:$2}' \
                         AND active = 'Y'}{yes}{no}}
           server_prompts = Username:: : Password::
           server_set_id = $1

        auth_cram_md5:
           driver = cram_md5
           public_name = CRAM-MD5
           server_secret = ${lookup mysql{SELECT passwd FROM users \
                         WHERE id = '${quote_mysql:${local_part:$1}}' \
                         AND mbox_host = '${quote_mysql:${domain:$1}}' \
                         AND active = 'Y'}{$value}fail}
           server_set_id = $1


список разрешенных хостов из hostlist relay_from_hosts ликвидировать (можно оставить localhost)
в настройках SMTP сервера почтового клиента необходимо указать, что для отправки почты требуется логин и пароль

Это то, что Вам требуется???

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

6. "SMTP авторизация в Exim'е"  
Сообщение от satelit on 25-Май-06, 08:22 

>Это то, что Вам требуется???

Требуется простая вещь, чтобы отправить почту, надо ввести пароль (устроит даже PLAIN), только вот не могу понять смысл в авторизации, если её можно отключить на клиенте?.

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

10. "SMTP авторизация в Exim'е"  
Сообщение от Александр (??) on 25-Май-06, 08:31 
>
>>Это то, что Вам требуется???
>
>Требуется простая вещь, чтобы отправить почту, надо ввести пароль (устроит даже PLAIN),
>только вот не могу понять смысл в авторизации, если её можно
>отключить на клиенте?.

если отправка почты с какого-то конкретного хоста через данный SMTP сервер НЕ РАЗРЕШЕНА,
то клиенту воленс-неволенс придется указать логин-пароль

У Вас --> hostlist   relay_from_hosts = 127.0.0.1 : 192.168.0.0/16
оставьте только 127.0.0.1

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

11. "SMTP авторизация в Exim'е"  
Сообщение от TR on 25-Май-06, 08:34 
>
>>Это то, что Вам требуется???
>
>Требуется простая вещь, чтобы отправить почту, надо ввести пароль (устроит даже PLAIN),
>только вот не могу понять смысл в авторизации, если её можно
>отключить на клиенте?.
Я думаю так. Авторизация не прокатывает со стороны клиентов для которых открыт релей, но если этим клиентам релей вырубить, то они письмо кроме как без авторизации отправить не смогут. Плюс можно будет отправить письмо на свой же домен, тоже без авторизации.
Поправьте если гоню.
ИМХО smtp польный сакс, думаю сообществу пора уже задуматься о другом протоколе более безопасном. Нужен такой протокол, который будет не по зубам спамерам.

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

8. "SMTP авторизация в Exim'е"  
Сообщение от satelit on 25-Май-06, 08:29 
Превратил
hostlist   relay_from_hosts = 127.0.0.1 : 192.168.0.0/16
в
hostlist   relay_from_hosts = 127.0.0.1
а ему поровну, как принимал почту с подсети 192,168,0,0 так и принимает и доставляет ??
Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

12. "SMTP авторизация в Exim'е"  
Сообщение от Александр (??) on 25-Май-06, 08:46 
>Превратил
>hostlist   relay_from_hosts = 127.0.0.1 : 192.168.0.0/16

>hostlist   relay_from_hosts = 127.0.0.1
>а ему поровну, как принимал почту с подсети 192,168,0,0 так и принимает
>и доставляет ??

сделайте рестарт exim

ну ежли не поможет, могу выкатить свой конфиг, у меня данная опция работает

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

13. "SMTP авторизация в Exim'е"  
Сообщение от satelit on 25-Май-06, 08:52 
>
>сделайте рестарт exim
>
Разумеется сделал.
>
>ну ежли не поможет, могу выкатить свой конфиг, у меня данная опция работает
>
Было бы интересно посмотреть.

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

14. "SMTP авторизация в Exim'е"  
Сообщение от Александр (??) on 25-Май-06, 09:01 
>>ну ежли не поможет, могу выкатить свой конфиг, у меня данная опция работает
>>
>Было бы интересно посмотреть.


######################################################################
#                    MAIN CONFIGURATION SETTINGS                     #
######################################################################

hide pgsql_servers = (/tmp/.s.PGSQL.5432)/mail/mailuser/crossword

######################################################################

# Specify your host's canonical name here. This should normally be the fully
# qualified "official" name of your host. If this option is not set, the
# uname() function is called to obtain the name. In many cases this does
# the right thing and you need not set anything explicitly.

primary_hostname = local.net

# The next three settings create two lists of domains and one list of hosts.
# These lists are referred to later in this configuration using the syntax
# +local_domains, +relay_to_domains, and +relay_from_hosts, respectively. They
# are all colon-separated lists:

domainlist local_domains = local.net
domainlist relay_to_domains =
hostlist   relay_from_hosts = localhost

# Most straightforward access control requirements can be obtained by
# appropriate settings of the above options. In more complicated situations,
# you may need to modify the Access Control List (ACL) which appears later in
# this file.

# The first setting specifies your local domains, for example:
#
#   domainlist local_domains = my.first.domain : my.second.domain
#
# You can use "@" to mean "the name of the local host", as in the default
# setting above. This is the name that is specified by primary_hostname,
# as specified above (or defaulted). If you do not want to do any local
# deliveries, remove the "@" from the setting above. If you want to accept mail
# addressed to your host's literal IP address, for example, mail addressed to
# "user@[192.168.23.44]", you can add "@[]" as an item in the local domains
# list. You also need to uncomment "allow_domain_literals" below. This is not
# recommended for today's Internet.

# The second setting specifies domains for which your host is an incoming relay.
# If you are not doing any relaying, you should leave the list empty. However,
# if your host is an MX backup or gateway of some kind for some domains, you
# must set relay_to_domains to match those domains. For example:
#
# domainlist relay_to_domains = *.myco.com : my.friend.org
#
# This will allow any host to relay through your host to those domains.
# See the section of the manual entitled "Control of relaying" for more
# information.

# The third setting specifies hosts that can use your host as an outgoing relay
# to any other host on the Internet. Such a setting commonly refers to a
# complete local network as well as the localhost. For example:
#
# hostlist relay_from_hosts = 127.0.0.1 : 192.168.0.0/16
#
# The "/16" is a bit mask (CIDR notation), not a number of hosts. Note that you
# have to include 127.0.0.1 if you want to allow processes on your host to send
# SMTP mail by using the loopback address. A number of MUAs use this method of
# sending mail.

# All three of these lists may contain many different kinds of item, including
# wildcarded names, regular expressions, and file lookups. See the reference
# manual for details. The lists above are used in the access control lists for
# checking incoming messages. The names of these ACLs are defined here:

acl_smtp_rcpt = acl_check_rcpt
# acl_smtp_mime = acl_check_mime
acl_smtp_data = acl_check_data

# You should not change those settings until you understand how ACLs work.

# If you are running a version of Exim that was compiled with the content-
# scanning extension, you can cause incoming messages to be automatically
# scanned for viruses. You have to modify the configuration in two places to
# set this up. The first of them is here, where you define the interface to
# your scanner. This example is typical for ClamAV; see the manual for details
# of what to set for other virus scanners. The second modification is in the
# acl_check_data access control list (see below).

av_scanner = clamd:/var/run/clamav/clamd

# For spam scanning, there is a similar option that defines the interface to
# SpamAssassin. You do not need to set this if you are using the default, which
# is shown in this commented example. As for virus scanning, you must also
# modify the acl_check_data access control list to enable spam scanning.

spamd_address = 127.0.0.1 783

# Specify the domain you want to be added to all unqualified addresses
# here. An unqualified address is one that does not contain an "@" character
# followed by a domain. For example, "caesar@rome.example" is a fully qualified
# address, but the string "caesar" (i.e. just a login name) is an unqualified
# email address. Unqualified addresses are accepted only from local callers by
# default. See the recipient_unqualified_hosts option if you want to permit
# unqualified addresses from remote sources. If this option is not set, the
# primary_hostname value is used for qualification.

qualify_domain = local.net

# If you want unqualified recipient addresses to be qualified with a different
# domain to unqualified sender addresses, specify the recipient domain here.
# If this option is not set, the qualify_domain value is used.

# qualify_recipient =

# The following line must be uncommented if you want Exim to recognize
# addresses of the form "user@[10.11.12.13]" that is, with a "domain literal"
# (an IP address) instead of a named domain. The RFCs still require this form,
# but it makes little sense to permit mail to be sent to specific hosts by
# their IP address in the modern Internet. This ancient format has been used
# by those seeking to abuse hosts by using them for unwanted relaying. If you
# really do want to support domain literals, uncomment the following line, and
# see also the "domain_literal" router below.

# allow_domain_literals

# No deliveries will ever be run under the uids of these users (a colon-
# separated list). An attempt to do so causes a panic error to be logged, and
# the delivery to be deferred. This is a paranoic safety catch. There is an
# even stronger safety catch in the form of the FIXED_NEVER_USERS setting
# in the configuration for building Exim. The list of users that it specifies
# is built into the binary, and cannot be changed. The option below just adds
# additional users to the list. The default for FIXED_NEVER_USERS is "root",
# but just to be absolutely sure, the default here is also "root".

# Note that the default setting means you cannot deliver mail addressed to root
# as if it were a normal user. This isn't usually a problem, as most sites have
# an alias for root that redirects such mail to a human administrator.

exim_user = mailnull
exim_group = mail
never_users = root

###

spool_directory = /var/spool/exim

# The setting below causes Exim to do a reverse DNS lookup on all incoming
# IP calls, in order to get the true host name. If you feel this is too
# expensive, you can specify the networks for which a lookup is done, or
# remove the setting entirely.

host_lookup = *

# The settings below, which are actually the same as the defaults in the
# code, cause Exim to make RFC 1413 (ident) callbacks for all incoming SMTP
# calls. You can limit the hosts to which these calls are made, and/or change
# the timeout that is used. If you set the timeout to zero, all RFC 1413 calls
# are disabled. RFC 1413 calls are cheap and can provide useful information
# for tracing problem messages, but some hosts and firewalls have problems
# with them. This can result in a timeout instead of an immediate refused
# connection, leading to delays on starting up an SMTP session.

rfc1413_hosts = *
rfc1413_query_timeout = 30s

# By default, Exim expects all envelope addresses to be fully qualified, that
# is, they must contain both a local part and a domain. If you want to accept
# unqualified addresses (just a local part) from certain hosts, you can specify
# these hosts by setting one or both of
#
# sender_unqualified_hosts =
# recipient_unqualified_hosts =
#
# to control sender and recipient addresses, respectively. When this is done,
# unqualified addresses are qualified using the settings of qualify_domain
# and/or qualify_recipient (see above).

# If you want Exim to support the "percent hack" for certain domains,
# uncomment the following line and provide a list of domains. The "percent
# hack" is the feature by which mail addressed to x%y@z (where z is one of
# the domains listed) is locally rerouted to x@y and sent on. If z is not one
# of the "percent hack" domains, x%y is treated as an ordinary local part. This
# hack is rarely needed nowadays; you should not enable it unless you are sure
# that you really need it.
#
# percent_hack_domains =
#
# As well as setting this option you will also need to remove the test
# for local parts containing % in the ACL definition below.

# When Exim can neither deliver a message nor return it to sender, it "freezes"
# the delivery error message (aka "bounce message"). There are also other
# circumstances in which messages get frozen. They will stay on the queue for
# ever unless one of the following options is set.

# This option unfreezes frozen bounce messages after two days, tries
# once more to deliver them, and ignores any delivery failures.

ignore_bounce_errors_after = 2d

# This option cancels (removes) frozen messages that are older than a week.

timeout_frozen_after = 7d

######################################################################

daemon_smtp_ports = 25 : 465

smtp_accept_max = 50
smtp_accept_max_per_host = 25
smtp_accept_max_per_connection = 50
smtp_connect_backlog = 50

check_spool_space = 64M
message_size_limit = 8M

log_selector = \
  +all_parents \
  +lost_incoming_connection \
  +received_sender \
  +received_recipients \
  +smtp_confirmation \
  +smtp_syntax_error \
  +smtp_protocol_error \
  -queue_run

auth_advertise_hosts = ${if eq{$tls_cipher}{}{}{*}}

tls_advertise_hosts = *
tls_verify_certificates = *

tls_certificate = /usr/local/certs/smtp.crt
tls_privatekey = /usr/local/certs/smtp.key

tls_on_connect_ports = 465

######################################################################
#                       ACL CONFIGURATION                            #
#         Specifies access control lists for incoming SMTP mail      #
######################################################################

begin acl

# This access control list is used for every RCPT command in an incoming
# SMTP message. The tests are run in order until the address is either
# accepted or denied.

acl_check_rcpt:

  # Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
  # testing for an empty sending host field.

  accept  hosts = :

  #############################################################################
  # The following section of the ACL is concerned with local parts that contain
  # @ or % or ! or / or | or dots in unusual places.
  #
  # The characters other than dots are rarely found in genuine local parts, but
  # are often tried by people looking to circumvent relaying restrictions.
  # Therefore, although they are valid in local parts, these rules lock them
  # out, as a precaution.
  #
  # Empty components (two dots in a row) are not valid in RFC 2822, but Exim
  # allows them because they have been encountered. (Consider local parts
  # constructed as "firstinitial.secondinitial.familyname" when applied to
  # someone like me, who has no second initial.) However, a local part starting
  # with a dot or containing /../ can cause trouble if it is used as part of a
  # file name (e.g. for a mailing list). This is also true for local parts that
  # contain slashes. A pipe symbol can also be troublesome if the local part is
  # incorporated unthinkingly into a shell command line.
  #
  # Two different rules are used. The first one is stricter, and is applied to
  # messages that are addressed to one of the local domains handled by this
  # host. The line "domains = +local_domains" restricts it to domains that are
  # defined by the "domainlist local_domains" setting above. The rule  blocks
  # local parts that begin with a dot or contain @ % ! / or |. If you have
  # local accounts that include these characters, you will have to modify this
  # rule.

  deny    message       = Restricted characters in address
          domains       = +local_domains
          local_parts   = ^[.] : ^.*[@%!/|]

  # The second rule applies to all other domains, and is less strict. The line
  # "domains = !+local_domains" restricts it to domains that are NOT defined by
  # the "domainlist local_domains" setting above. The exclamation mark is a
  # negating operator. This rule allows your own users to send outgoing
  # messages to sites that use slashes and vertical bars in their local parts.
  # It blocks local parts that begin with a dot, slash, or vertical bar, but
  # allows these characters within the local part. However, the sequence /../
  # is barred. The use of @ % and ! is blocked, as before. The motivation here
  # is to prevent your users (or your users' viruses) from mounting certain
  # kinds of attack on remote sites.

  deny    message       = Restricted characters in address
          domains       = !+local_domains
          local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
  #############################################################################

  # Accept mail to postmaster in any local domain, regardless of the source,
  # and without verifying the sender.

  accept  local_parts   = postmaster
          domains       = +local_domains

  # Deny unless the sender address can be verified.

  require verify        = sender

  # Accept if the message comes from one of the hosts for which we are an
  # outgoing relay. It is assumed that such hosts are most likely to be MUAs,
  # so we set control=submission to make Exim treat the message as a
  # submission. It will fix up various errors in the message, for example, the
  # lack of a Date: header line. If you are actually relaying out out from
  # MTAs, you may want to disable this. If you are handling both relaying from
  # MTAs and submissions from MUAs you should probably split them into two
  # lists, and handle them differently.

  # Recipient verification is omitted here, because in many cases the clients
  # are dumb MUAs that don't cope well with SMTP error responses. If you are
  # actually relaying out from MTAs, you should probably add recipient
  # verification here.

  # Note that, by putting this test before any DNS black list checks, you will
  # always accept from these hosts, even if they end up on a black list. The
  # assumption is that they are your friends, and if they get onto a black
  # list, it is a mistake.

  accept  hosts         = +relay_from_hosts
          control       = submission

  # Accept if the message arrived over an authenticated connection, from
  # any host. Again, these messages are usually from MUAs, so recipient
  # verification is omitted, and submission mode is set. And again, we do this
  # check before any black list tests.

  accept  authenticated = *
          control       = submission

  #############################################################################
  # There are no default checks on DNS black lists because the domains that
  # contain these lists are changing all the time. However, here are two
  # examples of how you can get Exim to perform a DNS black list lookup at this
  # point. The first one denies, whereas the second just warns.
  #
  # deny    message       = rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text
  #         dnslists      = black.list.example
  #
  # warn    message       = X-Warning: $sender_host_address is in a black list at $dnslist_domain
  #         log_message   = found in $dnslist_domain
  #         dnslists      = black.list.example
  #############################################################################

  #############################################################################
  # This check is commented out because it is recognized that not every
  # sysadmin will want to do it. If you enable it, the check performs
  # Client SMTP Authorization (csa) checks on the sending host. These checks
  # do DNS lookups for SRV records. The CSA proposal is currently (May 2005)
  # an Internet draft. You can, of course, add additional conditions to this
  # ACL statement to restrict the CSA checks to certain hosts only.
  #
  # require verify = csa
  #############################################################################

  # Accept if the address is in a local domain, but only if the recipient can
  # be verified. Otherwise deny. The "endpass" line is the border between
  # passing on to the next ACL statement (if tests above it fail) or denying
  # access (if tests below it fail).

  accept  domains       = +local_domains
          endpass
          verify        = recipient

  # Accept if the address is in a domain for which we are an incoming relay,
  # but again, only if the recipient can be verified.

  accept  domains       = +relay_to_domains
          endpass
          verify        = recipient

  # Reaching the end of the ACL causes a "deny", but we might as well give
  # an explicit message.

  deny    message       = relay not permitted


# This ACL is used after the contents of a message have been received. This
# is the ACL in which you can test a message's headers or body, and in
# particular, this is where you can invoke external virus or spam scanners.
# Some suggested ways of configuring these tests are shown below, commented
# out. Without any tests, this ACL accepts all messages. If you want to use
# such tests, you must ensure that Exim is compiled with the content-scanning
# extension (WITH_CONTENT_SCAN=yes in Local/Makefile).

acl_check_data:

  # Deny if the message contains a virus. Before enabling this check, you
  # must install a virus scanner and set the av_scanner option above.

  deny    malware   = *
          message   = This message contains a virus ($malware_name).

  # Add headers to a message if it is judged to be spam. Before enabling this,
  # you must install SpamAssassin. You may also need to set the spamd_address
  # option above.
  #
  # warn    spam      = nobody
  #         message   = X-Spam_score: $spam_score\n\
  #                     X-Spam_score_int: $spam_score_int\n\
  #                     X-Spam_bar: $spam_bar\n\
  #                     X-Spam_report: $spam_report

  warn  message = X-Spam-Score: $spam_score ($spam_bar)
        hosts   = !+relay_from_hosts
        spam    = nobody:true

  warn  message = X-Spam-Report: $spam_report
        hosts   = !+relay_from_hosts
        spam    = nobody:true

  warn  message = Subject: ***SPAM*** $h_Subject:
        hosts   = !+relay_from_hosts
        spam    = nobody

  deny  message = This message scored $spam_score spam points.
        spam    = nobody:true
        hosts   = !+relay_from_hosts
        condition = ${if >{$spam_score_int}{120}{1}{0}}

  # Accept the message.

  accept

  #####################

#acl_check_auth:
#
#  accept  encrypted = *
#
#  deny    message = TLS encryption or CRAM-MD5 required

######################################################################
#                      ROUTERS CONFIGURATION                         #
#               Specifies how addresses are handled                  #
######################################################################
#     THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT!       #
# An address is passed to each router in turn until it is accepted.  #
######################################################################

begin routers


  #####################

smart_route:
  driver = manualroute
  domains = ! +local_domains
  transport = remote_smtp
  route_list = * smart.local.net

# This router routes to remote hosts over SMTP by explicit IP address,
# when an email address is given in "domain literal" form, for example,
# <user@[192.168.35.64]>. The RFCs require this facility. However, it is
# little-known these days, and has been exploited by evil people seeking
# to abuse SMTP relays. Consequently it is commented out in the default
# configuration. If you uncomment this router, you also need to uncomment
# allow_domain_literals above, so that Exim can recognize the syntax of
# domain literal addresses.

# domain_literal:
#   driver = ipliteral
#   domains = ! +local_domains
#   transport = remote_smtp

# This router routes addresses that are not in local domains by doing a DNS
# lookup on the domain name. The exclamation mark that appears in "domains = !
# +local_domains" is a negating operator, that is, it can be read as "not". The
# recipient's domain must not be one of those defined by "domainlist
# local_domains" above for this router to be used.
#
# If the router is used, any domain that resolves to 0.0.0.0 or to a loopback
# interface address (127.0.0.0/8) is treated as if it had no DNS entry. Note
# that 0.0.0.0 is the same as 0.0.0.0/32, which is commonly treated as the
# local host inside the network stack. It is not 0.0.0.0/0, the default route.
# If the DNS lookup fails, no further routers are tried because of the no_more
# setting, and consequently the address is unrouteable.

# dnslookup:
#   driver = dnslookup
#   domains = ! +local_domains
#   transport = remote_smtp
#   ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
#   no_more

# The remaining routers handle addresses in the local domain(s), that is those
# domains that are defined by "domainlist local_domains" above.

# This router handles aliasing using a linearly searched alias file with the
# name /etc/aliases. When this configuration is installed automatically,
# the name gets inserted into this file from whatever is set in Exim's
# build-time configuration. The default path is the traditional /etc/aliases.
# If you install this configuration by hand, you need to specify the correct
# path in the "data" setting below.
#
##### NB  You must ensure that the alias file exists. It used to be the case
##### NB  that every Unix had that file, because it was the Sendmail default.
##### NB  These days, there are systems that don't have it. Your aliases
##### NB  file should at least contain an alias for "postmaster".
#
# If any of your aliases expand to pipes or files, you will need to set
# up a user and a group for these deliveries to run under. You can do
# this by uncommenting the "user" option below (changing the user name
# as appropriate) and adding a "group" option if necessary. Alternatively, you
# can specify "user" on the transports that are used. Note that the transports
# listed below are the same as are used for .forward files; you might want
# to set up different ones for pipe and file deliveries from aliases.

# system_aliases:
#   driver = redirect
#   allow_fail
#   allow_defer
#   data = ${lookup{$local_part}lsearch{/etc/aliases}}
#   user = mailnull
#   group = mail
#   file_transport = address_file
#   pipe_transport = address_pipe

system_aliases:
  driver = redirect
  allow_fail
  allow_defer
  data = ${lookup pgsql{SELECT alias FROM aliases \
    WHERE mail='$local_part@$domain'}{$value}fail}
  user = mailnull
  group = mail
  file_transport = address_file
  pipe_transport = address_pipe

# This router handles forwarding using traditional .forward files in users'
# home directories. If you want it also to allow mail filtering when a forward
# file starts with the string "# Exim filter" or "# Sieve filter", uncomment
# the "allow_filter" option.

# If you want this router to treat local parts with suffixes introduced by "-"
# or "+" characters as if the suffixes did not exist, uncomment the two local_
# part_suffix options. Then, for example, xxxx-foo@your.domain will be treated
# in the same way as xxxx@your.domain by this router. You probably want to make
# the same change to the localuser router.

# The no_verify setting means that this router is skipped when Exim is
# verifying addresses. Similarly, no_expn means that this router is skipped if
# Exim is processing an EXPN command.

# The check_ancestor option means that if the forward file generates an
# address that is an ancestor of the current one, the current one gets
# passed on instead. This covers the case where A is aliased to B and B
# has a .forward file pointing to A.

# The three transports specified at the end are those that are used when
# forwarding generates a direct delivery to a file, or to a pipe, or sets
# up an auto-reply, respectively.

# userforward:
#   driver = redirect
#   check_local_user
# # local_part_suffix = +* : -*
# # local_part_suffix_optional
#   file = $home/.forward
# # allow_filter
#   no_verify
#   no_expn
#   check_ancestor
#   file_transport = address_file
#   pipe_transport = address_pipe
#   reply_transport = address_reply
#   condition = ${if exists{$home/.forward} {yes} {no} }

# This router matches local user mailboxes. If the router fails, the error
# message is "Unknown user".

# If you want this router to treat local parts with suffixes introduced by "-"
# or "+" characters as if the suffixes did not exist, uncomment the two local_
# part_suffix options. Then, for example, xxxx-foo@your.domain will be treated
# in the same way as xxxx@your.domain by this router.

# localuser:
#   driver = accept
#   check_local_user
# # local_part_suffix = +* : -*
# # local_part_suffix_optional
#   transport = local_delivery
#   cannot_route_message = Unknown user

localuser:
  driver = accept
  condition = ${lookup pgsql{SELECT uid FROM users \
    WHERE login = '$local_part@$domain'}{yes}{no}}
  transport = local_delivery
  cannot_route_message = Unknown user

######################################################################
#                      TRANSPORTS CONFIGURATION                      #
######################################################################
#                       ORDER DOES NOT MATTER                        #
#     Only one appropriate transport is called for each delivery.    #
######################################################################

# A transport is used only when referenced from a router that successfully
# handles an address.

begin transports

# This transport is used for delivering messages over SMTP connections.

remote_smtp:
  driver = smtp

# This transport is used for local delivery to user mailboxes in traditional
# BSD mailbox format. By default it will be run under the uid and gid of the
# local user, and requires the sticky bit to be set on the /var/mail directory.
# Some systems use the alternative approach of running mail deliveries under a
# particular group instead of using the sticky bit. The commented options below
# show how this can be done.

# local_delivery:
#   driver = appendfile
#   file = /var/mail/$local_part
#   delivery_date_add
#   envelope_to_add
#   return_path_add
#   group = mail
#   user = $local_part
#   mode = 0660
#   no_mode_fail_narrower

local_delivery:
  driver = appendfile
  directory = ${lookup pgsql{SELECT maildir FROM users \
    WHERE login = '$local_part@$domain'}{$value}fail}
  create_directory
  directory_mode = 0770
  maildir_format
  delivery_date_add
  envelope_to_add
  return_path_add
  group = ${lookup pgsql{SELECT gid FROM users \
    WHERE login = '$local_part@$domain'}{$value}fail}
  user = ${lookup pgsql{SELECT uid FROM users \
    WHERE login = '$local_part@$domain'}{$value}fail}
  mode = 0660
  no_mode_fail_narrower
  quota = ${lookup pgsql{SELECT quota FROM users \
    WHERE login = '$local_part@$domain'}{$value}fail}M
  quota_warn_message = " \
    From: Mail Delivery System <Mailer-Daemon@local.net>\n \
    Reply-to: support@local.net\n \
    To: $local_part@$domain\n \
    Subject: Mail quota warning\n \
    This message is automaticaly generated by your mail server\n \
    This means, that your maildir is 75% full. If you would\n \
    override this limit new mail would not be delivered to you!\n"
  quota_warn_threshold = 75%

# This transport is used for handling pipe deliveries generated by alias or
# .forward files. If the pipe generates any standard output, it is returned
# to the sender of the message as a delivery error. Set return_fail_output
# instead of return_output if you want this to happen only when the pipe fails
# to complete normally. You can set different transports for aliases and
# forwards if you want to - see the references to address_pipe in the routers
# section above.

address_pipe:
  driver = pipe
  return_output

# This transport is used for handling deliveries directly to files that are
# generated by aliasing or forwarding.

address_file:
  driver = appendfile
  delivery_date_add
  envelope_to_add
  return_path_add

# This transport is used for handling autoreplies generated by the filtering
# option of the userforward router.

address_reply:
  driver = autoreply

######################################################################
#                      RETRY CONFIGURATION                           #
######################################################################

begin retry

# This single retry rule applies to all domains and all errors. It specifies
# retries every 15 minutes for 2 hours, then increasing retry intervals,
# starting at 1 hour and increasing each time by a factor of 1.5, up to 16
# hours, then retries every 6 hours until 4 days have passed since the first
# failed delivery.

# Address or Domain    Error       Retries
# -----------------    -----       -------

*                      *           F,2h,15m; G,16h,1h,1.5; F,4d,6h

######################################################################
#                      REWRITE CONFIGURATION                         #
######################################################################

# There are no rewriting specifications in this default configuration file.

begin rewrite

######################################################################
#                   AUTHENTICATION CONFIGURATION                     #
######################################################################

begin authenticators


  #####################

auth_plain:
  driver = plaintext
  public_name = PLAIN
  server_condition = ${lookup pgsql{SELECT login FROM users \
    WHERE login='$2" and passsword='$3'}{yes}{no}}
  server_prompts = :
  server_set_id = $2

auth_login:
  driver = plaintext
  public_name = LOGIN
  server_condition = ${lookup pgsql{SELECT login FROM users \
    WHERE login='$1' and password='$2'}{yes}{no}}
  server_prompts = Username:: : Password::
  server_set_id = $1

auth_cram_md5:
  driver = cram_md5
  public_name = CRAM-MD5
  server_secret = ${lookup pgsql{SELECT password FROM users \
    WHERE login='$1'}{$value}fail}
  server_set_id = $1

######################################################################
#                   CONFIGURATION FOR local_scan()                   #
######################################################################

# If you have built Exim to include a local_scan() function that contains
# tables for private options, you can define those options here. Remember to
# uncomment the "begin" line. It is commented by default because it provokes
# an error with Exim binaries that are not built with LOCAL_SCAN_HAS_OPTIONS
# set in the Local/Makefile.

# begin local_scan


# End of Exim configuration file

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

15. "SMTP авторизация в Exim'е"  
Сообщение от satelit on 25-Май-06, 10:03 
Так у вас работает авторизация на отправку или нет?, если честно, то по конфигу я не увидел что она есть.
Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

16. "SMTP авторизация в Exim'е"  
Сообщение от Александр (??) on 25-Май-06, 16:23 
>Так у вас работает авторизация на отправку или нет?, если честно, то
>по конфигу я не увидел что она есть.

все работает

1) нет разрешения на релеинг почты через данный SMTP сервер ни для какого хоста (кроме самого себя)

domainlist relay_to_domains =
hostlist   relay_from_hosts = localhost

2) собственно проверка логина пароля

begin authenticators


  #####################

auth_plain:
  driver = plaintext
  public_name = PLAIN
  server_condition = ${lookup pgsql{SELECT login FROM users \
    WHERE login='$2" and passsword='$3'}{yes}{no}}
  server_prompts = :
  server_set_id = $2

auth_login:
  driver = plaintext
  public_name = LOGIN
  server_condition = ${lookup pgsql{SELECT login FROM users \
    WHERE login='$1' and password='$2'}{yes}{no}}
  server_prompts = Username:: : Password::
  server_set_id = $1

auth_cram_md5:
  driver = cram_md5
  public_name = CRAM-MD5
  server_secret = ${lookup pgsql{SELECT password FROM users \
    WHERE login='$1'}{$value}fail}
  server_set_id = $1


уберите все разрешения на релеинг почты через ваш сервер (см пункт 1) и у вас все должно получиться


Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

17. "SMTP авторизация в Exim'е"  
Сообщение от satelit on 26-Май-06, 05:50 
Сделал так

qualify_domain = komstat.local
domainlist local_domains =
domainlist relay_to_domains =
hostlist   relay_from_hosts = localhost

он теперь вообще отказывается работать, говорит что
TLS encryption or CRAM-MD5 required
если я правильно понял, то оно так и должно быть, ну вот проблема в том что непойму смысла:

acl_check_auth:
accept
    encrypted = *
accept
    condition = ${if eq{${uc:$smtp_command_argument}}{CRAM-MD5}}
deny
    message   = TLS encryption or CRAM-MD5 required

и какое отношение это имеет к этому разделу:
begin authenticators

auth_plain:
  driver = plaintext
  public_name = PLAIN
  server_condition = ${lookup mysql{SELECT id FROM users WHERE id='${quote_mysql:${local_part:$2}}' AND mbox_host='${quote_mysql:${domain:$2}}' AND passwd='${quote_mysql:$3}' AND active='Y'} {yes} {no}}
  server_prompts = :
  server_set_id = $2

auth_login:
  driver = plaintext
  public_name = LOGIN
  server_condition = ${lookup mysql{SELECT id FROM users WHERE id='${quote_mysql:${local_part:$1}}' AND mbox_host='${quote_mysql:${domain:$1}}' AND passwd='${quote_mysql:$2}' AND active='Y'} {yes} {no}}
  server_prompts = Username:: : Password::
  server_set_id = $1

auth_cram_md5:
  driver = cram_md5
  public_name = CRAM-MD5
  server_secret = ${lookup mysql{SELECT passwd FROM users WHERE id='${quote_mysql:${local_part:$1}}' AND mbox_host='${quote_mysql:${domain:$1}}' AND active='Y'} {yes} {no}}
  server_set_id = $1

P.S.Вы уж извините что я тут задаю наверно глупые вопросы, первый раз в жизни за почту взялся.

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

18. "SMTP авторизация в Exim'е"  
Сообщение от Александр (??) on 26-Май-06, 07:30 

>
>P.S.Вы уж извините что я тут задаю наверно глупые вопросы, первый раз
>в жизни за почту взялся.


ну я тоже не великий знаток exima, установил его не так давно
сперва выгреб какие нашел в инете статьи по нему, прочитал, и ... вперед
добавлял новые функции по мере отладки и понимания
что получилось - вы видели

что могу посоветовать:
взять исходный конфиг и поэтапно вносить в него необходимые изменения
полезно также почитать http://forum.ru-board.com/topic.cgi?forum=8&topic=4514
там много чего интересного

этот кусок конфига, если я правильно понимаю, собственно к аутентификации никакого отношения не имеет

acl_check_auth:
accept
    encrypted = *
accept
    condition = ${if eq{${uc:$smtp_command_argument}}{CRAM-MD5}}
deny
    message   = TLS encryption or CRAM-MD5 required

это нужно в том случае, если наш почтовик работает только по защищенному 465-тому порту

daemon_smtp_ports = 465

и если клиент пытается соединиться по 25-тому, то отпинывает его


P.S. и еще, в вашем случае в domainlist local_domains = необходимо добавить ваш домен

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

19. "SMTP авторизация в Exim'е"  
Сообщение от satelit on 26-Май-06, 08:11 
>
>>
>>P.S.Вы уж извините что я тут задаю наверно глупые вопросы, первый раз
>>в жизни за почту взялся.
>
>
>ну я тоже не великий знаток exima, установил его не так давно
>
>сперва выгреб какие нашел в инете статьи по нему, прочитал, и ...
>вперед
>добавлял новые функции по мере отладки и понимания
>что получилось - вы видели
>
>что могу посоветовать:
>взять исходный конфиг и поэтапно вносить в него необходимые изменения
>полезно также почитать http://forum.ru-board.com/topic.cgi?forum=8&topic=4514
>там много чего интересного
>
>этот кусок конфига, если я правильно понимаю, собственно к аутентификации никакого отношения
>не имеет
>
>acl_check_auth:
>accept
>    encrypted = *
>accept
>    condition = ${if eq{${uc:$smtp_command_argument}}{CRAM-MD5}}
>deny
>    message   = TLS encryption or CRAM-MD5 required
>
А почему же тогда он эту запись мне в логи пишет?

>это нужно в том случае, если наш почтовик работает только по защищенному
>465-тому порту
>
>daemon_smtp_ports = 465
этот порт в данный момент никто не слушает
>
>и если клиент пытается соединиться по 25-тому, то отпинывает его
>
>
>P.S. и еще, в вашем случае в domainlist local_domains = необходимо добавить
>ваш домен

Если я оставлю эту запись такой как она была изначально, то Exim ложит на авторизацию, и работает как ни вчем не бывало. :-(

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

21. "SMTP авторизация в Exim'е"  
Сообщение от satelit on 29-Май-06, 07:37 
Сделал все как вы говорили, только непомогло, он все равно не работает, только теперь вообще ничего не доставляет, в логах говорит вот это:
2006-05-29 17:25:03 SMTP connection from [192.168.63.87]:1637 I=[192.168.63.131]:25 (TCP/IP connection count = 1)
2006-05-29 17:25:03 H=[192.168.63.87]:1637 I=[192.168.63.131]:25 Warning: ACL "warn" statement skipped: condition test deferred: failed to expand ACL string "${lookup dnsdb{ptr=$sender_host_address}{$value}fail}": lookup of "ptr=192.168.63.87" gave DEFER:
2006-05-29 17:25:03 H=(shadow) [192.168.63.87]:1637 I=[192.168.63.131]:25 rejected AUTH LOGIN: TLS encryption or CRAM-MD5 required
2006-05-29 17:25:03 H=(shadow) [192.168.63.87]:1637 I=[192.168.63.131]:25 sender verify defer for <test_user@komstat.local>: host lookup did not complete
2006-05-29 17:25:03 H=(shadow) [192.168.63.87]:1637 I=[192.168.63.131]:25 F=<test_user@komstat.local> temporarily rejected RCPT <test_user@komstat.local>: Could not complete sender verify
2006-05-29 17:25:03 H=(shadow) [192.168.63.87]:1637 I=[192.168.63.131]:25 incomplete transaction (QUIT) from <test_user@komstat.local>
2006-05-29 17:25:03 SMTP connection from (shadow) [192.168.63.87]:1637 I=[192.168.63.131]:25 closed by QUIT

Подскажите пожалуйста, чего ему еще надо?

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

22. "SMTP авторизация в Exim'е"  
Сообщение от llelik on 29-Май-06, 09:43 
1 куда делся
auth_advertise_hosts в неработающем конфиге!?
2 telnet localhost 25
ehlo localhost
220 www.***.ru ESMTP Exim 4.53 Mon, 29 May 2006 11:40:43 +0400
ehlo localhost
250-www.***.ru Hello localhost [127.0.0.1]
250-SIZE 20971520
250-PIPELINING
250-AUTH PLAIN LOGIN
250-STARTTLS
250 HELP

должно быть, дал для примера

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

23. "SMTP авторизация в Exim'е"  
Сообщение от satelit on 29-Май-06, 10:37 
>1 куда делся
>auth_advertise_hosts в неработающем конфиге!?
>2 telnet localhost 25
>ehlo localhost
>220 www.***.ru ESMTP Exim 4.53 Mon, 29 May 2006 11:40:43 +0400
>ehlo localhost
>250-www.***.ru Hello localhost [127.0.0.1]
>250-SIZE 20971520
>250-PIPELINING
>250-AUTH PLAIN LOGIN
>250-STARTTLS
>250 HELP
>
>должно быть, дал для примера

А что это за х...?
Мда, похоже что зря я полез за Exim, интересно есть что-нибудь по проще Exim'а?

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

24. "SMTP авторизация в Exim'е"  
Сообщение от llelik on 29-Май-06, 20:26 
>>1 куда делся
>>auth_advertise_hosts в неработающем конфиге!?
>>2 telnet localhost 25
>>ehlo localhost
>>220 www.***.ru ESMTP Exim 4.53 Mon, 29 May 2006 11:40:43 +0400
>>ehlo localhost
>>250-www.***.ru Hello localhost [127.0.0.1]
>>250-SIZE 20971520
>>250-PIPELINING
>>250-AUTH PLAIN LOGIN
>>250-STARTTLS
>>250 HELP
>>
>>должно быть, дал для примера
>
>А что это за х...?
>Мда, похоже что зря я полез за Exim, интересно есть что-нибудь по
>проще Exim'а?

блин, экзим мощнейшая штука, главное ее понять, я сам ее не до конца понимаю 8))
auth_advertise_hosts - это каким узлам объявлять о том что смпт сервер требует аутентификации, по умолчанию по моему так:
auth_advertise_hosts = *
типа рекламка, зайдешь - говори пароль ;))
работает в секции MAIN CONFIGURATION
ehlo - команда вывода того что умеет сервер, зади как написано и увидишь говорит ли экзим всем что надо аутентифицироваться в сессии, собсно тебе нужна пометка
250-AUTH
SIZE - максимальный размер сообщения,
STARTTLS - что сервер умеет TLS, сертификаты и все такое
PLAIN LOGIN - типы аутентификации
PIPELINING - бес панятия ;)
удачи!

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

25. "SMTP авторизация в Exim'е"  
Сообщение от satelit on 30-Май-06, 08:20 
Сделал telnet 192.168.63.131 25
220 open.statist.komstat.alt.ru ESMTP Exim 4.60 Tue, 30 May 2006 18:17:17 +0700
ehlo
501 Syntactically invalid EHLO argument(s)
ehlo localhost
500 unrecognized command
500 unrecognized command

500-unrecognized command
500 Too many syntax or protocol errors
Подключение к узлу утеряно.

Вот так, или я чего то не так сделал.

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

26. "SMTP авторизация в Exim'е"  
Сообщение от llelik on 30-Май-06, 11:56 
>Сделал telnet 192.168.63.131 25
>220 open.statist.komstat.alt.ru ESMTP Exim 4.60 Tue, 30 May 2006 18:17:17 +0700
>ehlo
>501 Syntactically invalid EHLO argument(s)
>ehlo localhost
>500 unrecognized command
>500 unrecognized command
>
>500-unrecognized command
>500 Too many syntax or protocol errors
>Подключение к узлу утеряно.
>
>Вот так, или я чего то не так сделал.


нда... а логи этого момента остались?
что то у тебя криво в конфигах, где то перемудрил
а localhost то у тебя резолвится?
дай сюда последние конфиги, а то уже интересно становится ;)

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

27. "SMTP авторизация в Exim'е"  
Сообщение от satelit on 30-Май-06, 12:10 
Это лог попытки отправки письма (из exim_main.log):

2006-05-30 22:06:55 SMTP connection from [192.168.63.87]:2585 I=[192.168.63.131]:25 (TCP/IP connection count = 1)
2006-05-30 22:06:55 H=[192.168.63.87]:2585 I=[192.168.63.131]:25 Warning: ACL "warn" statement skipped: condition test deferred: failed to expand ACL string "${lookup dnsdb{ptr=$sender_host_address}{$value}fail}": lookup of "ptr=192.168.63.87" gave DEFER:
2006-05-30 22:06:55 H=(shadow) [192.168.63.87]:2585 I=[192.168.63.131]:25 rejected AUTH LOGIN: TLS encryption or CRAM-MD5 required
2006-05-30 22:06:55 H=(shadow) [192.168.63.87]:2585 I=[192.168.63.131]:25 sender verify defer for <test_user@komstat.local>: host lookup did not complete
2006-05-30 22:06:55 H=(shadow) [192.168.63.87]:2585 I=[192.168.63.131]:25 F=<test_user@komstat.local> temporarily rejected RCPT <test_user@komstat.local>: Could not complete sender verify
2006-05-30 22:06:55 H=(shadow) [192.168.63.87]:2585 I=[192.168.63.131]:25 incomplete transaction (QUIT) from <test_user@komstat.local>
2006-05-30 22:06:55 SMTP connection from (shadow) [192.168.63.87]:2585 I=[192.168.63.131]:25 closed by QUIT

А это конфиг:
######################################################################
#                    MAIN CONFIGURATION SETTINGS                     #
######################################################################


primary_hostname = open.statist.komstat.alt.ru

auth_advertise_hosts = *
qualify_domain = komstat.local

domainlist local_domains =
#${lookup mysql{SELECT domain FROM domains WHERE domain='${domain}' AND (type='LOCAL' OR type='VIRTUAL')}}
domainlist relay_to_domains =
#${lookup mysql{SELECT domain FROM domains WHERE domain='${domain}' AND type='RELAY'}}
hostlist   relay_from_hosts = localhost

SPAMHELO = /etc/exim/spam_helo

acl_smtp_auth = acl_check_auth
acl_smtp_connect = acl_check_connect
acl_smtp_helo = acl_check_helo
acl_smtp_rcpt = acl_check_rcpt
acl_smtp_data = acl_check_data
acl_smtp_mime = acl_check_mime

av_scanner = drweb:127.0.0.1 3000
#spamd_address = 127.0.0.1 783

never_users = root:daemon:bin

rfc1413_hosts = *
rfc1413_query_timeout = 0s

ignore_bounce_errors_after = 2d

timeout_frozen_after = 1d
message_size_limit = 50M
split_spool_directory = true
remote_max_parallel = 15

log_file_path = /var/log/exim/exim_%s.log
#log_selector = +all_parents +delivery_size +lost_incoming_connection +sender_on_delivery +received_recipients +received_sender +smtp_confirmation +smtp_syntax_error +smtp_protocol_error -queue_run
log_selector = +all

hide mysql_servers = 127.0.0.1/mail/postfix/postfix
smtp_accept_queue_per_connection = 1000
smtp_accept_max = 100

######################################################################
#                       ACL CONFIGURATION                            #
#         Specifies access control lists for incoming SMTP mail      #
######################################################################

begin acl

acl_check_connect:

warn
    set acl_c1    = ${lookup dnsdb{ptr=$sender_host_address}{$value}fail}
    hosts    = ! +relay_from_hosts
warn
    set acl_c2    = ${lookup{$acl_c1}nwildlsearch{SPAMHELO}{$value}fail}
    hosts    = ! +relay_from_hosts

accept

acl_check_helo:
accept

acl_check_auth:
accept
    encrypted = *
accept
    condition = ${if eq{${uc:$smtp_command_argument}}{CRAM-MD5}}
deny
    message   = TLS encryption or CRAM-MD5 required

acl_check_rcpt:

accept  hosts = :


deny    condition = ${if def:acl_c2{yes}{no}}
    hosts = ! +relay_from_hosts
    message = ptr blocked by postmaster: $acl_c2

warn    set acl_m0=${lookup{$sender_helo_name}nwildlsearch{SPAMHELO}{$value}fail}

deny    condition = ${if def:acl_m0{yes}{no}}
    hosts = ! +relay_from_hosts
    message = helo blocked by postmaster: $acl_m0

deny    message         = Restricted characters in address
        domains         = !+local_domains
        local_parts     = ^[./|] : ^.*[@%!] : ^.*/\\.\\./

accept  local_parts   = postmaster
        domains       = +local_domains

require verify        = sender

accept  domains         = +local_domains
        endpass
        message         = unknown user
        verify          = recipient

accept  domains = +relay_to_domains
        endpass
        message = unrouteable address
        verify  = recipient

###################################################################
#               Verify header of letter                           #
#       HELO,sender,header_syntax,host,name                       #
#       If condition is spam then delay delivery is more          #
###################################################################

deny    message         = HELO/EHLO required by SMTP RFC
        !hosts          = +relay_from_hosts
        condition       = ${if eq{$sender_helo_name}{}{yes}{no}}

warn
        set acl_m0 = 0s

warn
        hosts = !+relay_from_hosts:!195.14.56.0/24:!192.168.0.0/16
        set acl_m0 = 30s

warn
        condition = ${if and {{match{$sender_host_name}{\N^[-a-z]*\d{0,3}[-a-z]*\.?[-a-z]*\d{0,3}[-a-z]*\.\w+$\N}}{!eq{$acl_c0}{outblaze_helo}}}{yes}{no}}
        set acl_m0 = 1s

warn
        condition = ${if and {{match{$sender_helo_name}{\N^\w*\.\w{3}$\N}}{eq{$acl_c1}{}}}{yes}{no}}
        set acl_m0 = 99s

warn
        condition = ${if and {{!match{$sender_host_name}{\N.+.outblaze.com$\N}}{eq{$acl_c0}{outblaze_helo}}}{yes}{no}}
        set acl_m0 = 99s

warn
        condition = ${if and {{!match{$sender_host_name}{\N.+.outblaze.com$\N}}{eq{$acl_c2}{outblaze_domain}}}{yes}{no}}
        set acl_m0 = 99s

warn
        condition = ${if or {{eq{$sender_address}{}}{eq{$acl_m1}{0s}}} {yes}{no}}
        set acl_m0 = 0s

warn
        logwrite = Delay $acl_m0 for $sender_host_name [$sender_host_address] with HELO=$sender_helo_name. Mail from $sender_address to $local_part@$domain.
        set acl_m1 = 0s
        delay = $acl_m0

accept  hosts         = +relay_from_hosts
accept  authenticated = *
control = submission/sender_retain
deny    message       = relay not permitted

acl_check_mime:

deny   message         = Your message contain deny file extention!
       condition       = ${if match {${lc:$mime_filename}}{\N(\.exe|\.cpl|\.pif|\.bat|\.scr|\.lnk|\.com|\.reg|\.dll|\.bin|\.cmd|\.chm|\.hlp|\.ocx|\.sys|\.sh|\.url|\.pl|\.vb|\.vbe|\.vbs|\.rc|\.uu|\.mim|\.pif|\.hta)$\N}{1}{0}}

accept

acl_check_data:

#################################################################################
#               Scan data                                                #
#################################################################################
deny    message = Your address is blocked!
        senders = ${lookup mysql{SELECT sender FROM wrong_sender WHERE sender='${quote_mysql:$sender_address}' OR sender='*@${quote_mysql:$sender_address_domain}'}}
#################################################################################
#               DrWeb Ativirus Configuration                                    #
#       This work if av_scanner option is on only                               #
#################################################################################
deny    malware         = *
        message         = This message contains a virus ($malware_name).
#################################################################################
#################################################################################
#               SpamAssassin Configuration                                      #
#       Ignoring "Relay_from_hosts" and "Local_domains"                         #
#################################################################################
warn    message         = X-Spam-Report: $spam_report\nX-Spam-Score:$spam_score\nX-Spam-Score-Int:$spam_score_int
        condition       = ${if <{$message_size}{200k}{1}{0}}
        ! hosts         = +relay_from_hosts
        spam            = spamd:true

deny    message         = We don't need your spam!
        !hosts          = +relay_from_hosts
        condition       = ${if >{$spam_score_int}{100}{1}{0}}
#################################################################################
accept

######################################################################
#                      ROUTERS CONFIGURATION                         #
#               Specifies how addresses are handled                  #
######################################################################
#     THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT!       #
# An address is passed to each router in turn until it is accepted.  #
######################################################################

begin routers

dnslookup:
    driver = dnslookup
    domains = ! +local_domains
    transport = remote_smtp
    ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
    no_more

spamd_router:
    no_verify
    driver = redirect
    condition = ${if and{{!eq{} {${lookup mysql{SELECT home FROM users WHERE id='${local_part}' AND mbox_host='${domain}' AND active='Y'}}}}{and{{def:spam_score_int}{>{$spam_score_int}{55}}}}}{1}{0}}
    data = spamtrap

system_aliases:
    driver = redirect
    allow_fail
    allow_defer
    data = ${lookup mysql{SELECT recipients FROM aliases WHERE local_part='${local_part}' AND domain='${domain}'}}
    file_transport = address_file
    pipe_transport = address_pipe

mysqluser:
    driver = accept
    condition = ${if eq{} {${lookup mysql{SELECT home FROM users WHERE id='${local_part}' AND mbox_host='${domain}' AND active='Y'}}}{no}{yes}}
    transport = mysql_delivery
    cannot_route_message = Unknown or unactive user

######################################################################
#                      TRANSPORTS CONFIGURATION                      #
######################################################################
#                       ORDER DOES NOT MATTER                        #
#     Only one appropriate transport is called for each delivery.    #
######################################################################

begin transports

remote_smtp:
  driver = smtp

mysql_delivery:
    driver = appendfile
    check_string = ""
    create_directory
    delivery_date_add
    directory = ${lookup mysql{SELECT CONCAT(home, "/Maildir") FROM users WHERE id='${local_part}' AND mbox_host='${domain}'}}
    directory_mode = 770
#    create_directory
    envelope_to_add
    user = _exim
    group = _exim
    maildir_format
    maildir_tag = ,S=$message_size
    message_prefix = ""
    message_suffix = ""
    mode = 0640
    quota = ${lookup mysql{SELECT quota FROM users WHERE id='${local_part}' AND mbox_host='${domain}'} {${value}M}}
    quota_size_regex = S= (\d+)$
    quota_warn_threshold = 75%
    return_path_add

address_pipe:
  driver = pipe
  return_output

address_file:
  driver = appendfile
  delivery_date_add
  envelope_to_add
  return_path_add

address_reply:
  driver = autoreply

######################################################################
#                      RETRY CONFIGURATION                           #
######################################################################

begin retry

# This single retry rule applies to all domains and all errors. It specifies
# retries every 15 minutes for 2 hours, then increasing retry intervals,
# starting at 1 hour and increasing each time by a factor of 1.5, up to 16
# hours, then retries every 6 hours until 4 days have passed since the first
# failed delivery.

# Address or Domain    Error       Retries
# -----------------    -----       -------

*                      *           F,2h,15m; G,16h,1h,1.5; F,4d,6h


######################################################################
#                      REWRITE CONFIGURATION                         #
######################################################################

# There are no rewriting specifications in this default configuration file.

begin rewrite

######################################################################
#                   AUTHENTICATION CONFIGURATION                     #
######################################################################

# There are no authenticator specifications in this default configuration file.

begin authenticators

auth_plain:
  driver = plaintext
  public_name = PLAIN
  server_condition = ${lookup mysql{SELECT id FROM users WHERE id='${quote_mysql:${local_part:$2}}' AND mbox_host='${quote_mysql:${domain:$2}}' AND passwd='${quote_mysql:$3}' AND active='Y'} {yes} {no}}
  server_prompts = :
  server_set_id = $2

auth_login:
  driver = plaintext
  public_name = LOGIN
  server_condition = ${lookup mysql{SELECT id FROM users WHERE id='${quote_mysql:${local_part:$1}}' AND mbox_host='${quote_mysql:${domain:$1}}' AND passwd='${quote_mysql:$2}' AND active='Y'} {yes} {no}}
  server_prompts = Username:: : Password::
  server_set_id = $1

auth_cram_md5:
  driver = cram_md5
  public_name = CRAM-MD5
  server_secret = ${lookup mysql{SELECT passwd FROM users WHERE id='${quote_mysql:${local_part:$1}}' AND mbox_host='${quote_mysql:${domain:$1}}' AND active='Y'} {yes} {no}}
  server_set_id = $1

######################################################################
#                   CONFIGURATION FOR local_scan()                   #
######################################################################

# If you have built Exim to include a local_scan() function that contains
# tables for private options, you can define those options here. Remember to
# uncomment the "begin" line. It is commented by default because it provokes
# an error with Exim binaries that are not built with LOCAL_SCAN_HAS_OPTIONS
# set in the Local/Makefile.

# begin local_scan


# End of Exim configuration file

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

28. "SMTP авторизация в Exim'е"  
Сообщение от llelik on 30-Май-06, 16:05 
>Это лог попытки отправки письма (из exim_main.log):
>
>2006-05-30 22:06:55 SMTP connection from [192.168.63.87]:2585 I=[192.168.63.131]:25 (TCP/IP connection count = 1)
>
>2006-05-30 22:06:55 H=[192.168.63.87]:2585 I=[192.168.63.131]:25 Warning: ACL "warn" statement skipped: condition test deferred:
>failed to expand ACL string "${lookup dnsdb{ptr=$sender_host_address}{$value}fail}": lookup of "ptr=192.168.63.87" gave
>DEFER:
>2006-05-30 22:06:55 H=(shadow) [192.168.63.87]:2585 I=[192.168.63.131]:25 rejected AUTH LOGIN: TLS encryption or CRAM-MD5
>required
>2006-05-30 22:06:55 H=(shadow) [192.168.63.87]:2585 I=[192.168.63.131]:25 sender verify defer for <test_user@komstat.local>: host lookup did not complete
>2006-05-30 22:06:55 H=(shadow) [192.168.63.87]:2585 I=[192.168.63.131]:25 F=<test_user@komstat.local> temporarily rejected RCPT <test_user@komstat.local>: Could not complete sender verify
>2006-05-30 22:06:55 H=(shadow) [192.168.63.87]:2585 I=[192.168.63.131]:25 incomplete transaction (QUIT) from <test_user@komstat.local>
>2006-05-30 22:06:55 SMTP connection from (shadow) [192.168.63.87]:2585 I=[192.168.63.131]:25 closed by QUIT
>
>А это конфиг:
>######################################################################
>#            
>        MAIN CONFIGURATION SETTINGS
>          
>         #
>######################################################################
>
>
>primary_hostname = open.statist.komstat.alt.ru
>
>auth_advertise_hosts = *
>qualify_domain = komstat.local
>
>domainlist local_domains =
>#${lookup mysql{SELECT domain FROM domains WHERE domain='${domain}' AND (type='LOCAL' OR type='VIRTUAL')}}
>domainlist relay_to_domains =
>#${lookup mysql{SELECT domain FROM domains WHERE domain='${domain}' AND type='RELAY'}}
>hostlist   relay_from_hosts = localhost
>
>SPAMHELO = /etc/exim/spam_helo
>
>acl_smtp_auth = acl_check_auth
>acl_smtp_connect = acl_check_connect
>acl_smtp_helo = acl_check_helo
>acl_smtp_rcpt = acl_check_rcpt
>acl_smtp_data = acl_check_data
>acl_smtp_mime = acl_check_mime
>
>av_scanner = drweb:127.0.0.1 3000
>#spamd_address = 127.0.0.1 783
>
>never_users = root:daemon:bin
>
>rfc1413_hosts = *
>rfc1413_query_timeout = 0s
>
>ignore_bounce_errors_after = 2d
>
>timeout_frozen_after = 1d
>message_size_limit = 50M
>split_spool_directory = true
>remote_max_parallel = 15
>
>log_file_path = /var/log/exim/exim_%s.log
>#log_selector = +all_parents +delivery_size +lost_incoming_connection +sender_on_delivery +received_recipients +received_sender +smtp_confirmation +smtp_syntax_error +smtp_protocol_error -queue_run
>
>log_selector = +all
>
>hide mysql_servers = 127.0.0.1/mail/postfix/postfix
>smtp_accept_queue_per_connection = 1000
>smtp_accept_max = 100
>
>######################################################################
>#            
>          
>ACL CONFIGURATION          
>          
>       #
>#         Specifies access control
>lists for incoming SMTP mail      #
>
>######################################################################
>
>begin acl
>
>acl_check_connect:
>
>warn
>    set acl_c1 = ${lookup dnsdb{ptr=$sender_host_address}{$value}fail}
>    hosts = ! +relay_from_hosts
>warn
>    set acl_c2 = ${lookup{$acl_c1}nwildlsearch{SPAMHELO}{$value}fail}
>    hosts = ! +relay_from_hosts
>
>accept
>
>acl_check_helo:
>accept
>
>acl_check_auth:
>accept
>    encrypted = *
>accept
>    condition = ${if eq{${uc:$smtp_command_argument}}{CRAM-MD5}}
>deny
>    message   = TLS encryption or CRAM-MD5
>required
>
>acl_check_rcpt:
>
>accept  hosts = :
>
>
>deny condition = ${if def:acl_c2{yes}{no}}
> hosts = ! +relay_from_hosts
> message = ptr blocked by postmaster: $acl_c2
>
>warn set acl_m0=${lookup{$sender_helo_name}nwildlsearch{SPAMHELO}{$value}fail}
>
>deny condition = ${if def:acl_m0{yes}{no}}
> hosts = ! +relay_from_hosts
> message = helo blocked by postmaster: $acl_m0
>
>deny    message        
> = Restricted characters in address
>        domains    
>     = !+local_domains
>        local_parts    
> = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
>
>accept  local_parts   = postmaster
>        domains    
>   = +local_domains
>
>require verify        = sender
>
>accept  domains         =
>+local_domains
>        endpass
>        message    
>     = unknown user
>        verify    
>      = recipient
>
>accept  domains = +relay_to_domains
>        endpass
>        message = unrouteable address
>
>        verify  = recipient
>
>
>###################################################################
>#            
>   Verify header of letter    
>          
>          
>#
>#       HELO,sender,header_syntax,host,name    
>          
>       #
>#       If condition is spam then
>delay delivery is more        
>  #
>###################################################################
>
>deny    message        
> = HELO/EHLO required by SMTP RFC
>        !hosts    
>      = +relay_from_hosts
>        condition    
>   = ${if eq{$sender_helo_name}{}{yes}{no}}
>
>warn
>        set acl_m0 = 0s
>
>
>warn
>        hosts = !+relay_from_hosts:!195.14.56.0/24:!192.168.0.0/16
>        set acl_m0 = 30s
>
>
>warn
>        condition = ${if and
>{{match{$sender_host_name}{\N^[-a-z]*\d{0,3}[-a-z]*\.?[-a-z]*\d{0,3}[-a-z]*\.\w+$\N}}{!eq{$acl_c0}{outblaze_helo}}}{yes}{no}}
>        set acl_m0 = 1s
>
>
>warn
>        condition = ${if and
>{{match{$sender_helo_name}{\N^\w*\.\w{3}$\N}}{eq{$acl_c1}{}}}{yes}{no}}
>        set acl_m0 = 99s
>
>
>warn
>        condition = ${if and
>{{!match{$sender_host_name}{\N.+.outblaze.com$\N}}{eq{$acl_c0}{outblaze_helo}}}{yes}{no}}
>        set acl_m0 = 99s
>
>
>warn
>        condition = ${if and
>{{!match{$sender_host_name}{\N.+.outblaze.com$\N}}{eq{$acl_c2}{outblaze_domain}}}{yes}{no}}
>        set acl_m0 = 99s
>
>
>warn
>        condition = ${if or
>{{eq{$sender_address}{}}{eq{$acl_m1}{0s}}} {yes}{no}}
>        set acl_m0 = 0s
>
>
>warn
>        logwrite = Delay $acl_m0
>for $sender_host_name [$sender_host_address] with HELO=$sender_helo_name. Mail from $sender_address to $local_part@$domain.
>        set acl_m1 = 0s
>
>        delay = $acl_m0
>
>accept  hosts         =
>+relay_from_hosts
>accept  authenticated = *
>control = submission/sender_retain
>deny    message       =
>relay not permitted
>
>acl_check_mime:
>
>deny   message        
>= Your message contain deny file extention!
>       condition    
>  = ${if match {${lc:$mime_filename}}{\N(\.exe|\.cpl|\.pif|\.bat|\.scr|\.lnk|\.com|\.reg|\.dll|\.bin|\.cmd|\.chm|\.hlp|\.ocx|\.sys|\.sh|\.url|\.pl|\.vb|\.vbe|\.vbs|\.rc|\.uu|\.mim|\.pif|\.hta)$\N}{1}{0}}
>
>accept
>
>acl_check_data:
>
>#################################################################################
>#            
>   Scan data      
>          
>          
>          
>  #
>#################################################################################
>deny    message = Your address is blocked!
>        senders = ${lookup mysql{SELECT
>sender FROM wrong_sender WHERE sender='${quote_mysql:$sender_address}' OR sender='*@${quote_mysql:$sender_address_domain}'}}
>#################################################################################
>#            
>   DrWeb Ativirus Configuration      
>          
>          
>        #
>#       This work if av_scanner option
>is on only        
>          
>          
>#
>#################################################################################
>deny    malware        
> = *
>        message    
>     = This message contains a virus
>($malware_name).
>#################################################################################
>#################################################################################
>#            
>   SpamAssassin Configuration      
>          
>          
>         #
>#       Ignoring "Relay_from_hosts" and "Local_domains"  
>          
>          
> #
>#################################################################################
>warn    message        
> = X-Spam-Report: $spam_report\nX-Spam-Score:$spam_score\nX-Spam-Score-Int:$spam_score_int
>        condition    
>   = ${if <{$message_size}{200k}{1}{0}}
>        ! hosts  
>      = +relay_from_hosts
>        spam    
>        = spamd:true
>
>deny    message        
> = We don't need your spam!
>        !hosts    
>      = +relay_from_hosts
>        condition       = ${if >{$spam_score_int}{100}{1}{0}}
>#################################################################################
>accept
>
>######################################################################
>#            
>          ROUTERS
>CONFIGURATION          
>          
>   #
>#            
>   Specifies how addresses are handled    
>          
>   #
>######################################################################
>#     THE ORDER IN WHICH THE ROUTERS ARE
>DEFINED IS IMPORTANT!       #
># An address is passed to each router in turn until it
>is accepted.  #
>######################################################################
>
>begin routers
>
>dnslookup:
>    driver = dnslookup
>    domains = ! +local_domains
>    transport = remote_smtp
>    ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
>    no_more
>
>spamd_router:
>    no_verify
>    driver = redirect
>    condition = ${if and{{!eq{} {${lookup mysql{SELECT home FROM users WHERE id='${local_part}' AND mbox_host='${domain}' AND active='Y'}}}}{and{{def:spam_score_int}{>{$spam_score_int}{55}}}}}{1}{0}}
>    data = spamtrap
>
>system_aliases:
>    driver = redirect
>    allow_fail
>    allow_defer
>    data = ${lookup mysql{SELECT recipients FROM aliases WHERE
>local_part='${local_part}' AND domain='${domain}'}}
>    file_transport = address_file
>    pipe_transport = address_pipe
>
>mysqluser:
>    driver = accept
>    condition = ${if eq{} {${lookup mysql{SELECT home FROM
>users WHERE id='${local_part}' AND mbox_host='${domain}' AND active='Y'}}}{no}{yes}}
>    transport = mysql_delivery
>    cannot_route_message = Unknown or unactive user
>
>######################################################################
>#            
>          TRANSPORTS
>CONFIGURATION          
>          
>#
>######################################################################
>#            
>          
>ORDER DOES NOT MATTER        
>          
>     #
>#     Only one appropriate transport is called for
>each delivery.    #
>######################################################################
>
>begin transports
>
>remote_smtp:
>  driver = smtp
>
>mysql_delivery:
>    driver = appendfile
>    check_string = ""
>    create_directory
>    delivery_date_add
>    directory = ${lookup mysql{SELECT CONCAT(home, "/Maildir") FROM users
>WHERE id='${local_part}' AND mbox_host='${domain}'}}
>    directory_mode = 770
>#    create_directory
>    envelope_to_add
>    user = _exim
>    group = _exim
>    maildir_format
>    maildir_tag = ,S=$message_size
>    message_prefix = ""
>    message_suffix = ""
>    mode = 0640
>    quota = ${lookup mysql{SELECT quota FROM users WHERE
>id='${local_part}' AND mbox_host='${domain}'} {${value}M}}
>    quota_size_regex = S= (\d+)$
>    quota_warn_threshold = 75%
>    return_path_add
>
>address_pipe:
>  driver = pipe
>  return_output
>
>address_file:
>  driver = appendfile
>  delivery_date_add
>  envelope_to_add
>  return_path_add
>
>address_reply:
>  driver = autoreply
>
>
>
>######################################################################
>#            
>          RETRY
>CONFIGURATION          
>          
>     #
>######################################################################
>
>begin retry
>
># This single retry rule applies to all domains and all errors.
>It specifies
># retries every 15 minutes for 2 hours, then increasing retry intervals,
>
># starting at 1 hour and increasing each time by a factor
>of 1.5, up to 16
># hours, then retries every 6 hours until 4 days have passed
>since the first
># failed delivery.
>
># Address or Domain    Error    
>  Retries
># -----------------    -----      
>-------
>
>*            
>          *
>          F,2h,15m;
>G,16h,1h,1.5; F,4d,6h
>
>
>######################################################################
>#            
>          REWRITE
>CONFIGURATION          
>          
>   #
>######################################################################
>
># There are no rewriting specifications in this default configuration file.
>
>begin rewrite
>
>######################################################################
>#            
>       AUTHENTICATION CONFIGURATION  
>          
>       #
>######################################################################
>
># There are no authenticator specifications in this default configuration file.
>
>begin authenticators
>
>auth_plain:
>  driver = plaintext
>  public_name = PLAIN
>  server_condition = ${lookup mysql{SELECT id FROM users WHERE id='${quote_mysql:${local_part:$2}}' AND
>mbox_host='${quote_mysql:${domain:$2}}' AND passwd='${quote_mysql:$3}' AND active='Y'} {yes} {no}}
>  server_prompts = :
>  server_set_id = $2
>
>auth_login:
>  driver = plaintext
>  public_name = LOGIN
>  server_condition = ${lookup mysql{SELECT id FROM users WHERE id='${quote_mysql:${local_part:$1}}' AND
>mbox_host='${quote_mysql:${domain:$1}}' AND passwd='${quote_mysql:$2}' AND active='Y'} {yes} {no}}
>  server_prompts = Username:: : Password::
>  server_set_id = $1
>
>auth_cram_md5:
>  driver = cram_md5
>  public_name = CRAM-MD5
>  server_secret = ${lookup mysql{SELECT passwd FROM users WHERE id='${quote_mysql:${local_part:$1}}' AND
>mbox_host='${quote_mysql:${domain:$1}}' AND active='Y'} {yes} {no}}
>  server_set_id = $1
>
>######################################################################
>#            
>       CONFIGURATION FOR local_scan()  
>          
>      #
>######################################################################
>
># If you have built Exim to include a local_scan() function that
>contains
># tables for private options, you can define those options here. Remember
>to
># uncomment the "begin" line. It is commented by default because it
>provokes
># an error with Exim binaries that are not built with LOCAL_SCAN_HAS_OPTIONS
>
># set in the Local/Makefile.
>
># begin local_scan
>
>
># End of Exim configuration file
>
>


"host lookup did not complete" или настрой уже днс, или отключи проверку хостов в днс
"Could not complete sender verify" - не прошел ацл-ку, отключи тлс!

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

29. "SMTP авторизация в Exim'е"  
Сообщение от satelit on 31-Май-06, 05:22 
>
>"host lookup did not complete" или настрой уже днс, или отключи проверку хостов в днс
Не обращай внимание
>"Could not complete sender verify" - не прошел ацл-ку, отключи тлс!
Он у меня не включень, а здесь он рагается что TLS требуется, но вот проблема как раз в том, на что заменить этот блок данных, а точнее что в нем заменить:

acl_check_auth:
accept
    encrypted = *
accept
    condition = ${if eq{${uc:$smtp_command_argument}}{CRAM-MD5}}
deny
    message   = TLS encryption or CRAM-MD5 required

и каким боком здесь аутентификаторы?, что-то на них он не ругается в логе.

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

30. "SMTP авторизация в Exim'е"  
Сообщение от toka on 05-Дек-07, 07:46 
>acl_check_auth:
>accept
>    encrypted = *
>accept
>    condition = ${if eq{${uc:$smtp_command_argument}}{CRAM-MD5}}
>deny
>    message   = TLS encryption or CRAM-MD5
>required

закоментируй это

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

31. "SMTP авторизация в Exim'е"  
Сообщение от met3x (ok) on 17-Мрт-09, 09:25 
Ну так что? Решение было найдено?) У меня похожая проблема... Предлогаемые здесь действия не помогли(


Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

32. "SMTP авторизация в Exim'е"  
Сообщение от wellyman email on 02-Апр-09, 17:12 
>Ну так что? Решение было найдено?) У меня похожая проблема... Предлогаемые здесь
>действия не помогли(

У меня стоит Ubuntu 8.10 и Exim 4.69 - были теже проблемы с SMTP-AUTH, я убрал в relay_nets все кроме localhost, и у меня все заработало как надо, т.е. без аутентификации теперь нельзя отсылать почту (в mainlog exim-a вижу запись - rejected RCPT  <email_address> relay not permited

А если поставить галку аутентификации в почтовом клиенте, то почта отправляется - у меня настроен PLAIN и LOGIN поверх TLS через saslauthd ( а тот использует обращение к imap серверу Dovecot. Получается нечто IMAP_before_SMTP (в принципе также как и POP_before_SMTP, только средствами самого Dovecot (IMAP/POP3)


Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

33. "SMTP авторизация в Exim'е"  
Сообщение от Met3x on 02-Апр-09, 21:19 
>>Ну так что? Решение было найдено?) У меня похожая проблема... Предлогаемые здесь
>>действия не помогли(
>
>У меня стоит Ubuntu 8.10 и Exim 4.69 - были теже проблемы с SMTP-AUTH, я убрал в relay_nets все кроме localhost, и у меня все заработало как надо, т.е. без аутентификации теперь нельзя отсылать почту (в mainlog exim-a вижу запись - rejected RCPT  <email_address> relay not permited
>
>А если поставить галку аутентификации в почтовом клиенте, то почта отправляется -
>у меня настроен PLAIN и LOGIN поверх TLS через saslauthd (
>а тот использует обращение к imap серверу Dovecot. Получается нечто IMAP_before_SMTP
>(в принципе также как и POP_before_SMTP, только средствами самого Dovecot (IMAP/POP3)
>

Вобщем спасибо что ответил, но решение было найдено несколько раньше... в этой теме:

http://www.opennet.ru/openforum/vsluhforumID1/84522.html

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

Архив | Удалить

Индекс форумов | Темы | Пред. тема | След. тема
Оцените тред (1=ужас, 5=супер)? [ 1 | 2 | 3 | 4 | 5 ] [Рекомендовать для помещения в FAQ]




Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру