#!!# cPanel Exim 4 Config

domainlist rbl_blacklist = lsearch;/etc/rblblacklist

domainlist rbl_bypass = lsearch;/etc/rblbypass

hostlist rbl_whitelist = lsearch;/etc/relayhosts : partial-lsearch;/etc/rblwhitelist



RELAY_WHITELIST=/etc/relayhosts

hostlist whitelisted_hosts = lsearch;RELAY_WHITELIST  

#!!#######################################################!!#

#!!# This new section of the configuration contains ACLs #!!#

#!!# (Access Control Lists) derived from the Exim 3      #!!#

#!!# policy control options.                             #!!#

#!!#######################################################!!#



#!!# These ACLs are crudely constructed from Exim 3 options.

#!!# They are almost certainly not optimal. You should study

#!!# them and rewrite as necessary.



begin acl



#!!# ACL that is used after the RCPT command

check_recipient:

 # Exim 3 had no checking on -bs messages, so for compatibility

 # we accept if the source is local SMTP (i.e. not over TCP/IP).

 # We do this by testing for an empty sending host field.

 accept  hosts = :





#**#

#**# RBL List Begin

#**#

#

# Always accept mail to postmaster & abuse for any local domain

#

accept domains = +local_domains

local_parts = postmaster:abuse

#

# Check sending hosts against DNS black lists.

# Accept all locally generated messages

# Reject message if address listed in blacklist.

deny message = Message rejected because $sender_fullhost \

is blacklisted at $dnslist_domain see $dnslist_text

!hosts = +relay_hosts

!authenticated = *



dnslists = bl.spamcop.net : \

#dnsbl.njabl.org : \

sbl-xbl.spamhaus.org : \

bl.spamcop.net : \

list.dsbl.org : \

cbl.abuseat.org : \

relays.ordb.org

# RBL Bypass Local Domain List

!domains = +rbl_bypass

# RBL Whitelist incoming hosts

!hosts = +rbl_whitelist

#**#

#**# RBL List End

#**#





# Accept bounces to lists even if callbacks or other checks would fail

 warn     message      = X-WhitelistedRCPT-nohdrfromcallback: Yes

          condition    = \

          ${if and {{match{$local_part}{(.*)-bounces\+.*}} \

                    {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}/config.pck}}} \

               {yes}{no}}



 accept   condition    = \

          ${if and {{match{$local_part}{(.*)-bounces\+.*}} \

                    {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}/config.pck}}} \

               {yes}{no}}





 # Accept bounces to lists even if callbacks or other checks would fail

 warn     message      = X-WhitelistedRCPT-nohdrfromcallback: Yes

          condition    = \

          ${if and {{match{$local_part}{(.*)-bounces\+.*}} \

                    {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}_${lc:$domain}/config.pck}}} \

               {yes}{no}}



 accept   condition    = \

          ${if and {{match{$local_part}{(.*)-bounces\+.*}} \

                    {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}_${lc:$domain}/config.pck}}} \

               {yes}{no}}



 #if it gets here it isn't mailman

                                                                                                                                         

 #sender verifications are required for all messages that are not sent to lists

                                                                                                                                         

 require verify = sender

 accept  domains = +local_domains



#**#

#**# Reject Email to Invalid Recipient

#**#

endpass

message = unknown user

verify = recipient

#**#





 endpass

                                                                                                                                         

 #recipient verifications are required for all messages that are not sent to the local machine

 #this was done at multiple users requests

                                                                                                                                         

 message = "The recipient cannot be verified.  Please check all recipients of this message to verify they are valid."

 verify = recipient

                                                                                                                                         

 accept  domains = +relay_domains



 warn  message = ${perl{popbeforesmtpwarn}{$sender_host_name}}

       hosts = +relay_hosts

 accept  hosts = +relay_hosts

                                                                               

 warn  message = ${perl{popbeforesmtpwarn}{$sender_host_address}}

       condition = ${perl{checkrelayhost}{$sender_host_address}}

 accept  condition = ${perl{checkrelayhost}{$sender_host_address}}



 accept  hosts = +auth_relay_hosts

         endpass

         message = $sender_fullhost is currently not permitted to \

                       relay through this server. Perhaps you \

                       have not logged into the pop/imap server in the \

                       last 30 minutes or do not have SMTP Authentication turned on in your email client.

         authenticated = *



 deny    message = $sender_fullhost is currently not permitted to \

                       relay through this server. Perhaps you \

                       have not logged into the pop/imap server in the \

                       last 30 minutes or do not have SMTP Authentication turned on in your email client.





#!!# ACL that is used after the DATA command

check_message:

 require verify = header_sender

 accept









begin authenticators



fixed_plain:

driver = plaintext

public_name = PLAIN

server_condition = "${perl{checkuserpass}{$1}{$2}{$3}}"

server_set_id = $2



fixed_login:

driver = plaintext

public_name = LOGIN

server_prompts = "Username:: : Password::"

server_condition = "${perl{checkuserpass}{$1}{$2}}"

server_set_id = $1





######################################################################

#                      REWRITE CONFIGURATION                         #

######################################################################

######################################################################

#                      ROUTERS CONFIGURATION                         #

#            Specifies how remote addresses are handled              #

######################################################################

#                          ORDER DOES MATTER                         #

#  A remote address is passed to each in turn until it is accepted.  #

######################################################################



# Remote addresses are those with a domain that does not match any item

# in the "local_domains" setting above.



# Deny and send notice to list of rejected domains.

reject_domains:

driver = redirect

# RBL Blacklist incoming hosts

domains = +rbl_blacklist

allow_fail

data = :fail: Connection rejected: SPAM source $domain is manually blacklisted.

########################################################################

 #   REPLACEMENT ACL CONFIGURATION RULES FOR CPANEL/EXIM 4-24         #

 #   With RBL Lookup and Blacklist. Specifies access  control         #  

 #   lists for incoming SMTP mail. Original Written by AuSSie 10/23/03#

 #   Edited on 12/21/04 with RBL inserted from eMtnMan                #

 ######################################################################



 # This access control list is used for every RCPT command in an incoming

 # SMTP message. The tests are run in order until the address is either

 # accepted or denied.

   

 check_recipient:

 

 # Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by

 # testing for an empty sending host field.

 

 accept  hosts = :

 

 # Accept anything from localhost, and especially mailman which

 # chokes badly if you refuse its mail

 

 accept  hosts    = 127.0.0.1/8



 # Deny if the local part contains . or @ or % or / or | or !. These are rarely

 # found in genuine local parts, but are often tried by people looking to

 # circumvent relaying restrictions.

 #

 # Also deny if the local part starts with a dot. Empty components aren't

 # strictly legal in RFC 2822, but Exim allows them because this is common.

 # However, actually starting with a dot may cause trouble if the local part

 # is used as a file name (e.g. for a mailing list).

 #

 # NOTE denying the dot is a new addition. Now i will be able tell when these

 # code thiefs will continue to steal my modifications and claim it their own.

 # Check the CPANEL FORUMS sometime for these people. I see all kinds of variations of what i have written.

 # If i see this modification in anyone elses code I will be able to tell that it's been stolen from here.

 

 deny   local_parts = ^.*[@%!/|] : ^\\. \

         messages = I've never seen ., @, %, !, /, or | in an any e-mail address. Neither should you!



 # Accept mail to POSTMASTER in any local domain, regardless of the source. If you dont want this option comment

 # out the next two lines, below.

 

accept domains = +local_domains

local_parts = postmaster:abuse



 #######################################################################

 # Now that we have all the overrides, we can start the deny rules     #

 #######################################################################

 

 deny     message      = "HELO/EHLO required by SMTP RFC"

          condition    = ${if eq{$sender_helo_name}{}{yes}{no}}

 

 deny     message      = Only one receipient accepted for NULL sender

          senders      = :

          condition    = ${if >{$rcpt_count}{1} {1}}



############################################################################

 #

 # There are no checks on DNS "black" lists because the domains that contain

 # these lists are changing all the time. However, here are two examples of

 # how you could get Exim to perform a DNS black list lookup at this point.

 # The first one denies, while the second just warns. Uncomment any of the ##'s

 # below if you want to use RBL Lookups. Modify the RBL's to suit your needs.

 # If you don't want to use DENY rules and only want to use Warn, then uncomment

 # only the warning rules and visa versa. If you want to use Deny and Warn rules

 # then uncomment both. Uncomment only the double #'s.

 #

 # Reject message if address listed in blacklist.

   deny message = Message rejected because $sender_fullhost \

   is blacklisted at $dnslist_domain see $dnslist_text

   !hosts = +relay_hosts

   !authenticated = *

   dnslists = dnsbl.njabl.org : \

   bl.spamcop.net : \

   sbl.spamhaus.org : \

   list.dsbl.org : \

   cbl.abuseat.org : \

   relays.ordb.org

 

 # RBL Bypass Local Domain List

 !domains = +rbl_bypass

 # RBL Whitelist incoming hosts

 !hosts = +rbl_whitelist

 #**#

 #**# RBL List End

#**#

############################################################################



 # Accept bounces to lists even if callbacks or other checks would fail

 warn     message      = X-WhitelistedRCPT-nohdrfromcallback: Yes

          condition    = \

          ${if and {{match{$local_part}{(.*)-bounces\+.*}} \

                    {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}/config.pck}}} \

               {yes}{no}}



 accept   condition    = \

          ${if and {{match{$local_part}{(.*)-bounces\+.*}} \

                    {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}/config.pck}}} \

               {yes}{no}}





 # Accept bounces to lists even if callbacks or other checks would fail

 warn     message      = X-WhitelistedRCPT-nohdrfromcallback: Yes

          condition    = \

          ${if and {{match{$local_part}{(.*)-bounces\+.*}} \

                    {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}_${lc:$domain}/config.pck}}} \

               {yes}{no}}



 accept   condition    = \

          ${if and {{match{$local_part}{(.*)-bounces\+.*}} \

                    {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}_${lc:$domain}/config.pck}}} \

               {yes}{no}}



 require verify = sender



 # Accept if the address is in a local domain, but only if the recipient can

 # be verified. Otherwise deny. The "endpass" line is the border between

 # passing on to the next ACL statement (if tests above it fail) or denying

 # access (if tests below it fail).

 

 # This section fixes the annoying problem of spammers sending mail to users and domains that don't exist on the box.

 # Why can't Cpanel learn that this fixes their issues. In order for this to happen successful, users who want to use

 # :FAIL: should enter, :fail: no such address here! in their default control panel setting for undeliverable mail. To

 # find this section, log into the contral panel for x or x2, click on Mail setting, Default Address, Set Default

 # address and in the space provided enter, :fail: no such address here!



 accept   domains      = +local_domains

          endpass

          message      = unknown user

          verify       = recipient

               

 # Accept if the address is in a domain for which we are relaying, but again,

 # only if the recipient can be verified.

                     

 accept   domains      = +relay_domains

          endpass

          message      = unrouteable address

          verify       = recipient



 accept  hosts = +relay_hosts

 accept  condition = ${perl{checkrelayhost}{$sender_host_address}}



 accept  hosts = +auth_relay_hosts

         endpass

         message = $sender_fullhost is currently not permitted to \

                       have not logged into the pop/imap server in the \

                       last 30 minutes or do not have SMTP Authentication turned on in your email client.

         authenticated = *



 deny    message = $sender_fullhost is currently not permitted to \

                       relay through this server. Perhaps you \

                       have not logged into the pop/imap server in the \

                       last 30 minutes or do not have SMTP Authentication turned on in your email client.



###############################

   accept hosts = :



   drop hosts = /etc/exim_deny

       message = Connection denied after dictionary attack

       log_message = Connection denied from $sender_host_address after dictionary attack





   drop message = Appears to be a dictionary attack

       log_message = Dictionary attack (after $rcpt_fail_count failures)

       condition = ${if > {${eval:$rcpt_fail_count}}{3}{yes}{no}}

       condition = ${run{/etc/exim_deny.pl $sender_host_address }{yes}{no}}

       !verify = recipient

##################################

#!!# ACL that is used after the DATA command

check_message:

 require verify = header_sender

 accept

2005-01-03 13:20:28 1ClWod-0004c2-VJ failed to expand condition "${perl{checkspam}}" for lookuphost router: Gid 513 is not permitted to relay mail at /etc/exim.pl line 365.



2005-01-03 13:20:28 1ClWod-0004c2-VJ failed to expand condition "${perl{checkspam}}" for literal router: Gid 513 is not permitted to relay mail at /etc/exim.pl line 365.





2005-01-03 14:08:05 1ClXYj-0005HX-Hs failed to expand condition "${perl{checkspam}}" for literal router: Gid 505 is not permitted to relay mail at /etc/exim.pl line 365.

./spamcheck





Spam Count = 1220

njabl.org = 308

spamcop = 622

spamhaus = 23

dsbl.org = 230

abuseat = 36

ordb.org = 1

Manual = 0

verify fail= 2237

No Relay = 105



All Spam:

/var/log/exim_mainlog:1220

/var/log/exim_mainlog.1.gz:0