pax_global_header 0000666 0000000 0000000 00000000064 14566342525 0014526 g ustar 00root root 0000000 0000000 52 comment=2d73bae7686b93a625ab00727812ccd0b30b68ef
mail-docker-master/ 0000775 0000000 0000000 00000000000 14566342525 0014552 5 ustar 00root root 0000000 0000000 mail-docker-master/.env 0000664 0000000 0000000 00000000032 14566342525 0015336 0 ustar 00root root 0000000 0000000 COMPOSE_PROJECT_NAME=mail
mail-docker-master/.gitignore 0000664 0000000 0000000 00000000625 14566342525 0016545 0 ustar 00root root 0000000 0000000 ~*
*~
*.sw[op]
*.py[cod]
.DS_Store
__pycache__/
.vagrant/
vendor/
Thumbs.db
*.retry
.svn/
.sass-cache/
*.log
*.out
*.so
node_modules/
.npm/
nbproject/
*.ipynb
.idea/
*.egg-info/
*.[ao]
.classpath
.cache/
bower_components/
*.class
*.[ewj]ar
secring.*
.*.kate-swp
.swp.*
.directory
.Trash-*
build/
_build/
dist/
.tox/
*.pdf
*.exe
*.dll
*.gz
*.tgz
*.tar
*.rar
*.zip
*.pid
*.lock
*.env
.bundle/
!Pipfile.lock
mail-docker-master/.gitlab-ci.yml 0000664 0000000 0000000 00000000446 14566342525 0017212 0 ustar 00root root 0000000 0000000 ---
include:
- project: shore/ci-stuff
file: templates/pre-commit.yml
- project: shore/ci-stuff
file: templates/docker.yml
build:
extends: .compose-build
tags: &tags [host01.shore.co.il]
pull:
extends: .compose-pull
tags: *tags
run:
extends: .compose-run
tags: *tags
mail-docker-master/.pre-commit-config.yaml 0000664 0000000 0000000 00000003111 14566342525 0021027 0 ustar 00root root 0000000 0000000 ---
repos:
- repo: https://github.com/pre-commit/pre-commit-hooks.git
rev: v4.0.1
hooks:
- id: check-added-large-files
- id: check-executables-have-shebangs
- id: check-json
- id: check-merge-conflict
- id: check-shebang-scripts-are-executable
- id: check-symlinks
- id: check-yaml
- id: detect-private-key
- id: end-of-file-fixer
exclude: gtube
- id: trailing-whitespace
exclude: \.diff$
- repo: https://github.com/codespell-project/codespell.git
rev: v2.1.0
hooks:
- id: codespell
- repo: https://github.com/Yelp/detect-secrets.git
rev: v1.1.0
hooks:
- id: detect-secrets
- repo: https://github.com/amperser/proselint.git
rev: 0.10.2
hooks:
- id: proselint
types: [plain-text]
exclude: LICENSE
- repo: https://gitlab.com/devopshq/gitlab-ci-linter.git
rev: v1.0.2
hooks:
- id: gitlab-ci-linter
args:
- "--server"
- https://git.shore.co.il
- repo: https://github.com/adrienverge/yamllint.git
rev: v1.26.3
hooks:
- id: yamllint
- repo: https://github.com/executablebooks/mdformat.git
rev: 0.7.10
hooks:
- id: mdformat
- repo: https://git.shore.co.il/nimrod/pre-commit-hooks.git
rev: v0.2.0
hooks:
- id: shell-validate
- id: docker-compose
- repo: https://github.com/shellcheck-py/shellcheck-py.git
rev: v0.7.2.1
hooks:
- id: shellcheck
- repo: https://github.com/AleksaC/hadolint-py.git
rev: v2.8.0
hooks:
- id: hadolint
mail-docker-master/LICENSE.txt 0000664 0000000 0000000 00000002054 14566342525 0016376 0 ustar 00root root 0000000 0000000 MIT License
Copyright (c) 2019 Adar Nimrod
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
mail-docker-master/README.md 0000664 0000000 0000000 00000001162 14566342525 0016031 0 ustar 00root root 0000000 0000000 # Mail containers setup
[![pipeline status](https://git.shore.co.il/shore/ldap-docker/badges/master/pipeline.svg)](https://git.shore.co.il/shore/ldap-docker/-/commits/master)
> A containerized mail server setup.
## Requirements
- Docker
- Docker Compose
## License
This software is licensed under the MIT license (see `LICENSE.txt`).
## Author Information
Nimrod Adar, [contact me](mailto:nimrod@shore.co.il) or visit my
[website](https://www.shore.co.il/). Patches are welcome via
[`git send-email`](http://git-scm.com/book/en/v2/Git-Commands-Email). The repository
is located at: .
mail-docker-master/clamd/ 0000775 0000000 0000000 00000000000 14566342525 0015632 5 ustar 00root root 0000000 0000000 mail-docker-master/clamd/.dockerignore 0000664 0000000 0000000 00000000064 14566342525 0020306 0 ustar 00root root 0000000 0000000 *
!entrypoint
!clamd.conf
!clamd-ping
!clamd-update
mail-docker-master/clamd/Dockerfile 0000664 0000000 0000000 00000001322 14566342525 0017622 0 ustar 00root root 0000000 0000000 FROM docker.io/debian:bookworm-slim
# hadolint ignore=DL3008
RUN apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
ca-certificates \
clamav-daemon \
clamav-freshclam \
netcat-openbsd \
procps \
&& \
freshclam --verbose --stdout && \
install -d -m 755 -o clamav -g clamav /run/clamav && \
rm -rf /tmp/* /var/tmp/* /var/lib/apt/lists/* /var/cache/apt/archives/*
COPY --chown=root:root clamd.conf /etc/clamav/
RUN clamconf -n
COPY --chown=root:root clamd-ping /usr/local/bin/
COPY --chown=root:root clamd-update /usr/local/bin/
USER clamav
WORKDIR /var/lib/clamav
EXPOSE 3310
CMD [ "clamd" ]
HEALTHCHECK CMD clamd-ping
mail-docker-master/clamd/README.md 0000664 0000000 0000000 00000001514 14566342525 0017112 0 ustar 00root root 0000000 0000000 # clamd
> ClamAV container image.
## Exposed interfaces
The daemon is accessible over TCP at port 3310 and over the `clamd.ctl` Unix
socket in the `/run/clamav` volume.
## Updates
The image comes with an updated virus database from the time the image was
built. To update the database run `clamd-update` from inside the container with
`docker exec` (there's no need to restart the container afterwards). For an
example see the [Cron image](../crond) inside this project.
## License
This software is licensed under the MIT license (see `LICENSE.txt`).
## Author Information
Nimrod Adar, [contact me](mailto:nimrod@shore.co.il) or visit my
[website](https://www.shore.co.il/). Patches are welcome via
[`git send-email`](http://git-scm.com/book/en/v2/Git-Commands-Email). The repository
is located at: .
mail-docker-master/clamd/clamd-ping 0000775 0000000 0000000 00000000170 14566342525 0017571 0 ustar 00root root 0000000 0000000 #!/bin/sh
set -eux
echo PING | nc -U /run/clamav/clamd.ctl || exit 1
echo PING | nc -t localhost 3310 || exit 1
exit 0
mail-docker-master/clamd/clamd-update 0000775 0000000 0000000 00000000273 14566342525 0020122 0 ustar 00root root 0000000 0000000 #!/bin/sh
set -eux
i=0
while ! clamd-ping
do
i=$(( i + 1 ))
[ "$i" -lt '5' ] || exit 1
sleep 10
done
freshclam --verbose --stdout
#echo RELOAD | nc -U /run/clamav/clamd.ctl
mail-docker-master/clamd/clamd.conf 0000664 0000000 0000000 00000003651 14566342525 0017566 0 ustar 00root root 0000000 0000000 #Automatically Generated by clamav-daemon postinst
#To reconfigure clamd run #dpkg-reconfigure clamav-daemon
#Please read /usr/share/doc/clamav-daemon/README.Debian.gz for details
LocalSocket /var/run/clamav/clamd.ctl
FixStaleSocket true
LocalSocketGroup clamav
LocalSocketMode 666
# TemporaryDirectory is not set to its default /tmp here to make overriding
# the default with environment variables TMPDIR/TMP/TEMP possible
User clamav
ScanMail true
ScanArchive true
ArchiveBlockEncrypted false
MaxDirectoryRecursion 15
FollowDirectorySymlinks false
FollowFileSymlinks false
ReadTimeout 180
MaxThreads 12
MaxConnectionQueueLength 15
LogFacility LOG_LOCAL6
LogClean false
LogVerbose false
PreludeEnable no
PreludeAnalyzerName ClamAV
DatabaseDirectory /var/lib/clamav
OfficialDatabaseOnly false
SelfCheck 0
Foreground true
Debug false
ScanPE true
MaxEmbeddedPE 10M
ScanOLE2 true
ScanPDF true
ScanHTML true
MaxHTMLNormalize 10M
MaxHTMLNoTags 2M
MaxScriptNormalize 5M
MaxZipTypeRcg 1M
ScanSWF true
DetectBrokenExecutables false
ExitOnOOM false
LeaveTemporaryFiles false
AlgorithmicDetection true
ScanELF true
IdleTimeout 30
CrossFilesystems true
PhishingSignatures true
PhishingScanURLs true
PhishingAlwaysBlockSSLMismatch false
PhishingAlwaysBlockCloak false
PartitionIntersection false
DetectPUA false
ScanPartialMessages false
HeuristicScanPrecedence false
StructuredDataDetection false
CommandReadTimeout 5
SendBufTimeout 200
MaxQueue 100
ExtendedDetectionInfo true
OLE2BlockMacros false
ScanOnAccess false
AllowAllMatchScan true
ForceToDisk false
DisableCertCheck false
DisableCache false
MaxScanSize 100M
MaxFileSize 25M
MaxRecursion 16
MaxFiles 10000
MaxPartitions 50
MaxIconsPE 100
PCREMatchLimit 10000
PCRERecMatchLimit 5000
PCREMaxFileSize 25M
ScanXMLDOCS true
ScanHWP3 true
MaxRecHWP3 16
StreamMaxLength 25M
LogTime true
LogFileUnlock false
LogFileMaxSize 0
Bytecode true
BytecodeSecurity TrustSigned
BytecodeTimeout 60000
TCPSocket 3310
TCPAddr 0.0.0.0
mail-docker-master/crond/ 0000775 0000000 0000000 00000000000 14566342525 0015657 5 ustar 00root root 0000000 0000000 mail-docker-master/crond/.dockerignore 0000664 0000000 0000000 00000000013 14566342525 0020325 0 ustar 00root root 0000000 0000000 *
!crontab
mail-docker-master/crond/Dockerfile 0000664 0000000 0000000 00000000255 14566342525 0017653 0 ustar 00root root 0000000 0000000 # hadolint ignore=DL3006
FROM registry.shore.co.il/cron as supersonic
# hadolint ignore=DL3002
USER root
# hadolint ignore=DL3018
RUN apk add --update --no-cache docker-cli
mail-docker-master/crond/README.md 0000664 0000000 0000000 00000001426 14566342525 0017141 0 ustar 00root root 0000000 0000000 # crond
> Cron container image.
## Description
This container runs Cron jobs for training SpamAssassin's Bayesian classifier
and for updating ClamAV's virus database. The jobs run in the other containers,
so the `dockerd` socket is bind mounted to this container and the commands are
executed via `docker exec` in the other containers. Thus, outside of the context
of this setup this container doesn't make much sense.
## License
This software is licensed under the MIT license (see `LICENSE.txt`).
## Author Information
Nimrod Adar, [contact me](mailto:nimrod@shore.co.il) or visit my
[website](https://www.shore.co.il/). Patches are welcome via
[`git send-email`](http://git-scm.com/book/en/v2/Git-Commands-Email). The repository
is located at: .
mail-docker-master/crond/crontab 0000664 0000000 0000000 00000000572 14566342525 0017236 0 ustar 00root root 0000000 0000000 @daily docker exec mail-clamd-1 clamd-update || wget --spider https://notify.shore.co.il/send?message=Clam%20update%20failed.
@daily docker exec mail-spamd-1 spamd-learn || wget --spider https://notify.shore.co.il/send?message=Spamd%20learn%20failed.
@daily docker exec mail-spamd-1 spamd-update || wget --spider https://notify.shore.co.il/send?message=Spamd%20update%20failed.
mail-docker-master/docker-compose.yml 0000664 0000000 0000000 00000004440 14566342525 0020211 0 ustar 00root root 0000000 0000000 # vim:ff=unix:ts=2:sw=2:ai:expandtab
---
version: '3.5'
services:
imap:
build:
context: dovecot/
environment:
LDAP_BASEDN: &ldap_basedn |-
${LDAP_BASE_DN:-ou=People,dc=shore,dc=co,dc=il}
LDAP_URIS: &ldap_uris '${LDAP_URIS:-ldapi:///}'
TLS_CERT_FILE: &tls_cert_file /var/ssl/mail.crt
TLS_DHPARAMS_FILE: /var/ssl/dhparams
TLS_KEY_FILE: &tls_key_file /var/ssl/mail.key
hostname: &imap_hostname imap.shore.co.il
networks:
default:
aliases:
- *imap_hostname
ports:
- 993:993
restart: always
volumes:
- _run_slapd:/run/slapd
- _run_dovecot:/run/dovecot
- mail:/var/mail
- /var/ssl:/var/ssl:ro
clamd:
build:
context: clamd/
restart: always
volumes:
- _run_clamav:/run/clamav
- spool:/var/spool/exim4
spamd:
build:
context: spamd/
restart: always
volumes:
- _run_spamd:/run/spamd
- mail:/var/mail:ro
- sa_learn:/var/backups/sa-learn
crond:
build:
context: crond/
restart: always
volumes:
- /run/docker.sock:/run/docker.sock
smtp:
build:
context: exim4/
environment:
ALT_DOMAINS: "nehe.sr : nehes.co"
# CLAMD_ADDRESS: clamd 3310
LDAP_URIS: *ldap_uris
LDAP_BASEDN: *ldap_basedn
# LMTP_ADDRESS: /run/dovecot/lmtp
DOMAIN: &domain "${DOMAIN:-shore.co.il}"
MAILNAME: &mailname "${MAILNAME:-smtp}.${DOMAIN:-shore.co.il}"
ROOT_ALIAS: "${ROOT_ALIAS:-nimrod}"
# SPAMD_ADDRESS: /run/spamd/spamd.sock
TLS_CERT_FILE: *tls_cert_file
TLS_KEY_FILE: *tls_key_file
DKIM_KEY_FILE: /var/ssl/dkim.key
DKIM_SELECTOR: host01
hostname: *mailname
networks:
default:
aliases:
- *mailname
ports:
- '25:25'
- 587:587
restart: always
volumes:
- _run_slapd:/run/slapd
- _run_clamav:/run/clamav
- _run_dovecot:/run/dovecot
- _run_spamd:/run/spamd
- spool:/var/spool/exim4
- /var/ssl:/var/ssl:ro
volumes:
_run_spamd:
_run_clamav:
name: run_clamav
_run_dovecot:
mail:
labels:
snapshot: 'true'
spool:
sa_learn:
labels:
snapshot: 'true'
_run_slapd:
external: true
name: run_slapd
networks:
default:
name: shore
mail-docker-master/dovecot/ 0000775 0000000 0000000 00000000000 14566342525 0016215 5 ustar 00root root 0000000 0000000 mail-docker-master/dovecot/.dockerignore 0000664 0000000 0000000 00000000043 14566342525 0020666 0 ustar 00root root 0000000 0000000 *
!*.sieve
!entrypoint
!patch.diff
mail-docker-master/dovecot/Dockerfile 0000664 0000000 0000000 00000002773 14566342525 0020220 0 ustar 00root root 0000000 0000000 FROM docker.io/buildpack-deps:bookworm as delete_to_trash
# hadolint ignore=DL3008,DL3015
RUN apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install -y dovecot-dev && \
git clone https://github.com/pali/dovecot_deleted_to_trash && \
make -C dovecot_deleted_to_trash
FROM docker.io/debian:bookworm-slim
# hadolint ignore=DL3008
RUN apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
dovecot-ldap \
dovecot-lmtpd \
dovecot-imapd \
dovecot-sieve \
patch \
ssl-cert \
time \
&& \
install -d -m 777 -o mail -g mail /var/lib/dovecot/sieve.d && \
rm -rf /tmp/* /var/tmp/* /var/lib/apt/lists/* /var/cache/apt/archives/*
COPY --from=delete_to_trash /dovecot_deleted_to_trash/lib_deleted_to_trash_plugin.so /usr/lib/dovecot/modules/
COPY --from=delete_to_trash /dovecot_deleted_to_trash/95-deleted_to_trash_plugin.conf /etc/dovecot/conf.d/
COPY --chown=root:root entrypoint /entrypoint
COPY patch.diff /root/
RUN patch --strip 0 --verbose --directory /etc/dovecot --input /root/patch.diff && \
doveconf
COPY --chown=mail:mail *.sieve /var/lib/dovecot/sieve.d/
# hadolint ignore=DL4006
RUN find /var/lib/dovecot/sieve.d/ -type f -name '*.sieve' -print0 | xargs -0n1 sievec -d
VOLUME /var/mail
VOLUME /run/dovecot
EXPOSE 993 25
ENV TLS_DHPARAMS_FILE /usr/share/dovecot/dh.pem
ENTRYPOINT [ "/entrypoint" ]
CMD [ "dovecot", "-F" ]
HEALTHCHECK --start-period=5m CMD doveadm service status || exit 1
mail-docker-master/dovecot/README.md 0000664 0000000 0000000 00000001415 14566342525 0017475 0 ustar 00root root 0000000 0000000 # Dovecot
> Dovecot container image.
## Exposed interfaces
The containers exposes TCP ports 25 (LMTP) and 993 (IMAPS) and the `lmtp` Unix
socket in the `/run/dovecot` volume (for LTMP submission).
## Environment variables
Name | Description
--- | ---
`LDAP_URIS` | LDAP URI (eg, `ldapi:///`).
`LDAP_BASEDN` | LDAP base DN (eg, `dc=example,dc=com`).
## Persistence
The mbox files are stored at `/var/mail`.
## License
This software is licensed under the MIT license (see `LICENSE.txt`).
## Author Information
Nimrod Adar, [contact me](mailto:nimrod@shore.co.il) or visit my
[website](https://www.shore.co.il/). Patches are welcome via
[`git send-email`](http://git-scm.com/book/en/v2/Git-Commands-Email). The repository
is located at: .
mail-docker-master/dovecot/before.sieve 0000664 0000000 0000000 00000000265 14566342525 0020517 0 ustar 00root root 0000000 0000000 # vim ft=sieve
require ["fileinto", "envelope"];
if anyof (header :contains "X-Spam-Status" "Yes",
header :contains "X-Virus-Status" "infected")
{
fileinto "Junk";
}
mail-docker-master/dovecot/entrypoint 0000775 0000000 0000000 00000001606 14566342525 0020361 0 ustar 00root root 0000000 0000000 #!/bin/sh
set -eux
install -d -m 755 -o dovecot -g root /var/run/dovecot
install -d -m 775 -o root -g dovecot /var/mail
install -d -m 775 -o root -g dovecot /run/dovecot
[ -f "$TLS_DHPARAMS_FILE" ] || time openssl dhparam -out "$TLS_DHPARAMS_FILE" 2048
DEBIAN_FRONTEND=noninteractive time make-ssl-cert generate-default-snakeoil --force-overwrite
# I don't know why environment variables aren't expanded and I'm too interested
# to find out.
sed -i "s@%{env:LDAP_URIS}@$LDAP_URIS@g" /etc/dovecot/dovecot-ldap.conf.ext
sed -i "s@%{env:LDAP_BASEDN}@$LDAP_BASEDN@g" /etc/dovecot/dovecot-ldap.conf.ext
sed -i "s@/etc/ssl/private/ssl-cert-snakeoil.key@$TLS_KEY_FILE@g" /etc/dovecot/conf.d/10-ssl.conf
sed -i "s@/etc/ssl/certs/ssl-cert-snakeoil.pem@$TLS_CERT_FILE@g" /etc/dovecot/conf.d/10-ssl.conf
sed -i "s@/usr/share/dovecot/dh.pem@$TLS_DHPARAMS_FILE@g" /etc/dovecot/conf.d/10-ssl.conf
eval exec "$@"
mail-docker-master/dovecot/nimrod.sieve 0000664 0000000 0000000 00000010476 14566342525 0020552 0 ustar 00root root 0000000 0000000 # vim ft=sieve
require ["fileinto", "envelope", "imap4flags"];
if address :is "from" "nimrod@shore.co.il" { setflag "\\seen"; }
if address :is :domain "from" [ "drushim.co.il", "indeed.com", "picaro.co.il",
"jobnet.co.il", "cps.co.il", "seev.co.il", "yad2jobs.co.il", "mindu.co.il",
"korentec.co.il", "ethosia.com", "ethosia.co.il", "nisha.co.il", "alljob.co.il",
"alljobs.co.il", "propel.co.il", "simplyfind.co.il", "jobby.co.il",
"niloosoft.com", "qhr.co.il", "dialog.co.il", "taldor.co.il", "linkedin.com",
"*.linkedin.com", "hire.withgoogle.com" , "hunterhrms.com", "triplebyte.com",
"gun.io", "lever.co", "*.lever.co", "logica-it.co.il", "lever.co", "*.lever.co",
"woo.io", "myworkday.com", "*.myworkday.com", "experteer.com",
"*.experteer.com", "hunted.co.il", "remote.com", "itworks.org.il",
"monster.com", "glassdoor.com", "careeralerts.data.ai" ]
{
fileinto "Wanted";
}
elsif address :is "from" [ "workatastartup@ycombinator.com" ]
{
fileinto "Wanted";
}
elsif anyof (
address :is :domain "from" [ "community.popcorncomputer.com", "puppet.com",
"devopsdays.org", "teleticket.co.il", "puppetlabs.com", "drivehq.com",
"bsdmag.org", "macecraft.com", "rol.co.il", "pointmail.co.za", "agora.co.il",
"bsdmag.com", "check.me", "dvorak.org", "perlmaven.com", "itnewsletter.co.il",
"aerofs.com", "lastpass.com", "openstack-israel.org", "sdjournal.org",
"htisrael.co.il", "github.com", "marriott-email.com", "meetup.com",
"8662244.co.il", "software.com.pl", "heroku.com", "eg-innovations.net",
"email-marriott.com", "info.docker.com", "docker.com", "docker.io",
"onedrive.microsoft.com", "aerofs.com", "m.aerofs.com", "airbnb.com",
"circleci.com", "bugs.debian.org", "getcloudify.com", "mqg.org.il",
"samerica.co.il", "gigaspaces.com", "getcloudify.org", "email.aol.com",
"microfocus.com", "*.microfocus.com", "statscraft.org.il", "novell.com",
"mozilla.org", "*.mozilla.org", "htmag.co.il", "source.parts",
"zamarin.org.il" ],
address :is "from" [ "ecomeshek@gmail.com", "ironethaifa@haifa.muni.il", "cloudnativeisrael@gmail.com" ],
address :is :domain "to" [ "openbsd.org", "meetup.com" ])
{
fileinto "Mailinglists";
}
elsif anyof (address :is :domain "from" [ "travelbird.be", "nitzan-hr.com",
"ispc.co.il", "meckano.co.il", "kustonline.be", "freefax.co.il", "summary.com",
"twoomail.com", "thephonehouse.es", "*.thephonehouse.es", "*.ru" ],
address :is "from" [ "rsnc.office@gmail.com", "zelba100@gmail.com" ])
{
fileinto "Junk";
}
elsif address :is :domain "from" [ "startcom.org", "davidcpa.co.il",
"icount.co.il", "10ten.co.il", "greeninvoices.co.il", "twilio.com",
"*.twilio.com", "he-cpa.co.il", "greeninvoice.co.il", "messagebird.com",
"letsdeel.com", "deel.support", "bezeqint.co.il", "bezeq.co.il",
"cellopark.co.il" ]
{
fileinto "Shore";
}
elsif address :is "to" [ "abuse@shore.co.il", "clamav@shore.co.il",
"ftp@shore.co.il", "hostmaster@shore.co.il", "mailer-daemon@shore.co.il",
"news@shore.co.il", "nobody@shore.co.il", "noc@shore.co.il",
"postmaster@shore.co.il", "root@shore.co.il", "security@shore.co.il",
"usenet@shore.co.il", "webmaster@shore.co.il", "www@shore.co.il" ]
{
fileinto "Root";
}
elsif address :is :domain "from" [ "leumi.co.il", "*.leumi.co.il",
"leumi-card.co.il", "*.leumi-card.co.il", "leumicard.co.il",
"*.leumicard.co.il" ]
{
fileinto "Leumi";
}
elsif address :is "from" [ "irist@zy1882.co.il", "tzaharon@zamarin.org.il" ]
{
fileinto "Daycare";
}
elsif address :is "from" [ "mail.amt.law@gmail.com", "mati@amt-law.co.il" ]
{
fileinto "Divorce";
}
elsif address :is :domain "from" [ "icc.co.il", "*.icc.co.il" ]
{
fileinto "Cal";
}
elsif address :is :domain "from" [ "htzone.co.il" ]
{
fileinto "htzone";
}
elsif address :is :domain "from" ["chorus.one"]
{
fileinto "ChorusOne";
}
elsif address :is :domain "from" ["fibi.co.il"]
{
fileinto "fibi";
}
elsif address :is :domain "from" ["expertlead.de", "expertlead.com", "expertlead.io"]
{
fileinto "expertlead";
}
elsif address :is :domain "from" ["smile.io"]
{
fileinto "smile";
}
elsif address :is :domain "from" ["google.com", "*.google.com", "youtube.com"]
{
fileinto "Google";
}
elsif address :is :domain "from" ["schoollinks.com"]
{
fileinto "schoollinks";
}
elsif address :is :domain "from" ["toptal.com", "*.toptal.com"]
{
fileinto "toptal";
}
elsif address :is :domain "from" ["workgenius.com", "*.workgenius.com"]
{
fileinto "workgenius";
}
mail-docker-master/dovecot/patch.diff 0000664 0000000 0000000 00000017277 14566342525 0020164 0 ustar 00root root 0000000 0000000 --- conf.d/10-auth.conf 2019-01-23 12:05:58.000000000 +0200
+++ conf.d/10-auth.conf 2019-03-04 11:54:04.477652365 +0200
@@ -48,7 +48,7 @@
# the standard variables here, eg. %Lu would lowercase the username, %n would
# drop away the domain if it was given, or "%n-AT-%d" would change the '@' into
# "-AT-". This translation is done after auth_username_translation changes.
-#auth_username_format = %Lu
+auth_username_format = %Ln
# If you want to allow master users to log in by specifying the master
# username within the normal username string (ie. not using SASL mechanism's
@@ -119,9 +119,9 @@
#!include auth-deny.conf.ext
#!include auth-master.conf.ext
-!include auth-system.conf.ext
+#!include auth-system.conf.ext
#!include auth-sql.conf.ext
-#!include auth-ldap.conf.ext
+!include auth-ldap.conf.ext
#!include auth-passwdfile.conf.ext
#!include auth-checkpassword.conf.ext
#!include auth-vpopmail.conf.ext
--- conf.d/20-lmtp.conf 2019-01-23 12:05:58.000000000 +0200
+++ conf.d/20-lmtp.conf 2019-03-04 13:25:51.061844327 +0200
@@ -20,7 +20,13 @@
# when a mail has multiple recipients.
#lmtp_hdr_delivery_address = final
+recipient_delimiter =+
+lmtp_save_to_detail_mailbox = yes
+lda_mailbox_autocreate = yes
+lda_mailbox_autosubscribe = yes
+
+
protocol lmtp {
# Space separated list of plugins to load (default is global mail_plugins).
- #mail_plugins = $mail_plugins
+ mail_plugins = $mail_plugins sieve
}
--- conf.d/90-sieve.conf 2019-03-05 21:15:58.905790954 +0200
+++ conf.d/90-sieve.conf 2019-03-05 21:19:18.160059384 +0200
@@ -36,7 +38,7 @@
# active script symlink is located.
# For other types: use the ';name=' parameter to specify the name of the
# default/active script.
- sieve = file:~/sieve;active=~/.dovecot.sieve
+ sieve = /var/lib/dovecot/sieve.d/%Ln.sieve
# The default Sieve script when the user has none. This is the location of a
# global sieve script file, which gets executed ONLY if user's personal Sieve
@@ -73,7 +75,7 @@
# to the script execution sequence in the specified order. Reading the
# numbered sieve_before settings stops at the first missing setting, so no
# numbers may be skipped.
- #sieve_before = /var/lib/dovecot/sieve.d/
+ sieve_before = /var/lib/dovecot/sieve.d/before.sieve
#sieve_before2 = ldap:/etc/sieve-ldap.conf;name=ldap-domain
#sieve_before3 = (etc...)
--- conf.d/10-logging.conf 2019-03-05 21:43:01.097279575 +0200
+++ conf.d/10-logging.conf 2019-03-05 22:17:49.041027765 +0200
@@ -4,7 +4,7 @@
# Log file to use for error messages. "syslog" logs to syslog,
# /dev/stderr logs to stderr.
-#log_path = syslog
+log_path = /dev/stderr
# Log file to use for informational messages. Defaults to log_path.
#info_log_path =
@@ -41,7 +41,7 @@
#log_core_filter =
# Log unsuccessful authentication attempts and the reasons why they failed.
-#auth_verbose = no
+auth_verbose = yes
# In case of password mismatches, log the attempted password. Valid values are
# no, plain and sha1. sha1 can be useful for detecting brute force password
--- dovecot.conf 2019-04-29 23:35:05.000000000 +0300
+++ dovecot.conf 2019-05-12 00:20:17.908388214 +0300
@@ -75,7 +75,7 @@
# Space separated list of environment variables that are preserved on Dovecot
# startup and passed down to all of its child processes. You can also give
# key=value pairs to always set specific settings.
-#import_environment = TZ
+import_environment = $import_environment LDAP_URIS LDAP_BASEDN TLS_KEY_FILE TLS_CERT_FILE
##
## Dictionary server settings
--- dovecot-ldap.conf.ext 2019-01-23 12:05:58.000000000 +0200
+++ dovecot-ldap.conf.ext 2019-06-29 19:09:54.704490949 +0300
@@ -21,7 +21,7 @@
# LDAP URIs to use. You can use this instead of hosts list. Note that this
# setting isn't supported by all LDAP libraries.
-#uris =
+uris = %{env:LDAP_URIS}
# Distinguished Name - the username used to login to the LDAP server.
# Leave it commented out to bind anonymously (useful with auth_bind=yes).
@@ -66,7 +66,7 @@
# The pass_filter is used to find the DN for the user. Note that the pass_attrs
# is still used, only the password field is ignored in it. Before doing any
# search, the binding is switched back to the default DN.
-#auth_bind = no
+auth_bind = yes
# If authentication binding is used, you can save one LDAP request per login
# if users' DN can be specified with a common template. The template can use
@@ -89,7 +89,7 @@
# LDAP base. %variables can be used here.
# For example: dc=mail, dc=example, dc=org
-base =
+base = %{env:LDAP_BASEDN}
# Dereference: never, searching, finding, always
#deref = never
@@ -127,8 +127,8 @@
# userdb prefetch instead of userdb ldap in dovecot.conf. In that case you'll
# also have to include user_attrs in pass_attrs field prefixed with "userdb_"
# string. For example:
-#pass_attrs = uid=user,userPassword=password,\
-# homeDirectory=userdb_home,uidNumber=userdb_uid,gidNumber=userdb_gid
+pass_attrs = uid=user,userPassword=password,\
+ homeDirectory=userdb_home,uidNumber=userdb_uid,gidNumber=userdb_gid
# Filter for password lookups
#pass_filter = (&(objectClass=posixAccount)(uid=%u))
--- conf.d/10-master.conf 2019-06-30 15:30:20.955944241 +0300
+++ conf.d/10-master.conf 2019-06-30 15:30:20.959944142 +0300
@@ -19,8 +19,8 @@
#port = 143
}
inet_listener imaps {
- #port = 993
- #ssl = yes
+ port = 993
+ ssl = yes
}
# Number of connections to handle before starting a new process. Typically
@@ -53,15 +53,15 @@
service lmtp {
unix_listener lmtp {
- #mode = 0666
+ mode = 0666
}
# Create inet listener only if you can't use the above UNIX socket
- #inet_listener lmtp {
+ inet_listener lmtp {
# Avoid making LMTP visible for the entire internet
#address =
- #port =
- #}
+ port = 25
+ }
}
service imap {
--- conf.d/10-ssl.conf 2019-07-27 09:10:44.307318844 +0300
+++ conf.d/10-ssl.conf 2020-06-07 09:47:53.412079557 +0300
@@ -9,8 +9,8 @@
# dropping root privileges, so keep the key file unreadable by anyone but
# root. Included doc/mkcert.sh can be used to easily generate self-signed
# certificate, just make sure to update the domains in dovecot-openssl.cnf
-ssl_cert =
#
-mail_location = mbox:~/mail:INBOX=/var/mail/%u
+mail_location = mbox:/var/mail/%Ln:INBOX=/var/mail/%Ln/Inbox
# If you need to set multiple mailbox locations or want to change default
# namespace settings, you can do it by defining namespace sections.
--- conf.d/20-imap.conf 2020-12-22 13:26:52.000000000 +0000
+++ conf.d/20-imap.conf 2022-12-05 07:33:47.876334736 +0000
@@ -95,5 +95,5 @@
# Maximum number of IMAP connections allowed for a user from each IP address.
# NOTE: The username is compared case-sensitively.
- #mail_max_userip_connections = 10
+ mail_max_userip_connections = 15
}
mail-docker-master/exim4/ 0000775 0000000 0000000 00000000000 14566342525 0015600 5 ustar 00root root 0000000 0000000 mail-docker-master/exim4/.dockerignore 0000664 0000000 0000000 00000000043 14566342525 0020251 0 ustar 00root root 0000000 0000000 *
!entrypoint
!exim4.conf
!aliases
mail-docker-master/exim4/Dockerfile 0000664 0000000 0000000 00000003327 14566342525 0017577 0 ustar 00root root 0000000 0000000 FROM docker.io/debian:bookworm-slim
# hadolint ignore=DL3008,DL4006
RUN apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
exim4-daemon-heavy \
fakeroot \
libcap2-bin \
patch \
procps \
spf-tools-perl \
ssl-cert \
time \
&& \
usermod -aG ssl-cert Debian-exim && \
install -d -m 750 -o Debian-exim -g Debian-exim /run/exim4 && \
install -o Debian-exim -g Debian-exim -m 644 /dev/null /etc/mailname && \
install -d -o Debian-exim -g ssl-cert -m 710 /etc/ssl/private && \
install -d -o Debian-exim -g root -m 755 /etc/ssl/certs && \
install -d -o Debian-exim -g Debian-exim -m 755 /var/lib/exim4/ && \
install -o root -g ssl-cert -m 664 /dev/null /etc/ssl/certs/ssl-cert-snakeoil.pem && \
install -o root -g ssl-cert -m 664 /dev/null /etc/ssl/private/ssl-cert-snakeoil.key && \
install -d -o root -g root -m 755 /usr/share/exim4 && \
install -o root -g ssl-cert -m 664 /dev/null /usr/share/exim4/dh.pem && \
setcap CAP_NET_BIND_SERVICE=+ep /usr/sbin/exim4 && \
rm -rf /usr/share/exim4/dh.pem /var/lib/exim4/config.autogenerated /etc/exim4/* && \
rm -rf /tmp/* /var/tmp/* /var/lib/apt/lists/* /var/cache/apt/archives/*
COPY --chown=root:root entrypoint /usr/local/bin/
COPY --chown=Debian-exim:Debian-exim aliases /etc/aliases
COPY --chown=root:root exim4.conf /etc/exim4/exim4.conf
# Chmod is needed because of
# https://gitlab.com/gitlab-org/gitlab-runner/-/issues/1736.
RUN chmod 644 /etc/exim4/exim4.conf && exim4 -bV
#USER Debian-exim
WORKDIR /var/spool/exim4
ENTRYPOINT ["entrypoint"]
CMD ["/usr/sbin/exim4", "-bdf", "-q30m", "-v"]
EXPOSE 25 587
HEALTHCHECK CMD exiwhat || exit 1
mail-docker-master/exim4/README.md 0000664 0000000 0000000 00000002101 14566342525 0017051 0 ustar 00root root 0000000 0000000 # Exim
> Exim container image.
## Exposed interfaces
The container exposes TCP ports 25 (SMTP) and 587 (submission).
## Environment variables
Name | Description
--- | ---
`CLAMD_ADDRESS` | Address of the clamd server (see http://exim.org/exim-html-current/doc/html/spec_html/ch-content_scanning_at_acl_time.htm).
`DKIM_KEY_FILE` |
`DKIM_SELECTOR` |
`LDAP_URIS` |
`LDAP_BASEDN` |
`LMTP_ADDRESS` | Address of the LMTP server (see http://exim.org/exim-html-current/doc/html/spec_html/ch-the_lmtp_transport.html).
`MAILNAME` |
`ROOT_ALIAS` |
`SPAMD_ADDRESS` | Address of the spamd server (see http://exim.org/exim-html-current/doc/html/spec_html/ch-content_scanning_at_acl_time.html).
`TLS_CERT_FILE` |
`TLS_KEY_FILE` |
## License
This software is licensed under the MIT license (see `LICENSE.txt`).
## Author Information
Nimrod Adar, [contact me](mailto:nimrod@shore.co.il) or visit my
[website](https://www.shore.co.il/). Patches are welcome via
[`git send-email`](http://git-scm.com/book/en/v2/Git-Commands-Email). The repository
is located at: .
mail-docker-master/exim4/aliases 0000664 0000000 0000000 00000000332 14566342525 0017142 0 ustar 00root root 0000000 0000000 # /etc/aliases
mailer-daemon: postmaster
postmaster: root
nobody: root
hostmaster: root
usenet: root
news: root
webmaster: root
www: root
ftp: root
abuse: root
noc: root
security: root
shosh: shoshana
shoshi: shoshana
mail-docker-master/exim4/entrypoint 0000775 0000000 0000000 00000002031 14566342525 0017735 0 ustar 00root root 0000000 0000000 #!/bin/sh
set -eux
# Set the mail name.
if [ -n "${MAILNAME:-}" ]
then
echo "$MAILNAME" > /etc/mailname
else
hostname > /etc/mailname
fi
# Set the root mail alias, if environment variable is present.
[ -z "${ROOT_ALIAS:-}" ] || echo "root: $ROOT_ALIAS" >> /etc/aliases
# Generate self-signed certificates if none are provided.
if [ "${TLS_CERT_FILE:-/etc/ssl/certs/ssl-cert-snakeoil.pem}" = "/etc/ssl/certs/ssl-cert-snakeoil.pem" ] || \
[ "${TLS_KEY_FILE:-/etc/ssl/private/ssl-cert-snakeoil.key}" = "/etc/ssl/private/ssl-cert-snakeoil.key" ]
then
echo Generating self-signed key and certificate. >&2
DEBIAN_FRONTEND=noninteractive time fakeroot make-ssl-cert generate-default-snakeoil --force-overwrite
fi
# Generate a DKIM keys if none are specifiec.
if [ "${DKIM_KEY_FILE:-/etc/exim4/dkim.key}" = "/etc/exim4/dkim.key" ]
then
echo Generating DKIM keys. >&2
openssl genrsa -out /etc/exim4/dkim.key 2048
echo Public DKIM key >&2
openssl rsa -in /etc/exim4/dkim.key -pubout -outform PEM >&2
fi
eval exec "$@"
mail-docker-master/exim4/exim4.conf 0000664 0000000 0000000 00000127105 14566342525 0017503 0 ustar 00root root 0000000 0000000 ######################################################################
# Runtime configuration file for Exim #
######################################################################
# This is a default configuration file which will operate correctly in
# uncomplicated installations. Please see the manual for a complete list
# of all the runtime configuration options that can be included in a
# configuration file. There are many more than are mentioned here. The
# manual is in the file doc/spec.txt in the Exim distribution as a plain
# ASCII file. Other formats (PostScript, Texinfo, HTML, PDF) are available
# from the Exim ftp sites. The manual is also online at the Exim website.
# This file is divided into several parts, all but the first of which are
# headed by a line starting with the word "begin". Only those parts that
# are required need to be present. Blank lines, and lines starting with #
# are ignored.
########### IMPORTANT ########## IMPORTANT ########### IMPORTANT ###########
# #
# Whenever you change Exim's configuration file, you *must* remember to #
# HUP the Exim daemon, because it will not pick up the new configuration #
# until you do. However, any other Exim processes that are started, for #
# example, a process started by an MUA in order to send a message, will #
# see the new configuration as soon as it is in place. #
# #
# You do not need to HUP the daemon for changes in auxiliary files that #
# are referenced from this file. They are read every time they are used. #
# #
# It is usually a good idea to test a new configuration for syntactic #
# correctness before installing it (for example, by running the command #
# "exim -C /config/file.new -bV"). #
# #
########### IMPORTANT ########## IMPORTANT ########### IMPORTANT ###########
######################################################################
# MACROS #
######################################################################
#
# If you want to use a smarthost instead of sending directly to recipient
# domains, uncomment this macro definition and set a real hostname.
# An appropriately privileged user can then redirect email on the command-line
# in emergencies, via -D.
#
# ROUTER_SMARTHOST=MAIL.HOSTNAME.FOR.CENTRAL.SERVER.EXAMPLE
SYSTEM_ALIASES_FILE = /etc/aliases
######################################################################
# MAIN CONFIGURATION SETTINGS #
######################################################################
#
exim_user = root
exim_group = mail
# Specify your host's canonical name here. This should normally be the fully
# qualified "official" name of your host. If this option is not set, the
# uname() function is called to obtain the name. In many cases this does
# the right thing and you need not set anything explicitly.
#primary_hostname = MAIL_NAME
# The next three settings create two lists of domains and one list of hosts.
# These lists are referred to later in this configuration using the syntax
# +local_domains, +relay_to_domains, and +relay_from_hosts, respectively. They
# are all colon-separated lists:
domainlist local_domains = ${env{DOMAIN}{$value}{@}} : ${env{ALT_DOMAINS}{$value}{@}}
domainlist relay_to_domains =
hostlist relay_from_hosts = <; 127.0.0.0/8; 192.168.0.0/16; 10.0.0.0/8; 172.16.0.0/12
# (We rely upon hostname resolution working for localhost, because the default
# uncommented configuration needs to work in IPv4-only environments.)
# Most straightforward access control requirements can be obtained by
# appropriate settings of the above options. In more complicated situations,
# you may need to modify the Access Control Lists (ACLs) which appear later in
# this file.
# The first setting specifies your local domains, for example:
#
# domainlist local_domains = my.first.domain : my.second.domain
#
# You can use "@" to mean "the name of the local host", as in the default
# setting above. This is the name that is specified by primary_hostname,
# as specified above (or defaulted). If you do not want to do any local
# deliveries, remove the "@" from the setting above. If you want to accept mail
# addressed to your host's literal IP address, for example, mail addressed to
# "user@[192.168.23.44]", you can add "@[]" as an item in the local domains
# list. You also need to uncomment "allow_domain_literals" below. This is not
# recommended for today's Internet.
# The second setting specifies domains for which your host is an incoming relay.
# If you are not doing any relaying, you should leave the list empty. However,
# if your host is an MX backup or gateway of some kind for some domains, you
# must set relay_to_domains to match those domains. For example:
#
# domainlist relay_to_domains = *.myco.com : my.friend.org
#
# This will allow any host to relay through your host to those domains.
# See the section of the manual entitled "Control of relaying" for more
# information.
# The third setting specifies hosts that can use your host as an outgoing relay
# to any other host on the Internet. Such a setting commonly refers to a
# complete local network as well as the localhost. For example:
#
# hostlist relay_from_hosts = <; 127.0.0.1 ; ::1 ; 192.168.0.0/16
#
# The "/16" is a bit mask (CIDR notation), not a number of hosts. Note that you
# have to include 127.0.0.1 if you want to allow processes on your host to send
# SMTP mail by using the loopback address. A number of MUAs use this method of
# sending mail. Often, connections are made to "localhost", which might be ::1
# on IPv6-enabled hosts. Do not forget CIDR for your IPv6 networks.
# All three of these lists may contain many different kinds of item, including
# wildcarded names, regular expressions, and file lookups. See the reference
# manual for details. The lists above are used in the access control lists for
# checking incoming messages. The names of these ACLs are defined here:
acl_smtp_rcpt = acl_check_rcpt
.ifdef _HAVE_PRDR
acl_smtp_data_prdr = acl_check_prdr
.endif
acl_smtp_data = acl_check_data
# You should not change those settings until you understand how ACLs work.
# If you are running a version of Exim that was compiled with the content-
# scanning extension, you can cause incoming messages to be automatically
# scanned for viruses. You have to modify the configuration in two places to
# set this up. The first of them is here, where you define the interface to
# your scanner. This example is typical for ClamAV; see the manual for details
# of what to set for other virus scanners. The second modification is in the
# acl_check_data access control list (see below).
av_scanner = clamd:${env{CLAMD_ADDRESS}{$value}{/run/clamav/clamd.ctl}}
# For spam scanning, there is a similar option that defines the interface to
# SpamAssassin. You do not need to set this if you are using the default, which
# is shown in this commented example. As for virus scanning, you must also
# modify the acl_check_data access control list to enable spam scanning.
spamd_address = ${env{SPAMD_ADDRESS}{$value}{/run/spamd/spamd.sock}}
# If Exim is compiled with support for TLS, you may want to enable the
# following options so that Exim allows clients to make encrypted
# connections. In the authenticators section below, there are template
# configurations for plaintext username/password authentication. This kind
# of authentication is only safe when used within a TLS connection, so the
# authenticators will only work if the following TLS settings are turned on
# as well.
# Allow any client to use TLS.
tls_advertise_hosts = *
# Specify the location of the Exim server's TLS certificate and private key.
# The private key must not be encrypted (password protected). You can put
# the certificate and private key in the same file, in which case you only
# need the first setting, or in separate files, in which case you need both
# options.
tls_certificate = ${env{TLS_CERT_FILE}{$value}{/etc/ssl/certs/ssl-cert-snakeoil.pem}}
tls_privatekey = ${env{TLS_KEY_FILE}{$value}{/etc/ssl/private/ssl-cert-snakeoil.key}}
# For OpenSSL, prefer EC- over RSA-authenticated ciphers
tls_require_ciphers = SECURE256:+SECURE128
# In order to support roaming users who wish to send email from anywhere,
# you may want to make Exim listen on other ports as well as port 25, in
# case these users need to send email from a network that blocks port 25.
# The standard port for this purpose is port 587, the "message submission"
# port. See RFC 4409 for details. Microsoft MUAs cannot be configured to
# talk the message submission protocol correctly, so if you need to support
# them you should also allow TLS-on-connect on the traditional but
# non-standard port 465.
daemon_smtp_ports = 25 : 587
# tls_on_connect_ports = 465
# Specify the domain you want to be added to all unqualified addresses
# here. An unqualified address is one that does not contain an "@" character
# followed by a domain. For example, "caesar@rome.example" is a fully qualified
# address, but the string "caesar" (i.e. just a login name) is an unqualified
# email address. Unqualified addresses are accepted only from local callers by
# default. See the recipient_unqualified_hosts option if you want to permit
# unqualified addresses from remote sources. If this option is not set, the
# primary_hostname value is used for qualification.
qualify_domain = shore.co.il
# If you want unqualified recipient addresses to be qualified with a different
# domain to unqualified sender addresses, specify the recipient domain here.
# If this option is not set, the qualify_domain value is used.
# qualify_recipient =
# The following line must be uncommented if you want Exim to recognize
# addresses of the form "user@[10.11.12.13]" that is, with a "domain literal"
# (an IP address) instead of a named domain. The RFCs still require this form,
# but it makes little sense to permit mail to be sent to specific hosts by
# their IP address in the modern Internet. This ancient format has been used
# by those seeking to abuse hosts by using them for unwanted relaying. If you
# really do want to support domain literals, uncomment the following line, and
# see also the "domain_literal" router below.
# allow_domain_literals
# No deliveries will ever be run under the uids of users specified by
# never_users (a colon-separated list). An attempt to do so causes a panic
# error to be logged, and the delivery to be deferred. This is a paranoic
# safety catch. There is an even stronger safety catch in the form of the
# FIXED_NEVER_USERS setting in the configuration for building Exim. The list of
# users that it specifies is built into the binary, and cannot be changed. The
# option below just adds additional users to the list. The default for
# FIXED_NEVER_USERS is "root", but just to be absolutely sure, the default here
# is also "root".
# Note that the default setting means you cannot deliver mail addressed to root
# as if it were a normal user. This isn't usually a problem, as most sites have
# an alias for root that redirects such mail to a human administrator.
never_users = root
# The setting below causes Exim to do a reverse DNS lookup on all incoming
# IP calls, in order to get the true host name. If you feel this is too
# expensive, you can specify the networks for which a lookup is done, or
# remove the setting entirely.
host_lookup = *
# The setting below causes Exim to try to initialize the system resolver
# library with DNSSEC support. It has no effect if your library lacks
# DNSSEC support.
dns_dnssec_ok = 1
# The settings below cause Exim to make RFC 1413 (ident) callbacks
# for all incoming SMTP calls. You can limit the hosts to which these
# calls are made, and/or change the timeout that is used. If you set
# the timeout to zero, all RFC 1413 calls are disabled. RFC 1413 calls
# are cheap and can provide useful information for tracing problem
# messages, but some hosts and firewalls have problems with them.
# This can result in a timeout instead of an immediate refused
# connection, leading to delays on starting up SMTP sessions.
# (The default was reduced from 30s to 5s for release 4.61. and to
# disabled for release 4.86)
#
#rfc1413_hosts = *
#rfc1413_query_timeout = 5s
# Enable an efficiency feature. We advertise the feature; clients
# may request to use it. For multi-recipient mails we then can
# reject or accept per-user after the message is received.
# This supports recipient-dependent content filtering; without it
# you have to temp-reject any recipients after the first that have
# incompatible filtering, and do the filtering in the data ACL.
# Even with this enabled, you must support the old style for peers
# not flagging support for PRDR (visible via $prdr_requested).
#
.ifdef _HAVE_PRDR
prdr_enable = true
.endif
# By default, Exim expects all envelope addresses to be fully qualified, that
# is, they must contain both a local part and a domain. If you want to accept
# unqualified addresses (just a local part) from certain hosts, you can specify
# these hosts by setting one or both of
#
# sender_unqualified_hosts =
# recipient_unqualified_hosts =
#
# to control sender and recipient addresses, respectively. When this is done,
# unqualified addresses are qualified using the settings of qualify_domain
# and/or qualify_recipient (see above).
# Unless you run a high-volume site you probably want more logging
# detail than the default. Adjust to suit.
log_selector = +smtp_protocol_error +smtp_syntax_error \
+tls_certificate_verified
# If you want Exim to support the "percent hack" for certain domains,
# uncomment the following line and provide a list of domains. The "percent
# hack" is the feature by which mail addressed to x%y@z (where z is one of
# the domains listed) is locally rerouted to x@y and sent on. If z is not one
# of the "percent hack" domains, x%y is treated as an ordinary local part. This
# hack is rarely needed nowadays; you should not enable it unless you are sure
# that you really need it.
#
# percent_hack_domains =
#
# As well as setting this option you will also need to remove the test
# for local parts containing % in the ACL definition below.
# When Exim can neither deliver a message nor return it to sender, it "freezes"
# the delivery error message (aka "bounce message"). There are also other
# circumstances in which messages get frozen. They will stay on the queue for
# ever unless one of the following options is set.
# This option unfreezes frozen bounce messages after two days, tries
# once more to deliver them, and ignores any delivery failures.
ignore_bounce_errors_after = 2d
# This option cancels (removes) frozen messages that are older than a week.
timeout_frozen_after = 7d
# By default, messages that are waiting on Exim's queue are all held in a
# single directory called "input" which is itself within Exim's spool
# directory. (The default spool directory is specified when Exim is built, and
# is often /var/spool/exim/.) Exim works best when its queue is kept short, but
# there are circumstances where this is not always possible. If you uncomment
# the setting below, messages on the queue are held in 62 subdirectories of
# "input" instead of all in the same directory. The subdirectories are called
# 0, 1, ... A, B, ... a, b, ... z. This has two benefits: (1) If your file
# system degrades with many files in one directory, this is less likely to
# happen; (2) Exim can process the queue one subdirectory at a time instead of
# all at once, which can give better performance with large queues.
# split_spool_directory = true
# If you're in a part of the world where ASCII is not sufficient for most
# text, then you're probably familiar with RFC2047 message header extensions.
# By default, Exim adheres to the specification, including a limit of 76
# characters to a line, with encoded words fitting within a line.
# If you wish to use decoded headers in message filters in such a way
# that successful decoding of malformed messages matters, you may wish to
# configure Exim to be more lenient.
#
# check_rfc2047_length = false
#
# In particular, the Exim maintainers have had multiple reports of problems
# from Russian administrators of issues until they disable this check,
# because of some popular, yet buggy, mail composition software.
# If you wish to be strictly RFC compliant, or if you know you'll be
# exchanging email with systems that are not 8-bit clean, then you may
# wish to disable advertising 8BITMIME. Uncomment this option to do so.
# accept_8bitmime = false
# Exim does not make use of environment variables itself. However,
# libraries that Exim uses (e.g. LDAP) depend on specific environment settings.
# There are two lists: keep_environment for the variables we trust, and
# add_environment for variables we want to set to a specific value.
# Note that TZ is handled separately by the timezone runtime option
# and TIMEZONE_DEFAULT buildtime option.
keep_environment = ^LDAP : CLAMD_ADDRESS : SPAMD_ADDRESS : DKIM_SELECTOR : DKIM_KEY_FILE : MAILNAME : LMTP_ADDRESS : TLS_KEY_FILE : TLS_CERT_FILE : DOMAIN : ALT_DOMAINS
# add_environment = PATH=/usr/bin::/bin
######################################################################
# ACL CONFIGURATION #
# Specifies access control lists for incoming SMTP mail #
######################################################################
begin acl
# This access control list is used for every RCPT command in an incoming
# SMTP message. The tests are run in order until the address is either
# accepted or denied.
acl_check_rcpt:
# Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
# testing for an empty sending host field.
accept hosts = :
control = dkim_disable_verify
#############################################################################
# The following section of the ACL is concerned with local parts that contain
# @ or % or ! or / or | or dots in unusual places.
#
# The characters other than dots are rarely found in genuine local parts, but
# are often tried by people looking to circumvent relaying restrictions.
# Therefore, although they are valid in local parts, these rules lock them
# out, as a precaution.
#
# Empty components (two dots in a row) are not valid in RFC 2822, but Exim
# allows them because they have been encountered. (Consider local parts
# constructed as "firstinitial.secondinitial.familyname" when applied to
# someone like me, who has no second initial.) However, a local part starting
# with a dot or containing /../ can cause trouble if it is used as part of a
# file name (e.g. for a mailing list). This is also true for local parts that
# contain slashes. A pipe symbol can also be troublesome if the local part is
# incorporated unthinkingly into a shell command line.
#
# Two different rules are used. The first one is stricter, and is applied to
# messages that are addressed to one of the local domains handled by this
# host. The line "domains = +local_domains" restricts it to domains that are
# defined by the "domainlist local_domains" setting above. The rule blocks
# local parts that begin with a dot or contain @ % ! / or |. If you have
# local accounts that include these characters, you will have to modify this
# rule.
deny message = Restricted characters in address
domains = +local_domains
local_parts = ^[.] : ^.*[@%!/|]
# The second rule applies to all other domains, and is less strict. The line
# "domains = !+local_domains" restricts it to domains that are NOT defined by
# the "domainlist local_domains" setting above. The exclamation mark is a
# negating operator. This rule allows your own users to send outgoing
# messages to sites that use slashes and vertical bars in their local parts.
# It blocks local parts that begin with a dot, slash, or vertical bar, but
# allows these characters within the local part. However, the sequence /../
# is barred. The use of @ % and ! is blocked, as before. The motivation here
# is to prevent your users (or your users' viruses) from mounting certain
# kinds of attack on remote sites.
deny message = Restricted characters in address
domains = !+local_domains
local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
#############################################################################
# Accept mail to postmaster in any local domain, regardless of the source,
# and without verifying the sender.
accept local_parts = postmaster
domains = +local_domains
# Deny unless the sender address can be verified.
#require verify = sender
# message = Couldn't verify sender
# Accept if the message comes from one of the hosts for which we are an
# outgoing relay. It is assumed that such hosts are most likely to be MUAs,
# so we set control=submission to make Exim treat the message as a
# submission. It will fix up various errors in the message, for example, the
# lack of a Date: header line. If you are actually relaying out out from
# MTAs, you may want to disable this. If you are handling both relaying from
# MTAs and submissions from MUAs you should probably split them into two
# lists, and handle them differently.
# Recipient verification is omitted here, because in many cases the clients
# are dumb MUAs that don't cope well with SMTP error responses. If you are
# actually relaying out from MTAs, you should probably add recipient
# verification here.
# Note that, by putting this test before any DNS black list checks, you will
# always accept from these hosts, even if they end up on a black list. The
# assumption is that they are your friends, and if they get onto a black
# list, it is a mistake.
accept hosts = +relay_from_hosts
control = submission
control = dkim_disable_verify
# Accept if the message arrived over an authenticated connection, from
# any host. Again, these messages are usually from MUAs, so recipient
# verification is omitted, and submission mode is set. And again, we do this
# check before any black list tests.
accept authenticated = *
control = submission
control = dkim_disable_verify
# Insist that a HELO/EHLO was accepted.
require message = nice hosts say HELO first
condition = ${if def:sender_helo_name}
# Insist that any other recipient address that we accept is either in one of
# our local domains, or is in a domain for which we explicitly allow
# relaying. Any other domain is rejected as being unacceptable for relaying.
require message = relay not permitted
domains = +local_domains : +relay_to_domains
# We also require all accepted addresses to be verifiable. This check will
# do local part verification for local domains, but only check the domain
# for remote domains. The only way to check local parts for the remote
# relay domains is to use a callout (add /callout), but please read the
# documentation about callouts before doing this.
require verify = recipient
# Deny if submitting on port 587 but not authenticated.
deny
condition = ${if eq{$interface_port}{587}}
!authenticated = *
message = All port 587 connections must be Authenticated
#############################################################################
# There are no default checks on DNS black lists because the domains that
# contain these lists are changing all the time. However, here are two
# examples of how you can get Exim to perform a DNS black list lookup at this
# point. The first one denies, whereas the second just warns.
#
# deny dnslists = black.list.example
# message = rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text
#
# warn dnslists = black.list.example
# add_header = X-Warning: $sender_host_address is in a black list at $dnslist_domain
# log_message = found in $dnslist_domain
#############################################################################
#############################################################################
# This check is commented out because it is recognized that not every
# sysadmin will want to do it. If you enable it, the check performs
# Client SMTP Authorization (csa) checks on the sending host. These checks
# do DNS lookups for SRV records. The CSA proposal is currently (May 2005)
# an Internet draft. You can, of course, add additional conditions to this
# ACL statement to restrict the CSA checks to certain hosts only.
#
# require verify = csa
#############################################################################
#############################################################################
# If doing per-user content filtering then recipients with filters different
# to the first recipient must be deferred unless the sender talks PRDR.
#
# defer !condition = $prdr_requested
# condition = ${if > {0}{$receipients_count}}
# condition = ${if !eq {$acl_m_content_filter} \
# {${lookup PER_RCPT_CONTENT_FILTER}}}
# warn !condition = $prdr_requested
# condition = ${if > {0}{$receipients_count}}
# set acl_m_content_filter = ${lookup PER_RCPT_CONTENT_FILTER}
#############################################################################
# At this point, the address has passed all the checks that have been
# configured, so we accept it unconditionally.
accept
# This ACL is used once per recipient, for multi-recipient messages, if
# we advertised PRDR. It can be used to perform receipient-dependent
# header- and body- based filtering and rejections.
# We set a variable to record that PRDR was active used, so that checking
# in the data ACL can be skipped.
.ifdef _HAVE_PRDR
acl_check_prdr:
warn set acl_m_did_prdr = y
#############################################################################
# do lookup on filtering, with $local_part@$domain, deny on filter match
#
# deny set acl_m_content_filter = ${lookup PER_RCPT_CONTENT_FILTER}
# condition = ...
#############################################################################
accept
.endif
# This ACL is used after the contents of a message have been received. This
# is the ACL in which you can test a message's headers or body, and in
# particular, this is where you can invoke external virus or spam scanners.
# Some suggested ways of configuring these tests are shown below, commented
# out. Without any tests, this ACL accepts all messages. If you want to use
# such tests, you must ensure that Exim is compiled with the content-scanning
# extension (WITH_CONTENT_SCAN=yes in Local/Makefile).
acl_check_data:
# Deny if the message contains an overlong line. Per the standards
# we should never receive one such via SMTP.
#
deny condition = ${if > {$max_received_linelength}{998}}
message = maximum allowed line length is 998 octets, \
got $max_received_linelength
# Deny if the headers contain badly-formed addresses.
#
deny !verify = header_syntax
message = header syntax
log_message = header syntax ($acl_verify_message)
# Deny if the message contains a virus. Before enabling this check, you
# must install a virus scanner and set the av_scanner option above.
#
# deny malware = *
# message = This message contains a virus ($malware_name).
# Add headers to a message if it is judged to be spam. Before enabling this,
# you must install SpamAssassin. You may also need to set the spamd_address
# option above.
#
# warn spam = nobody
# add_header = X-Spam_score: $spam_score\n\
# X-Spam_score_int: $spam_score_int\n\
# X-Spam_bar: $spam_bar\n\
# X-Spam_report: $spam_report
# Add headers with SpamAssasin score.
accept
spam = debian-spamd:true
add_header = X-Spam_score: $spam_score\n\
X-Spam_score_int: $spam_score_int\n\
X-Spam_bar: $spam_bar\n\
X-Spam_report: $spam_report\n\
X-Spam-Status: ${if >{$spam_score_int}{50} {Yes} {No}}
# Add a header in case a virus was found.
accept
malware = *
add_header = X-Virus-Status: infected
#############################################################################
# No more tests if PRDR was actively used.
# accept condition = ${if def:acl_m_did_prdr}
#
# To get here, all message recipients must have identical per-user
# content filtering (enforced by RCPT ACL). Do lookup for filter
# and deny on match.
#
# deny set acl_m_content_filter = ${lookup PER_RCPT_CONTENT_FILTER}
# condition = ...
#############################################################################
# Accept the message.
accept
######################################################################
# ROUTERS CONFIGURATION #
# Specifies how addresses are handled #
######################################################################
# THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT! #
# An address is passed to each router in turn until it is accepted. #
######################################################################
begin routers
# This router saves a copy of users outgoing messages to their Sent folder
# by redirecting a copy to their address with +Sent added.
sent_messages:
driver = redirect
cannot_route_message = Cannot save outgoing message to the Sent folder.
debug_print = "R: sent_messages for $local_part@$domain"
unseen = yes
user = Debian-exim
allow_filter = yes
local_part_suffix = +*
local_part_suffix_optional = yes
repeat_use = no
senders = !root@+local_domains : *@+local_domains
data = #Exim filter\n\
unseen deliver $sender_address_local_part+Sent@$sender_address_domain
# This router routes to remote hosts over SMTP by explicit IP address,
# when an email address is given in "domain literal" form, for example,
# . The RFCs require this facility. However, it is
# little-known these days, and has been exploited by evil people seeking
# to abuse SMTP relays. Consequently it is commented out in the default
# configuration. If you uncomment this router, you also need to uncomment
# allow_domain_literals above, so that Exim can recognize the syntax of
# domain literal addresses.
# domain_literal:
# driver = ipliteral
# domains = ! +local_domains
# transport = remote_smtp
# This router can be used when you want to send all mail to a
# server which handles DNS lookups for you; an ISP will typically run such
# a server for their customers. The hostname in route_data comes from the
# macro defined at the top of the file. If not defined, then we'll use the
# dnslookup router below instead.
# Beware that the hostname is specified again in the Transport.
.ifdef ROUTER_SMARTHOST
smarthost:
driver = manualroute
domains = ! +local_domains
transport = smarthost_smtp
route_data = ROUTER_SMARTHOST
ignore_target_hosts = <; 0.0.0.0 ; 127.0.0.0/8 ; ::1
no_more
.else
# This router routes addresses that are not in local domains by doing a DNS
# lookup on the domain name. The exclamation mark that appears in "domains = !
# +local_domains" is a negating operator, that is, it can be read as "not". The
# recipient's domain must not be one of those defined by "domainlist
# local_domains" above for this router to be used.
#
# If the router is used, any domain that resolves to 0.0.0.0 or to a loopback
# interface address (127.0.0.0/8) is treated as if it had no DNS entry. Note
# that 0.0.0.0 is the same as 0.0.0.0/32, which is commonly treated as the
# local host inside the network stack. It is not 0.0.0.0/0, the default route.
# If the DNS lookup fails, no further routers are tried because of the no_more
# setting, and consequently the address is unrouteable.
dnslookup:
debug_print = "R: dnslookup for $local_part@$domain"
driver = dnslookup
domains = ! +local_domains
transport = remote_smtp
ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
# if ipv6-enabled then instead use:
# ignore_target_hosts = <; 0.0.0.0 ; 127.0.0.0/8 ; ::1
no_more
# This closes the ROUTER_SMARTHOST ifdef around the choice of routing for
# off-site mail.
.endif
# The remaining routers handle addresses in the local domain(s), that is those
# domains that are defined by "domainlist local_domains" above.
# This router handles aliasing using a linearly searched alias file with the
# name SYSTEM_ALIASES_FILE. When this configuration is installed automatically,
# the name gets inserted into this file from whatever is set in Exim's
# build-time configuration. The default path is the traditional /etc/aliases.
# If you install this configuration by hand, you need to specify the correct
# path in the "data" setting below.
#
##### NB You must ensure that the alias file exists. It used to be the case
##### NB that every Unix had that file, because it was the Sendmail default.
##### NB These days, there are systems that don't have it. Your aliases
##### NB file should at least contain an alias for "postmaster".
#
# If any of your aliases expand to pipes or files, you will need to set
# up a user and a group for these deliveries to run under. You can do
# this by uncommenting the "user" option below (changing the user name
# as appropriate) and adding a "group" option if necessary. Alternatively, you
# can specify "user" on the transports that are used. Note that the transports
# listed below are the same as are used for .forward files; you might want
# to set up different ones for pipe and file deliveries from aliases.
system_aliases:
debug_print = "R: system_aliases for $local_part@$domain"
driver = redirect
allow_fail
allow_defer
data = ${lookup{$local_part}lsearch{SYSTEM_ALIASES_FILE}}
# user = exim
file_transport = address_file
pipe_transport = address_pipe
# This router matches LDAP users and if it fails, error message is "Recipient
# unknown".
ldap_user:
debug_print = "R: ldap_user for $local_part@$domain"
driver = accept
domains = +local_domains
local_part_suffix = +* : -*
local_part_suffix_optional
transport = lmtp_unix
cannot_route_message = Recipent ${local_part} doesn't exit @${domain}.
retry_use_local_part
condition = ${if eq {} {${lookup ldap {ldapi://%2Fvar%2Frun%2Fslapd%2Fldapi/ou=People,dc=shore,dc=co,dc=il?cn?sub?name=${quote_ldap:$local_part}} {$value} fail}} {0} {1} }
######################################################################
# TRANSPORTS CONFIGURATION #
######################################################################
# ORDER DOES NOT MATTER #
# Only one appropriate transport is called for each delivery. #
######################################################################
# A transport is used only when referenced from a router that successfully
# handles an address.
begin transports
# This transport is used for delivering messages over SMTP connections.
# Refuse to send any message with over-long lines, which could have
# been received other than via SMTP. The use of message_size_limit to
# enforce this is a red herring.
remote_smtp:
debug_print = "T: remote_smtp for $local_part@$domain"
driver = smtp
message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}}
dkim_domain = ${env{DOMAIN}{$value}{@}}
dkim_selector = ${env{DKIM_SELECTOR}{$value}{@}}
dkim_private_key = ${env{DKIM_KEY_FILE}{$value}{/etc/exim4/dkim.key}}
user = Debian-exim
group = Debian-exim
# This transport is used for delivering messages to a smarthost, if the
# smarthost router is enabled. This starts from the same basis as
# "remote_smtp" but then turns on various security options, because
# we assume that if you're told "use smarthost.example.org as the smarthost"
# then there will be TLS available, with a verifiable certificate for that
# hostname, using decent TLS.
smarthost_smtp:
driver = smtp
message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}}
multi_domain
#
.ifdef _HAVE_TLS
# Comment out any of these which you have to, then file a Support
# request with your smarthost provider to get things fixed:
hosts_require_tls = *
tls_verify_hosts = *
# As long as tls_verify_hosts is enabled, this won't matter, but if you
# have to comment it out then this will at least log whether you succeed
# or not:
tls_try_verify_hosts = *
#
# The SNI name should match the name which we'll expect to verify;
# many mail systems don't use SNI and this doesn't matter, but if it does,
# we need to send a name which the remote site will recognize.
# This _should_ be the name which the smarthost operators specified as
# the hostname for sending your mail to.
tls_sni = ROUTER_SMARTHOST
#
.ifdef _HAVE_OPENSSL
tls_require_ciphers = HIGH:!aNULL:@STRENGTH
.endif
.ifdef _HAVE_GNUTLS
tls_require_ciphers = SECURE192:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1
.endif
.endif
# This transport is used for local delivery to user mailboxes in traditional
# BSD mailbox format. By default it will be run under the uid and gid of the
# local user, and requires the sticky bit to be set on the /var/mail directory.
# Some systems use the alternative approach of running mail deliveries under a
# particular group instead of using the sticky bit. The commented options below
# show how this can be done.
local_delivery:
driver = appendfile
file = /var/mail/$local_part_data
delivery_date_add
envelope_to_add
return_path_add
# group = mail
# mode = 0660
# This transport is used for handling pipe deliveries generated by alias or
# .forward files. If the pipe generates any standard output, it is returned
# to the sender of the message as a delivery error. Set return_fail_output
# instead of return_output if you want this to happen only when the pipe fails
# to complete normally. You can set different transports for aliases and
# forwards if you want to - see the references to address_pipe in the routers
# section above.
address_pipe:
driver = pipe
return_output
# This transport is used for handling deliveries directly to files that are
# generated by aliasing or forwarding.
address_file:
driver = appendfile
delivery_date_add
envelope_to_add
return_path_add
# This transport is used for handling autoreplies generated by the filtering
# option of the userforward router.
address_reply:
driver = autoreply
# This transport uses LMTP over a Unix socket to deliver to a different
# server for storage.
lmtp_unix:
debug_print = "T: lmtp_unix for $local_part@$domain"
driver = lmtp
socket = ${env{LMTP_ADDRESS}{$value}{/run/dovecot/lmtp}}
rcpt_include_affixes = yes
user = Debian-exim
group = Debian-exim
lmtp_tcp:
debug_print = "T: lmtp_tcp for $local_part@$domain"
driver = smtp
protocol = lmtp
hosts = ${env{LMTP_ADDRESS}{$value}{imap}}
rcpt_include_affixes = yes
user = $exim_uid
group = $exim_gid
######################################################################
# RETRY CONFIGURATION #
######################################################################
begin retry
# This single retry rule applies to all domains and all errors. It specifies
# retries every 15 minutes for 2 hours, then increasing retry intervals,
# starting at 1 hour and increasing each time by a factor of 1.5, up to 16
# hours, then retries every 6 hours until 4 days have passed since the first
# failed delivery.
# WARNING: If you do not have any retry rules at all (this section of the
# configuration is non-existent or empty), Exim will not do any retries of
# messages that fail to get delivered at the first attempt. The effect will
# be to treat temporary errors as permanent. Therefore, DO NOT remove this
# retry rule unless you really don't want any retries.
# Address or Domain Error Retries
# ----------------- ----- -------
* * F,2h,15m; G,16h,1h,1.5; F,4d,6h
######################################################################
# REWRITE CONFIGURATION #
######################################################################
# There are no rewriting specifications in this default configuration file.
begin rewrite
######################################################################
# AUTHENTICATION CONFIGURATION #
######################################################################
# The following authenticators support plaintext username/password
# authentication using the standard PLAIN mechanism and the traditional
# but non-standard LOGIN mechanism, with Exim acting as the server.
# PLAIN and LOGIN are enough to support most MUA software.
#
# These authenticators are not complete: you need to change the
# server_condition settings to specify how passwords are verified.
# They are set up to offer authentication to the client only if the
# connection is encrypted with TLS, so you also need to add support
# for TLS. See the global configuration options section at the start
# of this file for more about TLS.
#
# The default RCPT ACL checks for successful authentication, and will accept
# messages from authenticated users from anywhere on the Internet.
begin authenticators
# PLAIN authentication has no server prompts. The client sends its
# credentials in one lump, containing an authorization ID (which we do not
# use), an authentication ID, and a password. The latter two appear as
# $auth2 and $auth3 in the configuration and should be checked against a
# valid username and password. In a real configuration you would typically
# use $auth2 as a lookup key, and compare $auth3 against the result of the
# lookup, perhaps using the crypteq{}{} condition.
PLAIN:
driver = plaintext
server_set_id = $auth2
server_prompts = :
server_condition = ${if ldapauth{user="cn=${quote_ldap_dn:$auth2},ou=People,dc=shore,dc=co,dc=il" pass=${quote:$auth3} ldapi://${quote_ldap:/run/slapd/ldapi}}}
server_advertise_condition = ${if def:tls_in_cipher }
# LOGIN authentication has traditional prompts and responses. There is no
# authorization ID in this mechanism, so unlike PLAIN the username and
# password are $auth1 and $auth2. Apart from that you can use the same
# server_condition setting for both authenticators.
LOGIN:
driver = plaintext
server_set_id = $auth1
server_prompts = <| Username: | Password:
server_condition = ${if ldapauth{user="cn=${quote_ldap_dn:$auth1},ou=People,dc=shore,dc=co,dc=il" pass=${quote:$auth2} ldapi://${quote_ldap:/run/slapd/ldapi}}}
server_advertise_condition = ${if def:tls_in_cipher }
######################################################################
# CONFIGURATION FOR local_scan() #
######################################################################
# If you have built Exim to include a local_scan() function that contains
# tables for private options, you can define those options here. Remember to
# uncomment the "begin" line. It is commented by default because it provokes
# an error with Exim binaries that are not built with LOCAL_SCAN_HAS_OPTIONS
# set in the Local/Makefile.
# begin local_scan
# End of Exim configuration file
mail-docker-master/spamd/ 0000775 0000000 0000000 00000000000 14566342525 0015656 5 ustar 00root root 0000000 0000000 mail-docker-master/spamd/.dockerignore 0000664 0000000 0000000 00000000065 14566342525 0020333 0 ustar 00root root 0000000 0000000 *
!entrypoint
!spamd-ping
!spamd-learn
!spamd-update
mail-docker-master/spamd/Dockerfile 0000664 0000000 0000000 00000002221 14566342525 0017645 0 ustar 00root root 0000000 0000000 FROM docker.io/debian:bookworm-slim
# hadolint ignore=DL3008
RUN apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
gnupg \
libmail-spf-perl \
sa-compile \
spamassassin \
spamc \
spamd \
&& \
usermod --append --groups mail debian-spamd && \
install -m 640 -o debian-spamd -g debian-spamd /dev/null /var/run/spamd.pid && \
install -d -m 750 -o debian-spamd -g debian-spamd /run/spamd && \
install -d -m 750 -o debian-spamd -g debian-spamd /var/backups/sa-learn && \
rm -rf /run/spamd/* /var/backups/sa-learn/* && \
rm -rf /tmp/* /var/tmp/* /var/lib/apt/lists/* /var/cache/apt/archives/*
COPY --chown=root:root entrypoint spamd-ping spamd-learn spamd-update /usr/local/bin/
USER debian-spamd
WORKDIR /var/lib/spamassassin
RUN spamd-update
EXPOSE 7783
VOLUME /run/spamd
VOLUME /var/backups/sa-learn
ENTRYPOINT [ "entrypoint" ]
CMD [ "spamd", "--create-prefs", "--max-children=5", "--helper-home-dir", "--listen=0.0.0.0:7783", "--socketpath=/var/run/spamd/spamd.sock", "--syslog=stderr", "--pidfile=/var/run/spamd.pid" ]
HEALTHCHECK CMD spamd-ping
mail-docker-master/spamd/README.md 0000664 0000000 0000000 00000002144 14566342525 0017136 0 ustar 00root root 0000000 0000000 # spamd
> SpamAssassin container image.
## Exposed interfaces
The daemon is accessible over TCP at port 7783 and over the `spamd.sock` Unix
socket in the `/run/spamd` volume.
## Training the Bayesian classifier
The image comes with the script `spamd-learn` which goes over the mobx files in
`/var/mail`, uses them for training the classifier and them saves the database
in the `/var/backups/sa-learn` volume. On startup, the container restores the
database from that volume. To update the database run `spamd-learn` from inside
the container with `docker exec` (there's no need to restart the container
afterwards). For an example see the [Cron image](../crond) inside this project.
## Updating the rules
Use the `spamd-update` script in the image.
## License
This software is licensed under the MIT license (see `LICENSE.txt`).
## Author Information
Nimrod Adar, [contact me](mailto:nimrod@shore.co.il) or visit my
[website](https://www.shore.co.il/). Patches are welcome via
[`git send-email`](http://git-scm.com/book/en/v2/Git-Commands-Email). The repository
is located at: .
mail-docker-master/spamd/entrypoint 0000775 0000000 0000000 00000000243 14566342525 0020016 0 ustar 00root root 0000000 0000000 #!/bin/sh
set -eux
if [ -f /var/backups/sa-learn/backup.txt ]
then
sh -c 'sleep 60; sa-learn --restore /var/backups/sa-learn/backup.txt' &
fi
eval exec "$@"
mail-docker-master/spamd/gtube.txt 0000664 0000000 0000000 00000001437 14566342525 0017532 0 ustar 00root root 0000000 0000000 Subject: Test spam mail (GTUBE)
Message-ID:
Date: Wed, 23 Jul 2003 23:30:00 +0200
From: Sender
To: Recipient
Precedence: junk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
This is the GTUBE, the
Generic
Test for
Unsolicited
Bulk
Email
If your spam filter supports it, the GTUBE provides a test by which you
can verify that the filter is installed correctly and is detecting incoming
spam. You can send yourself a test mail containing the following string of
characters (in upper case and with no white spaces and line breaks):
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
You should send this test mail from an account outside of your network.
mail-docker-master/spamd/spamd-learn 0000775 0000000 0000000 00000000705 14566342525 0020011 0 ustar 00root root 0000000 0000000 #!/bin/sh
set -eux
# shellcheck disable=SC2044
for user in $(find /var/mail -maxdepth 1 -mindepth 1 -type d)
do
sa-learn --spam --mbox --forget "$user/Junk" || true
find "$user" \
-maxdepth 1 \
-type f \
-mtime -2 \
\! -name Junk \
\! -name Inbox \
\! -name Sent \
-execdir sa-learn --ham --mbox --forget "{}" \;
done
sa-learn --sync
sa-learn --backup > /var/backups/sa-learn/backup.txt
mail-docker-master/spamd/spamd-ping 0000775 0000000 0000000 00000000245 14566342525 0017644 0 ustar 00root root 0000000 0000000 #!/bin/sh
set -eux
sa-check_spamd --verbose --socketpath /run/spamd/spamd.sock || exit 1
sa-check_spamd --verbose --hostname localhost --port 7783 || exit 1
exit 0
mail-docker-master/spamd/spamd-update 0000775 0000000 0000000 00000000725 14566342525 0020174 0 ustar 00root root 0000000 0000000 #!/bin/sh
set -eux
sa-update --gpghomedir /var/lib/spamassassin/sa-update-keys --verbose || exitcode="$?"
if [ "${exitcode:-0}" -eq '0' ]
then
echo 'Successful update, recompiling rules and reloading spamd.' >&2
sa-compile || true
kill -HUP "$(cat /var/run/spamd.pid)" || true
elif [ "${exitcode}" -eq '1' ]
then
echo 'No updates were available, exiting.' >&2
exit 0
else
echo "Update failed, exit code $exitcode." >&2
exit "$exitcode"
fi