Zabieramy się za konfiguracje naszego EXIMA:
##########################################################
# Runtime configuration file for Exim #
##########################################################
##########################################################
# MAIN CONFIGURATION SETTINGS #
##########################################################
# nazwa naszego Hosta
primary_hostname = domena.pl

# Obsługa wielu domen, ustawiamy aktywna domenę, adresy IP na których nasłuchuje EXIM

local_interfaces = 127.0.0.1 : IP1 : IP2

smtp_active_hostname = ${lookup{$interface_address}lsearch{/etc/exim/domeny_ip}{$value}{$primary_hostname}}

smtp_banner = „$smtp_active_hostname ESMTP $tod_full”

# Ustawiamy nagłowek wiadmości zależny od aktywnej domeny

message_id_header_domain = $smtp_active_hostname

# Tutaj wpisujemy domeny jakie mamy i nasz EXIM bedzie obsługiwał
domainlist local_domains = domena.pl : domena1.pl : domena2.pl
domainlist relay_to_domains =
# Którym hostom pozwalamay na relaying, poniżej mamy sieć lokalną z
maską 24-bitowa
hostlist relay_from_hosts = 127.0.0.1 : 192.168.0.0/24

#Porty nasłuchiwania

daemon_smtp_ports = 25 : 465 : 587
tls_on_connect_ports = 465
smtp_accept_max = 400

# Limit wielkości wiadomości

message_size_limit = 100M

# ustawienia dla list ACL
acl_smtp_data = acl_check_data
# nasz Clamav

av_scanner = clamd:/var/run/clamdav/clamd

acl_smtp_rcpt = acl_check_rcpt

acl_smtp_auth = acl_check_auth

LIM = 100
PERIOD = 1h
WARNTO = abuse@tax-net.pl
EXIMBINARY = /usr/local/exim/bin/exim -f root
SHELL = /bin/sh

acl_smtp_quit = acl_check_quit
acl_smtp_notquit = acl_check_notquit
acl_smtp_mail = acl_check_mail
acl_smtp_connect = acl_check_connect

# filtr tematów wiadomości
system_filter = /etc/exim/filtr_tematow
message_body_visible = 5000
system_filter_file_transport = address_file
system_filter_reply_transport = address_pipe
never_users = root : nobody
# Zadanie lookupu od hosta
host_lookup = *
# Żądanie odpowiedzi od sendera wg, standardu rfs 1413

smtp_enforce_sync = false

rfc1413_hosts = *
rfc1413_query_timeout = 30s

sender_unqualified_hosts = 192.168.0.0/24

# Po dwóch dniach usuwa błedne wiadomości
ignore_bounce_errors_after = 2d
# Ustawienia dla TLS
tls_advertise_hosts = *
tls_certificate = /etc/exim/cert/exim.crt
tls_privatekey = /etc/exim/cert/exim.key
tls_dhparam = /etc/exim/cert/dhparam.pem
# po 3 dniach usuwa wiadmosci frozen ze spool
timeout_frozen_after = 3d
check_log_space = 3M
#######################################################
# ACL CONFIGURATION #
# Specifies access control lists for incoming SMTP mail #
#######################################################

{loadposition Adsense}
# Listy ACL
begin acl
acl_check_data:
# zabraniamy na przesyłanie plików com,vbs,bat,pif,scr
#wiadomo dlaczego
deny message = $found_extension files are not accepted here
demime = com:vbs:bat:pif:scr
deny message = Niedozwolony zalacznik MIME ($demime_reason)
demime = *
condition = ${if >{$demime_errorlevel}{2}{1}{0}}
# po znalezieniu wirusa przez Clamav zostaje nam ślad w logu
deny message = Wiadomosc zawiera wirusa {$malware_name}
malware = *
accept
# Autoryzacja
acl_check_auth:

drop  message = authentication is allowed only once per message in order to slow down bruteforce cracking
set acl_m_auth = ${eval10:0$acl_m_auth+1}
condition = ${if >{$acl_m_auth}{2}}
delay = 22s

drop  message = blacklisted for bruteforce cracking attempt
set acl_c_authnomail = ${eval10:0$acl_c_authnomail+1}
condition = ${if >{$acl_c_authnomail}{4}}
continue = ${run{SHELL -c „echo $sender_host_address >>/var/spool/exim/blacklists/blocked_IPs;N{N echo Subject: $sender_host_address blocked; echo; echo for bruteforce auth cracking attempt.; N}N | EXIMBINARY WARNTO”}}

accept

accept encrypted = *
accept hosts = *
accept condition = ${if eq{${substr_0_5:$smtp_command_argument}}(PLAIN}{yes}{no}}
accept condition = ${if eq{${substr_0_8:$smtp_command_argument}}{LOGIN}{yes}{no}}

acl_check_quit:
warn  condition = ${if def:authentication_failed}
condition = $authentication_failed
logwrite = :reject: quit after authentication failed: ${sg{$sender_rcvhost}{N[nt]+N}{�40}}
ratelimit = 7 / 5m / strict / per_conn
continue = ${run{SHELL -c „echo $sender_host_address >>/var/spool/exim/blacklists/blocked_IPs;N{N echo Subject: $sender_host_address blocked; echo; echo for bruteforce auth cracking attempt.;N}N | EXIMBINARY WARNTO”}}

acl_check_notquit:
warn  condition = ${if def:authentication_failed}
condition = $authentication_failed
logwrite = :reject: $smtp_notquit_reason after authentication failed: ${sg{$sender_rcvhost}{N[nt]+N}{�40}}
condition = ${if eq{$smtp_notquit_reason}{connection-lost}}
ratelimit = 7 / 5m / strict / per_conn
continue = ${run{SHELL -c „echo $sender_host_address >>/var/spool/exim/blacklists/blocked_IPs;N{N echo Subject: $sender_host_address blocked; echo; echo for bruteforce auth cracking attempt.;N}N | EXIMBINARY WARNTO”}}

acl_check_mail:
accept set acl_c_authnomail = 0

acl_check_connect:
drop  message = $sender_host_address locally blacklisted for a bruteforce auth (login+password) cracking attempt
condition = ${if exists{/var/spool/exim/blacklists/blocked_IPs}}
condition = ${lookup{$sender_host_address}lsearch{/var/spool/exim/blacklists/blocked_IPs}{1}{0}}
accept
acl_check_rcpt:

# Greylisting

defer  log_message = Greylistowany host $sender_host_address
domains     = +local_domains
!authenticated = *
verify      = recipient/callout=20s,use_sender,defer_ok
set acl_m0  = request=smtpd_access_policynprotocol_state=RCPTnprotocol_
name=${uc:$received_protocol}nhelo_name=$sender_helo_namenclient_address=$send
er_host_addressnclient_name=$sender_host_namensender=$sender_addressnrecipien
t=$local_part@$domainnn
set acl_m0  = ${sg{${readsocket{/var/run/postgrey/postgrey}{$acl_m0}{5s}{
}{action=DUNNO}}}{action=}{}}
message     = ${sg{$acl_m0}{^\w+\s*}{}}
condition   = ${if eq{${uc:${substr{0}{5}{$acl_m0}}}}{DEFER}{true}{false}}

# Biała lista – używajac systemu RBL (czarnych list ) zdarza się że
# umieszczone na nich są hosty z których otrzymujemy wiadomości, np.
# o2.pl, onet.pl, a także hosty uslugodawców internetu np. orange.pl.
# Użytkownicy nie mogż wtedy korzystać z poczty za pośrednictwem połączeń
# od operatorów komórkowych, dodajemy więc do tej listy zaufane hosty,
# lub domeny, jeden/judna w wierszu w formacie IP, IP/maska, *.domena
accept hosts = /etc/exim/listy_acl/bialalista :
deny local_parts = ^.*[@%!/|] : ^\.
require verify = sender

drop    message          = „No you are Me or OURS (HELO was $sender_helo_name and equal my local domains or my domains relay)”
condition     = ${if match_domain{$sender_helo_name}{+local_domains:+relay_to_domains}{yes}{no}}
delay          = 45s

drop   message        = No you are not Me or OURS (HELO was $sender_helo_name and the subdomain is my domain ${extract{-3}{.}{$sender_helo_name}}.${extract{-2}{.}{$sender_helo_name}}.${extract{-1}{.}{$sender_helo_name}})
condition      = ${if match_domain{${extract{-3}{.}{$sender_helo_name}}.${extract{-2}{.}{$sender_helo_name}}.${extract{-1}{.}{$sender_helo_name}}}{+local_domains:+relay_to_domains}{yes}{no}}
delay          = 45s

drop   message        = No you are not ME or OURS (HELO was $sender_helo_name and equal my interface hostname)
condition      = ${if !def:interface_address {no}{yes}}
condition      = ${if match_ip{$interface_address}{${lookup dnsdb{>: defer_never,a=$sender_helo_name}}}{yes}{no}}
delay          = 45s
# Dodatkowa opcja – mamy pewną grupę userów w domenie np.
# domena.pl i chcemy wyslać do wszystkich wiadomość, można poprostu
# dodac odbiorców w programie pocztowym, ale można też zrobić alias do
# np. wszyscy@domena.pl, poniższy wpis powoduje to że do
# wszyscy@domena.pl może tylko wyslać osoba która znajduje się na liście
# wszyscy@domena.pl, zabezpiecza to przez masowym docieraniem spamu na
# konta użytkowników
deny
message = „Nie jestes uprawniony aby wyslac poczte na ten adres”
condition = ${if exists{/etc/exim/${local_part}@${domain}}{1}{0}}
senders = ! /etc/exim/${local_part}@${domain}
# Definicja własnej Czarnej listy
deny
message = „Tych klientow nie obslugujemy”
hosts = /etc/exim/listy_acl/czarnalista :

# SPF (Sender Policy Framework)

deny
message       = $sender_host_address nie ma pozwolenia by wysyłać poczte  od $sender_address_domain
log_message   = Brak SPF
spf           = fail

# Ustawienia RBL, najbardziej extremalna z tej listy jest
# sbl-xbl.smaphaus.org, na niej jest o2.pl onet.pl
deny
message = rejected because $sender_host_address jest na czarnej liscie $dnslist_domainn$dnslist_text
dnslists = bl.spamcop.net : sbl-xbl.spamhaus.org : relays.ordb.org : dnsbl.njabl.org : dnsbl.sorbs.net
#
warn message = X-Warning: $sender_host_address is in a black list at $dnslist_domain
dnslists = dialups.mail-abuse.org
############################################################
# Bez komentarza, wiadomo o co chodzi
accept domains = +local_domains
endpass
message = nieznany uzytkownik
verify = recipient
accept domains = +relay_to_domains
endpass
message = nieznany adres
verify = recipient
accept hosts = !@[] : +relay_from_hosts
set acl_m_user = $sender_host_address
condition = ${if exists{/var/spool/exim/blacklists/blocked_relay_users}}
condition = ${lookup{$acl_m_user}lsearch{/var/spool/exim/blacklists/blocked_relay_users}{1}{0}}
control = freeze/no_tell
control = submission/sender_retain/domain=
add_header = X-Relayed-From: $acl_m_user

accept hosts = !@[] : +relay_from_hosts
!verify = recipient/defer_ok/callout=10s,defer_ok,use_sender
ratelimit = LIM / PERIOD / per_rcpt / relayuser-$acl_m_user
continue = ${run{SHELL -c „echo $acl_m_user >>/var/spool/exim/blacklists/blocked_relay_users; N{N echo Subject: relay user $acl_m_user blocked; echo; echo because has sent mail to LIM invalid recipients during PERIOD.; N}N | EXIMBINARY WARNTO”}}
control = freeze/no_tell
control = submission/sender_retain/domain=
add_header = X-Relayed-From: $acl_m_user

accept  hosts         = +relay_from_hosts
control = submission/sender_retain/domain=
# Akceptujemy tylko autoryzowanych użytkownikow
accept authenticated = *
set acl_m_user = $authenticated_id
condition = ${if exists{$spool_directory/blocked_authenticated_users}}
condition = ${lookup{$acl_m_user}lsearch{/var/spool/exim/blacklists/blocked_authenticated_users}{1}{0}}
control = freeze/no_tell
control = submission/sender_retain/domain=
add_header = X-Authenticated-As: $acl_m_user

accept authenticated = *
!verify = recipient/defer_ok/callout=10s,defer_ok,use_sender
ratelimit = LIM / PERIOD / per_rcpt / user-$acl_m_user
continue = ${run{SHELL -c „echo $acl_m_user >>/var/spool/exim/blacklists/blocked_authenticated_users; N{N echo Subject: user $acl_m_user blocked; echo; echo because has sent mail to LIM invalid recipients during PERIOD.; N}N | EXIMBINARY WARNTO”}}
control = freeze/no_tell
control = submission/sender_retain/domain=
add_header = X-Authenticated-As: $acl_m_user

accept authenticated = *
control = submission/sender_retain/domain=
# Jeżeli wysyłający ma złe hasło lub login to w przypadku np. Outlook
# Express w monicie blędu pokaże mu sie tekst ponizej
deny
message = authentication PLAIN or LOGIN required – relay not permitted
###########################################################
# ROUTERS CONFIGURATION #
# Specifies how addresses are handled #
############################################################
# THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT! #
# An address is passed to each router in turn until it is accepted. #
############################################################

begin routers

#bogofilter

bogo_router:
domains = +local_domains
no_verify
condition = ${if !eq {$received_protocol}{bogodone} {1}{0}}
driver = accept
transport = bogo_transport

dnslookup:
driver = dnslookup
domains = ! +local_domains
transport = remote_smtp
ignore_target_hosts = 127.0.0.0/8
no_more
# Ustawienia aliasów, celowo ustawiony plik aliasów ma
# format $domain, z tego powodu ze jezeli nasz Exim obsługuje
# kilka domen musimy rozgraniczyc konta userów do danej domeny
system_aliases:
driver = redirect
allow_fail
allow_defer
data = ${lookup{$local_part}lsearch{/etc/exim/$domain}}
file_transport = address_file
pipe_transport = address_pipe
# Ustawienia dla pliku .forward w katalogu użytkownika
userforward:
driver = redirect
check_local_user
file = $home/.forward
no_verify
no_expn
check_ancestor
file_transport = address_file
pipe_transport = address_pipe
reply_transport = address_reply
# vacation – automatyczna odpowiedź
uservacation:

driver = accept require files = /var/mail/vacation/${local_part}/vacation.msg
condition = ${if or {{match {$h_precedence:} {(?i)junk|bulk|list}} {eq {sender_address} {}}} {no} {yes}}
senders = ” ! ^.*-request@.*:
! ^.*@list*.*:
! ^owner-.*@.*:
! ^postmaster@.*:
! ^listmaster@.*:
! ^mailer-daemon@.*
! ^root@.*”
no_expn
transport = vacation_reply
unseen
no_verify
# Lokalne skrzynki pocztowe
localuser:
driver = accept
check_local_user
transport = local_delivery
############################################################
# TRANSPORTS CONFIGURATION #
############################################################
# ORDER DOES NOT MATTER #
# Only one appropriate transport is called for each delivery. #
############################################################
begin transports
# Ustawienia transportu wiadomości, dodamy tu sobie stopkę z informacją
# że poczta byla skanowana antyvirem
# do tego celu świetnie nadaje się maly programik altermime, opis
# konfiguracji w dalszej częsci

#Transport Bogofilter

bogo_transport:
driver = pipe
command = /usr/local/exim/bin/exim -oMr bogodone -bS
use_bsmtp = true
headers_add = X-Bogofilterd: true
transport_filter = /usr/local/bin/bogofilter -d /var/spool/bogofilter -l -p -e -u
return_fail_output = true
group = eximgrp
user = exim
home_directory = „/tmp/bogofilter”
current_directory = „/tmp/bogofilter”
log_output = true
return_path_add = false

remote_smtp:
debug_print = „T: remote_smtp for @local_part@$domain”
driver = smtp

interface = „${lookup{$sender_address_domain}lsearch{/etc/exim/ip_domeny}{$value}}”
helo_data = „${lookup{$interface_address}lsearch{/etc/exim/domeny_ip}{$value}}”
transport_filter = /usr/local/bin/sh.stopka $sender_address
# gdzie trafiają moje maile ? odpowiedz poniżej wraz z dopisaniem stopki.
local_delivery:
driver = appendfile
transport_filter = /usr/local/bin/sh.stopka $sender_address
file = /var/mail/$local_part
delivery_date_add
envelope_to_add
return_path_add
group = users
# dalsze ustawienia pliku .forward
address_pipe:
driver = pipe
return_output
address_file:
driver = appendfile
delivery_date_add
envelope_to_add
return_path_add
address_reply:
driver = autoreply
# transport dla vacation
vacation_reply:
driver = autoreply
file = /var/mail/vacation/$local_part/vacation.msg
file_expand
from = System Automatycznej Odpowiedzi <$original_local_part@orginal_domain>
log = /var/mail/vacation/$local_part/vacation.db
once_repeat = 7d
subject = ${if def:h_Subject: {Re: ${quote:${escape:${length_50:$h_Subject:}}} (autoreply)} {Informacja} }
text = ”
Witaj $h_fromnn
Ta wiadomosc zostala wygenerowana automatycznien
Tekst ponizej zawiera informacje od uzytkownika:n
===================================================nn
”
to = „$sender_address”
#############################################################
# RETRY CONFIGURATION #
#############################################################
# Te ustawienia powodują że np. jeżeli padł jakiś serwer odbiorcy do
# którego piszesz to po czasie jaki tu jest ustawiony wiadomość będzie
# powtórnie wysłana
begin retry
# Domain Error Retries
# —— —– ——-
* * F,2h,15m; G,16h,1h,1.5; F,4d,6h
##############################################################
# REWRITE CONFIGURATION #
##############################################################
# There are no rewriting specifications in this default configuration file.
begin rewrite
##############################################################
# AUTHENTICATION CONFIGURATION #
##############################################################
# Ustawienia autoryzacji pwcheck.
begin authenticators
fixed_plain:
driver = plaintext
public_name = PLAIN
server_prompts = :
server_condition = ${if pwcheck{$2:$3}{1}{0}}
server_set_id = $2
login:
driver = plaintext
public_name = LOGIN
server_prompts = „Username:: : Password::”
server_condition = ${if pwcheck{$1:$2}{1}{0}}
server_set_id = $1
# I to by bylo na tyle pozostaje generacja certyfikatów dla TLS
openssl req -new -x509 -days 365 -nodes -out /etc/exim/cert/exim.crt -keyout /etc/exim/exim.key 
openssl dhparam -out /etc/exim/dhparam.pem 1024