Thanks for that anup. But I have many things in mine that you don't. My intention is not to replicate your settings (although I'm very grateful to you for sharing!)
S my simple question is: does the order of these commands matter? If I put my DNSLIST call at the very end, would it make a difference? I would like ALL these tests to be undertaken before a message is delivered.
With my current setup, even though a message passes the RBL check, it should be getting caught by the faulty HELP check, but it is not. Hence the question. It seems all these tests are not being undertaken. How can I make sure they are, and in the order I specify?
My full new code is below. Before I enter it in, just wanted to see if this is correct. Thanks for your thoughts!
Code:
#!!# ACL that is used after the RCPT command
check_recipient:
# Exim 3 had no checking on -bs messages, so for compatibility
# we accept if the source is local SMTP (i.e. not over TCP/IP).
# We do this by testing for an empty sending host field.
accept hosts = :
#---------------------------------------------------------------------
# First, deny all that have malformed addresses
#---------------------------------------------------------------------
deny domains = !+local_domains
local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
log_message = Invalid local part
##--------------------------------------------------------------------
##-- Added Chirpy's dictionary attack protection
##-- From http://www.configserver.com/free/eximdeny.html
##-- [ERICK_P May 29 2005]
##--------------------------------------------------------------------
drop hosts = /etc/exim_deny
message = Connection denied after dictionary attack
log_message = Connection denied from $sender_host_address after dictionary attack
drop message = Appears to be a dictionary attack
log_message = Dictionary attack (after $rcpt_fail_count failures)
condition = ${if > {${eval:$rcpt_fail_count}}{3}{yes}{no}}
condition = ${run{/etc/exim_deny.pl $sender_host_address }{yes}{no}}
!verify = recipient
##--------------------------------------------------------------------
#--------- [ERICK_P MAY 29 2005] HELO VERIFICATION ---------------------
# BE POLITE AND SAY HELO. REJECT ANYTHING FROM HOSTS THAT HAVN'T GIVEN
# A VALID HELO/EHLO TO US.
#---------------------------------------------------------------------
deny
message = Bad HELO: Empty HELO, Polite hosts say HELO first. Please see RFC 2821 section 4.1.1.1.
condition = ${if eq{$sender_helo_name}{}{yes}{no}}
#---------------------------------------------------------------------
# FORGED HOSTNAME -HELOS AS ONE OF MY OWN IPS
# FORGED HELO (OUR IP/HOSTNAME)
#---------------------------------------------------------------------
deny message = Forged HELO: You are not $sender_helo_name as you claim. You are not allowed to use it in HELO/EHLO as per RFC Standards.
!hosts = @[]
!hosts = +rv_relay_hosts
!authenticated = *
condition = ${if eq{$sender_helo_name}{$interface_address}{yes}{no}}
#---------------------------------------------------------------------
# FORGED HOSTNAME - HELOS AS MY OWN HOSTNAME OR DOMAIN
#---------------------------------------------------------------------
deny message = Forged HELO: you are not $sender_helo_name our local domain and you are not allowed to use as per RFC Standards.
#---------------------------------------------------------------------
# ACCEPT HELO WHICH IS IN LOCAL_DOMAIN IF WE RELAY OR HAD SMTP AUTH
#---------------------------------------------------------------------
!hosts = @[]
!hosts = +rv_relay_hosts
!authenticated = *
condition = ${if match_domain{$sender_helo_name}{+local_domains}{yes}{no}}
#---------------------------------------------------------------------
# HACKED HELO (DOMAIN.COM) (CONSTRUCTED BY VIRUSES)
#---------------------------------------------------------------------
deny message = Hacked HELO: you are not $sender_helo_name
condition = ${if match {$sender_helo_name}{\N^[A-Z0-9]+\.[a-z]+$\N}{yes}{no}}
condition = ${if match {$sender_helo_name}{\N^[0-9]+\.[a-z]+$\N}{no}{yes}}
!hosts = @[]
!hosts = +rv_relay_hosts
!authenticated = *
#---------------------------------------------------------------------
# MAILMAN STUFF:
# Accept bounces to lists even if callbacks or other checks would fail
#---------------------------------------------------------------------
warn message = X-WhitelistedRCPT-nohdrfromcallback: Yes
condition = \
${if and {{match{$local_part}{(.*)-bounces\+.*}} \
{exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}/config.pck}}} \
{yes}{no}}
accept condition = \
${if and {{match{$local_part}{(.*)-bounces\+.*}} \
{exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}/config.pck}}} \
{yes}{no}}
# Accept bounces to lists even if callbacks or other checks would fail
warn message = X-WhitelistedRCPT-nohdrfromcallback: Yes
condition = \
${if and {{match{$local_part}{(.*)-bounces\+.*}} \
{exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}_${lc:$domain}/config.pck}}} \
{yes}{no}}
accept condition = \
${if and {{match{$local_part}{(.*)-bounces\+.*}} \
{exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}_${lc:$domain}/config.pck}}} \
{yes}{no}}
#---------------------------------------------------------------------
# If it gets until here it isn't mailman
# Sender verifications are required for all messages
# that are not sent to lists.
#---------------------------------------------------------------------
require verify = sender
accept local_parts = postmaster
domains = +local_domains
endpass
message = "The recipient cannot be verified. $acl_verify_message"
verify = recipient
accept domains = +relay_domains
warn message = ${perl{popbeforesmtpwarn}{$sender_host_name}}
hosts = +relay_hosts
accept hosts = +relay_hosts
warn message = ${perl{popbeforesmtpwarn}{$sender_host_address}}
condition = ${perl{checkrelayhost}{$sender_host_address}}
accept condition = ${perl{checkrelayhost}{$sender_host_address}}
accept hosts = +auth_relay_hosts
endpass
message = $sender_fullhost is currently not permitted to \
relay through this server. Perhaps you \
have not logged into the pop/imap server in the \
last 30 minutes or do not have SMTP Authentication turned on in your email client.
authenticated = *
deny message = $sender_fullhost is currently not permitted to \
relay through this server. Perhaps you \
have not logged into the pop/imap server in the \
last 30 minutes or do not have SMTP Authentication turned on in your email client.
#-----------------------------------------------------------------------
# Only deny the RFC-Ignorant ones, as remaining are checked by
# SpamAssassin anyway
# -- Modified LWBlacklist v0.02 on May 29, 2005 [ERICK_P]
#-----------------------------------------------------------------------
deny !sender_domains = lsearch;/etc/localdomains
!hosts = +relay_hosts
!authenticated = *
message = Rejected because the sending host $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text
dnslists = dsn.rfc-ignorant.org/$sender_address_domain : \
postmaster.rfc-ignorant.org/$sender_address_domain
warn message = X-Warning: Should be rejected because the sending host $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text
dnslists = whitelist.MYDOMAIN.com!=127.0.0.13 : \
rhsbl.ahbl.org/$sender_address_domain : \
list.dsbl.org : \
dnsbl.ahbl.org : \
sbl-xbl.spamhaus.org : \
bl.spamcop.net : \
relays.ordb.org : \
rbl.MYDOMAIN.com
#!!# ACL that is used after the DATA command
check_message:
require verify = header_sender
## clamav ACL, reject virus infected mails with proper error
deny message = This message contains malformed MIME ($demime_reason).
demime = *
condition = ${if >{$demime_errorlevel}{2}{1}{0}}
deny message = This message contains a virus or other harmful content \
($malware_name)
demime = *
malware = *
deny message = Potentially executable content. If you meant to send this file \
then please package it up as a zip file and resend it.
demime = ###ade:adp:bas:bat:chm:cmd:com:cpl:crt:eml:exe:hlp:hta:inf:ins:isp:jse:lnk:mdb:mde:msc:msi:msp:pcd:reg:scr:sct:shs:url:vbs:vbe:wsf:wsh:wsc
# Add X-Scanned Header
warn message = X-Antivirus-Scanner: Clean mail though you should still use an Antivirus
## end clamav ACL
accept
LinkBack URL
About LinkBacks
How to: Spam+Virus Protection for cPanel server using Exiscan+Clamav+RBL+Spamassassin
Reply With Quote
.*?)filename=\\s*"+((\{[a-hA-H0-9-]{25,}\})|((.*?)\\s{10,}(.*?)))"+\$
Originally Posted by rvskin
