SOLVED exim & dkim "tainted filename"

MHFraser

Active Member
Feb 28, 2019
33
2
8
Australia
cPanel Access Level
Root Administrator
Hi,

have discovered one of my hosts is not able to dkim sign outgoing messages.
The /var/log/exim.paniclog is full of messages like this

2023-05-17 13:09:36 1pz7Xg-00083V-31 Tainted filename '/var/cpanel/domain_keys/private/[redacted].com.au'
2023-05-17 13:09:36 1pz7Xg-00083V-31 unable to open file for reading: /var/cpanel/domain_keys/private/[redacted].com.au
2023-05-17 13:13:11 1pz7bC-0008JM-02 Tainted filename '/var/cpanel/domain_keys/private/[redacted].com.au'
2023-05-17 13:13:11 1pz7bC-0008JM-02 unable to open file for reading: /var/cpanel/domain_keys/private/[redacted].com.au

exim version
# whmapi1 installed_versions packages=1|grep exim:
cpanel-exim: 4.96-8.cp108~el7

I know 4.94 introduced a bug like this but I'm not running that version.

dkim config in the exim.conf has these entries

smarthost_dkim:
driver = manualroute
domains = !"+local_domains +smart_hosts"
condition = "${if eq{${lookup{$sender_address_domain}partial-lsearch{/etc/staticroutes}{$value}}}{}{false}{true}}"
ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8 : [redacted]
headers_add = "${perl{mailtrapheaders}}"
require_files = "+/var/cpanel/domain_keys/private/${sender_address_domain}"
transport = remote_smtp_smart_dkim
route_list = !+local_domains "${lookup{$sender_address_domain}partial-lsearch{/etc/staticroutes}}"


remote_smtp_smart_dkim:
driver = smtp
hosts_require_tls = *
interface = ${if exists {/etc/mailips}{${lookup{$sender_address_domain}lsearch*{/etc/mailips}{$value}{}}}{}}
helo_data = ${if exists {/etc/mailhelo}{${lookup{$sender_address_domain}lsearch*{/etc/mailhelo}{$value}{$primary_hostname}}}{$primary_hostname}}
dkim_domain = $sender_address_domain
dkim_selector = default
dkim_private_key = "/var/cpanel/domain_keys/private/${dkim_domain}"
dkim_canon = relaxed


can someone pot me in the right direction here?
 
Last edited by a moderator:

MHFraser

Active Member
Feb 28, 2019
33
2
8
Australia
cPanel Access Level
Root Administrator
fixed.

for future googlers, exim needs to lookup the dkim keys, it wont accept a value from the email, so change these:

require_files = "+/var/cpanel/domain_keys/private/${lookup{$sender_address_domain}dsearch{/var/cpanel/domain_keys/private/}}"

dkim_private_key = "/var/cpanel/domain_keys/private/${lookup{$dkim_domain}dsearch{/var/cpanel/domain_keys/private/}}"