0

CentOS 6 with cPanel/WHM. Hackers kept getting into our cPanel mail accounts somehow and sending spam from our servers. They either spoofed the FROM address, or just used "reply to" to have their victims see the domain of the spammers' choice, e.g. lottery.microsoft.com or something like that. I decided to lock down the server and asked the hosting company to prevent any outgoing or incoming mail with non-local domains.

They made some changes to /etc/exim.conf, adding what looks like might be C code to the file. I didn't know configuration files could have programming constructs in them. Can anyone explain the meaning of the lines below?

The code they added is supposed to prevent emailing TO or FROM non-local domains. But now I would like to change it to allow emailing TO non-local, but continue preventing emailing FROM. I would also like to prevent outgoing emails with "reply-to" being non-local.

I assume the # are commented lines. Where do these variables come from? What are allow_fail and no_more? Is the if statement operational, or is it commented with the #?

#ifdef DCconfig_local
# configtype=local
#
# Stand-alone system, so generate an error for mail to a non-local domain
nonlocal:
debug_print = "R: nonlocal for $local_part@$domain"

  driver = redirect

  domains = !example.com

  qualify_domain = example.com
 # domains = ! +local_domains

  allow_fail

  data = :fail: Mailing to remote domains not supported

  no_more

#.endif
  • Voting to close for what reason? Because the answer is obvious to you? Congratulations! – Buttle Butkus Nov 18 '14 at 17:01
2

The exim configuration files have a syntax that allows complex processing. This is the language that was used for the configuration snippet you included. The language is Documentation for Exim documents the configuration.

It is possible that the mail is being sent by software other than exim. If it was sent by exim, the transmission should be recorded in /var/log/exim/mainlog or the rotated log for the period.

The default exim configuration is usually quite secure if the configuration variables are set correctly. Normally it is configured with a number of macro definitions starting DC. In your case, I would expect DCconfig_internet enabled. Fix your recipient processing, and you should be able to revert the changes made by your provider. To revert it, just enable the preprocessor directives at the top and bottom of this section.

Relay restriction is usually handled in the recipient ACL. Check the configuration file for a line beginning acl_smtp_rcpt. Then search for the value on the right side of the assignment. This will be the ACL used to check recipients. Read through this checking for accept and deny blocks until your get to a line like message = relay not permitted. That block should read something like:

require
  message = relay not permitted
  domains = +local_domains : +relay_to_domains

If you are allowing relaying, email is either being accepted before you reach this block, or this block is allowing external domains. There should be definitions for these something like:

hostlist relay_from_hosts = <; 127.0.0.1 ; ::1
domainlist local_domains = example.com  
domainlist relay_to_domains = 

If local_domains or relay_to_domains contain a wildcard ('*'), you may be an open relay.

To answer your specific questions:

  • # is a comment delimiter.
  • #ifdef and #.endif are disabled preprocesor directives. The reads .ifdef and .endif when enabled and work like c preporcessor directives.
  • allow_fail is a configuration command that allows the router to fail without bouncing the current message.
  • no_more is a configuration directive which stops routing if this router succeeds.
| improve this answer | |
0

It is impossible to determine from the code wether the ifdef is true or false.

Meaning of directives is the next:

  • if recipient's domain is NOT example.com then router activated

  • if sender's domain is not provided, qualify_domain example.com is used

  • allow :fail: as redirection data

  • redirect message to the :fail: and answer to sender: Mailing to remote domains not supported

  • stop message proceeding

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.