Exim version 4.51

Firstly, I can't see why my condition is failing, but secondly if I rin with
-d+all instead of -d+expand I get totally different answers because the zulu
time expands wrong....


run with -d+expand

  5576 expanding:
${extract{cwnhsPasswordExpiryDate}{$acl_c8}{$value}{000000000000}}
  5576    result: 20051005121715
  5576 expanding:
${lc:${extract{cwnhsPasswordExpiryDate}{$acl_c8}{$value}{000000000000}}}
  5576    result: 20051005121715
  5576 expanding:
${substr_0_12:${lc:${extract{cwnhsPasswordExpiryDate}{$acl_c8}{$value}{00000
0000000}}}}
  5576    result: 200510051217
  5576 check set acl_c1 =
${substr_0_12:${lc:${extract{cwnhsPasswordExpiryDate}{$acl_c8}{$value}{00000
0000000}}}}
  5576                  = 200510051217
  5576 expanding: $tod_zulu
  5576    result: 20051007102633Z
  5576 expanding: ${substr_0_12:$tod_zulu}
  5576    result: 200510071026
  5576 check set acl_c2 = ${substr_0_12:$tod_zulu}
  5576                  = 200510071026
  5576 expanding: $acl_c1
  5576    result: 200510051217
  5576 expanding: $acl_c2
  5576    result: 200510071026
  5576 condition: < {$acl_c1}{$acl_c2}
  5576    result: false
  5576 expanding: yes
  5576    result: yes
  5576 skipping: result is not used
  5576 expanding: no
  5576    result: no
  5576 expanding: ${if < {$acl_c1}{$acl_c2}{yes}{no}}
  5576    result: no
  5576 check condition = ${if < {$acl_c1}{$acl_c2}{yes}{no}}
  5576                 = no

run with -d+all

11:27:48  5580 expanding:
${substr_0_12:${lc:${extract{cwnhsPasswordExpiryDate}{$acl_c8}{$value}{00000
0000000}}}}
11:27:48  5580    result: 200510051217
11:27:48  5580 check set acl_c1 =
${substr_0_12:${lc:${extract{cwnhsPasswordExpiryDate}{$acl_c8}{$value}{00000
0000000}}}}
11:27:48  5580                  = 200510051217
11:27:48  5580 ---1 Get 0x81086b0    16       string.c  349
11:27:48  5580 ---0 Get 0x810b440    88       expand.c 2667
11:27:48  5580 ---0 Get 0x810b498    80       expand.c 2667
11:27:48  5580 ---0 Rst 0x810b498    **       expand.c 2743 41000
11:27:48  5580 ---0 Get 0x810b498   104       string.c  858
11:27:48  5580 ---0 Rst 0x810b4a8    **       expand.c 4621 41000
11:27:48  5580 expanding: $tod_zulu
11:27:48  5580    result: 2005-10-07 11:2
11:27:48  5580 ---0 Rst 0x810b44d    **       expand.c 4621 41000
11:27:48  5580 expanding: ${substr_0_12:$tod_zulu}
11:27:48  5580    result: 2005-10-07 1
11:27:48  5580 check set acl_c2 = ${substr_0_12:$tod_zulu}
11:27:48  5580                  = 2005-10-07 1
11:27:48  5580 ---1 Get 0x81086c0    16       string.c  349
11:27:48  5580 ---0 Get 0x810b450   104       expand.c 2667
11:27:48  5580 ---0 Get 0x810b4b8    96       expand.c 2667
11:27:48  5580 ---0 Rst 0x810b4b8    **       expand.c 2743 41000
11:27:48  5580 ---0 Get 0x810b4b8   104       string.c  858
11:27:48  5580 ---0 Rst 0x810b4c5    **       expand.c 4621 41000
11:27:48  5580 expanding: $acl_c1
11:27:48  5580    result: 200510051217
11:27:48  5580 ---0 Get 0x810b4c8    88       expand.c 2667
11:27:48  5580 ---0 Rst 0x810b4c8    **       expand.c 2743 41000
11:27:48  5580 ---0 Get 0x810b4c8   104       string.c  858
11:27:48  5580 ---0 Rst 0x810b4d5    **       expand.c 4621 41000
11:27:48  5580 expanding: $acl_c2
11:27:48  5580    result: 2005-10-07 1
11:27:48  5580 ---0 Get 0x810b4d8    32       string.c  349
11:27:48  5580 failed to expand: ${if < {$acl_c1}{$acl_c2}{yes}{no}}

-Andy-


--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

On Fri, 7 Oct 2005, Andrew Johnson wrote:

> Exim version 4.51
>
> Firstly, I can't see why my condition is failing, but secondly if I rin with
> -d+all instead of -d+expand I get totally different answers because the zulu
> time expands wrong....
>
> run with -d+expand

>  5576 expanding: $tod_zulu
>  5576    result: 20051007102633Z

> run with -d+all
>
> 11:27:48  5580 expanding: $tod_zulu
> 11:27:48  5580    result: 2005-10-07 11:2

You have found a bug in Exim. I have noted it for fixing. It seems that
the +memory debug switch causes this to happen. I have reproduced it on
4.54 with +d+memory (because +memory is no longer in the default +d),
but I have no idea why this bizarre effect occurs.

You should be able to avoid this bug by using -d+all-memory on 4.51.

--
Philip Hazel            University of Cambridge Computing Service,
ph10@...      Cambridge, England. Phone: +44 1223 334714.
Get the Exim 4 book:    http://www.uit.co.uk/exim-book

--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

Hi,
I've problem between two exims.

One Is a client whit compiled in GnuTLS support, other is a server
whit compiled in OpenSSL.

I've something like that in ACL on server side:

begin acl

check_recipient:
   accept  hosts         = :
   drop    message     = I don't take more than 20 RCPTs
             condition     = ${if > {$rcpt_count}{20}{yes}{no}}

[cut]

  require message       = Can't verify sender
           verify        = sender
           message       = Can't verify recipient
           verify        = recipient

   accept  recipients    = postmaster@xxx

   accept  domains       = +local_domains

   accept  hosts         = +relay_hosts

   accept  hosts         = +tls_relay_hosts
              verify        = certificate

   accept  hosts         = +auth_relay_hosts
               authenticated = *

   deny    message       = relay not permitted

And
   hostlist auth_relay_hosts = *
   tls_try_verify_hosts = *
   hostlist tls_relay_hosts = *
   tls_verify_certificates = /etc/exim/certs
   tls_certificate = /etc/ssl/certs/exim.pem
   tls_privatekey = /etc/ssl/certs/exim.pem

I often use the same computer with linux/win2k and i need to
authenticate once using PLAIN TEXT and once using certs

On client side I've:
begin routers
smarthost:
   driver = manualroute
   domains = ! +local_domains
   route_list = * pc-4.chomiczowka.waw.pl bydns
   transport = remote_smtp
   no_more


And in transport
remote_smtp:
   driver = smtp
   hosts_require_tls = pc-4.chomiczowka.waw.pl
   tls_certificate = /etc/ssl/certs/exim-client.neptun.majcom-cert.pem
   tls_privatekey = /etc/ssl/certs/exim-client.neptun.majcom-key.pem
   tls_require_ciphers = AES : 3DES

For debug, I change in server from tls_try_verify_hosts to tls_verify_host.

and exim4 -bd -d+tls 2>&1|tee exim

12129 SMTP>> 250-pc-4.chomiczowka.waw.pl Hello
chello212186088174.chello.pl [212.186.88.174]
12129 250-SIZE 10485760
12129 250-8BITMIME
12129 250-PIPELINING
12129 250-AUTH PLAIN LOGIN
12129 250-STARTTLS
12129 250 HELP
12129 SMTP<< STARTTLS
12129 tls_certificate file /etc/ssl/certs/exim.pem
12129 tls_privatekey file /etc/ssl/certs/exim.pem
12129 Initialized TLS
12129 host in tls_verify_hosts? yes (matched "212.186.88.174")
12129 SMTP>> 220 TLS go ahead
12129 Calling SSL_accept
12129 SSL info: before/accept initialization
12129 SSL info: before/accept initialization
12129 SSL info: SSLv3 read client hello A
12129 SSL info: SSLv3 write server hello A
12129 SSL info: SSLv3 write certificate A
12129 SSL info: SSLv3 write certificate request A
12129 SSL info: SSLv3 flush data
12129 SSL info: SSLv3 read client certificate B
12129 SSL info: SSLv3 read client certificate B
12129 SSL info: SSLv3 read client certificate B
12129 LOG: MAIN
12129   TLS error on connection from chello212186088174.chello.pl
(marek.majcom) [212.186.88.174]:59145 (SSL_accept): error:140890C7:SSL
routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate
12129 TLS failed to start
12129 LOG: smtp_connection MAIN
12129   SMTP connection from chello212186088174.chello.pl
(marek.majcom) [212.186.88.174]:59145 closed by EOF
12129 search_tidyup called
13124 child 12129 ended: status=0x0
13124 0 SMTP accept processes now running
13124 Listening...


I try on client side to use:

$ gnutls-cli -s --x509keyfile key.pem --x509certfile cert.pem -p 25 pc-4.chomi>
Resolving 'pc-4.chomiczowka.waw.pl'...
Connecting to '195.136.32.4:25'...

- Simple Client Mode:

220 ESMTP neptun [pc-4.chomiczowka.waw.pl]
EHLO DUPA
250-pc-4.chomiczowka.waw.pl Hello chello212186088174.chello.pl [212.186.88.174]
250-SIZE 10485760
250-8BITMIME
250-PIPELINING
250-AUTH PLAIN LOGIN
250-STARTTLS
250 HELP
STARTTLS
220 TLS go ahead
*** Starting TLS handshake
- Certificate type: X.509
  - Got a certificate list of 2 certificates.

  - Certificate[0] info:
   # The hostname in the certificate matches 'pc-4.chomiczowka.waw.pl'.
   # valid since: Sat Oct 18 23:33:17 CEST 2003
   # expires at: Tue Oct 15 23:33:17 CEST 2013
  # fingerprint: FF:82:CF:C2:41:16:94:1D:96:F3:31:7B:9D:51:C6:73
   # Subject's DN:
C=PL,ST=mazowieckie,L=Warszawa,O=MajCom,OU=SMTP,CN=pc-4.chomiczowka.waw.pl,EMAIL\
=postmaster@...
   # Issuer's DN:
C=PL,ST=mazowieckie,L=Warszawa,O=MajCom,OU=CA,CN=Marek
Majchrowski,EMAIL=majherek@...

  - Certificate[1] info:
   # valid since: Sat Oct 18 23:29:43 CEST 2003
   # expires at: Tue Oct 15 23:29:43 CEST 2013
  # fingerprint: A6:DE:68:8F:15:A3:B2:B9:F3:F6:E8:31:72:F1:32:43
   # Subject's DN:
C=PL,ST=mazowieckie,L=Warszawa,O=MajCom,OU=CA,CN=Marek
Majchrowski,EMAIL=majherek@...
   # Issuer's DN:
C=PL,ST=mazowieckie,L=Warszawa,O=MajCom,OU=CA,CN=Marek
Majchrowski,EMAIL=majherek@...


- Peer's certificate issuer is unknown
- Peer's certificate is NOT trusted
- Version: TLS 1.0
- Key Exchange: RSA
- Cipher: AES 256 CBC
- MAC: SHA
- Compression: NULL


And everything is ok.

Can anybody tell me, why GnuTLS with OpenSSL in exim can't understand together?

Best Regard
--
Marek Maj(c)herek Majchrowski
Warsaw University of Technology
Faculty of Electronics and Information Technology

--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

I just attempted a transport time rewrite that caused a mail loop, so
I'm looking for advice on how to test such things safely.

I believe exim -brw doesn't capture transport rewrites.  Though I'm
less sure, I suspect that -N doesn't run the transport at all.

The particular problem was that the rewrite produced a bad sender.
When the mail was refused, this produced a notification message.  When
the notification went out, it had a bad sender, and so on.

I tried to rewrite with
*@... $1@${read_file{/etc/mailname}}
but this produced
MAIL FROM:<*@...\n @biostat.ucsf.edu>
and a complaint about an unbalanced <.

Thanks.

--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

My first problem is with out going mail form my Exim.  It works for some
destination addresses but I get some that look like this.

2005-10-07 08:40:36 1ENtOm-0008Qf-Ly == larryraab@... R=dnslookup
T=remote_smtp defer (-53): retry time not reached for any host

Does this have to do with resolving DNS before sending out any emails?



My next question is if I create a webmaster account and try to send mail to it I
get the following error.

2005-10-07 08:35:57 1ENtKG-0008PL-Ry == root@... <webmaster@...>
R=localuser T=local_delivery defer (-29): User 0 set for local_delivery
transport is on the never_users list

I have no links or anything to the user webmaster or anything.

How can I resolve this?


Thanks for all the help.

Larry Raab


--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

* On 07/10/05 11:50 +0100, Tony Finch wrote:
> On Fri, 7 Oct 2005, Craig Schneider wrote:
> >
> > I was wondering if it would be possible with Exim to only allow users in
> > a flat text file to be able to receive external mail?
>
>   reject
>     message = External email to this user is not permitted
>   ! recipients = /path/to/file


I think I've suddenly acquired a new parachute and is floating
dangerously!
Is "reject" a new verb in the ACLs? I don't seem to be able to find
reference to it in spec.txt.

Nice weekend guys.


         cheers
        - wash
+----------------------------------+-----------------------------------------+
Odhiambo Washington            	 . WANANCHI ONLINE LTD (Nairobi, KE)  |
wash () WANANCHI ! com 	 . 1ere Etage, Loita Hse, Loita St.,  |
GSM: (+254) 722 743 223 	 . # 10286, 00100 NAIROBI             |
GSM: (+254) 733 744 121 	 . (+254) 020 313 985 - 9             |
+---------------------------------+------------------------------------------+
"Oh My God! They killed init! You Bastards!"
						  --from a /. post

--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

Quoth Larry Raab on Fri, Oct 07, 2005 at 08:48:47 -0600
> My first problem is with out going mail form my Exim.  It works for
> some destination addresses but I get some that look like this.

Both problems would be solved it you took the time to read the
documentation properly.

> 2005-10-07 08:40:36 1ENtOm-0008Qf-Ly == larryraab@... R=dnslookup
> T=remote_smtp defer (-53): retry time not reached for any host
>
> Does this have to do with resolving DNS before sending out any emails?

Nope, there is an option which controls this.  Check the documentation
under retry.

> My next question is if I create a webmaster account and try to send
> mail to it I get the following error.
>
> 2005-10-07 08:35:57 1ENtKG-0008PL-Ry == root@...
> <webmaster@...> R=localuser T=local_delivery defer (-29): User 0
> set for local_delivery transport is on the never_users list
>
> I have no links or anything to the user webmaster or anything.

"root@..." is on the never_users list.  Either remove it from said
list or create an alias that maps root to some other users.

--
yann@...                  -=*=-                      www.kierun.org
     PGP:   009D 7287 C4A7 FD4F 1680  06E4 F751 7006 9DE2 6318

--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

On Fri, 7 Oct 2005, Odhiambo G. Washington wrote:

> Is "reject" a new verb in the ACLs? I don't seem to be able to find
> reference to it in spec.txt.

I should have written "deny".

Tony.
--
<fanf@...>   <dot@...>   http://dotat.at/   ${sg{\N${sg{\
N\}{([^N]*)(.)(.)(.*)}{\$1\$3\$2\$1\$3\n\$2\$3\$4\$3\n\$3\$2\$4}}\
\N}{([^N]*)(.)(.)(.*)}{\$1\$3\$2\$1\$3\n\$2\$3\$4\$3\n\$3\$2\$4}}

--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

I understand that ROOT is on never_use list.  My problem is the WEBMASTER name
is not on that list yet mail that is sent to WEBMASTER is being sent to ROOT and
I am then getting the never_use error.

I have deleted and recrated the webmaster user several times to no avail.  Is
there a connection between root and webmaster somewhere?

>>> Yann Golanski <yann@...> 10/7/2005 8:58:03 AM >>>
Quoth Larry Raab on Fri, Oct 07, 2005 at 08:48:47 -0600
> My first problem is with out going mail form my Exim.  It works for
> some destination addresses but I get some that look like this.

Both problems would be solved it you took the time to read the
documentation properly.

> 2005-10-07 08:40:36 1ENtOm-0008Qf-Ly == larryraab@... R=dnslookup
> T=remote_smtp defer (-53): retry time not reached for any host
>
> Does this have to do with resolving DNS before sending out any emails?

Nope, there is an option which controls this.  Check the documentation
under retry.

> My next question is if I create a webmaster account and try to send
> mail to it I get the following error.
>
> 2005-10-07 08:35:57 1ENtKG-0008PL-Ry == root@...
> <webmaster@...> R=localuser T=local_delivery defer (-29): User 0
> set for local_delivery transport is on the never_users list
>
> I have no links or anything to the user webmaster or anything.

"root@..." is on the never_users list.  Either remove it from said
list or create an alias that maps root to some other users.

--
yann@...                  -=*=-                      www.kierun.org
     PGP:   009D 7287 C4A7 FD4F 1680  06E4 F751 7006 9DE2 6318



--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

On 7 Oct 2005 at 11:21, Michael Sprague wrote about
     "Re: [exim] 2 Problems / Question.":

|...
|  /etc/aliases.  You'll need to run newaliases if you
| update that file.

That's highly unlikely.  By default, exim uses /etc/aliases directly
and there's no need to run newaliases.  Unless your configuration
defines a value for the bi_command option, running it as "newaliases"
does nothing at all.

- Fred





--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

On 7 Oct 2005 at 9:16, Larry Raab wrote about
     "Re: [exim] 2 Problems / Question.":

|  My problem is the
| WEBMASTER name is not on that list yet mail that is sent to WEBMASTER
| is being sent to ROOT

Looks like a redirect router has mapped webmaster to root.  Most
likely, you have something like

webmaster: root

in your /etc/aliases file.

- Fred





--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

Larry Raab wrote:
> I understand that ROOT is on never_use list.  My problem is the WEBMASTER name
is not on that list yet mail that is sent to WEBMASTER is being sent to ROOT and
I am then getting the never_use error.
>
> I have deleted and recrated the webmaster user several times to no avail.  Is
there a connection between root and webmaster somewhere?
>
>

webmaster is probably an alias that points to root.  Check your aliases
file.  Probably /etc/aliases.  You'll need to run newaliases if you
update that file.

M

--
Michael F. Sprague     | mfs@...
http://www.saneinc.net | use STD::disclaimer;
System and Network Engineering (SaNE), Inc


--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

Larry Raab wrote:
> I understand that ROOT is on never_use list.  My problem is the
> WEBMASTER name is not on that list yet mail that is sent to WEBMASTER
> is being sent to ROOT and I am then getting the never_use error.
>
> I have deleted and recrated the webmaster user several times to no
> avail.  Is there a connection between root and webmaster somewhere?

http://exim.org/eximwiki/MailingListEtiquette#head-133abe53fab0e4e954a04a8fd8c0c\
4cd7f520f7f
http://exim.org/eximwiki/MailingListEtiquette#head-a6f7fb5ce8816568569a321f78331\
5207ec38063
http://exim.org/exim-html-4.50/doc/html/spec_5.html#IX309
http://exim.org/exim-html-4.50/doc/html/spec_22.html#IX1763

- Marc


--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

>>> fv+exim@... 10/7/2005 9:32:26 AM >>>
On 7 Oct 2005 at 11:21, Michael Sprague wrote about
     "Re: [exim] 2 Problems / Question.":

|...
|  /etc/aliases.  You'll need to run newaliases if you
| update that file.

That's highly unlikely.  By default, exim uses /etc/aliases directly
and there's no need to run newaliases.  Unless your configuration
defines a value for the bi_command option, running it as "newaliases"
does nothing at all.

- Fred


Thank you all for reminding me about the /etc/aliases file.

Sometimes we look for the hard answer when the simple one is the right one.


--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/


--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

hi tony,

> Yes. The message framing options on the appendfile and pipe transports
> don't apply to the smtp or lmtp transports.

gr8. all clear. thx!

richard

- --

/"\
\ /  ASCII Ribbon Campaign
  X   against HTML email, vCards
/ \  & micro$oft attachments

[GPG] OpenMacNews
fingerprint: 3F07 3CFD 138A FD91 A4A6  1840 1A7A 8CCB 882F 67A1
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (Darwin)

iEYEAREDAAYFAkNGlvAACgkQGnqMy4gvZ6ErEACdGob/4kP6tao8bAbmbJQP2dfQ
PgsAnj7gAI7rrdf9H1Xi+sUtYjBYbizp
=eQlv
-----END PGP SIGNATURE-----


--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

>Obviously so.

So, is it as easy as to add a host = ! statler  in the ACL in question?

>Leaving aside the wisdom of rejecting based on SPF, yes.

Yes, I know. But a customer wants it. One of the few who actually pays me
for the access.

>BTW, I hope statler is applying the same (or more) rejection criteria
>to incoming mail as scooter.

Yes, it has even more checks then scooter.

--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

Hey all, been a while!

Anyways, I'm running in to a snag, and I don't know if there's a fix, or if
I've maybe just come up with yet another item to add to the wishlist, but
I'm trying to make an expanded address list that gets used in the retry
rules so that I can kind of have a single line, dynamic retry rule.  The
point of it is that apparently if delivery fails for a user, it doesn't
thereafter follow retry entries for the host I wanted to send it to, but now
it looks for a retry rule for the individual recipient of the message.  So,
if I can make an address list that can tell me if a recipient is local or
not, then I can give them better retries than everyone else, so this is what
I tried in wanting to accomplish this:

addresslist local_retries       = ${lookup {$domain} dbmnz
{/etc/exim.host.db} {${if > {$value}{0} {*@$domain}{}}}{}}
...
begin retry
+local_retries                  *       F,3h,5m; F,12h,15m; F,1d,1h; F,2d,3h

The exim.host.db file just contains all my local hosts (I don't have a
definitive answer on users, due to aliases and such that aren't handled by
Exim), so I just want to search for the $domain in my .db file, and if it's
there spit out a wildcard *@$domain address for the retry to match.

However, the problem is that it seems like I've got access to virtually no
variables within the retry section?  I've been doing my testing with the
-brt option, and so far, I haven't been able to figure out a single variable
which would help me that gets expanded to anything but null.  Is this even
possible?  I don't know if Exim does a retry run for multiple recipients at
the same time, since -brt I think expects just one email address (I tried
separating with , and ; but it treats it as one user it appears, so I don't
know what that tells me).

If the multiple recipient thing isn't an issue and Exim does run a single
retry for each recipient, then is it possible we can get a few variables
like $local_part and $domain accessable in the retry rules for cases such as
this?

TIA,

Eli.


--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

On Fri, 2005-10-07 at 06:54 -0700, Ross Boylan wrote:
> I just attempted a transport time rewrite that caused a mail loop, so
> I'm looking for advice on how to test such things safely.
>
> I believe exim -brw doesn't capture transport rewrites.  Though I'm
> less sure, I suspect that -N doesn't run the transport at all.
>
> The particular problem was that the rewrite produced a bad sender.
> When the mail was refused, this produced a notification message.  When
> the notification went out, it had a bad sender, and so on.
>
> I tried to rewrite with
> *@... $1@${read_file{/etc/mailname}}
> but this produced
> MAIL FROM:<*@...\n @biostat.ucsf.edu>
> and a complaint about an unbalanced <.
>
> Thanks.
>
To answer part of my own question, I specified
return_path as a rewrite specification, but it's not.  I'm now using

   headers_rewrite = *@... $1@...
   return_path = ${if eq{${domain:$return_path}}{iron.psg.net} \
	 {${local_part:$return_path}@...}{$return_path}}

Does that look OK?  Is there a more elegant solution?
In particular, I'm not sure how that will behave with empty return paths
(error bounces).



--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

On Fri, 7 Oct 2005, Eli wrote:
>
> The point of it is that apparently if delivery fails for a user, it
> doesn't thereafter follow retry entries for the host I wanted to send it
> to, but now it looks for a retry rule for the individual recipient of
> the message.

You should read section 32.2 of the spec which clarifies this.

> addresslist local_retries       = ${lookup {$domain} dbmnz
> {/etc/exim.host.db} {${if > {$value}{0} {*@$domain}{}}}{}}

That is a bad way of writing
	 addresslist local_retries = *@dbmnz;/etc/exim.host.db

Tony.
--
<fanf@...>   <dot@...>   http://dotat.at/   ${sg{\N${sg{\
N\}{([^N]*)(.)(.)(.*)}{\$1\$3\$2\$1\$3\n\$2\$3\$4\$3\n\$3\$2\$4}}\
\N}{([^N]*)(.)(.)(.*)}{\$1\$3\$2\$1\$3\n\$2\$3\$4\$3\n\$3\$2\$4}}

--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

Tony wrote:
> You should read section 32.2 of the spec which clarifies this.

32.1 which refers to 10.18, but close enough (haha, sorry, just had to).

> > addresslist local_retries       = ${lookup {$domain} dbmnz
> > {/etc/exim.host.db} {${if > {$value}{0} {*@$domain}{}}}{}}
>
> That is a bad way of writing
>  addresslist local_retries = *@dbmnz;/etc/exim.host.db

I'll be damned, thanks man.  I guess there's a difference to reading the
docs, and actually understanding them :P  I never did quite understand all
the hype about the single key lookup types and honestly never understood
much about why they were used.  Now I do!

Thanks again,

Eli.


--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

>The best you could do
>would be to check received headers. However, you'd have no way of knowing
>whether the headers were forged.

Bleeding good point.


--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

On Fri, 7 Oct 2005, Eli wrote:

> Tony wrote:
> > You should read section 32.2 of the spec which clarifies this.
>
> 32.1 which refers to 10.18, but close enough (haha, sorry, just had to).

No, I did mean 32.2 because you seemed to be confused about how Exim
chooses retry rules. It is a bit subtle and to be honest I just ignore
most of the complexity :-)

begin retry

*@+our_domains  *  F,2h,15m; F,8h,30m; F,7d,60m; F,14d,2h

*@* 	 refused_A F,2h,15m; G,16h,30m,1.5
*@*  timeout_connect_A F,2h,15m; G,16h,30m,1.5

*@* 	 *  F,2h,15m; G,16h,30m,1.5; F,5d,8h

Tony.
--
<fanf@...>   <dot@...>   http://dotat.at/   ${sg{\N${sg{\
N\}{([^N]*)(.)(.)(.*)}{\$1\$3\$2\$1\$3\n\$2\$3\$4\$3\n\$3\$2\$4}}\
\N}{([^N]*)(.)(.)(.*)}{\$1\$3\$2\$1\$3\n\$2\$3\$4\$3\n\$3\$2\$4}}

--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

Tony wrote:
> No, I did mean 32.2 because you seemed to be confused about
> how Exim chooses retry rules. It is a bit subtle and to be
> honest I just ignore most of the complexity :-)

True, I am, and after reading 32.2 a few times, I think I can squash most of
my retry rules down to just one for local domains, except I have just one
more question (and testing retry rules completely isn't quite do-able with
-brt unless I take servers down ;P) and I should have it all figured out :)

I've got Exim relaying email to back-end SMTP systems, so all my "final
deliveries" are manualroute routers with specified hosts.  For each of
those, I have a retry rule made so that for any delivery errors to those
systems, it retries when I want.  However, now knowing Exim first tries the
server and then the domain of the recipient, would this mean that I could
have just:

addresslist local_peeps = *@dbmnz;/etc/exim.host.db
+local_peeps  *  F,3h,5m; F,12h,15m; F,1d,1h; F,2d,3h

As my only retry rule for handling all local users?  If any of the
manualroute hosts failed, it would first search retries for that host (not
find it) and then would try the domain of the local user which would match -
correct?  I'm only asking because I don't know if when Exim does this, a
*@domain would match because it sounds like exim is looking for only
"domain" (I'm thinking like pattern matching where *@domain wouldn't match
domain because of the *@).

Eli.


--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

On Fri, 2005-10-07 at 01:38 +0200, Jan Johansson wrote:
> >Leaving aside the wisdom of rejecting based on SPF, yes.
>
> Yes, I know. But a customer wants it. One of the few who actually pays
> me for the access.

Do they not also pay you for your expertise? Is it not your
responsibility to explain to them why certain options would be unwise?

--
dwmw2



--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

On Fri, 7 Oct 2005, Eli wrote:
>
> addresslist local_peeps = *@dbmnz;/etc/exim.host.db
> +local_peeps  *  F,3h,5m; F,12h,15m; F,1d,1h; F,2d,3h
>
> As my only retry rule for handling all local users?  If any of the
> manualroute hosts failed, it would first search retries for that host (not
> find it) and then would try the domain of the local user which would match -
> correct?

Yes.

> I'm only asking because I don't know if when Exim does this, a *@domain
> would match because it sounds like exim is looking for only "domain"
> (I'm thinking like pattern matching where *@domain wouldn't match domain
> because of the *@).

32.2 Choosing which retry rule to use

A domain on its own can match a domain pattern, or a pattern that starts
with '*@'.

Tony.
--
<fanf@...>   <dot@...>   http://dotat.at/   ${sg{\N${sg{\
N\}{([^N]*)(.)(.)(.*)}{\$1\$3\$2\$1\$3\n\$2\$3\$4\$3\n\$3\$2\$4}}\
\N}{([^N]*)(.)(.)(.*)}{\$1\$3\$2\$1\$3\n\$2\$3\$4\$3\n\$3\$2\$4}}

--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

I was talking earlier with a friend about having a failover email
system providing full redundancy

Ideally something like:

Mailserver A port 25 (Live)
    delivers locally to Mailserver A port 2525 maildirs
    relays a copy to Mailserver B port 2525  (backup)

Mailserver B port 25 (backup)
    delivers locally to Mailserver B port 2525 maildirs
    relays a copy to Mailserver A port 2525 maildirs (live)

The idea being that there is always a machine on the internet that
has full email.
So if server A gets rooted, burns down, the datacenter loses power
like the LA outage last month, you swap dns and server B handles
everything.

my first idea was that port 25 on each machine is an exim relay
station that just routes messages to the local mailstore and the
backup mta -- both running on port 2525.

my friend noted that setup would make messages seem accepted once the
port 25 host let go -- and that you have no control over whether its
getting to or being rejected from the local 2525 or backup 2525

he suggested some sort of daemon on 25 that speaks smtp and holds
onto the connection until either:
      a_ both the local and the backup mta have successfully processed
the message
      b_ the local mta has processed successfully and the remote is
unreachable (considered down)
if either mta rejects the message, then both do (but that should
never be the case)

before we spend any more time talking about trying to implement
something like this ourselves from scratch-- has anyone out there
done this with exim or another mta?

note: we never got as far as what to do about reading email - but
handling the imap stuff is for another list


--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

On Thursday 06 October 2005 21:43, Alan J. Flavell wrote:
> On Thu, 6 Oct 2005, Adam Funk wrote:
> > I still don't understand the spammers' motivation for this -- it
> > doesn't seem difficult to reject obviously dodgy HELOs.
>
> Quite a number of times, I've mused over the question of whether
> there's a kind of spammer who deliberately feeds an early clue, so
> that they don't waste too much effort on mail admins who are going to
> reject their spam somewhere in the course of the transaction anyway.

Interesting idea.  I suppose even they recognise limitations on their
resources.

--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

Jonathan Vanasco wrote:
> I was talking earlier with a friend about having a failover email
> system providing full redundancy
>
> Ideally something like:
>
> Mailserver A port 25 (Live)
>   delivers locally to Mailserver A port 2525 maildirs
>   relays a copy to Mailserver B port 2525  (backup)
>
> Mailserver B port 25 (backup)
>   delivers locally to Mailserver B port 2525 maildirs
>   relays a copy to Mailserver A port 2525 maildirs (live)

I have been thinking about doing something very similar to this.  In my
case, I have 4 servers, each having a subset of maildirs, so A->A&B,
B->B&C, C->C&D, and D->D&A.  So if A went down, D could take over its
functions if needed.

My cutover would involve taking A out of DNS and changing the database
entries for all accounts on A so Exim and Courier know where to look for
the maildir.

> my first idea was that port 25 on each machine is an exim relay  station
> that just routes messages to the local mailstore and the  backup mta --
> both running on port 2525.

I think what would work better is to have all your scanning happen on
the port 25 daemon (AV, SA, RBL, etc) and the 2525 daemon simply accepts
the mail (*only* from your 2 mail servers) and delivers it where is
needs to be (little or no checking).

An rsync between the servers may be able to handle changes that IMAP/POP
may have made.  Just make sure if you have an outage and you switch back
to server A, that you don't let the rsync run as it normally would or
you'll lose mail.

At this point, it is all in my head.  I haven't started implementing any
of it.  If you do, let me know how it works out.

--
Dennis Skinner
Systems Administrator
BlueFrog Internet
http://www.bluefrog.com

--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

Hi all

Sorry about the cross-post.  I tried this on exim-users with no response so I
thought I would try my luck here.

Really simply: does anyone know if its possible to do LDAP lookups directly in a
system_filter or similar (such as a central_filter using the redirect
transport)?  Basically, I want to lookup the OU for a particular mail user and
then perform selective filtering based on what 'organizational unit' that
particular mail user is in, system wide.  This can be done either within the
filter script, or declared outside of the script in exim.conf and then 'used' by
the script logic.

For example, I've setup a system-wide central filter as follows:

>central_filter:
>  driver = redirect
>  domains = +local_domains
>  file = /etc/exim/filter1
>  no_verify
>  user = exim
>  group = exim
>  allow_filter
>  allow_freeze

Then I want to have something like the following inside /etc/exim/filter1

>group = ${lookup ldapm
{ldap://localhost:389/ou=people,dc=testdomain,dc=com?ou?(mail=${local_­part})}{$\
value}
>
>if $group is "marketing" then save /dev/null endif

Does anyone know how to do this or if its possible?  I found this post:
http://www.exim.org/mail-archives/exim-users/Week-of-Mon-20030310/msg00292.html 
but no further information on the matter.

Perhaps I can lookup the group information outside of the central_filter, then
pass that information to the filtering script?

Also, I understand theres some caveats between system_filters and
central_filters with regards to multiple recipients which is why I chose to use
the redirect/central_filter model.  Are there any problems with this approach?

-a



--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/

I think I've mentioned this before, but if not here it goes.

I was thinking of having exim dump mail into either MySQL Cluster or
multi-master replication setup.

Each email would be keyed off recipient and uuid(), store the full
email as a blob, maybe pull out the headers into another table and
possibly the email body if it's text into another table for full text
searching (easy webmail!)

Tie them all together with the uuid() of course.

The pop3 server will list the messages giving the uuid as the UIDL.

I'm not exactly sure as to the best way to do this, either having the
pop3 server check list of messages on mysql against local disk cache,
or just dumping directly out of mysql.

The other thing is you could have a nice audit table to go along w/ the
emails storing the time each email was retreived/deleted.

You could have 2-10+ machines as mysql cluster or replication and also
run the pop3 server on each host.

I would use something like linux virtual server or maybe openbsd w/
pfsync and carp w/ perdition to handle talking to back end systems.

DNS hands out 1 ip, which can fail over to backup machine subsecond and
route to 1:M mysql/pop3 hosts.

The dbmail.org project is pretty close.

--- Dennis Skinner <dskinner@...> wrote:

> Jonathan Vanasco wrote:
> > I was talking earlier with a friend about having a failover email
> > system providing full redundancy
> >
> > Ideally something like:
> >
> > Mailserver A port 25 (Live)
> >   delivers locally to Mailserver A port 2525 maildirs
> >   relays a copy to Mailserver B port 2525  (backup)
> >
> > Mailserver B port 25 (backup)
> >   delivers locally to Mailserver B port 2525 maildirs
> >   relays a copy to Mailserver A port 2525 maildirs (live)
>
> I have been thinking about doing something very similar to this.  In
> my
> case, I have 4 servers, each having a subset of maildirs, so A->A&B,
> B->B&C, C->C&D, and D->D&A.  So if A went down, D could take over its
>
> functions if needed.
>
> My cutover would involve taking A out of DNS and changing the
> database
> entries for all accounts on A so Exim and Courier know where to look
> for
> the maildir.
>
> > my first idea was that port 25 on each machine is an exim relay
> station
> > that just routes messages to the local mailstore and the  backup
> mta --
> > both running on port 2525.
>
> I think what would work better is to have all your scanning happen on
>
> the port 25 daemon (AV, SA, RBL, etc) and the 2525 daemon simply
> accepts
> the mail (*only* from your 2 mail servers) and delivers it where is
> needs to be (little or no checking).
>
> An rsync between the servers may be able to handle changes that
> IMAP/POP
> may have made.  Just make sure if you have an outage and you switch
> back
> to server A, that you don't let the rsync run as it normally would or
>
> you'll lose mail.
>
> At this point, it is all in my head.  I haven't started implementing
> any
> of it.  If you do, let me know how it works out.
>
> --
> Dennis Skinner
> Systems Administrator
> BlueFrog Internet
> http://www.bluefrog.com
>
> --
> ## List details at http://www.exim.org/mailman/listinfo/exim-users
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://www.exim.org/eximwiki/
>


--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/