Anti Spam

If you want to reject messages from servers with no reverse dns add this under acl_check_rcpt:, it does have a exception list to which you can add domains where the acl should not be applied and trys to deliver a test message to sending address to verify if the sender is valid.

drop  message   = REJECTED - We don't accept messages from hosts without reverse DNS
        log_message = No reverse DNS
        domains = ! lsearch;/etc/exim/checks_exempt_hosts
        !verify = reverse_host_lookup
        !verify = sender/callout=2m,defer_ok
        !condition =  ${if eq{$sender_verify_failure}{}}

To reject messages from clients that dont provide a HELO/EHLO add this to acl_check_rcpt:

drop  message  = REFUSED - no HELO/EHLO greeting
        log_message = remote host did not present greeting
        condition = ${if def:sender_helo_name {false}{true}}

You can rate limit the connections to your server as well add this to acl_check_connect: to do so (read the exim docs on the parameters if you want to fine tune it for your site).

deny ratelimit = 250 / 15m / strict
       message = You can only send $sender_rate per $sender_rate_period
       log_message = RATE: $sender_rate/$sender_rate_period (max $sender_rate_limit)
accept

Stop rogue spam bots from trashing your machine.

smtp_accept_max_nonmail = 30
smtp_max_unknown_commands = 1

Allow pipelining only from the localhost to allow you to later use mailfeeder to release mail.

pipelining_advertise_hosts = 127.0.0.1

Address Verification

This users the router check_backend to communicate with your communigate pro system via ldap to ensure that an address exists before accepting mail for that address.

Add your default ldap servers to the exim configuration.

ldap_default_servers = xxx.xxx.xxx.xxx

Configure domains that have a catchall account (no verification if address exists before accepting mail.

# example /etc/exim/catchall_domains
somedomain.com

Specify this in the exim configuration.

domainlist domains_with_catchall = lsearch;/etc/exim/catchall_domains

Create and add the ldap enabled CGP domains to the file /etc/exim/ldap-domains. The first column is the domain alias or domain and the second is the actual domain as it exists in ldap as when you sync CGP domains to ldap it does not copy the domain aliases as well.

#example  /etc/exim/ldap-domains
example.com: example.com
example.co.za: example.com

Create the check_backend router, this should be the first router in your configuration.

check_backend:
 driver = redirect
 domains = ! +domains_with_catchall : +relay_to_domains
 allow_fail
 allow_defer
 forbid_file
 forbid_pipe
 data = ${lookup ldap{ldap:///uid=${local_part},cn=${lookup{$domain}lsearch{/etc/exim/ldap-domains}}?mail}{$value}{:fail: Unknown user}}
 #version 5.x use this instead
 #data = ${lookup ldap{ldap:///cn=${lookup{$domain}lsearch{/etc/exim/ldap-domains}}?uid?sub?(uid=$local_part)}{$local_part@$domain}{:fail: User Unknown}}

Clean Delivery Exim

This is the configuration that is used to deliver the clean mail that mailscanner has already scanned. The configuration file is /etc/exim/exim_out.conf. For this you can use the default configuration with all the checks and acls taken out.

You need to add this router to deliver the cleaned mail to the actual CGP servers. If you are running a cluster, this router is capable of spreading the deliveries across the servers that you have configured in /etc/exim/mail-routes making it fully redundant.

deliver_clean:
  driver = manualroute
  domains = +relay_to_domains
  transport = remote_smtp
  hosts_randomize = true
  route_data = ${lookup{$domain}lsearch{/etc/exim/mail-routes}}

Configure MySQL

Add this to the configuration file /etc/my.cnf:

socket=/var/lib/mysql/mysql.sock
skip-networking

This configures mysql to only communicate via the socket not tcp which is better for security and for performance.

Start mysql, this will initialize the default databases.

service mysqld start

Set the root users password:

mysqladmin -u root password NEWPASSWORD

Create the mailwatch database and populate tables:

mysql -p < /usr/local/src/mailwatch-1.0.4/create.sql

Create the mysql user for mailwatch and mailscanner logging:

mysql
mysql> GRANT ALL ON mailscanner.* TO mailwatch@localhost IDENTIFIED BY 'password';

Create the mailwatch admin user:

mysql mailscanner -u mailwatch -p
Enter password: ******
mysql> INSERT INTO users VALUES ('',md5(' '),'','A','0','0','0','0','0');

Configure MailScanner

Intro

Mailscanner has several configuration options i will only dwell on those that are needed to get the system working. To further customize the system please read the mailscanner documentation or look at the sample configuration files that i have provided.

Basic Configuration

Please edit the following configuration variables in /etc/MailScanner/MailScanner.conf:

Run As User = exim
Run As Group = exim
Incoming Queue Dir = /var/spool/exim.in/input
Outgoing Queue Dir = /var/spool/exim/input
MTA = exim
Sendmail = /usr/sbin/exim -C /etc/exim/exim_out.conf
Sendmail2 = /usr/sbin/exim -C /etc/exim/exim_out.conf
Quarantine User = exim
Quarantine Group = apache
Quarantine Permissions = 0660
Quarantine Infections = yes
Quarantine Whole Message = yes
Quarantine Whole Messages As Queue Files = no
Keep Spam And MCP Archive Clean = yes
Spam Actions = store
High Scoring Spam Actions = store
Detailed Spam Report = yes
Include Scores In SpamAssassin Report = yes

• Set permissions

chown exim.exim -R /var/spool/MailScanner/incoming
mkdir -p /var/spool/exim.in/{input,msglog,scan,db}
chown exim.exim /var/spool/exim.in/{input,msglog,scan,db}

Anti Virus

If you have a second virus scanner set

Virus Scanning = yes
Virus Scanners = "name of virus scanner"

Blacklists And Whitelists

We will be using SQL(mysql) based whitelisting and blacklisting to easily integrate with the mailwatch front end to allow users to whitelist and blacklist senders from within the web interface.

Edit the mailscanner configuration file and add:

Is Definitely Not Spam = &SQLWhitelist
Is Definitely Spam = &SQLBlacklist
Ignore Spam Whitelist If Recipients Exceed = 20

Edit the file /usr/lib/MailScanner/MailScanner/CustomFunctions/SQLBlackWhiteList.pm:

sub CreateList {
  my($type, $BlackWhite) = @_;
  my($dbh, $sth, $sql, $to_address, $from_address, $count);
  my($db_name) = 'mailscanner';
  my($db_host) = 'localhost';
  my($db_user) = 'mailwatch';
  my($db_pass) = 'password';

Mailwatch Integration

Edit the mailscanner configuration file and add:

Always Looked Up Last = &MailWatchLogging

Edit the file /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm:

my($db_name) = 'mailscanner';
my($db_host) = 'localhost';
my($db_user) = 'mailwatch';
my($db_pass) = 'password';

Configure Spamassassin

This configuration will use a mysql database to store the bayes information. So we will create a database and user that will be used to connect to the database. We will also be using extra rules (SARE hosted by Daryl C. W. O'Shea http://www.dostech.ca/) so we will configure sa-update to download them automatically.

Create MySQL Database

mysqladmin -p create bayes

Populate the database:

mysql -p bayes < /usr/share/doc/spamassassin-3.2.3/sql/bayes_mysql.sql

Create the user:

mysql -p
mysql> GRANT ALL ON bayes.* TO bayes@localhost IDENTIFIED BY 'password';

Configure To Use DB

Edit the file /etc/mail/spamassassin/local.cf and add:

bayes_store_module  Mail::SpamAssassin::BayesStore::MySQL
bayes_sql_dsn       DBI:mysql:bayes:localhost
bayes_sql_override_username bayes
bayes_sql_username  bayes
bayes_sql_password  password

SARE Rule Updates

Import the GPG key used to sign the rules:

wget http://daryl.dostech.ca/sa-update/sare/GPG.KEY sa-update --import GPG.KEY

Create the channels file /etc/mail/spamassassin/sare-sa-update-channels.txt:

updates.spamassassin.org
72_sare_redirect_post3.0.0.cf.sare.sa-update.dostech.net
70_sare_evilnum0.cf.sare.sa-update.dostech.net
70_sare_bayes_poison_nxm.cf.sare.sa-update.dostech.net
70_sare_html0.cf.sare.sa-update.dostech.net
70_sare_html_eng.cf.sare.sa-update.dostech.net
70_sare_header0.cf.sare.sa-update.dostech.net
70_sare_header_eng.cf.sare.sa-update.dostech.net
70_sare_specific.cf.sare.sa-update.dostech.net
70_sare_adult.cf.sare.sa-update.dostech.net
72_sare_bml_post25x.cf.sare.sa-update.dostech.net
99_sare_fraud_post25x.cf.sare.sa-update.dostech.net
70_sare_spoof.cf.sare.sa-update.dostech.net
70_sare_random.cf.sare.sa-update.dostech.net
70_sare_oem.cf.sare.sa-update.dostech.net
70_sare_genlsubj0.cf.sare.sa-update.dostech.net
70_sare_genlsubj_eng.cf.sare.sa-update.dostech.net
70_sare_unsub.cf.sare.sa-update.dostech.net
70_sare_uri0.cf.sare.sa-update.dostech.net
70_sare_obfu0.cf.sare.sa-update.dostech.net
70_sare_stocks.cf.sare.sa-update.dostech.net

Create an update script /usr/local/bin/update-sa:

#!/bin/bash
#
#
sa-update -D --channelfile /etc/mail/spamassassin/sare-sa-update-channels.txt --gpgkey 856AA88A

Make it executable and add it to cron:

chmod +x /usr/local/bin/update-sa
ln -s /usr/local/bin/update-sa /etc/cron.daily/
ln -s /usr/local/bin/update-sa /etc/cron.hourly