[gentoo-user] OT - Exim question

[gentoo-user] OT - Exim question

[Michael Sullivan]

I have an exim configuration question.   I run exim-4.69.  It's worked
well for over a year.  This morning I did a slight network topography
modification, and now my wife is having trouble sending email from her
computer.  Her computer used to be 192.168.1.4,, but it's connected to a
subrouter now that's connected into the main one.  The subrouter's IP is
192.168.0.1, if that matters.  My wife's computer is now 192.168.0.2.
She tried to send mail to one of her friends, and exim rejected the
message.  Here's the hostlist line from /etc/exim/exim.conf:

baby bind # grep hostlist /etc/exim/exim.conf
hostlist   relay_from_hosts = 127.0.0.1 : 192.168.1.2 : 192.168.1.3 :
192.168.1.4 : 192.168.0.2

Now, she can send a test message to herself by appending our domain to
the end of her username.  We're used to not having to do that.  How can
we get that back?  I would send the full exim.conf, but I don't remember
the syntax to sed to strip out all the comment lines, and my reference
books are packed away for our eminent  move...

-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] OT - Exim question

[Sergey Kobzar]

Hello Michael,

What does /var/log/exim/exim_mail log tell?


Thursday, March 13, 2008, 7:38:55 PM, you wrote:

> I have an exim configuration question.   I run exim-4.69.  It's worked
> well for over a year.  This morning I did a slight network topography
> modification, and now my wife is having trouble sending email from her
> computer.  Her computer used to be 192.168.1.4,, but it's connected to a
> subrouter now that's connected into the main one.  The subrouter's IP is
> 192.168.0.1, if that matters.  My wife's computer is now 192.168.0.2.
> She tried to send mail to one of her friends, and exim rejected the
> message.  Here's the hostlist line from /etc/exim/exim.conf:

> baby bind # grep hostlist /etc/exim/exim.conf
> hostlist   relay_from_hosts = 127.0.0.1 : 192.168.1.2 : 192.168.1.3 :
> 192.168.1.4 : 192.168.0.2

> Now, she can send a test message to herself by appending our domain to
> the end of her username.  We're used to not having to do that.  How can
> we get that back?  I would send the full exim.conf, but I don't remember
> the syntax to sed to strip out all the comment lines, and my reference
> books are packed away for our eminent  move...

-- 
Sergey

-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] OT - Exim question

[Michael Sullivan]

On Thu, 2008-03-13 at 20:21 +0200, Sergey Kobzar wrote:
> Hello Michael,
> 
> What does /var/log/exim/exim_mail log tell?
> 
> 
> Thursday, March 13, 2008, 7:38:55 PM, you wrote:
> 
> > I have an exim configuration question.   I run exim-4.69.  It's worked
> > well for over a year.  This morning I did a slight network topography
> > modification, and now my wife is having trouble sending email from her
> > computer.  Her computer used to be 192.168.1.4,, but it's connected to a
> > subrouter now that's connected into the main one.  The subrouter's IP is
> > 192.168.0.1, if that matters.  My wife's computer is now 192.168.0.2.
> > She tried to send mail to one of her friends, and exim rejected the
> > message.  Here's the hostlist line from /etc/exim/exim.conf:
> 
> > baby bind # grep hostlist /etc/exim/exim.conf
> > hostlist   relay_from_hosts = 127.0.0.1 : 192.168.1.2 : 192.168.1.3 :
> > 192.168.1.4 : 192.168.0.2
> 
> > Now, she can send a test message to herself by appending our domain to
> > the end of her username.  We're used to not having to do that.  How can
> > we get that back?  I would send the full exim.conf, but I don't remember
> > the syntax to sed to strip out all the comment lines, and my reference
> > books are packed away for our eminent  move...
> 
> -- 
> Sergey
> 

Mar 13 14:22:01 baby exim[25957]: 2008-03-13 14:22:01 unqualified
recipient rejected: <amy> H=([192.168.0.2]) [192.168.1.100] (failed to
find host name from IP address)

I guess 192.168.1.100 is what my main router calls the subrouter.  The
subrouter is configured to use the address 192.168.0.1 .  Do I need to
add 192.168.1.100 to the hostlist in exim.conf and restart exim?

-- 
gentoo-user@lists.gentoo.org mailing list

Re[2]: [gentoo-user] OT - Exim question

[Sergey Kobzar]

Hi Michael,

> Mar 13 14:22:01 baby exim[25957]: 2008-03-13 14:22:01 unqualified
> recipient rejected: <amy> H=([192.168.0.2]) [192.168.1.100] (failed to
> find host name from IP address)

> I guess 192.168.1.100 is what my main router calls the subrouter.  The
> subrouter is configured to use the address 192.168.0.1.

Probably this address is NATed.


> Do I need to add 192.168.1.100 to the hostlist in exim.conf and
> restart exim?

Yes - this is easy solution for your problem ;)


-- 
Sergey

-- 
gentoo-user@lists.gentoo.org mailing list

Re: Re[2]: [gentoo-user] OT - Exim question

[Michael Sullivan]

On Thu, 2008-03-13 at 21:47 +0200, Sergey Kobzar wrote:
> Hi Michael,
> 
> > Mar 13 14:22:01 baby exim[25957]: 2008-03-13 14:22:01 unqualified
> > recipient rejected: <amy> H=([192.168.0.2]) [192.168.1.100] (failed to
> > find host name from IP address)
> 
> > I guess 192.168.1.100 is what my main router calls the subrouter.  The
> > subrouter is configured to use the address 192.168.0.1.
> 
> Probably this address is NATed.
> 
> 
> > Do I need to add 192.168.1.100 to the hostlist in exim.conf and
> > restart exim?
> 
> Yes - this is easy solution for your problem ;)
> 
> 
> -- 
> Sergey
> 

It didn't work:

Mar 13 15:13:31 baby exim[26470]: 2008-03-13 15:13:31 unqualified
recipient rejected: <amy> H=([192.168.0.2]) [192.168.1.100] (failed to
find host name from IP address)
baby bind # grep 192.168.1.100 /etc/exim/exim.conf
hostlist   relay_from_hosts = 127.0.0.1 : 192.168.1.2 : 192.168.1.3 :
192.168.1.4 : 192.168.0.2 192.168.1.100

Is there any other option?

-- 
gentoo-user@lists.gentoo.org mailing list

Re[4]: [gentoo-user] OT - Exim question

[Sergey Kobzar]

Hi Michael,

Thursday, March 13, 2008, 10:15:33 PM, you wrote:

> It didn't work:

> Mar 13 15:13:31 baby exim[26470]: 2008-03-13 15:13:31 unqualified
> recipient rejected: <amy> H=([192.168.0.2]) [192.168.1.100] (failed to
> find host name from IP address)
> baby bind # grep 192.168.1.100 /etc/exim/exim.conf
> hostlist   relay_from_hosts = 127.0.0.1 : 192.168.1.2 : 192.168.1.3 :
> 192.168.1.4 : 192.168.0.2 192.168.1.100

> Is there any other option?

1. Show your config.
2. Tell Exim to not do resolving for hosts from 192.168.0/24 and
   192.168.1/24 networks (host_lookup option).


-- 
Sergey

-- 
gentoo-user@lists.gentoo.org mailing list

Re: Re[4]: [gentoo-user] OT - Exim question

[Michael Sullivan]

On Thu, 2008-03-13 at 22:29 +0200, Sergey Kobzar wrote:
> Hi Michael,
> 
> Thursday, March 13, 2008, 10:15:33 PM, you wrote:
> 
> > It didn't work:
> 
> > Mar 13 15:13:31 baby exim[26470]: 2008-03-13 15:13:31 unqualified
> > recipient rejected: <amy> H=([192.168.0.2]) [192.168.1.100] (failed to
> > find host name from IP address)
> > baby bind # grep 192.168.1.100 /etc/exim/exim.conf
> > hostlist   relay_from_hosts = 127.0.0.1 : 192.168.1.2 : 192.168.1.3 :
> > 192.168.1.4 : 192.168.0.2 192.168.1.100
> 
> > Is there any other option?
> 
> 1. Show your config.
> 2. Tell Exim to not do resolving for hosts from 192.168.0/24 and
>    192.168.1/24 networks (host_lookup option).
> 
> 
> -- 
> Sergey
> 

Here's the config.  I think I have my sed command correct to remove the
commented lines from the listing:

baby ~ # cat /etc/exim/exim.conf | sed /#/d
domainlist local_domains = @ : espersunited.com :
baby.espersunited.com : localhost : localdomain :
camille.espersunited.com : catherine.espersunited.com : camille :
catherine
domainlist relay_to_domains =
hostlist   relay_from_hosts = 127.0.0.1 : 192.168.1.2 : 192.168.1.3 :
192.168.1.4 : 192.168.0.2 192.168.1.100
acl_smtp_rcpt = acl_check_rcpt
acl_smtp_data = acl_check_data
acl_smtp_mime = acl_check_mime
av_scanner = clamd:/tmp/clamd
spamd_address = 127.0.0.1 783
qualify_domain = espersunited.com
never_users = root
host_lookup = *
rfc1413_hosts = *
rfc1413_query_timeout = 5s
sender_unqualified_hosts = baby.espersunited.com :
camille.espersunited.com : catherine.espersunited.com :
localhost.localdomain
recipient_unqualified_hosts = baby.espersunited.com :
camille.espersunited.com : catherine.espersunited.com :
localhost.localdomain
ignore_bounce_errors_after = 2d
timeout_frozen_after = 7d
begin acl
acl_check_rcpt:
  accept  hosts = :
  deny    message       = Restricted characters in address
         domains       = +local_domains
          local_parts   = ^[.] : ^.*[@%!/|]


  deny    message       = Restricted characters in address
          domains       = !+local_domains
          local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./


  accept  local_parts   = postmaster
          domains       = +local_domains


  require verify        = sender




  accept  hosts         = +relay_from_hosts
          control       = submission


  accept  authenticated = *
          control       = submission


  require message = relay not permitted
          domains = +local_domains : +relay_to_domains


  require verify = recipient




  accept




acl_check_data:


  



warn    message    = X-SpamScore: $spam_score ($spam_bar)
        spam       = nobody:true
warn    message    = X-SpamReport: $spam_report
        spam       = nobody:true
warn    message    = X-Spam-Flag: ${if \
                     >{$spam_score_int}{58}{Almost Certainly}\
                     {${if >{$spam_score_int}{55}{Probably}\
                     {${if >{$spam_score_int}{50}{Possibly}{Doubtful}\
                     }}}}}
        spam       = nobody
warn message = Subject: [*SPAM*] $h_Subject ${if \
                     >{$spam_score_int}{58}{Almost Certainly}\
		     {${if >{$spam_score_int}{55}{Probably}\
		     {${if >{$spam_score_int}{50}{Possibly}{Doubtful}\
		     }}}}}
	spam       = nobody

deny    message    = Rejected: spam score $spam_score
        spam       = nobody:true
        condition  = ${if >{$spam_score_int}{60}{1}{0}}

accept

acl_check_mime:
   warn decode = default

   deny message = Blacklisted file extension detected
   condition = ${if match \
       {${lc:$mime_filename}} \
       {\N(\.exe|\.pif|\.bat|\.scr|\.lnk|\.com|.vbs)$\N} \
       {1}{0}}

   accept
acl_check_content:
   deny  message = Serious MIME defect detected ($demime_reason)
   demime = *
   condition = ${if >{$demime_errorlevel}{2}{1}{0}}

   deny  message = This message contains malware ($malware_name)
   malware = *

   warn  message = X-Spam-Score: $spam_score ($spam_bar)
   spam = nobody:true
   warn  message = X-Spam-Report: $spam_report
   spam = nobody:true

   warn message = Subject: [*SPAM*] $h_Subject
   spam = nobody

   deny  message = This message scored $spam_score points.
Congratulations!
   spam = nobody:true
   condition = ${if >{$spam_score_int}{50}{1}{0}}

   accept



begin routers





dnslookup:
  driver = dnslookup
  domains = ! +local_domains
  transport = remote_smtp
  ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
  no_more





system_aliases:
  driver = redirect
  allow_fail
  allow_defer
  data = ${lookup{$local_part}lsearch{/etc/mail/aliases}}
  file_transport = address_file
  pipe_transport = address_pipe







userforward:
  driver = redirect
  check_local_user
  file = $home/.forward
  no_verify
  no_expn
  check_ancestor
  file_transport = address_file
  pipe_transport = address_pipe
  reply_transport = address_reply




localuser:
  driver = accept
  check_local_user
  transport = local_delivery
  cannot_route_message = Unknown user





begin transports



remote_smtp:
  driver = smtp



local_delivery:
  driver = appendfile
  directory = /home/$local_part/.maildir
  maildir_format
  delivery_date_add
  envelope_to_add
  return_path_add



address_pipe:
  driver = pipe
  return_output



address_file:
  driver = appendfile
  delivery_date_add
  envelope_to_add
  return_path_add



address_reply:
  driver = autoreply




begin retry



*                      *           F,2h,15m; G,16h,1h,1.5; F,4d,6h





begin rewrite





begin authenticators










I'm not quite sure how to word the host_lookup option.  I'm not sure how
to tell it not to do host lookups for my network and subnetwork, but
still do lookups for everyone else...

-- 
gentoo-user@lists.gentoo.org mailing list

Re[6]: [gentoo-user] OT - Exim question

[Sergey Kobzar]

Hi Michael,

See comments below.


> Here's the config.  I think I have my sed command correct to remove the
> commented lines from the listing:

> baby ~ # cat /etc/exim/exim.conf | sed /#/d
> domainlist local_domains = @ : espersunited.com :
^^^^^^^^^^^^^^^^^^^^^^^^^^^ - Did you really spit domainlist on few
lines w/o backslashes at the end of each line or it's your MUA?


> baby.espersunited.com : localhost : localdomain :
> camille.espersunited.com : catherine.espersunited.com : camille :
> catherine

Did you really spit domainlist on few lines w/o backslashes at the
end of each line or it's your MUA?


> domainlist relay_to_domains =
> hostlist   relay_from_hosts = 127.0.0.1 : 192.168.1.2 : 192.168.1.3 :
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - Same as domainlist local_domains above

> 192.168.1.4 : 192.168.0.2 192.168.1.100
> acl_smtp_rcpt = acl_check_rcpt
> acl_smtp_data = acl_check_data
> acl_smtp_mime = acl_check_mime
> av_scanner = clamd:/tmp/clamd
> spamd_address = 127.0.0.1 783
> qualify_domain = espersunited.com
> never_users = root
> host_lookup = *
^^^^^^^^^^^^^^^^^^ - try change it to something like:
host_lookup = !192.168.0.0/24: !192.168.1.0/24


> rfc1413_hosts = *
> rfc1413_query_timeout = 5s
^^^^^^^^^^^^^^^^^^^^^^^^^^^^ you can freely set it to 0s


> sender_unqualified_hosts = baby.espersunited.com :
^^^^^^^^^^^^^^^^^^^^^^^^^^ - usually you don't need this in case of
correct MUA settings.


> camille.espersunited.com : catherine.espersunited.com :
> localhost.localdomain
> recipient_unqualified_hosts = baby.espersunited.com :
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - same as for sender_unqualified_hosts

> camille.espersunited.com : catherine.espersunited.com :
> localhost.localdomain
> ignore_bounce_errors_after = 2d
> timeout_frozen_after = 7d
> begin acl
> acl_check_rcpt:
>   accept  hosts = :
>   deny    message       = Restricted characters in address
>          domains       = +local_domains
>           local_parts   = ^[.] : ^.*[@%!/|]


>   deny    message       = Restricted characters in address
>           domains       = !+local_domains
>           local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./


>   accept  local_parts   = postmaster
>           domains       = +local_domains


>   require verify        = sender
^^^^^^^^^^^^^^^^^^ - are you sure you really need this in your case?
:)


>   accept  hosts         = +relay_from_hosts
>           control       = submission


>   accept  authenticated = *
>           control       = submission


>   require message = relay not permitted
>           domains = +local_domains : +relay_to_domains


>   require verify = recipient
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - this does not work as expected. Use
something like 'require verify = recipient/callout=60s,defer_ok'.



>   accept




> acl_check_data:


>   



> warn    message    = X-SpamScore: $spam_score ($spam_bar)
>         spam       = nobody:true
> warn    message    = X-SpamReport: $spam_report
>         spam       = nobody:true
> warn    message    = X-Spam-Flag: ${if \
>                      >{$spam_score_int}{58}{Almost Certainly}\
>                      {${if >{$spam_score_int}{55}{Probably}\
>                      {${if >{$spam_score_int}{50}{Possibly}{Doubtful}\
>                      }}}}}
>         spam       = nobody
> warn message = Subject: [*SPAM*] $h_Subject ${if \
>                      >{$spam_score_int}{58}{Almost Certainly}\
>                      {${if >{$spam_score_int}{55}{Probably}\
>                      {${if >{$spam_score_int}{50}{Possibly}{Doubtful}\
>                      }}}}}
>         spam       = nobody

> deny    message    = Rejected: spam score $spam_score
>         spam       = nobody:true
>         condition  = ${if >{$spam_score_int}{60}{1}{0}}

Worth to set message size limit here for spam checking.


> accept

> acl_check_mime:
>    warn decode = default

>    deny message = Blacklisted file extension detected
>    condition = ${if match \
>        {${lc:$mime_filename}} \
>        {\N(\.exe|\.pif|\.bat|\.scr|\.lnk|\.com|.vbs)$\N} \
>        {1}{0}}

>    accept
> acl_check_content:
>    deny  message = Serious MIME defect detected ($demime_reason)
>    demime = *
>    condition = ${if >{$demime_errorlevel}{2}{1}{0}}

>    deny  message = This message contains malware ($malware_name)
>    malware = *

>    warn  message = X-Spam-Score: $spam_score ($spam_bar)
>    spam = nobody:true
>    warn  message = X-Spam-Report: $spam_report
>    spam = nobody:true

>    warn message = Subject: [*SPAM*] $h_Subject
>    spam = nobody

>    deny  message = This message scored $spam_score points.
> Congratulations!
>    spam = nobody:true
>    condition = ${if >{$spam_score_int}{50}{1}{0}}

Why do you check message for spam twice? %)


>    accept



> begin routers





> dnslookup:
>   driver = dnslookup
>   domains = ! +local_domains
>   transport = remote_smtp
>   ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
>   no_more





> system_aliases:
>   driver = redirect
>   allow_fail
>   allow_defer
>   data = ${lookup{$local_part}lsearch{/etc/mail/aliases}}
>   file_transport = address_file
>   pipe_transport = address_pipe







> userforward:
>   driver = redirect
>   check_local_user
>   file = $home/.forward
>   no_verify
>   no_expn
>   check_ancestor
>   file_transport = address_file
>   pipe_transport = address_pipe
>   reply_transport = address_reply




> localuser:
>   driver = accept
>   check_local_user
>   transport = local_delivery
>   cannot_route_message = Unknown user





> begin transports



> remote_smtp:
>   driver = smtp



> local_delivery:
>   driver = appendfile
>   directory = /home/$local_part/.maildir
>   maildir_format
>   delivery_date_add
>   envelope_to_add
>   return_path_add



> address_pipe:
>   driver = pipe
>   return_output



> address_file:
>   driver = appendfile
>   delivery_date_add
>   envelope_to_add
>   return_path_add



> address_reply:
>   driver = autoreply


> begin retry


> *                      *           F,2h,15m; G,16h,1h,1.5; F,4d,6h


> begin rewrite


> begin authenticators


> I'm not quite sure how to word the host_lookup option.  I'm not sure how
> to tell it not to do host lookups for my network and subnetwork, but
> still do lookups for everyone else...

See above.

http://exim.org/exim-html-current/doc/html/spec_html/index.html - one
of the reasons why I like Exim very much :)



-- 
Sergey

-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] OT - Exim question

[kashani]

Michael Sullivan wrote:
>>> Do I need to add 192.168.1.100 to the hostlist in exim.conf and
>>> restart exim?
>> Yes - this is easy solution for your problem ;)
>>
>>
>> -- 
>> Sergey
>>
> 
> It didn't work:
> 
> Mar 13 15:13:31 baby exim[26470]: 2008-03-13 15:13:31 unqualified
> recipient rejected: <amy> H=([192.168.0.2]) [192.168.1.100] (failed to
> find host name from IP address)
> baby bind # grep 192.168.1.100 /etc/exim/exim.conf
> hostlist   relay_from_hosts = 127.0.0.1 : 192.168.1.2 : 192.168.1.3 :
> 192.168.1.4 : 192.168.0.2 192.168.1.100
> 
> Is there any other option?
> 

Add 192.168.0.2 and .100 to your /etc/hosts file. You've got Exim set to 
deny IP addresses that do not resolve.

kashani
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] OT - Exim question

[Michael Sullivan]

On Thu, 2008-03-13 at 14:32 -0700, kashani wrote:
> Michael Sullivan wrote:
> >>> Do I need to add 192.168.1.100 to the hostlist in exim.conf and
> >>> restart exim?
> >> Yes - this is easy solution for your problem ;)
> >>
> >>
> >> -- 
> >> Sergey
> >>
> > 
> > It didn't work:
> > 
> > Mar 13 15:13:31 baby exim[26470]: 2008-03-13 15:13:31 unqualified
> > recipient rejected: <amy> H=([192.168.0.2]) [192.168.1.100] (failed to
> > find host name from IP address)
> > baby bind # grep 192.168.1.100 /etc/exim/exim.conf
> > hostlist   relay_from_hosts = 127.0.0.1 : 192.168.1.2 : 192.168.1.3 :
> > 192.168.1.4 : 192.168.0.2 192.168.1.100
> > 
> > Is there any other option?
> > 
> 
> Add 192.168.0.2 and .100 to your /etc/hosts file. You've got Exim set to 
> deny IP addresses that do not resolve.
> 
> kashani

192.168.0.2 was already in there, but I've added 192.168.1.100 to
both /etc/hosts and the DNS server files.  Now, in addition to the
previous error, I get this:

Mar 13 21:14:15 baby exim[30880]: 2008-03-13 21:14:15 unqualified
recipient rejected: <amy> H=([192.168.0.2]) [192.168.1.100]
(192.168.1.100 does not match any IP address for
subrouter.espersunited.com.1.168.192.in-addr.arpa)

baby named # grep subrouter *
db.1.168.192:100 IN PTR	subrouter.espersunited.com
db.espersunited.com:subrouter.espersunited.com	IN A 192.168.1.100


-- 
gentoo-user@lists.gentoo.org mailing list