secure (encrypted) LDAP connections. The second of these ensures that an
encrypted TLS connection is used.
+.new
+With sufficiently modern LDAP libraries, Exim supports forcing TLS over regular
+LDAP connections, rather than the SSL-on-connect &`ldaps`&.
+See the &%ldap_start_tls%& option.
+.wen
+
.section "LDAP quoting" "SECID68"
.cindex "LDAP" "quoting"
routers, and transports run) the count is increased to include the
&'Received:'& header line that Exim standardly adds, and also any other header
lines that are added by ACLs. The blank line that separates the message header
-from the body is not counted. Here is an example of the use of this variable in
-a DATA ACL:
+from the body is not counted.
+
+As with the special case of &$message_size$&, during the expansion of the
+appendfile transport's maildir_tag option in maildir format, the value of
+&$message_linecount$& is the precise size of the number of newlines in the
+file that has been written (minus one for the blank line between the
+header and the body).
+
+Here is an example of the use of this variable in a DATA ACL:
.code
deny message = Too many lines in message header
condition = \
.section "Data lookups" "SECID101"
.table2
.row &%ibase_servers%& "InterBase servers"
+.row &%ldap_ca_cert_dir%& "dir of CA certs to verify LDAP server's"
+.row &%ldap_ca_cert_file%& "file of CA certs to verify LDAP server's"
+.row &%ldap_cert_file%& "client cert file for LDAP"
+.row &%ldap_cert_key%& "client key file for LDAP"
+.row &%ldap_cipher_suite%& "TLS negotiation preference control"
.row &%ldap_default_servers%& "used if no server in query"
+.row &%ldap_require_cert%& "action to take without LDAP server cert"
+.row &%ldap_start_tls%& "require TLS within LDAP"
.row &%ldap_version%& "set protocol version"
.row &%lookup_open_max%& "lookup files held open"
.row &%mysql_servers%& "default MySQL servers"
logged.
+.new
+.option ldap_ca_cert_dir main string unset
+.cindex "LDAP", "TLS CA certificate directory"
+This option indicates which directory contains CA certificates for verifying
+a TLS certificate presented by an LDAP server.
+While Exim does not provide a default value, your SSL library may.
+Analogous to &%tls_verify_certificates%& but as a client-side option for LDAP
+and constrained to be a directory.
+.wen
+
+
+.new
+.option ldap_ca_cert_file main string unset
+.cindex "LDAP", "TLS CA certificate file"
+This option indicates which file contains CA certificates for verifying
+a TLS certificate presented by an LDAP server.
+While Exim does not provide a default value, your SSL library may.
+Analogous to &%tls_verify_certificates%& but as a client-side option for LDAP
+and constrained to be a file.
+.wen
+
+
+.new
+.option ldap_cert_file main string unset
+.cindex "LDAP" "TLS client certificate file"
+This option indicates which file contains an TLS client certificate which
+Exim should present to the LDAP server during TLS negotiation.
+Should be used together with &%ldap_cert_key%&.
+.wen
+
+
+.new
+.option ldap_cert_key main string unset
+.cindex "LDAP" "TLS client key file"
+This option indicates which file contains the secret/private key to use
+to prove identity to the LDAP server during TLS negotiation.
+Should be used together with &%ldap_cert_file%&, which contains the
+identity to be proven.
+.wen
+
+
+.new
+.option ldap_cipher_suite main string unset
+.cindex "LDAP" "TLS cipher suite"
+This controls the TLS cipher-suite negotiation during TLS negotiation with
+the LDAP server. See &<<SECTreqciphssl>>& for more details of the format of
+cipher-suite options with OpenSSL (as used by LDAP client libraries).
+.wen
+
+
.option ldap_default_servers main "string list" unset
.cindex "LDAP" "default servers"
This option provides a list of LDAP servers which are tried in turn when an
with LDAP support.
+.new
+.option ldap_require_cert main string unset.
+.cindex "LDAP" "policy for LDAP server TLS cert presentation"
+This should be one of the values "hard", "demand", "allow", "try" or "never".
+A value other than one of these is interpreted as "never".
+See the entry "TLS_REQCERT" in your system man page for ldap.conf(5).
+Although Exim does not set a default, the LDAP library probably defaults
+to hard/demand.
+.wen
+
+
+.new
+.option ldap_start_tls main boolean false
+.cindex "LDAP" "whether or not to negotiate TLS"
+If set, Exim will attempt to negotiate TLS with the LDAP server when
+connecting on a regular LDAP port. This is the LDAP equivalent of SMTP's
+"STARTTLS". This is distinct from using "ldaps", which is the LDAP form
+of SSL-on-connect.
+In the event of failure to negotiate TLS, the action taken is controlled
+by &%ldap_require_cert%&.
+.wen
+
+
.option ldap_version main integer unset
.cindex "LDAP" "protocol version, forcing"
This option can be used to force Exim to set a specific protocol version for
logged, but are not included in the bounce message, which merely contains
&"local delivery failed"&.
+If the command exits on a signal and the &%freeze_signal%& option is set then
+the message will be frozen in the queue. If that option is not set, a bounce
+will be sent as normal.
+
If the return code is greater than 128 and the command being run is a shell
script, it normally means that the script was terminated by a signal whose
-value is the return code minus 128.
+value is the return code minus 128. The &%freeze_signal%& option does not
+apply in this case.
If Exim is unable to run the command (that is, if &[execve()]& fails), the
return code is set to 127. This is the value that a shell returns if it is
frozen, whatever the setting of &%ignore_status%&.
+.new
+.otion freeze_signal pipe boolean false
+.cindex "signal exit"
+.cidenx "&(pipe)& transport", "signal exit"
+Normally if the process run by a command in a pipe transport exits on a signal,
+a bounce message is sent. If &%freeze_signal%& is set, the message will be
+frozen in Exim's queue instead.
+.wen
+
+
.option ignore_status pipe boolean false
If this option is true, the status returned by the subprocess that is set up to
run the command is ignored, and Exim behaves as if zero had been returned.
If you do not specify anything at build time or run time, that is where the
logs are written.
-A log file path may also contain &`%D`& if datestamped log file names are in
-use &-- see section &<<SECTdatlogfil>>& below.
+.new
+A log file path may also contain &`%D`& or &`%M`& if datestamped log file names
+are in use &-- see section &<<SECTdatlogfil>>& below.
+.wen
Here are some examples of possible settings:
.display
+.new
.section "Datestamped log files" "SECTdatlogfil"
.cindex "log" "datestamped files"
Instead of cycling the main and reject log files by renaming them
periodically, some sites like to use files whose names contain a datestamp,
-for example, &_mainlog-20031225_&. The datestamp is in the form &_yyyymmdd_&.
-Exim has support for this way of working. It is enabled by setting the
-&%log_file_path%& option to a path that includes &`%D`& at the point where the
-datestamp is required. For example:
+for example, &_mainlog-20031225_&. The datestamp is in the form &_yyyymmdd_& or
+&_yyyymm_&. Exim has support for this way of working. It is enabled by setting
+the &%log_file_path%& option to a path that includes &`%D`& or &`%M`& at the
+point where the datestamp is required. For example:
.code
log_file_path = /var/spool/exim/log/%slog-%D
log_file_path = /var/log/exim-%s-%D.log
log_file_path = /var/spool/exim/log/%D-%slog
+log_file_path = /var/log/exim/%s.%M
.endd
As before, &`%s`& is replaced by &"main"& or &"reject"&; the following are
examples of names generated by the above examples:
/var/spool/exim/log/mainlog-20021225
/var/log/exim-reject-20021225.log
/var/spool/exim/log/20021225-mainlog
+/var/log/exim/main.200212
.endd
When this form of log file is specified, Exim automatically switches to new
files at midnight. It does not make any attempt to compress old logs; you
The location of the panic log is also determined by &%log_file_path%&, but it
is not datestamped, because rotation of the panic log does not make sense.
-When generating the name of the panic log, &`%D`& is removed from the string.
-In addition, if it immediately follows a slash, a following non-alphanumeric
-character is removed; otherwise a preceding non-alphanumeric character is
-removed. Thus, the three examples above would give these panic log names:
+When generating the name of the panic log, &`%D`& or &`%M`& are removed from
+the string. In addition, if it immediately follows a slash, a following
+non-alphanumeric character is removed; otherwise a preceding non-alphanumeric
+character is removed. Thus, the four examples above would give these panic
+log names:
.code
/var/spool/exim/log/paniclog
/var/log/exim-panic.log
/var/spool/exim/log/paniclog
+/var/log/exim/panic
.endd
+.wen
.section "Logging to syslog" "SECID249"
git://git.exim.org / exim.git / blobdiff