Recognised RDN type labels include "CN", "O", "OU" and "DC".
The field selectors marked as "time" above
-may output a number of seconds since epoch
-if the modifier "int" is used.
+take an optional modifier of "int"
+for which the result is the number of seconds since epoch.
+Otherwise the result is a human-readable string
+in the timezone selected by the main "timezone" option.
The field selectors marked as "list" above return a list,
newline-separated by default,
.vitem &$sender_host_address$&
.vindex "&$sender_host_address$&"
-When a message is received from a remote host, this variable contains that
-host's IP address. For locally submitted messages, it is empty.
+When a message is received from a remote host using SMTP,
+this variable contains that
+host's IP address. For locally non-SMTP submitted messages, it is empty.
.vitem &$sender_host_authenticated$&
.vindex "&$sender_host_authenticated$&"
processed and the message itself has been received, but before the final
acknowledgment is sent. See chapter &<<CHAPACL>>& for further details.
-.option acl_smtp_data_prdr main string&!! unset
-.cindex "DATA" "ACL for"
+.option acl_smtp_data_prdr main string&!! accept
+.cindex "PRDR" "ACL for"
+.cindex "DATA" "PRDR ACL for"
.cindex "&ACL;" "PRDR-related"
.cindex "&ACL;" "per-user data processing"
This option defines the ACL that,
adjusted lightly. An unrecognised item will be detected at startup, by
invoking Exim with the &%-bV%& flag.
+The option affects Exim operating both as a server and as a client.
+
Historical note: prior to release 4.80, Exim defaulted this value to
"+dont_insert_empty_fragments", which may still be needed for compatibility
with some clients, but which lowers security by increasing exposure to
some now infamous attacks.
-An example:
+Examples:
.code
# Make both old MS and old Eudora happy:
openssl_options = -all +microsoft_big_sslv3_buffer \
+dont_insert_empty_fragments
+
+# Disable older protocol versions:
+openssl_options = +no_sslv2 +no_sslv3
.endd
Possible options may include:
unauthenticated. See also &%hosts_require_auth%&, and chapter
&<<CHAPSMTPAUTH>>& for details of authentication.
-.option hosts_try_prdr smtp "host list&!!" unset
+.option hosts_try_prdr smtp "host list&!!" *
.cindex "PRDR" "enabling, optional in client"
This option provides a list of servers to which, provided they announce
PRDR support, Exim will attempt to negotiate PRDR
for multi-recipient messages.
+The option can usually be left as default.
.option interface smtp "string list&!!" unset
.cindex "bind IP address"
permits this.
-.option multi_domain smtp boolean true
+.option multi_domain smtp boolean&!! true
.vindex "&$domain$&"
When this option is set, the &(smtp)& transport can handle a number of
addresses containing a mixture of different domains provided they all resolve
&$domain$& in an expansion for the transport, because it is set only when there
is a single domain involved in a remote delivery.
+It is expanded per-address and can depend on any of
+&$address_data$&, &$domain_data$&, &$local_part_data$&,
+&$host$&, &$host_address$& and &$host_port$&.
.option port smtp string&!! "see below"
.cindex "port" "sending TCP/IP"
The Internet standards bodies strongly discourage use of this mode.
-.option retry_include_ip_address smtp boolean true
+.option retry_include_ip_address smtp boolean&!! true
Exim normally includes both the host name and the IP address in the key it
constructs for indexing retry data after a temporary delivery failure. This
means that when one of several IP addresses for a host is failing, it gets
However, in some dialup environments hosts are assigned a different IP address
each time they connect. In this situation the use of the IP address as part of
the retry key leads to undesirable behaviour. Setting this option false causes
-Exim to use only the host name. This should normally be done on a separate
-instance of the &(smtp)& transport, set up specially to handle the dialup
-hosts.
+Exim to use only the host name.
+Since it is expanded it can be made to depend on the host or domain.
.option serialize_hosts smtp "host list&!!" unset
as part of the &[gnutls_priority_init]& function. This is very similar to the
ciphersuite specification in OpenSSL.
-The &%tls_require_ciphers%& option is treated as the GnuTLS priority string.
+The &%tls_require_ciphers%& option is treated as the GnuTLS priority string
+and controls both protocols and ciphers.
The &%tls_require_ciphers%& option is available both as an global option,
controlling how Exim behaves as a server, and also as an option of the
&url(http://www.gnutls.org/manual/gnutls.html#Listing-the-ciphersuites-in-a-priority-string, then the example code)
on that site can be used to test a given string.
+For example:
+.code
+# Disable older versions of protocols
+tls_require_ciphers = NORMAL:%LATEST_RECORD_VERSION:-VERS-SSL3.0
+.endd
+
Prior to Exim 4.80, an older API of GnuTLS was used, and Exim supported three
additional options, "&%gnutls_require_kx%&", "&%gnutls_require_mac%&" and
"&%gnutls_require_protocols%&". &%tls_require_ciphers%& was an Exim list.
.section "The SMTP PRDR ACL" "SECTPRDRACL"
+.cindex "PRDR" "ACL for"
.oindex "&%prdr_enable%&"
The &%acl_smtp_data_prdr%& ACL is available only when Exim is compiled
with PRDR support enabled (which is the default).
has been accepted.
The ACL test specfied by &%acl_smtp_data_prdr%& happens after a message
-has been recieved, and is executed for each recipient of the message.
-The test may accept or deny for inividual recipients.
+has been recieved, and is executed once for each recipient of the message
+with &$local_part$& and &$domain$& valid.
+The test may accept, defer or deny for inividual recipients.
The &%acl_smtp_data%& will still be called after this ACL and
can reject the message overall, even if this ACL has accepted it
for some or all recipients.
git://git.exim.org / users / heiko / exim.git / blobdiff