.oindex "&%-bmalware%&"
.cindex "testing", "malware"
.cindex "malware scan test"
-This debugging option causes Exim to scan the given file,
+This debugging option causes Exim to scan the given file or directory
+(depending on the used scanner interface),
using the malware scanning framework. The option of &%av_scanner%& influences
this option, so if &%av_scanner%&'s value is dependent upon an expansion then
the expansion should have defaults which apply to this invocation. ACLs are
by Exim in conjunction with the &%-MC%& option. It signifies that the
remote host supports the ESMTP &_DSN_& extension.
+.new
+.vitem &%-MCG%&
+.oindex "&%-MCG%&"
+This option is not intended for use by external callers. It is used internally
+by Exim in conjunction with the &%-MC%& option. It signifies that an
+alternate queue is used, named by the following option.
+.wen
+
.vitem &%-MCP%&
.oindex "&%-MCP%&"
This option is not intended for use by external callers. It is used internally
be done. If a message requires any remote deliveries, it remains on the queue
for later delivery.
-.vitem &%-q%&<&'qflags'&>&~<&'start&~id'&>&~<&'end&~id'&>
+.new
+.vitem &%-q[q][i][f[f]][l][G<name>[/<time>]]]%&
+.oindex "&%-qG%&"
+.cindex queue named
+.cindex "named queues"
.cindex "queue" "delivering specific messages"
+If the &'G'& flag and a name is present, the queue runner operates on the
+queue with the given name rather than the default queue.
+The name should not contain a &'/'& character.
+For a periodic queue run (see below)
+append to the name a slash and a time value.
+.wen
+
+.vitem &%-q%&<&'qflags'&>&~<&'start&~id'&>&~<&'end&~id'&>
When scanning the queue, Exim can be made to skip over messages whose ids are
lexically less than a given value by following the &%-q%& option with a
starting message id. For example:
This causes any temporarily failing address to be retried every 15 minutes for
2 hours, then at intervals starting at one hour and increasing by a factor of
1.5 until 16 hours have passed, then every 6 hours up to 4 days. If an address
-is not delivered after 4 days of temporary failure, it is bounced.
+is not delivered after 4 days of temporary failure, it is bounced. The time is
+measured from first failure, not from the time the message was received.
If the retry section is removed from the configuration, or is empty (that is,
if no retry rules are defined), Exim will not retry deliveries. This turns
.endlist ilist
-.section "Query-style lookup types" "SECID62"
+.section "Query-style lookup types" "SECTquerystylelookups"
.cindex "lookup" "query-style types"
.cindex "query-style lookup" "list of types"
The supported query-style lookup types are listed below. Further details about
.section "Expansion of lists" "SECTlistexpand"
.cindex "expansion" "of lists"
-Each list is expanded as a single string before it is used. The result of
+Each list is expanded as a single string before it is used.
+
+.new
+&'Exception: the router headers_remove option, where list-item
+splitting is done before string-expansion.'&
+.wen
+
+The result of
expansion must be a list, possibly containing empty items, which is split up
into separate items for matching. By default, colon is the separator character,
but this can be varied if necessary. See sections &<<SECTlistconstruct>>& and
qualified host name. See also &$smtp_active_hostname$&.
-.vitem &$proxy_host_address$& &&&
- &$proxy_host_port$& &&&
- &$proxy_target_address$& &&&
- &$proxy_target_port$& &&&
+.new
+.vitem &$proxy_external_address$& &&&
+ &$proxy_external_port$& &&&
+ &$proxy_local_address$& &&&
+ &$proxy_local_port$& &&&
&$proxy_session$&
These variables are only available when built with Proxy Protocol
or Socks5 support
For details see chapter &<<SECTproxyInbound>>&.
+.wen
.vitem &$prdr_requested$&
.cindex "PRDR" "variable for"
The value set for the &%qualify_recipient%& option in the configuration file,
or if not set, the value of &$qualify_domain$&.
+.new
+.vitem &$queue_name$&
+.vindex &$queue_name$&
+.cindex "named queues"
+.cindex queues named
+The name of the spool queue in use; empty for the default queue.
+.wen
+
.vitem &$rcpt_count$&
.vindex "&$rcpt_count$&"
When a message is being received by SMTP, this variable contains the number of
There is also a command line option &%-pd%& (for delay) which suppresses the
initial startup, even if &%perl_at_start%& is set.
+.new
+.ilist
+.oindex "&%perl_taintmode%&"
+.cindex "Perl" "taintmode"
+To provide more security executing Perl code via the embedded Perl
+interpeter, the &%perl_taintmode%& option can be set. This enables the
+taint mode of the Perl interpreter. You are encouraged to set this
+option to a true value. To avoid breaking existing installations, it
+defaults to false.
+.wen
+
.section "Calling Perl subroutines" "SECID86"
When the configuration file includes a &%perl_startup%& option you can make use
.table2
.row &%perl_at_start%& "always start the interpreter"
.row &%perl_startup%& "code to obey when starting Perl"
+.row &%perl_taintmode%& "enable taint mode in Perl"
.endtable
.option perl_at_start main boolean false
+.cindex "Perl"
This option is available only when Exim is built with an embedded Perl
interpreter. See chapter &<<CHAPperl>>& for details of its use.
.option perl_startup main string unset
+.cindex "Perl"
This option is available only when Exim is built with an embedded Perl
interpreter. See chapter &<<CHAPperl>>& for details of its use.
+.option perl_startup main boolean false
+.cindex "Perl"
+This Option enables the taint mode of the embedded Perl interpreter.
+
.option pgsql_servers main "string list" unset
.cindex "PostgreSQL lookup type" "server list"
-.option queue_run_max main integer 5
+.option queue_run_max main integer&!! 5
.cindex "queue runner" "maximum number of"
This controls the maximum number of queue runner processes that an Exim daemon
can run simultaneously. This does not mean that it starts them all at once,
run. If you do not want queue runs to occur, omit the &%-q%&&'xx'& setting on
the daemon's command line.
+.new
+.cindex queues named
+.condex "named queues"
+To set limits for different named queues use
+an expansion depending on the &$queue_name$& variable.
+.wen
+
.option queue_smtp_domains main "domain list&!!" unset
.cindex "queueing incoming messages"
.cindex "message" "queueing remote deliveries"
response to EHLO only to those client hosts that match this option. See
chapter &<<CHAPTLS>>& for details of Exim's support for TLS.
Note that the default value requires that a certificate be supplied
-using the &%tls_certificate%& option. If no certificate is available then
-the &%tls_advertise_hosts%& option should be set empty.
+using the &%tls_certificate%& option. If TLS support for incoming connections
+is not required the &%tls_advertise_hosts%& option should be set empty.
.option tls_certificate main string&!! unset
Server Name Indication extension, then this option and others documented in
&<<SECTtlssni>>& will be re-expanded.
+.new
+If this option is unset or empty a fresh self-signed certificate will be
+generated for every connection.
+.wen
+
.option tls_crl main string&!! unset
.cindex "TLS" "server certificate revocation list"
.cindex "certificate" "revocation list for server"
&url(http://www.gnutls.org/manual/html_node/Priority-Strings.html),
but beware that this relates to GnuTLS 3, which may be newer than the version
installed on your system. If you are using GnuTLS 3,
-&url(http://www.gnutls.org/manual/gnutls.html#Listing-the-ciphersuites-in-a-priority-string, then the example code)
+then the example code
+&url(http://www.gnutls.org/manual/gnutls.html#Listing-the-ciphersuites-in-a-priority-string)
on that site can be used to test a given string.
For example:
If a STARTTLS command is issued within an existing TLS session, it is
rejected with a 554 error code.
-To enable TLS operations on a server, you must set &%tls_advertise_hosts%& to
-match some hosts. You can, of course, set it to * to match all hosts.
-However, this is not all you need to do. TLS sessions to a server won't work
-without some further configuration at the server end.
+To enable TLS operations on a server, the &%tls_advertise_hosts%& option
+must be set to match some hosts. The default is * which matches all hosts.
+
+.new
+If this is all you do, TLS encryption will be enabled but not authentication -
+meaning that the peer has no assurance it is actually you he is talking to.
+You gain protection from a passive sniffer listening on the wire but not
+from someone able to intercept the communication.
+.wen
+
+Further protection requires some further configuration at the server end.
It is rumoured that all existing clients that support TLS/SSL use RSA
encryption. To make this work you need to set, in the server,
effect.
+.new
+.vitem &*queue*&&~=&~<&'text'&>
+This modifier specifies the use of a named queue for spool files
+for the message.
+This could be used, for example, for known high-volume burst sources
+of traffic, or for quarantine of messages.
+Separate queue-runner processes will be needed for named queues.
+If the text after expansion is empty, the default queue is used.
+.wen
+
+
.vitem &*remove_header*&&~=&~<&'text'&>
This modifier specifies one or more header names in a colon-separated list
that are to be removed from an incoming message, assuming, of course, that
&`P `& on &`<=`& lines: protocol used
&` `& on &`=>`& and &`**`& lines: return path
&`PRX `& on &'<='& and&`=>`& lines: proxy address
+&`Q `& alternate queue name
&`QT `& on &`=>`& lines: time spent on queue so far
&` `& on &"Completed"& lines: time spent on queue
&`R `& on &`<=`& lines: reference for local bounce
main configuration option to a hostlist; connections from these
hosts will use Proxy Protocol.
+.new
The following expansion variables are usable
(&"internal"& and &"external"& here refer to the interfaces
of the proxy):
.display
-&'proxy_host_address '& internal IP address of the proxy
-&'proxy_host_port '& internal TCP port of the proxy
-&'proxy_target_address '& external IP address of the proxy
-&'proxy_target_port '& external TCP port of the proxy
+&'proxy_external_address '& IP of host being proxied or IP of remote interface of proxy
+&'proxy_external_port '& Port of host being proxied or Port on remote interface of proxy
+&'proxy_local_address '& IP of proxy server inbound or IP of local interface of proxy
+&'proxy_local_port '& Port of proxy server inbound or Port on local interface of proxy
&'proxy_session '& boolean: SMTP connection via proxy
.endd
-If &$proxy_session$& is set but &$proxy_host_address$& is empty
+If &$proxy_session$& is set but &$proxy_external_address$& is empty
there was a protocol error.
+.wen
Since the real connections are all coming from the proxy, and the
per host connection tracking is done before Proxy Protocol is
git://git.exim.org / users / jgh / exim.git / blobdiff