Доброго времени суток, не могу совладать с парой моментов, а именно
-
авторизация ldap через freeipa c фильтрацией по активным пользователям + наличие пользователя в нужной группе.
-
на transport при локальной доставке переменные $domain_data и $local_part_data пустые, при этом переменные $domain и $local_part заполнены корректно нужными данными, но с версии 4.94 их использовать нельзя более. Соотвественно получаю при доставке письма локально не ту директорию что надо :
Нужно: directory = /var/spool/mail/$domain_data/$local_part_data ( path for example: /var/spool/mail/example.com/user)., но получаю вот это:
20:44:33 89714 ╭considering: /var/spool/mail/$domain_data/$local_part_data
20:44:33 89714 ├──expanding: /var/spool/mail/$domain_data/$local_part_data
20:44:33 89714 ╰─────result: /var/spool/mail//
Входные данные:
OS: Oracle linux 8
exim: exim-4.94.2-2.el8.x86_64
freeipa: cn=users,cn=accounts,dc=example,dc=com , группа по которой нужно фильтровать почтовых пользователей mail
Конфиг exim:
# TLS/SSL
tls_advertise_hosts = *
tls_certificate = /etc/exim/ssl/example.crt
tls_privatekey = /etc/exim/ssl/example.key
daemon_smtp_ports = 25 : 465 : 587
tls_on_connect_ports = 465
smtp_receive_timeout = 60s
smtp_accept_max = 120
smtp_accept_max_per_host = 10
smtp_accept_max_per_connection = 100
smtp_accept_queue = 100
smtp_accept_queue_per_connection = 80
smtp_connect_backlog = 100
smtp_return_error_details = true
smtp_enforce_sync = true
####################
split_spool_directory = true
queue_run_max = 30
exim_user=exim
exim_group=mail
helo_allow_chars = _
auto_thaw = 1h
message_size_limit = 25M
check_spool_space = 256M
return_size_limit = 10k
# End some good preferences
ldap_default_servers = <; example1.ru:389 ; example2.ru:389
LDAP_AD_BINDDN = "uid=ldap_user,CN=Users,CN=accounts,DC=example,DC=ru"
LDAP_AD_PASS = **************
LDAP_AD_BASE_DN = "CN=Users,CN=accounts,DC=example,DC=ru"
LDAP_AD_MAIL_RCPT = \
user=LDAP_AD_BINDDN \
pass=LDAP_AD_PASS \
ldap:///DC=example,DC=ru?mail?sub?(&(|(objectClass=top)(objectClass=user)\
(objectClass=organizationalPerson)(objectClass=person))\
(mail=${quote_ldap:${local_part}@${domain}}))
######################################################################
# MAIN CONFIGURATION SETTINGS #
######################################################################
#smtp_banner = "$primary_hostname, ESMTP EXIM"
smtp_banner = "mx1.example.ru, ESMTP EXIM"
primary_hostname = mx1.example.ru
domainlist local_domains = lsearch;/etc/exim/localdomains
domainlist relay_to_domains = lsearch;/etc/exim/relaydomains
domainlist secure_domain = example.ru
hostlist relay_from_hosts = net-iplsearch;/etc/exim/relay_from_hosts
acl_smtp_helo = acl_check_helo
acl_smtp_rcpt = acl_check_rcpt
#acl_smtp_data = acl_check_data
acl_smtp_mime = acl_check_mime
# Listen only on loopback interface
local_interfaces = 0.0.0.0
qualify_domain = mx1.example.ru
allow_domain_literals = false
never_users = root
host_lookup = !+relay_from_hosts
rfc1413_hosts = *
rfc1413_query_timeout = 0s
#
sender_unqualified_hosts =
recipient_unqualified_hosts =
#
ignore_bounce_errors_after = 45m
timeout_frozen_after = 1d
system_filter = /etc/exim/filter/sys.filter
system_filter_file_transport = address_file
keep_environment = ^LDAP
add_environment = PATH=/usr/bin::/bin
######################################################################
# ACL CONFIGURATION #
######################################################################
begin acl
acl_check_helo:
accept hosts = +relay_from_hosts
drop condition = ${if match {$sender_helo_name}{\N^(\d+\.){3}\d+$\N}{yes}{no}}
message = "HELO/EHLO should not be the ip-address"
drop condition = ${if match {$sender_host_name}{adsl|dialup|peer|ppp|gprs|dhcp|dynamic-ip|ddns}{yes}{no}}
message = "Connection is not permited for you"
drop condition = ${if and{{def:sender_host_address}{!def:sender_host_name}}{yes}{no}}
message = "Reverse DNS lookup failed"
drop message = "Host in blacklist - $dnslist_domain \n $dnslist_text"
dnslists = cbl.abuseat.org : \
bl.spamcop.net
accept
acl_check_rcpt:
deny
message = [SPF] $sender_host_address is not allowed to send mail from $sender_address_domain
log_message = SPF check failed.
spf = fail
deny message = Restricted characters in address
domains = +local_domains
local_parts = ^[.] : ^.*['@%!=+/|]
deny message = Restricted characters in address
domains = !+local_domains
local_parts = ^[./|] : ^.*[@%!+='] : ^.*/\\.\\./
accept local_parts = postmaster
domains = +local_domains
accept hosts = +relay_from_hosts
require verify = sender
accept domains = +local_domains
require message = Authentication required, relay not permited.
authenticated = *
deny message = Relay not permited
accept
acl_check_mime:
# File extension filtering.
deny message = Blacklisted file extension detected
condition = ${if match \
{${lc:$mime_filename}} \
{\N(\.exe|\.pif|\.bat|\.scr|\.lnk|\.com)$\N} \
{1}{0}}
accept
######################################################################
# ROUTERS CONFIGURATION #
# Specifies how addresses are handled #
######################################################################
begin routers
dnslookup:
driver = dnslookup
domains = ! +local_domains
transport = remote_smtp
ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
no_more
adsi_check:
driver = redirect
domains = +local_domains
allow_fail
allow_defer
data = ${lookup ldap {LDAP_AD_MAIL_RCPT}\
{${local_part}@${domain}} {:fail: User unknown}}
redirect_router = local_adsi_user
local_adsi_user:
driver = accept
transport = local_ad_delivery
cannot_route_message = Unknown user
######################################################################
# TRANSPORTS CONFIGURATION #
######################################################################
begin transports
DKIM_DOMAIN = ${lookup{$sender_address_domain}lsearch*@{/etc/exim/domain_dkim}{$sender_address_domain}{}}
DKIM_PRIVATE_KEY = ${extract{key}{${lookup{$sender_address_domain}lsearch*@{/etc/exim/domain_dkim}}}{$value}{}}
DKIM_SELECTOR = ${extract{selector}{${lookup{$sender_address_domain}lsearch*@{/etc/exim/domain_dkim}}}{$value}{}}
DKIM_CANON = ${extract{canon}{${lookup{$sender_address_domain}lsearch*@{/etc/exim/domain_dkim}}}{$value}{relaxed}}
DKIM_STRICT = ${extract{strict}{${lookup{$sender_address_domain}lsearch*@{/etc/exim/domain_dkim}}}{$value}{false}}
remote_smtp:
driver = smtp
dkim_domain = DKIM_DOMAIN
dkim_selector = email
dkim_private_key = DKIM_PRIVATE_KEY
local_ad_delivery:
driver = appendfile
delivery_date_add
envelope_to_add
return_path_add
maildir_format
create_directory
directory = /var/spool/mail/$domain_data/$local_part_data
directory_mode = 0770
group = mail
user = mail
mode = 0640
no_mode_fail_narrower
address_pipe:
driver = pipe
return_output
address_file:
driver = appendfile
delivery_date_add
envelope_to_add
return_path_add
address_reply:
driver = autoreply
######################################################################
# RETRY CONFIGURATION #
######################################################################
begin retry
# Address or Domain Error Retries
# ----------------- ----- -------
* * F,2h,15m; G,16h,1h,1.5; F,4d,6h
######################################################################
# REWRITE CONFIGURATION #
######################################################################
begin rewrite
######################################################################
# AUTHENTICATION CONFIGURATION #
######################################################################
begin authenticators
######################################################################
# CONFIGURATION FOR local_scan() #
######################################################################
# begin local_scan
# End of Exim configuration file
