RootForum Community

Code: Select all

2005-11-28 22:53:04 1Egqvm-0005ug-7d <= webmaster-vir@declude.com H=mail.fluns.com (www.declude.com) [63.246.13.85] P=smtp S=3017 id=4.3.2.7.0.20001102202253.00adb610@localhost.example.com T="Test eicar.com file [eicarencodedzip]"
2005-11-28 22:53:04 1Egqvm-0005ug-7d => /var/opt/vmail/XXXX.info/oliver/Maildir <oliver@XXXX.info> R=virtual_domains T=virtual_delivery
2005-11-28 22:53:04 1Egqvm-0005ug-7d Completed

Code: Select all

2005-11-28 20:05:01 H=cph254.neoplus.adsl.tpnet.pl (142528648) [83.31.213.254] rejected EHLO or HELO 142528648: "Dropped IP-only or IP-starting helo"
2005-11-28 20:05:39 H=p5485fedc.dip.t-dialin.net (146051280) [84.133.254.220] rejected EHLO or HELO 146051280: "Dropped IP-only or IP-starting helo"
2005-11-28 20:06:13 H=cm-85-152-224-117.telecable.es (144202488) [85.152.224.117] rejected EHLO or HELO 144202488: "Dropped IP-only or IP-starting helo"
2005-11-28 20:06:42 H=(146606752) [82.2.34.177] rejected EHLO or HELO 146606752: "Dropped IP-only or IP-starting helo"
2005-11-28 20:07:07 H=(146606752) [83.237.133.103] rejected EHLO or HELO 146606752: "Dropped IP-only or IP-starting helo"
2005-11-28 20:07:13 H=24-107-138-114.dhcp.stls.mo.charter.com (144151776) [24.107.138.114] rejected EHLO or HELO 144151776: "Dropped IP-only or IP-starting helo"
2005-11-28 20:41:16 H=sev93-3-82-237-27-79.fbx.proxad.net [82.237.27.79] F=<IQIPDJBKPJ@technistone.com> rejected RCPT <oliver@XXXX.info>: DNSBL listed at sbl-xbl.spamhaus.org

Code: Select all

# You should not change that setting until you understand how ACLs work.

# The following ACL entry is used if you want to do content scanning with the
# exiscan-acl patch. When you uncomment this line, you must also review the
# acl_check_content entry in the ACL section further below.

acl_smtp_data = acl_check_content

# This ACL added by Avleen Vig will drop all mail where the sender's helo
# command contains your IP address. Please check the IP address at the top
# for the configure file to make it your own.

acl_smtp_helo = acl_check_helo

# This configuration variable defines the virus scanner that is used with
# the 'malware' ACL condition of the exiscan acl-patch. If you do not use
# virus scanning, leave it commented. Please read doc/exiscan-acl-readme.txt
# for a list of supported scanners.

av_scanner = clamd:/var/run/clamav/clamd.ctl

# The following setting is only needed if you use the 'spam' ACL condition
# of the exiscan-acl patch. It specifies on which host and port the SpamAssassin
# "spamd" daemon is listening. If you do not use this condition, or you use
# the default of "127.0.0.1 783", you can omit this option.

spamd_address = 127.0.0.1 783

Code: Select all

  deny  senders = :
        hosts   = !+relay_from_hosts
        !acl    = spf_from_acl
        message = Your sender is not permitted (read spf.pobox.com)

  # First unpack MIME containers and reject serious errors.
  deny  message = This message contains a MIME error ($demime_reason)
        demime = *
        condition = ${if >{$demime_errorlevel}{2}{1}{0}}
        
  # Reject typically wormish file extensions. There is almost no
  # sense in sending such files by email.
  deny  message = This message contains an unwanted file extension ($found_extension)
        demime = bat:btm:cmd:com:cpl:dll:exe:lnl:msi:pif:prf:reg:scr:vbs:url
  
  # Reject virus infested messages.
  deny  message = This message contains malware ($malware_name)
        demime = *
	malware = *
        log_message = This message contains malware ($malware_name)

  # Reject messages containing "viagra" in all kinds of whitespace/case combinations
  # WARNING: this is an example !
  # deny  message = This message matches a blacklisted regular expression ($regex_match_string)
  #      regex = [Vv] *[Ii] *[Aa] *[Gg] *[Rr] *[Aa]

  # Always add X-Spam-Score and X-Spam-Report headers, using SA system-wide settings
  # (user "nobody"), no matter if over threshold or not.
  
  warn  message = X-Spam-Score: $spam_score ($spam_bar)
        hosts = !+relay_from_hosts
        condition = ${if <{$message_size}{550k}{1}{0}}
        spam = vmail:true
  warn  message = X-Spam-Report: $spam_report
        condition = ${if <{$message_size}{550k}{1}{0}}
        spam = vmail:true

  warn  message = X-Spam-Bar: $spam_bar
        spam = vmail:true

        #tag the message as spam as per user settings..
	 warn  message = X-New-Subject: ***SPAM($spam_score)*** $h_subject
	         spam = spam
		      condition = ${if >{$spam_score_int}{${lookup mysql
		                {select users.sa_tag *10 from users,domains 
		                where localpart = '${quote_mysql:$local_part}' 
		                and domain = '${quote_mysql:$domain}' 
		                and users.on_spamassassin = '1' 
		                and users.domain_id=domains.domain_id 
		                and users.sa_tag > 0 }{$value}fail}} {yes}{no}}
															





  # This code was derived from a post to exim-users by Alan J. Flavell:
  # http://www.exim.org/pipermail/exim-users/Week-of-Mon-20031201/063095.html
  deny  hosts           = emi.mail.pas.earthlink.net
        message         = X-PH-FW: leaky forwarder, $dnslist_domain=$dnslist_value
                          set acl_m4 = ${if match {$h_received:}
                                {N[(d+).(d+).(d+).(d+)])s+.*by 
                                emi.mail.pas.earthlink.netN}
                                {$4.$3.$2.$1}fail}
        dnslists        = sbl-xbl.spamhaus.org:list.dsbl.org:dynablock.njabl.org/$acl_m4

  deny  hosts           = emi.mail.pas.earthlink.net
        message         = Please use your FQDN for HELO
        condition       = ${if match {$h_received:}{Nhelo=d+.d+.d+.d+N}{yes}{no} }