Hi Olaf,
I had a similar problem several years ago, but had to ensure TLS in and
TLS out to potentially hundreds of domains so implemented in in our mail
relay servers using a MySQL database:
CREATE TABLE `tls_force_remote_domains` (
`id` int(10) unsigned NOT NULL AUTO_INCREMENT,
`domain` varchar(100) NOT NULL,
`active` tinyint(1) unsigned NOT NULL DEFAULT 0,
`description` varchar(250) DEFAULT NULL,
PRIMARY KEY (`id`),
UNIQUE KEY `domain` (`domain`)
) ENGINE=InnoDB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8mb4
COLLATE=utf8mb4_general_ci COMMENT='Domains for which TLS must be used
for sending and receiving email'
and domain_lists:
TLS_FORCE_REMOTE_DOMAINS = SELECT domain FROM tls_force_remote_domains
WHERE active=1;
domainlist tls_force_remote_domains = ${lookup
mysql{TLS_FORCE_REMOTE_DOMAINS}{${sg{$value}{\\n}{ : }} }}
TLS_FORCE_LOCAL_DOMAINS = SELECT domain FROM domains WHERE active=1 AND
force_tls=1;
domainlist tls_force_local_domains = ${lookup
mysql{TLS_FORCE_LOCAL_DOMAINS}{${sg{$value}{\\n}{ : }} }}
I put this snippet at the bottom of acl_check_mail:
#
# TLS during MAIL command
#
#
# first, log the connection status
#
warn log_message = MAIL: TLS-STATUS Sender
domain=$sender_address_domain Host=$sender_fullhost using TLS
cipher=$tls_in_cipher
encrypted = *
warn log_message = MAIL: TLS-STATUS Sender
domain=$sender_address_domain Host=$sender_fullhost NOT using TLS
! encrypted = *
#
# second, log if a specific sender domain is in force TLS list
#
warn log_message = MAIL: TLS-REQUIRED Domain
$sender_address_domain requires a TLS connection
sender_domains = +tls_force_remote_domains
#
# next, accept all MAIL commands for which the connection is
encrypted with TLS
#
accept log_message = MAIL: TLS-ACCEPT encrypted session -
cipher=$tls_in_cipher
encrypted = *
#
# now, check for domains that must use TLS and might not be - in
# which case we should reject
#
deny log_message = MAIL: TLS-REJECT mail from domain
$sender_address_domain requires a TLS connection
message = TLS encryption required for mail from this domain
sender_domains = +tls_force_remote_domains
! encrypted = *
#
# finally, accept everything else without TLS
#
accept log_message = MAIL: NON-TLS-ACCEPT Accept unencrypted
email from: $sender_address host: $sender_fullhost
and made this my last-but-one router:
#
# if the destination domain is in the tls_force_remote_domains list then set
# the transport to remote_smtp_force_tls to force the selection of TLS
#
outbound_force_tls:
driver = dnslookup
domains = +tls_force_remote_domains
transport = remote_smtp_force_tls
before:
#
# if we fall through to here then we're not forcing TLS on a listed domain,
# so do a normal delivery for all non-local domains. This may still use TLS
# if advertised but its not forced.
#
outbound_lookup:
driver = dnslookup
domains = ! +local_domains
transport = remote_smtp
ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
no_more
and then this in my transports:
#
# This transport is used for delivering messages over SMTP connections
# where TLS is optional (not forced), so no hosts require TLS (but it may be
# negotiated if the far end advertises STARTTLS) and no cipher suite is
# specified.
#
remote_smtp:
driver = smtp
#
# This transport is used for delivering messages over SMTP connections
# where TLS is mandatory (forced) with high cipher strength. NB. this
# transport is selected based on the destination domain, so the hosts that
# at this point the host(s) that require TLS are 'any' (wildcard) because we
# don't care who we're talking to it must use TLS.
#
remote_smtp_force_tls:
driver = smtp
hosts_require_tls = *
hosts_try_fastopen = !*.l.google.com
tls_require_ciphers = HIGH:!SRP:!PSK:!SHA:@STRENGTH
My approach is a bit long-winded and not condensed as you ask, but it
lets me control forced TLS in either direction (if I want to) with only
a minor tweek and I don't case too much about what is under the hood as
I simply add or remove domains to/from the "tls_force_remote_domains"
MySQL table and Exim and this config takes care of it.
Mike
On 23/03/2023 15:30, Olaf Hopp (SCC) via Exim-users wrote:
> Hi,
> for legal reasons I have a list of domains, where I *must* send via TLS
> Currently, I have two routers and transports:
>
> router_A:
> domains: +domainlist-with-TLS-Domains
> transport: tlssmtp
> router_B:
> domains: *
> transport: smtp
>
> tlssmtp:
> hosts_require_tls = *
> driver = smtp
> smtp:
> driver smtp
>
>
> in reality two routers and transports are much more complicated but
> almost
> identical. The same is true for the transports.
>
> Is it somehow possible to consolidate this into one router and one
> transport
> and lets have in the transport "something like"
>
> domains_require_tls = +domainlist-with-TLS-Domains
>
> I now that this option does not exist, but is it possible to configure
> one router and one transport that act like that ?
>
> Regards, Olaf
>
>
--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
smime.p7s (5.65 KB)