Mailing List Archive

On Wed, Oct 04, 2023 at 02:11:27PM +0200, Mario Emmenlauer via Exim-users wrote:
> I wanted sender verification only for non-authenticated users. The
> spam protection is (for me) not relevant for authenticated users.
> They are assumed to be trustworthy.

What's the problem to add conditions like "authenticated = *" to your ACLs?
--
Eugene Berdnikov

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On Wed, Oct 04, 2023 at 02:11:27PM +0200, Mario Emmenlauer via Exim-users wrote:

> Also, I'd like to have unique mailnames for each desktop, like
> <hostname>.mydomain.org, to better identify where the mail originated
> from. But these domains do not really exist, they would be "fake"
> mailnames to identify the various desktop computers.
>
> Now, the server rejects all such emails because sender verification
> failed.

A plausible work-around would be the equivalent of that described for
null-client configurations in:

http://www.postfix.org/MULTI_INSTANCE_README.html#quick

/etc/postfix/generic:
# The smarthost supports "+" addressing (recipient_delimiter = +).
# Mail from "root" exposes the origin host, without replies
# and bounces going back to the same host.
#
# On clustered MTAs this file is typically machine-built from
# a template file. The build process expands the template into
# "mtaadmin+root=mta1"
#
root mtaadmin+root=mta1

but you could do this for all users, instead of just "root". Tagging
the mail origin, without using a fake domain. Or perhaps (somewhat
likely) it is only "root" and the like that you need this for, with mail
from interactive users not needing any explicit tagging with the source
host...

--
Viktor.

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On 04.10.23 15:05, Evgeniy Berdnikov via Exim-users wrote:
> On Wed, Oct 04, 2023 at 02:11:27PM +0200, Mario Emmenlauer via Exim-users wrote:
>> I wanted sender verification only for non-authenticated users. The
>> spam protection is (for me) not relevant for authenticated users.
>> They are assumed to be trustworthy.
>
> What's the problem to add conditions like "authenticated = *" to your ACLs?

Oh my, I can not believe it's that simple! I spent 4 hours on google and could
not find related examples.

So to confirm, the ACL that verifies only non-authenticated users would read:

deny
!acl = acl_local_deny_exceptions
!verify = sender
authenticated = *
message = Sender verification failed


All the best,

Mario Emmenlauer


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On 04.10.23 15:59, Mario Emmenlauer wrote:
> On 04.10.23 15:05, Evgeniy Berdnikov via Exim-users wrote:
>> On Wed, Oct 04, 2023 at 02:11:27PM +0200, Mario Emmenlauer via Exim-users wrote:
>>> I wanted sender verification only for non-authenticated users. The
>>> spam protection is (for me) not relevant for authenticated users.
>>> They are assumed to be trustworthy.
>>
>>   What's the problem to add conditions like "authenticated = *" to your ACLs?
>
> Oh my, I can not believe it's that simple! I spent 4 hours on google and could
> not find related examples.
>
> So to confirm, the ACL that verifies only non-authenticated users would read:
>
>   deny
>     !acl = acl_local_deny_exceptions
>     !verify = sender
>     authenticated = *
>     message = Sender verification failed

I think I misunderstood. Is the correct ACL the following? Does that still perform
sender verification on non-authenticated users?

accept
authenticated = *

deny
!acl = acl_local_deny_exceptions
!verify = sender
message = Sender verification failed

All the best,

Mario


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

> Now I would like to configure this server as a smarthost, so it will
> forward emails from my desktop computers (without static IP or DNS).
> Also, I'd like to have unique mailnames for each desktop, like
> <hostname>.mydomain.org, to better identify where the mail originated
> from. But these domains do not really exist, they would be "fake"
> mailnames to identify the various desktop computers.
[...]
> I'm not sure if what I'm trying is possible and sensible. Am I
> completely on the wrong track here? Are there a better way to
> achieve something similar?

I think there's a problem with your plan, unless I'm missing something.

If these non-existent unique mail names for your desktop computers
appear in either the envelope sender address (the SMTP MAIL FROM) or
the From: header, this is not a good idea by itself because if you
leak these email addresses out into the outside world, the email will
either be rejected (for an envelope sender) or unreplyable (for a From:
header). Here, your existing sender verification is telling you that
you're trying to send email with addresses that don't work.

To fix this, you'd need to either make the names exist in DNS (even if
only as MX entries that direct email to mydomain.org's regular mail
server) or to change your server's Exim configuration so that it
rewrites all of these email addresses in the envelope sender and the
address headers. At that point, the only place they'd appear is in the
Received: header, and if they're only going to appear in the Received:
header my view is that you might as well not bother.

- cks

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On Wed, Oct 04, 2023 at 03:59:23PM +0200, Mario Emmenlauer wrote:
> So to confirm, the ACL that verifies only non-authenticated users would read:
>
> deny
> !acl = acl_local_deny_exceptions
> !verify = sender
> authenticated = *
> message = Sender verification failed

You should revert condition, i.e. write "!authenticated = *".
And better to put it before "!verify = sender".

Additional question is what you expect from this sender verification.
If you don't care, it looks like magic, but this magic could suddenly
become contrary to your expectations. In particular, this condition
"verify=sender" only checks whether sender's address is routable,
so it protect from formally invalid addresses (with invalid syntax
or non-existent domains). This is very weak condition for internet.
I propose to study "/callout" and other options in docs (ch.46).
--
Eugene Berdnikov

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On 04.10.23 16:34, Chris Siebenmann wrote:
>> Now I would like to configure this server as a smarthost, so it will
>> forward emails from my desktop computers (without static IP or DNS).
>> Also, I'd like to have unique mailnames for each desktop, like
>> <hostname>.mydomain.org, to better identify where the mail originated
>> from. But these domains do not really exist, they would be "fake"
>> mailnames to identify the various desktop computers.
> [...]
>> I'm not sure if what I'm trying is possible and sensible. Am I
>> completely on the wrong track here? Are there a better way to
>> achieve something similar?
>
> I think there's a problem with your plan, unless I'm missing something.
>
> If these non-existent unique mail names for your desktop computers
> appear in either the envelope sender address (the SMTP MAIL FROM) or
> the From: header, this is not a good idea by itself because if you
> leak these email addresses out into the outside world, the email will
> either be rejected (for an envelope sender) or unreplyable (for a From:
> header). Here, your existing sender verification is telling you that
> you're trying to send email with addresses that don't work.
>
> To fix this, you'd need to either make the names exist in DNS (even if
> only as MX entries that direct email to mydomain.org's regular mail
> server) or to change your server's Exim configuration so that it
> rewrites all of these email addresses in the envelope sender and the
> address headers. At that point, the only place they'd appear is in the
> Received: header, and if they're only going to appear in the Received:
> header my view is that you might as well not bother.

This is a very interesting and valid point! I could actually quite
easily create MX entries for the host's subdomains on mydomain.org,
so that MX <hostname>.mydomain.org points to mydomain.org.

But does that mean that in turn, each of these subdomains would need
to be added as a local domain in exim on mydomain.org? Are there any
downsides with that? It seems a bit wrong that mydomain.org has local
domains <hostname>.mydomain.org, but that is just my gut feeling, and
I may be wrong here?

All the best,

Mario

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

> This is a very interesting and valid point! I could actually quite
> easily create MX entries for the host's subdomains on mydomain.org,
> so that MX <hostname>.mydomain.org points to mydomain.org.
>
> But does that mean that in turn, each of these subdomains would need
> to be added as a local domain in exim on mydomain.org? Are there any
> downsides with that? It seems a bit wrong that mydomain.org has local
> domains <hostname>.mydomain.org, but that is just my gut feeling, and
> I may be wrong here?

It's a common configuration for there to be (email) subdomains within a
domain, and also for those subdomains to be handled by the same mail
server (or at least the same MX entry, which is all that the outside
world can tell about the situation).

(We use Exim here and currently our mail server has 144 additional
names on top of its primary name. And notice how common 'local_domains'
(pluralized) is in Exim configurations.)

- cks

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On Wed, 4 Oct 2023, Mario Emmenlauer via Exim-users wrote:

>
> I have a dedicated server running exim. It works great, except I
> can not get a smarthost setup to work in combination with sender
> verification.
>
> On the server, I have sender verification enabled, as a means to
> reduce spam. It generally works well. The ACLs are just the ones
> from Debian/Ubuntu:
>
> /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt:
> deny
> !acl = acl_local_deny_exceptions
> !verify = sender
> message = Sender verification failed
>
> /etc/exim4/conf.d/acl/40_exim4-config_check_data:
> deny
> !acl = acl_local_deny_exceptions
> !verify = header_sender
> message = No verifiable sender address in message headers
>
>
> Now I would like to configure this server as a smarthost, so it will
> forward emails from my desktop computers (without static IP or DNS).
> Also, I'd like to have unique mailnames for each desktop, like
> <hostname>.mydomain.org, to better identify where the mail originated
> from. But these domains do not really exist, they would be "fake"
> mailnames to identify the various desktop computers.
>
> Now, the server rejects all such emails because sender verification
> failed. I can see that this is sensible. But it is not what I want.
> I wanted sender verification only for non-authenticated users. The
> spam protection is (for me) not relevant for authenticated users.
> They are assumed to be trustworthy.
>
> I'm not sure if what I'm trying is possible and sensible. Am I
> completely on the wrong track here? Are there a better way to
> achieve something similar?

I don't really understand what you are trying to do with
sender verify here and I agree with others that you do not
want to put the desktop's name into the email address.

*If* the desktops can support RFC1413, setting the
rfc1413_hosts
option to include them would be worth considering.
This would allow the smarthost to record (header and/or logfile IIRC)
the hostname *and user* that originated the email.
I have not used this for a long time, but IIRC you could force
the sender address to match the rfc1413 user response.

Windows does not natively support RFC1413. Worse, I think that there
s nothing to stop an ordinary windows user from running a spoofing
rfc1413 service.

--
Andrew C. Aitchison Kendal, UK
andrew@aitchison.me.uk

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On Wed, Oct 04, 2023 at 12:49:29PM -0400, Chris Siebenmann via Exim-users wrote:

> > But does that mean that in turn, each of these subdomains would need
> > to be added as a local domain in exim on mydomain.org? Are there any
> > downsides with that? It seems a bit wrong that mydomain.org has local
> > domains <hostname>.mydomain.org, but that is just my gut feeling, and
> > I may be wrong here?
>
> It's a common configuration for there to be (email) subdomains within a
> domain, and also for those subdomains to be handled by the same mail
> server (or at least the same MX entry, which is all that the outside
> world can tell about the situation).
>

Sure, one can expose every internal host as a reachable email subdomain,
optionally equivalent to the main domain, but this is not a good idea.

Email addresses persist in mailboxes for years or even decades, and
sometimes even very dated messages elicit legitimate responses.
Exposing internal namespace structure rather gets in the way of keeping
email addresses valid for the long-term.

Rather than leak user@<somehost>.domain forms out to the public
Internet, explain and solve the real problem that not masquerading
all users behind the primary domain is supposed to solve???

--
Viktor.


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On 04.10.23 19:22, Viktor Dukhovni via Exim-users wrote:
> On Wed, Oct 04, 2023 at 12:49:29PM -0400, Chris Siebenmann via Exim-users wrote:
>
> Sure, one can expose every internal host as a reachable email subdomain,
> optionally equivalent to the main domain, but this is not a good idea.
>
> Email addresses persist in mailboxes for years or even decades, and
> sometimes even very dated messages elicit legitimate responses.
> Exposing internal namespace structure rather gets in the way of keeping
> email addresses valid for the long-term.
>
> Rather than leak user@<somehost>.domain forms out to the public
> Internet, explain and solve the real problem that not masquerading
> all users behind the primary domain is supposed to solve???

I'm sorry, I should have better motivated my goal!

So for me, the exim email system on the desktop computers is exclusively used
by the Linux operating system. I do not enable incoming email, so all mails are
generated by the various services that come with Linux. Some of these services
are operated intentionally by me, like logcheck and monit. But some are just
basic system services that tend to report relevant information via email, often
to root.

Now most of these emails are not of very high priority to me. But it seems good
to collect them somewhere to stay in the loop. Therefore I'd like to collect
basically all system email of basically all desktop computers in a single email
account on my main server.

Since this is auto-generated system mail, there is absolutely no chance that I
would want to reply to such email, now or in the future.

I do not necessarily need the From or To parts of the email to reflect the
hostname where the mail was generated. But it is a nice feature and helps to
sort and filter the mail.

With the suggestions on this list I now got all of this working! But I would
happily learn about better ways to achieve this?

All the best,

Mario

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On 04/10/2023 17:49, Chris Siebenmann via Exim-users wrote:
> And notice how common 'local_domains'
> (pluralized) is in Exim configurations.

The word is only meaningful in the context of the Exim configuration.

It's commonly used as a domain-list, sure. And used in a specific way.

But this is the choice of the config file. There is nothing special
about the letter-sequence being used.

--
Cheers,
Jeremy


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On Wed, Oct 04, 2023 at 09:36:12PM +0200, Mario Emmenlauer wrote:

> > Rather than leak user@<somehost>.domain forms out to the public
> > Internet, explain and solve the real problem that not masquerading
> > all users behind the primary domain is supposed to solve???
>
> So for me, the exim email system on the desktop computers is exclusively used
> by the Linux operating system. I do not enable incoming email, so all mails are
> generated by the various services that come with Linux. Some of these services
> are operated intentionally by me, like logcheck and monit. But some are just
> basic system services that tend to report relevant information via email, often
> to root.

As I suspected, you're sensibly trying to be able to tell at a glance
which machine a message is from. This use-case is the main purpose of
the address rewritng proposed in the Postfix null-client guide in the
MULTI_INSTANCE doc.

I am sure confident very similar can be done in Exim. Just rewrite
on each host (From headers):

# Replace "admin" with any suitable name of your choice.
# Replace "hostname" with the actual name of each machine.
root -> admin+root=hostname@domain.example
bin -> admin+bin=hostname@domain.example
...

Any bounces will end up in "admin"'s mailbox on the smarthost.
You'll be able to tell where the message came from by looking
at the From address.

--
Viktor.

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

> > So for me, the exim email system on the desktop computers is
> > exclusively used by the Linux operating system. I do not enable
> > incoming email, so all mails are generated by the various services
> > that come with Linux. Some of these services are operated
> > intentionally by me, like logcheck and monit. But some are just
> > basic system services that tend to report relevant information via
> > email, often to root.
>
> As I suspected, you're sensibly trying to be able to tell at a glance
> which machine a message is from. This use-case is the main purpose of
> the address rewritng proposed in the Postfix null-client guide in the
> MULTI_INSTANCE doc.

Another, much more brute force way (if you don't have a common
/etc/passwd file that's somehow distributed around) is to change the
/etc/passwd GECOS field for relevant accounts to have the machine's name
in it. This assumes you have a limited number of such accounts and that
your machine names are fixed (you don't rename them around), but it's
very light-weight and easy.

We do this (for root) with:
chfn -f "$(hostname) root" root

It wouldn't be hard to do this for a list of system logins, especially
if you didn't care greatly about duplicating their current GECOS values.

This has been quite handy to tell at a glance what important system is
sending us root email for some reason, without having to look at the
Received: headers or hope that whatever generated the email put the
hostname in the Subject:.

(This is less cool than address rewriting and other tricks, though.)

- cks

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On Wed, Oct 04, 2023 at 07:59:21PM -0400, Chris Siebenmann via Exim-users wrote:
> Another, much more brute force way (if you don't have a common
> /etc/passwd file that's somehow distributed around) is to change the
> /etc/passwd GECOS field for relevant accounts to have the machine's name
> in it.

MUAs usually insert GECOS to mail headers, but many system daemons do not.
--
Eugene Berdnikov

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On Wed, Oct 04, 2023 at 09:36:12PM +0200, Mario Emmenlauer via Exim-users wrote:
> Since this is auto-generated system mail, there is absolutely no chance that I
> would want to reply to such email, now or in the future.

Right way is to make ALL sender's addresses routable, even for
automatically generated mails, and redirect possible bounces
to admin's mailbox. If you don't do it, you can miss important
emergency notifications, which are often reflected by problems
with e-mail delivery.
--
Eugene Berdnikov

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On 05.10.23 01:37, Viktor Dukhovni via Exim-users wrote:
> On Wed, Oct 04, 2023 at 09:36:12PM +0200, Mario Emmenlauer wrote:
>
>>> Rather than leak user@<somehost>.domain forms out to the public
>>> Internet, explain and solve the real problem that not masquerading
>>> all users behind the primary domain is supposed to solve???
>>
>> So for me, the exim email system on the desktop computers is exclusively used
>> by the Linux operating system. I do not enable incoming email, so all mails are
>> generated by the various services that come with Linux. Some of these services
>> are operated intentionally by me, like logcheck and monit. But some are just
>> basic system services that tend to report relevant information via email, often
>> to root.
>
> As I suspected, you're sensibly trying to be able to tell at a glance
> which machine a message is from. This use-case is the main purpose of
> the address rewritng proposed in the Postfix null-client guide in the
> MULTI_INSTANCE doc.
>
> I am sure confident very similar can be done in Exim. Just rewrite
> on each host (From headers):
>
> # Replace "admin" with any suitable name of your choice.
> # Replace "hostname" with the actual name of each machine.
> root -> admin+root=hostname@domain.example
> bin -> admin+bin=hostname@domain.example
> ...
>
> Any bounces will end up in "admin"'s mailbox on the smarthost.
> You'll be able to tell where the message came from by looking
> at the From address.

This sounds very interesting, I'll give it a try! Thanks for the very nice
suggestion!

All the best,

Mario

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On 05.10.23 01:59, Chris Siebenmann via Exim-users wrote:
>>> So for me, the exim email system on the desktop computers is
>>> exclusively used by the Linux operating system. I do not enable
>>> incoming email, so all mails are generated by the various services
>>> that come with Linux. Some of these services are operated
>>> intentionally by me, like logcheck and monit. But some are just
>>> basic system services that tend to report relevant information via
>>> email, often to root.
>>
>> As I suspected, you're sensibly trying to be able to tell at a glance
>> which machine a message is from. This use-case is the main purpose of
>> the address rewritng proposed in the Postfix null-client guide in the
>> MULTI_INSTANCE doc.
>
> Another, much more brute force way (if you don't have a common
> /etc/passwd file that's somehow distributed around) is to change the
> /etc/passwd GECOS field for relevant accounts to have the machine's name
> in it. This assumes you have a limited number of such accounts and that
> your machine names are fixed (you don't rename them around), but it's
> very light-weight and easy.
>
> We do this (for root) with:
> chfn -f "$(hostname) root" root
>
> It wouldn't be hard to do this for a list of system logins, especially
> if you didn't care greatly about duplicating their current GECOS values.
>
> This has been quite handy to tell at a glance what important system is
> sending us root email for some reason, without having to look at the
> Received: headers or hope that whatever generated the email put the
> hostname in the Subject:.

This is actually also a pretty nice idea, I will also test that. We have
quite a limited number of users so it should not be too hard to test.
Thanks for the suggestion!

All the best,

Mario

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On 05.10.23 11:14, Evgeniy Berdnikov via Exim-users wrote:
> On Wed, Oct 04, 2023 at 09:36:12PM +0200, Mario Emmenlauer via Exim-users wrote:
>> Since this is auto-generated system mail, there is absolutely no chance that I
>> would want to reply to such email, now or in the future.
>
> Right way is to make ALL sender's addresses routable, even for
> automatically generated mails, and redirect possible bounces
> to admin's mailbox. If you don't do it, you can miss important
> emergency notifications, which are often reflected by problems
> with e-mail delivery.

Yes, this is something I did not really consider :( But after the
suggestions here on the list I can value this. I'll go for an approach
that keeps the addresses routable. Thanks for pointing that out!

All the best,

Mario

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

D?a 5. októbra 2023 13:29:46 UTC používate? Mario Emmenlauer via Exim-users <exim-users@lists.exim.org> napísal:

>Yes, this is something I did not really consider :( But after the
>suggestions here on the list I can value this. I'll go for an approach
>that keeps the addresses routable. Thanks for pointing that out!

I use dnsmasq for my LANs, it acts as DNS + DHCP (and in some
+ TFTP, but that is unrelated). The dnsmasq can serve MX record
for all its entries (hosts registered either via DHCP or from
/etc/hosts or eqivalent files) and assign static MX records. The
some hosts are running own MTA (for various reasons), these has
its own MX record in dnsmasq, thus overrides autogenerated one.

I use custom TLD, but i will not suggest that (it is historical, from
time when TLD list was limited). Use either dedicated subdomain
of own domain or use home.arpa.

All my hosts are managed under that DNS zone, and all have MX
pointed to dedicated MTA. That dedicated MTA handles host's
FQDN as wildcard domain, and all these addresses are redirected
(delivered) to dedicated (admin) mailbox without address rewriting.
(in some LANs i even encrypt them and resend via public mail, but
that is another story)

These hosts are not assumed to regulary get emails, but in case
of bounce, it is delivered to admin, thus noticed. As the host's
names are part of sender (and From:) domain, here is no problem
to know from which host it comes. But hostname in subject is
better, as some MUAs shows sender address by too small
font.

Do not rewrite sender allow me to sort emails by sender on
IMAP server, but i usually prefer to sort them by subject.

Do not rely on that only services can send emails, especially
on desktops. Anyone can use exim via stdin (or eg. mailx) to
send mails, thus make sure to restrict it in nonSMTP ACL.

regards


--
Slavko
https://www.slavino.sk/

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On 2023-10-04, Mario Emmenlauer via Exim-users <exim-users@lists.exim.org> wrote:
> On 04.10.23 16:34, Chris Siebenmann wrote:
>>> Now I would like to configure this server as a smarthost, so it will
>>> forward emails from my desktop computers (without static IP or DNS).
>>> Also, I'd like to have unique mailnames for each desktop, like
>>> <hostname>.mydomain.org, to better identify where the mail originated
>>> from. But these domains do not really exist, they would be "fake"
>>> mailnames to identify the various desktop computers.
>> [...]
>>> I'm not sure if what I'm trying is possible and sensible. Am I
>>> completely on the wrong track here? Are there a better way to
>>> achieve something similar?
>>
>> I think there's a problem with your plan, unless I'm missing something.
>>
>> If these non-existent unique mail names for your desktop computers
>> appear in either the envelope sender address (the SMTP MAIL FROM) or
>> the From: header, this is not a good idea by itself because if you
>> leak these email addresses out into the outside world, the email will
>> either be rejected (for an envelope sender) or unreplyable (for a From:
>> header). Here, your existing sender verification is telling you that
>> you're trying to send email with addresses that don't work.
>>
>> To fix this, you'd need to either make the names exist in DNS (even if
>> only as MX entries that direct email to mydomain.org's regular mail
>> server) or to change your server's Exim configuration so that it
>> rewrites all of these email addresses in the envelope sender and the
>> address headers. At that point, the only place they'd appear is in the
>> Received: header, and if they're only going to appear in the Received:
>> header my view is that you might as well not bother.
>
> This is a very interesting and valid point! I could actually quite
> easily create MX entries for the host's subdomains on mydomain.org,
> so that MX <hostname>.mydomain.org points to mydomain.org.
>
> But does that mean that in turn, each of these subdomains would need
> to be added as a local domain in exim on mydomain.org?

That would be one solutions, but local domains does not need to be a static
list: you could do a dnsdb lookup for instance

assuming you are example.com, something like this perhaps.

local_doamins = example.com : ${lookup dnsdb{MX=$domain}{${if eq{$value}{42 example.com}{$domain}}}}

which would require their host's doman name to have a single
"42 example.com" MX record and would use the DNS to confirm their existance.

You may wish to add further checks (eg: check that they are a subdomain of you)

> Are there any downsides with that? It seems a bit wrong that mydomain.org
> has local domains <hostname>.mydomain.org, but that is just my gut feeling,
> and I may be wrong here?

Some people like to keep their hostnames secret as part of defense in
depth.

Domainlist local_domains is part of the default exim configuration.
it doesn't actually do anything to exim's behaviour by itself, it only
has effect where local_domains is used in other parts of the
confoguration.

--
Jasen.
???????? ????? ???????

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/