Previous Next Contents (Exim 4.40 Specification)

38. Access control lists

Access Control Lists (ACLs) are defined in a separate section of the run time configuration file, headed by “begin acl”. Each ACL definition starts with a name, terminated by a colon. Here is a complete ACL section which contains just one very small ACL:

  begin acl
  
  small_acl:
    accept   hosts = one.host.only

You can have as many lists as you like in the ACL section, and the order in which they appear does not matter. The lists are self-terminating.

The majority of ACLs are used to control Exim's behaviour when it receives certain SMTP commands. This applies both to incoming TCP/IP connections, and when a local process submits a message over a pipe (using the -bs option). The most common use is for controlling which recipients are accepted in incoming messages. In addition, you can also define an ACL that is used to check local non-SMTP messages. The default configuration file contains an example of a realistic ACL for checking RCPT commands. This is discussed in chapter 7.

38.1. Testing ACLs

The -bh command line option provides a way of testing your ACL configuration locally by running a fake SMTP session with which you interact. The host relay-test.mail-abuse.org provides a service for checking your relaying configuration (see section 38.27 for more details).

38.2. Specifying when ACLs are used

In order to cause an ACL to be used, you have to name it in one of the relevant options in the main part of the configuration. These options are:

  acl_not_smtp   ACL for non-SMTP messages

  acl_smtp_auth   ACL for AUTH

  acl_smtp_connect   ACL for start of SMTP connection

  acl_smtp_data   ACL after DATA

  acl_smtp_etrn   ACL for ETRN

  acl_smtp_expn   ACL for EXPN

  acl_smtp_helo   ACL for HELO or EHLO

  acl_smtp_mail   ACL for MAIL

  acl_smtp_mailauth   ACL for the AUTH parameter of MAIL

  acl_smtp_rcpt   ACL for RCPT

  acl_smtp_starttls   ACL for STARTTLS

  acl_smtp_vrfy   ACL for VRFY

For example, if you set

  acl_smtp_rcpt = small_acl

the little ACL defined above is used whenever Exim receives a RCPT command in an SMTP dialogue. The majority of policy tests on incoming messages can be done when RCPT commands arrive. A rejection of RCPT should cause the sending MTA to give up on the recipient address contained in the Exim 4.40 Specification Concepts

Concepts

A B C D E F G H I J K L M N O P Q R S T U V W X Z “

The Exim FAQ

This is the FAQ for the Exim Mail Transfer Agent. Many thanks to the many people who provided the original information. This file would be amazingly cluttered if I tried to list them all. Suggestions for corrections, improvements, and additions are always welcome.

This version of the FAQ applies to Exim 4.43 and later releases.

References of the form Cnnn, Fnnn, Lnnn, and Snnn are to the sample configuration, filter, local_scan(), and “useful script” files. These are hyperlinked from the HTML version of this FAQ. They can also be found in the separately distributed directory called config.samples. The primary location is

ftp://ftp.csx.cam.ac.uk/pub/software/email/exim/exim4/config.samples.tar.gz ftp://ftp.csx.cam.ac.uk/pub/software/email/exim/exim4/config.samples.tar.bz2

There are brief descriptions of these files at the end of this document.

Philip Hazel
Last update: 14-October-2004

Index

A Keyword-in-context index to the questions is available. This is usually the quickest way to find information in the FAQ.

The FAQ is divided into the following sections:

	0. General debugging	15. UUCP
	1. Building and installing	16. Modifying message bodies
	2. Routing in general	17. Encryption (TLS/SSL)
	3. Routing to remote hosts	20. Millennium
	4. Routing for local delivery	50. Miscellaneous
	5. Filtering	91. Mac OS X
	6. Delivery	92. Freebsd
	7. Policy controls	93. HP-UX
	8. Rewriting addresses	94. BSDI
	9. Headers	95. IRIX
	10. Performance	96. Linux
	11. Majordomo	97. Sun systems
	12. Fetchmail	98. Configuration cookbook
	13. Perl	99. List of sample configurations
	14. Dial-up and ISDN

List of questions

0. GENERAL DEBUGGING

Q0001: Exim is crashing. What is wrong?
Q0002: Exim is not working. What is wrong? How can I check what it is doing?
Q0003: What does the error Child process of address_pipe transport returned 127 from command xxx mean?
Q0004: My virtual domain setup isn't working. How can I debug it?
Q0005: Why is Exim not rejecting incoming messages addressed to non-existent users at SMTP time?
Q0006: I've put an entry for *.my.domain in a DBM lookup file, but it isn't getting recognized.
Q0007: I've put the entry *@domain.com in a lookup database, but it isn't working. The expansion I'm using is:
Q0008: If I run ./exim -d -bt user@domain all seems well, but when I send a message from my User Agent, it does not arrive at its destination.
Q0009: What does no immediate delivery: too many messages received in one SMTP connection mean?
Q0010: Exim puts for <address> in the Received: headers of some, but not all, messages. Is this a bug?
Q0011: Instead of exim_dbmbuild, I'm using a homegrown program to build DBM (or cdb) files, but Exim doesn't seem to be able to use them.
Q0012: Exim is unable to route to any remote domains. It doesn't seen to be able to access the DNS.
Q0013: What does the error message transport system_aliases: cannot find transport driver "redirect" in line 92 mean?
Q0014: Exim is timing out after receiving and responding to the DATA command from one particular host, and yet the client host also claims to be timing out. This seems to affect only certain messages.
Q0015: What does the message Socket bind() to port 25 for address (any) failed: address already in use mean?
Q0016: I've set verify = header_syntax in my ACL, but this causes Exim to complain about header lines like To: Work: Jim <jims@email>, Home: Bob <bobs@email> which look all right to me. Is this a bug?
Q0017: Whenever Exim tries to deliver a specific message to a particular server, it fails, giving the error Remote end closed connection after data or Broken pipe or a timeout. What's going on?
Q0018: Why do messages not get delivered down the same connection when I do something like: exim -v -R @aol.com? For other domains, I do this and I see the appropriate waiting for passed connections to get used messages.
Q0019: There seems to be a problem in the string expansion code: it doesn't recognize references to headers such as ${h_to}.
Q0020: Why do connections to my machine's SMTP port take a long time to respond with the banner, when connections to other ports respond instantly? The delay is sometimes as long as 30 seconds.
Q0021: What does failed to create child process to send failure message mean? This is a busy mail server with smtp_accept_max set to 500, but this problem started to occur at about 300 incoming connections.
Q0022: What does No transport set by system filter in a log line mean?
Q0023: Why is Exim refusing to relay, saying failed to find host name from IP address when I have the sender's IP address in an ACL condition? My configuration contains this ACL statement:
Q0024: When I run exim -bd -q10m I get PANIC LOG: exec of exim -q failed.
Q0025: I can't seem to get a pipe command to run when I include a ${if expansion in it. This fails:
Q0026: I'm trying to get Exim to connect an alias to a pipe, but it always gives error code 127, with the comment (could mean unable to exec or command does not exist).
Q0027: What does the error Spool file is locked mean?
Q0028: Exim is reporting IP addresses as 0.0.0.0 or 255.255.255.255 instead of their correct values. What's going on?
Q0029: I can't seem to figure out why PAM support doesn't work correctly.
Q0030: I'm trying to use a query-style lookup for hosts that are allowed to relay, but it is giving really weird errors.
Q0031: Exim is rejecting connections from hosts that have more than one IP address, for no apparent reason.
Q0032: Exim is failing to find the MySQL library, even though is it present within LD_LIBRARY_PATH. I'm getting this error:
Q0033: What does the error lookup of host "xx.xx.xx" failed in yyy router mean?
Q0034: Exim works fine on one host, but when I copied the binary to another identical host, it stopped working (it could not resolve DNS names).
Q0035: I set a hosts condition in an ACL to do a lookup in a file of IP addresses, but it doesn't work.
Q0036: Why do I get the error Permission denied: creating lock file hitching post when Exim tries to do a local delivery?
Q0037: I am experiencing mailbox locking problems with Sun's mailtool used over a network.
Q0038: What does the error message error in forward file (filtering not enabled): missing or malformed local part mean?
Q0039: I have installed Exim, but now I can't mail to root any more. Why is this?
Q0040: How can I stop undeliverable bounce messages (e.g. to routeable, but undeliverable, spammer senders) from clogging up the queue for days?
Q0041: What does the message unable to set gid=ddd or uid=ddd (euid=ddd): local delivery to ... transport=ttt mean?
Q0042: My ISP's mail server is rejecting bounce messages from Exim, complaining that they have no sender. The SMTP trace does indeed show that the sender address is <>. Why is the Sender on the bounce message empty?
Q0043: What does the error Unable to get interface configuration: 22 Invalid argument mean?
Q0044: What does the error Failed to create spool file mean?
Q0045: I see entries in the log that mention two different IP addresses for the same connection. Why is this? For example:
Q0046: A short time after I start Exim I see a defunct zombie process. What is causing this?
Q0047: On a reboot, or a restart of the mail system, I see the message Mailer daemons: exim abandoned: unknown, malformed, or incomplete option -bz sendmail. What does this mean?
Q0048: Whenever exim restarts it takes up to 3-5 minutes to start responding on the SMTP port. Why is this?
Q0049: What does the log message no immediate delivery: more than 10 messages received in one connection mean?
Q0050: I am getting complaints from a customer who uses my Exim server for relaying that they are being blocked with a Too many connections error.
Q0051: When I test my system filter with -bf, I get the error filtering command "fail" is disabled. Why is this?
Q0052: What does ridiculously long message header in an error report mean?
Q0053: Exim on my host responds to a connection with 220 *****... and won't understand EHLO commands.
Q0054: I'm getting an Exim configuration error unknown rewrite flag character (m) in line 386 but I haven't used any flags on my rewriting rules.
Q0055: What does the error Failed to open wait-remote_smtp database: Invalid argument mean?
Q0056: We are using Exim to send mail from our web server. However, whenever a user sends an email it gets sent with the return path (envelope sender) apache@server_name.com because the PHP script is running as apache.
Q0057: We've got people complaining about attachments that don't show up as attachments, but are included in the body of the message.
Q0058: What does the error failed to open DB file /var/spool/exim/db/retry: File exists mean?
Q0059: When my Outlook Express 6.0 client sends a STARTTLS command to begin a TLS session, Exim doesn't seem to receive it. The Outlook log shows this:
Q0060: Why am I getting the error failed to expand /data/lists/lists/${lc for require_files: ${lc is not a known operator for this setting:
Q0061: What does the error Too many “Received” headers - suspected mail loop mean?
Q0062: When I try to start an Exim daemon with -bd it crashes. I ran a debugger and discovered that the crash is happening in the function getservbyname(). What's going on?
Q0063: When I try to start an Exim daemon, nothing happens. There is no process, and nothing is written to the Exim log.
Q0064: When I run exim -d test@domain it delivers fine, but when I send a message from the mail command, I get User unknown and the mail is saved in dead.letter.
Q0065: When (as root) I use -C to run Exim with an alternate configuration file, it gives an error about being unable to create a spool file when trying to run an autoreply transport. Why is this?
Q0066: What does the message unable to set gid=xxx or uid=xxx mean?
Q0067: What does the error too many unrecognized commands mean?
Q0068: Exim times out when trying to connect to some hosts, though those hosts are known to be up and running. What's the problem?
The Exim FAQ Section 0
The Exim FAQ
Contents   Next

0. GENERAL DEBUGGING

Q0001:  Exim is crashing. What is wrong?

A0001:  Exim should never crash. The author is always keen to know about crashes, so that they can be diagnosed and fixed. However, before you start sending me email, please check that you are running the latest release of Exim, in case the problem has already been fixed. The techniques described below can also be useful in trying to pin down exactly which circumstances caused the crash and what Exim was trying to do at the time. If the crash is reproducible (by a particular message, say) keep a copy of that message.

Q0002:  Exim is not working. What is wrong? How can I check what it is doing?

A0002:  Exactly how is it not working? Check the more specific questions in the other sections of this FAQ. Some general techniques for debugging are:

(1) Look for information in Exim's log files. These are in the log directory in Exim's spool directory, unless you have configured a different path for them. Serious operational problems are reported in paniclog.

(2) If the problem involves the delivery of one or more messages, try forcing a delivery with the -M option and also set the -d option, to cause Exim to output debugging information. For example:
```
   exim -d -M 0z6CXU-0005RR-00
```
The output is written to the standard error stream. You need to have admin privileges to use -M and -d.

(3) If the problem involves incoming SMTP mail, try using the -bh option to simulate an incoming connection from a specific host, for example:
```
   exim -bh 10.9.8.7
```
This goes through the motions of an SMTP session, without actually accepting a message. Information about various policy checks is output. You will need to know how to pretend to be an SMTP client.

(4) If the problem involves lack of recognition or incorrect handling of local addresses, try using the -bt option with debugging turned on, to see how Exim is handling the address. For example,
```
   exim -d -bt z6abc
```
shows you how it would handle the local part z6abc.

Q0003:  What does the error Child process of address_pipe transport returned 127 from command xxx mean?

A0003:  It means that when a transport called address_pipe was run to pass an email message by means of a pipe to another process running the command xxx, the return code from that command was 127, which indicates some kind of error (the success return code is 0).

The most common meaning of exit code 127 is that when Exim tried to run the command xxx, it failed. One cause of this might be incorrect permissions on the file containing the command. See also Q0026.

Q0004:  My virtual domain setup isn't working. How can I debug it?

A0004:  You can use an exim command with -d to get it to show you how it is processing addresses. You don't actually need to send a message; use the -bt option like this:
```
   exim -d -bt localpart@virtualhost
```
This will show you which routers it is using. If the problem appears to be with the expansion of an option setting, you can use the debug_print option on a router to get Exim to output the expanded string values as it goes along.

Q0005:  Why is Exim not rejecting incoming messages addressed to non-existent users at SMTP time?

A0005:  This is controlled by the ACL that is run for each incoming RCPT command. It is defined by the acl_smtp_rcpt option. You can check this part of your configuration by using the -bh option to run a simulated SMTP session, during which Exim will tell you what things it is checking.

Q0006:  I've put an entry for *.my.domain in a DBM lookup file, but it isn't getting recognized.

A0006:  You need to request “partial matching” by setting the search type to partial-dbm in order for this to work.

Q0007:  I've put the entry *@domain.com in a lookup database, but it isn't working. The expansion I'm using is:
```
   ${lookup{${lc:$sender_address}}dbm{/the/file} ...
```
A0007:  As no sender address will ever be *@domain.com this will indeed have no effect as it stands. You need to tell Exim that you want it to look for defaults after the normal lookup has failed. In this case, change the search type from dbm to dbm*@. See the section on Default values in single-key lookups in the chapter entitled File and database lookups in the Exim manual.

Q0008:  If I run ./exim -d -bt user@domain all seems well, but when I send a message from my User Agent, it does not arrive at its destination.

A0008:  Try sending a message directly to Exim by typing this:
```
   exim -v user@domain
   <some message, could be empty>
   .
```
If the message gets delivered to a rem

`acl_not_smtp`	ACL for non-SMTP messages
`acl_smtp_auth`	ACL for AUTH
`acl_smtp_connect`	ACL for start of SMTP connection
`acl_smtp_data`	ACL after DATA
`acl_smtp_etrn`	ACL for ETRN
`acl_smtp_expn`	ACL for EXPN
`acl_smtp_helo`	ACL for HELO or EHLO
`acl_smtp_mail`	ACL for MAIL
`acl_smtp_mailauth`	ACL for the AUTH parameter of MAIL
`acl_smtp_rcpt`	ACL for RCPT
`acl_smtp_starttls`	ACL for STARTTLS
`acl_smtp_vrfy`	ACL for VRFY