You should at least set up an alias for postmaster in the /etc/aliases file.
The file should contain lines of the form
user: someone@isp.com
otheruser: someoneelse@anotherisp.com
This way emails from user will appear to be from someone@isp.com to the outside world. Technically, the from, reply-to, and sender addresses, along with the envelope sender, are rewritten for users that appear to be in the local domain.
In the blacklist, the trick is to read a line break as "or" if it follows a positive item, and as "and" if it follows a negative item.
For example, a /etc/exim4/local_host_blacklist
192.168.10.0/24
!172.16.10.128/26
172.16.10.0/24
10.0.0.0/8
Exim just evaluates left to right (or up-down in the file listing context), so you don't get the same kind of operator binding as in a programming language.
In the blacklist, the trick is to read a line break as "or" if it follows a positive item, and as "and" if it follows a negative item.
For example, a /etc/exim4/local_sender_blacklist
domain1.example
!local@domain2.example
domain2.example
domain3.example
Exim just evaluates left to right (or up-down in the file listing context), so you don't get the same kind of operator binding as in a programming language.
The file should contain key-value pairs of domain pattern and route data of the form
domain: host-list options
dict.ref.example: mail-1.ref.example:mail-2.ref.example
foo.example: internal.mail.example.com
bar.example: 192.168.183.3
which will cause mail for foo.example to be sent to the host internal.mail.example (IP address derived from A record only), and mail to bar.example to be sent to 192.168.183.3.
See spec.txt chapter 20.3 through 20.7 for a more detailed explanation of host list format and available options.
The file should contain lines of the form
username:crypted-password:clear-password
crypted-password is the crypt(3)-created hash of your password. You can, for example, use the mkpasswd program from the whois package to create a crypted password. It is recommended to use a modern hash algorithm, see mkpasswd --method=help. Consider not using crypt or MD5.
clear-password is only necessary if you want to offer CRAM-MD5 authentication. If you don't plan on doing so, the third column can be omitted completely.
This file must be readable for the Debian-exim user and should not be readable for others. Recommended file mode is root:Debian-exim 640.
The file should contain lines of the form
target.mail.server.example:login-user-name:password
which will cause exim to use login-user-name and password when sending messages to a server with the canonical host name target.mail.server.example. Please note that this does not configure the mail server to send to (this is determined in Debconf), but only creates the correlation between host name and authentication credentials to avoid exposing passwords to the wrong host.
Please note that target.mail.server.example is currently the value that exim can read from reverse DNS: It first follows the host name of the target system until it finds an IP address, and then looks up the reverse DNS for that IP address to use the outcome of this query (or the IP address itself should the query fail) as index into /etc/exim4/passwd.client.
This goes inevitably wrong if the host name of the mail server is a CNAME (a DNS alias), or the reverse lookup does not fit the forward one.
Currently, you need to manually lookup all reverse DNS names for all IP addresses that your SMTP server host name points to, for example by using the host command. If the SMTP smarthost alias expands to multiple IPs, you need to have multiple lines for all the hosts. When your ISP changes the alias, you will need to manually fix that.
You may minimize this trouble by using a wild card entry or regular expressions, thus reducing the risk of divulging the password to the wrong SMTP server while reducing the number of necessary lines. For a deeper discussion, see the Debian BTS #244724.
password is your SMTP password in clear text. If you do not know about your SMTP password, you can try using your POP3 password as a first guess.
This file must be readable for the Debian-exim user and should not be readable for others. Recommended file mode is root:Debian-exim 640.
# example for CONFDIR/passwd.client
# this will only match if the server's generic name matches exactly
mail.server.example:user:password
# this will deliver the password to any server
*:username:password
# this will deliver the password to servers whose generic name ends in
# mail.server.example
*.mail.server.example:user:password
# this will deliver the password to servers whose generic name matches
# the regular expression
^smtp[0-9]*.mail.server.example:user:password
This manual page needs a major re-work. If somebody knows better groff than us and has more experience in writing manual pages, any patches would be greatly appreciated.
Adding or keeping items in the abovementioned host lists which are not resolvable by DNS has severe consequences.
e.g. if resolving a hostname in local_host_blacklist returns a temporary error (DNS timeout) exim will not be able to check whether a connecting host is part of the list. Exim will therefore return a temporary SMTP error for every connecting host.
On the other hand if there is a permanent error in resolving a name in the host list (the record was removed from DNS) exim behaves as if the host does not match the list. e.g. a local_host_blacklist consisting of
notresolvable.example.com:rejectme.example.com
is equivalent to an empty one. - Exim tries to match the IP-address of the conecting host to notresolvable.example.com, resolving this IP by DNS fails, exim behaves as if the connecting host does not match the list. List processing stops at this point!
Starting the list with the special pattern +ignore_unknown as a safeguard against this behavior is strongly recommended if hostnames are used in hostlists.
See Exim specification Chapter Domain, host, address, and local part lists , section Behaviour when an IP address or name cannot be found. <http://www.exim.org/exim-html-current/doc/html/spec_html/ch-domain_host_address_and_local_part_lists.html>