Exim Send Only Mail Spooler

May 15, 2020

After setting up a series of complex platforms, I needed a means of getting alerts to me should any of these fail. While a centralised platform such as Slack is normally better for operations teams, it doesn’t really work out that way for a home network and email will do the trick, but since I want things to be centralised I’ll need a mail server first.

Since there’s no need to receive any mail we can just use a send-only mail spooler and I’ll be using my favorite spooler, Exim. A lightweight and highly flexible spooler for email, one of the oldest and most stable options for this use.

I’m only going to be configuring for internal, unauthenticated SMTP transport over TCP port 25. This would never usually be an acceptable configuration for true production use, however I’m only allowing this movement of traffic within my own network for error notifications. There are also other mitigating steps protecting this system from attackers shown below.

Operating System: Ubuntu 16.04
Required Applications: exim-daemon-light, mailutils

Install the Pre-Requisite Software

sudo apt-get update
sudo apt-get install exim-daemon-light mailutils

Configure the Exim Spooler

Once installed, I’ll configure the Spooler:

dpkg-reconfigure exim4-config

This will present a text based configuration wizard for Exim:

For my purposes, I’m going to be configuring Exim as an **internet site** and using SMTP only

On the next page, I define the FQDN for the server Exim is **running on**

Next we define the “listener” address, which will listen on TCP port 25, the IPv4 and IPv6 localhost addresses are defined automatically, however since we want external systems to use Exim, I’ve defined the servers primary IP

Now I define all acceptable mail domains, the FQDN, NETBIOS and localhost names (localhost names are added automatically and can be removed as they’re for local delivery only, but they do no harm)

Now I define domains to relay mail for, as I will be sending as phoney addresses in this domain and relaying, I have included the **madcaplaughs.co.uk** domain. Without this, external systems will throw a 550 relay error.

Now I define the **hosts** which are allowed to use Exim for relaying **without authentication**. I have defined the entire data subnet. This allows relaying from any other system within this address space, but prevents any external systems from interacting (as does blocking TCP port 25 at the firewall)

Allowing full DoD DNS queries. The server should be pretty quiet anyway

Using Maildir as my format, mail is only going to be stored here for NDRs

I now have a working spooler, and it can be tested by either setting up a remote system, or from the localhost by running:

echo "This is the body of the message" | mail -s FakeSubject welsh@tinfoilcipher.co.uk

Simple as that 🙂

Exim Send Only Mail Spooler

Install the Pre-Requisite Software

Configure the Exim Spooler

Simulating AWS Terraform Builds With Localstack

Ansible – Looping Over Lists and Dictionaries

Emulating AWS Services Using Localstack