This file is indexed.

/etc/courier/esmtpd-ssl is in courier-mta 0.78.0-2ubuntu2.

This file is owned by root:root, with mode 0o644.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
##VERSION: $Id: 7629956af3d4c2c1eb8e42f42296347c0843f2db-20170725204024$
#
# esmtpd-ssl created from esmtpd-ssl.dist by sysconftool
#
# Do not alter lines that begin with ##, they are used when upgrading
# this configuration.
#
#  Copyright 2000-2016 Double Precision, Inc.  See COPYING for
#  distribution information.
#
#  This configuration file sets various options for the Courier-SMTP server
#  when used to handle SSL ESMTP connections.
#
#  SSL and non-SSL connections are handled by a dedicated instance of the
#  couriertcpd daemon.  If you are accepting both SSL and non-SSL ESMTP
#  connections, you will start two instances of couriertcpd, one on the
#  ESMTP port 25, and another one on the ESMTP-SSL port 465.
#
#  Download OpenSSL from http://www.openssl.org/
#
##NAME: install_prefix:0
#
# Do not change the following settings.

prefix=/usr
exec_prefix=/usr

##NAME: BOFHCHECKDNS:0
#
#  Comment out the following line in order to accept mail with a bad
#  return address.

BOFHCHECKDNS=1

##NAME: BOFHNOEXPN:1
#
#  Set BOFHNOEXP to 1 to disable EXPN

BOFHNOEXPN=0

##NAME: BOFHNOVRFY:1
#
#  Set BOFHNOVERIFY to disable VRFY

BOFHNOVRFY=0

##NAME: TARPIT:1
#
#  Set TARPIT to 0 to disable tarpitting

TARPIT=1

##NAME: NOADDMSGID:0
#
#  The following environment variables keep Courier from adding
#  default Date: and Message-ID: header to messages which do not have them.
#  If you would like to add default headers only for mail from certain
#  IP address ranges, you can override them in couriertcpd access file,
#  see couriertcpd(8).

NOADDMSGID=1

##NAME: NOADDDATE:0
#

NOADDDATE=1

##NAME: NOADDRREWRITE:0
#
# Don't rewrite To:, From:, and Cc: headers.  Set to 2 in order to omit
# rewriting them only if there is a DKIM-Signature.

NOADDRREWRITE=0

##NAME: ESMTP_LOG_DIALOG:0
#
#  If set, log the esmtp dialog.

ESMTP_LOG_DIALOG=0

##NAME: AUTH_REQUIRED:0
#
# Set AUTH_REQUIRED to 1 in order to force the client to use ESMTP
# authentication.  You can override AUTH_REQUIRED on a per-IP address basis
# using smtpaccess.  See makesmtpaccess(8).

AUTH_REQUIRED=0

##NAME: SSLPORT:0
#
#  Options in the esmtpd-ssl configuration file AUGMENT the options in the
#  esmtpd configuration file.  First the esmtpd configuration file is read,
#  then the esmtpd-ssl configuration file, so we do not have to redefine
#  anything.
#
#  However, some things do have to be redefined.  The port number is
#  specified by SSLPORT, instead of PORT.  The default port is port 465.
#
#  Multiple port numbers can be separated by commas.  When multiple port
#  numbers are used it is possibly to select a specific IP address for a
#  given port as "ip.port".  For example, "127.0.0.1.900,192.168.0.1.900"
#  accepts connections on port 900 on IP addresses 127.0.0.1 and 192.168.0.1
#  The SSLADDRESS setting is a default for ports that do not have
#  a specified IP address.

SSLPORT=465

##NAME: SSLADDRESS:0
#
#  Address to listen on, can be set to a single IP address.
#
# SSLADDRESS=127.0.0.1

SSLADDRESS=0

##NAME: SSLPIDFILE:0
#
#

SSLPIDFILE=/run/courier/esmtpd-ssl.pid

##NAME: ESMTPDSSLSTART:0
#
#  Whether or not to start ESMTP over SSL on esmtps port:

ESMTPDSSLSTART=YES

##NAME: COURIERTLS:0
#
# The following variables configure ESMTP over SSL.  If OpenSSL or GnuTLS
# is available during configuration, the couriertls helper gets compiled, and
# upon installation a dummy TLS_CERTFILE gets generated. courieresmtpd will
# automatically advertise the ESMTP STARTTLS extension if both TLS_CERTFILE
# and COURIERTLS exist.
#
# WARNING: Peer certificate verification has NOT yet been tested.  Proceed
# at your own risk.  Only the basic SSL/TLS functionality is known to be
# working. Keep this in mind as you play with the following variables.
#

COURIERTLS=/usr/bin/couriertls

##NAME: TLS_PRIORITY:0
#
# GnuTLS setting only
#
# Set TLS protocol priority settings (GnuTLS only)
#
# DEFAULT: NORMAL:-CTYPE-OPENPGP
#
# TLS_PRIORITY="NORMAL:-CTYPE-OPENPGP"
#
# This setting is also used to select the available ciphers.
#
# The actual list of available ciphers depend on the options GnuTLS was
# compiled against. The possible ciphers are:
#
# AES256, 3DES, AES128, ARC128, ARC40, RC2, DES, NULL
#
# Also, the following aliases:
#
# HIGH -- all ciphers that use more than a 128 bit key size
# MEDIUM -- all ciphers that use a 128 bit key size
# LOW -- all ciphers that use fewer than a 128 bit key size, the NULL cipher
#        is not included
# ALL -- all ciphers except the NULL cipher
#
# See GnuTLS documentation, gnutls_priority_init(3) for additional
# documentation.

##NAME: TLS_PROTOCOL:0
#
# TLS_PROTOCOL sets the protocol version.  The possible versions are:
#
# OpenSSL:
#
# TLSv1 - TLS 1.0, or higher.
# TLSv1.1 - TLS1.1, or higher.
# TLSv1.2 - TLS1.2, or higher.
#
# The default value is TLSv1

##NAME: TLS_CIPHER_LIST:0
#
# TLS_CIPHER_LIST optionally sets the list of ciphers to be used by the
# OpenSSL library.  In most situations you can leave TLS_CIPHER_LIST
# undefined
#
# OpenSSL:
#
# TLS_CIPHER_LIST="TLSv1:HIGH:!LOW:!MEDIUM:!EXP:!NULL:!aNULL@STRENGTH"

##NAME: TLS_MIN_DH_BITS:0
#
# TLS_MIN_DH_BITS=n
#
# GnuTLS only:
#
# Set the minimum number of acceptable bits for a DH key exchange.
#
# GnuTLS's compiled-in default is 727 bits (as of GnuTLS 1.6.3). Some server
# have been encountered that offer 512 bit keys. You may have to set
# TLS_MIN_DH_BITS=512 here, if necessary.

##NAME: TLS_TIMEOUT:0
# TLS_TIMEOUT is currently not implemented, and reserved for future use.
# This is supposed to be an inactivity timeout, but its not yet implemented.
#

##NAME: TLS_CERTFILE:0
#
# TLS_CERTFILE - certificate to use.  TLS_CERTFILE is required for SSL/TLS
# servers, and is optional for SSL/TLS clients.  TLS_CERTFILE is usually
# treated as confidential, and must not be world-readable. Set TLS_CERTFILE
# instead of TLS_DHCERTFILE if this is a garden-variety certificate
#
# VIRTUAL HOSTS ON THE SAME IP ADDRESS.
#
# Install each certificate $TLS_CERTFILE.domain, so if TLS_CERTFILE is set to
# /etc/certificate.pem, then you'll need to install the actual certificate
# files as /etc/certificate.pem.www.example.com,
# /etc/certificate.pem.www.domain.com and so on. Then, create a link from
# $TLS_CERTFILE to whichever certificate you consider to be the main one,
# for example:
# /etc/certificate.pem => /etc/certificate.pem.www.example.com
#
# IP-BASED VIRTUAL HOSTS:
#
# There may be a need to support older SSL/TLS client that don't support
# virtual hosts on the same IP address, and require a dedicated IP address
# for each SSL/TLS host. If so, install each certificate file as
# $TLS_CERTFILE.aaa.bbb.ccc.ddd, where "aaa.bbb.ccc.ddd" is the IP address
# for the certificate's domain name. So, if TLS_CERTFILE is set to
# /etc/certificate.pem, then you'll need to install the actual certificate
# files as /etc/certificate.pem.192.168.0.2, /etc/certificate.pem.192.168.0.3
# and so on, for each IP address.
#
# In all cases, $TLS_CERTFILE needs to be linked to one of the existing
# certificate files.

TLS_CERTFILE=/etc/courier/esmtpd.pem

##NAME: TLS_DHPARAMS:0
#
# TLS_DHPARAMS - DH parameter file.
#
TLS_DHPARAMS=/etc/courier/dhparams.pem

##NAME: TLS_TRUSTCERTS:0
#
# TLS_TRUSTCERTS=pathname - load trusted certificates from pathname.
# pathname can be a file or a directory. If a file, the file should
# contain a list of trusted certificates, in PEM format. If a
# directory, the directory should contain the trusted certificates,
# in PEM format, one per file and hashed using OpenSSL's c_rehash
# script. TLS_TRUSTCERTS is used by SSL/TLS clients (by specifying
# the -domain option) and by SSL/TLS servers (TLS_VERIFYPEER is set
# to PEER or REQUIREPEER).

TLS_TRUSTCERTS=/etc/ssl/certs

##NAME: TLS_VERIFYPEER:0
#
# TLS_VERIFYPEER - how to verify client certificates.  The possible values of
# this setting are:
#
# NONE - do not verify anything
#
# PEER - verify the client certificate, if one's presented
#
# REQUIREPEER - require a client certificate, fail if one's not presented
#
#
TLS_VERIFYPEER=NONE

##NAME: TLS_EXTERNAL:0
#
# To enable SSL certificate-based authentication:
#
# 1) TLS_TRUSTCERTS must be set to a pathname that holds your certificate
#    authority's SSL certificate
#
# 2) TLS_VERIFYPEER=PEER or TLS_VERIFYPEER=REQUIREPEER (the later settings
#    requires all SSL clients to present a certificate, and rejects
#    SSL/TLS connections without a valid cert).
#
# 3) Set TLS_EXTERNAL, below, to the subject field that holds the login ID.
#    Example:
#
#  TLS_EXTERNAL=emailaddress
#
# The above example retrieves the login ID from the "emailaddress" subject
# field. The certificate's emailaddress subject must match exactly the login
# ID in the courier-authlib database.

##NAME: SYSLOGNAME:0
#
# Name that courieresmtpd uses to log to syslog
#
# SYSLOGNAME=courieresmtpd

##NAME: MAXDAEMONS:0
#
#  Maximum number of daemons started
#

MAXDAEMONS=40

##NAME: MAXPERC:0
#
#  Maximum number of connections accepted from the same C address block
#

MAXPERC=5

##NAME: MAXPERIP:0
#
#
#  Maximum number of connections accepted from the same IP address

MAXPERIP=5