###########################################################################
#
#                    SmtpProxyAService Config File
#
# When SmtpProxyAService reads this config file, it looks for the 
#   section that corresponds to its instance name (given in AService.cfg).
#
# You may specify an alternate config file in AService.cfg by 
#   giving an instance name of the form: FILE [ "|" SECTION ].  Otherwise,
#   instance name is read as: FILE, and the section "default" is read.
# 
# The format of each non-comment line is:
#
#   SECTION:KEY VALUE*
#
# Some parameters are listed with their default values, to reconfigure, 
#   it may be necessary to uncomment a config line
#
###########################################################################

#
# LdapUrl is the site's domain (DC) directory server tree.  
#  ldaps is supported, but the ssl config below must also be correct.
#  To enable failover, the hostpart of the url may be a space-separated
#  list of hosts e.g. "ldap://ldap1 ldap2/o=internet".  The port
#  389 is not necessary, as it is the default.
#
default:LdapUrl "ldap://<local.ugldaphost>/<msg.dctree.Suffix.1>"

# 
# LogDir is the directory where PopProxyAService writes log files
# LogLevel controls the verbosity of the logging
#
default:LogDir <msg.RootPath>/data/log
#default:LogLevel 1

#
# BindDN and BindPass are the credentials used to bind to directory
#   to do searches.  Using "cn=Directory Manager" is overkill, but will 
#   always work.  A more restricted user with read-only privileges is
#   recommended.
#
default:BindDN   "uid=msg-admin-<msg.ServerHostName>-<msg.product.InstallationTimestamp>, ou=People, <deforgdn>"
default:BindPass "<msg.enduser.AdminPassword>"

#
# Session protocol timeout.
#
#default:Timeout 1800

#
# Set this to force a reverse DNS lookup of every client connection
# regardless of whether or not Wrap filters are used.  When this
# is set to no, the reverse lookup is only performed if necessary to
# evaluate a Wrap filter.  For the SMTP proxy it is recommended this
# be set to yes to remove load from the relay MTA.  For the other proxies
# this option should be left unset (so it defaults to no).
#
default:ClientLookup yes

#
# This is a space-separated list of SMTP relay host names.  These relays
# MUST support the XPEHLO extension.  MMP will load-balance among these
# hosts.  This must be non-empty for the SMTP proxy to function.
#
default:SmtpRelays

#
# This specifies how many seconds the MMP will wait for an SMTP Relay
# to respond before trying the next one in the list.
#
default:FailoverTimeout 10

#
# This is a password used to authorize source channel changes on the
# relay SMTP servers.  The PROXY_PASSWORD tcp_local channel option must
# also be set at each relay.  A non-empty value must be provided for the
# SMTP proxy to operate.
#
default:SmtpProxyPassword

#
# The MMP will remove any unrecognized EHLO keywords from the EHLO list
# returned by an SMTP relay.  This configuration option specifies
# additional EHLO keywords which should not be removed from the list.
#
# The SMTP proxy has built in knowledge of the following keywords,
# so there is no need to list them in this option:
#  AUTH STARTTLS 8BITMIME PIPELINING DSN ENHANCEDSTATUSCODES EXPN HELP
#  XLOOP ETRN SIZE LANG
#
#default:EhloKeywords

#
# This option enables the POP before SMTP kludge used to support legacy
# POP clients which haven't been upgraded to support SMTP AUTH (RFC 2554).
# It will cause a significant performance penalty as well as creating
# security concerns since it authorizes all relays from a given IP address
# for the duration of the AuthServiceTTL.  The AuthService and AuthServiceTTL
# settings in PopProxyAService.cfg are required for this to work.
#
# The argument to this option specifies the MTA channel to use as a source
# channel when the user has previously authenticated to POP within the
# AuthServiceTTL window.  Since the MTA source channel is used for relay
# blocking, this can be used to authorize relay by users on the same IP
# where a recent POP authentication originated.
#
# If at all possible, encourage your users to upgrade their POP clients,
# rather than using this option.  Once this is deployed at a site
# users will become dependant on clients which fail to track Internet
# security standards (thus putting end users at greater risk of hacking)
# and your site will be stuck with the unavoidable performance penalty
# necessary to track and coordinate IP addresses of recent successful
# POP sessions.
#
#default:PopBeforeSmtpKludgeChannel tcp_intranet

#
# Banner override
#
#default:Banner

#
# "SearchFormat" dictates how the SmtpProxy will search directory.  It is a 
#   printf-style string.  The following substitutions are made:
#
#  "%s" - userid+virtualdomain (with CanonicalVirtualDomainDelim)
#  "%U" - userid only
#  "%V" - virtual domain only
#  "%C" - client IP address 
#  "%S" - server IP address
#  "%D" - client cert DN 
#
# If any of these are not applicable (can't be determined, or aren't 
#   available), they are replaced by "*".  The default is "(uid=%s)".
#	
#default:SearchFormat (uid=%s)

#
# SSL configuration
#
#  Enable SSL from client to MMP with this:
#default:SSLEnable         yes
#default:SSLCertNicknames  Server-Cert
#  Password File for SSL server keys:
#default:SSLKeyPasswdFile  <msg.RootPath>/config/sslpassword.conf
#  Where SSL session cache, secmod, cert, and key files are located:
#default:SSLCacheDir       <msg.RootPath>/config
#  Customizable SSL security module database file name:
#default:SSLSecmodFile     secmod.db
#  Customizable SSL cert7.db and key3.db file prefixes:
#default:SSLCertPrefix     ""
#default:SSLKeyPrefix      ""

#
# If this port is also listed in the ServiceList option in AService.cfg,
# then SMTP SSL will be enabled on this port.
#
#default:SSLPorts          465

#
# If this is set to a value other than the default of 0, then all connections
# to SMTP relays will be SSL protected and this will be the default port,
# although if a port number is included in the SmtpRelays list, then it
# will override the default port.
#
#default:SSLBacksidePort   465

#
# VirtualDomain config 
#
#default:VirtualDomainFile <msg.RootPath>/config/vdmap.cfg

#
# list of valid delimiters
# 
#default:VirtualDomainDelim @

#
# canonical delimiter
#
#default:CanonicalVirtualDomainDelim @

#
# certmap file (for SSL client-cert-based authentication)
#
#default:CertMapFile

#
# BaseDN for start of certmap lookups.  If using hosted domains (iMS 5.0
#  LDAP schema), then this must be set to the root of the user/group
#  directory tree in order for client-cert-based authentication to work.
#  Default value is the DN from the LdapUrl option.
#
#default:CertmapDN

#
# proxyauth credentials, necessary for client-cert-based auth
#
#default:StoreAdmin
#default:StoreAdminPass

#
# How the Proxy reconstructs a userid for playback to SMTP server.
#  It is a printf-style string.  The following substitutions are made:
#
#  "%V" - Virtual Domain Name
#  "%U" - userid only
#  "%A[ATTR]" - the value of the user attribute ATTR
#
#default:ReplayFormat

#
# ConnLimits this can either be a comma-separated list of entries of 
#  the form:
#
#   IP "|" MASK ":" NUM
#
# or the name of a file containing one of the above entries per line, 
#  most specific IP-MASK pairs to least specific
#
default:ConnLimits 0.0.0.0|0.0.0.0:20

#
# LdapCache config
#
#default:LdapCacheSize 10000
#default:LdapCacheTTL 900

#
# TCPAccess (global)
#
#default:TCPAccess

#
# TCPAccess (per-user)
#
#default:TCPAccessAttr

#
# do HostedDomains (if not specified, defaults on) 
#
#default:HostedDomains yes

#
# default HostedDomain (NULL default)
#
default:DefaultDomain <local.defdomain>

