The recipe below has been tested with the following configuration. Reasonably close software versions should work as well.
Exim 4.50
Mailman 2.1.5
Python 2.3
Perl 5.8 (suidperl is required)
Two scripts are needed: A Python script called is-list-member which performs the actual list membership test, and a SGID Perl script, is-list-member-sgid, which performs the transition from the Exim user to the Mailman user.
The following steps are recommended to install these scripts:
Download the is-list-member Python script and save it to the file /etc/exim4/scripts/is-list-member.
Set the executable bits on /etc/exim4/scripts/is-list-member.
Adjust the path to the Mailman installation hard-coded in the script to your local needs:
sys.path = ['/usr/lib/mailman'] + sys.path from Mailman import mm_cfg from Mailman import Utils
The directory should contain Mailman's paths.py file.
Download the is-list-member-sgid Perl script and save it to the file /etc/exim4/scripts/is-list-member-sgid.
The is-list-member-sgid contains the path to the is-list-member script. Change it if necessary.
Change the group of /etc/exim4/scripts/is-list-member-sgid to the Mailman group (for example, list). Set the SGID and executable bit on the file.
As a result, any local user can invoke the is-list-member-sgid script to probe mail addresses for list membership. If this is a problem, place the script into a directory which can only be accessed by the Exim user (or use file system ACLs if available).
Add the following ACL entry before accepting mail to the Exim 4 configuration (in the acl_smtp_rcpt ACL):
deny domains = +mailman_domains
# Check if the local part is a Mailman list.
condition = \
${if exists{MAILMAN_HOME/lists/$local_part/config.pck} \
{yes}{no}}
# Check blacklists (optional).
# Mail from non-subscribers will still go through.
# condition = some blacklist check
# Check for list membership. The if condition ensures
# that the script (which runs under the Mailman group)
# cannot inject code to be executed by the Exim user.
!condition = ${if match{${run \
{/etc/exim4/scripts/is-list-member-sgid \
$local_part $sender_address}{$value}{fail}}}\
{^([a-z]+)}{$1}{fail}}
# Document the cause for rejection in the error message.
message = Please subscribe the address <$sender_address> \
to this mailing list before posting.
If necessary, adjust the path to the Mailman installation (MAILMAN_HOME) and to the is-list-member script.