Go to the first, previous, next, last section, table of contents.


23 The forwardfile director

The `forwardfile' director can be used for two different but related operations. Its effect is to replace a local part with a list of addresses, file names, or pipe commands, taken from a single file. It gets its name from the common case where the file is in a user's home directory and is called `.forward', but another common use is for expanding mailing lists, which are discussed in more detail in chapter "Using Exim to handle mailing lists". A transport must not be specified for this director. A configuration error occurs if one is given.

When handling a user's `.forward' file, a uid, gid, and home directory are commonly obtained from the password file by calling `getpwnam()'. However, these may alternatively be specified by options to the director, in which case `getpwnam()' is not called.

23.1 Forward file items

The contents of the file are a list of addresses, file names, or pipe commands, separated by commas or newlines. Items that are empty are ignored. This includes items consisting solely of RFC 822 address comments. If an item is entirely enclosed in double quotes, these are removed, but otherwise double quotes are retained, because some forms of mail address require the use of double quotes, though never enclosing the whole address.

23.2 Errors in forward files

If `skip_syntax_errors' is set, a malformed address that causes a parsing error is skipped, and an entry is written to the main log. This may be useful for mailing lists that are automatically managed, but note the inherent danger. The option should never be set for users' `.forward' files. Otherwise, if any error is detected while generating the list of new addresses, the message is frozen, except for the special case of inability to open an included file when `no_freeze_missing_include' is set. In this case, delivery is simply deferred.

23.3 Filter files

As an alternative to treating the file as a simple list of addresses, the `forwardfile' director can be configured, by means of the `filter' option, to read a file and interpret it as a list of filtering instructions if it conforms to a specific format. The instructions can specify various actions such as appending the message to certain mail folders, or forwarding it to other users, predicated on the content of the message. Details of the syntax and semantics of filter files are described in a separate document entitled Exim's User interface to mail filtering; this is intended for use by end users.

23.4 The home directory

The `home' expansion variable can be used in a number of local options for `forwardfile'. Its value depends on the way the options are set up, as follows:

It is thus possible to specify


file = ${home}/.forward

to look up `.forward' files without first statting the home directory to see if it exists. This is not recommended if home directories are NFS mounted.

If the generic option `require_files' contains `home', it takes the same value as it does when expanding the `file' option, and this value is also used for `home' if encountered in a filter file.

23.5 Forwardfile private options

allow_system_actions (forwardfile) option

Option: allow_system_actions
Type: boolean
Default: false

Setting this option permits the use of `freeze' and `fail' in filter files. This should not be set on the director for users' `.forward' files, but can be useful if you want to run a system-wide filter for each address, as opposed to the system filter, which runs just once per message. See chapter "System-wide message filtering".

check_ancestor (forwardfile) option

Option: check_ancestor
Type: boolean
Default: false

Although this option is off by default in the code, it is set in the default configuration file for handling users' `.forward' files. It is recommended for this use of the `forwardfile' director. When set, if a generated address is the same as any ancestor of the current address, then it is not used, but instead the current address gets passed on to subsequent directors. This helps in the case where local part A is aliased to B, and B has a `.forward' file pointing back to A, for example: `Joe.Bloggs' is aliased to `jb' and `~jb/.forward' contains:


\Joe.Bloggs, some.other.address

Without the `check_ancestor' setting, either local part (`jb' or `joe.bloggs') gets processed once by each director and so ends up as it was originally. If `jb' is the real mailbox name, then mail to `jb' gets delivered (having been turned into `joe.bloggs' by the `.forward' file and back to `jb' by the alias), while mail to `joe.bloggs' fails. Setting `check_ancestor' on the `forwardfile' director prevents it from turning `jb' back into `joe.bloggs' when that was the original address.

The `aliasfile' director also has a `check_ancestor' option for use in special cases. Setting it does not have the desired effect in a conventional configuration.

check_group (forwardfile) option

Option: check_group
Type: boolean
Default: false

The group of the file is checked only when this option is set. If `check_local_user' is set, then the user's default group is permitted; otherwise the group must be one of those listed in the `owngroups' option.

check_local_user (forwardfile) option

Option: check_local_user
Type: boolean
Default: true

If this option is true, then the local part that is passed to this director is checked to ensure that it is the login of a local user by calling the `getpwnam()' function. The director fails to handle the address if it is not. In addition, when this option is true, the string specified for the `file' option is taken as relative to the user's home directory if it is not an absolute path, unless the `file_directory' option is set.

When this option is set, the local user is always one of the permitted owners of the file, and the local user's uid is used when reading the forward file if the `seteuid' option is set or if the global security setting is not `setuid'.

current_directory (forwardfile) option

Option: current_directory
Type: string
Default: unset

This option associates a current directory with any address that `forwardfile' directs to a local transport because it specifies a file name or pipe command. The option string is expanded and is set as the current directory during the delivery process, unless overridden by a setting on the transport. See chapter "Environment for running local transports" for details of the local delivery environment.

directory (forwardfile) option

Option: directory
Type: string
Default: unset

This is an obsolete name for the `file_directory' option.

directory_transport (forwardfile) option

Option: directory_transport
Type: string
Default: unset

A `forwardfile' director sets up a direct delivery to a directory when a path name ending with a slash is specified as a new `address' (see chapter "Default transports"). The transport used is taken from the global option `address_directory', unless this option is set to override it. The string must be the name of a configured transport.

directory2_transport (forwardfile) option

Option: directory2_transport
Type: string
Default: unset

A `forwardfile' director sets up a direct delivery to a directory when a path name ending with two slashes is specified as a new `address' (see chapter "Default transports"). The transport used is taken from the global option `address_directory2', unless this option is set to override it. The string must be the name of a configured transport.

errors_to (forwardfile) option

Option: errors_to
Type: string
Default: unset

This used to exist as an option specific to this director, but it is now a generic option that can be used on any director or router (see chapter "Common generic options for directors and routers").

file (forwardfile) option

Option: file
Type: string
Default: unset

This option must be set. The string is expanded before use -- see above for a discussion of the `home' expansion variable. If expansion fails, Exim panics. The expanded string is interpreted as a single file name, and must start with a slash character unless `check_local_user' is true, or a `file_directory' option is set. A non-absolute path is interpreted relative to the `file_directory' setting if it exists; otherwise it is interpreted relative to the user's home directory.

If a non-absolute path is used, Exim uses the `stat()' function to check the directory before attempting to open the file therein. If the directory is inaccessible, the delivery to the current address is deferred. This distinguishes between the cases of a non-existent file (where the director cannot handle the address) and an unmounted NFS directory (where delivery should be deferred). Thus the difference between the two settings


file = .forward
file = $home/.forward

is that in the second case the directory is not checked with `stat()'.

If the file exists but is empty or contains only blank and comment lines starting with #, Exim behaves as if it did not exist, and the director fails to handle the address. Note that this is not the case when the file contains syntactically valid items that happen to yield empty addresses, for example, items containing only RFC 822 address comments.

file_directory (forwardfile) option

Option: file_directory
Type: string
Default: unset

The string is expanded before use -- see above for a discussion of the `home' expansion variable. The option sets a directory path which is used if the `file' option does not specify an absolute path. This on its own is not very useful, since the directory string could just as well be prepended to the file string. However, if a separate directory is given, it is treated like a directory obtained from `check_local_user', and its existence is tested before trying to open the file. If the directory appears not to exist, delivery is deferred. Thus, a setting such as


directory = /usr/forwards
file = ${local_part}.forward

defers delivery if `/usr/forwards' appears not to exist. This can be useful if the directory is NFS mounted. If `check_local_user' is also set, `file_directory' takes precedence in determining the directory name for non-absolute files.

If `forwardfile' sets up a delivery to a file or a pipe command and the `home_directory' option is not set, then the directory specified by `file_directory', or if that is not set, the home directory obtained from `check_local_user' is associated with the address during delivery.

file_transport (forwardfile) option

Option: file_transport
Type: string
Default: unset

A `forwardfile' director sets up a direct delivery to a file when a path name not ending in a slash is specified as a new `address' (see chapter "Default transports"). The transport used is taken from the global option `address_file', unless this option is set to override it. The string must be the name of a configured transport.

filter (forwardfile) option

Option: filter
Type: boolean
Default: false

If this option is set, and the forward file starts with the text `# Exim filter', then it is interpreted as a set of filtering commands instead of a list of forwarding addresses. Details of the syntax and semantics of filter files are described in a separate document entitled Exim's User interface to mail filtering; this is intended for use by end users.

In addition to the commands described therein, there are some extra commands that are permitted only in system filter files, or if `allow_system_actions' is set. These are described in chapter "System-wide message filtering".

The logging facility in filter files is available only if the filter is being run under some unprivileged uid. The system configuration must specify that `seteuid()' is available, either `user' or `check_local_user' must be set on the director, `forbid_filter_log' must not be set, and the global `security' setting must not be `setuid'. Writing the log takes place while the filter file is being interpreted, that is, at directing time. It does not queue up for later like the delivery commands. The reason for this is so that a log file need be opened only once for several write operations.

forbid_file (forwardfile) option

Option: forbid_file
Type: boolean
Default: false

If this option is true, then this director may not generate a new address which specifies delivery to a local file. If it attempts to do so, a delivery failure occurs.

forbid_filter_log (forwardfile) option

Option: forbid_filter_log
Type: boolean
Default: false

This is an obsolete name for `forbid_filter_logwrite'.

forbid_filter_logwrite (forwardfile) option

Option: forbid_filter_logwrite
Type: boolean
Default: false

If this option is true, use of the logging facility in filter files is not permitted. This is in any case available only if the filter is being run under some unprivileged uid, which is normally the case for ordinary users' `.forward' files on a system with `seteuid()' available.

forbid_include (forwardfile) option

Option: forbid_include
Type: boolean
Default: false

If this option is true, then items of the form


:include:<path name>

are not permitted, and if one is encountered, the message is frozen.

forbid_pipe (forwardfile) option

Option: forbid_pipe
Type: boolean
Default: false

If this option is true, then this director may not generate a new address which specifies delivery to a pipe. If it attempts to do so, a delivery failure occurs.

forbid_reply (forwardfile) option

Option: forbid_reply
Type: boolean
Default: false

If this option is true, then this director may not generate an automatic reply message. If it attempts to do so, a delivery failure occurs. Automatic replies can be generated only from filter files, not from traditional forward files.

freeze_missing_include (forwardfile) option

Option: freeze_missing_include
Type: boolean
Default: true

If a file named by the `include' mechanism fails to open, delivery is frozen if this option is true. Otherwise, delivery is just deferred. Unsetting this option can be useful if included files are NFS mounted and may not always be available.

group (forwardfile) option

Option: group
Type: string
Default: unset

This option should be specified only in conjunction with the `user' option. If `seteuid()' is being used to read the file as a particular user, then this group is set using `setegid()' during that process, overriding any group that might have been obtained by `check_local_user'.

Furthermore, if a file or pipe delivery is generated by this director, and the transport does not specify a user and group, then the user and group given in the director are used when running the delivery process. If the string contains no $ characters, it is resolved when Exim starts up. Otherwise, the string is expanded at the time the director is run, and must yield either a digit string or a name which can be looked up using `getgrnam()'.

home_directory (forwardfile) option

Option: home_directory
Type: string
Default: unset

If this option is set, it associates a home directory with any address that `forwardfile' directs to a local transport because it specifies a file name or pipe command. The option string is expanded and set as the home directory during the delivery process, unless overridden by a setting on the transport. If `home_directory' is not set, then the directory specified by `file_directory', or if that is not set, the home directory obtained from `check_local_user' is associated with the address during delivery. See chapter "Environment for running local transports" for details of the local delivery environment. This option has no effect during the running of the `forwardfile' director.

ignore_eacces (forwardfile) option

Option: ignore_eacces
Type: boolean
Default: false

If this option is set and an attempt to open the forward file yields the EACCES error (permission denied) then `forwardfile' behaves as if the file did not exist.

ignore_enotdir (forwardfile) option

Option: ignore_enotdir
Type: boolean
Default: false

If this option is set and an attempt to open the forward file yields the ENOTDIR error (something on the path is not a directory) then `forwardfile' behaves as if the file did not exist.

initgroups (forwardfile) option

Option: initgroups
Type: boolean
Default: false

If a file or pipe delivery is generated by this director, and this option is true, and `user' is set, then the `initgroups()' function is called when running the transport to ensure that any additional groups associated with the uid are set up. Also, if the forward file is read under a specific uid and gid, `initgroups()' is called after they have been set up.

modemask (forwardfile) option

Option: modemask
Type: integer
Default: 022

This specifies mode bits which must not be set for the forward file. If they are set, the director fails and the message is frozen.

owners (forwardfile) option

Option: owners
Type: string-list
Default: unset

This specifies a list of permitted owners for the file. These are in addition to the local user in the case when `check_local_user' is set. If `owners' is unset and `check_local_user' is false, no check on the ownership is done. If the file is not correctly owned, the director fails and the message is frozen.

owngroups (forwardfile) option

Option: owngroups
Type: string-list
Default: unset

This specifies a list of permitted groups for the file. These are in addition to the local user's group in the case when `check_local_user' is set. However, a check on the group is made only when `check_group' is set. If the file's group is not correct, the director fails and the message is frozen.

pipe_transport (forwardfile) option

Option: pipe_transport
Type: string
Default: unset

A `forwardfile' director sets up a direct delivery to a pipe when a string starting with a vertical bar character is specified as a new `address' (see chapter "Default transports"). The transport used is taken from the global option `address_pipe', unless this option is set to override it. The string must be the name of a configured transport.

qualify_preserve_domain (forwardfile) option

Option: qualify_preserve_domain
Type: boolean
Default: false

If this is set and an unqualified address (one without a domain) is generated, it is qualified with the domain of the incoming address instead of the global setting in `qualify_recipient'.

reply_transport (forwardfile) option

Option: reply_transport
Type: string
Default: unset

A `forwardfile' director sets up a delivery to an `autoreply' transport when a `mail' or `vacation' command is used in a filter file (see chapter "Default transports"). The transport used is taken from the global option `address_reply', unless this option is set to override it. The string must be the name of a configured transport.

rewrite (forwardfile) option

Option: rewrite
Type: boolean
Default: true

If this option is set false, addresses generated by the director are not subject to address rewriting. Otherwise, they are treated like new addresses.

seteuid (forwardfile) option

Option: seteuid
Type: boolean
Default: false

This option may not be set unless the compile-time configuration in the OS-specific configuration files specifies that the `seteuid()' function is available in the operating system. In addition, either the `check_local_user' or the `user' and `group' options must be set. A configuration error occurs if these conditions do not hold.

When this option is true, the `seteuid()' and `setegid()' functions are called to change the effective uid and gid to that of the local user before accessing the home directory and the file. This is necessary in two circumstances:

  1. When Exim is configured to change the effective uid from root to the Exim user (using `seteuid()') while running the directors. See chapter "Security considerations" for details.
  2. When users' home directories are NFS mounted, and root access is not exported to the current machine, to allow for cases when the files are not world-readable.

The `forwardfile' director can detect the first of these cases, and it always uses `seteuid()', regardless of the setting of this option, since it does not make sense to do otherwise.

On a system without the `seteuid()' function, but with NFS home directories that do not export root, it is necessary for forward files to be world-readable.

skip_syntax_errors (forwardfile) option

Option: skip_syntax_errors
Type: boolean
Default: false

If `skip_syntax_errors' is set, a malformed address that causes a parsing error is skipped, and an entry is written to the main log. This may be useful for mailing lists that are automatically managed, but note the inherent danger. It should never be set for users' `.forward' files.

syntax_errors_to (forwardfile) option

Option: syntax_errors_to
Type: string
Default: unset

This option applies only when `skip_syntax_errors' is set. If any addresses are skipped because of syntax errors, a mail message is sent to the address specified by `syntax_errors_to', giving details of the failing address(es). Often it will be appropriate to set `syntax_errors_to' to be the same address as `errors_to'.

user (forwardfile) option

Option: user
Type: string
Default: unset

If `seteuid()' is being used to read the file as a particular user, which happens when `seteuid()' is available in the operating system and either the `seteuid' option is set or the global `security' option is not set to `setuid', then this user is set during that process, overriding any user that might have been obtained by `check_local_user'. The user is also set during interpretation of a filter file; if it writes log entries the log file must be accessible to this user.

In addition, when a file, pipe, or auto-reply delivery is generated by this director, and the transport does not specify a user, then the user given here is used when running the delivery process. If the string contains no $ characters, it is resolved when Exim starts up. Otherwise, the string is expanded at the time the director is run, and must yield either a digit string or a name which can be looked up using `getpwnam()'.


Go to the first, previous, next, last section, table of contents.