October 28, 2017 Roberto Puzzanghera166 comments
The complete changelog is inside the patch file.
qmail-remote.c: in case of remote servers not allowing EHLO the response for an alternative HELO was checked twice, making the connection to die. (Thanks to Luca Franceschini)
I have created a combined patch including the latest versions of several commonly-used
You're invited to take a look at the next page of this guide, which presents several tests for these patches toward the bottom of the page.
NB: first of all, you must have a valid MX record for your
/var/qmail/control/me domain, otherwise you'll get errors when trying to send to
~alias/qmail-log (more info here).
This library is a prerequisite of the DKIM patch by Manvendra Bhangui, which is part of my package. You must compile this, otherwise the compilation will break.
cd /usr/local/src wget http://notes.sagredo.eu/files/qmail/tar/libdomainkeys-0.69.tar.gz tar xzf libdomainkeys-0.69.tar.gz wget http://notes.sagredo.eu/files/qmail/patches/libdomainkeys-0.69.diff ln -s libdomainkeys-0.69 libdomainkeys cd libdomainkeys chown -R root.root . patch < ../libdomainkeys-0.69.diff make cp libdomainkeys.a /usr/lib
This library is a prerequisite of the SRS patch, which is part of my package. You must install this, otherwise the compilation will break.
wget http://www.libsrs2.org/srs/libsrs2-1.0.18.tar.gz tar xzf libsrs2-1.0.18.tar.gz cd libsrs2-1.0.18 ./configure make make install ldconfig cd ../
Be sure that libsrs2 is actually linked, otherwise you are going to have a qmail-send infinite crash and finally an auto-DoS:
> ldconfig -p|grep libsrs2 libsrs2.so.0 (libc6,x86-64) => /usr/local/lib/libsrs2.so.0 libsrs2.so (libc6,x86-64) => /usr/local/lib/libsrs2.so
In case you decided to install the
libsrs2 library by means of a package provided by your Linux distribution, you should check the path where the library was installed. Check if the file
/usr/local/include/srs2.h actually exists; if not you may have to modify the
srs.c in the netqmail source dir as follows:
#include </usr/local/include/srs2.h>#include </usr/include/srs2.h>
wget http://notes.sagredo.eu/files/qmail/patches/roberto-netqmail-1.06.patch-latest.gz cd netqmail-1.06 gunzip -c ../roberto-netqmail-1.06.patch-latest.gz | patch
The combined patch you downloaded has
chkuser enabled. It’s configured to perform recipient verification and MAV (Mail From: Address Verification).
You can customize your configuration by editing the
chkuser_settings.h file (in
/usr/local/src/netqmail-1.06) before compiling
qmail. In order to enable
chkuser, the following line must be commented out:
#define CHKUSER_STARTING_VARIABLE "CHKUSER_START"
Uncomment to enable the check of user and domain format for sender address. This will reject fake senders without any domain declared (like ).
Uncomment to enable checking of domain MX for rcpt addresses
Uncomment to enable checking of domain MX for sender address
This enables usage of "#" and "+" characters within sender address. It is used by SRS (Sender Rewriting Scheme) products.
As far as my MTA is concerned, this solved an "invalid sender address format" reject message prompted by an email address of a mailman mailing list..
By default the authentication will be denied if the client does not provide the STARTTLS command. If you want to allow connections without TLS, just do
in your run file. Values other than 0 (or not declaring this variable at all) will force TLS before the auth.
By default the auth is allowed with LOGIN or PLAIN mechanism. You are invited to look at the README.auth file for further details concerning the use of the SMTPAUTH environment variable, expecially if you want to use CRAM-MD5.
The BIG-TODO patch included in my combined patch may require that your queue has to be rebuilt. So be aware that all existing messages in the queue will be destroyed when you erase the queue below.
To discover if your
qmail has messages in the queue:
> qmailctl stat /service/qmail-send: up (pid 18127) 6 seconds /service/qmail-send/log: up (pid 18134) 6 seconds /service/qmail-smtpd: up (pid 18126) 6 seconds /service/qmail-smtpd/log: up (pid 18135) 6 seconds /service/qmail-submission: up (pid 18131) 6 seconds /service/qmail-submission/log: up (pid 18132) 6 seconds /service/vpopmaild: up (pid 18129) 6 seconds /service/vpopmaild/log: up (pid 18128) 6 seconds messages in queue: 0 messages in queue but not yet preprocessed: 0
If this will be the first time you install the combined patch (which contains the BIG-TODO patch), you’ll need to take these steps:
qmailctl stop rm -r /var/qmail/queue
If qmail is running stop the services before installing:
Finally install and start
make setup check qmailctl start
If you don’t want to enable SMTP relay (using SMTP/TLS access), you can skip this section.
To secure the smtp authentication you must create the SSL certificate. The certificate must be owned by the user who runs
qmail-smtpd, in our case vpopmail.
> make cert Generating a 1024 bit RSA private key ..................++++++ .......++++++ writing new private key to '/var/qmail/control/servercert.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:IT State or Province Name (full name) [Some-State]:Italy Locality Name (eg, city) :Cagliari Organization Name (eg, company) [Internet Widgits Pty Ltd]:Your Name Organizational Unit Name (eg, section) : Common Name (eg, YOUR name) :smtp.yourdomain.net Email Address :email@example.com > make tmprsadh > chown vpopmail.vchkpw /var/qmail/control/*.pem
It is important that the “Common Name” matches the domain name that your email clients will specify as their SMTP server.
Now let’s create a cronjob to update the certificate every day:
> crontab -e 03 05 * * * /var/qmail/bin/update_tmprsadh > /dev/null 2>&1
Important: If you run
qmail-submission as a user other than
vpopmail, and you’re installing my combined patch, you must adjust
/var/qmail/bin/update_tmprsadh accordingly. Otherwise you’ll probably exceed the connection timeout due to privilege problems, and won’t be able to send messages when connected remotely.
It provides cram-md5, login, plain authentication support for qmail-smtpd (port 587) and qmail-remote.
Added FORCEAUTHMAILFROM environment variable to REQUIRE that authenticated user and 'mail from' are identical.
Added SMTPAUTHMETHOD, SMTPAUTHUSER and SMTP_AUTH_USER env variables for external plugins (see http://qmail-spp.sourceforge.net/doc/)
It implements TLS encrypted and authenticated SMTP between the MTAs and from MUA to MTA. I have adjusted the file
.pem files to
vpopmail, which runs
The POODLE vulnerability has been fixed.
You may be interested to take a look to the page concerning
smtp-auth and TLS testing here.
optionally gets qmail to require TLS before authentication to improve security.
You have to declare FORCETLS=0 if you want to allow the auth without TLS
performs recipient verification and Mail From: Address Verification (MAV).
You may be interested to take a look to this page concerning chkuser testing.
Enables simscan and qmail-dkim to return the appropriate message for each e-mail it refuses to deliver. Simscan rejects with the name of the virus or the spam-score; qmail-dkim rejects with the verification failure message.
It can check incoming mails inside the SMTP daemon, add Received-SPF lines and optionally block undesired transfers.
implements Sender Rewriting Scheme fixing SPF break upon email forwarding. To enable SRS read carefully the configuration instructions above.
This patch enables
qmail to handle large DNS packets.
rereads control/concurrencylocal and control/concurrencyremote files when qmail-send receives a HUP signal.
It sets the spawn limit above 255.
Fixes a compiler error if you set
concurrency higher than 509 in
adds maildirquota support to qmail-pop3d and qmail-local.
qmail-smtpd logging its actions and decisions (search for a line starting with
qmail-smtp:). This is useful for discovering fake IP addresses with bad HELO’s when
qmail-smtpd doesn’t log anything.
adds a user-definable delay after SMTP clients have initiated SMTP sessions, prior to qmail-smtpd responding with "220 ESMTP". It can reject connections from clients which tried to send commands before greeting. You can control the delay via the environment variable
SMTPD_GREETDELAY (was GREETDELAY in the original patch). A value of
SMTPD_GREETDELAY=”30” will delay
qmail-smtpd’s response for 30 seconds.
adds DKIM signing & verification support to qmail at both
qmail-remote/local level and SURBL filtering support to qmail.
The file hier.c modified to chown /var/qmail/control/cache and subdirs to vpopmail.
addresses a problem known as the silly qmail (queue) problem.
qmail use a hashing mechanism in the todo folder similar to that used in the rest of the queue.
qmail-inject from rewriting the null sender, fixing an issue with sieve vacation/reject messages.
Prevents double bounces from hitting your queue a second time provided that you delete the first line from
qmail-smtpd to reject messages if they’re larger than the maximum number of bytes allowed (you can set this value in the
/var/qmail/control/databytes control file).
Provides the ability to archive each email that flows through the system. Archiving only messages from or to certain email addresses is possible as well.
Enables qmail-remote to handle CR (\r) properly, always sending the line breaks as CRLF (\r\n) and avoiding to double the CR (like qmail-remote normally does). This often caused me a broken header when forwarding messages by means of a sieve rule.
By default all outgoing emails are sent through the first IP address on the interface. In case of a multiple IP server this patch makes qmail send outgoing emails with the IP eventually stored in control/outgoingip. The ehlo domain is NOT modified by this patch.
makes qmail-smtpd log a line similar to the following:
@4000000039b89c95026a89b4 mail recv: pid 8155 from <firstname.lastname@example.org> qp 8157
The pid allows you to match the message up with a given tcpserver process and the qp lets you find a particular delivery.
avoids qmail getting large amounts of DNS data we have no interest in and that may overflow our response buffer.
makes qmail rfc2821 compliant
makes qmail rfc2821 compliant
allows you to reject spam and virus looking at the sender's ip address. Added a line to make qmail-smtpd log the reject reason as well as the envelope to facilitate diagnostics.
prevents a problem caused by an MX or other mail routing directive instructing qmail to connect to itself without realizing it's connecting to itself, saving CPU time.
It will hide your Private or Public IP in the email Headers when you are sending Mail as a Relay Client.
causes the various qmail programs to generate date stamps in the local timezone.
qmail-smtpd to accept messages that are terminated with a single
\n instead of the required
allows you to set a limit on how many recipients are specified for any one email message by setting
control/maxrcpt. RFC 2821 section 126.96.36.199 says that an MTA MUST allow at least 100 recipients for each message, since this is one of the favourite tricks of the spammer.
I slightly modified the patch also to log its response.
extra.h to record the Message-ID in the
qmail-send log as explained here towards the bottom of the page. An alias
~alias/.qmail-log had to be added as well to store the
awk command with the regex which retrieves the Message-ID.
Thanks to Simone for the hint.
Be aware that you must have a valid MX record for your FQDN (look at
qmail-send log now appears as follows:
eMPF follows a set of administrator-defined rules describing who can message whom. With this, companies can segregate various parts of their organizations email activities, as well as provide a variety of security-enhancing services.
It's useful in case of spammed servers, to temporarily stop outgoing messages. It adds a line like this in your
2015-03-30 18:05:54.442596500 policy_check: remote email@example.com -> local firstname.lastname@example.org (UNAUTHENTICATED SENDER) 2015-03-30 18:05:54.442612500 policy_check: policy allows transmission
adds the ability to match address evelopes via Regular Expressions (REs) in the qmail-smtpd process.
Added new control file '
control/badrcptto (Tx Luca Franceschini).
control/brtlimit and BRTLIMIT variable to limit max invalid recipient errors before closing the connection.
It works in conjunction with chkuser with both cdb and mysql accounts. Look here for details
It gets qmail to reject relay probes generated by so-called anti-spammers. These relay probes have '!', '%' and '@' in the local (username) part of the address.
Fixed a little bug in 'mail from' address handling (see the patch by Andre Opperman at http://qmail.cr.yp.narkive.com/kBry6GJl/bug-in-qmail-smtpd-c-addrparse-function)
smtpd logging with fixed format (note: 'size' field is evaluated only when control/databytes or DATABYTES are set. An entry 'qlogenvelope' is generated after accepting or rejecting every recipients in the envelope phase, example:
qlogenvelope: result=rejected code=553 reason=rblreject detail=b.barracudacentral.org helo=test.machine.it email@example.com firstname.lastname@example.org relay=no rcpthosts=yes size= authuser= authtype= encrypted= sslverified=no localip=188.8.131.52 localport=25 remoteip=184.108.40.206 remoteport=57502 remotehost= qp= id=39156 qlogenvelope: result=accepted code=250 reason=rcptto detail=chkuser helo=test email@example.com firstname.lastname@example.org relay=no rcpthosts=yes size= authuser= authtype= encrypted= sslverified=no localip=220.127.116.11 localport=25 remoteip=18.104.22.168 remoteport=57742 remotehost= qp= pid=37357
an entry 'qlogreceived' is generated after DATA (message accepted o rejected by qmail-queue)
qlogreceived: result=accepted code=250 reason=queueaccept detail= helo=test.machine.it email@example.com firstname.lastname@example.org relay=yes rcpthosts= size= email@example.com,firstname.lastname@example.org authtype=login encrypted=tls sslverified=no localip=192.168.200.162 localport=25 remoteip=192.168.200.162 remoteport=52602 remotehost= qp=30982 pid=30980
useful in special cases if you temporarily need to reject the null sender (although breaks RFC compatibility). You just need to put 1 (actually any number different from 0) in your control/rejectnullsenders to reject the null sender with 421 error message.
Removes CNAME check in order to avoid getting large amounts of data of no interest in and that may overflow the response buffer.
Originally designed for the purpose of receipt validation, it can also be used to limit the number of email a given IP and/or auth-user and/or domain can send in a given time interval. It has to be used in conjuction with the rcptcheck-overlimit.sh LF's script.
apache clamav dkim dovecot ezmlm fail2ban hacks lamp linux linux-vserver mariadb mediawiki mozilla mysql owncloud patches php proftpd qmail qmailadmin rbl roundcube rsync sieve simscan slackware spamassassin ssh surbl tcprules tex ucspi-tcp vpopmail vqadmin