Patching qmail

January 17, 2022 Roberto Puzzanghera 340 comments


The complete changelog and patch info are inside the README.PATCH file.

  • Jan 17, 2022
    -now qmail-smtpd logs rejects when the client tries to auth when auth is not allowed, or it's not allowed without TLS (a closed connection with no log at all appeared before).
    -added qmail-spp.o to the TARGET file so that it will be purged with "make clean".
    diff here
  • Dec 19, 2021
    -added qmail-spp patch
  • Sep 27, 2021
    -chkuser: now it allows double hyphens "--" in the sender email, like in (diff here)
  • Aug 22, 2021
    -minor fix to qlog: now it logs the auth-type correctly (diff)
  • 2021.06.19
    -chkuser: defined extra allowed characters in sender/rcpt addresses and added the slash to the list (tx Thomas). diff here
  • 2021.06.12
    -RSA key and DH parameters are created 4096 bit long also in Makefile-cert. qmail-smtpd.c and qmail-remote.c updated accordingly (tx Eric Broch).
    -Makefile-cert: the certs will be owned by vpopmail:vchkpw
  • 2021.03.21 RSA key and DH parameters increased to 4096 bits
  • 2020.12.04
    received.c: some adjustments to compile with gcc-10 (diff here)

Playing with qmail-spp

December 19, 2021 Roberto Puzzanghera 0 comments

qmail-spp provides plug-in support for qmail-smtpd. It allows you to write external programs and use them to check SMTP command argument validity. The plug-in can trigger several actions, like denying a command with an error message, logging data, adding a header and much more.

  • Author: Pawel Foremski
  • More info here

Today I played for the first time with an ancient patch for qmail: qmail-spp and I was really impressed for the ease of use and the elegance of its code, which is inserted inside qmail-smtpd.c with a few touches, despite of the many things that it can do when installed and enabled.

It can run a custom plugin in any language and at any level of the smtp session, grabbing the environment variables, writing into stderr or blocking the smtp session with a return error for the sender.

In no time at all I managed to understand its logic and write a small plugin by adapting a c program I wrote for s/qmail a few months ago to check the validity of the recipient.

Of course I decided to add this patch to my combo. I've just modified the way it has to be enabled, just not to bother those who don't want to touch their run scripts. So, while the original patch is enabled by default, I modified things a little bit so that you have to manually enable it by exporting the variable ENABLE_SPP in your run scripts. Therefore the original NOSPP variable is useless.

Have fun!

Roundcube webmail

December 1, 2021 Roberto Puzzanghera 7 comments

Roundcube is a full featured webmail with a nice interface.


  • Dic 1, 2021
    RC upgraded to v. 1.5.1
  • Gen 3, 2021
    disabled the SMTP authentication when sending messages via RC. SMTP port changed to 25.

Migrating to the last version

The following "migration" notes didn't work fine this time, when upgrading to v. 1.5.0 from v. 1.4.11. When running the script I got a couple of error concerning the database schema:

ERROR: Error in DDL upgrade 2020020101: [1091] Can't DROP 'user_id_fk_cache_index'; check that column/key exists

This was very annoying. I cured it manually installing all the database foreign keys. Look at this page for more info. I also had to create the 'contactgroupmembers', but I think it would be created by the script in case of no errors.

I solved this one upgrading my mariadb from 10.0 to 10.5

ERROR: Error in DDL upgrade 2020091000: [1709] Index column size too large. The maximum column size is 767 bytes.

So, for what concerns this major update, it could be better for most of us to perform a clean installation.

I'm leaving the following "upgrade" notes for future upgrades, hoping that they may remain valid.

Installing and configuring vpopmail

October 30, 2021 Roberto Puzzanghera 75 comments

Vpopmail provides an easy way to manage virtual email domains and non /etc/passwd email accounts on your mail servers.

The purpose of this note is to show how to use Mysql as the authentication system. Having a users database also offers the advantage of communicating with the database via PHP, and creating web-based user interfaces to manage accounts.

Patch details

The patch we'll apply is the result of the following bunch of patches:

  • sql-aliasdomains patch, which makes vpopmail save the aliasdomains to MySQL. This makes the dovecot sql auth driver aware of the aliasdomains, provided that you modify the sql query as well (see the dovecot page for more info).
  • defaultdelivery patch, which makes vpopmail to copy your favourite delivery agent (stored in QMAILDIR/control/defauldelivery) into the .qmail-default file of any newly created domain, overriding the default vpopmail's behaviour, where vpopmail copies its delivery agent vdelivermail. You have to configure with --enable-defaultdelivery to enable this.
    If the functionality is disabled (--disable-defaultdelivery, which is the default option) vdelivermail is installed with the "delete" option instead of "bounce-no-mailbox", which is not reasonable anymore.
  • dovecot-pwd_query patch
    If you want to use the dovecot's sql auth driver with one table for each domain (--disable-many-domains) you have to heavily customize your password query. With this patch vpopmail installs the sql procedure and functions in the database when you create a new domain. The procedure can be called by dovecot to perform the auth.
    The sql stuff supports aliasdomains and mysql limits and will be loaded from ~/vpopmail/etc/pwd-query_disable-many-domains.sql. You can customize the sql procedure editing this file.
    You have to configure with --enable-mysql-bin=PATH as we have to install the procedure calling the mysql bin as a shell command (no way to load an sql query from a file in C language, comments welcome).
  • vusaged configure patch
    It seems that at least on Debian 11 vusaged refuses to run the configure successfully, as the mysql libraries
    are not linked (configure: error: No vauth_getpw in libvpopmail). After some inspection, I noticed that avoiding the break of the configure command, the following make command will find libmysqlclient and compile with no problems, and the program works as expected.
    NB: an autoreconf -f -i into the vusaged directory is needed before configuring, as the script was modified.
  • recipient check patch. It can be used with Erwin Hoffmann's s/qmail to accomplish the recipient check. Not important in my installation, look at doc/README.vrcptcheck for more info.
  • gcc-10-compat patch, which gets vpopmail to compile with gcc-10