Configuring qmail

September 14, 2023 Roberto Puzzanghera 85 comments

More info on Life with qmail
README.vdelivermail

Changelog

Sep 14, 2023
- simsizelimit control file defined
Jun 18, 2023
- defined the variable QMAILDIR in all run scripts in order to manage installations of qmail in directories different from default /var/qmail
- /home/vpopmail is now ~vpopmail in order to manage installations of vpopmail in directories different from default /home/vpopmail
- defined the variable TCPRULES_DIR on top of all run scripts
Mar 2, 2023
- vusaged moved to daemontools

Defining alias and control files

QMAILDIR=/var/qmail
echo 3 > $QMAILDIR/control/spfbehavior
echo "| ~vpopmail/bin/vdelivermail '' delete" > $QMAILDIR/control/defaultdelivery
echo 200 > $QMAILDIR/control/concurrencyincoming
echo postmaster > $QMAILDIR/control/bouncefrom
echo 20000000 > $QMAILDIR/control/databytes
echo mydomain.tld > $QMAILDIR/control/doublebouncehost
echo postmaster > $QMAILDIR/control/doublebounceto
echo 272800 > $QMAILDIR/control/queuelifetime
echo 30000000 > $QMAILDIR/control/softlimit
echo 100 > $QMAILDIR/control/maxrcpt
echo 2 > $QMAILDIR/control/brtlimit
echo 10000000 > /var/qmail/control/simsizelimit

cd /usr/local/src/netqmail-1.06
./config-fast smtp.mydomain.tld

When you run ./config-fast it will automatically populate these files: defaultdomain, locals, me, plusdomain, rcpthosts. smtp.yourdomain.tld will be the name of your MTA and it must have a valid MX record.

defaultdomain when you have many domains on the same server (defined later in the virtualhost file) this is the default domain
locals domains that we deliver locally (qmail-send via qmail-lspawn program). Other domains are spawned by qmail-rspawn and delivered to other MTAs. The domains listed in locals should not be confused with virtualdomains; infact, qmail-send doesn't even read virtualdomains if the recipient domain is already listed in locals and in that case you'll get a "no mailbox" error message. This is the reason why it's not a good idea to use a virtualdomain as the name of the MTA.
me the name of the server. This is the domain name that appers in the from field when you receive system messages, for instance. It's also the domain used in the HELO (i.e. the greeting at the very beginning of the SMTP conversation). It must have a valid MX record in our DNS, and also an SPF record as we'll see later.
plusdomain domain substituted for trailing "+"
rcpthosts Domains that we accept mail for. Later you will see how chkuser rejects incoming emails for non existing recipients.
spfbehavior concerns the SPF configuration.
softlimit sets soft resource limits for qmail-smtpd
databytes is the max number of bytes in message (0=no limit)
doublebounceto is the account which will receive double-bounce messages. If you’re using my combined patch, you can erase the first line of /var/qmail/control/doublebounceto to delete these unwanted messages before they’re injected into the local queue.
brtlimit is the maximum allowed numer of not found recipients. The connection with the remote host will be closed if this number is exceeded (brtlimit patch)
defaultdelivery is the default .qmail file. It tells qmail how to deliver the email. In case you didn't understand yet how the delivery is done, please read at this point the relaying chapter of Life with qmail and expecially the README.vdelivermail that comes with vpopmail, which explains how the .qmail files are used.
simsizelimit We define in advance a variable for simscan, which we'll install later. It defines the maximum size in bytes of the messages that simscan will pass to spamassassin.

You can find an exhaustive presentation of all control configuration files on Life with qmail book http://www.lifewithqmail.org/lwq.html#configuration

Setup the primary administrator's email address. This address will receive mail for root, postmaster, and mailer-daemon. Replace postmaster@yourdomain.tld with the administrator email address (postmaster):

cd $QMAILDIR/alias
echo "postmaster@mydomain.tld" > .qmail-postmaster
ln -s .qmail-postmaster .qmail-mailer-daemon
ln -s .qmail-postmaster .qmail-root
chmod 644 .qmail*

Setup the log dirs

The log dirs belong to qmaill.nofiles user and should not be accessible by other users

mkdir -p /var/log/qmail

chown -R qmaill.nofiles /var/log/qmail
chgrp root /var/log/qmail
chmod -R og-wrx /var/log/qmail
chmod g+rx /var/log/qmail

Defining the supervise scripts

References: tcpserver page

Download the startup scripts from here and untar

cd $QMAILDIR 
wget https://notes.sagredo.eu/files/qmail/supervise.tar.gz 
tar xzf supervise.tar.gz
chown -R root:root rc supervise
rm supervise.tar.gz

You can see the rc excutable, which is the qmail-start script, and the supervise folder:

rc
supervise/
| 
|----qmail-smtpd/
|    |
|    |-----run
|    |-----log/
|          |
|          |---run
|
|----qmail-smtpsd/
|    |
|    |-----run
|    |-----log/
|          |
|          |---run
|
|----qmail-submission/
|    |
|    |-----run
|    |-----log/
|          |
|          |---run
|
|----qmail-send/
|    |
|    |-----run
|    |-----log/
|          |
|          |---run
|
|----vpopmaild/
|    |
|    |-----run
|    |-----log/
|          |
|          |---run
|
|----vusaged/
     |
     |-----run
     |-----log/
           |
           |---run

When you create symbolic links to a supervise directory in the /service dir, the run command will be executed at boot time when /command/svcscanboot is launched, i.e. at boot time.

QMAILDIR=/var/qmail
ln -s $QMAILDIR/supervise/qmail-smtpd      /service
ln -s $QMAILDIR/supervise/qmail-smtpsd     /service
ln -s $QMAILDIR/supervise/qmail-submission /service
ln -s $QMAILDIR/supervise/qmail-send       /service
ln -s $QMAILDIR/supervise/vpopmaild        /service
ln -s $QMAILDIR/supervise/vusaged          /service
ln -s $QMAILDIR/admin/clear                /service

Let's see more in detail the supervise scripts that we have downloaded. Many lines are still commented out because concern features that will be activated later. For the moment only the basic functionalities remain active.

File qmail/rc

#!/bin/sh 

QMAILDIR=/var/qmail 

# Comment out to disable dkim sign at qmail-remote level 
DKIMSIGN=1 

if [ -n $DKIMSIGN ]; then 
 # Sign with 2048 bit RSA. Comment out DKIMSIGNOPTIONS to sign with 1024 bit 
 DKIMSIGNOPTIONS="-z 2" 
 DKIMDOMAIN=`cat $QMAILDIR/control/dkimdomain` 

 # DKIM sign at qmail-remote level 
 exec env - PATH="$QMAILDIR/bin:$PATH" \ 
 QMAILREMOTE=$QMAILDIR/bin/spawn-filter  \ 
 DKIMSIGNOPTIONS="$DKIMSIGNOPTIONS" \ 
 DKIMDOMAIN="$DKIMDOMAIN" \ 
 FILTERARGS=$QMAILDIR/bin/dk-filter \ 
 qmail-start "`cat $QMAILDIR/control/defaultdelivery`" 

else 
 # Use this if you are signing at qmail-smtpd level or you don't want to sign at all 
 exec env - PATH="$QMAILDIR/bin:$PATH" \ 
 qmail-start "`cat $QMAILDIR/control/defaultdelivery`" 
fi

Do not bother of the lines concerning the DKIM settings. The server can work with those lines active. We will cover that topic later in this guide.

File qmail/supervise/qmail-smtpd/run

#!/bin/sh

QMAILDIR=/var/qmail
QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`
MAXSMTPD=`cat $QMAILDIR/control/concurrencyincoming`
SOFTLIMIT=`cat $QMAILDIR/control/softlimit`
LOCAL=`head -1 $QMAILDIR/control/me`
TCPRULES_DIR=~vpopmail/etc

#export REJECTNULLSENDERS=1
#export SMTPAUTH="!cram"

# qmail-spp plugins
#export ENABLE_SPP=1
#export HELO_DNS_CHECK=PLRIV

# enable greetdelay for qmail-smtpd
export SMTPD_GREETDELAY=20
export DROP_PRE_GREET=1

# greylisting
#export JGREYLIST_DIR="$QMAILDIR/jgreylist"
#export JGREYLIST_LOG_SMTP=1

# enable chkuser
export CHKUSER_START=ALWAYS

# DKIM - SURBL configuration
# DKIMQUEUE and SURBLQUEUE are front-ends of qmail-queue
export SURBL=1 # Comment out to enable SURBL filtering
#export QMAILQUEUE=$QMAILDIR/bin/simscan # do not execute SURBL nor DKIM filtering
export QMAILQUEUE=$QMAILDIR/bin/surblqueue # executes surblfilter
export SURBLQUEUE=$QMAILDIR/bin/simscan    # executes simscan after SURBL

#### qmail-dkim disabled => no dkim verification
#### to have verification active export SURBLQUEUE=$QMAILDIR/bin/qmail-dkim

#export SURBLQUEUE=$QMAILDIR/bin/qmail-dkim # executes qmail-dkim after surblfilter
export DKIMQUEUE=$QMAILDIR/bin/simscan     # simscan is executed after qmail-dkim
export DKIMKEY=/usr/local/etc/domainkeys/%/default
# DKIM verification. Use carefully
export DKIMVERIFY="FGHKLMNOQRTVWp"
# allow msg without "subject" in the h= list
export UNSIGNED_SUBJECT=1
# avoid verification of outgoing messages
export RELAYCLIENT_NODKIMVERIFY=1

# turn off TLS on port 25
#export DISABLETLS="1"

# require that authenticated user and 'mail from' are identical
export FORCEAUTHMAILFROM="1"

# rcptcheck-overlimit. Limits the number of emails sent by relayclients
if [ -x $QMAILDIR/bin/rcptcheck-overlimit.sh ]; then
  export RCPTCHECK=$QMAILDIR/bin/rcptcheck-overlimit.sh
  export RCPTCHECKRELAYCLIENT="1"
fi

# enable simscan debug
#export SIMSCAN_DEBUG=4
#export SIMSCAN_DEBUG_FILES=2

exec /usr/local/bin/softlimit -m "$SOFTLIMIT" \
    /usr/local/bin/tcpserver -v -R -l "$LOCAL" \
    -x $TCPRULES_DIR/tcp.smtp.cdb -c "$MAXSMTPD" \
    -u "$QMAILDUID" -g "$NOFILESGID" 0 25 \
    $QMAILDIR/bin/qmail-smtpd /bin/true 2>&1

Note that the standard smtp (port 25) does not allow the authentication.

You have to adjust the resource limit (softlimit in bytes). Each system is different, and has different requirements. Life with qmail suggests just 2MB. You have to experiment the correct value increasing by steps of 1MB, especially once you have loaded spamassassin, clamAV and simscan (the mail scanner).

We'll cover GREETDELAY and DKIM later.

File qmail/supervise/qmail-smtpd/log/run

#!/bin/sh

LOGUSER="qmaill"
LOGDIR="/var/log/qmail/smtpd"
LOGDIRQLOG="/var/log/qmail/smtpd/qlog"

if [ -x /usr/local/bin/archive_qmail_qlog ]; then
  exec /usr/local/bin/setuidgid $LOGUSER /usr/local/bin/multilog t n5 s16777215 $LOGDIR \
  	n5 s16777215 '-*' '+*qlog*' !/usr/local/bin/archive_qmail_qlog $LOGDIRQLOG
else
  exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s16777215 $LOGDIR
fi

If you want to have a dir (/var/log/qmail/smtpd/qlog) which saves separately just the "qlogenvelope" lines as follows:

@400000005855db3028811e24 qlogenvelope: result=accepted code=250 reason=rcptto detail=chkuser helo=smtp.senderdomain.com mailfrom=sender@senderdomain.com rcptto=user@rcptdomain.com relay=no rcpthosts=yes size= authuser= authtype= encrypted= sslverified=no localip=10.0.0.4 localport=25 remoteip=83.103.72.231 remoteport=43618 remotehost= qp= pid=11928
@400000005855db322a892324 qlogreceived: result=accepted code=250 reason=queueaccept detail= helo=smtp.senderdomain.com mailfrom=sender@senderdomain.com rcptto=user@rcptdomain.com relay=no rcpthosts= size=2689 authuser= authtype= encrypted= sslverified=no localip=10.0.0.4 localport=25 remoteip=83.103.72.231 remoteport=43618 remotehost= qp=11934 pid=11928

then create the archive_qmail_qlog

cat > /usr/local/bin/archive_qmail_qlog << __EOF__
#!/bin/sh
tai64nlocal >> /var/log/qmail/smtpd/qlog/qmail-smtpd.log
# let's prepare the same for qmail-smtpsd
tai64nlocal >> /var/log/qmail/smtpsd/qlog/qmail-smtpsd.log
__EOF__
chmod +x /usr/local/bin/archive_qmail_qlog

In this way we have the /var/log/qmail/smtpd/qmail-smtpd.log file with just the qlog lines in human-readable time format:

2016-01-29 13:15:17.677946500 qlogenvelope: result=accepted code=250 reason=rcptto detail=chkuser helo=smtp.senderdomain.com mailfrom=sender@senderdomain.com rcptto=user@rcptdomain.com relay=no rcpthosts=yes size= authuser= authtype= encrypted= sslverified=no localip=10.0.0.4 localport=25 remoteip=83.103.72.231 remoteport=43618 remotehost= qp= pid=11928
2016-01-29 13:15:17.677946500 qlogreceived: result=accepted code=250 reason=queueaccept detail= helo=smtp.senderdomain.com mailfrom=sender@senderdomain.com rcptto=user@rcptdomain.com relay=no rcpthosts= size=2689 authuser= authtype= encrypted= sslverified=no localip=10.0.0.4 localport=25 remoteip=83.103.72.231 remoteport=43618 remotehost= qp=11934 pid=11928

You may want to rotate this log file saving a "qlog" file like this in your logrotate configuration (/etc/logrotate.d/qlog in my Slackware):

cat > /etc/logrotate.d/qlog << __EOF__
/var/log/qmail/smtpd/qlog/qmail-smtpd.log /var/log/qmail/smtpsd/qlog/qmail-smtpsd.log {
missingok
notifempty
delaycompress
rotate 50
daily
minsize 2M
create 0644 qmaill root
}
__EOF__

File /var/qmail/supervise/qmail-smtpsd/run

#!/bin/sh

QMAILDIR=/var/qmail
QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`
MAXSMTPD=`cat $QMAILDIR/control/concurrencyincoming`
SOFTLIMIT=`cat $QMAILDIR/control/softlimit`
LOCAL=`head -1 $QMAILDIR/control/me`
TCPRULES_DIR=~vpopmail/etc

SSL_DIR="$QMAILDIR/control"
SSL_CHROOT="$SSL_DIR"
SSL_UID=$QMAILDUID
SSL_GID=$NOFILESGID
CERTFILE="$SSL_DIR/servercert.pem"
KEYFILE="$SSL_DIR/servercert.pem"
DHFILE="$SSL_DIR/dh4096.pem"
export SSL_UID SSL_GID SSL_CHROOT
export CERTFILE KEYFILE DHFILE

#export REJECTNULLSENDERS=1
#export SMTPAUTH="!cram"

# qmail-spp plugins
#export ENABLE_SPP=1
#export HELO_DNS_CHECK=PLRIV

# This enables greetdelay for qmail-smtpd
export SMTPD_GREETDELAY=20
export DROP_PRE_GREET=1

# greylisting
#export JGREYLIST_DIR="$QMAILDIR/jgreylist"
#export JGREYLIST_LOG_SMTP=1

# enable chkuser
export CHKUSER_START=ALWAYS

# DKIM - SURBL configuration
# DKIMQUEUE and SURBLQUEUE are front-ends of qmail-queue
export SURBL=1 # Comment out to enable SURBL filtering
#export QMAILQUEUE=$QMAILDIR/bin/simscan # do not execute SURBL nor DKIM filtering
export QMAILQUEUE=$QMAILDIR/bin/surblqueue # executes surblfilter
export SURBLQUEUE=$QMAILDIR/bin/simscan    # executes simscan after SURBL

#### qmail-dkim disabled => no dkim verification
#### to have verification active export SURBLQUEUE=$QMAILDIR/bin/qmail-dkim

#export SURBLQUEUE=$QMAILDIR/bin/qmail-dkim # executes qmail-dkim after surblfilter
export DKIMQUEUE=$QMAILDIR/bin/simscan     # simscan is executed after qmail-dkim
export DKIMKEY=/usr/local/etc/domainkeys/%/default
# DKIM verification. Use carefully
export DKIMVERIFY="FGHKLMNOQRTVWp"
# allow msg without "subject" in the h= list
export UNSIGNED_SUBJECT=1
# avoid verification of outgoing messages
export RELAYCLIENT_NODKIMVERIFY=1

# turn off TLS on port 25
#export DISABLETLS="1"

# require that authenticated user and 'mail from' are identical
export FORCEAUTHMAILFROM="1"

# rcptcheck-overlimit. Limits the number of emails sent by relayclients
if [ -x $QMAILDIR/bin/rcptcheck-overlimit.sh ]; then
  export RCPTCHECK=$QMAILDIR/bin/rcptcheck-overlimit.sh
  export RCPTCHECKRELAYCLIENT="1"
fi

# enable simscan debug
#export SIMSCAN_DEBUG=4
#export SIMSCAN_DEBUG_FILES=2

exec /usr/local/bin/softlimit -m "$SOFTLIMIT" \
    /usr/local/bin/sslserver -seV -Rp -l "$LOCAL" \
    -Xx $TCPRULES_DIR/tcp.smtp.cdb -c "$MAXSMTPD" \
    -u "$QMAILDUID" -g "$NOFILESGID" 0 smtps \
    $QMAILDIR/bin/qmail-smtpd /bin/true 2>

File qmail/supervise/qmail-smtpsd/log/run

#!/bin/sh

LOGUSER="qmaill"
LOGDIR="/var/log/qmail/smtpsd"
LOGDIRQLOG="/var/log/qmail/smtpsd/qlog"

if [ -x /usr/local/bin/archive_qmail_qlog ]; then
  exec /usr/local/bin/setuidgid $LOGUSER /usr/local/bin/multilog t n5 s16777215 $LOGDIR \
  	n5 s16777215 '-*' '+*qlog*' !/usr/local/bin/archive_qmail_qlog $LOGDIRQLOG
else
  exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s16777215 $LOGDIR
fi

File qmail/supervise/qmail-send/run

#!/bin/sh
exec /var/qmail/rc

File qmail/supervise/qmail-send/log/run

#!/bin/sh
exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s16000000 n200 /var/log/qmail/send

File qmail/supervise/qmail-submission/run

This service makes the MTA also act as an outgoing relay, but the user must authenticate (with TLS encryption).

#!/bin/sh

QMAILDIR=/var/qmail
QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`
MAXSMTPD=`cat $QMAILDIR/control/concurrencyincoming`
SOFTLIMIT=`cat $QMAILDIR/control/softlimit`
LOCAL=`head -1 $QMAILDIR/control/me`
TCPRULES_DIR=~vpopmail/etc

# You MUST export this, otherwise you'd get a 30 sec timeout
# "!" if you want the submission feature (auth required)
export SMTPAUTH="!"

# This enables greetdelay for qmail-smtpd.
export SMTPD_GREETDELAY=3
export DROP_PRE_GREET=1

# This enables chkuser
export CHKUSER_START=ALWAYS

# This makes qmail to allow connections without TLS (default 1)
#export FORCETLS=0

# This turns off TLS on port 587 (default 0)
#export DISABLETLS=1

# Requires that authenticated user and 'mail from' are identical (default 0)
export FORCEAUTHMAILFROM=1

# rcptcheck-overlimit. Limits the number of emails sent by relayclients
#export RCPTCHECK=$QMAILDIR/bin/rcptcheck-overlimit.sh
#export RCPTCHECKRELAYCLIENT=1

exec /usr/local/bin/softlimit -m "$SOFTLIMIT" \
    /usr/local/bin/tcpserver -v -R -l "$LOCAL" \
    -x $TCPRULES_DIR/tcp.submission.cdb -c "$MAXSMTPD" \
    -u "$QMAILDUID" -g "$NOFILESGID" 0 587 \
    $QMAILDIR/bin/qmail-smtpd \
    ~vpopmail/bin/vchkpw /bin/true 2>&1

Note the use of vchkpw in conjunction with qmail-smtpd to ensure authentication. The connection requires TLS enabled. This is the reason why we opened a separate secure connection on port 587 to allow remote clients to use our MTA as a relay.

The SMTPAUTH variable is related to the authentication patch. You are invited to take a look to the README.auth file for further details.

File qmail/supervise/qmail-submission/log/run

#!/bin/sh

LOGUSER="qmaill"
LOGDIR="/var/log/qmail/submission"

exec /usr/local/bin/setuidgid $LOGUSER /usr/local/bin/multilog t s16000000 n200 $LOGDIR

File qmail/supervise/vpopmaild/run

#!/bin/sh
QMAILDUID=`id -u root`
NOFILESGID=`id -g root`
VPOPMAILID=`id -g vpopmail`

exec /usr/local/bin/softlimit -m 30000000 \
    /usr/local/bin/tcpserver -v -H -R -l 0 \
    -u $QMAILDUID -g $NOFILESGID 0 $VPOPMAILID \
    ~vpopmail/bin/vpopmaild 2>&1

vpopmaild is important when connecting to vpopmail via webmail to change the password, for instance.

File qmail/supervise/vpopmaild/log/run

#!/bin/sh

LOGUSER="qmaill"
LOGDIR="/var/log/qmail/vpopmail"

exec /usr/local/bin/setuidgid $LOGUSER /usr/local/bin/multilog t $LOGDIR

File qmail/supervise/vusaged/run

#!/bin/sh
exec ~vpopmail/bin/vusaged 2>&1

File qmail/supervise/vusaged/log/run

#!/bin/sh
exec setuidgid qmaill /usr/local/bin/multilog t /var/log/qmail/vusaged

cronjobs

To backup the log files of the qmail services we'll use the convert-multilog script from John Simpson (thanks to the author and to Marc for the suggestion) who describes the script as follows:

convert-multilog is a script which searches "/service/*/log/main" for any "@4*" files (the automatic cut-off files generated by multilog), converts their timestamps from tai64n to human-readable format, and writes them to /var/log/{service}.{date}. Once the lines from a given "@4*" file have been converted, the file is deleted.

The log files are saved separated by date, for example

-rw-r--r-- 1 root   root   259558 Aug 24 12:21 qmail-smtpd.2014-08-20
-rw-r--r-- 1 root   root   806917 Aug 24 12:21 qmail-smtpd.2014-08-21
-rw-r--r-- 1 root   root  1523116 Aug 24 12:21 qmail-smtpd.2014-08-22
-rw-r--r-- 1 root   root   364022 Aug 24 12:21 qmail-smtpd.2014-08-23

Inside each file the date is now human-readable

2014-08-23 00:31:49.503947500 tcpserver: status: 1/20

This is very useful when you have to do quick searches.

Install like this:

mkdir -p /var/log/qmail/backup
wget -O  /usr/local/bin/convert-multilog https://notes.sagredo.eu/files/qmail/convert-multilog
chmod +x /usr/local/bin/convert-multilog

ln -s /var/log/qmail/send       /service/qmail-send/log/main 
ln -s /var/log/qmail/smtpd      /service/qmail-smtpd/log/main 
ln -s /var/log/qmail/smtpsd     /service/qmail-smtpsd/log/main
ln -s /var/log/qmail/submission /service/qmail-submission/log/main

NB: the script that you have downloaded is my patched version, which gains compatibility with the readable timeformat (daemontools' multilog_readable-datetime patch). If ypu decided not to install that patch, then download the original convert-multilog program.

Now set up a cronjob once a day (crontab -e):

59 2 * * * /usr/local/bin/convert-multilog 1> /dev/null

Since we want to convert each log file every day, we have to rotate them on a daily basis. So we'll add something like this to our crontab:

0 0 * * * /usr/local/bin/svc -a /service/qmail-submission/log
0 0 * * * /usr/local/bin/svc -a /service/qmail-smtpd/log
0 0 * * * /usr/local/bin/svc -a /service/qmail-smtpsd/log
0 0 * * * /usr/local/bin/svc -a /service/qmail-send/log
0 0 * * * /usr/local/bin/svc -a /service/vpopmaild/log
0 0 * * * /usr/local/bin/svc -a /service/vusaged/log

qmailctl script

Reference: Life with qmail
Download qmailctl (thanks to Sam Tang)

As usual we will put the script in /usr/local/bin and give it the +x flag.

wget -O /usr/local/bin/qmailctl https://notes.sagredo.eu/files/qmail/qmailctl
chmod +x /usr/local/bin/qmailctl

The startup script below does the following:

Starts/stops the services
Calls tcprules to reload tcp.smtp.cdb and tcp.submission.cdb
Shows the status of the services and the queue
Shows the up/down status of some other related daemons
Shows the the date of the clamav database

Note that it starts and stops vpopmaild also, and starts both normal SMTP on port 25, and the submission service on port 587, where SMTP authentication is required to perform outgoing relay for remote users. In any event, be sure to review the service list to make sure it reflects the services you want to provide.

#!/bin/bash
#
# tx Sam Tang
#
# May 25, 2022
# a few modifications by Roberto Puzzanghera to avoid error strings in the service uptime when service is stopped
#
# Aug 07, 2022
# now the script exits if services are not started with svscanboot or the supervise script is missing
#

# Put here the services you want to manage
svclist="qmail-smtpd qmail-smtpsd qmail-submission qmail-send vpopmaild vusaged"
# Put here the services want monitoring
servicelist="dovecot clamd freshclam spamd solr httpd mariadb fail2ban"

QMAILDIR=/var/qmail
QMAILDUID=`id -u qmaild`
NOFILESGID=`id -g qmaild`
TCPRULES_DIR=~vpopmail/etc

PATH=$QMAILDIR/bin:/bin:/usr/bin:/usr/local/bin:/usr/local/sbin
export PATH 

function show_uptime() {
	re='^[0-9]+$'
	org="$(svstat /service/$1 | awk '{print $2,$3,$4;}' | sed 's/up/[ up ]/g' | sed 's/down/[ down ]/g' | sed ''/up/s//`printf "\033[1\;32mup\033[0m"`/'' | sed ''/down/s//`printf "\033[1\;31mdown\033[0m"`/'')"
	sec="$(svstat /service/$1 | awk '{print $5;}')"
	if ! [[ $sec =~ $re ]]; then
		sec="$(svstat /service/$1 | awk '{print $3;}')"
    fi
	d=$(( $sec / 86400))
	h=$(( $(($sec - $d * 86400)) / 3600 ))
	m=$(( $(($sec -d * 86400 - $h * 3600)) / 60 ))
	s=$(($sec -d * 86400 - $h * 3600 - $m * 60))

	if [ $sec -le 60 ]; then
		if [[ "$(svstat /service/qmail-smtpd | awk '{print $2}')" = 'down' ]]; then
			printf "%-22s %s %s %s %s %s\n" "$1:" $org
		else
			printf "%-22s %s %s %s %s %s %s seconds\n" "$1:" $org $s
		fi
	else
		printf "%-22s %s %s %s %s %s %3s day(s), %02d:%02d:%02d\n" "$1:" $org $d $h $m $s
	fi
}

# check if qmail has been sttarted at boot time
function svscan_check() {
	if ! pgrep -x "svscanboot" > /dev/null; then
		echo "/command/svscanboot not running. Please stat qmail running:"
		echo "qmailctl boot"
		echo "or"
		echo "/command/svscanboot"
		exit 1
	fi
}

case "$1" in
  start)
    svscan_check
    echo "Starting qmail"

    for svc in $svclist ; do
	if [ ! -x /service/$svc ]; then
	  echo $svc service script not found
    	elif svok /service/$svc ; then
     	  svc -u /service/$svc
     	else
     	  echo $svc service not running
     	fi
    done

    if [ -d /var/lock/subsys ]; then
      touch /var/lock/subsys/qmail
    fi
    ;;
  stop)
    svscan_check
    echo "Stopping qmail..."
    for svc in $svclist ; do
      if [ ! -x /service/$svc ]; then
        echo $svc service script not found
	  else
      	echo " $svc"
      	svc -d /service/$svc
	  fi
    done
    if [ -f /var/lock/subsys/qmail ]; then
    rm /var/lock/subsys/qmail
    fi
    ;;
  stat)
    svscan_check
    for svc in $svclist ; do
      if [ ! -x /service/$svc ]; then
		echo $svc service script not found
	  else
        show_uptime $svc
        show_uptime "$svc/log"
	  fi
    done
    echo ""
    for service in $servicelist ; do
      printf "%-22s " "$service status:"
      if (( $(ps -ef | grep -v grep | grep $service | wc -l) > 0 ))
      then
          echo -e "[ \033[1;32mup\033[m ]"
      else
          echo -e "[ \033[1;31mdown\033[m ]"
      fi
    done
    if [ -f $QMAILDIR/control/simversions.cdb ]; then
    	printf "\nClamAV database updated at: "
	stat --printf=%y $QMAILDIR/control/simversions.cdb | cut -d. -f1
    fi
    if [ -f $QMAILDIR/users/assign ]; then
	printf "Total Domains: "
	wc -l < $QMAILDIR/users/assign
    fi
    echo ""
    qmail-qstat
    ;;
  doqueue|alrm|flush)
    svscan_check
    echo "Sending ALRM signal to qmail-send."
    svc -a /service/qmail-send
    ;;
  queue)
    svscan_check
    qmail-qstat
    qmail-qread
    ;;
  reload|hup)
    svscan_check
    echo "Sending HUP signal to qmail-send."
    svc -h /service/qmail-send
    ;;
  pause)
    svscan_check
    for svc in $svclist ; do
      echo "Pausing $svc"
      svc -p /service/$svc
    done
    ;;
  cont)
    svscan_check
    for svc in $svclist ; do
      echo "Continuing $svc"
      svc -c /service/$svc
    done
    ;;
  restart)
    svscan_check
    echo "Restarting qmail:"
    for svc in $svclist ; do
      if [ "$svc" != "qmail-send" ] ; then
        echo "* Stopping $svc."
        svc -d /service/$svc
      fi
    done
    echo "* Sending qmail-send SIGTERM and restarting."
    svc -t /service/qmail-send
    for svc in $svclist ; do
      if [ "$svc" != "qmail-send" ] ; then
        echo "* Restarting $svc."
        svc -u /service/$svc
      fi
    done
    ;;
  cdb)
    if ! grep '\#define POP_AUTH_OPEN_RELAY 1' ~vpopmail/include/config.h >/dev/null; then
      (cd $TCPRULES_DIR ; cat tcp.smtp | tcprules tcp.smtp.cdb tcp.smtp.tmp)
      echo "Updated tcp.smtp.cdb."
      (cd $TCPRULES_DIR ; cat tcp.submission | tcprules tcp.submission.cdb tcp.submission.tmp)
      echo "Updated tcp.submission.cdb."
    else
      ~vpopmail/bin/clearopensmtp
      echo "Ran clearopensmtp."
    fi
    ;;
  clear)
    svscan_check
    echo "Clearing readproctitle service errors with ................."
    svc -o /service/clear
    ;;
  kill)
    svscan_check
    echo "First stopping services ... "
    for svc in $svclist ; do
    	if svok /service/$svc ; then
            svc -d /service/$svc
            svc -d /service/$svc/log
    	fi
    done
    echo "Now sending processes the kill signal ... "
        killall -g svscanboot
    echo "done"
    ;;
  boot)
    echo "Starting qmail"
    /command/svscanboot &
    ;;
  reboot)
    $0 kill
    sleep 5
    $0 boot
    ;;
  help)
    cat <<HELP
    stop -- stops mail service (smtp connections refused, nothing goes out)
   start -- starts mail service (smtp connection accepted, mail can go out)
   pause -- temporarily stops mail service (connections accepted, nothing leaves)
    cont -- continues paused mail service
    stat -- displays status of mail service
     cdb -- rebuild the tcpserver cdb file for smtp
 restart -- stops and restarts smtp, sends qmail-send a TERM & restarts it
 doqueue -- sends qmail-send ALRM, scheduling queued messages for delivery
  reload -- sends qmail-send HUP, rereading locals and virtualdomains
   queue -- shows status of queue
    alrm -- same as doqueue
   flush -- same as doqueue
     hup -- same as reload
   clear -- clears the readproctitle service errors with .....................
    kill -- svc -d processes in svclist, then do 'killall -g svscanboot'
    boot -- Boots qmail and all services in /service running /command/svscanboot
  reboot -- kill & boot commands in sequence
HELP
    ;;
  *)
    echo "Usage: $0 {start|stop|restart|doqueue|flush|reload|stat|pause|cont|cdb|queue|clear|kill|boot|reboot|help}"
    exit 1
    ;;
esac

exit 0

Usage

# qmailctl help

    stop -- stops mail service (smtp connections refused, nothing goes out)
   start -- starts mail service (smtp connection accepted, mail can go out)
   pause -- temporarily stops mail service (connections accepted, nothing leaves)
    cont -- continues paused mail service
    stat -- displays status of mail service
     cdb -- rebuild the tcpserver cdb file for smtp
 restart -- stops and restarts smtp, sends qmail-send a TERM & restarts it
 doqueue -- sends qmail-send ALRM, scheduling queued messages for delivery
  reload -- sends qmail-send HUP, rereading locals and virtualdomains
   queue -- shows status of queue
    alrm -- same as doqueue
   flush -- same as doqueue
     hup -- same as reload
   clear -- clears the readproctitle service errors with .....................
    kill -- svc -d processes in svclist, then do 'killall -g svscanboot'
    boot -- Boots qmail and all services in /service running /command/svscanboot
  reboot -- kill & boot commands in sequence

qmailctl can be used to kill all qmail processes and to reboot the server. I use this option inside the rc.6 of my Slackware virtual server to avoid errors messages when stopping or rebooting the guest. You can easily call the clear service as well.

svtools

More info: https://github.com/kayahr/svtools
Author: Klaus Reimer

This is a nice collection of tools to manage daemontools' services that you may want to consider. mlcat is one of those; it can cat a service's log with human readable dates with a short command like:

mlcat qmail-smtpd

I slightly modified that script here, just to use it without the need of the "qmail-" prefix:

mlcat smtpd

Installing

cd /usr/local/src
wget https://github.com/kayahr/svtools/archive/master.zip
unzip master.zip
cd svtools-master
make
make install
mkdir /etc/sv /var/log/sv
chown root.root /etc/sv /var/log/sv
cd /usr/local/bin
rm mlcat
wget https://notes.sagredo.eu/files/qmail/mlcat
chmod +x mlcat

Allowing selected clients to send outgoing messages

Info: http://cr.yp.to/qmail/faq/servers.html

Create ~vpopmail/etc/tcp.smtp and ~vpopmail/etc/tcp.submission (the latter one in case you want to enable the submission service).

Enable outgoing relay in this way:

10.0.0.:allow,RELAYCLIENT=""
127.:allow,RELAYCLIENT=""
1.2.3.4:deny
:allow

Localhost and 10.0.0.0 subnet can use our MTA as an outgoing relay, 1.2.3.4 is denied, the other IPs can only send messages to the domains listed inside /var/qmail/control/rcpthosts.

tcp.smtp

0.0.0.0:allow,RELAYCLIENT=""
10.0.0.:allow,RELAYCLIENT=""
127.:allow,RELAYCLIENT=""
:allow,CHKUSER_WRONGRCPTLIMIT="3"

chkuser will ban clients' IP after 3 consecutive failures.

tcp.submission

:allow,CHKUSER_WRONGRCPTLIMIT="3"

Updating cdb files

qmailctl can invoke tcprules to create the cdb file in this way:

# qmailctl cdb
Updated tcp.smtp.cdb.
Updated tcp.submission.cdb.

You must run this command every time you modify tcp.smtp or tcp.submission.

Configuring the standard SMTP service on 25 in tcp.smtp ensures that only localhost and authorized IPs can use the SMTP service as an outgoing relay. We will accept inbound messages from outside as long as the recipient domain is included in the file /var/qmail/control/rcpthosts. When someone sends a message to a domain name not listed in rcpthosts, qmail will respond with “Sorry, that domain isn’t in my list of allowed rcpthosts (#5.7.1)”.

When you enable SMTP authentication on port 587, remote users who successfully authenticate will be allowed to send messages using our MTA.

Running `qmail` at boot time

The command /command/svcscanboot has been inserted in your /etc/inittab at the time you installed daemontools, or you have installed a daemontools systemd service, as already explained in the here.

Patching

Testing

qmail

add a comment

Comments

authentication issues on port 587

jeff maina June 23, 2023 10:30

Hi Roberto, thank you so much for this guide.

I've followed the guide step by step, and I keep on getting the error "421 unable to read controls (#4.3.0)" when testing port 587 authentication

I've tried researching the issue, and I can't seem to fix the issue.

Where might I be going wrong?