This page is meant to hold my patches available for qmail and some
documentation about building and installing them.
news: I switched to Postfix, so I will not maintain it for now :(
last change: 2015-03-25 @ 12:53
INCLUDED PATCHES IN THIS BIG PATCH (md24)
===========================================
NEW SMTP SERVER FEATURES (qmail-smtpd)
----------------------------------------
- ESMTP STARTTLS command (rfc2595)
- via tls patch by Scott Gifford http://www.suspectclass.com/~sgifford/
- ESMTP AUTH command (rfc2554)
- with 6 sasl methods (plain,login,cram-md5,cram-sha1,cram-ripemd,digest-md5)
- control/auth/* controls that
- see README.auth
- ESMTP SIZE command (rfc1870)
- control/databytes and control/databytes+
- ESMTP ENHANCEDSTATUSCODES (rfc3463, rfc2034, rfc1893)
- see README.status
- qmailqueue patch
- by Bruce Guenter <bguenter-djb-qmail@qcc.sk.ca>
- tarpitting
- control/tarpitcount
- the value of $TARPITCOUNT overrides the control file
- control/tarpitdelay
- the value of $TARPITDELAY overrides the control file
- if $NO_TARPITTING is set, then tarpitting will be disabled
- ipme patch
- ip 0.0.0.0 is a special address which always refers to this host (rfc1122)
-> http://www.suspectclass.com/~sgifford/qmail/
- two patches from Paul Jarc
- realrcptto (checking for real existance of accounts)
- qmail-branch (more control in .qmail files)
- outgoing ip patch
- by Sergio Gelato and Andy Reptonis
- some additions by me
- bmcheck() -> badmailfrom + badmailto + badhelo checks
- variable logging of these checks
- one environment variable for each bmcheck, so you can set it with tcpserver
- the bad* controlfiles accept regex.7 expressions
- see README.bmchecks for additional information
- bigdns patch
- handling of oversized dns responses
- big concurrency patch by Johannes Erdfelt
- see http://qmail.org/big-concurrency.patch
- the big-todo patch
- from Dave Smith, Russell Nelson and Bruce Guenter
- countrol/mfcheck
- mail from dns check
- if 1: only dns will be looked up
- if 2: SMTP callback/sender verification will be done
- control/goodmailfrom
- accept always mail from the envelope MAIL FROM
- you can use mail addresses, which wouldn't get through mfcheck :)
-> e.g. root@some.stupidhost.local -> adminmails@host.de
- control/maxrcpt
- max recipients a unauthorized session can have
- client gets tarpitted
- control/maxhops
- the value can be changed now on the fly
- control/maxcmdlen
- max length of a smtp command
- client gets tarpitted, if over the max.
- control/maxaddrlen
- max length of an email address given to RPCPT TO or MAIL FROM
- client gets tarpitted, if over the max.
- control/smtpgreeting can have multiple lines
- control/rcptcheck
- see README.antispam
- control/datechecks
- news-YYYYMMDD checking against RCPT TO
- see qmail-smtpd.8
- if the environment variable BLACKLISTED is set, than we have a spammer and
feed our spamassassin :)
- "RCPT TO" is ignored, the mail is sent to $BLACKLISTED
- for setting this variable, just use my patch against rblsmtpd from
http://www.mcmilk.de/qmail/dl/djb-ware/ucspi-tcp-0.88-rbl.diff.bz2
- $RCPTTOFIXED can be used for delivering all mail to one special address
- HELO/EHLO requires explicit a hostname, or the client gets an error
- "501 5.5.4 syntax error, I need your hostname"
NEW SMTP CLIENT FEATURES (qmail-remote)
-----------------------------------------
- ESMTP AUTH command (rfc2554)
- with 5 sasl methods (plain,login,cram-md5,cram-sha1,cram-ripemd)
- control/smtprelays controls that
- ESMTP SIZE command (rfc1870)
- when the remote server supports the SIZE extension, we issue a SIZE=xyz
- logs all SMTP traffic to control/log/remote_fd (but not the DATA!)
- overview of available controlfiles
- smtprelays (forward/relay with authentication, creating virtual relays)
- smtproutes (relay to servers without autentication, relay to virtual relays)
- qmtproutes (sending via qmtp protocol, if remote system can handly that)
- outgoingip (bind to an outgoing ip, when sending)
- timeoutconnect / timeoutremote
NEW POP3 FEATURES
-------------------
- sasl authentication via the AUTH command (rfc1734)
- with 6 sasl methods (plain,login,cram-md5,cram-sha1,cram-ripemd,digest-md5)
- pop3 LAST command is now rfc1460 valid
- pop3 STLS command is now supported
- via tls patch by Scott Gifford http://www.suspectclass.com/~sgifford/
- netscape progressbar patch
- Netscape's download indicator doesn't progress
- pop3 CAPA command
- including RESP-CODES (rfc2449) + AUTH-RESP-CODE (rfc3206)
- begin with pop3 EXPIRE + LOGIN DELAY capabilities ... but how to use them?
CONTROLFILES FOR LOGGING
--------------------------
- control/log/bmchecks
-> enable/disable logging of the pattern matching in the bad* controlfiles
- control/log/datechecks
-> enable/disable logging of the foo-bar-YYYYMMDD@domain.com checks
- control/log/orchecks
-> enable/disable logging of the open relay tests
- control/log/tarpitting
-> enable/disable the logging of some info about the client which gets
tarpitted
- control/log/pop3_in
- 1 = on / 0 = off
- log all the incoming pop3 commands from the client
- control/log/pop3_out
- 1 = on / 0 = off
- log outgoing server responses from qmail-pop3d + qmail-popup
- control/log/pop3_fd
- logging filedescriptor
- used for logging qmail-popup and qmail-pop3d (in/out)
- control/log/smtp_in
- 1 = on / 0 = off
- log all the incoming commands from the client
- control/log/smtp_out
- 1 = on / 0 = off
- log outgoing server responses from qmail-smtpd
- control/log/smtp_fd
- logging filedescriptor
- used for logging qmail-smtpd (in/out)
- control/log/remote_fd
- logging filedescriptor / 0 means off
- logs always the full session
MISCELLANEOUS OTHER CHANGES
-----------------------------
- qmail-send:
- reread control/concurrencylocal + control/concurrencyremote on SIGHUP
- explicit use of struct utimbuf
- qmail-local, quota-1.1 patch
- by Jeff Hayward <j.hayward@ots.utexas.edu>
- see README.quota
- preline patch
- adds the -p option to preline, which is telling it to ignore EPIPE
- sendmail
- flagf, http://david.acz.org/software/sendmail-flagf.patch
- flagN is ignored (DSN option)
- patch to fix minor bug in parsing .qmail files
- qmail-queue reads now control/bigbrother
- address queue extra feature
- sample: "badguy@example.net:bigbrother@example.net"
- automatically forward all mail _to_ and _from_ <badguy@example.net> to
<bigbrother@example.net>
- is required in germany since 2005-01-01 (TKÜV)
- see also http://www.nrg4u.com/
- fixed some security issues:
- Wietse Venema has two DOS attacks against qmail:
1. "run a qmail system out of swap space by feeding long SMTP commands"
-> solved via checking of input length
-> control/maxcmdlen should define a maximum value
2. "run a qmail system out of swap space by feeding an infinite amount of recipients"
-> solved via counting of recipients
-> control/maxrcpt should define a maximum value
- Georgi Guninski has an advisory
- see http://www.guninski.com/qmailcrash.html for info
- I don't know if it is really that bad, but i changed the "int pos" to an
"unsigned int pos" :)
- fixed serveral gcc warning issues:
- type of void main() to int main()
- added also some stupid return xxx
- replaced the puts() function with out()
- added all the missing headers, to avoid implicit declarations
- use of struct utimbuf in qmail-send.c
last change: 2015-03-25 @ 12:53
CONTROLFILES FOR AUTHENTICATION
=================================
- all controlfiles are in the QMAILHOME/control/auth/ directory
- definitions for defining valid authentication methods:
LOGIN = 1
PLAIN = 2
CRAM-MD5 = 4
CRAM-SHA1 = 8
CRAM-RIPEMD = 16 (RIPEMD-160)
DIGEST-MD5 = 32
- control/auth/pop3 (default: 60)
- integer, describing the valid authentication methods for ssl-unsecured pop3
connections
- control/auth/spop3 (default: 63)
- integer, describing the valid authentication methods for ssl-secured pop3
connections (via stls command / xxx: currently not implemented!)
- control/auth/smtp (default: 60)
- integer, describing the valid authentication methods for unsecured smtp
connections
- control/auth/smtps (default: 63)
- integer, describing the valid authentication methods for ssl-secured smtp
connections (via starttls comamnd)
- examples:
LOGIN + PLAIN (3: 1+2)
LOGIN + DIGEST-MD5 (33: 1+32)
LOGIN + PLAIN + CRAM-MD5 + CRAM-SHA1 (15: 1+2+4+8)
- control/auth/delay
- if the the client issues a wrong authentication, he has delayed this time
in seconds
- control/auth/oldauth (default is 0 = off)
- integer, when >0 than "AUTH=LOGIN" is issued for broken M$ clients
- TODO: how can we do tls/ssl with qmail-popup + qmail-pop3d ...
- currently I startet writing a qmail-tls, which wraps the whole session...
last change: 2015-03-25 @ 12:53
CONTROLFILES FOR REMOTE AUTHENTICATION (qmail-remote)
=======================================================
- qmail-remote reads the routing files in this order:
1. smtprelays
2. smtproutes
3. qmtproutes
- that means:
- smtproutes extends smtprelays
<smtprelays sample>
# detect best mechanism at relay for user@domain
user@domain:smtp.example.com|username|password|
# detect best mechanism at smtp1.example.com for domain1
domain1:smtp1.example.com|username|password|
# use explicit cram-md5 at domain2
domain2:smtp2.example.com|username|password|cram-md5
# use login method at domain3
domain3:smtp3.example.com|username|password|login
# just a virtual 'relay4' - this relay shouldn't exist in the real internet!
domain4:relay4
domain5:relay4
domain6:relay4
domain7:relay4
domain8:relay4
domain9:relay4
# just a virtual 'xyz.local' - this relay shouldn't exist in the real internet!
domain4:xyz.local
# always use default relay with authentication
:default-relay|user|pass|
</smtprelays sample>
<smtproutes sable>
# the virtual server 'relay4' from above is handled by mx.example.com
relay4:mx4.example.com
# the virtual server 'yxz.local' from above is handled by mx.example.com
xyz.local:mx.example.com
# domain1 is handled by smtp2.example.com
domain1:smtp2.example.com
# domain2 is handled by smtp2.example.com
domain2:smtp2.example.com
# use a default relay with no authentication
# -> you shouldn't add an default relay here _and_ in control/smtprelays
:smtp.example.com
</smtproutes sample>
last change: 2015-03-25 @ 12:53
OVERVIEW OF ANTISPAM FEATURES
===============================
- exit with "221 2.0.0 error: I can break rules, too. goodbye."
- if a client sends the DATA command, but no RCPT TO was accepted
- stolen from postfix :)
- control/p0fsock
- passiv p0f remote OS guessing (from fefe)
- see http://lcamtuf.coredump.cx/p0f.shtml
- realrcptto patch is included
- only valid recipients will be accepted
- control/rcptcheck
- contains the path to a script or program, which checks the validity of the
rcpipient and/or the sender
- the script/program can use $SENDER and $RECIPIENT for checking
- $SENDER is set to the envelope from (MAIL FROM)
- $RECIPIENT is set to the envelope recipient (RCPT TO)
- $RCPTCHECK overrides the value of control/rcptcheck
- based on the return values, the mail will be accepted or rejected:
1 -> "553 5.1.1 sorry, no mailbox here by that name."
2 -> "421 4.3.0 unable to verify recipient/sender (misuse)"
3 -> "421 4.3.0 unable to verify recipient/sender (internal)"
11 -> "451 4.1.1 bad destination mailbox address"
12 -> "451 4.1.2 bad destination system address"
13 -> "451 4.1.3 bad destination mailbox address syntax"
14 -> "451 4.1.4 destination mailbox address ambiguous"
16 -> "451 4.1.6 mailbox has moved"
17 -> "451 4.1.7 bad sender's mailbox address syntax"
18 -> "451 4.1.8 bad sender's system address"
21 -> "452 4.2.1 mailbox disabled, not accepting messages"
22 -> "452 4.2.2 mailbox full"
111 -> "421 4.3.0 unable to verify recipient/sender (temporary)"
112 -> "421 4.3.0 unable to verify recipient/sender (greylisting)"
- you can implement greylisting and adavanced checking for valid mail adresses
with that, look here for more: http://www.mcmilk.de/qmail/dl/qmail-scripts/
- control/badmailfrom,badmailto,badhelo,goomailto can be used with regex.7
expressions
- that means: full HELO/EHLO + MAIL FROM + RCPT TO address matching is
supported
- $BLACKLISTED
- if set, the mail is considered as spam and will be send to the local
address <$BLACKLISTED> - so it should contain a <spam-recv-mailaddr>
- the mailsize is limited by the file databytes+
- control/mfcheck (mail from dns check)
0: no dns-check is done
1: only the dns mx/a check is done
2: - a testbounce will be send to the remote mx of the senderdomain
- permamently ignores the ip's, which are listed @ control/mxblacklist
- control/datechecks (mostly from fefe)
- without that patch, the usenet and also some mailinglisten are unuseable!
- checks whether a part of the local part of an incoming mail addresses
looks like an 8-digit date string of the form YYYYMMDD, where Y mean
year, M = month and D = day
- how does it work:
e.g. datechecks contains: 'qmail-list-:7'
- this means, that an email to qmail-list-YYYYMMDD is valid for 7 days
- if today is 2004-11-14, than an email to qmail-list-20041213 will be
accepted, but not an mail to qmail-list-20041103!
- control/clamd
- contains ip:port or the absolute path to the clamd socket
- each SMTP DATA stream will be send to clamd and scanned for viruses
- if a virus is found, the client gets tarpitted with a message like:
S: 554 5.7.7 your email contains the virus "Worm.Sober.I"!
- control/mxblacklist
- contains ip adresses, which are invalid for remote mail exchangers
- it should contain at least 127.0.0.1 - so that domains like englishforum.biz,
which mx is resolving to 127.0.0.1, are not valid
- control/greylisting
- doesn't exist
- but you can use the control/rcptcheck feature for it
/TR
last change: 2015-03-25 @ 12:53
BADHELO
=========
- checking against 'HELO/EHLO ???' commands
- environment variables:
$NO_BADHELO -> disable this checking @ all
$BADHELO -> use this file for the checks (instead of control/badhelo)
- if a pattern matches, then the EHLO/HELO command from the client gets
tarpitted with: "553 5.7.1 sorry, your helo or ehlo is incorrect"
BADMAILFROM
=============
- checking against 'MAIL FROM:<???>' commands
- environment variables:
$NO_BADMAILFROM -> disable this checking @ all
$BADMAILFROM -> use this file for the checks (instead of control/badmailfrom)
- if one pattern matches, the client gets tarpitted with this error:
"553 5.7.1 sorry, your envelope sender has been denied"
BADMAILTO
===========
- checking against 'RCPT TO:<???>' commands
- environment variables:
$NO_BADMAILTO -> disable this checking @ all
$BADMAILTO -> use this file for the checks (instead of control/badmailto)
- if one pattern matches, the client gets tarpitted with this error:
"553 5.7.1 sorry, your envelope recipient has been denied"
GOODMAILFROM
==============
- checking against 'MAIL FROM:<???>' commands
- environment variables:
$NO_GOODMAILFROM -> disable this checking @ all
$GOODMAILFROM -> use this file for the checks (instead of control/goodmailfrom)
- if a pattern matches, then the mail gets accepted; because the sender
address is whitelisted (no mfcheck is done)
RULES FOR THESE 4 FILES
=========================
- regular expressions as described in regex(7) can be used
- the patterns are used for matching against the '???' string
/TR 2004-11-26
Jeff Hayward <j.hayward@ots.utexas.edu>last change: 2015-03-25 @ 12:53
This patch to qmail-1.03 modifies the way qmail-local treats a 'quota
exceeded' error when writing to a maildir.
The virgin code as distributed by DJB treats this as a 'temporary
error on maildir' and leaves the message in the queue for later
delivery retries. The modified code treats it as a permanent error
and immediately returns the message to the sender.
This allows you use the standard unix file system quota mechanism to
enforce per-uid limits on either the number of files (inodes) in that
uid's maildir(s) or the total size of all files (blocks) in the
maildir(s), or both, without leaving yourself (as) exposed to
potential denial of service by running out of space for the qmail
queue area.
Please let me know if you find this useful (or not). I am happy to
receive bug reports as well as other comments.
last change: 2015-03-25 @ 12:53
CHANGES FOR THE QMAIL-MD PATCH
================================
md24_2008-05-11: [CURRENT STABLE]
- some glibc fixes
md24_2007-08-13:
- removed the big tls patch from Frederik Vermeulen
- added the tls patch from Scott Gifford (pop3 and smtpd via sslserver)
- fixed a clamav antivirus scanning and added clamav socket support
- control/clamd defines ip:port or the absolute path to the socket of clamd
- removed spf
- changed default sasl mechanism in insecure/secure modes
md23_2006-08-18:
- added the control/mxblacklist (idea from Guna Veit)
md22-2006-07-20:
- an important fix in qmail-remote.c
- small fix for gcc 4.1.1 in readwrite.h
- no new features, just bug fixes!
md21_2005-01-13:
- qmail-smtpd:
- added rfc3848 support
- the transmission types SMTP, ESMTPA, ESMTPS, ESMTPSA are set in the
"with" clause of a Received header
md20_2005-01-13:
- qmail-remote:
- fixed ehlo keyword parsing (2005-01-11)
- qmail-smtpd:
- if connection to clamd breaks down, don't try to reconnect (2005-01-12/13)
- fixes in handling of goodmailfrom (2005-01-05)
- logging of the testbounce is now better (2005-01-04)
- fixed handling of temporary testbounce errors (2005-01-04)
- fixed testbounce problem with greylisting servers, only replys >=500 to
RCPT TO are not okay (2005-01-03)
md20_2005-01-02:
- qmail-smtpd.c:
- added control/bigbrother / see README
- added antivirus testing with clamd / see README.antispam
- control/mfcheck has changed / see README.antispam
- the TARPIT logging is human readable now :)
- added some exitcodes to the rcptcheck / see README.antispam
- added SMTPGREETING environment variable
- added the passiv p0f remote OS guessing (from fefe)
- added control/maxaddrlen (defaults to 900)
- added control/reqbrackets (defaults to 1 = yes)
- fixed NULL termination of rcptcheckprog
- removed the hostname argument from qmail-smtpd
- updated documentation
md19_2004-11-29: [OLD STABLE]
- WARNING: qmail-smtpd needs the hostname argument until md19!
- qmail-smtpd.c:
- bugfix, realrcptto_init() was not called in some special case
- if you got sth. like 'status 11' in your log ... then you have to update!
md19_2004-10-23:
- sig_catch.c:
- if available, use SA_RESTART in the sa_flags
md19_2004-10-06:
- qmail-remote:
- fixed EHLO keyword parsing
md19_2004-10-05:
- qmail-smtpd:
- $BLACKLISTED should contain a <spam-recv-mailaddr>
- $RCPTTOFIXED can be used for explicit delivering all mail to one special
address
- don't issue STARTTLS, if control/servercert.pem doesn't exist
- control/smtpgreetings can have multiple lines now
- authenticated users are are no spamfeeder
- the variable $BLACKLISTED is ignored, AUTH was ok
- qmail-remote:
- fixed QUIT issue
- recognizes control/qmtproutes
md18_2004-09-02:
- qmail-remote can use authentication now (5 methods)
md17_2004-08-31:
- updated the manpage preline.1
- qmail-remote:
- fixed qmtp()
- esmtp auth command
md17_2004-08-30:
- qmail-smtpd:
- smtpgreeting can have multiple lines
- added a goodmailfrom (mfcheck + badmailfrom checks are skipped for these
addresses)
- HELO/EHLO require now an argument!
md17_2004-08-29:
- qmail-smtpd:
- fixed "SIZE 0" issue in ehlo response (rfc says, it is valid - but it looks ugly)
- fixed AUTH=xyz in MAIL FROM command!
- added the spam catcher, see README.antispam (xxx: untestet here)
- added the rcptcheck control file
- qmail-remote:
- needs only a bit of modification for remote auth
md17_2004-08-06:
- qmail-remote SIZE + AUTH command (just a beginning)
- added the qmail-1.03-qmtpc.patch v2 (qmail-remote will try qmtp first)
md17_2004-08-04:
- qmail-remote supports now the logging of all smtp commands
- removed obsoleted tls patch 20021228 and added the 20040419 release
md16_2004-07-2x:
- some fixes @ qmail-smtpd
- added the two patches from http://multivac.cwru.edu./qmail/
- realrcptto (checking for real existance of virtual users)
- qmail-branch (more control in .qmail files)
- added the latest spf patch from Christophe Saout
- see http://www.saout.de/misc/spf/qmail-spf-rc3.patch
md16_2004-07-04:
- update of documentation
md16_2004-07-02:
- update of documentation
- added the forgotten note about the outgoingip patch
- commands.c:
- check out the command length
-> if it is too long, than tarpit the remote host!
- qmail-smtpd.8
- yeah! I updated the *fu..ing* manpage of qmail-smtpd
- qmail-smtpd:
- added support for a maxrcpt controlfile
- news-YYYYMMDD checking, I named the controlefile datechecks
- added the "221 2.0.0 error: I can break rules, too. goodbye." error
-> is issued when the client sends a DATA command, but has not the right
to do that!
- qmail-remote.c
- try next mx, if first has a temporary error!
- qmail-showctl.c
- removed obsoleted things
- ctl_log_err -> ctl_log_fd
- removed the preformatted manpage stuff
md15_2004-06-17:
- big concurrency patch by Johannes Erdfelt
-> http://qmail.org/big-concurrency.patch
- the big-todo patch from Dave Smith, Russell Nelson and Bruce Guenter
- the outgoing ip patch from Andy Repton and Sergio Gelato
- update of the included documentation @ ./docs
- misc other things
- the errno problem with glibc
- qmail-send.c uses now struct utimbuf
md14_2004-01-10:
- patch is deleted! -> doesn't work correctly!
md13_2004-01-10:
- fixed qmail-sasl.c: we need a flush(), so that order of logging is okay!
- let qmail-popup return zero
md13_2004-01-08:
- startet that file!
- qmail-pop3d.c:
- corrected rfc1460 support (last command)
- fixed small qmail-local.c bug @ line 651
- is a set of scripts which makes compilation of all the needed programs very easy
- the installation includes currently:
- ripmime-1.4.0.3
- openssl-0.9.7e
- cdb-0.75
- checkpassword-0.90
- daemontools-0.76
- qmail-1.03
- djbdns-1.05
- ucspi-tcp-0.88
- qpasswd-0.5
- last update: 2004-12-10
- take a look at the directory, or just download the latest tarball
