http://permalink.gmane.org/gmane.mail.qmail.general hourly 1 1901-01-01T00:00+00:00 http://gmane.org/img/gmane-25t.png http://gmane.org http://permalink.gmane.org/gmane.mail.qmail.general/57585 <pre> Would you look at this: Apr 23 19:42:01 mailsystem vpopmail[1806]: vchkpw-smtps: vpopmail user not found some-random-string&lt; at &gt;:4.5.6.7 Before, I wasn't getting any of these in the logs. I run a bruteforce script and it was only matching non-SSL attempts. For posterity, this is what I changed my 'run' file to: #!/bin/sh QMAILDUID=`id -u vpopmail` NOFILESGID=`id -g vpopmail` MAXSMTPD=`cat /var/qmail/control/concurrencyincoming` exec /usr/local/bin/softlimit -m 30000000 \ /usr/local/bin/tcpserver -H -R -l 0 *-s* -v \ -x /usr/local/vpopmail/etc/tcp.smtp.cdb -c "$MAXSMTPD" \ *-n /opt/ssl/wildcard.isp.net.pem* \ -u "$QMAILDUID" -g "$NOFILESGID" 0 smtps \ /var/qmail/bin/qmail-smtpd 0 \ /usr/local/vpopmail/bin/vchkpw true 2&gt;&amp;1 Not too much documentation with the patch. To avoid reading the source: *-s* tells it to use SSL/TLS, -S tells it not to. Withou</pre> Darek 2013-04-23T23:56:14 http://permalink.gmane.org/gmane.mail.qmail.general/57584 <pre> Ah, makes sense. patching tcpserver would likely be easier than rebuilding qmail, and whatever else would need to be redone. Thanks a million! </pre> Darek 2013-04-23T21:31:09 http://permalink.gmane.org/gmane.mail.qmail.general/57583 <pre> On 2013-04-23 22:05, Darek wrote: I would look at in the cdb file /usr/local/vpopmail/etc/tcp.smtp.cdb # cat /usr/local/vpopmail/etc/tcp.smtp.cdb | cdbdump; I would guess that RELAYCLIENT is set for the source ip of your stunnel (or something like that) /Uffe </pre> Uffe Jakobsen 2013-04-23T21:23:07 http://permalink.gmane.org/gmane.mail.qmail.general/57582 <pre>On Tuesday, April 23 at 04:05 PM, quoth Darek: Stunnel is your problem. Essentially, all stunnel connections look, to qmail, like they're coming from localhost, and localhost is (usually) allowed to send mail without authenticating. One solution would be to make it so that localhost cannot send mail without authenticating, but that can have complications, depending on what software you use that relies on being able to send email via SMTP to localhost (e.g. webmail or various mailing list software packages). Another solution is to use a DIFFERENT way of tunneling SMTPS, such as mailfront or Frederik Vermeulen's SSL patch to qmail or tcpserver-ssl. ~Kyle </pre> Kyle Wheeler 2013-04-23T21:01:30 http://permalink.gmane.org/gmane.mail.qmail.general/57581 <pre>Hi there, I'm running Qmail on FreeBSD 9.1 (port version qmail-1.03_8) with the SMTP-AUTH patch from ports. I run it using tcpserver and daemontools, with the exact file, except the smtps port running through stunnel. The non-SSL process does correct user lookups and fails incorrect authentication. The SSL one gladly accepts any random string for user and pass and allows relay. I am running the same commands, only adding stunnel for the second one. A bit lost as to why this is happening. Below I use the same base64 encoded string for the login, both attempts from an untrusted source, not allowed to relay anywhere. $ perl -MMIME::Base64 -e 'print encode_base64("some-random-string");' c29tZS1yYW5kb20tc3RyaW5n $ *telnet mail.server.net 25* Trying 1.2.3.4... Connected to mail.server.net . Escape character is '^]'. 220 mail.server.net ESMTP *AUTH LOGIN* 334 VXNlcm5hbWU6 *c29tZS1yYW5kb20tc3RyaW5n* 334 UGFzc3dvcmQ6 *c29tZS1yYW5kb20tc3RyaW5n* 535 authorization failed (#5.7.0) ^] $ *openssl s_client -</pre> Darek 2013-04-23T20:05:10 http://permalink.gmane.org/gmane.mail.qmail.general/57580 <pre>Thus said Jason Haar on Tue, 23 Apr 2013 12:54:20 +1200: Personally I prefer this patch: http://marc.info/?l=qmail&amp;m=134062672511072&amp;w=2 Andy </pre> Andy Bradford 2013-04-23T01:26:04 http://permalink.gmane.org/gmane.mail.qmail.general/57579 <pre> [cross-posted from djbdns list] Not to contradict DJB, but it does look like all the ANY query does it try to see if there is a CNAME for the canonicalized host. So doing an actual CNAME does sound more appropriate. Am I missing anything? </pre> Jason Haar 2013-04-23T00:54:20 http://permalink.gmane.org/gmane.mail.qmail.general/57578 <pre>Sending from a cell phone. Apologies. The error message is geneated by Google (sending from an unrelated gmail account). If you think regenerating the cdb would help i can, but both systems are 64 bit debian, so i doubt endianness is the culprit. But i am willing to try and report this evening. Ag </pre> Aaron Goldblatt 2013-04-08T19:22:12 http://permalink.gmane.org/gmane.mail.qmail.general/57577 <pre>The issue is his validrcptto.cdb I think he should run his test without the wildcard email address That is the standard bounce for rejection during smtp session ... it is not a delivery issue From what I can make up his old box was not rejecting the invalid addresses simply deleting the mails That is not the behaviour of my validrcptto patch. </pre> John Puttergill 2013-04-08T18:56:27 http://permalink.gmane.org/gmane.mail.qmail.general/57576 <pre>-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On Monday, April 8 at 01:51 AM, quoth Aaron Goldblatt: When you say "bounced immediately", do you mean it's *rejected* during the SMTP session (i.e. you are running into a validrcptto problem), or is it accepted and a bounce message is generated (i.e. you are running into a delivery problem)? ~Kyle - -- Only the fool hopes to repeat an experience; the wise man knows that every experience is to be viewed as a blessing. -- Henry Miller -----BEGIN PGP SIGNATURE----- Comment: Thank you for using encryption! iQIcBAEBCAAGBQJRYuQjAAoJECuveozR/AWexn8QAIPAM9JGZMNIzIh/Bq1Y24pM 0EWpXqOK4X9hWR0zgk73nif4dfm5dsJOgb/cH8hD2U+GCyMKZPf7PPZLKrv/JpXh 6sud11AlEhyiHL65fW45fiAQuMt7BWsSegejE66gtCztxTCFWtEqQ5YBxHoski9J 2vYYVJWrqLNsjDYGaMdkpMyKeeh0/Orrq+t3Iy+oOrAhiUBx1czsldjcdKkb/y1Q LnvaDdwusVLIOlg8xhCcO8wemMJtThES0S74+6Sats1hVt26mjqTSk06JHrISGKq ntr6J1gxAF0iP9QcF0oPPGKkB4Sb77Q9OEYKBpLC8P8dJlWzzIaC0a7FoQ7yv94V /49nvh1MvE</pre> Kyle Wheeler 2013-04-08T15:37:07 http://permalink.gmane.org/gmane.mail.qmail.general/57575 <pre> Really? I'm convinced that the database format is fixed, cross-platform, etc. etc. quote&gt; Positions, lengths, and hash values are 32-bit quantities, stored in quote&gt; little-endian form in 4 bytes. I think you should look elsewhere. - M </pre> Michael Sierchio 2013-04-08T15:12:40 http://permalink.gmane.org/gmane.mail.qmail.general/57574 <pre>-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On Monday, April 8 at 01:51 AM, quoth Aaron Goldblatt: I believe the CDB database format is not fully cross-platform, and if your old computer is 32-bit and your new one is 64-bit, you may need to simply rebuild the validrcptto.cdb database. ~Kyle - -- The purpose of computing is insight, not numbers. -- Richard W. Hamming -----BEGIN PGP SIGNATURE----- Comment: Thank you for using encryption! iQIcBAEBCAAGBQJRYtvOAAoJECuveozR/AWemvMP/06NoV0Iet12xhCcicicXq+J tTPC8JlekbMul2zT2tT3wk7G8vvflvbUP7eqjlQSuiMZvgIVoi4aILXLoN2iuHyn qAWEPAMGdQ5y8l8RkICbHjJo8Jv+HOFTUzExMgjazFhvBScPamvWdJ0Iw7VhW0G9 MdQ2KOKWLrALikwpTN1LWDLGvZ6ib7IxcPGJsUW0tONIm8dG4XFDZPGbatFwiiRW B7drJjbTCazlUKH64XHIc3SD/p6DB2Mw+sU0Wu9WQdqkRO5GgECyvNi6DTluUym0 258xaJbZWEFEN12HNrkZpd9WV+l/4CnrVgO6FN2jfLtBMlr6E/rthVP3TarQlsPA snmrSNtZtXkvT4GnPLIQRI/tzkYcyLvp7MIhjuE3OFKowjPf+5gtBlqwNeY5jtul CDxrn1ufswoVD2eyF//0LU+d3QyI8YXyLokvXCDSw8L1kXrKYkf4l/IfYxKj/+f0 7</pre> Kyle Wheeler 2013-04-08T15:01:34 http://permalink.gmane.org/gmane.mail.qmail.general/57573 <pre>-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On Monday, April 8 at 11:12 AM, quoth Michael Sierchio: AAAAnd if you actually read the *code* of DJB's CDB software, it defines "32-bit unsigned integer" as "unsigned int" (see uint32.h), which on machines that use the ILP64 data model, is actually a 64-bit integer. This is a consequence of using software that pre-dates the establishment of the uint32_t datatype: it's darn hard to create an integer of a specific (large-ish) size in a portable way. You can consider that a bug in his software if you like; it certainly means it can violate the CDB spec on some machines with some compilers. But, whether this is the issue or not, it can't hurt to give my suggestion a shot. ~Kyle - -- The important work of moving the world forward does not wait to be done by perfect men. -- George Eliot -----BEGIN PGP SIGNATURE----- Comment: Thank you for using encryption! iQIcBAEBCAAGBQJRYuOgAAoJECuveozR/AWeWn8</pre> Kyle Wheeler 2013-04-08T15:34:56 http://permalink.gmane.org/gmane.mail.qmail.general/57572 <pre>i'm trying to migrate my qmail setup from an ancient box with dying hard drives to a vps, setup thus: old box: blotts.goldblatt.net lwq setup, netqmail106 with validrcptto.cdb patch new box: preg.goldblatt.net lwq setup, netqmail106 with validrcptto.cdb patch if you go digging in the DNS records for goldblatt.net, you'll see the present MX receiver is blotts, and it works as i intend. the only way for me to test this out is to adjust the MX record, which i will not do and leave unattended until i have this fixed. DESIRED BEHAVIOR on blotts, *&lt; at &gt;goldblatt.net comes in and is filtered for delivery according to a series of .qmail files that live in /var/qmail/alias: -rw-r--r-- 1 root qmail 27 May 21 2010 .qmail-goldblatt-aaron -rw-r--r-- 1 root qmail 27 Dec 19 03:58 .qmail-goldblatt-benjamin -rw-r--r-- 1 root qmail 27 May 21 2010 .qmail-goldblatt-lists -rw-r--r-- 1 root qmail 27 May 21 2010 .qmail-goldblatt-lists-default -rw-r--r-- 1 root qmail 2 May 21 2010 .qmail-goldblatt-lists-d</pre> Aaron Goldblatt 2013-04-08T06:51:12 http://permalink.gmane.org/gmane.mail.qmail.general/57571 <pre>Just an update on this. I have applied the patch available here http://www.ingorohloff.de/soft/qmail.html. It worked for me. Thanks to everyone responded in this thread. Special thanks to Erwin Hoffmann. On Mon, Mar 25, 2013 at 7:42 PM, Erwin Hoffmann &lt;feh&lt; at &gt;fehcom.de&gt; wrote: </pre> Sikkandar Dulkaranai 2013-04-03T12:47:52 http://permalink.gmane.org/gmane.mail.qmail.general/57570 <pre>Hi, Am 02.04.2013 um 22:25 schrieb Sikkandar Dulkaranai: I thought, I did: http://www.fehcom.de/qmail/smtpauth.html##SETUP &lt;--snip--&gt; First: control/authsenders: eschmidt&lt; at &gt;google.com:gmail-smtp-in.l.google.com:587|E. Schmidt|topsecret Second control/smtproutes: gmail.com:gmail-smtp-in.l.google.com|myaccount|mypasswd &lt;--snap--&gt; From man qmail-remote: authsenders Authenticated sender. For each sender included in authsenders: sender:relay:port|user|password qmail-remote will try SMTP Authentication of type CRAM-MD5, LOGIN, or PLAIN with the provided user name user and password password (the authentication information) and eventually relay the mail through relay on port port. The use of relay and port follows the same rules as for smtproutes Note: In case sender is empty, qmail-remote will try to deliver each outgoing mail SMTP authenticated. If the authentication information is missing, the mail is delivered none-authenticated. authsende</pre> Erwin Hoffmann 2013-04-02T21:11:47 http://permalink.gmane.org/gmane.mail.qmail.general/57569 <pre>Hi, It is a great one. It will be a great help if you could add to your document on "How to test Smart relay or Smart host (if possible from command line) after everything is done as per your instructions". On Wed, Apr 3, 2013 at 12:43 AM, Erwin Hoffmann &lt;feh&lt; at &gt;fehcom.de&gt; wrote: </pre> Sikkandar Dulkaranai 2013-04-02T20:25:53 http://permalink.gmane.org/gmane.mail.qmail.general/57568 <pre>Hi everybody out there, within my current qmail-authentication patch (0.8) I realized a feature for qmail-remote which was required by some users: qmail-remote allows now two distinct mechanisms to enable authentication: * Sender-based authentication: This is triggered by the 'Mail From:' address and can be customized by control/authsenders. * Target-based authentication: As an extension for control/smtproutes now for a specific route the authentication information can be optionally added. The last feature is often called a 'smart relay' or 'smart host'. Of course the 'Submisson' is always possible! Sender-based authentication has precedence over 'relay-based' authentication. The current version + docs are available on my web site http://www.fehcom.de/qmail/smtpauth.html Note: For qmail-smtpd I use now an extensible scheme for the environment variable SMTPAUTH. These features have been included into my SPAMCONTROL patch (2.7). Users of this patch are encouraged to update ! All new features ar</pre> Erwin Hoffmann 2013-04-02T19:13:28 http://permalink.gmane.org/gmane.mail.qmail.general/57567 <pre>Hi John, Am 01.04.2013 um 19:10 schrieb John Giordano: Ok. I verified, that your ezmlm-manage.c is from the original 0.53 package; while I have used ezmlm-0.53 + ezmlm-idx-0.324. Under FreeBSD 8.1 the original ezmlm fails with the same error code, while the 'mixture' of the above does work. ./compile ezmlm-manage.c ezmlm-manage.c: In function 'main': ezmlm-manage.c:320: warning: incompatible implicit declaration of built-in function 'log' ezmlm-manage.c:320: error: incompatible type for argument 1 of 'log' ezmlm-manage.c:320: error: too many arguments to function 'log' ezmlm-manage.c:331: warning: incompatible implicit declaration of built-in function 'log' ezmlm-manage.c:331: error: incompatible type for argument 1 of 'log' ezmlm-manage.c:331: error: too many arguments to function 'log' ezmlm-manage.c:135: warning: return type of 'main' is not 'int' *** Error code 1 Thus, please try to get hold of ezmlm-idx-0.324 and try yourself. If you are not successful, contact me again. regards. --eh. </pre> Erwin Hoffmann 2013-04-02T18:33:20 http://permalink.gmane.org/gmane.mail.qmail.general/57566 <pre>Howdy, Thanks for the reply Erwin. I am pretty sure I got the source for this directly from Dr. Bernstein's webpage. Is there another version of ezmlm floating around out there? I also tried to get ezmlm-idx to compile and that bombed as well. Hrmph. Can you provide a URL that has the "patched" version of ezmlm? I don't think we need all the stuff in ezmlm-idx. Our version of ezmlm-manage.c has 403 lines of code in it: [root&lt; at &gt;tesla:/]$ wc -l /usr/local/src/ezmlm/ezmlm-0.53/ezmlm-manage.c 403 /usr/local/src/ezmlm/ezmlm-0.53/ezmlm-manage.c [root&lt; at &gt;tesla:/]$ Well... sorry but I am going to paste it into the body of this message. Not sure if the mailing list will strip attachments or not. Thanks for being willing to check it out! Cheers, Jg [root&lt; at &gt;tesla:/]$ cat /usr/local/src/ezmlm/ezmlm-0.53/ezmlm-manage.c #include &lt;sys/types.h&gt; #include &lt;sys/stat.h&gt; #include "error.h" #include "stralloc.h" #include "str.h" #include "env.h" #include "sig.h" #include "slurp.h" #include "getconf.h" #include "strer</pre> John Giordano 2013-04-01T17:10:47 http://permalink.gmane.org/gmane.mail.qmail.general/57565 <pre>Hi John, Am 28.03.2013 um 18:16 schrieb John Giordano: Hm. In my ezmlm-manage.c (version 0.53) I can't identify the piece of code which causes troubles at the location you mentioned. Pls. provide aus with the section of the source code, thus we can see, whether you use a patched version of ezmlm. Regarding 'alloc.c' you are missing probably '#include &lt;stdlib.h&gt;' at the beginning. regards. --eh. </pre> Erwin Hoffmann 2013-03-30T14:18:36 Search the mailing list at Gmane query http://search.gmane.org/?group=$group=gmane.mail.qmail.general