gmane.mail.qmail.general

Re: Ezmlm.org domain

Russ Nelson — 2012-05-24T05:13:10

 > On Mon, May 21, 2012 at 09:11:39PM +0200, Erwin Hoffmann wrote:
 > 
 > > (upps. what is happening with qmail.org ?)
 > 
 > Russ Nelson appears to be focusing on other things these days, or is
 > busy, or something.  Sent him a djbdns-related mail a few months ago and
 > didn't receive a response.

Yeah, I don't know enough about dnscurve to say whether the patch
should be up or not.

 > Speaking of which, his tinydns.org domain is about to expire:
 > Domain Name:TINYDNS.ORG
 > Created On:24-May-2000 16:17:40 UTC
 > Last Updated On:26-May-2011 05:01:47 UTC
 > Expiration Date:24-May-2012 16:17:40 UTC

Not to worry, I keep track of such things.

Re: tcpserver -p (paranoid) settings

Andy Bradford — 2012-05-23T01:07:23

Thus said kirk on Tue, 22 May 2012 14:08:07 PDT:


Your firewall  is misconfigured.  It should  reject connections  to port
113, and  not drop  them (or  allow them so  that the  IP stack  in your
computer can send a connection refused). When you use -v, tcpserver will
attempt to do IDENT lookups, and any firewall that drops packets to port
113, instead  of rejecting them, will  cause a 26 second  delay. You can
adjust the timeout using -t (the default is 26 seconds).

By the way, there are other benefits to having the IDENT lookup enabled.
It introduces a delay and many  spammers will drop the connection if the
banner  takes too  long  to come  up---the banner  won't  come up  until
tcpserver has gathered it's information.

Andy

Re: tcpserver -p (paranoid) settings

Erwin Hoffmann — 2012-05-22T21:19:44

Hi Kirk

you are missing the '-R' option:

 -R     Do not attempt to obtain $TCPREMOTEINFO from the remote host. To
              avoid loops, you must use this option for servers on  TCP  ports
              53 and 113.

regards.
--eh. 

PS: This is not a minor change.


Am 22.05.2012 um 23:08 schrieb kirk:

tcpserver -p (paranoid) settings

kirk — 2012-05-22T21:08:07

i've recently switched my qmail-smtpd/run script to this:

#exec /usr/local/bin/softlimit -m 100000000 \
# /usr/local/bin/tcpserver -v -R -l "$LOCAL" -x /etc/tcp.smtp.cdb -c 
"$MAXSMTPD" \
#   -u "$QMAILDUID" -g "$NOFILESGID" 0 smtp \
#       /usr/local/bin/rblsmtpd -b \
#        -r zen.spamhaus.org \
#        -r bl.spamcop.net \
#   /var/qmail/bin/qmail-smtpd mail.icapsolutions.com \
#   /home/vpopmail/bin/vchkpw /usr/bin/true 2>&1

exec /usr/local/bin/softlimit -m 100000000 \
   /usr/local/bin/tcpserver -v -p -l "$LOCAL" -x /etc/tcp.smtp.cdb -c 
"$MAXSMTPD" \
     -u "$QMAILDUID" -g "$NOFILESGID" 0 smtp \
         /usr/local/bin/rblsmtpd -b \
         -r zen.spamhaus.org \
         -r bl.spamcop.net \
     /var/qmail/bin/qmail-smtpd mail.icapsolutions.com \
     /home/vpopmail/bin/vchkpw /usr/bin/true 2>&1

i also have this in etc/tcp.smtpd:

127.:allow,RELAYCLIENT="",RBLSMTPD="",QMAILQUEUE="/var/qmail/bin/qmail-queue"
192.168.101.:allow,RELAYCLIENT="",RBLSMTPD="",QMAILQUEUE="/var/qmail/bin/qmail-queue"
192.168.1.:allow,RELAYCLIENT="",RBLSMTPD="",QMAILQUEUE="/var/qmail/bin/qmail-queue"
=:allow
:allow,RBLSMTPD="-You have a reverse DNS problem, contact us here 
http://www.icapsolutions.com/contact"


before the change to qmail-smtpd/run script (with the #'s) it was 
working with no issues.  with the minor change for "-p", now when i 
create a mail and hit "send", i get a good 15 to 20 second delay.  the 
mail goes out but with that long delay.  i got the above changes from here:
http://www.chrishardie.com/qmail-anti-spam-howto/#sysoption2

am i missing something?

kirk

Re: tcpserver & IPv6

Erwin Hoffmann — 2012-05-22T09:24:27

Hi Florian (and all who are interested),

currently I'm working on IPv6, and particular it's integration into ucspi-ssl and qmail. 
Felix already did most of the coding ;-)

Let me try to explain parts of the problem:

Your IPvX settings:

a) In your setting, you use IPv6 enabled tcpserver to catch any TCP packet for port 25.
     You bind tcpserver to ANY available IP address by means of the '0' 

b) tcpserver will happily accept any IPv4 AND IPv6 packet on any (at start) available IP address.

c) The IPv4 address your host has is '0.0.0.0' (unspecified), '127.0.0.1' (loopback) and the 
     dedicated address, lets lay 1.2.3.4.

d) IPv6 address you host has is '::' (unspecified), '::1' (loopback), the link-local LLU 
    address (fe80:....), and the Global IPv4 address, typically 2001:......

e) In case you have turned on IPv6 privacy extension, additional LLU AND Global addresses
    will come and go. I doubt, this is going to work with tcpserver anyway. 

Your smtp.cdb:

f) Let's consider tcpserver receives an IPvX packet. It needs to look inside the cdb. 
   Here you may have defined some IP based rules, typically '127.0.0.1:allow'. 

g) The kernel of your OS will translate any IPv4 DA in the packet to an IPv4-mapped IPv6 address. 
    The lookup will fail. 

h) tcpserver's rule don't work neither with IPv4 CIDR addresses nor IPv6 addresses. 
    For the first problem I have provided a patch, on the second issue I'm working on (better:
    one of my students). 

Some solution: 

i) Always bind tcpserver (and perhaps sslserver) to a dedicated IPv4/IPv6 address.
j) Use distinguished smtpd.cdbs for each case.
 
Of course:

k) rblsmtpd does currently not support IPv6 addresses.


Good luck and best regards.

--eh.

PS: You can check for some system commands to tune IPv6 in my talk about the Router Advertisement Protocol:

http://www.fehcom.de/ipnet/ipv6_en.html



Am 22.05.2012 um 09:33 schrieb flori< at >bin.org.in:

Re: tcpserver & IPv6

2012-05-22T07:33:54

Hello,

as I read it I expected that I do not need those switches. And heres  
the run file:

start-stop-daemon --start --user qmaild \
         --pidfile /var/run/tcpserver_smtpd.pid --make-pidfile \
         --exec \
         /usr/bin/tcpserver -- -R -H -l $HOSTNAME \
         -u vpopmail -g vpopmail -x /etc/tcp.smtp.cdb 0 smtp \
         $rblsmtpd /usr/sbin/qmail-smtpd \
         /var/vpopmail/bin/vchkpw /bin/true 2>&1 \
         | /usr/bin/multilog t n14 s1000000 /var/log/smtp &

Quoting Nicolai <nicolai-qmail< at >chocolatine.org>:




----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Re: tcpserver & IPv6

2012-05-22T07:12:37

Dear Panashe,

yes sorry forgot: Its a Debian sarge/squeeze with kernel 2.6.26-2-amd64..

regards Florian


Quoting Panashe Flack <lists222< at >m.l.vaunt.eu>:




----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Re: tcpserver & IPv6

Nicolai — 2012-05-21T22:06:30

You may need to modify your run file; Felix's patch (which the above is
apparently based on) adds new -4 and -6 arguments to tcpserver.  Post
your qmail-smtpd run file here.

Also what operating system are you using?

Nicolai

Re: Ezmlm.org domain

Andrew Richards — 2012-05-21T21:31:51

I think Bruce Guenter has been holding the fort for ezmlm. He's got a recent 
archive here,
untroubled.org/ezmlm/

cheers,

Andrew.

Re: Ezmlm.org domain

Bob Hutchinson — 2012-05-21T20:52:27

It is already registered
Domain name: ezmlm.net

Registrant Contact:

   Kenny Tsui ()

   Fax:
   107 Galleria Pky
   unit 1
   Thornhill, Ontario L3T7X4
   CA

Re: tcpserver & IPv6

Panashe Flack — 2012-05-21T21:07:31

you may want to provide a little more information, such as your linux distribution?

tcpserver & IPv6

Florian Leeber — 2012-05-21T20:46:07

Hello all,

I am playing around with IPv6 a bit and found those instructions on the
net: http://www.brandonturner.net/blog/2009/08/qmail-ipv6-tcpserver/ -
however, after applying the patch exactly nothing changed. tcpserver
does not seem to bind itself to the IPv6 stack, also, there is no error
or informational message. Rest of the system including sshd, apache and
dovecot is already "dualhomed", so I know that kernel and other stuff is
pretty fine.

Any ideas?

regards Florian

Re: Ezmlm.org domain

Erwin Hoffmann — 2012-05-21T20:24:21

Hi


Am 21.05.2012 um 21:38 schrieb Nicolai:



Uff.


Not yet. But to my knowledge it is still free. 

I just does want the community to ask for a 'go' and perhaps the input and some links to be re-adjusted. 

I'm still planning to support qmail & add-ons on a larger scale -- check my website under 'ip-networks'.

regards.
--eh.

Re: Ezmlm.org domain

Nicolai — 2012-05-21T19:38:26


Russ Nelson appears to be focusing on other things these days, or is
busy, or something.  Sent him a djbdns-related mail a few months ago and
didn't receive a response.  Speaking of which, his tinydns.org domain is
about to expire:

Domain Name:TINYDNS.ORG
Created On:24-May-2000 16:17:40 UTC
Last Updated On:26-May-2011 05:01:47 UTC
Expiration Date:24-May-2012 16:17:40 UTC


You own ezmlm.net?

Nicolai

Re: Ezmlm.org domain

David T. Ashley — 2012-05-21T19:33:28

Hi Erwin,

You may do that of course.  I also prophylactically snatched up
ezmlm-idx.org to prevent domain speculation.

I've been in touch with Bruce G. and I do have the identity of the person
who was the previous domain registrant.

My only concern about this whole mess with the domain is how to keep it
from recurring.  As I understand the current situation, the previous
registrant of ezmlm.org had an invalid e-mail on record with the registrar
and so didn't get the expiration warnings.  But even without that sort of a
mess, someone could easily fall ill or have other issues, and there needs
to be a succession plan and a better way to do this.

For example, I'm 49, eat too much at McDonald's and Starbucks, ride a
motorcycle, have a pilot's license, and also drink and gamble excessively.
The list of things that could kill me in any given week is substantial.  I
could catch a bullet between the eyes from another Blackjack player because
I'm counting cards and split 10's--and that is probably my smallest risk. :
)

OK, you could register ezmlm.net (if you haven't already), or I could
donate ezmlm-idx.org for group use.  But how do we have joint ownership or
somehow keep the mistake that happened with ezmlm.org from recurring?

It seems to me we ought to answer those questions before we select a domain
name or try to obtain or rebuild the mailing list ...

Thanks, Dave Ashley


On Mon, May 21, 2012 at 3:11 PM, Erwin Hoffmann <feh< at >fehcom.de> wrote:

Ezmlm.org domain

Erwin Hoffmann — 2012-05-21T19:11:39

Hi,

ezmlm.org has disappeared.

(upps. what is happening with qmail.org ?)

I'm willing to set up a new domain 'ezmlm.net' (running on my server -- with ezmlm of course) hosting the domain and to support it to some extend.



Does anyone have the current content and the list of subscribers ?

Feel free to contact me. 

regards.
--eh.

netqmail-1.06-channels.patch - domain control

kirk — 2012-05-16T14:49:04

I've found this patch while searching for something that would help to 
control outgoing messages on a per domain basis.  Mainly I need it for 
recipients with domains of yahoo and hotmail  etc., the top major 
account providers.

the patch is found here:
http://www.thesmbexchange.com/eng/netqmail-1.06-channels.patch

I've loaded the patch and it appears to work.  It creates multiple 
instances of the qmail-rspawn based on a a few simple control files.  
The question I have is regarding the concurrency limit.  The 
documentation describes concurrency briefly, but what I don't know is 
how it applies to qmail-rspawn.  If I run multiple instances of 
qmail-rspawn, is the concurrency limit applied to "each" instance, or is 
it accumulative?  In other words, I have my qmail server set up with the 
standard build netqmail-1.06, with the patch above, and have a default 
concurrency limit set to 250.  The patch provides config files to 
isolate domains, so I set up 5 config "channels", each one limits the 
amount of traffic to 100 connections (a sudo concurrency limit of 100) 
and spinning off 5 instance of qmail-rspawn.  So if the default 
concurrency limit is set to 250, and I have 5 instances of qmail-rspawn 
each that can handle 100 connection each, will the concurrency limit 
become breached and crash qmail?  Or is "each" instance of qmail-rspawn 
limited to 250?

Thanks,
Kirk

Re: Thanks in advance for your help- qmail-smtpd issue

Hugo Monteiro — 2012-05-16T14:29:55

Verify the number of max file descriptors your system allows.
But what you really should start doing is to check the logs for
messages indicating the problem.

Regards,

Hugo Monteiro.


On Wed, May 16, 2012 at 3:18 PM, David Enrique Espejo Rodriguez
<despejo< at >ifxcorp.com> wrote:

Thanks in advance for your help- qmail-smtpd issue

David Enrique Espejo Rodriguez — 2012-05-16T14:18:06

Good morning community:

We are having a very annoying issue with a qmail-ldap 1.03 implementation with approx 30k mailboxes. Suddenly, the users begin to receive an error like "451 mail server temporarily rejected message" when they try to send from webmail or desktop mail client. The qmail-smtpd sockets remain open, and the only workaround is to restart the service. We haven´t found evidence of spam attack, but the issue is occurring now every day.

We really appreciate your help, because is hitting our production system.

Thanks

David  Espejo
Colombia

***** Aviso de Confidencialidad *****
Este mensaje, (incluyendo cualquier anexo) está dirigido únicamente a los destinatarios arriba señalados. Puede contener información confidencial o privilegiada y no debe ser leído, copiado o de otra forma utilizado por cualquier otra persona. Si usted recibe esta comunicación por error, favor avisar al remitente y eliminar el mensaje de su sistema.

***** Disclaimer *****
This email (including any attachments) is intended only for the recipient(s) named above. It may contain confidencial or privileged information and should not be read, copied or otherwise used by any other person. If you are not a recipient, please contact the sender and delete the email from your system.

Re: send mail from multiple ip's

kirk — 2012-05-10T23:32:37

i've installed a fresh qmail install (via lifewithqmail) on Fedora 16 
along with lukasfeiler.com-bigqmail.patch and everything appears to be 
running.  i did have to add this one step for getting the svscan daemon 
running, here it is just in case anyone cares:
$ vi /usr/local/etc/svscan.service
~~~ put this in it:
[Unit]
Description=Daemontools svscan

[Service]
ExecStart=/usr/local/bin/svscanboot
Restart=on-abort

[Install]
WantedBy=multi-user.target
~~~~~~~~~~~~~~~~~~~~~~~
$ ln -s /usr/local/etc/svscan.service /etc/systemd/system
$ systemctl start svscan.service

but that was minor.  since i needed the patch for 2 features, 
concurrencyremote and outgoingips, his patch seemed reasonable.  
however, i cant find any documentation as to configure the various 
features, and i cant seem to connect on port 25 which obviously fails 
due to the smtp_auth patch.

this link appears to be dead: http://shupp.org/smtp-auth-tls so i dont 
know what to change in what i think is /var/qmail/supervise/qmail-smtpd/run.

does (or has) anyone used this and can you point me to the doc page for 
configuration?

thanks
kirk






On 4/25/2012 11:34 AM, Erwin Hoffmann wrote:

Re: limit outgoing "from" to domains in rcpthosts

Kyle Wheeler — 2012-04-29T16:24:33

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Wednesday, April 25 at 09:13 PM, quoth ahlist:

The first way that springs to mind is a simple wrapper around 
qmail-remote. All you have to do is compare the second argument to 
rcpthosts, like this:

#!/bin/bash
if grep -q "$2" /var/qmail/control/rcpthosts ; then
   exec /var/qmail/bin/qmail-remote.orig "$< at >"
else
   # If you want to save it, cat it somewhere here, e.g.:
   # safecat /var/log/spam_msgs/tmp /var/log/spam_msgs/cur
fi

That assumes that you moved the original qmail-remote binary to 
/var/qmail/bin/qmail-remote.orig

If you already use a wrapper around qmail-remote (like my DKIM 
wrapper), that logic should be easy to add.


This would be log analysis; there are a couple good packages, starting 
with DJB's own qmailanalyse, and going on to Dr. Hoffman's newanalyse 
package.

Hope that helps!

~Kyle
- -- 
There are four boxes to be used in defense of liberty: soap, ballot, 
jury, and ammo. Please use in that order.
                                                      -- Ed Howdershelt
-----BEGIN PGP SIGNATURE-----
Comment: Thank you for using encryption!

iQIcBAEBCAAGBQJPnWtBAAoJECuveozR/AWeRNIP/0SewuLJQNhEhxfJORcfJe9O
CldQUHhCnsq6NzTEgkO+eTzJQ7q8VG2bArdW6FU2z9yr8naKKLpuYgGW0jFTlmP5
kuHstaRqzU48yDqgqccsut89pbadvphkAFSVGDaqK2b/t/RMIclobOf+lSiUpBTq
zeHX8RIeLnYoCBv8S0WRT8NqyT3srjQ/fvs0LEgeriKlH5Yfm7uTQnTwMznyJMGU
qNm9IPsBxqH/dY/YTD/SRgBZ36UA8bcGdyw05IN64tQ8DUtzGwajpEU9ujPCSNig
PjsVfLf5hK59V8jOd+DElPhe0Yo8h6RB5tbgEcrP06sE0lJYB4zKOTdiE7OxPWMg
AW6mCV+zjvPwldqxL5gdaRy9nJeogzKnW3LlWNg3rVAHWJ8klcaILywX7YUvg5Ji
nsUsQKX6lfw0xQkVy7fPfw7iT5AQRdHGMNOtXNM1gDzhPDxn2Rx9UlYdz4RseRbZ
rXKqP3UT4y4rYOXRHoGV01De8U8xiBhBZKBSq2R2NNBfem1/6eOuWSFpF4lylKDB
gyphw67udHb/qvP3e3gqlltuRrpH+9IcUOlgsCeIHzhdtMxgROr04svxL+QWrnM2
2rAARqAtE0NhEzoMhspgLPQEiXfLTIpdt6g2LKWeXaawMqpD0Vew5t3nv1rilNFR
x9VhUs+y+9Af9B7H9P0A
=wX2p
-----END PGP SIGNATURE-----