- More info on Life with qmail
- README.vdelivermail
Changelog
- Jul 31, 2024
multilog uses "d" flag as default to gain compatibility with the readable datetime format of multilog in daemontools-0.78. Change it with the "t" flag if you prefer to have timestamps. - Jul 6, 2024
enabled auth and turned off STARTTLS on port 465 (tx Alexandre Chaves Fonceca) - Mar 8, 2024
qmail-smtpd/run
andqmail-smtpsd/run
files: check ifsimscan
is installed in order to runqmail
also in that case - Feb 4, 2023
rc file: the DKIM_ON variable was not evaluated correctly, so DKIM was always active. Fixed-if [ -r ${QMAILDIR}/control/filterargs ] && [ -n $DKIM_ON ]; then +if [ -r ${QMAILDIR}/control/filterargs ] && [ -n "$DKIM_ON" ]; then
- Jan 21, 2024
tcprules files moved to qmail/control
Index
- Defining alias and control files
- Setup the log dirs
- Defining the supervise scripts
- rc file
- qmail-smtpd/run
- qmail-smtpsd/run
- qmail-send/run
- qmail-submission/run
- vpopmaild
- vusaged
- cronjobs
- qmailctl
- tcprules
- svtools
- Running qmail at boot time
Defining alias and control files
QMAILDIR=/var/qmail echo 3 > $QMAILDIR/control/spfbehavior echo "| ~vpopmail/bin/vdelivermail '' delete" > $QMAILDIR/control/defaultdelivery echo 200 > $QMAILDIR/control/concurrencyincoming echo noreply > $QMAILDIR/control/bouncefrom echo 20000000 > $QMAILDIR/control/databytes echo 272800 > $QMAILDIR/control/queuelifetime echo 30000000 > $QMAILDIR/control/softlimit echo 100 > $QMAILDIR/control/maxrcpt echo 2 > $QMAILDIR/control/brtlimit echo 10000000 > /var/qmail/control/simsizelimit cd /usr/local/src/netqmail-1.06 ./config-fast smtp.mydomain.tld
When you run ./config-fast
it will automatically populate these files: defaultdomain, locals, me, plusdomain, rcpthosts
. smtp.yourdomain.tld
will be the name of your MTA and it must have a valid MX record.
defaultdomain
when you have many domains on the same server (defined later in thevirtualhost
file) this is the default domainlocals
domains that we deliver locally (qmail-send
viaqmail-lspawn
program). Other domains are spawned byqmail-rspawn
and delivered to other MTAs. The domains listed inlocals
should not be confused withvirtualdomains
; infact,qmail-send
doesn't even readvirtualdomains
if the recipient domain is already listed inlocals
and in that case you'll get a "no mailbox" error message. This is the reason why it's not a good idea to use a virtualdomain as the name of the MTA.me
the name of the server. This is the domain name that appers in thefrom
field when you receive system messages, for instance. It's also the domain used in theHELO
(i.e. the greeting at the very beginning of theSMTP
conversation). It must have a validMX
record in ourDNS
, and also theSPF
andDKIM
records as we'll see later. Also,me
should be your reverseDNS
domain, as some provider may block you if theHELO
domain is not associated with theIP
address.plusdomain
domain substituted for trailing "+"rcpthosts
Domains that we accept mail for. Later you will see howchkuser
rejects incoming emails for non existing recipients.spfbehavior
concerns the SPF configuration.softlimit
sets soft resource limits forqmail-smtpd
bouncefrom
is the username of bounce sender. You may want to definebouncefrom as well, i.e. the domain of bounce sender, which defaults to
me
.databytes
is the max number of bytes in message (0=no limit).queuelifetime
are the seconds a message can remain in queue.maxrcpt
sets a limit on how many recipients are specified for any one email message (qmail-maxrcpt
patch).brtlimit
is the maximum allowed numer of not found recipients. The connection with the remote host will be closed if this number is exceeded (brtlimit patch)defaultdelivery
is the default.qmail
file. It tellsqmail
how to deliver the email. In case you didn't understand yet how the delivery is done, please read at this point the relaying chapter of Life with qmail and expecially the README.vdelivermail that comes withvpopmail
, which explains how the.qmail
files are used.simsizelimit
We define in advance a variable forsimscan
, which we'll install later. It defines the maximum size in bytes of the messages thatsimscan
will pass tospamassassin
.
You can find an exhaustive presentation of all control configuration files on Life with qmail book http://www.lifewithqmail.org/lwq.html#configuration
Setup the primary administrator's email address. This address will receive mail for root, postmaster, and mailer-daemon. Replace postmaster@yourdomain.tld with the administrator email address (postmaster):
cd $QMAILDIR/alias echo "postmaster@mydomain.tld" > .qmail-postmaster ln -s .qmail-postmaster .qmail-mailer-daemon ln -s .qmail-postmaster .qmail-root chmod 644 .qmail*
Setup the log dirs
The log dirs belong to qmaill.nofiles
user and should not be accessible by other users
mkdir -p /var/log/qmail chown -R qmaill:nofiles /var/log/qmail chgrp root /var/log/qmail chmod -R og-wrx /var/log/qmail chmod g+rx /var/log/qmail
Defining the supervise scripts
- References: tcpserver page
Download the startup scripts from here and untar
cd $QMAILDIR wget https://notes.sagredo.eu/files/qmail/supervise.tar.gz tar xzf supervise.tar.gz chown -R root:root rc supervise rm supervise.tar.gz
You can see the rc
excutable, which is the qmail-start
script, and the supervise
folder:
rc supervise/ | |----qmail-smtpd/ | | | |-----run | |-----log/ | | | |---run | |----qmail-smtpsd/ | | | |-----run | |-----log/ | | | |---run | |----qmail-submission/ | | | |-----run | |-----log/ | | | |---run | |----qmail-send/ | | | |-----run | |-----log/ | | | |---run | |----vpopmaild/ | | | |-----run | |-----log/ | | | |---run | |----vusaged/ | |-----run |-----log/ | |---run
When you create symbolic links to a supervise directory in the /service dir, the run
command will be executed at boot time when /command/svcscanboot is launched, i.e. at boot time.
QMAILDIR=/var/qmail ln -s $QMAILDIR/supervise/qmail-smtpd /service ln -s $QMAILDIR/supervise/qmail-smtpsd /service ln -s $QMAILDIR/supervise/qmail-submission /service ln -s $QMAILDIR/supervise/qmail-send /service ln -s $QMAILDIR/supervise/vpopmaild /service ln -s $QMAILDIR/supervise/vusaged /service ln -s $QMAILDIR/supervise/clear /service
Let's see more in detail the supervise scripts that we have downloaded. Many lines are still commented out because concern features that will be activated later. For the moment only the basic functionalities remain active.
File qmail/rc
#!/bin/sh QMAILDIR=/var/qmail # Comment out DKIM_ON=1 to disable dkim sign at qmail-remote level # You have to define your variables in control/filterargs (DKIM page for more info) # echo "*:remote:/var/qmail/bin/qmail-dkim:DKIMQUEUE=/bin/cat,DKIMSIGN=/var/qmail/control/domainkeys/%/default,DKIMSIGNOPTIONS=-z 2" > /var/qmail/control/filterargs #DKIM_ON=1 if [ -r $QMAILDIR/control/filterargs ] && [ -n "$DKIM_ON" ]; then # DKIM sign at qmail-remote level exec env - PATH="$QMAILDIR/bin:$PATH" \ QMAILREMOTE=$QMAILDIR/bin/spawn-filter \ qmail-start "`cat $QMAILDIR/control/defaultdelivery`" else # Use this if you are signing at qmail-smtpd level or you don't want to sign at all exec env - PATH="$QMAILDIR/bin:$PATH" \ qmail-start "`cat $QMAILDIR/control/defaultdelivery`" fi
Do not bother of the lines concerning the DKIM settings. The server can work with those lines active. We will cover that topic later in this guide.
File qmail/supervise/qmail-smtpd/run
#!/bin/sh QMAILDIR=/var/qmail QMAILDUID=`id -u vpopmail` NOFILESGID=`id -g vpopmail` MAXSMTPD=`cat $QMAILDIR/control/concurrencyincoming` SOFTLIMIT=`cat $QMAILDIR/control/softlimit` LOCAL=`head -1 $QMAILDIR/control/me` TCPRULES_DIR=/var/qmail/control #export REJECTNULLSENDERS=1 #export SMTPAUTH="!cram" # qmail-spp plugins #export ENABLE_SPP=1 #export HELO_DNS_CHECK=PLRIV # enable greetdelay for qmail-smtpd export SMTPD_GREETDELAY=20 export DROP_PRE_GREET=1 # greylisting #export JGREYLIST_DIR="$QMAILDIR/jgreylist" #export JGREYLIST_LOG_SMTP=1 # enable chkuser export CHKUSER_START=ALWAYS ################### DKIM - SURBL configuration ################################# # DKIMQUEUE and SURBLQUEUE are front-ends of qmail-queue export SURBL=1 # Comment out to enable SURBL filtering # If simscan is not installed yet, do not assign QMAILQUEUE # so that the installation works at the beginning stage as well if [ -x $QMAILDIR/bin/simscan ]; then export QMAILQUEUE=$QMAILDIR/bin/surblqueue # executes surblfilter export SURBLQUEUE=$QMAILDIR/bin/simscan # executes simscan after SURBL #export QMAILQUEUE=$QMAILDIR/bin/simscan # do not execute SURBL nor DKIM filtering #### qmail-dkim disabled => no dkim verification #### to have verification active export SURBLQUEUE=$QMAILDIR/bin/qmail-dkim. Othewise the following will be ignored #export SURBLQUEUE=$QMAILDIR/bin/qmail-dkim # executes qmail-dkim after surblfilter export DKIMQUEUE=$QMAILDIR/bin/simscan # simscan is executed after qmail-dkim # DKIM verification. Use carefully export DKIMVERIFY="FGHKLMNOQRTVWp" # allow msg without "subject" in the h= list export UNSIGNED_SUBJECT=1 # avoid verification of outgoing messages export RELAYCLIENT_NODKIMVERIFY=1 fi ################################################################################ # turn off TLS on port 25 #export DISABLETLS="1" # require that authenticated user and 'mail from' are identical export FORCEAUTHMAILFROM="1" # rcptcheck-overlimit. Limits the number of emails sent by relayclients if [ -x $QMAILDIR/bin/rcptcheck-overlimit.sh ]; then export RCPTCHECK=$QMAILDIR/bin/rcptcheck-overlimit.sh export RCPTCHECKRELAYCLIENT="1" fi # enable simscan debug #export SIMSCAN_DEBUG=4 #export SIMSCAN_DEBUG_FILES=2 exec /usr/local/bin/softlimit -m "$SOFTLIMIT" \ /usr/local/bin/tcpserver -v -R -l "$LOCAL" \ -x $TCPRULES_DIR/tcp.smtp.cdb -c "$MAXSMTPD" \ -u "$QMAILDUID" -g "$NOFILESGID" 0 25 \ $QMAILDIR/bin/qmail-smtpd /bin/true 2>&1
Note that the standard smtp
(port 25) does not allow the authentication.
You have to adjust the resource limit (softlimit
in bytes). Each system is different, and has different requirements. Life with qmail
suggests just 2MB. You have to experiment the correct value increasing by steps of 1MB, especially once you have loaded spamassassin
, clamAV
and simscan
(the mail scanner).
We'll cover GREETDELAY
and DKIM
later.
multilog
considerations
multilog
program
As already mentioned in the daemontools
page, you can get multilog
to print loglines with timestamps, as the original program's behaviour does, or with a human readable datetime format. The usage changes as far as the very first argument is concerned, as timestamp goes with t
while the readable datetime goes with a d
.
So, these is the usage for datetime:
multilog d <other-arguments> <script>
which prints something like
2024-07-31 18:06:03.823254532 tcpserver: status: 0/200/0
and this is for timestamps
multilog t <other-arguments> <script>
which prints something like
@4000000066aa062d281ba97c tcpserver: status: 0/200/0
This guide uses datetime as default.
File qmail/supervise/qmail-smtpd/log/run
#!/bin/sh LOGUSER="qmaill" LOGDIR="/var/log/qmail/smtpd" LOGDIRQLOG="/var/log/qmail/smtpd/qlog" if [ -x /usr/local/bin/archive_qmail_qlog ]; then exec /usr/local/bin/setuidgid $LOGUSER /usr/local/bin/multilog d n5 s16777215 $LOGDIR \ n5 s16777215 '-*' '+*qlog*' !/usr/local/bin/archive_qmail_qlog $LOGDIRQLOG else exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog d s16777215 $LOGDIR fi
If you want to print timestamps instead of readable datimes that qlog
line above has to be changed as follows (note the additional blank space):
n5 s16777215 '-*' '+* qlog*' !/usr/local/bin/archive_qmail_qlog $LOGDIRQLOG
If you want to have a dir (/var/log/qmail/smtpd/qlog) which saves separately just the "qlogenvelope
" lines as follows:
@400000005855db3028811e24 qlogenvelope: result=accepted code=250 reason=rcptto detail=chkuser helo=smtp.senderdomain.com mailfrom=sender@senderdomain.com rcptto=user@rcptdomain.com relay=no rcpthosts=yes size= authuser= authtype= encrypted= sslverified=no localip=10.0.0.4 localport=25 remoteip=83.103.72.231 remoteport=43618 remotehost= qp= pid=11928 @400000005855db322a892324 qlogreceived: result=accepted code=250 reason=queueaccept detail= helo=smtp.senderdomain.com mailfrom=sender@senderdomain.com rcptto=user@rcptdomain.com relay=no rcpthosts= size=2689 authuser= authtype= encrypted= sslverified=no localip=10.0.0.4 localport=25 remoteip=83.103.72.231 remoteport=43618 remotehost= qp=11934 pid=11928
then create the archive_qmail_qlog
cat > /usr/local/bin/archive_qmail_qlog << __EOF__ #!/bin/sh tai64nlocal >> /var/log/qmail/smtpd/qlog/qmail-smtpd.log # let's prepare the same for qmail-smtpsd tai64nlocal >> /var/log/qmail/smtpsd/qlog/qmail-smtpsd.log __EOF__ chmod +x /usr/local/bin/archive_qmail_qlog
In this way we have the /var/log/qmail/smtpd/qmail-smtpd.log file with just the qlog
lines in human-readable time format:
2016-01-29 13:15:17.677946500 qlogenvelope: result=accepted code=250 reason=rcptto detail=chkuser helo=smtp.senderdomain.com mailfrom=sender@senderdomain.com rcptto=user@rcptdomain.com relay=no rcpthosts=yes size= authuser= authtype= encrypted= sslverified=no localip=10.0.0.4 localport=25 remoteip=83.103.72.231 remoteport=43618 remotehost= qp= pid=11928 2016-01-29 13:15:17.677946500 qlogreceived: result=accepted code=250 reason=queueaccept detail= helo=smtp.senderdomain.com mailfrom=sender@senderdomain.com rcptto=user@rcptdomain.com relay=no rcpthosts= size=2689 authuser= authtype= encrypted= sslverified=no localip=10.0.0.4 localport=25 remoteip=83.103.72.231 remoteport=43618 remotehost= qp=11934 pid=11928
You may want to rotate this log file saving a "qlog" file like this in your logrotate configuration (/etc/logrotate.d/qlog in my Slackware):
cat > /etc/logrotate.d/qlog << __EOF__ /var/log/qmail/smtpd/qlog/qmail-smtpd.log /var/log/qmail/smtpsd/qlog/qmail-smtpsd.log { missingok notifempty delaycompress rotate 50 daily minsize 2M create 0644 qmaill root } __EOF__
File /var/qmail/supervise/qmail-smtpsd/run
#!/bin/sh QMAILDIR=/var/qmail QMAILDUID=`id -u vpopmail` NOFILESGID=`id -g vpopmail` MAXSMTPD=`cat $QMAILDIR/control/concurrencyincoming` SOFTLIMIT=`cat $QMAILDIR/control/softlimit` LOCAL=`head -1 $QMAILDIR/control/me` TCPRULES_DIR=/var/qmail/control SSL_DIR="$QMAILDIR/control" SSL_CHROOT="$SSL_DIR" SSL_UID=$QMAILDUID SSL_GID=$NOFILESGID CERTFILE="$SSL_DIR/servercert.pem" KEYFILE="$SSL_DIR/servercert.pem" DHFILE="$SSL_DIR/dh4096.pem" export SSL_UID SSL_GID SSL_CHROOT export CERTFILE KEYFILE DHFILE #export REJECTNULLSENDERS=1 export SMTPAUTH="!" # qmail-spp plugins #export ENABLE_SPP=1 #export HELO_DNS_CHECK=PLRIV # This enables greetdelay for qmail-smtpd export SMTPD_GREETDELAY=20 export DROP_PRE_GREET=1 # greylisting #export JGREYLIST_DIR="$QMAILDIR/jgreylist" #export JGREYLIST_LOG_SMTP=1 # enable chkuser export CHKUSER_START=ALWAYS ################### DKIM - SURBL configuration ################################# # DKIMQUEUE and SURBLQUEUE are front-ends of qmail-queue export SURBL=1 # Comment out to enable SURBL filtering # If simscan is not installed yet, do not assign QMAILQUEUE # so that the installation works at the beginning stage as well if [ -x $QMAILDIR/bin/simscan ]; then export QMAILQUEUE=$QMAILDIR/bin/surblqueue # executes surblfilter export SURBLQUEUE=$QMAILDIR/bin/simscan # executes simscan after SURBL #export QMAILQUEUE=$QMAILDIR/bin/simscan # do not execute SURBL nor DKIM filtering #### qmail-dkim disabled => no dkim verification #### to have verification active export SURBLQUEUE=$QMAILDIR/bin/qmail-dkim. Othewise the following will be ignored #export SURBLQUEUE=$QMAILDIR/bin/qmail-dkim # executes qmail-dkim after surblfilter export DKIMQUEUE=$QMAILDIR/bin/simscan # simscan is executed after qmail-dkim # DKIM verification. Use carefully export DKIMVERIFY="FGHKLMNOQRTVWp" # allow msg without "subject" in the h= list export UNSIGNED_SUBJECT=1 # avoid verification of outgoing messages export RELAYCLIENT_NODKIMVERIFY=1 fi ################################################################################ # turn off TLS on port 465 export DISABLETLS=1 export FORCETLS=0 # require that authenticated user and 'mail from' are identical export FORCEAUTHMAILFROM="1" # rcptcheck-overlimit. Limits the number of emails sent by relayclients if [ -x $QMAILDIR/bin/rcptcheck-overlimit.sh ]; then export RCPTCHECK=$QMAILDIR/bin/rcptcheck-overlimit.sh export RCPTCHECKRELAYCLIENT="1" fi # enable simscan debug #export SIMSCAN_DEBUG=4 #export SIMSCAN_DEBUG_FILES=2 exec /usr/local/bin/softlimit -m "$SOFTLIMIT" \ /usr/local/bin/sslserver -seV -Rp -l "$LOCAL" \ -Xx $TCPRULES_DIR/tcp.smtp.cdb -c "$MAXSMTPD" \ -u "$QMAILDUID" -g "$NOFILESGID" 0 smtps \ $QMAILDIR/bin/qmail-smtpd ~vpopmail/bin/vchkpw /bin/true 2>
File qmail/supervise/qmail-smtpsd/log/run
#!/bin/sh LOGUSER="qmaill" LOGDIR="/var/log/qmail/smtpsd" LOGDIRQLOG="/var/log/qmail/smtpsd/qlog" if [ -x /usr/local/bin/archive_qmail_qlog ]; then exec /usr/local/bin/setuidgid $LOGUSER /usr/local/bin/multilog d n5 s16777215 $LOGDIR \ n5 s16777215 '-*' '+*qlog*' !/usr/local/bin/archive_qmail_qlog $LOGDIRQLOG else exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog d s16777215 $LOGDIR fi
Again, if you want to print timestamps instead of readable datimes that qlog
line above has to be changed as follows (note the additional blank space):
n5 s16777215 '-*' '+* qlog*' !/usr/local/bin/archive_qmail_qlog $LOGDIRQLOG
File qmail/supervise/qmail-send/run
#!/bin/sh exec /var/qmail/rc
File qmail/supervise/qmail-send/log/run
#!/bin/sh exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog d s16000000 n200 /var/log/qmail/send
File qmail/supervise/qmail-submission/run
This service makes the MTA also act as an outgoing relay, but the user must authenticate (with TLS encryption).
#!/bin/sh QMAILDIR=/var/qmail QMAILDUID=`id -u vpopmail` NOFILESGID=`id -g vpopmail` MAXSMTPD=`cat $QMAILDIR/control/concurrencyincoming` SOFTLIMIT=`cat $QMAILDIR/control/softlimit` LOCAL=`head -1 $QMAILDIR/control/me` TCPRULES_DIR=/var/qmail/control # You MUST export this, otherwise you'd get a 30 sec timeout # "!" if you want the submission feature (auth required) export SMTPAUTH="!" # This enables greetdelay for qmail-smtpd. export SMTPD_GREETDELAY=3 export DROP_PRE_GREET=1 # This enables chkuser export CHKUSER_START=ALWAYS # This makes qmail to allow connections without TLS (default 1) #export FORCETLS=0 # This turns off TLS on port 587 (default 0) #export DISABLETLS=1 # Requires that authenticated user and 'mail from' are identical (default 0) export FORCEAUTHMAILFROM=1 # rcptcheck-overlimit. Limits the number of emails sent by relayclients #export RCPTCHECK=$QMAILDIR/bin/rcptcheck-overlimit.sh #export RCPTCHECKRELAYCLIENT=1 exec /usr/local/bin/softlimit -m "$SOFTLIMIT" \ /usr/local/bin/tcpserver -v -R -l "$LOCAL" \ -x $TCPRULES_DIR/tcp.submission.cdb -c "$MAXSMTPD" \ -u "$QMAILDUID" -g "$NOFILESGID" 0 587 \ $QMAILDIR/bin/qmail-smtpd \ ~vpopmail/bin/vchkpw /bin/true 2>&1
Note the use of vchkpw in conjunction with qmail-smtpd to ensure authentication. The connection requires TLS
enabled. This is the reason why we opened a separate secure connection on port 587 to allow remote clients to use our MTA as a relay.
The SMTPAUTH
variable is related to the authentication patch. You are invited to take a look to the README.auth file for further details.
File qmail/supervise/qmail-submission/log/run
#!/bin/sh LOGUSER="qmaill" LOGDIR="/var/log/qmail/submission" exec /usr/local/bin/setuidgid $LOGUSER /usr/local/bin/multilog d s16000000 n200 $LOGDIR
File qmail/supervise/vpopmaild/run
#!/bin/sh QMAILDUID=`id -u root` NOFILESGID=`id -g root` VPOPMAILID=`id -g vpopmail` exec /usr/local/bin/softlimit -m 30000000 \ /usr/local/bin/tcpserver -v -H -R -l 0 \ -u $QMAILDUID -g $NOFILESGID 0 $VPOPMAILID \ ~vpopmail/bin/vpopmaild 2>&1
vpopmaild
is important when connecting to vpopmail
via webmail to change the password, for instance.
File qmail/supervise/vpopmaild/log/run
#!/bin/sh LOGUSER="qmaill" LOGDIR="/var/log/qmail/vpopmail" exec /usr/local/bin/setuidgid $LOGUSER /usr/local/bin/multilog d $LOGDIR
File qmail/supervise/vusaged/run
#!/bin/sh exec ~vpopmail/bin/vusaged 2>&1
File qmail/supervise/vusaged/log/run
#!/bin/sh exec setuidgid qmaill /usr/local/bin/multilog d /var/log/qmail/vusaged
cronjobs
To backup the log files of the qmail
services we'll use the convert-multilog script from John Simpson (thanks to the author and to Marc for the suggestion) who describes the script as follows:
convert-multilog is a script which searches "/service/*/log/main" for any "@4*" files (the automatic cut-off files generated by multilog), converts their timestamps from tai64n to human-readable format, and writes them to /var/log/{service}.{date}. Once the lines from a given "@4*" file have been converted, the file is deleted.
The log files are saved separated by date, for example
-rw-r--r-- 1 root root 259558 Aug 24 12:21 qmail-smtpd.2014-08-20 -rw-r--r-- 1 root root 806917 Aug 24 12:21 qmail-smtpd.2014-08-21 -rw-r--r-- 1 root root 1523116 Aug 24 12:21 qmail-smtpd.2014-08-22 -rw-r--r-- 1 root root 364022 Aug 24 12:21 qmail-smtpd.2014-08-23
Inside each file the date is now human-readable
2014-08-23 00:31:49.503947500 tcpserver: status: 1/20
This is very useful when you have to do quick searches.
Install like this:
mkdir -p /var/log/qmail/backup wget -O /usr/local/bin/convert-multilog https://notes.sagredo.eu/files/qmail/convert-multilog chmod +x /usr/local/bin/convert-multilog ln -s /var/log/qmail/send /service/qmail-send/log/main ln -s /var/log/qmail/smtpd /service/qmail-smtpd/log/main ln -s /var/log/qmail/smtpsd /service/qmail-smtpsd/log/main ln -s /var/log/qmail/submission /service/qmail-submission/log/main
NB: the script that you have downloaded is my patched version, which gains compatibility with the readable datetime format (daemontools' multilog_readable-datetime
patch). If you decided to use timestamps, then download the original convert-multilog
program.
Now set up a cronjob once a day (crontab -e):
59 2 * * * /usr/local/bin/convert-multilog 1> /dev/null
Since we want to convert each log file every day, we have to rotate them on a daily basis. So we'll add something like this to our crontab:
0 0 * * * /usr/local/bin/svc -a /service/qmail-submission/log 0 0 * * * /usr/local/bin/svc -a /service/qmail-smtpd/log 0 0 * * * /usr/local/bin/svc -a /service/qmail-smtpsd/log 0 0 * * * /usr/local/bin/svc -a /service/qmail-send/log 0 0 * * * /usr/local/bin/svc -a /service/vpopmaild/log 0 0 * * * /usr/local/bin/svc -a /service/vusaged/log
qmailctl script
- Reference: Life with qmail
- Download qmailctl (thanks to Sam Tang)
As usual we will put the script in /usr/local/bin and give it the +x flag.
wget -O /usr/local/bin/qmailctl https://notes.sagredo.eu/files/qmail/qmailctl chmod +x /usr/local/bin/qmailctl
The startup script below does the following:
- Starts/stops the services
- Calls
tcprules
to reloadtcp.smtp.cdb
andtcp.submission.cdb
- Shows the status of the services and the queue
- Shows the up/down status of some other related daemons
- Shows the the date of the
clamav
database
Note that it starts and stops vpopmaild
also, and starts both normal SMTP on port 25, and the submission service on port 587, where SMTP authentication is required to perform outgoing relay for remote users. In any event, be sure to review the service list to make sure it reflects the services you want to provide.
#!/bin/bash # # tx Sam Tang # # May 25, 2022 # a few modifications by Roberto Puzzanghera to avoid error strings in the service uptime when service is stopped # # Aug 07, 2022 # now the script exits if services are not started with svscanboot or the supervise script is missing # # Put here the services you want to manage svclist="qmail-smtpd qmail-smtpsd qmail-submission qmail-send vpopmaild vusaged" # Put here the services want monitoring servicelist="dovecot clamd freshclam spamd solr httpd mariadb fail2ban" QMAILDIR=/var/qmail QMAILDUID=`id -u qmaild` NOFILESGID=`id -g qmaild` TCPRULES_DIR=/var/qmail/control PATH=$QMAILDIR/bin:/bin:/usr/bin:/usr/local/bin:/usr/local/sbin export PATH function show_uptime() { re='^[0-9]+$' org="$(svstat /service/$1 | awk '{print $2,$3,$4;}' | sed 's/up/[ up ]/g' | sed 's/down/[ down ]/g' | sed ''/up/s//`printf "\033[1\;32mup\033[0m"`/'' | sed ''/down/s//`printf "\033[1\;31mdown\033[0m"`/'')" sec="$(svstat /service/$1 | awk '{print $5;}')" if ! [[ $sec =~ $re ]]; then sec="$(svstat /service/$1 | awk '{print $3;}')" fi d=$(( $sec / 86400)) h=$(( $(($sec - $d * 86400)) / 3600 )) m=$(( $(($sec -d * 86400 - $h * 3600)) / 60 )) s=$(($sec -d * 86400 - $h * 3600 - $m * 60)) if [ $sec -le 60 ]; then if [[ "$(svstat /service/qmail-smtpd | awk '{print $2}')" = 'down' ]]; then printf "%-22s %s %s %s %s %s\n" "$1:" $org else printf "%-22s %s %s %s %s %s %s seconds\n" "$1:" $org $s fi else printf "%-22s %s %s %s %s %s %3s day(s), %02d:%02d:%02d\n" "$1:" $org $d $h $m $s fi } # check if qmail has been sttarted at boot time function svscan_check() { if ! pgrep -x "svscanboot" > /dev/null; then echo "/command/svscanboot not running. Please stat qmail running:" echo "qmailctl boot" echo "or" echo "/command/svscanboot" exit 1 fi } case "$1" in start) svscan_check echo "Starting qmail" for svc in $svclist ; do if [ ! -x /service/$svc ]; then echo $svc service script not found elif svok /service/$svc ; then svc -u /service/$svc else echo $svc service not running fi done if [ -d /var/lock/subsys ]; then touch /var/lock/subsys/qmail fi ;; stop) svscan_check echo "Stopping qmail..." for svc in $svclist ; do if [ ! -x /service/$svc ]; then echo $svc service script not found else echo " $svc" svc -d /service/$svc fi done if [ -f /var/lock/subsys/qmail ]; then rm /var/lock/subsys/qmail fi ;; stat) svscan_check for svc in $svclist ; do if [ ! -x /service/$svc ]; then echo $svc service script not found else show_uptime $svc show_uptime "$svc/log" fi done echo "" for service in $servicelist ; do printf "%-22s " "$service status:" if (( $(ps -ef | grep -v grep | grep $service | wc -l) > 0 )) then echo -e "[ \033[1;32mup\033[m ]" else echo -e "[ \033[1;31mdown\033[m ]" fi done if [ -f $QMAILDIR/control/simversions.cdb ]; then printf "\nClamAV database updated at: " stat --printf=%y $QMAILDIR/control/simversions.cdb | cut -d. -f1 fi if [ -f $QMAILDIR/users/assign ]; then printf "Total Domains: " wc -l < $QMAILDIR/users/assign fi echo "" qmail-qstat ;; doqueue|alrm|flush) svscan_check echo "Sending ALRM signal to qmail-send." svc -a /service/qmail-send ;; queue) svscan_check qmail-qstat qmail-qread ;; reload|hup) svscan_check echo "Sending HUP signal to qmail-send." svc -h /service/qmail-send ;; pause) svscan_check for svc in $svclist ; do echo "Pausing $svc" svc -p /service/$svc done ;; cont) svscan_check for svc in $svclist ; do echo "Continuing $svc" svc -c /service/$svc done ;; restart) svscan_check echo "Restarting qmail:" for svc in $svclist ; do if [ "$svc" != "qmail-send" ] ; then echo "* Stopping $svc." svc -d /service/$svc fi done echo "* Sending qmail-send SIGTERM and restarting." svc -t /service/qmail-send for svc in $svclist ; do if [ "$svc" != "qmail-send" ] ; then echo "* Restarting $svc." svc -u /service/$svc fi done ;; cdb) if ! grep '\#define POP_AUTH_OPEN_RELAY 1' ~vpopmail/include/config.h >/dev/null; then (cd $TCPRULES_DIR ; cat tcp.smtp | tcprules tcp.smtp.cdb tcp.smtp.tmp) echo "Updated tcp.smtp.cdb." (cd $TCPRULES_DIR ; cat tcp.submission | tcprules tcp.submission.cdb tcp.submission.tmp) echo "Updated tcp.submission.cdb." else ~vpopmail/bin/clearopensmtp echo "Ran clearopensmtp." fi ;; clear) svscan_check echo "Clearing readproctitle service errors with ................." svc -o /service/clear ;; kill) svscan_check echo "First stopping services ... " for svc in $svclist ; do if svok /service/$svc ; then svc -d /service/$svc svc -d /service/$svc/log fi done echo "Now sending processes the kill signal ... " killall -g svscanboot echo "done" ;; boot) echo "Starting qmail" /command/svscanboot & ;; reboot) $0 kill sleep 5 $0 boot ;; help) cat <<HELP stop -- stops mail service (smtp connections refused, nothing goes out) start -- starts mail service (smtp connection accepted, mail can go out) pause -- temporarily stops mail service (connections accepted, nothing leaves) cont -- continues paused mail service stat -- displays status of mail service cdb -- rebuild the tcpserver cdb file for smtp restart -- stops and restarts smtp, sends qmail-send a TERM & restarts it doqueue -- sends qmail-send ALRM, scheduling queued messages for delivery reload -- sends qmail-send HUP, rereading locals and virtualdomains queue -- shows status of queue alrm -- same as doqueue flush -- same as doqueue hup -- same as reload clear -- clears the readproctitle service errors with ..................... kill -- svc -d processes in svclist, then do 'killall -g svscanboot' boot -- Boots qmail and all services in /service running /command/svscanboot reboot -- kill & boot commands in sequence HELP ;; *) echo "Usage: $0 {start|stop|restart|doqueue|flush|reload|stat|pause|cont|cdb|queue|clear|kill|boot|reboot|help}" exit 1 ;; esac exit 0
Usage
# qmailctl help stop -- stops mail service (smtp connections refused, nothing goes out) start -- starts mail service (smtp connection accepted, mail can go out) pause -- temporarily stops mail service (connections accepted, nothing leaves) cont -- continues paused mail service stat -- displays status of mail service cdb -- rebuild the tcpserver cdb file for smtp restart -- stops and restarts smtp, sends qmail-send a TERM & restarts it doqueue -- sends qmail-send ALRM, scheduling queued messages for delivery reload -- sends qmail-send HUP, rereading locals and virtualdomains queue -- shows status of queue alrm -- same as doqueue flush -- same as doqueue hup -- same as reload clear -- clears the readproctitle service errors with ..................... kill -- svc -d processes in svclist, then do 'killall -g svscanboot' boot -- Boots qmail and all services in /service running /command/svscanboot reboot -- kill & boot commands in sequence
qmailctl
can be used to kill all qmail
processes and to reboot the server. I use this option inside the rc.6 of my Slackware
virtual server to avoid errors messages when stopping or rebooting the guest. You can easily call the clear
service as well.
Compiling the tcprules
If not done yet compile your tcprules
files:
> qmailctl cdb Updated tcp.smtp.cdb. Updated tcp.submission.cdb.
You have to recompile the tcprules each time you modify tcp.smtp or tcp.submission. There's no need to restart qmail
.
svtools
- More info: https://github.com/kayahr/svtools
- Author: Klaus Reimer
This is a nice collection of tools to manage daemontools
' services that you may want to consider. mlcat
is one of those; it can cat a service's log with human readable dates with a short command like:
mlcat qmail-smtpd
I slightly modified that script here, just to use it without the need of the "qmail-" prefix:
mlcat smtpd
Installing
cd /usr/local/src wget https://github.com/kayahr/svtools/archive/master.zip unzip master.zip cd svtools-master make make install mkdir /etc/sv /var/log/sv chown root:root /etc/sv /var/log/sv cd /usr/local/bin rm mlcat wget https://notes.sagredo.eu/files/qmail/mlcat chmod +x mlcat
Running qmail
at boot time
The command /command/svcscanboot
has been inserted in your /etc/inittab at the time you installed daemontools,
or you have installed a daemontools systemd
service, as already explained in the here
.
Comments
some bugs?
Alexandre Chaves Fonceca July 6, 2024 03:18 CET
Hello, I found some bugs that I think deserve attention:
1)
In the file /var/qmail/supervise/qmail-smtpsd/run, instead of:
shouldn't it be:
Because with /bin/true as a parameter of qmail-smtpd without vchkpw, you get invalid auth giving "235 ok, go ahead."
2)
Still in /var/qmail/supervise/qmail-smtpsd/run, in your default configuration, since the TLS connection is made by sslserver, but qmail-smtp doesn't know this... you need:
Otherwise, auth is deactivated until you run a STARTTLS, which doesn't make sense because the connection is already encrypted.
Since the connection was already encrypted before qmail-smtpd, for it, the connection is transparent, and it should allow auth without TLS and not offer the STARTTLS option at all.
3)
There is a bug in the function "void smtp_auth(arg)" of qmail-smtpd.c that when you try to give "auth" without a parameter (or using an invalid one), instead of giving the error of not implemented (or not available), it kills the connection due to a segfault in qmail-smtpd.
At https://www.fehcom.de/sqmail/sqmail.html they mention this:
[20230931#1/4.3.02] qmail-smtpd may segfault in case of invalid AUTH method input.
Maybe this patch needs updating here too?
Regards,
Reply | Permalink
some bugs?
Roberto Puzzanghera Alexandre Chaves Fonceca July 6, 2024 20:50 CET
you have a testing branch with the invalid-auth issue cured here https://github.com/sagredo-dev/qmail/tree/authinvalid. Can you give it a try?
commit: https://github.com/sagredo-dev/qmail/compare/main...authinvalid
Reply | Permalink
some bugs?
Alexandre C Fonceca Roberto Puzzanghera July 7, 2024 16:15 CET
I applied this patch, and it worked for submission (587), but in 465 we still have a segfault with invalid auths. I don't understand why the err_authinvalid function you added doesn't work for it.
Reply | Permalink
some bugs?
Roberto Puzzanghera Alexandre C Fonceca July 9, 2024 10:19 CET
Now it should work with both 587 and 465 ports
Reply | Permalink
some bugs?
Alexandre C Fonceca Roberto Puzzanghera July 10, 2024 01:30 CET
It worked perfectly! tks...
Reply | Permalink
some bugs?
Roberto Puzzanghera Alexandre Chaves Fonceca July 6, 2024 11:04 CET
Hello,
1) This is intentional as I'm not allowing the auth on port 25 for security reasons
2) yes, I'll correct the qmail-smtps/run accordingly
3) I'll have a look at it, but I'm not sure I can update the auth feature, as s/qmail doesn't publish the exact modifications related to each commit
Reply | Permalink
some bugs?
Alexandre Chaves Fonceca Roberto Puzzanghera July 6, 2024 13:11 CET
Regarding item 1, I am indeed referring to qmail-smtpsd (port 465), not the smtpd on port 25.
Reply | Permalink
some bugs?
Roberto Puzzanghera Alexandre Chaves Fonceca July 6, 2024 13:19 CET
Ok, I'll do that. Thanks for the hint
Reply | Permalink
Configuration Files
Kenny Lee March 8, 2024 03:24 CET
Hi Roberto,
regarding your /var/qmail/rc, /var/qmail/supervise/qmail-smtpd/run and /var/qmail/supervise/qmail-submission/run files, can i have the files configure only for beginning stage? coz now inside your files got included those application which not yet setup like simscan, DKIM, SPP and other checking...
maybe we can enable those command while we hit that stage only? so that our testing on SMTP and 587 are workable.
Thank you
Reply | Permalink
Configuration Files
Roberto Puzzanghera Kenny Lee March 8, 2024 08:06 CET
Hi Kenny,
all features that may fault at the beginning stage are disabled by default. For example, DKIM_ON is commented out in your rc and qmail-dkim is not launched in your qmail-smtpd run file. rcptcheck-overlimit is ignored if not configured yet, while greylisting and qmail-spp are commented out.
The only features that are enabled by default are greetdelay, chkuser and SURBL, which don't need any attention. You can comment out those lines.
Reply | Permalink
Configuration Files
Roberto Puzzanghera Roberto Puzzanghera March 8, 2024 08:39 CET
you are right concerning simscan. If not configured yet you have to comment out these lines
I'll do a modification to check if simscan is installed as soon as I have time
Reply | Permalink
Configuration Files
Roberto Puzzanghera Roberto Puzzanghera March 8, 2024 16:44 CET
I did the modification. Check it out
Reply | Permalink
TCPRULES_DIR
Kenny Lee January 24, 2024 07:44 CET
Hi Roberto,
regarding your qmail/supervise/qmail-smtpd/run file
if follow your steps, the tcp.smtp.cdb is located at /home/vpopmail/etc/ ,right?
Reply | Permalink
TCPRULES_DIR
Roberto Puzzanghera Kenny Lee January 24, 2024 07:54 CET
Hi Kenny, you have to put in TCPRULES_DIR the location of the tcp.smtp.cdb file, so in your case it will be
you have to adjust the qmailctl script as well
Reply | Permalink
authentication issues on port 587
jeff maina June 23, 2023 10:30 CET
Hi Roberto, thank you so much for this guide.
I've followed the guide step by step, and I keep on getting the error "421 unable to read controls (#4.3.0)" when testing port 587 authentication
I've tried researching the issue, and I can't seem to fix the issue.
Where might I be going wrong?
Reply | Permalink
authentication issues on port 587
Roberto Puzzanghera jeff maina June 23, 2023 14:33 CET
Hi jeff, perhaps you enabled SPP and forgot to create the smtpplugins control file?
Reply | Permalink
question regarding SRS
Herbert June 19, 2023 13:36 CET
Maybe dumb question but I haven't found an answer till now:
If I have a server with multiple virtual EMail-Domains - do I need SRS configuration for only the main domain or every virtual domain.
And if yes - how is the sytax for /var/qmail/control/srs_domain?
Every domain in a new line?
Thanks in advance!
Regards,
Herbert
Reply | Permalink
question regarding SRS
Roberto Puzzanghera Herbert June 19, 2023 18:38 CET
it's not a dumb question at all :)
I have just "srs.sagredo.eu" in my srs_domain control file
libsrs2 site says https://www.libsrs2.org/docs/mta-users.html
srs_domain (string)
A domain to use in rewritten addresses. This must point only to machines which know the encoding secret used by this system since any bounces will go to the MX for this domain. This is primarily of use when a system forwards mail for multiple virtual domains, or multiple mail servers forward mail for a single domain using different secrets. It may default to something sensible on some MTAs where appropriate information is available to the SRS subsystem.
Reply | Permalink
question regarding SRS
Herbert Roberto Puzzanghera June 21, 2023 07:57 CET
Hi Roberto,
my question was because of a problem I have with a mailserver.
Google is imho one of the most restrictive EMailproviders and with Google mailservers SRS works like a charm in my "Multidomainenvironment" with one SRS Domain for all EMaildomains I have.
But when I last checked the maillogs a mailserver complained about "forged EMail".
So I can treat this as an error from the other EMailserver not "understanding" SRS rewrites?
And besides that I recognized that spf.pobox.com is not working anymore?
Could you or anyone check if this is true and if yes maybe you could change the error message for SPF error response in the sourcecode?
Thank's in advance for your help!
Herbert
Reply | Permalink
question regarding SRS
Roberto Puzzanghera Herbert June 21, 2023 10:13 CET
Be aware that you can always overwrite the default SPF explanation by means of the /var/qmail/control/spfexp file. BTW I'll change it with a generic explanation in the next patch release
Reply | Permalink
question regarding SRS
Herbert Roberto Puzzanghera June 21, 2023 10:28 CET
ah - ok - didn't know this...maybe this solves some problems - I'm curious :-)
Regards,
Herbert
Reply | Permalink
question regarding SRS
Roberto Puzzanghera Herbert June 21, 2023 08:19 CET
Hi Herbert,
> Google is imho one of the most restrictive EMailproviders and with Google mailservers SRS works like a charm in my "Multidomainenvironment" with one SRS Domain for all EMaildomains I have.
I can confirm that
> But when I last checked the maillogs a mailserver complained about "forged EMail".
> So I can treat this as an error from the other EMailserver not "understanding" SRS rewrites?
I presume that this is the answer. I haven't done tests with providers without srs.
Did you set the SPF record for your srsdomain? When I do tests with google I pass the SPF, but the DKIM sign fails, as the message is signed by the remote receiver. So it's possible that it is classified as "forged" when both SPF and DKIM fail and DMARC with them
> And besides that I recognized that spf.pobox.com is not working anymore?
> Could you or anyone check if this is true and if yes maybe you could change the error message for SPF error response in the sourcecode?
I know... anyone can suggest a free spf checker?
Reply | Permalink
smtps port 465 or submission port 587 support multiple domains ssl cert
Keng Heng. Chan April 10, 2023 07:27 CET
Hi,
Would like to know the smtps port 465 or submission port 587 support multiple domains ssl cert ?
Beside using the letsencrypt to create the multiple ssl cert in single flie.
Reply | Permalink
smtps port 465 or submission port 587 support multiple domains ssl cert
Roberto Puzzanghera Keng Heng. Chan April 10, 2023 07:43 CET
Yes. There's no need for a specific support for multiple domains cert. It will accept the connection if the cert is valid
Reply | Permalink
typo in smtpsd log script
Goofy March 4, 2023 11:41 CET
hi, I think there's a minor typo in the smtpsd log part: (I noticed it when running qmailctl stat -> log of smtpd was always 1 or 0. But the actual typo seems to be in smtpsd
Reply | Permalink
typo in smtpsd log script
Roberto Puzzanghera Goofy March 4, 2023 12:02 CET
Yes you are right. Corrected. I'll correct the tar file as well later
Reply | Permalink
Typo?
Herbert February 24, 2023 12:46 CET
Hi Roberto,
I think you have typo in your manual:
Imho the last line should look like this:
and shouldn't be the "clear-service" also under /service?
Regards,
Herbert
Reply | Permalink
Typo?
Roberto Puzzanghera Herbert February 24, 2023 13:48 CET
Yes, absolutely. Thank you, corrected
Reply | Permalink
qmailctl stat erro
Kelvin August 2, 2022 20:01 CET
when running qmailctl stat we get the following error
Reply | Permalink
qmailctl stat erro
Roberto Puzzanghera Kelvin August 3, 2022 16:17 CET
Look at this modified version https://notes.sagredo.eu/files/qmail/qmailctl which will output a more intelligible error message
Reply | Permalink
qmailctl stat erro
Kelvin Roberto Puzzanghera August 3, 2022 16:30 CET
Thank you Roberto Puzzanghera
Really with this qmailctl the errors are more intelligible
follow now
But services exist in /service/
Reply | Permalink
qmailctl stat erro
Roberto Puzzanghera Kelvin August 3, 2022 20:34 CET
Can you check that those listed symbolic links point to existing files and that those scripts are executables?
Reply | Permalink
qmailctl stat erro
Kelvin Roberto Puzzanghera August 4, 2022 01:39 CET
Symbolic links are present in /service/
Reply | Permalink
qmailctl stat erro
Roberto Puzzanghera Kelvin August 4, 2022 07:33 CET
Weird... Qmailctl is not finding the executables...
Let's see if the services start/stop
Reply | Permalink
qmailctl stat erro
Kelvin Roberto Puzzanghera August 4, 2022 15:37 CET
The commands svc -u /service/qmail-smtpd and svc -d /service/qmail-smtpd are executed but return nothing, neither executed successfully nor executed with failure
Reply | Permalink
qmailctl stat erro
Roberto Puzzanghera Kelvin August 4, 2022 17:39 CET
Let's see if they are running.
Start the server
Check if it is up
or even
Reply | Permalink
qmailctl stat erro
Anonymous Roberto Puzzanghera August 5, 2022 16:40 CET
netstat does not return anything
Reply | Permalink
qmailctl stat erro
Roberto Puzzanghera Anonymous August 5, 2022 16:49 CET
It appears that the smtpd run file Is missing. I suggest to double check the supervise installation
Reply | Permalink
qmailctl stat erro
Kelvin Roberto Puzzanghera August 5, 2022 17:01 CET
the run file exists follows the ls -la of all folders in the /var/qmail/supervise directory with their respective run files
Reply | Permalink
qmailctl stat erro
Roberto Puzzanghera Kelvin August 7, 2022 21:26 CET
I modified again the qmailctl script. Now it checks that svscanboot is already running. I also added a note at the bottom of the "Configuring" page to advice systemd user to run /command/svscanboot at boot
Reply | Permalink
qmailctl stat erro
Roberto Puzzanghera Kelvin August 5, 2022 18:39 CET
Weird.. your tests are contraddictory...
Did you installed the rc file in /var/qmail? If yes try to start qmail manually
Reply | Permalink
qmailctl stat erro
Roberto Puzzanghera Kelvin August 2, 2022 20:37 CET
this is because the supervise scripts are missing...
Reply | Permalink
Received "delivery 303: failure: User_over_quota._(#5.1.1)¨ if MAILDIR used in .qmail-"
idollar February 8, 2022 10:12 CET
Hello,
I have performed my installation following your guide. MANY THANKS !!!!!
I would like to use direct Maildirs in the .qmail- files. In this way, I can redidect email easily to my sub-maildirs and use the ifspamh tool.
I have set the following files:
# cat .qmail-default
| /home/vpopmail/bin/ifspamh isspamuser@mydomain.org
| /home/vpopmail/bin/vdelivermail '' /home/vpopmail/domains/mydomain.org/myuser
# cat .qmail-isspamuser
/home/vpopmail/domains/mydomain.org/myuser/Maildir/.Spam/
My problem is that any email to "isspamuser@mydomain.org" is rejected with the following error:
delivery 278: failure: User_over_quota._(#5.1.1)/
I came to the conclusion that qmail-local rejects the delivery because I am not using vdelivermail in the .qmail-isspamuser file. Instead I use the regular Maildir.
My alternative is to use vdeliver but it understands the path as a "user path" and adds Maildir at the end:
# cat .qmail-isspamuser
| /home/vpopmail/bin/vdelivermail '' /home/vpopmail/domains/mydomain.org/myuser/Maildir/.Spam/
delivery 298: deferral: user_does_not_exist,_but_will_deliver_to_/home/vpopmail/domains/mydomain.org/myuser/Maildir/.Spam//can_not_open_new_email_file_errno=2_file=/home/vpopmail/domains/mydomain.org/myuser/Maildir/.Spam/Maildir/tmp/1644311037.167234.host,S=16793/system_error/
Has anyone had a similar issue ?
Any idea on how to get this done ?
Thanks in advance
Reply | Permalink
Qmailctl Script Error
Shailendra Shukla November 21, 2020 12:35 CET
Hi Roberto ,
I followed you installation and got stuck at the qmailctl script . It gives the following error
Can you please help me on that . I have downloaded the script as per your guide . Tried by copy and pasting the script but same error message.
Regards
Shail
Reply | Permalink
Qmailctl Script Error
Shailendra Shukla Shailendra Shukla November 21, 2020 12:54 CET
Sorry the correct error message is
Regards
Shail
Reply | Permalink
Qmailctl Script Error
Roberto Puzzanghera Shailendra Shukla November 21, 2020 13:00 CET
it seems like the $sec variable is empty. Can you check
Reply | Permalink
Qmailctl Script Error
Shailendra Shukla Roberto Puzzanghera November 21, 2020 13:27 CET
Reply | Permalink
Qmailctl Script Error
Roberto Puzzanghera Shailendra Shukla November 21, 2020 13:33 CET
can you copy&paste the content of your qmailctl, please?
Reply | Permalink
Qmailctl Script Error
Anonymous Roberto Puzzanghera November 21, 2020 13:40 CET
I downloaded the script from and I am running Centos6.10
Reply | Permalink
Qmailctl Script Error
Roberto Puzzanghera Anonymous November 21, 2020 13:47 CET
I've no idea, but I know that $sec is empty. I would try to replace $sec with ${sec}
Reply | Permalink
Qmailctl Script Error
Shailendra Shukla Roberto Puzzanghera November 21, 2020 13:50 CET
got it working seems like svscanboot was not working
started the same with csh -cf '/command/svscanboot &'
and then tried the script started working have added the above command to rc.local . Thanks a lot for your help.
Reply | Permalink
Qmailctl Script Error
Newb Shailendra Shukla July 27, 2021 14:00 CET
I have a same problem with svscanboot.
Can u tell me where exacly did you copy command:
csh -cf '/command/svscanboot &'
in file rc.local?
I tried added it the above/below "exit" and svscan still dont work after reboot :(
Reply | Permalink
Qmailctl Script Error
Roberto Puzzanghera Newb July 27, 2021 14:08 CET
Is your rc.local working for all the other programs that you start at boot time?
Reply | Permalink
Qmailctl Script Error
Newb Roberto Puzzanghera July 27, 2021 14:12 CET
i got there only vpopmail there but it isnt working too ater boot
Reply | Permalink
Qmailctl Script Error
Roberto Puzzanghera Newb July 27, 2021 14:16 CET
Are you sure that your systemd is set to run your rc.local? I'm not expert of systemd because slackware doesn't use it, but I guess that there could be other ways to run a script at boot..
Reply | Permalink
Qmailctl Script Error
Newb Roberto Puzzanghera July 27, 2021 14:23 CET
Fixed it.
It seems it is not possible to enable rc.local at startup using SystemD on Ubuntu 20.04 and u have to do it another way
Reply | Permalink
Qmailctl Script Error
Roberto Puzzanghera Newb July 27, 2021 14:25 CET
I managed to do it in a debian 10 with systemd.
Anyhow, please, can you write a note on how you solved?
Reply | Permalink
Qmailctl Script Error
Newb Roberto Puzzanghera July 27, 2021 14:54 CET
Of course :)
To enable rc-local service you have to:
1) Manually create a systemd service
Now enter the following text, save and close the file.
2) Enable the service on boot (enable rc.local with systemd on Ubuntu 20.04)
Next you reboot and check status:
it should be active
Reply | Permalink
Small error in guide
Gabriel Torres July 16, 2019 12:59 CET
Hi Roberto,
I found a small mistake in the configuration published above. In this line:
The 'n' and 's' parameters are too low, and the log files are deleted too soon. To maintain coherency with the rest of the configuration, n should be 200 and s should be 16000000 in both occurrences, like this:
Please update the guide! :)
Cheers.
Reply | Permalink
Small error in guide
Roberto Puzzanghera Gabriel Torres July 16, 2019 13:37 CET
Thanks for the hint.
s16000000 (or even s16777215 which is the maximum size allowed) is better. Instead I'm going to put n5 everywhere, infact I'm explaining below how to backup the logs every night...
Reply | Permalink
Small error in guide
Gabriel Torres Roberto Puzzanghera July 16, 2019 16:43 CET
Hi Roberto,
Yes, I use the backup option you published, and they are stored at /var/log/qmail/backup
The problem is that -n5 and -s10000000 is not sufficient for us, as we send out newsletters to over 400,000 subscribers. With that, the backup that is generated contains only the log entries starting at around 23h00min, i.e. the older entries are discarded automatically as they are not available at /var/log/qmail/smtpd anymore. Hence the need to increase those numbers... ;)
Cheers.
Reply | Permalink
qmail-remote not working at its full capacity
Gabriel Torres June 27, 2019 01:33 CET
Hi Roberto,
I have a problem here that maybe you or other readers of this guide might have a better understanding about what is going on.
I have concurrencyremote configured with 120. However, qmail-send only sends, at best, 20 emails concurrently. I used to have qmail patched and installed according to a different guide, and decided to redo everything from scratch using your patch/guide to see if the problem would be solved.
While your guide solved a lot of other problems we used to have (e.g., our previous installation would accept any email and then perform any check, and now with chkuser our server only accepts "good" emails and rejects all sorts of junk, making the server to run faster and with lower loads). But it didn't solve this particular issue.
If you see, I send our newsletter this morning, and it is still sending it out. You can see we have almost 100,000 emails in queue:
But qmail-send is only sending less than 10 in parallel:
If we run qmHandle -a, qmail-send starts sending up to 120 emails in parallel, but soon after an initial burst of emails, it goes back to sending up to 20 emails concurrently at best.
I really don't know what is going on and how to diagnose this. It may be a hardware-related issue (e.g. server in need of more RAM), but I don't want to risk getting a new, more expensive server, or even adding more RAM and the problem ending up being something else.
Our server config is a dedicated quad-core Xeon X3210 with 8 GiB of RAM.
If you have any idea or heard of this issue before, please let me know.
Cheers!
Reply | Permalink
qmailctl with Debian
Gabriel Torres June 19, 2019 05:27 CET
Hi,
This new qmailctl script is awesome, as it also shows the status of whatever additional programs/services we want.
However, in order to make it compatible with Debian, two small adjustments are required.
Cheers
Reply | Permalink
Modified of qmailctl
Sam Tang April 4, 2018 01:17 CET
Hi Roberto, thanks for your great qmail setup guide, your website saving lots of my time.
I would like to share my qmailctl script here, this is what I had updated:
- by default when run "qmailctl stat", it will show all qmail's service uptime by seconds, I made it more readable, now will display something like "0 days, 00 hours 16 mins"
- can assign another service which related qmail for monitoring, like dovecot, clamd, freshclam...
- change "up" and "down" to green and red color.
Download: https://www.phpini.com/qmailctl
once again, thank you for your great work.
Reply | Permalink
Modified of qmailctl
Roberto Puzzanghera Sam Tang April 4, 2018 10:43 CET
Thank you, this is very nice. I'm going to update my script and link this new one in this guide
Reply | Permalink
Modified of qmailctl
Kevin Salt Roberto Puzzanghera August 1, 2018 15:08 CET
It would seem there is a syntax error in the script ...
I tried copy/paste of the text version above, and downloading the versions from this site and the original. All have the same error
Reply | Permalink
Modified of qmailctl
Roberto Puzzanghera Kevin Salt August 2, 2018 07:41 CET
did you cat&paste or downloaded the file? The second is more secure...
Reply | Permalink
Modified of qmailctl
Kevin Salt Roberto Puzzanghera August 2, 2018 07:49 CET
As my comment says, i tried all the sources. Copy/pasted the text, and downloaded from both source location. I've also found lots of issues with warnings and some errors when coming with gcc 4.8 (especially simscan).
In the end i just have to and referred to my old installation with upgraded spamassassin and cclamav.
Reply | Permalink
Modified qmailctl
zinkro Kevin Salt November 26, 2018 17:05 CET
hi,
for sh 4.4 just simply delete 'function' from line 16, is not necessary declare functions with this.
Reply | Permalink
Modified qmailctl
GoofY zinkro April 10, 2019 08:21 CET
THNX a lot, fixed it in my case! (Debian 9.8).
Reply | Permalink
SRS
Kenneth Dalbjerg September 19, 2017 21:05 CET
Hi
I have a little problems with the SRS.
I have configure it, and it also working just, fine, the address got rewrite and so on.
But if we got a bounce back, the mail will not be deliver to the right sender address, it will try deliver it to the SRS rewrite address.
Do anyone know what iam missing?
Reply | Permalink
pop3 port
Steve Conrad April 27, 2017 02:49 CET
One minor typo I noticed was that your supervise script has the pop server running on port 89 (the vpopmail uid) rather than the usual port 110. Probably this wasn't what you had in mind. Thanks for the great guide.
Reply | Permalink
I'm referring to qmail
Steve Conrad Steve Conrad April 29, 2017 21:31 CET
I'm referring to qmail/supervise/vpopmaild/run from your tarball and listed just up the page a bit from here. That last 89 should probably be a 110 instead. Looks like the vpopmail UID got typoed in place of the intended port number.
Not so sure about running vpopmaild as root either. I think you want to be doing that as vpopmail so as to access the maildirs it owns.
#!/bin/sh
QMAILDUID=`id -u root` # wouldn't this be better off as "-u vpopmail"
NOFILESGID=`id -g root` # and "-g vchkpw"?
Reply | Permalink
No it is not the pop3 service
roberto puzzanghera Steve Conrad May 1, 2017 20:29 CET
No it is not the pop3 service (pop3 is served by dovecot in my configuration). vpopmaild is a daemon that you can use to connect and talk with vpopmail. Dovecot and roundcube can use it to change the passwords, for instance
Reply | Permalink
uh.. I don't remember to have
roberto puzzanghera Steve Conrad April 27, 2017 08:20 CET
uh.. I don't remember to have published any note about qmail-pop3d... can you provide a link to the page please?
Reply | Permalink
Hello,
Al March 21, 2017 16:09 CET
Hello,
I set everithing like you wrote in this tutorial and everithing works well, but I have a problem with receieving error message from postmaster when I send email to unknown user.
Instead from postmaster@example.com I get error message from "postmaster@mail.example.com"@mail.example.com
Do you know how can I fix that to get message from postfix@domain.net instead of postmaster@fqdn_hostname?
Thank you,
Al
Reply | Permalink
on qmail the hostname of the
roberto puzzanghera Al March 21, 2017 16:50 CET
on qmail the bounce sender is from the control/bouncefrom file, which is postmaster in my configuration. postmaster is defined by the alias .qmail-postmaster as explained above
Reply | Permalink
Hi Roberto,
Al roberto puzzanghera March 22, 2017 09:10 CET
Hi Roberto,
I now realized that I should get system messages from postmaster@FQDN instead postmaster@HOSTNAME(e.g. postmaster@mail.example.com instead postmaster@example.com) just like you wrote in this tutorial.
Also, I changed /control/bouncefrom file and put only "postamster" instead "postmaster@example.com", so now I receive mails from postmaster@mail.example.com instead "postmaster@mail.example.com"@mail.example.com just like I wanted
Thank you for your support
Reply | Permalink
qmail generating log@myserver.net emails which bounce?
George Cooke October 1, 2015 20:56 CET
Hi Roberto once again thanks for this guide, it's the best Linux guide i've ever seen, so perfect and thourough!
But I have a problem, when I send mail from gmail to a valid vpopmail user at my qmail server, the mail is delivered fine, but the external sender additionally gets a postmaster bounce email from my qmail server about a log@[myserver.net] delivery failure, saying that user doesn't exist like this:
Also, my logs don't seem to have the extra timestamps and message-ID's that yours do, so obviously it's something wrong with logging but I can't figure out what/where the problem is!
+I am also using the netqmail-1.06-exttodo-channels patch: (info, patch file) - I had to patch the failing hunks myself, but it seems to work, hope thats not causing the logging problem), in the log below that's what the suppl[N] queues are for.
You can see what it's doing in the qmail-send log below, it seems to be generating a log@ email for every send, hence the double bounce at the end.
In the below log:
- myserver.net is my qmail server I am setting up (the one I followed your guide on):
- user@gmail.com is the user who sent the mail to my vpopmail user, and who recieves the postmaster bounce email above (about log@myserver.net failing).
- test@myserver.net is the valid vpopmail user who receives the mail from the gmail user ok.
Thanks!
Reply | Permalink
Hi George, I can't garantee
roberto puzzanghera George Cooke October 1, 2015 20:58 CET
Hi George, I can't garantee that the patch you applayed on top of my package will not interfere in some way..
Anyway, as mentioned above in the "Improved qmail-send log" paragraph, you have an email to log@yourdomain just to record the Message-ID in the qmail-send log. You may want to revert that qmail-queue-extra patch or double check your configuration, in particular the content of the file .qmail-log
Reply | Permalink
Thanks for getting back to me
George Cooke roberto puzzanghera October 1, 2015 21:00 CET
Thanks for getting back to me Roberto it's really appreciated!
I did realise it was something to do with the logging, but now I realise how it actually works, it's smart, you send an internal email to the log@ which is the command to log! So I can tell now, something is thinking log@ doesn't exist and therefore:
1. It's sending a bounce
2. The enhanced logging is not working.
So I just have to figure out why it's deciding log@ doesn't exist when actually it does according to qmail alias config.
Thanks a million, you're work has really helped us!
Reply | Permalink
log alias applies to local domain
Norbert George Cooke October 14, 2015 15:08 CET
Reply | Permalink
Alternative way for rotating log files of qmail services
Marc August 23, 2014 13:54 CET
Hello,
as an alternative for rotating the log files from the qmail services i use the convert-multilog script from John Simpson, who describes the script function as follows:
To make the script work with this tutorial, you have to create the following links:
Then you have to create a cronjob:
I like this one because i have the log files inside my /var/log/ dir and the logfiles have normal timestamps.
Cheers
Reply | Permalink
I modified this page with
roberto puzzanghera Marc August 25, 2014 20:43 CET
I modified this page with your suggestion :)
Reply | Permalink
This is very interesting
roberto puzzanghera Marc August 24, 2014 11:16 CET
This is very interesting. I think I'll use it as soon as possible. Thank you
Reply | Permalink
tcpserver binding on ipv4 & ipv6 machine
Marc August 17, 2014 08:18 CET
I have ipv4 & ipv6 enabled on an Debian wheezy 64 machine and tcpserver binds the services only to ipv6 ports. I have to use the option -4 in the run files to use it with ipv4. But then ipv6 ist not possible anymore. In your standard run files the Option 0 is used which should bind tcpserver to any available IP address on any interface according to the tcpserver doc. Do you have a clue wyh tcpserver binds the service ports only to ipv6?
Reply | Permalink
ucspi-tcp6
roberto puzzanghera Marc August 17, 2014 09:19 CET
Are you using the new e.h.'s tcpserver program http://www.fehcom.de/ipnet/ucspi-tcp6/tcpserver.html? In that case I would try to test the -6 option.
Reply | Permalink
hi roberto, thanks for
Marc roberto puzzanghera August 17, 2014 10:41 CET
hi roberto, thanks for answering so fast. i'm using the package ucspi-tcp6-1.00. I have tried the -6 option and the result is the same as without the option (binding only to ipv6). For now i will use the -4 option so that i can use the installation with ip4. When i have more time i will take a closer look. Thank you for this tutorial. It has helped me much.
Reply | Permalink
Why GREETDELAY in qmail-submission/run?
Otto Dandenell August 14, 2014 11:47 CET
Hi,
First off, thanks for your excellent notes / turial. I am building a new server 10 years after the last time I did it. It's so wonderful to have these step-by-step instructions, and all the patches consolidated.
I am curious about the 5 second greet delay in the submission service. Even that low number causes IT stress when I test tghe outgoing mail using Thunderbird.
Since the submission service requires STARTTLS and authentication, spammers are stopped anyway, aren't they?
Regards
/ Otto Dandenell, Sweden
Reply | Permalink
Hi Otto, thanks for your
roberto puzzanghera Otto Dandenell August 14, 2014 18:35 CET
Hi Otto, thanks for your comment.
From time to time I get heavy attacks on port 587 due to spammers who tries to guess users' passwords. Last time it was 2 days with 1 attempt every few seconds. I see them in /var/log/maillog
I think that 5 seconds is a little stress for users, but a verrrry big loss of cpu time for spammers, if you multiply 5s times the number of attempts spanned in a couple of days :-)
anyway it's much better to have a firewall filter like fail2ban and avoid to use that GREETDELAY (https://notes.sagredo.eu/en/qmail-notes-185/setting-up-your-firewall-with-fail2ban-170.html). Maybe it's better to comment out that line on the run script and advise to use it just in case fail2ban is not active.
And time ago I read that a lot of spammers drop the connection if a GREETDELAY of just a couple of seconds is set, but comments are welcome on the purpose
best regards
Roberto
Reply | Permalink
Roberto,Thanks for clearing
Otto Dandenell roberto puzzanghera August 15, 2014 08:55 CET
Roberto,
Thanks for clearing that up. I'll have a look at fail2ban.
Regards
/ Otto
Reply | Permalink
Minor tweak for your supervise/vpopmaild/run script
Aaron November 27, 2012 21:03 CET
I appreciate that you are keeping your documentation referencing /var/qmail for the most part. The supervise/vpopmaild/run script has a reference to "/usr/local/qmail/..." instead of "/var/qmail/.." while the rest of your scripts reference "/var/qmail". Up to you if you want to fix it, of course. I caught it because I don't use /usr/loca/qmail and it was causing an error in readproctitle.
Thanks for the great work!
Reply | Permalink
Thanks
roberto puzzanghera Aaron November 27, 2012 21:24 CET
Thanks, Aaron. Actually the variable MAXSMTPD was not used by tcprules and I have corrected the vpopmaild/run script
Reply | Permalink
Forcetls error....
Anonymous September 15, 2011 20:10 CET
Hi I have a problem with Gmail & roberto-netqmail-1.06.patch-2011.07.27 Problem concerns Forcetls patch: The history of the disease: tcprules:
Qmail run script (Submission):
The server is working properly:
Result (swaks):
If I disable FORCETLS (export FORCETLS="1"), login works fine. My OS: Gentoo Hardened with grsec / Pax
Fortunately, for the moment I test the server in his home, but soon I'm going to run it on a server at work (~ 300 users)
Can I count on any suggestions to solve the problem?
Cheers ;)
Reply | Permalink
RE: force-tls
roberto puzzanghera Anonymous September 17, 2011 11:14 CET
I haven't tested my patch in conjunction with spamdyke. I would try to do a test disabling it.
Reply | Permalink
Thanks
Jacekalex roberto puzzanghera September 17, 2011 16:46 CET
Indeed, he was guilty Spamdyke.
How Spamdyke compiled with the flag -tls, the problem disappeared.
Thank You
Cheers
:)
Reply | Permalink
Nn mi mette la posta su vpopmail
Remo Jacekalex February 18, 2013 17:45 CET
Ciao Roberto, grazie per le info che hai messo, pero' nn mi mette la posta su new sotto vpopmail. i logs mostrano che arriva pero' nn si vede, inoltre nn mi fa connettere su 587 o 25 per mandare la posta suggerimenti?
Grazie
Reply | Permalink
SMTPAUTH
roberto puzzanghera Remo February 18, 2013 20:57 CET
riguardo al problema dell'invio da remoto, la qmail-auth path richiede che vanga esportata la variabile SMTPAUTH nel run file. Se viene lasciata vuota è possibile autenticarsi con LOGIN o PLAIN
Reply | Permalink
Ciao Remo,stai seguendo la
roberto puzzanghera Remo February 18, 2013 19:47 CET
Ciao Remo,
stai seguendo la mia guida passo passo? che LDA stai usando?
per quanto riguarda l'invio da remoto, come certamente sai è necessario accoppiare qmail-smtpd a vchkpw nel tuo run file, vedi se vuoi gli esempi nella pagina sulla configurazione, ma sono dei run file molto standard, come vedi. Stai usando la mia patch, con qmail-auth di E.Hoffmann?
Se vuoi posta i log, se preferisci mandameli in privato (tsasto contact su in alto)
Roberto
Reply | Permalink