Giter VIP home page Giter VIP logo

qpsmtpd's Introduction

Build Status Coverage Status

Qpsmtpd - qmail perl simple mail transfer protocol daemon

Web site, FAQ, Email List

Qpsmtpd is an extensible SMTP engine written in Perl. See plugins/quit_fortune for a cute example.

License

Qpsmtpd is licensed under the MIT License; see the LICENSE file for more information.

What's new?

See the Changes file! :-)

Installation

Required Perl Modules

* Net::DNS
* MIME::Base64
* Mail::Header (part of the MailTools distribution)

If your Perl is older than 5.8.0, you will also need

* Data::Dumper
* File::Temp
* Time::HiRes

The easiest way to install modules from CPAN is with the CPAN shell. Run it with

perl -MCPAN -e shell

qpsmtpd installation

Make a new user and a directory where you'll install qpsmtpd. I usually use "smtpd" for the user and /home/smtpd/qpsmtpd/ for the directory.

Put the files there. If you install from git you can just do run the following command in the /home/smtpd/ directory.

git clone git://github.com/smtpd/qpsmtpd.git

Beware that the master branch might be unstable and unsuitable for anything but development, so you might want to get a specific release, for example (after running git clone):

git checkout -b local_branch v0.93

chmod o+t ~smtpd/qpsmtpd/ (or whatever directory you installed qpsmtpd in) to make supervise start the log process.

Edit the file config/IP and put the ip address you want to use for qpsmtpd on the first line (or use 0 to bind to all interfaces).

If you use the supervise tools, then you are practically done! Just symlink /home/smtpd/qpsmtpd into your /services (or /var/services or /var/svscan or whatever) directory. Remember to shutdown qmail-smtpd if you are replacing it with qpsmtpd.

If you don't use supervise, then you need to run the ./run script in some other way.

The smtpd user needs write access to ~smtpd/qpsmtpd/tmp/ but should not need to write anywhere else. This directory can be configured with the spool_dir configuration and permissions can be set with spool_perms.

As of version 0.25 the distributed ./run script runs tcpserver with the -R flag to disable identd lookups. Remove the -R flag if that's not what you want.

Configuration

Configuration files can go into either /var/qmail/control or into the config subdirectory of the qpsmtpd installation. Configuration should be compatible with qmail-smtpd making qpsmtpd a drop-in replacement.

If qmail is installed in a nonstandard location you should set the $QMAIL environment variable to that location in your "./run" file.

If there is anything missing, then please send a patch (or just information about what's missing) to the mailinglist or a PR to github.

Better Performance

For better performance we recommend using "qpsmtpd-forkserver" or running qpsmtpd under Apache 2.x. If you need extremely high concurrency use Haraka.

Plugins

The qpsmtpd core only implements the SMTP protocol. No useful function can be done by qpsmtpd without loading plugins.

Plugins are loaded on startup where each of them register their interest in various "hooks" provided by the qpsmtpd core engine.

At least one plugin MUST allow or deny the RCPT command to enable receiving mail. The rcpt_ok is one basic plugin that does this. Other plugins provide extra functionality related to this; for example the resolvable_fromhost plugin described above.

Configuration files

All the files used by qmail-smtpd should be supported; so see the man page for qmail-smtpd. Extra files used by qpsmtpd include:

plugins

List of plugins, one per line, to be loaded in the order they appear in the file. Plugins are in the plugins directory (or in a subdirectory of there).

rhsbl_zones

Right hand side blocking lists, one per line. For example:

dsn.rfc-ignorant.org does not accept bounces - http://www.rfc-ignorant.org/

See http://www.rfc-ignorant.org/ for more examples.

dnsbl_zones

Normal ip based DNS blocking lists ("RBLs"). For example:

relays.ordb.org spamsources.fabel.dk

spool_dir

If this file contains a directory, it will be the spool directory smtpd uses during the data transactions. If this file doesn't exist, it will default to use $ENV{HOME}/tmp/. This directory should be set with a mode of 700 and owned by the smtpd user.

spool_perms

The default spool permissions are 0700. If you need some other value, chmod the directory and set it's octal value in config/spool_perms.

tls_before_auth

If this file contains anything except a 0 on the first noncomment line, then AUTH will not be offered unless TLS/SSL are in place, either with STARTTLS, or SMTP-SSL on port 465.

everything (?) that qmail-smtpd supports.

In my test qpsmtpd installation I have a "config/me" file containing the hostname I use for testing qpsmtpd (so it doesn't introduce itself with the normal name of the server).

Problems

In case of problems, always check the logfile first.

By default, qpsmtpd logs to log/main/current. Qpsmtpd can log a lot of debug information. You can get more or less by adjusting the number in config/loglevel. Between 1 and 3 should give you a little. Setting it to 10 or higher will get lots of information in the logs.

If the logfile doesn't give away the problem, then post to the mailinglist (subscription instructions above). If possible, put the logfile on a webserver and include a reference to it in the mail.

qpsmtpd's People

Contributors

abh avatar analogic avatar andreamtp avatar aqua avatar biergaizi avatar filippocarletti avatar flimzy avatar hjp avatar jaredj avatar jmartens avatar jokey2k avatar kjetilk avatar lnedry avatar luzluna avatar msimerson avatar mufus avatar peterbokunet avatar priyadi avatar rgreab avatar robinbowes avatar rsiddall avatar rspier avatar salvis avatar shaiku avatar skx avatar tlavoie avatar tmzullinger avatar tpoindessous avatar vetinari avatar wornet-aer avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

qpsmtpd's Issues

ParaDNS tests fail with Perl-Net-DNS-0.72

I'm trying to have rpm for every dependency of qpsmtpd-async but I'm stuck with this bug:

Those the components version:

  • Perl v5.16.3
  • perl-Danga-Socket-1.61
  • perl-Net-DNS-0.72
  • ParaDNS-2.0
    [ParaDNS-2.0]# perl Makefile.PL 
    Checking if your kit is complete... 
    Looks good Writing Makefile for ParaDNS 
    [ParaDNS-2.0]# make 
    cp lib/ParaDNS/Resolver.pm blib/lib/ParaDNS/Resolver.pm 
    cp lib/ParaDNS.pm blib/lib/ParaDNS.pm 
    cp fast-rdns.pl blib/lib/fast-rdns.pl 
    cp fast-rdns.pl blib/script/fast-rdns.pl 
    /usr/bin/perl -MExtUtils::MY -e 'MY->fixin(shift)' -- blib/script/fast-rdns.pl 
    Manifying blib/man3/ParaDNS::Resolver.3pm 
    Manifying blib/man3/ParaDNS.3pm 
    [ParaDNS-2.0]# make test 
    PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/00basic.t .. 1/5 
    # Failed test 'Got nosuchhost.axkit.org doesn't exist (NOANSWER)' 
    # at t/00basic.t line 44. # Looks like you failed 1 test of 5. 
    t/00basic.t .. Dubious, test returned 1 (wstat 256, 0x100) 
    Failed 1/5 subtests 
    Test Summary Report 
    ------------------- 
    t/00basic.t (Wstat: 256 Tests: 5 Failed: 1) 
    Failed test: 3 Non-zero exit status: 1 Files=1, Tests=5, 1 wallclock secs ( 0.02 usr 0.01 sys + 0.10 cusr 0.02 csys = 0.15 CPU) 
    Result: FAIL Failed 1/1 test programs. 1/5 subtests failed. 
    make: *** [test_dynamic] Errore 1

https://rt.cpan.org/Public/Bug/Display.html?id=98386

Can you please check what is preventing ParaDNS 2.0 work with perl-Net-DNS-0.72 or if the tests have to be updated and maybe bump a new rev (ParaDNS 2.0.1 or 2.1)?

My perl skills are low but if I got that bug fixed and working I can keep going on to produce rpms ready to be submitted to Fedora. On the qpsmtpd the script provided works great, but ParaDNS need some love.

Add option to hide leakage of user info through Auth-Res and Received from header

There should be option to not add Authentication-Results header for outgoing email since it reveals username and login method. Received header shows remote user IP address and sometimes show local network IP address (plugin Helo with header X-HELO also).

I am going to write privacy plugin to remove/update these headers, but it should be hidden by default i guess.

How to set the config dir location for qpstmpd-forkserver

I installed qpsmtpd-0.93 on FreeBSD with pkg install p5-qpsmtpd
I have it running, but it doesn't seem to load my config. How do I get the qpsmtpd-forkserver to use a specific config directory? I'd like to load the directory localed at /usr/local/etc/qpsmtpd/config, but I can't find anyway to set or right the config file. The documentation on the Internet appears to be years out of date and even looking at the perl sources, I don't see how the documentation that I did find could work,

How to do I set the config dir?

DMARC plugin: Can't use string ("/usr/local/share/perl/5.18.2/aut"...

Freshly installed ubuntu and Mail::DMARC from CPAN (i looked at mail::dmarc code but cant identify if its problem of plugin or dmarc package)

(data_post_headers) dmarc: Can't use string ("/usr/local/share/perl/5.18.2/aut"...) as a HASH ref while "strict refs" in use at /usr/local/share/perl/5.18.2/Mail/DMARC/Base.pm line 157, line 56.

GMail rejects to connect over SMTP

Hi,

I'm actually using qpsmtpd on my server setup, to handle my emails and I'm pretty much satisfied with it. Although I'm facing one difficulty that is not allowing me to use my personal GMail account with my mail server, by allowing google to connect through SMTP to my mail server.

This is my list of currently used plugins:

## can lead to dos if we reject some proper connections based on karma!
karma reject 0 db_dir /data/karma

tls
hosts_allow
fcrdns
quit_fortune
earlytalker
count_unrecognized_commands 4
relay
#whitelist
dnsbl reject 1 reject_type disconnect
rhsbl
helo policy strict reject 0
auth/auth_dovecot
dont_require_anglebrackets
badmailfrom reject naughty
resolvable_fromhost reject 1
sender_permitted_from reject 1
rcpt_database
badrcptto
rcpt_ok
dovecot_quota
#headers reject 0 reject_type temp require From future 2 past 15
bogus_bounce log
bounce_stamp
dkim reject 0
dmarc reporting 0
attachments ".ADE,.ADP,.BAT,.CHM,.CMD,.COM,.CPL,.EXE,.HTA,.INS,.ISP,.JAR,.JSE,.LIB,.LNK,.MDE,.MSC,.MSP,.MST,.PIF,.SCR,.SCT,.SHB,.SYS,.VB,.VBE,.VBS,.VXD,.WSC,.WSF,.WSH,.JS"
spamassassin reject 12 munge_subject_threshold 6 subject_prefix *****SPAM*****
virus/clamdscan clamd_socket /var/run/clamav/clamd.ctl
naughty reject data
queue/extended_qmail
remove_headers
#spamassassin_relay reject 10 headers none

This is the log when trying to use 465 over SSL:

2016-10-16 14:48:40 [karma] - pass, no record
2016-10-16 14:48:40 [tls] - pass, connect via SMTPS
2016-10-16 14:48:40 [fcrdns] - karma 1 (1)
2016-10-16 14:48:40 [fcrdns] - pass
2016-10-16 14:48:41 [earlytalker] - pass, not spontaneous
2016-10-16 14:48:41 [relay] - skip, no match
2016-10-16 14:48:41 - 220 mail.julianxhokaxhiu.com ESMTP
2016-10-16 14:48:41 - dispatching EHLO mail-lf0-f41.google.com
2016-10-16 14:48:41 [helo] - karma 1 (2)
2016-10-16 14:48:41 [helo] - pass
2016-10-16 14:48:41 - 250-mail.julianxhokaxhiu.com Hi mail-lf0-f41.google.com [209.85.215.41]
2016-10-16 14:48:41 - 250-PIPELINING
2016-10-16 14:48:41 - 250-8BITMIME
2016-10-16 14:48:41 - 250 AUTH PLAIN LOGIN
2016-10-16 14:48:41 - dispatching AUTH PLAIN <hidden credentials>

This is the log when trying to use 587 over TLS

2016-10-16 14:30:22 [karma] - pass, no record
2016-10-16 14:30:22 [fcrdns] - karma 1 (1)
2016-10-16 14:30:22 [fcrdns] - pass
2016-10-16 14:30:23 [earlytalker] - pass, not spontaneous
2016-10-16 14:30:23 [relay] - skip, no match
2016-10-16 14:30:23 - 220 mail.julianxhokaxhiu.com ESMTP
2016-10-16 14:30:23 - dispatching EHLO mail-lf0-f47.google.com
2016-10-16 14:30:23 [helo] - karma 1 (2)
2016-10-16 14:30:23 [helo] - pass
2016-10-16 14:30:23 - 250-mail.julianxhokaxhiu.com Hi mail-lf0-f47.google.com [209.85.215.47]
2016-10-16 14:30:23 - 250-PIPELINING
2016-10-16 14:30:23 - 250-8BITMIME
2016-10-16 14:30:23 - 250 STARTTLS
2016-10-16 14:30:23 - dispatching STARTTLS
2016-10-16 14:30:23 - 220 Go ahead with TLS
2016-10-16 14:30:23 [tls] - TLS setup returning
2016-10-16 14:30:23 - dispatching EHLO mail-lf0-f47.google.com
2016-10-16 14:30:23 [helo] - karma 1 (3)
2016-10-16 14:30:23 [helo] - pass
2016-10-16 14:30:23 - 250-mail.julianxhokaxhiu.com Hi mail-lf0-f47.google.com [209.85.215.47]
2016-10-16 14:30:23 - 250-PIPELINING
2016-10-16 14:30:23 - 250-8BITMIME
2016-10-16 14:30:23 - 250 AUTH PLAIN LOGIN
2016-10-16 14:30:23 - dispatching AUTH PLAIN <hidden credentials>

Can somebody help me to understand what I am doing wrong? Using Thunderbird anyway works fine.
Feel free to ask for more configuration files if needed.

Thanks in advance,
Julian

greylisting plugin treats 'white' clients very similarly to non-'white' clients

From plugins/greylisting POD:

How that works is best explained by example:

A new connection arrives from the host shvj1.jpmchase.com. The sender is
[email protected] and the recipient is [email protected]. This is
the first connection for that triplet so the connection is deferred for
black_timeout minutes. After the timeout, but before the grey_timeout
elapses, shvj1.jpmchase.com retries and successfully delivers the mail. For
the next white_timeout days, emails for that triplet are not delayed.

This describes what happens when a client re-attempts delivery within the window after black_timeout but before grey_timeout elapses. But what about clients that don't re-attempt inside this window? They hit this codepath:

    $self->log(LOGWARN, "pass: timed out (grey)");
    return $self->cleanup_and_return(DECLINED);

In other words, they pass greylisting until they're reaped out of the database after white_timeout passes... just like 'white' clients. 985bb45 in my testing branch introduces a test showing an example of this -- a client that connects once and is greylisted will pass greylisting for the next 36 days.

If this is really the behavior that we want, then we could accomplish the same thing without employing greylist_timeout and noting 'white' clients at all. If this is not the behavior we want, I'm not quite sure what behavior we do what.

Run-time warnings in spamassassin plugin

t/plugin_tests.t ..... 31/? Use of uninitialized value in string ne at ./plugins/helo line 343.
t/plugin_tests.t ..... 131/? Use of uninitialized value $required in numeric gt (>) at ./plugins/spamassassin line 453.
Use of uninitialized value $required in numeric gt (>) at ./plugins/spamassassin line 453.
t/plugin_tests.t ..... ok

helo forged-ip checks prone to false positives on RFC1918/NAT blocks

The helo plugin recently acquired verification of IP/HELO greetings; I've been seeing FPs for NATted hosts, generally for SMTP-capable desktop mail clients behind home routers. These hosts could pass an AUTH check later in the SMTP conversation but don't get that far.

I'm a little skeptical of the HELO IP check given the increasing prevalence of NAT as IPv4 gets scarce, but so far the only FPs I've seen (actually, the only times I've seen the forged address check fire at all) are on desktop clients.

Work around buggy Outlook quoted-printable output

Outlook is buggy and occasionally and generates quoted-printable output which does not specify whether lines should be terminated with \r\n or \n when in fact they ought to be terminated with \r\n. Given this input, MIME::Tools assumes \n, breaking some files. This plugin attempts to identify attachments affected by this Outlook issue; if we find any, we want to transmit the original (broken) encoding rather than re-encoding with bad assumptions.

This matters whenever the message is re-written in such a way that the MIME message data is altered (such as when adding a signature).

AUTH doesn't work with prefork

When using prefork and using Qpsmtpd as SMTP relay with authentication then this only works for the first "round" use of the instances. This is due to the fact that a variable in SMTP.pm ($self->{_auth}) is not reset. This means that the user will see a "but you already said AUTH" response with a 503 error code.

I have temp. fixed this by adding a
$self->{_auth} = undef;

in the auth function (Line 256) of SMTP.pm

Regards,
Jesper

Extract attachment meta data in a plugin

A plugin which parses MIME messages, and provides a meta data about all attachments, including attachment names and file sizes, and possibly the MIME application type.

$! is meaningless in fault() call

Qpsmtpd/SMTP.pm (and cousins) have a 'fault' sub, which reports $! to STDOUT, but $! is always meaningless in this context. From perlvar: "the value of $! is meaningful only immediately after a failure:"

The way fault() is called, it is never immediately after any failure. I propose we simply remove $! from the output.

qpsmtpd has problems with usernames with trailing \x00 bytes

What steps will reproduce the problem?

  1. An attempt is made to login with a username with trailing x\00-bytes

What is the expected output? What do you see instead?

I expect a line in the log-file reporting the IP-address of the attempted login, and the login mechanism (authvcm/login). But this information is missing, making it impossible for e.g. fail2ban to block future login attempts from this IP-address.

What version of the product are you using? qpsmtpd-0.84-8.el5.sme
On what operating system? sme 8.1 (centos 5.10)

Please provide any additional information below.

Using a terminal, I try to login, first as user "testuser" (base64 encoded):

jes@holck-desktop:/tmp$ telnet ibsgaarden.dk 25
Trying 192.168.10.1...
Connected to ibsgaarden.dk.
Escape character is '^]'.
220 katrine.ibsgaarden.dk ESMTP
ehlo jesper.ibsgaarden.dk
250-ibsgaarden.dk Hi pc-00089.ibsgaarden.dk [192.168.10.89]
250-PIPELINING
250-8BITMIME
250-SIZE 50000000
250-STARTTLS
250 AUTH PLAIN LOGIN
auth login
334 VXNlcm5hbWU6
dGVzdHVzZXI=
334 UGFzc3dvcmQ6
cGFzc3dvcmQ=
535 Authentication failed for testuser - authcvm/login
QUIT

And the qpsmtpd log file shows

2014-08-12 15:53:55.791253500 6530 logging::logterse plugin (deny): ` 192.168.10.89 pc-00089.ibsgaarden.dk jesper.ibsgaarden.dk auth::auth_cvm_unix_local 901 authcvm/login msg denied before queued
2014-08-12 15:53:55.791489500 6530 Authentication failed for testuser - authcvm/login

But then I try the same with user "testuser\x00\x00\x00\x00\x00\x00", i.e. the letters "testuser", followed by six 00-bytes:

jes@holck-desktop:/tmp$ telnet ibsgaarden.dk 25
Trying 192.168.10.1...
Connected to ibsgaarden.dk.
Escape character is '^]'.
220 katrine.ibsgaarden.dk ESMTP
ehlo jesper.ibsgaarden.dk
250-ibsgaarden.dk Hi pc-00089.ibsgaarden.dk [192.168.10.89]
250-PIPELINING
250-8BITMIME
250-SIZE 50000000
250-STARTTLS
250 AUTH PLAIN LOGIN
auth login
334 VXNlcm5hbWU6
dGVzdHVzZXIAAAAAAAA=
334 UGFzc3dvcmQ6
cGFzc3dvcmQ=
535 Authentication failed for testuser -
QUIT

The login fails, as it should, but this time the qpsmtpd log file only shows

2014-08-12 15:55:03.957949500 6756 Authentication failed for testuser -

Notice the missing line from the logterse plugin. So no IP-address is logged, and fail2ban can't do anything.

With an existing user name, it is possible to login, even with trailing \x00 bytes

jes@holck-desktop:/tmp$ telnet ibsgaarden.dk 25
Trying 192.168.10.1...
Connected to ibsgaarden.dk.
Escape character is '^]'.
220 katrine.ibsgaarden.dk ESMTP
ehlo jesper.ibsgaarden.dk
250-ibsgaarden.dk Hi pc-00089.ibsgaarden.dk [192.168.10.89]
250-PIPELINING
250-8BITMIME
250-SIZE 50000000
250-STARTTLS
250 AUTH PLAIN LOGIN
auth login
334 VXNlcm5hbWU6
aG9sY2sAAAAAAAA=
334 UGFzc3dvcmQ6
cGFzc3dvcmQ=
235 LOGIN authentication successful for holck - authcvm/login

This login should fail, I think. But apparently qpsmtpd strips the supplied user name of the \x00 bytes.

Tests failing for plugin/resolvable_fromhost

On my machine these tests are failing in the master branch:

t/plugin_tests.t ..... 37/? 
#   Failed test at t/plugin_tests/resolvable_fromhost line 83.

#   Failed test at t/plugin_tests/resolvable_fromhost line 74.
t/plugin_tests.t ..... 72/? 
#   Failed test at t/plugin_tests/resolvable_fromhost line 66.

#   Failed test 'perl.test'
#   at t/plugin_tests/helo line 116.
# Looks like you failed 4 tests of 292.
t/plugin_tests.t ..... Dubious, test returned 4 (wstat 1024, 0x400)
Failed 4/292 subtests 

Port issue for TLS on port 465

I think there might be an incorrect port setting in the plugin/tls, which is breaking when deploying on port 465. This port should start clear, and then provide STARTTLS to switch on SSL, same as port 25. However, the code for connecting reads:

if ( ! defined $local_port || $local_port != 465 ) {  # SMTPS

This should probably read:

if ( ! defined $local_port || $local_port != 587 ) {  # SMTPS

Using 465 here makes the server start in SSL directly, which is not the normal port 465 behaviour. Where a server on 587 should start directly in SSL. The use of negated conditions makes it harder to read the logic here, but basically 465 is not SMTPS, it's the legacy/secondary SMTP.

I'll happy send a pull request if needed.

What should be done about SSLv3 'POODLE' attack?

SSLv3 is no longer secure due to the 'POODLE' attack

What should QP do about this? There are three obvious options:

a. Disable SSLv3 in the TLS plugin. The benefits: no TLS transactions would ever use the insecure SSLv3, and fewer security auditors will pester QP administrators about this issue.

b. Leave SSLv3 enabled in the TLS plugin. The benefits: when talking to clients that don't support the other cyphers we support, SSLv3 would allow for an insecure encrypted communication that is preferable to insecure plaintext communication.

c. Make supported cyphers configurable in the TLS plugin (presumably the SSL_version string). I think there was a previous discussion on this which concluded that this wasn't necessary. I'm not sure whether this issue really does anything to change that conclusion.

Our fork has gone with A, mainly because we get calls from customers all the time about audit failures like this and the easiest thing is to avoid the audit failures, and to be able to tell inquisitive customers that we've disabled SSLv3 in everything that uses encryption. So if we were ever to merge back the upstream TLS plugin (which would not be difficult at all aside from this issue), it would require upstream to have done A or C, or else for us to change our minds and choose B.

intermittent test failure

I get this failure only occasionally, while using google (8.8.8.8) as my nameserver.

t/qpsmtpd-address.t .. ok
t/qpsmtpd-base.t ..... 26/?
#   Failed test 'resolve_ptr: FQDN: '
#   at t/qpsmtpd-base.t line 96.
# Looks like you failed 1 test of 27.
t/qpsmtpd-base.t ..... Dubious, test returned 1 (wstat 256, 0x100)
Failed 1/27 subtests

FATAL PLUGIN ERROR [logging::file]

Hi, i tried prefork 0.94 and last head 846c77e both of them has problem with file log:

119 220 Go ahead with TLS
119 (unrecognized_command) tls: TLS setup returning
FATAL PLUGIN ERROR [logging::file]: Can't call method "hook_logging" on unblessed reference at lib/Qpsmtpd/Plugin.pm line 46 during global destruction.
82 cleaning up after 119
282 221... Have a wonderful day.
282 click, disconnecting
FATAL PLUGIN ERROR [logging::file]: Can't call method "hook_logging" on unblessed reference at lib/Qpsmtpd/Plugin.pm line 46 during global destruction.
281 cleaning up after 282

karma plugin rejects when more than 1 recipient

Emails with more than 1 recipient are rejected when the karma plugin is enabled

@400000005760f07232f62e44 30316 (connect) relay: skip, no match
@400000005760f0750ae1e574 30316 (connect) dnsbl: pass
@400000005760f0750aebfb7c 30316 220 robert.lapiole.org ESMTP
@400000005760f0750d006c2c 30316 dispatching EHLO mx.firewall-services.com
@400000005760f0750f02664c 30316 (ehlo) helo: reverse domain match
@400000005760f0750f0442dc 30316 (ehlo) helo: pass
@400000005760f0750f1142fc 30316 250-lapiole.org Hi front.firewall-services.com [212.129.1.223]
@400000005760f0750f125854 30316 250-PIPELINING
@400000005760f0750f130c04 30316 250-8BITMIME
@400000005760f0750f13bfb4 30316 250-SIZE 20000000
@400000005760f0750f14a244 30316 250 STARTTLS
@400000005760f0751144864c 30316 dispatching MAIL FROM:<[email protected]> SIZE=989
@400000005760f07524b7e8f4 30316 (mail) resolvable_fromhost: pass, firewall-services.com.net has MX at ASPMX.L.GOOGLE.COM
@400000005760f07619d889fc 30316 (mail) rhsbl: pass
@400000005760f077103617d4 30316 (mail) sender_permitted_from: pass
@400000005760f0771039195c 30316 (mail) naughty: pass
@400000005760f07710428b54 30316 250 <[email protected]>, sender OK - how exciting to get mail from you!
@400000005760f0771047a404 30316 dispatching RCPT TO:<[email protected]>
@400000005760f077107693a4 30316 (rcpt) badrcptto: pass
@400000005760f077107aa2b4 30316 (rcpt) check_goodrcptto: stripping '-' extensions
@400000005760f07711a94744 30316 (rcpt) rcpt_ok: pass: lapiole.org in rcpthosts
@400000005760f07711acc9b4 30316 250 <[email protected]>, recipient ok
@400000005760f07711b0f804 30316 dispatching RCPT TO:<[email protected]>
@400000005760f07711b71e3c 30316 (rcpt) karma: recipients t: 1 (<[email protected]>)
@400000005760f07711b8200c Use of uninitialized value $history in numeric gt (>) at /usr/share/qpsmtpd/plugins/karma line 406.
@400000005760f07711b8b864 Use of uninitialized value $history in concatenation (.) or string at /usr/share/qpsmtpd/plugins/karma line 418.
@400000005760f07711bd214c 30316 (deny) logging::logterse: ` 212.129.1.223      front.firewall-services.com       mx.firewall-services.com  <[email protected]>    <[email protected]>    karma   901     too many recipients for karma -1 (h: )     msg denied before queued
@400000005760f07711bea404 30316 550 too many recipients for karma -1 (h: )
@400000005760f07711c21ea4 30316 dispatching DATA
@400000005760f07711c86034 30316 354 go ahead
@400000005760f07717f6356c 30316 spooling message to disk
@400000005760f0772bfc98e4 30316 (data_post_headers) dkim: pass, no signature, neutral policy
@400000005760f07739b9a044 30316 (data_post_headers) dmarc: skip, no policy
@400000005760f07739cb95ec 30316 (data_post) bogus_bounce: pass, not a null sender
@400000005760f07739cf8d8c 30316 (data_post) bcc: message copied to [email protected]
@400000005760f07739e0fe64 30316 (data_post) headers: pass
@400000005760f07739e4b784 30316 (data_post) sender_permitted_from: pass
@400000005760f07739e795e4 30316 (data_post) naughty: pass
@400000005760f07739f180f4 30316 (data_post) uribl: pass, No URIs found in mail
@400000005760f07c28262514 30316 (data_post) spamassassin: pass, Ham, 0.7 < 12, learn=no
@400000005760f07c290b7434 30316 (data_post) virus::clamdscan: pass, clean
@400000005760f07c2919cffc 30316 (queue) logging::logterse: ` 212.129.1.223     front.firewall-services.com       mx.firewall-services.com  <[email protected]>    <[email protected]>,<[email protected]>      queued          <50b7-5760f080-7-51bad800@212276509>       No, score=0.7 required=4.0 autolearn=no autolearn_force=n
@400000005760f07c2944c7fc 30322 (queue) queue::qmail_2dqueue: (for 30316) Queuing to /var/qmail/bin/qmail-queue
@400000005760f07c2f7df774 30316 250 Queued! 1465970802 qp 30322 <50b7-5760f080-7-51bad800@212276509>

The problem is in rcpt_handler function, I don't really understand the logic here. Leaving aside the $history issue (not defined), it means that only hosts which have a positive history can send us emails with more than one recipient ? That seems too aggressive. It should at least be optional

Precedence between whitelisting and badrcptto?

57a0e4b
added whitelisting support to badrcptto with the call to $self->is_immune().
Is that useful? What are the use cases for badrcptto?
I have two:

  1. Close a mailbox because the addressee has disappeared (e.g. an employee who quit).
  2. Close a mailbox because it's receiving too much junk.

The unique advantage of badrcptto is that it supports a custom message to inform the sender of why the mailbox is not working anymore, and possibly to give one or more alternative addresses. The basic premise is that we want to completely shut down that mailbox.

Unfortunately, whitelisting defeats the purpose, because it allows mail from whitelisted senders to go through, so (#1) they never see the message that we wanted to show to them, especially to legitimate senders, and (#2) junk comes through again.

My reason for bringing this up is receiving a piece of spam (in the catch-all mailbox) from yahoo.co.jp (which is whitelisted in list.dnswl.org via the dns_whitelist_soft plugin) for an account listed in badrcptto.

If we say "this rcptto is bad!", is there a use case for allowing a whitelisted host or sender to get through anyway?

Hans

Run-time warnings in misc.t

t/misc.t ............. 3/12 t/misc.t[29494]: program fault - command not performed (No such file or directory)
t/misc.t[29494]: test message (No such file or directory)
t/misc.t ............. ok

Per user/domain plugin configurability

Make a system for configuring the plugins per user/domain/...

 support databytes per user / domain

Methods to create a bounce message easily; partly so we can accept a
mail for one user but bounce it right away for another RCPT'er.

The data_post hook should be able to put in the notes what addresses
should go through, bounce and get rejected respectively, and qpsmtpd
should just do the right thing. See also and David Carraway's thoughts for "user filters"

dnsbl ignores dns_whitelist_soft

Here's what I'm seeing in 7-debug-2015-01-22_121515.log:

dns_whitelist_soft
waiting for whitelist dns
done waiting for whitelist dns, got 1 answers ...
name 18.208.239.213.list.dnswl.org
got txt record
Host 213.239.208.18 is whitelisted: hoststar.ch http://dnswl.org/s?s=2441
Plugin dns_whitelist_soft, hook rcpt returned DECLINED,
dnsbl
...
naughty
disconnecting
Plugin naughty, hook data returned DENYHARD, Listed http://www.spamsources.fabel.dk/ip/213.239.208.18

Is it possible to get dnsbl to respect dns_whitelist_soft?

Hans

optional Authentication-Results header (enabled by default)

QP adds auth username and mechanism to the Received: header for authenticated email.

[It is now in an Authentication-Results: header, not in the received header]

This has been criticized on the mailing list:

The authentication details, on the other hand, I think should be removed.
Google will show you [many pairs of (server,auth-username) archived on the
web](http://www.google.co.uk/search?num=100&q=%22smtp-
auth+username%22+%22mechanism%22) as a result of authenticated emails being sent to mailing lists via qpsmtpd.

I don't see it as a good idea to give attackers free information about what
accounts are valid on what servers. Again, all that a recipient needs to
know is encapsulated in the "with (E)SMTP(S)A" clause of the header.

Is this a legitimate critique?

Add a plugin to sanity-check message ids

Messages are sometimes received with multiple message-id headers, or an entirely missing or corrupt message-id. A plugin to ensure there is always one and only one message-id header should be created.

inconsistent log formatting

#175 attempted to add some information about which plugin is running to log entries, but it was reverted because it was actually redundant. I wanted to merge the bit of Qpsmtpd::varlog() that did this to our fork, but it turns out it's already in there. However, it's only executed if no logging plugin is enabled so that varlog() has to output directly to STDERR. Most logging plugins do add the plugin name and hook name to the log entry, however two common logging plugins, logging/file and logging/syslog, do not.

Why don't we just decide on a standard format (presumably the format already used most places), and do the prepending in Qpsmtpd::varlog() instead of leaving it up to each logging plugin?

Reject in data_post_header not working

While debugging why the dmarc plugin was not rejecting anything (including voluntarily spoofed sender), I found that rejecting in the data_post_header hook has no effect. We can see logs like:

2016-04-28 18:58:15.122271500 27079 spooling message to disk
2016-04-28 18:58:15.140199500 27079 (data_post_headers) dkim: pass, no signature, neutral policy
2016-04-28 18:58:15.191361500 27079 (data_post_headers) dmarc: has policy, no report URI
2016-04-28 18:58:15.191497500 27079 (data_post_headers) dmarc: fail
2016-04-28 18:58:15.191720500 27079 (data_post_headers) dmarc: karma -3 (-4)
2016-04-28 18:58:15.191822500 27079 (data_post_headers) dmarc: fail
2016-04-28 18:58:15.192182500 27079 (deny) logging::logterse: ` 213.41.128.39  front.remote.org       mx.remote.org  <[email protected]>     <[email protected]>      dmarc   901     failed DMARC policy     msg denied before queued
2016-04-28 18:58:15.193392500 27079 (data_post) bogus_bounce: pass, not a null sender
2016-04-28 18:58:15.193623500 27079 (data_post) bcc: message copied to [email protected]
2016-04-28 18:58:15.194583500 27079 (data_post) headers: pass
2016-04-28 18:58:15.194735500 27079 (data_post) naughty: pass
2016-04-28 18:58:15.194981500 27079 (data_post) uribl: pass, No URIs found in mail
2016-04-28 18:58:20.546714500 27079 (data_post) spamassassin: pass, Ham, 0.1 < 12, learn=no
2016-04-28 18:58:20.557516500 27079 (data_post) virus::clamdscan: pass, clean
2016-04-28 18:58:20.557630500 27079 (queue) logging::logterse: ` 212.83.168.232 front.remote.org       mx.remote.org  <[email protected]>     <[email protected]>,<[email protected]>        queued          <49bb-57224100-7-51bed40@212606113>     No, score=0.1 required=4.0
2016-04-28 18:58:20.560137500 27091 (queue) queue::qmail_2dqueue: (for 27079) Queuing to /var/qmail/bin/qmail-queue

I'm sending from a spoofed whatsapp.com address (which has a p=reject DMARC policy), the DMARC plugin sees it, and send a reject (the logterse plugin logs it), but no 55X is sent to the remote peer, the connection continues, and the email is accepted.

If I edit the dmarc plugin and hook into data_post instead of data_post_header, then everything is fine

    else {
        $self->{_dmarc} = Mail::DMARC::PurePerl->new();
#        $self->register_hook('data_post_headers', 'check_dmarc');
        $self->register_hook('data_post', 'check_dmarc');
    };

Now, the question is, what's the best way to fix this:

  • Should data_post_headers be fixed to honor rejection (as the doc https://github.com/smtpd/qpsmtpd/blob/master/docs/hooks.md clearly says it should be supported)
  • Or, should we update the doc, stating the data_post_headers is only to alter headers, and create a new function in the dmarc plugin, hooking into data_post to handle the reject

Any advice ?

dkim plugin: Sign for others

I'm still wrestling with dkim...

The doc says

Sign for others

Following the directions above will configure QP to DKIM sign messages from authenticated senders of example.org. Suppose you host client.com and would like to DKIM sign their messages too? Do that as follows:

cd ~smtpd/config/dkim
ln -s example.org client.com

QP will follow the symlink target and sign client.com emails with the example.org DKIM key.

I've done that, but I keep getting the signature for example.org (i.e. d=example.org), which means it fails alignment with [email protected].

How can I get d=client.com if the sender is [email protected]?

Hans

Plugin sender_permitted_from ignores whitelisthelo

Today I have to argue the other way around...

sender_permitted_from calls is_immune(), but is_immune() checks only whitelisthost and whitelistsender.

I send some mail through SpamCop and back, and when the mail comes back, it's blocked by SPF. I'd like to fix this by whitelisting SpamCop's HELO, rather than relying on guessing the IPs of their MTAs.

The whitelist plugin does evaluate whitelisthelo and set a transaction note, but no one is checking that note. Is that a design choice or a bug?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.