Qmail Howto
12) Installing Relay-CTRL
You might wonder what Relay-CTRL is. Well, this small program performs smtp authorization. Basically, it serves those clients who want to send email messages through our server. It will protect the mail server from thousands of abusers who send unsolicited mail through open-relay servers. Not only does Relay-CTRL solve the relaying problem, but it also verifies that only local accounts are able to send mail to outside servers.
The install procedure is fairly easy. This is what you have to do:
cd /usr/local/src tar zxf relay-ctrl-3.1.1.tar.gz cd relay-ctrl-3.1.1 make ./installer mkdir /var/qmail/relay-ctrl mkdir /var/qmail/relay-ctrl/allow chmod 700 /var/qmail/relay-ctrl chmod 777 /var/qmail/relay-ctrl/allow mkdir /etc/relay-ctrl echo /var/qmail/relay-ctrl/allow > /etc/relay-ctrl/RELAY_CTRL_DIR echo 900 > /etc/relay-ctrl/expiry echo /etc/tcp.smtp.cdb > /etc/relay-ctrl/smtpcdb echo /var/qmail/relay-ctrl > /etc/relay-ctrl/spooldir echo /usr/local/bin/tcprules > /etc/relay-ctrl/tcprules
What are we doing here? After installing relay-ctrl, we are setting up "/var/qmail/relay-ctrl/allow" as the directory where temporary access files will be written. If a user with IP "100.100.100.10" is successfully authenticated, a file called "100.100.100.10" is created in this directory. The file will contain "USER=yourdomain.com" (yourdomain.com being the domain that the user belongs to). The user is now able to send messages but only for a specified amount of time (expiry). The expiry is located in /etc/relay-ctrl/expiry. In this guide, the expiry time is 900 seconds, which means that after 15 minutes the user will no longer be able to send messages through the mail server, unless he/she authenticates again.
Also, don't forget to add the following cron job to your system. You can either put the line into /etc/crontab or create a file relay-ctrl in /etc/cron.d
* * * * * root /usr/local/bin/envdir /etc/relay-ctrl /usr/local/bin/relay-ctrl-age
Restart the cron daemon for changes to take effect.
13) Preparing POP3 and SMTP startup environment
Qmail is useless without POP3 and SMTP protocols. You can't send and receive e-mail from remote hosts without running these services. We have already installed most of the stuff now. It is a good idea to test our accomplishments so far, by running Qmail with POP3 and SMTP.
Download the file "runmail" from this server and place it in /usr/local/bin.
This script will definitely confuse many of you. But don't worry, I am here to explain you what each line of the above code does :-) The script can be divided into three parts - the first one runs vmailmgr daemon, the second one runs an smtp server and the third one runs a pop3 server. Remember, that you'll be needing both smtp and pop3 servers if you want to be able to send and receive mail. The vmailmgr daemon is needed for web-based administration, which I will be covering in "oMail-admin" section below.
Again, the first two lines specify the paths to executables to make our lives easier and our script smaller. The third line changes the directory to root. Softlimit -m 10000000 sets the maximum memory usage to 10MB. You can limit it to a smaller amount of memory, if you want to. Just make sure that the limit is reasonable - otherwise the program could simply fail to execute because of memory limitations. The next line executes vmailmgr daemon, which is needed if you want to be able to add/remove/modify mail users through a web interface. We run vmailmgrd through unixserver, which creates a socket and waits for incoming connections. All vmailmgrd connections are logged in /var/qmail/logs/vmailmgrd. The second part of the script runs an SMTP server. Again, we limit the memory usage to 10MB via softlimit. The envdir lines set the config directory to /etc/relay-ctrl for relay-ctrl. The next line starting with tcpserver is rather compicated. The "-v" switch given to tcpserver makes sure that all error and status messages are printed out (if they occur). The "-H" switch disables DNS lookups. We don't need to do DNS lookups, since our patched qmail already does that. The "-R" switch will stop tcpserver from attempting to obtain $TCPREMOTEINFO variable from remote hosts (we don't need it). The "-l $HOSTNAME" switch will force tcpserver not to lookup local host name in DNS (no need to resolve ourselves). The "-x /etc/tcp.smtp.cdb" switch forces tcpserver to follow the rules compiled by our tcprulesedit script. The "-c200" switch limits the maximum number of simultaneous connections to 200. The "-u5002" switch sets tcpserver user id to "qmaill" and "-g5000" sets group id to "nofiles". Next 0 and smtp simply tell tcpserver to listen on any available interface on port 25. The "rblsmtpd -b -r relays.ordb.org rblsmtpd -r sbl.spamhaus.org" command executes anti-spam filter for denying blacklisted servers on the Internet. If the first blacklist server fails, the second one (sbl.spamhaus.org) takes over. You can check whether your blacklist settings work by sending a test message to nelson-sbl-test@crynwr.com. If you receive only one message with "Terminating conversation" message at the end, settings are good to go. If you receive two messages with one saying "Uh-oh, your SBL block is not working!", it means that either the relay servers are unreachable at the moment or something is wrong with your settings. The "fixcrio" command will insert missing CRs at the end of messages. Some old mail servers send messages that contain bare linefeeds and fixcrio will deal with those. It's very unlikely that such servers exist, but adding this executable will make sure that we are not denying messages from some old non-blacklisted servers. The next "relay-ctrl-check" command checks if the mail user has already been authenticated. If /var/qmail/relay-ctrl/allow directory does not contain sender's IP address, the message is rejected with 553 error message "sorry, that domain isn't in my list of allowed rcpthosts". If everything is good and the user did authenticate before, the message is successfully delivered through "qmail-smtpd", which is the next command we are executing. The "setuidgid qmaill" makes multilog execute under "qmaill" user. I've already explained multilog switches above, so I will not go through that part again.
The third part of the script deals with running a pop3 server on port 110. Just like we did for smtp server, we execute softlimit followed by envdir for relay-ctrl. This is needed because relay-ctrl must record authenticated user's IP address and domain into the temp allow directory. Next, we run tcpserver - only this time we execute it under "root" account (the -u0 and -g0 switches). Plus, we now specify port 110 to listen on instead of smtp (port 25). The next command "qmail-popup localhost" will read a POP username and password from the connecting client. You can either specify "localhost" or your fully qualified domain name after "qmail-popup". The next line starts with "checkvpw" which is the default password authentication utility for vmailmgr. So, all it does is - it checks whether the specified username and password are correct. Of course, if the authentication fails, checkvpw exits causing tcpserver to disconnect the user with a failure message. If the authentication is successful, the next command "relay-ctrl-allow" is executed. It will make sure that the user's IP address and domain are recorded into a temp file in relay-ctrl's allow directory. Next, "qmail-pop3d" is run, allowing the user to receive and delete his/her messages from the server. Once more, we are switching to "qmaill" user id for multilog and using /var/qmail/logs/pop3 log directory to log all pop3 connections.
The script is ready. Now, all we need to do is make it executable:
chmod 755 /usr/local/bin/runmail
14) Testing Qmail installation
Before we go any further, let's make sure that everything we've done so far works properly. For that, we'll have to execute Qmail, POP3 and SMTP. Then, we will send and receive a couple of test messages. Only then will there be a point in continuing and completing qmail installation.
So, let's get Qmail, POP3 and SMTP running:
/var/qmail/rc & /usr/local/bin/runmail
If you get a permission error with multilog, type "chown qmaill:nofiles /var/qmail/logs" and "chown qmaill:nofiles /var/qmail/logs/qmail". Kill running qmail with "killall qmail-lspawn" and then retry running the script with "/var/qmail/rc &".
Type ps ax | grep qmail in shell prompt. The command should return 8-9 different processes (qmail-send, qmail-rspawn, qmail-clean and etc). The output will look similar to this:
17295 pts/1 S 0:00 qmail-send 17296 pts/1 S 0:00 multilog t n100 s1000000 /var/qmail/logs/qmail 17297 pts/1 S 0:00 qmail-lspawn ./Maildir 17298 pts/1 S 0:00 qmail-rspawn 17299 pts/1 S 0:00 qmail-clean 17315 pts/1 S 0:00 multilog t n100 s1000000 /var/qmail/logs/vmailmgrd 25459 pts/1 S 0:00 multilog t n100 s1000000 /var/qmail/logs/smtp 25461 pts/1 S 0:00 multilog t n100 s1000000 /var/qmail/logs/pop3 25736 pts/1 S 0:00 grep qmail
Now type ps ax | grep tcpserver again in shell prompt. The command should return only three lines. The output will look similar to this:
25458 pts/1 S 0:00 tcpserver -v -H -R -l server.com -x /etc/tcp.smtp.cdb... 25460 pts/1 S 0:00 tcpserver -v -H -R -l server.com -x /etc/tcp.smtp.cdb... 25801 pts/1 S 0:00 grep tcpserver
If you have something similar to examples above, your installation is most probably up and running. If you receive an empty output, something went wrong. In that case, check out the "current" log files in /var/qmail/logs.
Our current objective is to test how our system is working. Create an account in your e-mail client (Outlook Express, Bat or whatever you have there) on another computer using the domain, login and password you've supplied before. In our case, your login is "test@yourserver.com" and password is the password that you typed in when you issued a "vadduser" command. The settings for both POP3 and SMTP should remain default to e-mail client's values. For POP3 and SMTP server address, either supply your new mail server's IP address or its valid hostname. I usually type in an IP address (less DNS queries and faster). Click send/receive and see what happens. If you get an error, see what type of error you get. Make sure that everything you specify in your mail client is valid and working. Sometimes people type in something wrong and then blame it on others. I hope you are not the nut case :-) Anyway, if you get a window that asks you to retype your password, that means that you have either mistyped your password, or supplied a wrong login. By the way, did I mention that you must supply your login and domain for authentication? (type in your full e-mail address as your login - ex: test@yourserver.com).
Warning: Don't try to send an e-mail to check how everything works yet. You will simply get an error message "unable to exec qq". This is because we have /var/qmail/bin/qmail-scanner-queue.pl to process the qmail queue and this file simply does not exist!
15) Qmail-Autoresponder Installation
The installation is very easy. All you need to do, is run "make", copy the compiled binary to /usr/local/bin and make it executable.
cd /usr/local/src tar zxf qmail-autoresponder-0.97.tar.gz cd qmail-autoresponder-0.97 make qmail-autoresponder cp qmail-autoresponder /usr/local/bin chmod 755 /usr/local/bin/qmail-autoresponder
Create a vdeliver-postdeliver file in /etc/vmailmgr folder and copy-paste the following into it:
#!/bin/sh if test -s $MAILDIR/autoresponse/message.txt then qmail-autoresponder message.txt $MAILDIR/autoresponse fi
Then make it executable:
chmod 755 /etc/vmailmgr/vdeliver-postdeliver
Related posts:
10/31/2007 - 10:10
I have a problem with autoresponse. When it send’s the response, the sender address goes like this “”@domain.com . This way, it’s always flaged as relay, on my relay server.
Do you have any hint?
11/14/2007 - 02:40
Hi,
Really good site. Thanks for your valuable help. Do you have anything similar for postfix,mysql,dovecoat with webmail option. Since all these can be installed along with the O.S. and only need to integrate.
Rgds,
Saji Alexander.
11/28/2007 - 18:32
if you’re having problems making Courier for Fedora/Redhat with error /usr/include/stdio.h:385: error: syntax error before ‘&&’ token , you can find information here http://atmail.com/view_article.php?num=199
02/19/2010 - 02:45
That article no longer exists.
It has been replaced by: http://atmail.com/kb/?p=270
Just in case it disappears again, here it is:
———————-
Description: The standard Courier-IMAP 3.0.8 distribution will not build on stock Fedora/Redhat systems. Compilation fails while building the authlib library, usually with an error message like:
In file included from authstaticlistsearch.c:9:
/usr/include/stdio.h:385: error: syntax error before ‘&&’ token
A review of the stdio.h file shows that no ‘&&’ symbols appears on or near line 385.
Solution: The courier-imap/authlib directory contains a file named ‘debug.h’ to support the debugging of authentication attempts against the Courier IMAP server. This file contains a C preprocessor macro named ‘dprintf’ that conflicts with the ‘dprintf’ function defined in glibc’s ’stdio.h’. This conflict isn’t a problem so long as ‘#include ‘ appears before ‘#include “debug.h”‘ in the authlib source files. Unfortunately, this is not the case for files ‘authstaticlistsearch.c’, ‘authmoduser3.c’, ‘mod.h’, ‘authtest.c’, ‘debug.c’, and ‘authdaemon.c’.
To fix this problem, open these files in a text editor and move the ‘#include “debug.h”‘ line so that it is the last include directive. Make sure that you do not paste it into a ‘#if … #endif’ block. Once you have made these changes, the build process should succeed.
01/20/2008 - 15:07
I installed Your Qmail-modification a couple of years ago. Thanks for that! Now I would like to use your patch for bounce handling.
patch
03/04/2008 - 02:46
Hi,
how can we know a email is bounced or not ?? qmail handles smtp return codes ??
Thanks,
Satish.K
03/25/2008 - 03:46
/usr/local/bin/setuidgid qmaill “contrib/test_installation.sh -doit”
i stuck at that line and my fedora 8 give me :
/usr/local/bin/setuidgid qmaill “contrib/test_installation.sh -doit”
setuidgid: fatal: unable to run contrib/test_installation.sh -doit: file does not exist
AND also when i run : # /usr/local/bin/setuidgid qmaill \
“/var/qmail/bin/qmail-scanner-queue.pl” -g
perlscanner: generate new DB file
perlscanner: total of 9 entries.
my fedora 8 only reply : perlscanner: generate new DB file
**Please help me, it’s already 2 to 3 days since i tried to solve it but can’t…
04/30/2008 - 17:53
Hi Nasim. Thanks a lot for providing nice and very helpful instructions in plain english :-)
I’ve installed mail production server on Debian(4) using your guidlines.
Although I came across some problems after install, i.e. when I have created second virtual domain, mail server stopped recieving any messages at all(even though the first virtual domain was working on it’s own before). Is it something to do with Qmail-Scanner, where by one required to enter domains’ names before installing it(–local-domains “domain.one.com,domain.two.com”; page 5 of your instractions)?
Thanks a lot in advance if you can spare some time to answer this question.
Kind regards,
yuriy
05/01/2008 - 10:31
Yuriy, are you still receiving mail for the first domain that you had created before? Also, a little troubleshooting would definitely help. Try this:
1) Telnet to your server’s IP address port 25 by typing “telnet x.x.x.x 25″
2) Type “HELO test.com” or some other domain and press enter
3) Type “MAIL FROM:test@test.com” and press enter
4) Type “RCPT TO:test@yourdomain.com” and press enter
5) Type “DATA” and press enter
6) Type some garbage and then type “.” on a separate line. The server should respond “250 ok xxxxxxx qp xxxxx”.
7) Type “quit” on a separate line and see what output you get.
8) While doing all of the above check your qmail logs. Both the incoming tcp logs and your qmail logs.
9) After you are done with the telnet session, your logs should report what the problem is.
If your domain is not in one of the configuration files, you will get a descriptive error in the log. If there is any other problem, you should see it in the log as well.
If you can’t telnet to your server, then your tcpserver is having a problem and might need to be rebooted.
Hope the above helps.
Nasim
05/06/2008 - 07:36
i’m sorry..could you give me a module to make QMAIL in SLACKWARE 12, i have try to make it, but not suxess..please. for my homework
05/06/2008 - 11:11
Hi Nazim.
I can telnet to my server and do all steps you have listed alright. It’s just when I’m trying to set additional virtual domain it stops receiving emails(one can still send emails though) even to the first virtual domain. When I remove the second virtual domain it will start to receive emails but only after couple hours.I reckon that it’s Qmail-Scanner coursing this problem. I probably leave this issue to sort later on(I’m planning to install another test server but will keep in mind using more than one domain then).
I have couple more issues which require immediate attention and I was trying to sort them out but no luck so far.
1. I need to set our email server to give a 550 error for an invalid address. I have used Andrew Richards’ qmail-verify patch(http://free.acrconsulting.co.uk/email/qmail-verify.html). I can see qmail-verify daemon is running on our server but it’s not rejecting non-existing users(so it’s accepting anything with our domain). The problem could be that /home/email/[virtual_domain]/.qmail-default telling that anything coming with this domain is valid.
But because I’m using virtual domain .qmail-default pipes to /usr/local/bin/vdeliver.So vdeliver is deciding who is right users on our server. Andrew suggested to remove /home/email/[virtual_domain]/.qmail-default but when I did it email server stopped to receive emials. Do you know what parameters I need to pass to /usr/local/bin/vdeliver in /home/email/[virtual_domain]/.qmail-default so qmail-verify can properly filter email users?
2. Due to the increase in the number of ISP’s blocking port 25 for third party mailservers I need to set on mail server additional port to answer SMTP request. I was looking on google and found the following link http://www.skorpionweb.org/archives/2005/09/running_qmail_s.php.
So I followed the logic in this article and set separate tcpserver which listens to different port:
1) Created /var/qmail/rc2 :
#!/bin/sh
PATH=”/var/qmail/bin:/usr/local/bin”
export PATH
cd /
qmail-start ./Maildir | setuidgid qmaill \
multilog t n50 s1000000 \
/var/qmail/logs/qmail2 &
2) Created /usr/local/bin/runmail2:
exec softlimit -m 10000000 \
envdir /etc/relay-ctrl relay-ctrl-chdir \
tcpserver -v -H -R -l $HOSTNAME -x /etc/tcp.smtp.cdb -c200 -u5002 -g5000 0 587 qmail-smtpd 2>&1 &
3) Created /var/qmail/logs/qmail2 and chown it to qmaill:nofiles.
Now I can start separate tcpserver with port 587 and everything looks healthy with but when I change port 25 to 587 and try to send mail I have got an error “…The server may be unavailable or refusing connection…”
I wonder whether I need to set another instance of qmail-smtpd(may be qmail-smtpd2, just guessing here).
Thanks a lot again for your time and effort to keep this site going & helping folks like myself :-)
Kind regards, yuriy
05/24/2008 - 23:59
Hi Nazim,
Problem with setting second virtual domain was sorted out. It turned out that one needs to restart qmail server after adding another virtual domain.
Also I have sorted an issue with 550 error page(I have wrote about it in one of my previous posts).
With virtual domain .qmail-default file should exist for each user. So solution was pretty simple: copy original .qmail-default to .qmail-USERNAME in /home/email/yourdomain/ folder. Also my /etc/tcp.smtp looks like this:
127.:allow,RELAYCLIENT=”",RBLSMTPD=”",QMAILQUEUE=”/var/qmail/bin/qmail-queue”
:allow,QMAILQUEUE=”/var/qmail/bin/qmail-scanner-queue.pl”,VERIFY=”"
05/25/2008 - 02:29
Hi Nazim,
Sometimes I have an error when sending email(addresses which I used before or new):
An error occurred while sending mail.The mail server responded: sorry, that domain isn’t in my list of allowed rcpthosts(#5.7.1). Please check the message recipients and try again.
I thought that it something to do with timing out authentication so I have removed 900 from /etc/relay-ctrl/expiry(step 12->Installing Relay-CTRL; pagehttp://mansurovs.com/2002/12/20/qmail-howto/4) but I’m still getting this error.
I’ll appreciate if you could advice on what could be wrong, please.
Thanks a lot in advance,
yuriy
05/30/2008 - 10:10
Hi Nasim:
Have you tried to use CourierIMAP 4.3.1 (with AuthLib)?
I would appreciate your comments about it.
Thanks.
06/20/2008 - 19:22
This was helpful. Thank you.
06/29/2008 - 14:03
Nice tutorial. If anyone needs help, you can contact my via email on my website.
I could do it for free.
09/05/2008 - 16:04
> – Qmail Patches from http://mansurovs.com
Where is the patches, i find but…
10/03/2008 - 07:19
So what if I want a more minimalistic solution. Basically I have a mail server that only needs to serve one site, and primarily outgoing mail. So no fancy stuff needed like multiple users and auto-responders.
I would like to have a suite of admin tools, for instance, being able to manually send an email that’s been stuck in the queue and watching the remote mail server response, ideally have a php script parse this information.
Hours on Google have really only given me scripts for the end-user, none for really managing the admin part of qmail.
10/16/2008 - 23:09
Nice tutorial. This is only the patch that I haven’t encountered a problem.
I hope you can add a patch such as validrcptto. This is nice patch. However, I’m getting a hunk failed when I’m trying to patch it after patching all the patch on your tutorial. Probably, some code doesn’t conform to validrcptto patch. I’m not a C programmer so I’m getting a hard time fixing the problem. Please inform me via my email ntserafica@yahoo.com if you have the patch.
This could be a great gift this coming christmas :)
03/27/2009 - 22:20
can you have an instruction on how to get squirrelmail work together with your tutorial..
Thank in advanced
03/28/2009 - 01:50
I followed you through step 17.1 everything work fine but when I telnet to port 15 and 110 …these errors occur
===============================================
telnet 127.0.0.1 25
Trying 127.0.0.1…
Connected to localhost (127.0.0.1).
Escape character is ‘^]’.
220 tnway.com ESMTP
exit
502 unimplemented (#5.5.1)
quit
======================================================
telnet 127.0.0.1 110
Trying 127.0.0.1…
Connected to localhost (127.0.0.1).
Escape character is ‘^]’.
+OK
hello
-ERR authorization first
exit
-ERR authorization first
=============================================
What wrong with me ? I really need your help
Thank in advanced
03/28/2009 - 01:56
billyduc,
Just install Courier IMAP and you will be able to use Squirrelmail or any other web-based mail system. I personally use Horde http://www.horde.org/ and love the functionality.
Regarding your other issues with telnetting – the output seems to be normal and the services are responding. Did you try to send an email to your server through an external provider like gmail/yahoo? Did you try to use a client like Outlook to download emails through POP3/IMAP?
Nasim
03/30/2009 - 01:50
I use Evolution for email client.
I setup for “test” account to send and receive mail
When I clicked Send / Receive Button. It prompt me
Unable to connect to POP server myhost.mydomain.com.
Error Sending password : -ERR authorization failed
Please enter the POP password for test on host myhost.mydomain.com
I enter the password for test account……But the error window is open
Error While Fetching Mail
Unable to connect to POP server myhost.mydomain.com.
Error Sending password : Operation now in progress
05/05/2009 - 13:21
hey, i wrote a practical step-by-step how-to on qmail… please see the link: “http://119.15.153.9/qmail/qmail-install.html” , i hope some one will require it.
07/17/2009 - 11:06
Great howto, tnx!
08/19/2009 - 15:37
When I was trying to compile the qmail-autoresponder-0.97, it gave me the following error messages:
main.c: In function âexec_qmail_injectâ:
main.c:257: warning: missing sentinel in function call
./compile options.c
options.c:1:25: error: mysql/mysql.h: No such file or directory
make: *** [options.o] Error 1
I have the mysql installed. Please help.
Thank you
11/14/2009 - 15:09
I did “apt-get install libmysqlclient15-dev” and it solved the problem with options.c:1:25: error: mysql/mysql.h: No such file or directory
11/14/2009 - 15:13
Andreas, thank you for the input!
Whenever there is a problem with mysql.h not being found, you need to install the mysql client source files, just like you did.
01/02/2010 - 07:39
Hello,
I like to forward all bounced emails for all of my user accounts to a single account.
is there a qmail setting or patch that allows me to forwards all bounced emails of my user accounts to a single admin account?
Regards