Diff: NetQmail

Differences between version 2 and previous revision of NetQmail.

Other diffs: Previous Major Revision, Previous Author

Newer page:	version 2	Last edited on Friday, 9 December 2005 9:44:29	by CyberLeo	Revert
Older page:	version 1	Last edited on Friday, 9 December 2005 2:46:22	by CyberLeo	Revert

---

version 2

Netqmail enhancements

Prerequisites

• DaemonTools
• UCSPI-tcp
• libspf - The Sender Policy Framework
• SPP Framework
• netqmail-1.05
• netqmail-1.05-smtpauth-tls.patch
• oversize-dns.patch
• big-concurrency.patch
• netqmail-maildir++ patch

For authentication, either use chkpassword or vpopmail.

Installation

• daemontools

I wanna find a way to install this that doesn't involve completely ignoring FHS.

mkdir /package
chmod 1755 /package
cd /package
wget http://cr.yp.to/daemontools/daemontools-0.76.tar.gz
tar -zxvf daemontools-0.76.tar.gz
mv admin/daemontools-0.76/ daemontools-0.76
rmdir admin/
wget http://www.qmail.org/moni.csi.hu/pub/glibc-2.3.1/daemontools-0.76.errno.patch
patch -p0 < daemontools-0.76.errno.patch
cd daemontools-0.76/
./package/install
cd ..
rm daemontools-0.76.tar.gz daemontools-0.76.errno.patch

• UCSPI-TCP

wget http://cr.yp.to/ucspi-tcp/ucspi-tcp-0.88.tar.gz
tar -zxvf ucspi-tcp-0.88.tar.gz
cd ucspi-tcp-0.88
wget http://www.qmail.org/moni.csi.hu/pub/glibc-2.3.1/ucspi-tcp-0.88.a_record.patch
patch -p1 < ucspi-tcp-0.88.a_record.patch
wget http://www.qmail.org/moni.csi.hu/pub/glibc-2.3.1/ucspi-tcp-0.88.errno.patch
patch -p1 < ucspi-tcp-0.88.errno.patch
wget http://www.qmail.org/moni.csi.hu/pub/glibc-2.3.1/ucspi-tcp-0.88.nobase.patch
patch -p1 < ucspi-tcp-0.88.nobase.patch
make
make setup check

• Build and install libspf-v1. A default build is fine.

tar jxvf libspf-1.0.0-p3.tar.bz2
cd libspf-1.0.0p3
./configure && make && make install

• Extract the SPP patches

tar zxvf qmail-spp.tar.gz

• Extract netqmail and prepare it.

tar zxvf netqmail-1.05.tar.gz
cd netqmail-1.05
./collate.sh
cd netqmail-1.05

• Apply the patches

patch -Np1 -i ../../netqmail-1.05-tls-smtpauth-20051423.patch
patch -Np1 -i ../../netqmail-maildir++.patch
patch -Np1 -i ../../qmail-1.03-oversize-dns.patch
patch -Np1 -i ../../big-concurrency.patch
patch -Np1 -i ../../qmail-spp-0.41/netqmail-spp-smtpauth-tls.diff

• Modify build-time configuration

echo "500" > conf-spawn
echo "199" > conf-split

• Create the users

pw groupadd nofiles
pw useradd alias -g nofiles -d /var/qmail/alias -s /sbin/nologin
pw useradd qmaild -g nofiles -d /var/qmail -s /sbin/nologin
pw useradd qmaill -g nofiles -d /var/qmail -s /sbin/nologin
pw useradd qmailp -g nofiles -d /var/qmail -s /sbin/nologin
pw groupadd qmail
pw useradd qmailq -g qmail -d /var/qmail -s /sbin/nologin
pw useradd qmailr -g qmail -d /var/qmail -s /sbin/nologin
pw useradd qmails -g qmail -d /var/qmail -s /sbin/nologin

• Build and install netqmail

make
make setup check
make cert
make tmprsadh
touch /var/qmail/control/smtpplugins

At this point, you probably need to pick which startup script you want from /var/qmail/boot and copy it to /var/qmail/rc

cp /var/qmail/boot/home /var/qmail/rc

Most configuration instructions pulled from http://sylvestre.ledru.info/howto/howto_qmail_vpopmail.php with intelligent interpretation and modification.

• Configure Daemontools

mkdir /service
chmod 755 /service
mkdir /var/qmail/supervise
chmod 755 /var/qmail/supervise

mkdir /var/qmail/supervise/qmail-smtpd
mkdir /var/qmail/supervise/qmail-smtpd/log
chmod +t /var/qmail/supervise/qmail-smtpd

mkdir /var/qmail/supervise/qmail-send
mkdir /var/qmail/supervise/qmail-send/log
chmod +t /var/qmail/supervise/qmail-send

mkdir /var/qmail/supervise/qmail-pop3d
mkdir /var/qmail/supervise/qmail-pop3d/log
chmod +t /var/qmail/supervise/qmail-pop3d

ln -s /var/qmail/supervise/* /service/

• Configure UCSPI-TCP

• Install the necessary plugins

Getting the various authentication schemes working was really a pain.

• pop3d/imapd auth - These run as root, so there's no need to modify permissions to run vchkpw
• smtpd auth - This runs as qmaild, so qmaild must be added to group vchkpw and tcpserver must -g vchkpw to run vchkpw
• vpopmail_check_user.sh - This runs as qmaild/vchkpw, and requires read access to vdominfo, vuserinfo, valias and vpopmail/domains.

In the end:

-rws--x--- vpopmail vchkpw ~vpopmail/bin/valias
-rws--x--- vpopmail vchkpw ~vpopmail/bin/vchkpw
-rws--x--- vpopmail vchkpw ~vpopmail/bin/vdominfo
-rws--x--- root     vchkpw ~vpopmail/bin/vuserinfo <-- ??? If owned vpopmail, 'Error: unable to setuid'
-rwxr-x--- vpopmail vchkpw ~vpopmail/domains/ <-- Children permissions similar.