Difference between revisions of "Qpsmtpd/sme11"

From SME Server
Jump to navigationJump to search
Line 257: Line 257:
 
|}
 
|}
  
−
==Templates==
+
==Config files==
 +
{| class="wikitable"
 +
|+template: is templated individually ; metadata: use another template via a metadata file.
 +
!config file
 +
!qpsmtpd
 +
!sqpsmtpd
 +
!uqpsmtpd
 +
!plugin
 +
!related properties
 +
!information
 +
|-
 +
|badhelo
 +
|template
 +
|metadata
 +
|metadata
 +
|helo
 +
|
 +
|
 +
|-
 +
|badmailfrom
 +
|template
 +
|metadata
 +
|metadata
 +
|badmailfrom
 +
badmailfromto
 +
 
 +
badrcptto
 +
|
 +
|
 +
|-
 +
|badrcptto
 +
|template
 +
|metadata
 +
|metadata
 +
|badrcptto
 +
check_goodrcptto
 +
|
 +
|fixed output
 +
|-
 +
|badrcptto_ext
 +
|template
 +
|metadata
 +
|metadata
 +
|badrcptto
 +
|
 +
|hide emails  when db accounts setprop ACCOUNT Visible internal
 +
|-
 +
|dkim
 +
|folder
 +
|folder
 +
|folder
 +
|
 +
|
 +
|not in use
 +
|-
 +
|dnsbl_allow
 +
|template
 +
|metadata
 +
|metadata
 +
|dnsbl
 +
|
 +
|
 +
|-
 +
|dnsbl_zones
 +
|template
 +
|metadata
 +
|metadata
 +
|dnsbl
 +
per_user_config
 +
|$qpsmtpd{RBLList}
 +
|
 +
|-
 +
|forcespamcheck
 +
|template
 +
|metadata
 +
|metadata
 +
|forcespamcheck
 +
|
 +
|empty file, plugin set in peers
 +
|-
 +
|goodrcptto
 +
|template
 +
|metadata
 +
|metadata
 +
|check_goodrcptto
 +
|
 +
|
 +
|-
 +
|invalid_resolvable_fromhost
 +
|template
 +
|metadata
 +
|metadata
 +
|resolvable_fromhost
 +
|
 +
|fixed output
 +
|-
 +
|IP
 +
|template
 +
|metadata
 +
|metadata
 +
|
 +
|
 +
|IP for tcpserver to bind to , 0 for all, fixed to 0
 +
|-
 +
|loglevel
 +
|template
 +
|metadata
 +
|metadata
 +
|logterse (...)
 +
|$qpsmtpd{LogLevel}
 +
|
 +
|-
 +
|memory_threshold
 +
|template
 +
|metadata
 +
|metadata
 +
|
 +
|
 +
|fixed to 1
 +
|-
 +
|norelayclients
 +
|template
 +
|metadata
 +
|metadata
 +
|relay
 +
|
 +
|$GatewayIP if set
 +
|-
 +
|peers
 +
|folder
 +
|folder
 +
|folder
 +
|peers
 +
|
 +
|see peers section
 +
|-
 +
|plugin_dirs
 +
|template
 +
|metadata
 +
|metadata
 +
|
 +
|
 +
|fixed output /usr/share/qpsmtpd/plugins
 +
|-
 +
|plugins
 +
|x
 +
|x
 +
|x
 +
|x
 +
|x
 +
|has a copy of peers fragments, hidden by metadata
 +
|-
 +
|relayclients
 +
|template
 +
|'''metadata : to remove?'''
 +
|'''metadata: to remove?'''
 +
|greylisting
 +
relay
 +
 
 +
spamassassin
 +
|
 +
|IP allowed for relay without auth
 +
|-
 +
|rhsbl_zones
 +
|template
 +
|metadata
 +
|metadata
 +
|rhsbl
 +
|$qpsmtpd{SBLList}
 +
|
 +
|-
 +
|signatures_patterns
 +
|template
 +
|metadata
 +
|metadata
 +
|
 +
|
 +
|uses db mailpatterns
 +
|-
 +
|smtpgreeting
 +
|template
 +
|metadata
 +
|metadata
 +
|
 +
|$qpsmtpd{Greeting}
 +
|default to host.domain
 +
|-
 +
|spool_dir
 +
|template
 +
|metadata
 +
|metadata
 +
|
 +
|
 +
|fixed output /var/spool/qpsmtpd
 +
|-
 +
|spool_perms
 +
|x
 +
|x
 +
|x
 +
|
 +
|
 +
|file, do not alter
 +
|-
 +
|subject_prefix
 +
|template
 +
|metadata
 +
|metadata
 +
|
 +
|$spamassassin{Subject}
 +
|
 +
|-
 +
|timeout
 +
|template
 +
|metadata
 +
|metadata
 +
|
 +
|$qpsmtpd{timeout}
 +
|120 as default
 +
|-
 +
|timeoutsmtpd
 +
|template
 +
|metadata
 +
|metadata
 +
|
 +
|$qpsmtpd{timeoutsmtpd}
 +
|120 as default
 +
|-
 +
|tls_before_auth
 +
|template
 +
|template
 +
|template
 +
|
 +
|$qpsmtpd{TlsBeforeAuth}
 +
|hardcoded for uqpsmtpd and sqpsmtpd
 +
|-
 +
|tls_ciphers
 +
|template
 +
|template
 +
|template
 +
|tls
 +
|$qpsmtpd{TlsBeforeAuth}
 +
$sqpsmtpd{TlsBeforeAuth}
 +
 
 +
$uqpsmtpd{TlsBeforeAuth}
 +
|sqpsmtpd default to uqpsmtpd
 +
global default is $modSSL{CipherSuite} || 'ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:HIGH@STRENGTH:!SSLv2:!ADH:!aNULL:!MD5:!RC4'
 +
|-
 +
|tls_protocols
 +
|template
 +
|template
 +
|template
 +
|tls
 +
|SSLv2, SLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
 +
|TLS1.2 minimum for uqpsmtpd and sqpsmtpd
 +
TLS1.1 minimum for qpsmtpd
 +
 
 +
properties are set individually for each service
 +
|-
 +
|uribl_zones
 +
|template
 +
|metadata
 +
|metadata
 +
|
 +
|$qpsmtpd{UBLList}
 +
|
 +
|}
 +
 
 
==Upgrade Considerations==
 
==Upgrade Considerations==
 
===A-Record DNSBL Services===
 
===A-Record DNSBL Services===

Revision as of 16:24, 26 April 2024

Warning.png Work in Progress:
this is a work in progress for the new SME 11 qpsmtpd configuration has marked this page as a Work in Progress. The contents off this page may be in flux, please have a look at this page history the to see list of changes.


qpsmtpd

qpsmtpd has been a core component of SME Server since SME 7, providing advanced spam fighting capabilities.

SME Server 9.2 introduced qpsmtpd 0.96 with several new capabilities. At the same time, smeserver-qpsmtpd has been updated to provide additional SME Server configuration options.

SME Server 10 start moving the services to systemd.

SME Server 11 will upgrade to qpsmtpd 1.0. At the same time, smeserver-qpsmtpd has been updated providing separate configuration for each running deamons and introducing a third running deamon now covering all usual SMTP ports 25 (qpsmtpd), 587 (new uqpsmtpd) and 465 (sqpsmtpd). Also SME11 provides a full systemd implementaiton of the services without runit. Softlimit has been increased from 50MB to 150MB.

Systemd Configuration

Some of the setting that were previously arranged using runit run script and multiple called script are all now present in systemd unit, with a dropin file to override default. The dropin file is templated

# /usr/lib/systemd/system/uqpsmtpd.service
[Unit]
Description=qpsmtpd on submission port
After=network.target network-online.target qpsmtpd.service

[Service]
Type=simple
LimitDATA=150000000
LimitSTACK=150000000
LimitMEMLOCK=150000000
Environment=PORT=587 INSTANCES=40 INSTANCES_PER_IP=5 QPSMTPD_CONFIG=/var/service/uqpsmtpd/config PATH=/var/qmail/bin:/bin:/usr/bin:/usr/local/bin TCPLOCALHOST=me
WorkingDirectory=/var/service/qpsmtpd/

ExecStartPre=/sbin/e-smith/service-status uqpsmtpd
ExecStartPre=/sbin/e-smith/systemd/qpsmtpd-init %N
ExecStart=/usr/bin/qpsmtpd-forkserver \
        -u qpsmtpd \
        -l 0.0.0.0 \
        -p $PORT \
        -c $INSTANCES \
        -m $INSTANCES_PER_IP
ExecReload=/bin/kill -HUP $MAINPID
Restart=always
RestartSec=20s
SyslogIdentifier=uqpsmtpd

[Install]
WantedBy=sme-server.target

# /usr/lib/systemd/system/uqpsmtpd.service.d/50koozali.conf
#------------------------------------------------------------
#              !!DO NOT MODIFY THIS FILE!!
# 
# Manual changes will be lost when this file is regenerated.
#
# Please read the developer's guide, which is available
# at http://www.contribs.org/development/
#
# Copyright (C) 1999-2006 Mitel Networks Corporation
#------------------------------------------------------------
[Service]
LimitDATA=150000000
LimitSTACK=150000000
LimitMEMLOCK=150000000
Environment=
Environment=QPSMTPD_CONFIG=/var/service/uqpsmtpd/config PORT=587 INSTANCES=10 INSTANCES_PER_IP=5 PATH=/var/qmail/bin:/bin:/usr/bin:/usr/local/bin TCPLOCALHOST=sme11.example.com

Services folders

/var/service/qpsmtpd
/var/service/qpsmtpd/config
/var/service/qpsmtpd/config/dkim
/var/service/qpsmtpd/config/peers
/var/service/qpsmtpd/peers
/var/service/qpsmtpd/ssl
/var/service/sqpsmtpd
/var/service/sqpsmtpd/supervise
/var/service/sqpsmtpd/config
/var/service/sqpsmtpd/config/dkim -> ../../qpsmtpd/config/dkim
/var/service/sqpsmtpd/config/peers
/var/service/sqpsmtpd/peers
/var/service/qpsmtpd/ssl -> ../qpsmtpd/ssl
/var/service/uqpsmtpd
/var/service/uqpsmtpd/config
/var/service/uqpsmtpd/config/dkim -> ../../qpsmtpd/config/dkim
/var/service/uqpsmtpd/config/peers
/var/service/uqpsmtpd/peers
/var/service/qpsmtpd/ssl -> ../qpsmtpd/ssl

Properties in configuration db

x: use the value of qpsmtpd key property for this key too.
property qpsmtpd sqpsmtpd uqpsmtpd information
Authentication enabled enabled enabled
Bcc disabled x x
BccMode cc x x
BccUser maillog x x
DNSBL disabled x x
Instances 40 10 10
InstancesPerIP 5 5 5
LogLevel 6 x x
MaxScannerSize 25000000 x x
MaximumDateOffset 0 x x
PatternsScan disabled x x
Proxy blocked x x
RBLList bl.spamcop.net,dnsbl-1.uceprotect.net,dnsbl-2.uceprotect.net,psbl.surriel.com,zen.spamhaus.org x x
RHSBL disabled x x
RelayRequiresAuth enabled x x
SoftLimit 150000000 150000000 150000000
SBLList multi.surbl.org,black.uribl.com,rhsbl.sorbs.net x x
TCPPort 25 465 587
TCPProxyPort 25 x x
TlsBeforeAuth 1 1 (hardcoded) 1 (hardcoded)
UBLList multi.surbl.org:8-16-64-128,black.uribl.com,rhsbl.sorbs.net x x
URIBL disabled x x
VirusScan enabled x x
access public public public
qplogsumm disabled x x
status enabled enabled enabled
tnef2mime enabled x x

Config files

template: is templated individually ; metadata: use another template via a metadata file.
config file qpsmtpd sqpsmtpd uqpsmtpd plugin related properties information
badhelo template metadata metadata helo
badmailfrom template metadata metadata badmailfrom

badmailfromto

badrcptto

badrcptto template metadata metadata badrcptto

check_goodrcptto

fixed output
badrcptto_ext template metadata metadata badrcptto hide emails when db accounts setprop ACCOUNT Visible internal
dkim folder folder folder not in use
dnsbl_allow template metadata metadata dnsbl
dnsbl_zones template metadata metadata dnsbl

per_user_config

$qpsmtpd{RBLList}
forcespamcheck template metadata metadata forcespamcheck empty file, plugin set in peers
goodrcptto template metadata metadata check_goodrcptto
invalid_resolvable_fromhost template metadata metadata resolvable_fromhost fixed output
IP template metadata metadata IP for tcpserver to bind to , 0 for all, fixed to 0
loglevel template metadata metadata logterse (...) $qpsmtpd{LogLevel}
memory_threshold template metadata metadata fixed to 1
norelayclients template metadata metadata relay $GatewayIP if set
peers folder folder folder peers see peers section
plugin_dirs template metadata metadata fixed output /usr/share/qpsmtpd/plugins
plugins x x x x x has a copy of peers fragments, hidden by metadata
relayclients template metadata : to remove? metadata: to remove? greylisting

relay

spamassassin

IP allowed for relay without auth
rhsbl_zones template metadata metadata rhsbl $qpsmtpd{SBLList}
signatures_patterns template metadata metadata uses db mailpatterns
smtpgreeting template metadata metadata $qpsmtpd{Greeting} default to host.domain
spool_dir template metadata metadata fixed output /var/spool/qpsmtpd
spool_perms x x x file, do not alter
subject_prefix template metadata metadata $spamassassin{Subject}
timeout template metadata metadata $qpsmtpd{timeout} 120 as default
timeoutsmtpd template metadata metadata $qpsmtpd{timeoutsmtpd} 120 as default
tls_before_auth template template template $qpsmtpd{TlsBeforeAuth} hardcoded for uqpsmtpd and sqpsmtpd
tls_ciphers template template template tls $qpsmtpd{TlsBeforeAuth}

$sqpsmtpd{TlsBeforeAuth}

$uqpsmtpd{TlsBeforeAuth}

sqpsmtpd default to uqpsmtpd

global default is $modSSL{CipherSuite} || 'ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:HIGH@STRENGTH:!SSLv2:!ADH:!aNULL:!MD5:!RC4'

tls_protocols template template template tls SSLv2, SLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3 TLS1.2 minimum for uqpsmtpd and sqpsmtpd

TLS1.1 minimum for qpsmtpd

properties are set individually for each service

uribl_zones template metadata metadata $qpsmtpd{UBLList}

Upgrade Considerations

A-Record DNSBL Services

Some DNSBL services - notably b.barracudacentral.org - provide their results using a DNS "A" record instead of a DNS TXT record. The dnsbl plugin requires these services to include a colon (":") in dnsbl_zones - however, SME used to use a colon the server separator in the configuration database. In order to support these A-Record DNSBL services, the separator for RBLList, SBLList, and the new UBLList is now a comma.
You can now configure b.barracudacentral.org using (note the single quotes):
config setprop qpsmtpd RBLList server1,server2,'b.barracudacentral.org:Blocked - see <http://bbl.barracudacentral.com/q.cgi?ip=%IP%>'

DKIM & DMARC

DKIM & DMARC are now supported natively by SME Server. To enable these you will need to configure appropriate DNS records in your public DNS server.
There are forum reports of problems for users who had DKIM enabled using the DKIM contrib.

URIBL

qpsmtpd now supports URIBL - the ability to block emails that contain known malicious URLs within the body of the email. This service is disabled by default.
Enable URIBL with the default services using:
config setprop qpsmtpd URIBL enabled
  signal-event email-update
Note: If your SME server is using high traffic external DNS forwarders like google (8.8.8.8 / 8.8.4.4), opendns (208.67.222.222 / 208.67.220.220), or any large ISP's (Cox, Comcast, Verizon), enabling URIBL may block all incoming email. This will only affect you if you have configured a DNS forwarder in server-manager -- a default SME server installation does its own direct DNS lookups and would not be affected unless you receive over 250,000 emails per day.
Read more at http://uribl.com/refused.shtml

"Naughty" plugin

SME Server is now using the 'naughty' plugin which allows early plugins like dnsbl, earlytalker, etc to indicate that the email should be rejected at a later point in the interaction. This allows the server to log extra information for denied emails. Specifically, emails denied by dnsbl will now show the sender and recipient email addresses in the qpsmtpd log

Plugins

Below is a list of all the plugins from /usr/share/qpsmtpd/plugins on a freshly updated SME 9.2 server.

+ New in SME 9.2
* Improved or changed in SME 9.2
U Unused (by default) in SME Server
E Extra / External Configuration Required
CW Contrib or Wiki page exists that uses this plugin
SM Can be configured using server-manager
DB Can be configured using db variables
AC Auto-configured by SME Server


Retrieved from "https://wiki.koozali.org/index.php?title=Qpsmtpd/sme11&oldid=42922"