Qpsmtpd/sme11

From SME Server
Jump to navigationJump to search
Warning.png Work in Progress:
this is a work in progress for the new SME 11 qpsmtpd configuration has marked this page as a Work in Progress. The contents off this page may be in flux, please have a look at this page history the to see list of changes.


qpsmtpd

qpsmtpd has been a core component of SME Server since SME 7, providing advanced spam fighting capabilities.

SME Server 9.2 introduced qpsmtpd 0.96 with several new capabilities. At the same time, smeserver-qpsmtpd has been updated to provide additional SME Server configuration options.

SME Server 10 start moving the services to systemd.

SME Server 11 will upgrade to qpsmtpd 1.0. At the same time, smeserver-qpsmtpd has been updated providing separate configuration for each running deamons and introducing a third running deamon now covering all usual SMTP ports 25 (qpsmtpd), 587 (new uqpsmtpd) and 465 (sqpsmtpd). Also SME11 provides a full systemd implementaiton of the services without runit. Softlimit has been increased from 50MB to 150MB.

Systemd Configuration

Some of the setting that were previously arranged using runit run script and multiple called script are all now present in systemd unit, with a dropin file to override default. The dropin file is templated

# /usr/lib/systemd/system/uqpsmtpd.service
[Unit]
Description=qpsmtpd on submission port
After=network.target network-online.target qpsmtpd.service

[Service]
Type=simple
LimitDATA=150000000
LimitSTACK=150000000
LimitMEMLOCK=150000000
Environment=PORT=587 INSTANCES=40 INSTANCES_PER_IP=5 QPSMTPD_CONFIG=/var/service/uqpsmtpd/config PATH=/var/qmail/bin:/bin:/usr/bin:/usr/local/bin TCPLOCALHOST=me
WorkingDirectory=/var/service/qpsmtpd/

ExecStartPre=/sbin/e-smith/service-status uqpsmtpd
ExecStartPre=/sbin/e-smith/systemd/qpsmtpd-init %N
ExecStart=/usr/bin/qpsmtpd-forkserver \
        -u qpsmtpd \
        -l 0.0.0.0 \
        -p $PORT \
        -c $INSTANCES \
        -m $INSTANCES_PER_IP
ExecReload=/bin/kill -HUP $MAINPID
Restart=always
RestartSec=20s
SyslogIdentifier=uqpsmtpd

[Install]
WantedBy=sme-server.target

# /usr/lib/systemd/system/uqpsmtpd.service.d/50koozali.conf
#------------------------------------------------------------
#              !!DO NOT MODIFY THIS FILE!!
# 
# Manual changes will be lost when this file is regenerated.
#
# Please read the developer's guide, which is available
# at http://www.contribs.org/development/
#
# Copyright (C) 1999-2006 Mitel Networks Corporation
#------------------------------------------------------------
[Service]
LimitDATA=150000000
LimitSTACK=150000000
LimitMEMLOCK=150000000
Environment=
Environment=QPSMTPD_CONFIG=/var/service/uqpsmtpd/config PORT=587 INSTANCES=10 INSTANCES_PER_IP=5 PATH=/var/qmail/bin:/bin:/usr/bin:/usr/local/bin TCPLOCALHOST=sme11.example.com

Services folders

/var/service/qpsmtpd
/var/service/qpsmtpd/config
/var/service/qpsmtpd/config/dkim
/var/service/qpsmtpd/config/peers
/var/service/qpsmtpd/peers
/var/service/qpsmtpd/ssl
/var/service/sqpsmtpd
/var/service/sqpsmtpd/supervise
/var/service/sqpsmtpd/config
/var/service/sqpsmtpd/config/dkim -> ../../qpsmtpd/config/dkim
/var/service/sqpsmtpd/config/peers
/var/service/sqpsmtpd/peers
/var/service/qpsmtpd/ssl -> ../qpsmtpd/ssl
/var/service/uqpsmtpd
/var/service/uqpsmtpd/config
/var/service/uqpsmtpd/config/dkim -> ../../qpsmtpd/config/dkim
/var/service/uqpsmtpd/config/peers
/var/service/uqpsmtpd/peers
/var/service/qpsmtpd/ssl -> ../qpsmtpd/ssl

Properties in configuration db

x: use the value of qpsmtpd key property for this key too.
property qpsmtpd sqpsmtpd uqpsmtpd information
Authentication enabled enabled enabled
Bcc disabled x x
BccMode cc x x
BccUser maillog x x
DNSBL disabled x x
Instances 40 10 10
InstancesPerIP 5 5 5
LogLevel 6 x x
MaxScannerSize 25000000 x x
MaximumDateOffset 0 x x
PatternsScan disabled x x
Proxy blocked x x
RBLList bl.spamcop.net,dnsbl-1.uceprotect.net,dnsbl-2.uceprotect.net,psbl.surriel.com,zen.spamhaus.org x x
RHSBL disabled x x
RelayRequiresAuth enabled x x
SoftLimit 150000000 150000000 150000000
SBLList multi.surbl.org,black.uribl.com,rhsbl.sorbs.net x x
TCPPort 25 465 587
TCPProxyPort 25 x x
TlsBeforeAuth 1 1 (hardcoded) 1 (hardcoded)
UBLList multi.surbl.org:8-16-64-128,black.uribl.com,rhsbl.sorbs.net x x
URIBL disabled x x
VirusScan enabled x x
access public public public
qplogsumm disabled x x
status enabled enabled enabled
tnef2mime enabled x x

Templates

Upgrade Considerations

A-Record DNSBL Services

Some DNSBL services - notably b.barracudacentral.org - provide their results using a DNS "A" record instead of a DNS TXT record. The dnsbl plugin requires these services to include a colon (":") in dnsbl_zones - however, SME used to use a colon the server separator in the configuration database. In order to support these A-Record DNSBL services, the separator for RBLList, SBLList, and the new UBLList is now a comma.
You can now configure b.barracudacentral.org using (note the single quotes):
config setprop qpsmtpd RBLList server1,server2,'b.barracudacentral.org:Blocked - see <http://bbl.barracudacentral.com/q.cgi?ip=%IP%>'

DKIM & DMARC

DKIM & DMARC are now supported natively by SME Server. To enable these you will need to configure appropriate DNS records in your public DNS server.
There are forum reports of problems for users who had DKIM enabled using the DKIM contrib.

URIBL

qpsmtpd now supports URIBL - the ability to block emails that contain known malicious URLs within the body of the email. This service is disabled by default.
Enable URIBL with the default services using:
config setprop qpsmtpd URIBL enabled
  signal-event email-update
Note: If your SME server is using high traffic external DNS forwarders like google (8.8.8.8 / 8.8.4.4), opendns (208.67.222.222 / 208.67.220.220), or any large ISP's (Cox, Comcast, Verizon), enabling URIBL may block all incoming email. This will only affect you if you have configured a DNS forwarder in server-manager -- a default SME server installation does its own direct DNS lookups and would not be affected unless you receive over 250,000 emails per day.
Read more at http://uribl.com/refused.shtml

"Naughty" plugin

SME Server is now using the 'naughty' plugin which allows early plugins like dnsbl, earlytalker, etc to indicate that the email should be rejected at a later point in the interaction. This allows the server to log extra information for denied emails. Specifically, emails denied by dnsbl will now show the sender and recipient email addresses in the qpsmtpd log

Plugins

Below is a list of all the plugins from /usr/share/qpsmtpd/plugins on a freshly updated SME 9.2 server.

+ New in SME 9.2
* Improved or changed in SME 9.2
U Unused (by default) in SME Server
E Extra / External Configuration Required
CW Contrib or Wiki page exists that uses this plugin
SM Can be configured using server-manager
DB Can be configured using db variables
AC Auto-configured by SME Server


Retrieved from "https://wiki.koozali.org/index.php?title=Qpsmtpd/sme11&oldid=42921"