Linux Admin Tech Forum

What is qmail?

qmail is an Internet Mail Transfer Agent (MTA) for UNIX-like operating systems. It's a drop-in replacement for the Sendmail system provided with UNIX operating systems. qmail uses the Simple Mail Transfer Protocol (SMTP) to exchange messages with MTA's on other systems.

3. Why use qmail?

Your operating system included an MTA, probably Postfix or Sendmail, so if you're reading this document you're probably looking for something different. Some of the advantages of qmail over vendor-provided MTA's include:

3. Security

qmail was designed for high security. Sendmail has a long history of serious security problems. When Sendmail was written, the Net was a much friendlier place. Everyone knew everyone else, and there was little need to design and code for high security. Today's Internet is a much more hostile environment for network servers.Sendmail's author, Eric Allman, and the current maintainer, Claus Assman, have done a good job of tightening up the program, but nothing short of a redesign can achieve true security.

3.2. Performance

qmail parallelizes mail delivery, performing up to 20 deliveries simultaneously, by default.

3.3. Reliability

Once qmail accepts a message, it guarantees that it won't be lost. qmail also supports a new mailbox format that works reliably even over NFS without locking.

3.4. Simplicity

qmail is smaller than any other equivalently-featured MTA.

Note: The official qmail web page, http://cr.yp.to/qmail.html covers the advantages of qmail more extensively.

4. History

qmail was written by Dan Bernstein (DJB), http://en.wikipedia.org/wiki/Daniel_J._Bernstein, a math professor now at the University of Illinois in Chicago. Dr. Bernstein is also well known for his work in the field of cryptography and for his lawsuit against the U.S. government regarding the publishing of encryption source code. Seehttp://en.wikipedia.org/wiki/Bernstein_v._United_States or http://cr.yp.to/export.html for information regarding the lawsuit.

The first public release of qmail, beta version 0.70, occurred on January, 24, 96. The first gamma release, 0.90, was on August, 96.

Version 0, the first general release, was announced on February, 20, 97. The current version, 03, was released on June, , 98.

The next release is expected to be an evaluation version of 2.0. Some of things that might appear in version 2 are covered at http://cr.yp.to/qmail/future.html.

5. Features

The qmail web page, http://cr.yp.to/qmail.html, has a comprehensive list of qmail's features. This section is based heavily on that list.

5. Setup

Automatic adaptation to your UNIX variant--no porting needed
Automatic per-host configuration
Quick installation--no big list of decisions to make

5.2. Security

Clear separation between addresses, files, and programs
Minimization of setuid code
Minimization of root code
Five-way trust partitioning--security in depth
Optional logging of one-way message hashes, entire message contents, etc. (See What is QUEUE_EXTRA? in Appendix E.)

5.3. Message construction

RFC 822 and RFC 23 compliant
Full support for address groups
Automatic conversion of old-style address lists to RFC 822 format
sendmail command for compatibility with current user agents
Header line length limited only by memory
Host masquerading (See defaulthost)
User masquerading (See MAILUSER and MAILHOST)
Automatic Mail-Followup-To creation (See QMAILMFTFILE)

5.4. SMTP service

RFC 82 RFC 23, RFC 5 RFC 52, and RFC 54 compliant
8-bit clean
RFC 93/ident/TAP callback--can help track spammers/forgers
Relay control--stops unauthorized relaying by outsiders
No interference between relay control and aliases
Automatic recognition of local IP addresses
Per-buffer timeouts
Hop counting
Parallelism limit (via ucspi-tcp)
Refusal of connections from known abusers (via ucspi-tcp)
Relaying and message rewriting for authorized clients
Optional RBL/ORBS support (via rblsmtpd)

5.5. Queue management

Instant handling of messages added to queue
Parallelism limits
Split queue directory--no slowdown when queue gets big
Quadratic retry schedule--old messages tried less often (see Appendix E)
Independent message retry schedules
Automatic safe queueing--no loss of mail if system crashes
Automatic per-recipient checkpointing
Automatic queue cleanups
Queue viewing (See qmail-qread)
Detailed delivery statistics (via qmailanalog)

5.6. Bounces

QSBMF bounce messages--both machine-readable and human-readable
HCMSSC support--language-independent RFC 93 error codes
Double bounces sent to postmaster

5.7. Routing by domain

Any number of names for local host (See locals)
Any number of virtual domains (See virtualdomains)
Domain wildcards (See virtualdomains)
Configurable "percent hack" support (See percenthack)
UUCP hook

5.8. SMTP delivery

RFC 82 RFC 974, and RFC 23 compliant
8-bit clean
Automatic downed host backoffs
Artificial routing--smarthost, localnet, mailertable (See smtproutes)
per-buffer timeouts
Passive SMTP queue--perfect for SLIP/PPP (via serialmail)
AutoTURN support (via serialmail)

5.9. Forwarding and mailing lists

Sendmail .forward compatibility (via dot-forward)
Hashed forwarding databases (via fastforward)
Sendmail /etc/aliases compatibility (via fastforward)
Address wildcards (See .qmail-default)
Mailing list owners--automatically divert bounces and vacation messages
VERPs--automatic recipient identification for mailing list bounces
Delivered-To--automatic loop prevention, even across hosts

5.. Local delivery

User-controlled address hierarchy--fred controls fred-anything mbox delivery
Reliable NFS delivery (See maildir)
User-controlled program delivery: procmail etc. (See qmail-command)
Optional new-mail notification (See qbiff)
Optional NRUDT return receipts (See qreceipt)
Conditional filtering (See condredirect and bouncesaying)

5.. POP3 service

RFC 39 compliant
UIDL support
TOP support
APOP hook
modular password checking (via checkpassword)

6. Related packages

qmail follows the classic UNIX philosophy that each tool should perform a single, well-defined function, and complex functions should be built by connecting a series of simple tools into a "pipeline". The alternative is to build more and more complex tools that re-invent much of the functionality of the simpler tools.

It's not surprising, then, that qmail itself doesn't do everything everyone might want it to do. Here, then, are some of the most popular add-ons written for qmail. Of course, many standard UNIX utilities can also be plugged into qmail.

dot-forward--a Sendmail .forward file compatibility add-on
fastforward--a Sendmail alias database compatibility add-on
ucspi-tcp--an inetd replacement
daemontools--a set of tools for managing daemons and their logs
qmailanalog--a set of qmail log file analysis tools
serialmail--tools for mailing over slow networks
mess822--tools for parsing Internet mail messages
ezmlm--a mailing list manager for qmail

7. Architecture

Appendix D covers qmail's functional and physical structure. In a nutshell, qmail consists of a series of programs (modules) that perform different tasks.

8. License

As of 2007--30, qmail 03 is in the public domain. See http://cr.yp.to/qmail/dist.html. This means that there are no legal limits to what you can do with it: you can copy it, give it away, sell it, modify it, rename it, or use pieces of it in copy-protected works, without any restrictions.

Other packages by Dan Bernstein, such as daemontools and ucspi-tcp, are copyrighted by the author, and are not distributed with a statement of user's rights. Inhttp://cr.yp.to/softwarelaw.html, he outlines what he thinks your rights are under U.S. copyright law. See also http://en.wikipedia.org/wiki/License-free_software.

9. Comparison with other MTA's

A book could be written about this topic, but it would be tedious reading. Here's a quick comparison of qmail with some of the most common UNIX MTA's.

MTA	Maturity	Security	Features	Performance	Sendmailish	Modular
qmail	medium	high	high	high	addons	yes
Sendmail	high	low	high	low	x	no
Postfix	medium	high	high	high	yes	yes
exim	medium	low	high	medium	yes	no
Courier	low	medium	high	medium	optional	yes

Sendmailish means the MTA behaves like Sendmail in some ways that would make a switch from Sendmail to the alternative MTA more user-transparent, such as the use of .forward files, /etc/aliases, and delivery to /var/spool/mail.

Jonathan de Boyne Pollard has reviews of many Unix MTAs at http://homepages.tesco.net/~J.deBoynePollard/Reviews/UnixMTSes/. Another detailed comparison is available at http://www.geocities.com/mailsoftware42/.

. Documentation

. man pages

The qmail distribution comes with a complete set of man pages. After installation, they're in /var/qmail/man. You'll probably need to add that directory to your MANPATHenvironment variable.

Shell	Command
Bourne (/bin/sh)	`MANPATH=$MANPATH:/var/qmail/man; export MANPATH`
bash, Korn	`export MANPATH=$MANPATH:/var/qmail/man`
C Shell	`setenv MANPATH $MANPATH:/var/qmail/man`

At this point, commands in the format "man name-of-qmail-man-page" should display the appropriate man page.

The man pages are also available on-line in HTML format from:

http://www.qmail.org/man/index.html

Note: The qmail man pages are loaded with information, but they require careful reading because they're written in a very dense, technical style. You might want to print off a set and read them through once to familiarize yourself with what's there and where it is. Very little information is repeated on multiple pages, so if you don't know where something is covered, it can be hard to find it.

.2. Docs

The qmail distribution includes a series of documents that are installed under /var/qmail/doc. They include:

FAQ: Frequently Asked Questions, with answers
INSTALL*: Installation documentation
PIC.*: Descriptions of how qmail performs key tasks. See the Architecture appendix for more information.
Various other installation-related documentation

These docs are also available on-line from:

http://www.qmail.org/man/index.html

.3. FAQs

There are two official FAQ (Frequently Asked Questions, with answers) documents:

/var/qmail/doc/FAQ, the plain text version, and
The web FAQ at http://cr.yp.to/qmail/faq.html.

The web FAQ is more complete.

.4. Books

.4. The qmail Handbook

Dave Sill, the author of Life with qmail, has written a qmail book for Apress (http://www.apress.com/). This book, The qmail Handbook, covers everything in this guide, but goes into much more detail and also covers a lot of new ground.

For more information, see http://www.apress.com/catalog/book/935402/. To order this book from my bookstore, in association with Amazon.com, seehttp://www.amazon.com/exec/obidos/ASIN/935402/davesill.

.4.2. Qmail Quickstarter: Install, Set Up and Run your own Email Server

Kyle Wheeler has written a qmail book for Packt (http://www.packtpub.com/). As the title suggests, this book is designed to help people new to qmail to set up a mail server.

To order this book from my bookstore, in association with Amazon.com, see http://www.amazon.com/exec/obidos/ASIN/4750/davesill.

.4.3. qmail

John Levine has written a qmail book for O'Reilly & Associates (http://www.oreilly.com/). See http://qmail.gurus.com/ for more info including the Table of Contents and a sample chapter.

To order this book from my bookstore, in association with Amazon.com, see http://www.amazon.com/exec/obidos/ASIN/65926285/davesill.

.4.4. Running qmail

Richard Blum has written Running qmail, which is published by Sams. This book has received mixed reviews on the qmail mailing list.

For more information or to order this book, see http://www.amazon.com/exec/obidos/ASIN/06723454/davesill.

.4.5. qmail: Yuksek Performansli E-Posta Sunucu

Ismail Yenigul, et al, have written a Turkish-language qmail book. See http://www.acikakademi.com/catalog/qmail/.

.5. List archives

The qmail e-mail mailing list, maintained by Dan Bernstein, is a valuable source of information. Web archives of the lists messages are kept at:

Most questions about qmail can be answered by searching the list archives first.

.6. Other Web Sites

http://cr.yp.to/qmail.html: the official qmail home page.
http://www.qmail.org: the unofficial qmail home page. Contains lots of information about add-ons and patches, and links to many good qmail web pages on other sites.
http://www.flounder.net/qmail/qmail-howto.html: Adam McKenna's HOWTO.

. Support

. Mailing lists

The following lists reside on list.cr.yp.to. In order to prevent harvesting of e-mail addresses by spammers, I'm avoiding the use of complete, valid addresses and "mailto" URL's.

The lists are managed by ezmlm, which uses different addresses to perform different functions:

listname@list.cr.yp.to: the submission address. Messages sent here go out to all members of the list. Do not send subscribe/unsubscribe requests here: they won't work, and they'll annoy the subscribers.
listname-help@list.cr.yp.to: the "help" address. Returns a list of command addresses and general usage information.
listname-subscribe: send a blank message here to subscribe.
listname-unsubscribe: send a blank message here to unsubscribe.

To specify a subscription/unsubscription address, say joe@example.com, send the message to:

listname-subscribe-joe=example.com@list.cr.yp.to.

. qmail

The main qmail mailing list. For discussion and questions/answers on most things related to qmail, except those with their own lists. Read Charles Cazabon's " Steps to qmail List Bliss" at http://pyropus.ca/personal/writings/-steps-to-qmail-list-bliss.html before posting. Also read the FAQs and search the list archives before posting a question. When you ask questions, please try to include sufficient details to make it possible for people to respond:

What did you do? What's your configuration? Include qmail-showctl output if you're not sure what's important. What action did you take? If this is a new installation, tell how you installed qmail.
What did you expect to happen? What was the outcome you were trying to achieve? Don't assume the reader can guess.
What did happen? Describe the actual result. Include log file clippings and copies of messages, with headers.

Note: The qmail list uses a utility called qsecretary to verify that messages posted to the list are not spam. Each message posted to the list will result in an e-mail confirmation request from qsecretary. Read the message and follow the directions to confirm your message--usually just replying to the qsecretary message will do the trick. Regular list posters often automate this process using autoresponders like Charles Cazabon's pymsgauth, available fromhttp://pyropus.ca/software/pymsgauth/. pymsgauth verifies that message sent to the qmail list really came from you, so it won't automatically confirm forged messages sent to the list in your name.

.2. qmailannounce

The qmail announcement mailing list. New releases are announced here. There's no submission address: it's a read-only list.

.3. serialmail

For discussion of the serial mail package.

.4. ezmlm

For discussion of the ezmlm mailing list manager.

.2. Consultants

See http://www.qmail.org/top.html#paidsup for a list of commercial support providers.

.3. FAQTS Knowledgebase

A database of qmail-related questions and answers is available at http://qmail.faqts.com/. If you have a question that the FAQ doesn't answer, try searching this knowledgebase. It's especially good at answering "how to" questions

INSTALLING TOMCAT

We’ll need the tomcat6 package to run Tomcat’s core components, as well as the tomcat6-admin-webapps package since we’ll use Tomcat’s Manager Application for application deployments, either thru Maven’s Cargo component or thru the web-browser. Since we’ll compile the authbind application from its sources, we’ll also need gcc, the GNU C Compiler package which contains all components to build an application on Linux. To install all this, grab a terminal and execute:

yum -y install tomcat6 tomcat6-admin-webapps gcc

Usually a web server is started automatically on system boot. This can be achieved by

/sbin/chkconfig --levels 235 tomcat6 on

LISTENING ON PORTS<1024 IN LINUX WITH AN UNPRIVILEGED USER

There are more options to achieve this:
-    By using authbind which authorizes specific users to specific ports under 1024
-    By using Jsvc, a set of libraries and applications for making Java applications run on UNIX more easily (Jsvc allows Tomcat application to perform some privileged operations as root (e.g. bind to a port < 1024), and then switch identity to a non-privileged user.)
-    By configuring iptables to re-route the packets from port 80 to 8080
This article describes the authbind approach. But first, let's tell Tomcat to listen on port 80 instead of 8080.

CHANGING TOMCAT'S DEFAULT HTTP PORT

The default HTTP port is defined in /etc/tomcat6/server.xml:

We need to change this default port to 80 in server.xml. Either replace by hand, or automatically: to replace the occurrences of port=”8080” to port=”80”, execute the following script:

sed -i 's/port\=\"8080\"/port\=\"80\"/' /etc/tomcat6/server.xml

The same for port 8443, which will be replaced with port 443:

sed -i 's/port\=\"8443\"/port\=\"443\"/' /etc/tomcat6/server.xml

We'll start Tomcat with authbind. This can be achieved by changing Tomcat's init-script in /etc/init.d, replacing the line

TOMCAT_SCRIPT="/usr/sbin/tomcat6"

with

TOMCAT_SCRIPT="exec authbind --deep /usr/sbin/tomcat6"

Again, it can be automated like this:

sed -i  's/TOMCAT_SCRIPT=\"\/usr\/sbin\/tomcat6\"/TOMCAT_SCRIPT=\"exec authbind  --deep \/usr\/sbin\/tomcat6\"/' /etc/init.d/tomcat6

We have to tell Tomcat to use the IPv4 stack by default. This can be done by appending the line CATALINA_OPTS="-Djava.net.preferIPv4Stack=true" to /etc/tomcat6/tomcat6.conf:

sed -i '$ a\CATALINA_OPTS=\"-Djava\.net\.preferIPv4Stack=true\"\n' /etc/tomcat6/tomcat6.conf

INSTALLING AND CONFIGURING AUTHBIND

Authbind is installed the usual way, with the help of gcc and make. Please note: For this step to succeed, the gcc package is needed. It is already installed with the command yum install gcc earlier, when tomcat was installed.

cd ~
http://ftp.debian.org/debian/pool/main/a/authbind/authbind_1.2.0.tar.gz
tar xzf authbind_1.2.0.tar.gz
cd authbind_1.2.0
make
make install

Authbind is configured with some special files, for which we can assign our arbitrary permissions for the users we want to give access to. Since Tomcat is running with the Tomcat user, we'll tell authbind to allow connections to the HTTP port 80 and the HTTPS port 443 for this account:

touch /etc/authbind/byport/80
chmod 500 /etc/authbind/byport/80
chown tomcat /etc/authbind/byport/80
touch /etc/authbind/byport/443
chmod 500 /etc/authbind/byport/443
chown tomcat /etc/authbind/byport/443

For the changes to take effect, Tomcat has to be restarted:

/etc/init.d/tomcat6 restart

Wednesday, February 24, 2016

Life with qmail - document