36d7678ec9
From https://www.fehcom.de/qmail/smtpauth.html#PATCHES Generic SMTP authentication for qmail-smtpd and qmail-remote. Complies to RFC 3848 and RFC 4409. * Provides now CRAM-MD5 authentication for qmail-remote as well. * Fine tuning of SMTPAUTH annoncements for qmail-smtpd and SUBMISSION support. * Sender based authentication according to 'Mail From:' and authenticated smarthost relaying for qmail-remote. * Fixed bug (0.8.2): qmail-smtpd secretly allows auth even when disabled! (tx Chris P.) * Fixed AMD64 bug for MD5 (0.8.3) and small others (tx Alan P.)
263 lines
5.6 KiB
Groff
263 lines
5.6 KiB
Groff
.TH qmail-smtpd 8
|
|
.SH NAME
|
|
qmail-smtpd \- receive mail via SMTP
|
|
.SH SYNOPSIS
|
|
.B qmail-smtpd
|
|
.SH DESCRIPTION
|
|
.B qmail-smtpd
|
|
receives mail messages via the Simple Mail Transfer Protocol (SMTP)
|
|
and invokes
|
|
.B qmail-queue
|
|
to deposit them into the outgoing queue.
|
|
.B qmail-smtpd
|
|
must be supplied several environment variables;
|
|
see
|
|
.BR tcp-environ(5) .
|
|
|
|
.B qmail-smtpd
|
|
is responsible for counting hops.
|
|
It rejects any message with 100 or more
|
|
.B Received
|
|
or
|
|
.B Delivered-To
|
|
header fields.
|
|
|
|
.B qmail-smtpd
|
|
supports ESMTP, including the 8BITMIME, DATA, PIPELINING, SIZE, and AUTH options.
|
|
.B qmail-smtpd
|
|
includes a \'MAIL FROM:\' parameter parser and obeys \'Auth\' and \'Size\' advertisements.
|
|
.B qmail-smtpd
|
|
can accept LOGIN, PLAIN, and CRAM-MD5 AUTH types. It invokes
|
|
.IR checkprogram ,
|
|
which reads on file descriptor 3 the username, a 0 byte, the password
|
|
or CRAM-MD5 digest/response derived from the SMTP client,
|
|
another 0 byte, a CRAM-MD5 challenge (if applicable to the AUTH type),
|
|
and a final 0 byte.
|
|
.I checkprogram
|
|
invokes
|
|
.I subprogram
|
|
upon successful authentication, which should in turn return 0 to
|
|
.BR qmail-smtpd ,
|
|
effectively setting the environment variables $RELAYCLIENT and $TCPREMOTEINFO
|
|
(any supplied value replaced with the authenticated username).
|
|
.B qmail-smtpd
|
|
will reject the authentication attempt if it receives a nonzero return
|
|
value from
|
|
.I checkprogram
|
|
or
|
|
.IR subprogram .
|
|
|
|
.SH TRANSPARENCY
|
|
.B qmail-smtpd
|
|
converts the SMTP newline convention into the UNIX newline convention
|
|
by converting CR LF into LF.
|
|
It returns a temporary error and drops the connection on bare LFs;
|
|
see
|
|
.BR http://pobox.com/~djb/docs/smtplf.html .
|
|
|
|
.B qmail-smtpd
|
|
accepts messages that contain long lines or non-ASCII characters,
|
|
even though such messages violate the SMTP protocol.
|
|
.SH "CONTROL FILES"
|
|
.TP 5
|
|
.I badmailfrom
|
|
Unacceptable envelope sender addresses.
|
|
.B qmail-smtpd
|
|
will reject every recipient address for a message
|
|
if the envelope sender address is listed in
|
|
.IR badmailfrom .
|
|
A line in
|
|
.I badmailfrom
|
|
may be of the form
|
|
.BR @\fIhost ,
|
|
meaning every address at
|
|
.IR host .
|
|
.TP 5
|
|
.I databytes
|
|
Maximum number of bytes allowed in a message,
|
|
or 0 for no limit.
|
|
Default: 0.
|
|
If a message exceeds this limit,
|
|
.B qmail-smtpd
|
|
returns a permanent error code to the client;
|
|
in contrast, if
|
|
the disk is full or
|
|
.B qmail-smtpd
|
|
hits a resource limit,
|
|
.B qmail-smtpd
|
|
returns a temporary error code.
|
|
|
|
.I databytes
|
|
counts bytes as stored on disk, not as transmitted through the network.
|
|
It does not count the
|
|
.B qmail-smtpd
|
|
Received line, the
|
|
.B qmail-queue
|
|
Received line, or the envelope.
|
|
|
|
If the environment variable
|
|
.B DATABYTES
|
|
is set, it overrides
|
|
.IR databytes .
|
|
.TP 5
|
|
.I localiphost
|
|
Replacement host name for local IP addresses.
|
|
Default:
|
|
.IR me ,
|
|
if that is supplied.
|
|
.B qmail-smtpd
|
|
is responsible for recognizing dotted-decimal addresses for the
|
|
current host.
|
|
When it sees a recipient address of the form
|
|
.IR box@[d.d.d.d] ,
|
|
where
|
|
.I d.d.d.d
|
|
is a local IP address,
|
|
it replaces
|
|
.IR [d.d.d.d]
|
|
with
|
|
.IR localiphost .
|
|
This is done before
|
|
.IR rcpthosts .
|
|
.TP 5
|
|
.I morercpthosts
|
|
Extra allowed RCPT domains.
|
|
If
|
|
.I rcpthosts
|
|
and
|
|
.I morercpthosts
|
|
both exist,
|
|
.I morercpthosts
|
|
is effectively appended to
|
|
.IR rcpthosts .
|
|
|
|
You must run
|
|
.B qmail-newmrh
|
|
whenever
|
|
.I morercpthosts
|
|
changes.
|
|
|
|
Rule of thumb for large sites:
|
|
Put your 50 most commonly used domains into
|
|
.IR rcpthosts ,
|
|
and the rest into
|
|
.IR morercpthosts .
|
|
.TP 5
|
|
.I rcpthosts
|
|
Allowed RCPT domains.
|
|
If
|
|
.I rcpthosts
|
|
is supplied,
|
|
.B qmail-smtpd
|
|
will reject
|
|
any envelope recipient address with a domain not listed in
|
|
.IR rcpthosts .
|
|
|
|
Exception:
|
|
If the environment variable
|
|
.B RELAYCLIENT
|
|
is set,
|
|
.B qmail-smtpd
|
|
will ignore
|
|
.IR rcpthosts ,
|
|
and will append the value of
|
|
.B RELAYCLIENT
|
|
to each incoming recipient address.
|
|
|
|
.I rcpthosts
|
|
may include wildcards:
|
|
|
|
.EX
|
|
heaven.af.mil
|
|
.heaven.af.mil
|
|
.EE
|
|
|
|
Envelope recipient addresses without @ signs are
|
|
always allowed through.
|
|
.TP 5
|
|
.I smtpgreeting
|
|
SMTP greeting message.
|
|
Default:
|
|
.IR me ,
|
|
if that is supplied;
|
|
otherwise
|
|
.B qmail-smtpd
|
|
will refuse to run.
|
|
The first word of
|
|
.I smtpgreeting
|
|
should be the current host's name.
|
|
.TP 5
|
|
.I timeoutsmtpd
|
|
Number of seconds
|
|
.B qmail-smtpd
|
|
will wait for each new buffer of data from the remote SMTP client.
|
|
Default: 1200.
|
|
|
|
.SH "ENVIRONMENT VARIABLES READ"
|
|
Environment variables may be defined globally in the
|
|
.B qmail-smtpd
|
|
startup script and/or individually as part of the
|
|
.B tcpserver's
|
|
cdb database.
|
|
The environment variables may be quoted ("variable", or 'variable') and
|
|
in case of global use, have to be exported.
|
|
.B qmail-smtpd
|
|
supports the following legacy environment variables, typically
|
|
provided by
|
|
.B tcpserver
|
|
or
|
|
.B sslserver
|
|
or
|
|
.BR tcp-env :
|
|
.IR TCPREMOTEIP ,
|
|
.IR TCPREMOTEHOST
|
|
.IR TCPREMOTEINFO
|
|
and
|
|
.IR TCPLOCALPORT
|
|
as well as
|
|
.IR RELAYCLIENT .
|
|
|
|
.B qmail-smtpd
|
|
may use the following environment variables for SMTP authentication:
|
|
.TP 5
|
|
.IR SMTPAUTH
|
|
is used to enable SMTP Authentication for the AUTH types
|
|
LOGIN and PLAIN.
|
|
In case
|
|
.TP 5
|
|
.IR SMTPAUTH='+cram'
|
|
is defined,
|
|
.B qmail-smtpd
|
|
honors LOGIN, PLAIN, and additionally CRAM-MD5 authentication.
|
|
Simply
|
|
.TP 5
|
|
.IR SMTPAUTH='cram'
|
|
restricts authentication just to CRAM-MD5.
|
|
If however
|
|
.TP 5
|
|
.IR SMTPAUTH='!'
|
|
starts with an exclamation mark, AUTH is required.
|
|
You can enforce 'Submission' using this option
|
|
and binding
|
|
.B qmail-smtpd
|
|
to the SUBMISSION port \'587'\.
|
|
In particular,
|
|
.TP 5
|
|
.IR SMTPAUTH='!cram'
|
|
may be useful.
|
|
In opposite, if
|
|
.TP 5
|
|
.IR SMTPAUTH='-'
|
|
starts with a dash, AUTH is disabled for particular
|
|
connections.
|
|
|
|
Note: The use of 'cram' requires a CRAM-MD5 enabled PAM.
|
|
|
|
.SH "SEE ALSO"
|
|
tcp-env(1),
|
|
tcp-environ(5),
|
|
qmail-control(5),
|
|
qmail-inject(8),
|
|
qmail-newmrh(8),
|
|
qmail-queue(8),
|
|
qmail-remote(8)
|