| View previous topic :: View next topic |
| Author |
Message |
trellis
n00b
Joined: 05 Feb 2005
Posts: 22
Location: UK
|
 Posted: Thu Feb 10, 2005 7:55 pm Post subject: qmail question - allowing relay from local LAN? [SOLVED] |
 |
|
I'm a complete qmail newbie, but I've managed to get qmail working, the only problem is I want to allow relaying from addresses on my local lan.
I have added the necessary lines to /etc/tcp.smtp, e.g.:
x.x.x.x:allow,RELAYCLIENT="",RBLSMTPD=""
Rebuilt the database (the comment at the top of tcp.smtp explaining how to do this is totally wrong, BTW) , and restarted svscan, and even rebooted the entire box!
Still getting the error that "host is not in rcpthosts" when trying to relay.
What have I screwed up?
Last edited by trellis on Wed Feb 16, 2005 10:19 pm; edited 1 time in total |
|
| Back to top |
|
 |
cselkirk
Apprentice
Joined: 09 Jun 2003
Posts: 199
Location: NL
|
| Posted: Sat Feb 12, 2005 1:35 pm Post subject: |
|
|
When you say addresses do you mean all address on the subnet? I see in the above rules you have "x.x.x.x:allow" which would define one host, the "x.x.x.x".
If this is not what you want then the following maybe what you are looking for:
| Code: | | 192.168.:allow,RELAYCLIENT="" |
Similarly for whatever class subnet you happen to be using.
Also, you say the comment at the top of tcp.smtp is wrong, I can't verify that as my tcp.smtp didn't come with a comment, anyhow, incase this happens to be something you are running foul of here is what it should be:
| Code: | | tcprules tcp.smtp.cdb tcp.smtp.tmp < tcp.smtp |
Similarly for other *tcp.${SERVICE}, and restart svscan.
HTH
_________________
cn=cselkirk,dc=xs4all,dc=nl |
|
| Back to top |
|
|
trellis
n00b
Joined: 05 Feb 2005
Posts: 22
Location: UK
|
| Posted: Tue Feb 15, 2005 11:01 am Post subject: |
|
|
Thanks for that.
I have a /29 subnet, and couldn't find any examples dealing with subnets so I thought it would be safer to enumerate all the addresses (there are only 6 of them!)
It definitely did rebuild the database (I checked the time stamp), so I'm now wondering whether it matters where the "allow" lines appear in the input file? I put them right at the end - will this work? |
|
| Back to top |
|
|
cselkirk
Apprentice
Joined: 09 Jun 2003
Posts: 199
Location: NL
|
| Posted: Tue Feb 15, 2005 12:07 pm Post subject: |
|
|
tcpserver will use the first rule it finds (begining with the top most rule I believe). eg:
| Code: | 192.168.1.1:allow,RELAYCLIENT=""
192.168.1.2:deny |
So if the $TCPREMOTEIP is 192.168.1.1 it will match the first rule, and the connection will be allowed, and if the $TCPREMOTEIP is 192.168.1.2 it will be denied.
A rule like ":deny" would tell tcpserver to drop all connections that aren't handled by more specific rules.
You can abreviate the address range in a number of ways (as I showed above with the 192.168.:allow example) you can give a range in a similar manner, eg:
| Code: | | 192.168.1.1-10:allow,RELAYCLIENT="" |
This would allow relaying from 192.168.1.1 to 192.168.1.10 only.
I think perhaps your rules are correct, at least from the snippits you've posted this would seem the case. I'm almost tempted to think that your *.cdb's are not read by tcpserver. I would check to see where tcpserver is reading it's cdb's from ..
| Code: | | % grep cdb /service/qmail-smtpd/run |
In my case they are read from /etc/tcprules.d. I would check this is the case WRT your install (older qmail ebuilds used /etc for storing the cdb).
BTW, I was quite wrong in saying that you need to restart svscan as tcpserver re-reads the *.cbd on each connection (what was I thinking).
HTH and let me know how you get on ..
_________________
cn=cselkirk,dc=xs4all,dc=nl |
|
| Back to top |
|
|
cselkirk
Apprentice
Joined: 09 Jun 2003
Posts: 199
Location: NL
|
| Posted: Tue Feb 15, 2005 12:37 pm Post subject: |
|
|
Forgot to mention that you can check the rules in your cdb with the following:
| Code: | | TCPREMOTEIP=192.168.1.1 tcprulescheck /etc/tcprules.d/tcp.smtp.cdb |
The output should show if 192.168.1.1 has the environment variable RELAYCLIENT="" set. I would run this for the IP of the mailserver itself and a client IP you expect should be able to relay.
HTH
_________________
cn=cselkirk,dc=xs4all,dc=nl |
|
| Back to top |
|
|
trellis
n00b
Joined: 05 Feb 2005
Posts: 22
Location: UK
|
| Posted: Tue Feb 15, 2005 10:01 pm Post subject: |
|
|
Many thanks for your help, but still no luck, unfortunately 
| Code: |
qmail-smtpd # grep cdb run
/usr/bin/tcpserver ${TCPSERVER_OPTS} -x /etc/tcp.${SERVICE}.cdb \
etc # TCPREMOTEIP=<ip-address> tcprulescheck /etc/tcp.smtp.cdb
rule <ip-address>:
set environment variable RELAYCLIENT=
set environment variable RBLSMTPD=
allow connection
|
where <ip-address> is an IP address on my subnet from which I am attempting to relay via qmail.
All looks perfect, yet when I attempt to relay mail to anywhere other than those domains set up in rcpthosts, I get the following error:
| Code: |
sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)
|
Now, to me that suggests either that RELAYCLIENT has not been set, or that the smtp daemon is ignoring RELAYCLIENT.
But I'm stuck as to why it isn't working - it all looks fine to me:?
Very odd. |
|
| Back to top |
|
|
cselkirk
Apprentice
Joined: 09 Jun 2003
Posts: 199
Location: NL
|
| Posted: Tue Feb 15, 2005 10:57 pm Post subject: |
|
|
OK, well at least we know your rules are in order .. hehe.
I'm inclinded to agree with your appraisal, however I should ask the obvious question.
So, /var/qmail/control/rcpthosts contains a valid FQDN? And that FQDN is the machines name (qualified by reverse DNS lookup)?
_________________
cn=cselkirk,dc=xs4all,dc=nl |
|
| Back to top |
|
|
cselkirk
Apprentice
Joined: 09 Jun 2003
Posts: 199
Location: NL
|
| Posted: Tue Feb 15, 2005 11:23 pm Post subject: |
|
|
After a little digging I come accross this. So, your not the only person witht this particular problem. It is possible the tcpserver is broken (at least under some installs), aggressive CFLAGS perhaps?
I'm less inclined to think it's the compile process, but perhaps. Have you checked bugs.gentoo.org?
_________________
cn=cselkirk,dc=xs4all,dc=nl |
|
| Back to top |
|
|
cselkirk
Apprentice
Joined: 09 Jun 2003
Posts: 199
Location: NL
|
| Posted: Wed Feb 16, 2005 11:42 am Post subject: |
|
|
Just a thought, I wonder if this is related to the +ipv6 bug.
Try re-mergeing sys-apps/ucspi-tcp with -ipv6.
| Code: | | emerge -p -v sys-apps/ucspi-tcp |
You should see +ipv6 .. so we'll disable via package.use
| Code: | echo "sys-apps/ucspi-tcp -ipv6" >> /etc/portage/package.use
emerge sys-apps/ucspi-tcp
/etc/init.d/svscan restart |
HTH
_________________
cn=cselkirk,dc=xs4all,dc=nl |
|
| Back to top |
|
|
trellis
n00b
Joined: 05 Feb 2005
Posts: 22
Location: UK
|
| Posted: Wed Feb 16, 2005 11:44 am Post subject: |
|
|
I have checked bugs.gentoo.org, but couldn't find any relating specifically to this problem (although I couldn't think of a search term to achieve less than 200 results!)
Should I raise a new bug? |
|
| Back to top |
|
|
cselkirk
Apprentice
Joined: 09 Jun 2003
Posts: 199
Location: NL
|
| Posted: Wed Feb 16, 2005 11:54 am Post subject: |
|
|
| trellis wrote: | | I have checked bugs.gentoo.org, but couldn't find any relating specifically to this problem (although I couldn't think of a search term to achieve less than 200 results!) |
Try the search term "ipv6" .. I'm almost certain this is the issue. I would first try re-merging with USE="-ipv6" and test relaying from the clients listed in your cdb's, that is before opening a new bug.
_________________
cn=cselkirk,dc=xs4all,dc=nl |
|
| Back to top |
|
|
trellis
n00b
Joined: 05 Feb 2005
Posts: 22
Location: UK
|
| Posted: Wed Feb 16, 2005 8:38 pm Post subject: |
|
|
| Thanks - will try that, but which packages should I re-merge? Should I un-merge them first? Will I lose my configs? |
|
| Back to top |
|
|
cselkirk
Apprentice
Joined: 09 Jun 2003
Posts: 199
Location: NL
|
| Posted: Wed Feb 16, 2005 9:44 pm Post subject: |
|
|
I'm sorry, I completly omited to say which packge, "sys-apps/ucspi-tcp". And, no you don't need to unmerge and there are no configuration files that come with the package to etc-update.
_________________
cn=cselkirk,dc=xs4all,dc=nl |
|
| Back to top |
|
|
trellis
n00b
Joined: 05 Feb 2005
Posts: 22
Location: UK
|
| Posted: Wed Feb 16, 2005 10:07 pm Post subject: |
|
|
many thanks! It is busy emerging as I write this... 
(Being of a semi-paranoid nature, I backed up my config files anyway!) |
|
| Back to top |
|
|
Bojan
Tux's lil' helper
Joined: 18 Oct 2004
Posts: 145
Location: € Matrix
|
| Posted: Wed Feb 16, 2005 10:18 pm Post subject: |
|
|
I hope this will help ... I had similar problems with qmail when I was trying to enable relaying mail for LAN users.
It turned out that I've made a mistake in FQDN section of /var/qmail/control/servercert.cnf
Perhaps it is worth re-checking that ... |
|
| Back to top |
|
|
trellis
n00b
Joined: 05 Feb 2005
Posts: 22
Location: UK
|
| Posted: Wed Feb 16, 2005 10:18 pm Post subject: |
|
|
 It worked!
Looks like it was associated with ipv6.
Many thanks for all your help, cselkirk !
Thanks to you, I now have a fully working qmail server  |
|
| Back to top |
|
|
cselkirk
Apprentice
Joined: 09 Jun 2003
Posts: 199
Location: NL
|
| Posted: Thu Feb 17, 2005 1:54 am Post subject: |
|
|
Ahh good .. now to turn you into the spam kings .. hehe
The bug has been reported, but it's probably a good idea to file another bug WRT the guide as the issue should probably be mentioned there.
Good your up and working ...
_________________
cn=cselkirk,dc=xs4all,dc=nl |
|
| Back to top |
|
|
trellis
n00b
Joined: 05 Feb 2005
Posts: 22
Location: UK
|
| Posted: Thu Feb 17, 2005 3:58 pm Post subject: |
|
|
| The guide I was working to was the Virtual domains qmail/courier-imap one, but I didn't bother with courier-imap - just used qmail's own pop3d. This guide didn't mention configuring relaying in this way - I made it up |
|
| Back to top |
|
|
cselkirk
Apprentice
Joined: 09 Jun 2003
Posts: 199
Location: NL
|
| Posted: Thu Feb 17, 2005 6:33 pm Post subject: |
|
|
Still, the Guide should probably mention this as a gotcha. uspci-tcp is a component/dependency of qmail and so anyone installing qmail on gentoo will encounter this problem. Not only if relaying, tcpserver looses the ability to understand ipv4 addressing. Fortunatly tcpservers default behavior is only to allow relaying when explictly defined and even an empty cdb will still only mean ":allow".
I wasn't saying you specificly need to report it but the guides author should probably get a heads up.
_________________
cn=cselkirk,dc=xs4all,dc=nl |
|
| Back to top |
|
|
cmoad
n00b
Joined: 03 Aug 2003
Posts: 40
Location: Indianapolis, IN
|
| Posted: Tue Mar 01, 2005 1:13 am Post subject: |
|
|
I have done everything on this forum and I am still having problems. I can receive mail and send to a local account but weird things happen when I try to send to a remote account. First of all, everything acts as if it works fine. The qmail-smtpd log acts as if the mail was processed fine. The weird thing I am seeing is a spawned process that is not doing anything.
If I send an email from cmoad@mydomain.com to cmoad@gmail.com for example, I see a process named:
| Quote: | | qmail-remote gmail.com cmoad@mydomain.com cmoad@gmail.com |
This process never goes away!
Any ideas?
Thanks for the help. |
|
| Back to top |
|
|
j-m
Retired Dev
Joined: 31 Oct 2004
Posts: 975
|
| Posted: Tue Mar 01, 2005 1:18 am Post subject: |
|
|
Sure...
| Code: |
ditch qmail
emerge postfix
|
I hate to do this but I really have to say that qmail without those loads of third-party patches is missing the basic functionality of modern MTA. All the stuff is messy and unnecessarily complex and therefore prone to errors and problems. It´s just about time to say goodbye...  |
|
| Back to top |
|
|
cmoad
n00b
Joined: 03 Aug 2003
Posts: 40
Location: Indianapolis, IN
|
| Posted: Tue Mar 01, 2005 1:26 am Post subject: |
|
|
| Haha! Did you post this exact response in another thread? I swear I saw it there too. One question to you though, is the gentoo guide, http://www.gentoo.org/doc/en/virt-mail-howto.xml, a good one to follow? |
|
| Back to top |
|
|
j-m
Retired Dev
Joined: 31 Oct 2004
Posts: 975
|
| Posted: Tue Mar 01, 2005 10:04 am Post subject: |
|
|
Yes, it works very well. This one is also nice...  |
|
| Back to top |
|
|
cselkirk
Apprentice
Joined: 09 Jun 2003
Posts: 199
Location: NL
|
| Posted: Tue Mar 01, 2005 5:09 pm Post subject: |
|
|
| j-m wrote: | | I hate to do this but I really have to say that qmail without those loads of third-party patches is missing the basic functionality of modern MTA. All the stuff is messy and unnecessarily complex and therefore prone to errors and problems. It´s just about time to say goodbye... :twisted: |
Nonsense. Would you say the Linux kernel is "missing basic functionality" due to the fact that third party patches are applied? Take a look at any of the *-sources ebuilds and the number of patches available via other "third parties", and why stop there .. the number of ebuilds that don't get patches applied would probably be in quite a distinct minority.
The fact that qmail is patched by vendors says absolutly nothing about its functioning as an MTA.
As to "messy and unnecessarily complex" this is simply a matter of your opinion, and as such I won't bother commenting on.
_________________
cn=cselkirk,dc=xs4all,dc=nl |
|
| Back to top |
|
|
j-m
Retired Dev
Joined: 31 Oct 2004
Posts: 975
|
| Posted: Tue Mar 01, 2005 5:33 pm Post subject: |
|
|
| cselkirk wrote: |
Nonsense. Would you say the Linux kernel is "missing basic functionality" due to the fact that third party patches are applied? Take a look at any of the *-sources ebuilds and the number of patches available via other "third parties", and why stop there .. the number of ebuilds that don't get patches applied would probably be in quite a distinct minority.
|
Plain vanilla qmail does not contain any of those patches. Please look at the ebuild and the obnoxious number of patches it downloads and applies for you. You would have to do all the work yourself, if you downloaded vanilla qmail from its (largely unmaintained) homepage. Without those patches, the package is basically unuseable. Think of this like if you downloaded vanilla kernel and would have to patch it with ext2/ext3. Now if you could look at postfix ebuild and compare. This is really funny.
E.g., qmail is unable to reject email when the mailbox (local or virtual) does not exist a puts it into mailqueue!!! It won´t just do it until a third party patch is applied. OMG. You really think that this is a sane software design? I don´t. It´s a hodgepodge mess.  |
|
| Back to top |
|
|
|
Networking & Security
