Download qmHandle from SourceForge. You actually only need the script ‘qmHandle’ so use that if you have it handy. Upload it to the server and untar it if necessary. You may download the file directly from SourceForge using the wget command:

# wget http://sourceforge.net/projects/qmhandle/files/qmhandle-1.3/qmhandle-1.3.2/qmhandle-1.3.2.tar.gz/download

Then decompress the file using the tar command:

# tar -xvzf qmhandle-1.3.2.tar.gz

First it is recommended to shutdown qmail using the service command to prevent possible corruption of the mail queue:

This is a document to help you convert your apache certs to qmail.

Please note that the common name you used needs to match the server name in order for your clients not to get the nag screen when they send emails via SSL or TLS.

In order to convert your apache cert, it is important to create the cert correctly. Here is how to do it:

First, We create the key:

# openssl genrsa -out domain.xxx.key 2048

You can substitute 2048 with 4096 for stronger encryption and make sure you replace YOURDOMAIN with your actual domain name.

Next, We need to add a password. Go ahead and type it and confirm.

Now create a csr:

# openssl req -new -key YOURDOMAIN.key -out YOURDOMAIN.csr

It is important to note here to type in all information for your company. When it asks for Common Name (eg, YOUR name) []: it is VERY IMPORTANT this field matches what your users are going to use for their mailserver name. If you are buying a cert for multiple domains, this will be the domain users use the most. When viewing a cert for multiple domains, the common will appear first and the others will show on the cert.

This is the csr you can you to generate your cert when asked by the domain you buy your cert from.

——————————————————————————————————————-

First lets backup the current /var/qmail/control folder first:

# mkdir /var/qmail/backup_control
# cp -Rp /var/qmail/control/* /var/qmail/backup_control

Please copy the .crt, .csr and the .key to the root folder. Then run the following to make a signed cert:

# cat /root/cert.key > /var/qmail/control/servercert.pem
# cat /root/cert.crt >> /var/qmail/control/servercert.pem
# cat /root/intermediate.crt >> /var/qmail/control/servercert.pem

And now lets set the permissions on the servercert.pem:

# chown root:qnofiles /var/qmail/control/servercert.pem
# chmod 640 /var/qmail/control/servercert.pem

Now lets create the clientcert.pem file and the permissions:

# cp /var/qmail/control/servercert.pem /var/qmail/control/clientcert.pem
# chown root:qmail /var/qmail/control/clientcert.pem
# chmod 640 /var/qmail/control/clientcert.pem

Now restart qmail in order to make the changes take effect:

# qmailctl restart

If you have any other services that reference the servercert.pem, you will want to restart those services as well. Such services could include smtpd-ssl and smtpd-tls (Just as an example)

Now if you decided to run imap, You can use the following to create imap certs as well.

# cp /var/qmail/control/servercert.pem /usr/local/share/courier-imap/imapd.pem
# cp /var/qmail/control/servercert.pem /usr/local/share/courier-imap/pop3d.pem

Now to restart the service(s)

# svc -t /service/courier-*

That will restart ALL the courier- services.

Now your customers will not get the annoying nag screen when people send mail via smtp-ssl, smtp-tls or via imap!

rom Qmailtoaster

Security Certificate

To configure a SSL certificate for TLS and/or SSL over SMTP:
1) Create a private key using the triple des encryption standard (recommended):

# openssl genrsa -des3 -out servercert.key.enc 1024

2) Remove the pass phrase from the private key:

# openssl rsa -in servercert.key.enc -out servercert.key

3) Generate Certificate Request

# openssl req -new -key servercert.key -out servercert.csr

4) Go to DiscountWebCerts and submit servercert.csr for a trusted certificate ($19.95). You will then receive a servercert.crt. Now just do the following.

5) Create standard .pem in /var/qmail/control/servercert.pem

# cat servercert.key servercert.crt > /var/qmail/control/servercert.pem

• NOTE – For reference, here is the command to sign the request for a self signed certificate:

1. openssl x509 -req -days 365 -in servercert.csr -signkey servercert.key -out servercert.crt

Here is an additional resource with some good examples.

http://www.madboa.com/geek/openssl/#cert-self

• • NOTE – Some certificate providers, like GoDaddy for example, will also give you a chain file (also sometimes called intermediate file), dump it into the same servercert.pem like so:

cat /etc/pki/tls/private/localhost.key /etc/pki/tls/certs/localhost.crt /etc/pki/tls/certs/intermediate.crt > /var/qmail/control/servercert.pem

This will join all three of them: The key, signed certificate and the intermediate certificate. You can use the same certificate you have obtained for your Apache website.

# chown root:vchkpw /var/qmail/control/servercert.pem
# chmod 640 /var/qmail/control/servercert.pem

Note, in order to avoid verification errors in email clients (i.e. Outlook, Thunderbird, etc), you need to use the same server name (FQDN) in your client configuration(s) for both incoming (pop/imap) and outgoing (smtp) servers that was entered as the hostname when the certificate request was created. This should also be the same name that is used on the DNS MX record.

That’s all there is to it. There is no need to restart qmail.
You can also use this signed certificate for apache by putting:

• servercert.key in /etc/pki/tls/private/localhost.key
• servercert.crt in /etc/pki/tls/certs/localhost.crt

Be sure to check your /etc/httpd/conf.d/ssl.conf file to be certain that the correct file names are specified, and that the corresponding parameters are not commented out.

You need to restart apache to activate the modified certificate configuration.
See Building a Secure Redhat Apache Server HOWTO for guidance with securing your Apache Server.

Self-signed ssl cert gleaned from the archives
Quick-n-dirty how-to for ssl certs

# cd /usr/share/ssl/certs

# make stunnel.pem

# mv stunnel.pem /var/qmail/control/servercert.pem

Then run these commands to finish:

# cd /var/qmail/control

# chown root:qmail /var/qmail/control/servercert.pem

# chmod 644 /var/qmail/control/servercert.pem

# ln -s /var/qmail/control/servercert.pem /var/qmail/control/clientcert.pem

Dual MTA Qmail

Recently i installed two qmails in a single server to handle mails from inner and outer domains. I will be posting a step by step tutorial of the same in the coming days.

Why dual MTA?

Basically i wanted two different queues to handle mails in different ways.
Queue 1) To get the mails(incoming) and pass it on to queue 2.
Queue 2) Will receive mails only from queue 1, runs virus scan, spamassassin and delivers mails to local or remote mail boxes(outgoing).

While i could have achieved the same functionality with single queue i doubted it may not suit my needs in the future. Say if the server can handle 250 mails and the queue is already full then we may see some delay in receiving mails from remote machines and/or may completely loose some mails. More over I don’t have to change the incoming queue’s setup and continue receiving mails until i needed. It provides me the flexibility to pass the message to different server/s altogether whenever needed.

How the setup will look like?

Queue 1: Two qmail-smtpd instances one listening on port 25 and the other listening on port 465(SSL).
port 25 – To receive mails from public domains such as yahoo/google.
port 465 – For internal users to send mails(auth + encryption).

Queue 2: qmail-smtpd listens on port 2000. Receives mail only from localhost(127.0.0.1). Calls qmailscanner and have it scanned with clamav & spamassassin. If it has virus the mail is quarantined. If tagged SPAM then the mail’s subject is prepend with [SPAM] and delivered to user’s mail box. If the user is local, the mail will be delivered to Junk directory.

Also there were some specific needs for me. We had many aliases in the server and only certain people must be able to send mail to those aliases. While this can be done with mailing list software like ezmlm i thought of discovering more. When a unauthorized user sends a mail to particular alias it will send a mail to the moderator. I wanted the mail to be bounced back to the sender(ezmlm has that option) and also give my own message for the bounce(reason). I wrote my own perl script to achieve this and it was simple enough. Ezmlm is also installed in my server and serving other purposes.

Enough for tonight. I will be posting

For the inside queue(that scans and delivers mail) i followed the instructions from qmailrocks. Disk space, pre-installation check list & other instructions are here

Note: I installed vpopmail without mysql since the number of domains i manage is small. If you are going to have more than 10 domains consider using vpopmail with mysql backend. Remember to replace all example.net entries with your own domain. For hostnames enter the FQDN of your server.

After installing qmailrocks, make sure that mails to & from your domain works. The qmail installation from qmailrocks listens on port 25, alter it to listen on port 2000.

Last few lines in ‘/var/qmail/supervise/qmail-smtpd/run’ looks like this

# tail -4 /var/qmail/supervise/qmail-smtpd/run

 /usr/local/bin/tcpserver -v -R -l "$LOCAL" -x /etc/tcp.smtp.cdb -c "$MAXSMTPD" \ -u "$QMAILDUID" -g "$NOFILESGID" 127.0.0.1 2000 \ /var/qmail/bin/qmail-smtpd your.hostname.here \ /home/vpopmail/bin/vchkpw /usr/bin/true 2>&1 

With the above setting, the QMR installation will serve us as a separate queue which will scan any mail that comes to it. Now we have everything setup to install our other queue.

Note: I used /var/qmail-inside as my qmail directory(for all incoming mails). You can choose any other directory you want. Also for this queue i patched qmail with jms’s combined patch set 6cd

Below are the steps:

 cd /usr/local/src wget ftp://ftp.jp.qmail.org/qmail/qmail-1.03.tar.gz wget http://qmail.jms1.net/patches/qmail-1.03-jms1.6cd.patch wget http://untroubled.org/qmail-qfilter/qmail-qfilter-2.1.tar.gz wget http://qmail.jms1.net/scripts/service-qmail-send-run wget http://qmail.jms1.net/scripts/service-qmail-smtpd-run tar zxfv qmail-1.03.tar.gz mv qmail-1.03 qmail-inside cd qmail-inside/ 

Edit conf-qmail and change the directory entry from /var/qmail to /var/qmail-inside

 echo 211 > conf-split echo 255 > conf-spawn patch < /usr/local/src/qmail-1.03-jms1.6cd.patch make setup check 

Next we have to copy create necessary control files for qmail. Copying all the control files from the /var/qmail/control will do. But we have remove some unwanted files too. virtualdomains file has the names of the virtual domains created with vpopmail. However, having this file means that the mail will be directly delivered to the vpopmail user rather than passing it to out other queue.

 cd /var/qmail-inside/control/ cp /var/qmail/control/* /var/qmail-inside/control/ rm -f virtualdomains.lock locals.lock rcpthosts.lock clientcert.pem rm -f virtualdomains 

It is better to link some files directly from /var/qmail so that when there are new virtual domains we don’t have to change the file each time we add a new virtual domain.

 /var/qmail-inside/control rm -f rcpthosts ln -s /var/qmail/control/rcpthosts rm -f plusdomain ln -s /var/qmail/control/plusdomain 

Now we are gonna created necessary aliases and cbd file.

 cd /var/qmail-inside/alias echo "postmaster" > .qmail-root echo "postmaster@example.net" > .qmail-postmaster echo "postmaster" > .qmail-mailer-daemon cp .qmail-root .qmail-abuse echo "127.0.0.1:allow,RELAYCLIENT=\"\"" > /etc/tcp.smtp.inside tcprules /etc/tcp.smtp.inside.cdb /etc/tcp.smtp.inside.tmp < /etc/tcp.smtp.inside 

Next step is to create all supervise and log directories

 mkdir -p /var/qmail-inside/supervise/qmail-inside-send/log mkdir -p /var/qmail-inside/supervise/qmail-smtpd-25/log mkdir -p /var/qmail-inside/supervise/qmail-smtpd-465/log chmod +t /var/qmail-inside/supervise/qmail-inside-send chmod +t /var/qmail-inside/supervise/qmail-smtpd-25 chmod +t /var/qmail-inside/supervise/qmail-smtpd-465 mkdir -p /var/log/qmail-inside/qmail-inside-send mkdir -p /var/log/qmail-inside/qmail-smtpd-25 mkdir -p /var/log/qmail-inside/qmail-smtpd-465 chown -R qmaill /var/log/qmail-inside/ chown vpopmail.qmail servercert.pem 

Create run files for both smtpd instances:
vi /var/qmail-inside/supervise/qmail-smtpd-25/log/run

 #!/bin/sh exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s2500000 /var/log/qmail-inside/qmail-smtpd-25 

vi /var/qmail-inside/supervise/qmail-inside-send/log/run

 #!/bin/sh exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t /var/log/qmail-inside/qmail-inside-send 

Now we are going to create the supervise directories:

 cd /var/qmail-inside/supervise cp /usr/local/src/service-qmail-smtpd-run qmail-smtpd-25/ cp /usr/local/src/service-qmail-smtpd-run qmail-smtpd-465/ cp /usr/local/src/service-qmail-send-run qmail-inside-send/ cp qmail-smtpd-25/log/run qmail-smtpd-465/log/ 

vi qmail-smtpd-465/log/run

change the directory qmail-smtpd-25 to qmail-smtpd-465

 chmod 755 qmail-smtpd-465/log/run qmail-smtpd-25/log/run\ qmail-inside-send/log/run cd /var/qmail-inside/supervise/qmail-inside-send/ mv service-qmail-send-run run 

Edit the file run: vi run

and change the following entries

 VQ=/var/qmail to VQ=/var/qmail-inside 

and save the file

 chmod 755 run cd ../qmail-smtpd-25/ mv service-qmail-smtpd-run run vi run 

Change the following:

 VQ="/var/qmail-inside" SMTP_CDB="/etc/tcp.smtp.inside.cdb" GREETDELAY=30 IP=0 uncomment RBLSMTPD_PROG, RBL_BAD , save the file and make it executable. # chmod 755 run 

We have to install sslserver for enabling secured smtp connections(i configured it to listen on port 465).

Installing sslserver

 cd /usr/local/src/ wget http://www.superscript.com/ucspi-ssl/ucspi-ssl-0.70.tar.gz cd /package/ tar zxfv /usr/local/src/ucspi-ssl-0.70.tar.gz cd host/superscript.com/net/ucspi-ssl-0.70 package/compile package/rts # output should be empty package/install cd /var/qmail-inside/supervise/qmail-smtpd-465/ mv service-qmail-smtpd-run run vi run 

change the following

 VQ="/var/qmail-inside" SMTP_CDB="/etc/tcp.smtp.cdb" QUSER=vpopmail IP=0 PORT=465 SSL=1 AUTH=1 REQUIRE_AUTH=1 

Save the file

 chmod 755 run cd /var/qmail-inside/control/ echo ":127.0.0.1:2000" > smtproutes cd /service/ ln -s /var/qmail-inside/supervise/qmail-smtpd-25/ ln -s /var/qmail-inside/supervise/qmail-inside-send/ ln -s /var/qmail-inside/supervise/qmail-smtpd-465/ 

ps -ef|grep qmail-inside

will show that the processes are started and running. Check the corresponding services logs and make sure that they don’t throw errors.

If you followed the above steps word by word then, log files for the above services will be at: /var/log/qmail-inside/qmail-smtpd-25/current and /var/log/qmail-inside/qmail-smtpd-465/current

Errors and fixes:
When configuring your mail client to send mail you get auth failure. You have to use useid@example.net as username. Also make sure that SSLis enbaled and the port is set as 465.

Following commands can delete all mails from your qmail mail server queue.

qmailctl stop
find /var/qmail/queue/mess -type f -exec rm {} \;
find /var/qmail/queue/info -type f -exec rm {} \;
find /var/qmail/queue/local -type f -exec rm {} \;
find /var/qmail/queue/intd -type f -exec rm {} \;
find /var/qmail/queue/todo -type f -exec rm {} \;
find /var/qmail/queue/remote -type f -exec rm {} \;
qmailctl start