-
Notifications
You must be signed in to change notification settings - Fork 6
/
qmail-remove_chkuser_vpopmail.patch
2938 lines (2916 loc) · 95.5 KB
/
qmail-remove_chkuser_vpopmail.patch
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Patch to remove chkuser and its vpopmail dependency from qmail
Tested with version 2024.06.08
Use as follows:
patch -p1 < qmail-no-chkuser-vpopmail.patch
====================================================================================================
diff -ruN qmail/CHKUSER.automatic_patching qmail-no-chkuser-vpopmail/CHKUSER.automatic_patching
--- qmail/CHKUSER.automatic_patching 2024-02-05 20:29:09.069233988 +0100
+++ qmail-no-chkuser-vpopmail/CHKUSER.automatic_patching 1970-01-01 01:00:00.000000000 +0100
@@ -1,94 +0,0 @@
-Chkuser 2.0.9 automatic patching
-
-When to use automatic patching
-==============================
-
-The release.tar package contains some .patch files, ready for installation,
-trying to semplify the most frequent situations.
-
-You may use one of these patches if you have these sources:
-
- - a clean qmail 1.03 or netqmail 1.05
-
-You may also consider using one of these patches if you have additional compatible
-patches installed. This means that these additional patches should not have changed
-the same sources and lines which are going to be used by chkuser.
-
-If you have any doubt, backup your sources and try the automatic installation,
-otherwise execute the manual installation (that's very easy).
-
-Backup
-======
-
-Save you qmail working sources before making any change.
-
-Basic installation
-==================
-
-Download the newest release.tar package and untar it. It will create a directory
-containing all release chkuser files and patches.
-
-Chose the most appropriate .patch file to be applied, according to your qmail
-installation: .patch files names are self-describing.
-
-Position in the qmail/netqmail source directory:
-
- $ cd /usr/.../netqmail-1.05
-
-Apply selected patch:
-
- $ patch < /path_to_chkuser_release_dir/netqmail-1.05_chkuser-2.x.x.patch
-
-No errors should be displayed. If you see any error, better you restore your
-sources and go to manual editing.
-
-editing vpopmail home path
-
- If your production home path for vpopmail (or whatever you call him) user
- is NOT /home/vpopmail, you must perform the following additional actions.
-
- Edit Makefile, changing the line referring to vpopmail's home path and
- putting the right home path:
-
- VPOPMAIL_HOME=/home/vpopmail
-
- Edit conf-cc, changing the string referring to vpopmail's home path and
- putting the right home path:
-
- cc -O2 -I/home/vpopmail/include
-
-chkuser settings
-================
-
-Edit chkuser_settings.h, uncommenting the options you prefer, and commenting the
-ones you don't want. Default settings should cover the most of situations.
-
-See the related settings pages for more informations.
-
-Make
-====
-Now, make (or gmake on *BSD) as your usual. No errors (just warnings) should
-come out. If you see any error, better you restore your sources
-and go to manual editing.
-
-Checking
-========
-Select a domain, contained in your rcpthosts, for which bouncing is enabled, and run:
-
- $ ./qmail-smtpd
- mail from <wrong_sender>
- mail from <right_sender>
- rcpt to: <fake_user@your_domain>
- rcpt to: <real_user@your_domain>
-
-You should see error and ok messages, depending on the addresses you typed.
-
-Install
-=======
-Copy the new executable in the /var/qmail/bin directory (or make install).
-
-Running
-=======
-This patched qmail-smtpd must be executed in a different way than the normal one.
-See the running pages for detailed instructions.
-
diff -ruN qmail/CHKUSER.changelog qmail-no-chkuser-vpopmail/CHKUSER.changelog
--- qmail/CHKUSER.changelog 2024-02-05 20:29:09.069233988 +0100
+++ qmail-no-chkuser-vpopmail/CHKUSER.changelog 1970-01-01 01:00:00.000000000 +0100
@@ -1,183 +0,0 @@
-
-CHKUSER 2.0 change log
-
-2.0.9 - 21 march 2007
- New features
- - New variable for accepting only authorized senders:
- #define CHKUSER_EXTRA_MUSTAUTH_VARIABLE "CHKUSER_MUSTAUTH"
- if the variable exists, then messages are accepted only if RELAYCLIENT is set
- If defined, it works always despite CHKUSER being ON/OFF
- This feature can be used for a "submission port" (see RFC 2476)
- - Improved checking of MySQL server availability (if MySQL is used as vpopmail user's DB)
- - Introduction of a new variable for disabling chkuser on the fly: CHKUSER_DISABLE_VARIABLE
- (can be used for single IP or defined as "RELAYCLIENT" for all authorized e-mail clients)
- - Improved starting variables checking sequence
- CHKUSER_ALWAYS_ON and CHKUSER_STARTING_VARIABLE cannot be defined together
- and in such a case a fatal error is displayed; (in previous versions
- CHKUSER_ALWAYS_ON would automatically disable CHKUSER_STARTING_VARIABLE definition).
- CHKUSER_DISABLE_VARIABLE is always evaluated after CHKUSER_ALWAYS_ON is set or
- CHKUSER_STARTING_VARIABLE is evaluated, so CHKUSER_ALWAYS_ON or
- CHKUSER_STARTING_VARIABLE can set the general behaviour, while
- CHKUSER_DISABLE_VARIABLE should be invoked to handle exceptions.
- - New variable for accepting qmail doublebounces: CHKUSER_ENABLE_DOUBLEBOUNCE_VARIABLE
- Sender "#@[]" will be accepted. It is used by qmail for doublebounces, and should be enabled for
- selected IP senders.
- - define CHKUSER_ENABLE_VAUTH_OPEN has been substituted by CHKUSER_VAUTH_OPEN_CALL: this new
- define must contain the name of the call used to open the auth DB
-
- Updated features
- - checking for ezmlm mailing list is now done looking for file "editor"
- within mailing-list directory
- - defines for allowed character within sender and rcpt addresses increased
- up to CHKUSER_ALLOW_SENDER_CHAR_10 and CHKUSER_ALLOW_RCPT_CHAR_10
- - updated SMTP error strings; more exact and detailed error codes
- (thanks to Olivier Dony and Dane Thorsen)
- - logging of valid rcpt. If CHKUSER_LOG_VALID_RCPT is defined then all valid
- recipients are logged, even if domain does not want bouncing or chkuser
- is disabled
-
- Bugs corrected
- - negative checking of backend DB connection did not report
- DB unavailability in some situations
- (thanks to Matt Brookings of Inter7)
- - in check_rcpt_address_format format checking was done using defines
- reserved for senders
-
-V 2.0.8 - 7 december 2004
- Features
- Freeze of new features of 2.0.7, except null senders behaviour.
- CHKUSER_ENABLE_NULL_SENDER_WITH_TCPREMOTEHOST is no more available
- CHKUSER_ENABLE_NULL_SENDER is no more available
- NULL SENDERS are now always accepted. No option is available to disable
- this behaviour. Previous chkuser versions broke RFC compatibility on
- null senders, and complicated real life e-mailing.
- Logging of null senders <> is now available.
-
- Bugs corrected
- Sender controls were not executed if CHKUSER_STARTING_VARIABLE was defined
- (thanks to Charles Sprickman)
- Domains not in control/virtualdomains are now explicitely excluded from
- following cascade checks; in previous versions following cascade
- checks were done using fake domains paths.
- vget_assign is now handled correctly (a domain in rcpthosts but not
- in virtualdomains could have an incorrect path in previous versions
- (this bug is also in all chkusr versions)
-
- Defaults changed
- CHKUSER_RCPT_FORMAT is now undefined as default
- CHKUSER_RCPT_MX is now undefined as default.
- CHKUSER_SENDER_FORMAT is now undefined as default
- CHKUSER_SENDER_MX is now undefined as default.
- CHKUSER_ERROR_DELAY_INCREASE new default is 300 milliseconds
-
-V 2.0.7 - 25 october 2004
- Features
- added vclose() of DB auth connection, overriding
- qmail-smtpd _exit call
- improved MX checking; now SOFT failure is handled as
- temporary error.
- added #define CHKUSER_RCPTMX_TMP_STRING
- added #define CHKUSER_SENDERMX_TMP_STRING
- added handling of mailman mailing lists
- (and related #define CHKUSER_ENABLE_MAILMAN_LISTS)
- changed order of checking for recipients:
- 1 - valias
- 2 - alias
- 3 - alias extensions
- 4 - users
- 5 - users extensions
- 6 - lists
- added #define CHKUSER_ACCEPT_NULL_SENDER (default defined)
- added #define CHKUSER_ENABLE_ALIAS_DEFAULT (default not defined)
- enables checking of .qmail-alias-default
- added #define CHKUSER_IDENTIFY_REMOTE_VARIABLE "CHKUSER_IDENTIFY"
- in order to allow a easy identification of remote IP
- (substitutes RELAYCLIENT in chkuser logging)
- added #define CHKUSER_ALLOW_RCPT_SRS
- enable usage of "#" and "+" characters within rcpt address
- added #define CHKUSER_ALLOW_RCPT_CHAR_1 '$'
- added #define CHKUSER_ALLOW_RCPT_CHAR_2 '%'
- added #define CHKUSER_ALLOW_RCPT_CHAR_3 '£'
- added #define CHKUSER_ALLOW_RCPT_CHAR_4 '?'
- added #define CHKUSER_ALLOW_RCPT_CHAR_5 '*'
- #define CHKUSER_ENABLE_USERS_EXTENSIONS
- substitutes #define CHKUSER_ENABLE_EXTENSIONS
- #define CHKUSER_ENABLE_EZMLM_LISTS
- substitutes #define CHKUSER_ENABLE_LISTS
- #define CHKUSER_USERS_DASH
- substitutes #define CHKUSER_EXTENSION_DASH
-
- Bugs corrected
- sender address "name@" could cause a crash. Corrected
- (Thanks to Dmitry Petukhov)
- Corrected Makefile: now qmail-smtpd.c recompiles if chkuser.h
- changes
- Corrected a bug in #endif sequence related to
- #define CHKUSER_RCPT_FORMAT (thanks to Alex Plainer)
- Corrected a bug in chkuser_sender; now is not executed when
- chkuser is disabled
- Corrected check of format for domains:
- "xn--" admitted as leading string
- Deleted correction over usage of RELAYCLIENT variable
- Previous correction could affect a special
- feature of RELAYCLIENT (thanks to Alex Pleiner)
-
- Defaults changed
- #define CHKUSER_ENABLE_NULL_SENDER_WITH_TCPREMOTEHOST (default undefined)
-
-
-V 2.0.6 - 25 september 2004
- No bugs, just doc updates and an empty patch file corrected
-
- #define CHKUSER_ENABLE_VGET_REAL_DOMAIN was existing and working in code,
- but not reported both in docs and inside chkuser_settings.h
- (default is commented, but this #define is important)
- patch for toaster-0.6-1 was empty. Now the correct one is provided
-
-V 2.0.5 - 23 september 2004
- This is the first public release.
-
- added #define CHKUSER_ALLOW_SENDER_CHAR_1 (default not defined)
- added #define CHKUSER_ALLOW_SENDER_CHAR_2 (default not defined)
- added #define CHKUSER_ALLOW_SENDER_CHAR_3 (default not defined)
- added #define CHKUSER_ALLOW_SENDER_CHAR_4 (default not defined)
- added #define CHKUSER_ALLOW_SENDER_CHAR_5 (default not defined)
- added #define CHKUSER_MIN_DOMAIN_LEN (default defined 4) -
- Previously it was hard coded as 5. Juergen Kendzorra
- showed me some existing names long only 4 chars.
- added #define CHKUSER_LOG_VALID_SENDER (default defined)
-
-V 2.0.4 - 15 september 2004
-
- added #define CHKUSER_SENDER_NOCHECK_VARIABLE (default not defined)
- added #define CHKUSER_DEBUG_STDERR (default not defined)
- added #define CHKUSER_ALLOW_SENDER_SRS (default not defined)
- cleaned some typos in code and documentation (thanks to Juergen
- Kendzorra - http://www.kendzorra.de)
-
-
-V 2.0.3 - 8 september 2004
- This is the first version released outside, for wider testing.
-
- Tested Makefile for netqmail 1.05
- Added Makefiles for applying over other patches
-
-V 2.0.0 - july 2004
- chkuser 2.0.0 starts here, and is a private internal release.
- Version 2.0 is much more modular than previous one (named chkusr),
- and has been designed with the goal of enabling more features and
- semplifying installations and upgrades of the patch himself.
-
- chkusr changes his name, to reflect a deep change of the patch.
-
- Chkusr 1.0 received a lot of feedbacks and suggestions.
- The most of these suggestions are now inside version 2.0.
-
- - Marcelo Coelho (marcelo at tpn.com.br), segnaled me some
- unseen minor bugs of chkusr 1.0 (minor but very annoying to
- my pride) and suggested some very interesting features
- (some of them are now in chkuser 2.0).
- - Iulian Margarintescu (http:://www.erata.net) suggested a
- workable way of introducing quota check on recipients
- (now in chkuser 2.0).
-
diff -ruN qmail/CHKUSER.copyright qmail-no-chkuser-vpopmail/CHKUSER.copyright
--- qmail/CHKUSER.copyright 2024-02-05 20:29:09.069233988 +0100
+++ qmail-no-chkuser-vpopmail/CHKUSER.copyright 1970-01-01 01:00:00.000000000 +0100
@@ -1,15 +0,0 @@
-
-chkuser for qmail/netqmail > 1.0.3 and vpopmail > 5.3.x
-
-Author: Antonio Nati tonix@interazioni.it
-
-All rights on this software and
-the identifying words chkusr and chkuser kept by the author
-
-This software may be freely used, modified and distributed,
-but this lines must be kept in every original or derived version.
-
-Original author "Antonio Nati" and the web URL
-"http://www.interazioni.it/opensource"
-must be indicated in every related work or web page
-
diff -ruN qmail/CHKUSER.log_format qmail-no-chkuser-vpopmail/CHKUSER.log_format
--- qmail/CHKUSER.log_format 2024-02-05 20:29:09.069233988 +0100
+++ qmail-no-chkuser-vpopmail/CHKUSER.log_format 1970-01-01 01:00:00.000000000 +0100
@@ -1,69 +0,0 @@
-
-chkuser 2.0.9 logging format
-
-When #defines for logging are enabled, chkuser patch emits log informations
-on the same qmail-smtpd log destination
-
-This is the log format:
-
- CHKUSER "brief message": \
- from <sender:remoteinfo:relayclient> \
- remote <helo:remotehostname:remotehostip> \
- rcpt <recipient> : "extended message"
-
-where
- brief message
- * accepted rcpt
- * relaying rcpt
- * rejected relaying
- * rejected rcpt
- * no auth resource
- * mbx overquota
- * rejected intrusion
- * intrusion threshold
- * accepted sender
- * rejected sender
- * must auth
-
- sender sender declared within "mail from"
-
- remoteinfo the value of "TCPREMOTEINFO" or the autenticated user
-
- relayclient the value of CHKUSER_IDENTIFY env variable (this name
- is defined by #define CHKUSER_IDENTIFY_REMOTE_VARIABLE)
-
- helo helo declared from remote system
-
- hostname the value of "TCPREMOTEHOST"
-
- remotehostip the value of "TCPREMOTEIP"
-
- recipient recipient address
-
- extended message this field has more wide description for
- some generic "brief message":
- accepted rcpt found existing recipient
- accepted rcpt accepted any recipient for any rcpt doman (from 2.0.9)
- accepted rcpt accepted any recipient for this domain (from 2.0.9)
- relaying rcpt client allowed to relay
- rejected relaying client not allowed to relay
- rejected rcpt not existing recipient
- rejected rcpt max number of recipients
- rejected rcpt max number of invalid recipients
- rejected rcpt invalid rcpt address format
- rejected rcpt invalid rcpt MX domain
- rejected rcpt temporary DNS problem (from 2.0.9)
- intrusion threshold max number of allowed rcpt
- intrusion threshold max number of allowed invalid rcpt
- rejected intrusion rcpt ignored, session over intrusion threshold
- no auth resource no auth resource available
- must auth sender not authenticated/authorized (from 2.0.9)
- mbx overquota rcpt mailbox is overquota
- accepted sender sender accepted (from 2.0.9)
- accepted sender accepted any sender always (from 2.0.9)
- accepted sender accepted null sender always (from 2.0.9)
- accepted doublebounce accepted qmail doublebounce #@[] (from 2.0.9)
- rejected sender invalid sender address format
- rejected sender invalid sender MX domain
- rejected sender temporary DNS problem (from 2.0.9)
-
diff -ruN qmail/CHKUSER.manual_patching qmail-no-chkuser-vpopmail/CHKUSER.manual_patching
--- qmail/CHKUSER.manual_patching 2024-02-05 20:29:09.069233988 +0100
+++ qmail-no-chkuser-vpopmail/CHKUSER.manual_patching 1970-01-01 01:00:00.000000000 +0100
@@ -1,182 +0,0 @@
-Chkuser 2.0 manual editing
-
-Manual editing is a very simple operation.
-
-Watching the patch design, shown in the patch design page, you may see that
-only some simple changes must be done to qmail-smtpd.c and Makefile.
-
-Backup
-======
-
-Save you qmail working sources before making any change.
-
-Basic installation
-==================
-
-Download the newest release.tar package and untar it. It will create a directory
-containing all chkuser files and patches.
-
-Position in the qmail/netqmail source directory:
-
- $ cd /usr/.../netqmail-1.05
-
-Copy all the chkuser sources:
-
- $ cp /path_to_release_tar/chkuser* .
-
-edit qmail-smtpd.c
- within qmail-smtpd.c, change the following lines:
-
- At the end of initial #include declarations, add the following (+) lines:
-
- #include "timeoutwrite.h"
- #include "commands.h"
-
-+ /* start chkuser code */
-+ #include "chkuser.h"
-+ /* end chkuser code */
-
- #define MAXHOPS 100
-
-Within smtp_mail routine, add the following (+) lines
-
- void smtp_mail(arg) char *arg;
- {
- if (!addrparse(arg)) { err_syntax(); return; }
-+ /* start chkuser code */
-+ if (chkuser_sender (&addr) != CHKUSER_OK) { return; }
-+ /* end chkuser code */
- flagbarf = bmfcheck();
-
- Within smtp_rcpt routine, delete the following (-) lines and substitute
- them with the (+) ones:
-
-- if (relayclient) {
-- --addr.len;
-- if (!stralloc_cats(&addr,relayclient)) die_nomem();
-- }
-- else
-- if (!addrallowed()) { err_nogateway(); return; }
-
-+ /* start chkuser code */
-+ switch (chkuser_realrcpt (&mailfrom, &addr)) {
-+ case CHKUSER_KO:
-+ return;
-+ break;
-+ case CHKUSER_RELAYING:
-+ --addr.len;
-+ if (!stralloc_cats(&addr,relayclient)) die_nomem();
-+ if (!stralloc_0(&addr)) die_nomem();
-+ break;
-+ }
-+ /* end chkuser code */
-
- if (!stralloc_cats(&rcptto,"T")) die_nomem();
- if (!stralloc_cats(&rcptto,addr.s)) die_nomem();
- if (!stralloc_0(&rcptto)) die_nomem();
-
-edit Makefile
- Within Makefile, change or add the following lines.
-
- At the begininng of the file:
-
- # Don't edit Makefile! Use conf-* for configuration.
-
-+ VPOPMAIL_HOME=/home/vpopmail
-+ SMTPD_CHKUSER_OBJ=chkuser.o dns.o
-+ VPOPMAIL_LIBS=`head -1 $(VPOPMAIL_HOME)/etc/lib_deps` `cat dns.lib`
-
- SHELL=/bin/sh
-
- Be carefule to use the right path, if your vpopmail production home
- path is NOT "/home/vpopmail".
-
- dns.lib is added to qmail-smtpd building instructions, so, if you
- have previously patched qmail-smtpd in order to include dns.lib, take
- care to delete the duplication from the previous lines.
-
- Before "clean:" insert the chkuser.o definition:
-
- exit.h auto_spawn.h
- ./compile chkspawn.c
-+ chkuser.o: \
-+ compile chkuser.c chkuser.h chkuser_settings.h
-+ ./compile chkuser.c
-
- clean: \
-
- Beware: the "./compile chkuser.c" line has an heading TAB.
-
- Change the qmail-smtpd compiling and linking instructions,
- deleting the (-) lines and adding the (+) ones.
-
-
- qmail-smtpd: \
- load qmail-smtpd.o rcpthosts.o commands.o timeoutread.o \
- timeoutwrite.o ip.o ipme.o ipalloc.o control.o constmap.o received.o \
- date822fmt.o now.o qmail.o cdb.a fd.a wait.a datetime.a getln.a \
- open.a sig.a case.a env.a stralloc.a alloc.a substdio.a error.a str.a \
-- fs.a auto_qmail.o socket.lib
-+ fs.a auto_qmail.o socket.lib $(SMTPD_CHKUSER_OBJ)
-- ./load qmail-smtpd rcpthosts.o commands.o timeoutread.o \
-+ ./load qmail-smtpd $(SMTPD_CHKUSER_OBJ) rcpthosts.o commands.o timeoutread.o \
- timeoutwrite.o ip.o ipme.o ipalloc.o control.o constmap.o \
- received.o date822fmt.o now.o qmail.o cdb.a fd.a wait.a \
- datetime.a getln.a open.a sig.a case.a env.a stralloc.a \
-- alloc.a substdio.a error.a str.a fs.a auto_qmail.o `cat \
-- socket.lib`
-+ alloc.a substdio.a error.a str.a fs.a auto_qmail.o \
-+ $(VPOPMAIL_LIBS) \
-+ `cat socket.lib`
-
- Beware: all the lines starting from and following "./load" have an heading TAB.
-
-edit TARGETS
- Append the following blue line at the end of TARGETS file:
-
- man
- setup
- check
-+ chkuser.o
-
-edit conf-cc
- Edit conf-cc, adding the include path of production vpopmail:
-
- cc -O2 -I/home/vpopmail/include
-
- Be carefule to use the right path, if your vpopmail production home path
- is NOT "/home/vpopmail".
-
-chkuser settings
-================
-Edit chkuser_settings.h, uncommenting the options you prefer, and commenting the
-ones you don't want. Default settings should cover the most of situations.
-
-See the related settings pages for more informations.
-
-Make
-====
-Now, make (or gmake on *BSD) as your usual. No errors (just warnings)
-should come out. If you see any error, check carefully edited lines.
-
-Checking
-========
-Select a domain, contained in your rcpthosts, for which bouncing is enabled, and run:
-
- $ ./qmail-smtpd
- mail from <wrong_sender>
- mail from <right_sender>
- rcpt to: <fake_user@your_domain>
- rcpt to: <real_user@your_domain>
-
-You should see error and ok messages, depending on the addresses you typed.
-
-Install
-=======
-Copy the new executable in the /var/qmail/bin directory (or make install).
-
-Running
-=======
-This patched qmail-smtpd must be executed in a different way than the normal one.
-See the running pages for detailed instructions.
-
diff -ruN qmail/CHKUSER.readme qmail-no-chkuser-vpopmail/CHKUSER.readme
--- qmail/CHKUSER.readme 2024-02-05 20:29:09.069233988 +0100
+++ qmail-no-chkuser-vpopmail/CHKUSER.readme 1970-01-01 01:00:00.000000000 +0100
@@ -1,54 +0,0 @@
-chkuser 2.0 - README
-
-Description
-===========
-The original qmail-smtpd accepts by default all messages, checking later for
-the existence of the recipient. So, if the message is delivered to not existing
-recipients a lot of additional system work and network traffic are generated,
-with multiple expensive bouncing if the sender is a fake one.
-
-chkuser has been developed with the goal to improve the acceptance SMTP phase
-of qmail-smtpd. qmail-smtpd patched with chkuser may check the existance of
-e-mail recipients immediately in the SMTP acceptance phase of a message and
-rejects istantly all messages not directed to existing users, avoiding
-additional traffic, work and messages bounced more times.
-
-These goals are achieved enquirying the existing vpopmail archives (each
-format is supported: cdb, MySQL, LDAP, etc.) by using standard vpopmail calls,
-or using customized chkuser routines.
-
-Version 2.0 - From chkusr to chkuser
-====================================
-Version 2.0 is a lot different from previous versions, so it deserves a more
-evident change in the name.
-
-Version 2.0 has been designed with the goal to be modular, and to make more easy
-both adding new features to chkuser code and semplifing code update.
-
-Patching over original qmail files is done over a few points, while the most of
-chkuser code remains ouside, in dedicated chkuser's files.
-
-Same for settings, that are inside a dedicated chkuser_settings.h file.
-
-The intention is to semplify upgrading: for future chkuser releases, upgrading
-will require only to update chkuser specific files, leaving all the rest
-untouched, and changing chkuser_settings.h only if new features must be enabled.
-
-Logging and SPAM
-================
-chkuser 2.0 has detailed logging of accepted and refused recipients and senders,
-allowing a deep analysis of "who's sending to who". This can lead to more
-sophisticated future enhancements of anti-SPAM features.
-
-Intrusion rejection
-===================
-chkuser 2.0 can be tuned to reject sessions exceeding some recipients limits
-(limits can be set for max recipients and max not existing recipients).
-
-URL Location
-============
-For any new release, support, FAQ, mailing lists, or other information, see:
-
- http://www.interazioni.it/opensource
-
-
diff -ruN qmail/CHKUSER.running qmail-no-chkuser-vpopmail/CHKUSER.running
--- qmail/CHKUSER.running 2024-02-05 20:29:09.069233988 +0100
+++ qmail-no-chkuser-vpopmail/CHKUSER.running 1970-01-01 01:00:00.000000000 +0100
@@ -1,103 +0,0 @@
-
-CHKUSER 2.0.9 - Running instructions
-
-Chkuser may run using the most of security, following very strictly the sacurity
-model used By Dan Berstein. To achieve this goal, chkuser may switch between
-differents UID/GID, for differente purposes.
-
-However this is incompatible with TLS patches (like toaster-0.6-1), as these patches
-want to run under a unique UID/GID. Luckily, qmail is enought robust to let us
-run this way.
-
-To achieve both these goals, chkuser uses a #define (CHKUSER_ENABLE_UIDGID)
-that indicates if UID/GID switching is wanted, and running instructions must
-adapt to this way.
-
-Instead, when this define is not used, another way of running must be used.
-(Just for precision, even if the CHKUSER_ENABLE_UIDGID define is used, chkuser
-may be run without switching UID/GID).
-
-Running with UID/GID switch
-===========================
-
-If you want the most security when using chkuser, and you have enabled
-CHKUSER_ENABLE_UIDGID within chkuser_settings.h (it's enabled by default), use
-these instructions.
-
-Description.
- qmail-smtpd-chkusr must be installed (by default in /var/qmail/bin) with
- setuid (user qmaild) and setgid (group qnofiles), and executed by tcpserver
- with -u vpopmail-user and -g vchkpw-group parameters.
-
- qmail-smtpd-chkusr starts running with the original qmail-smtpd uid and gid,
- switching to needed uid and gid only for vpopmail checks on user existance,
- turning back to the starting uid and gid.
-
-Instructions.
- You have to set SUID (set-user-ID-on-execution) and SGID
- (set-group-ID-on-execution) bits on qmail-smtpd-chkusr:
- chown qmaild qmail-smtpd
- chgrp nofiles qmail-smtpd
- chmod 6555 qmail-smtpd
-
- and the result you see should be like (different size and date, of course):
- -r-sr-sr-x 1 qmaild nofiles 57056 Feb 14 18:18 qmail-smtpd-chkusr
-
- Integrate qmail-smtpd in your start files:
-
- As example, a real start command for qmail-smtpd-chkusr may be
-
- #!/bin/sh -e
- #
- # Using splogger to send the log through syslog.
-
- exec env - PATH="/var/qmail/bin:/usr/local/bin" \
- tcpserver -t 5 -v -p -x <your.tcp.smtp.cdb> \
- -u <vpopmail-user> -g <vchkpw-group> -l <your-host.domain> 0 smtp \
- qmail-smtpd-chkusr splogger smtpd &
-
- where
- <vpopmail-user> = vpopmail uid
- <vchkpw-group> = vchkpw gid
- <your-host.domain> = your host.domain (!)
- <your.tcp.smtp.cdb> = your tcp.permission.to.relay cdb
-
- NOTE: if you are using more system users for your domains, the execution
- uid (which I indicated as vpopmail) should be set to root.
-
-
-Running with fixed UID/GID
-==========================
-You may use these instructions if you've not defined CHKUSER_ENABLE_UIDGID, or if
-you want to run qmail-smtpd as unique user, despite of CHKUSER_ENABLE_UIDGID define.
-qmail-smtpd is well safe and robust, and there is no risk running it directly as
-vpopmail user, unless you use untrusted software layered down.
-
-Description.
- qmail-smtpd must be installed normally (-r-xr-xr-x) and executed by tcpserver
- with -u vpopmail-user and -g vchkpw-group parameters.
-
-Instructions.
- Integrate qmail-smtpd-chkusr in your start files:
-
- As example, a real start command for qmail-smtpd-chkusr may be
-
- #!/bin/sh -e
- #
- # Using splogger to send the log through syslog.
-
- exec env - PATH="/var/qmail/bin:/usr/local/bin" \
- tcpserver -t 5 -v -p -x <your.tcp.smtp.cdb> \
- -u <vpopmail-user> -g <vchkpw-group> -l <your-host.domain> 0 smtp \
- qmail-smtpd-chkusr splogger smtpd &
-
- where
- <vpopmail-user> = vpopmail uid
- <vchkpw-group> = vchkpw gid
- <your-host.domain> = your host.domain (!)
- <your.tcp.smtp.cdb> = your tcp.permission.to.relay cdb
-
- NOTE: if you are using more system users for your domains, the execution user
- (which I indicated as vpopmail) should be set to root.
-
-
diff -ruN qmail/Makefile qmail-no-chkuser-vpopmail/Makefile
--- qmail/Makefile 2024-06-23 16:18:00.857307333 +0200
+++ qmail-no-chkuser-vpopmail/Makefile 2024-06-23 16:43:04.893936669 +0200
@@ -1,9 +1,5 @@
# Don't edit Makefile! Use conf-* for configuration.
-VPOPMAIL_LIBS=`head -1 $(shell /bin/sh vpopmail-dir.sh)/etc/lib_deps` `cat dns.lib`
-
-SMTPD_CHKUSER_OBJ=chkuser.o dns.o
-
DEFINES=-DEXTERNAL_TODO # use to enable external todo
SHELL=/bin/sh
@@ -126,10 +122,8 @@
&&./auto-uid auto_uidq `head -6 conf-users | tail -1` \
&&./auto-uid auto_uidr `head -7 conf-users | tail -1` \
&&./auto-uid auto_uids `head -8 conf-users | tail -1` \
- &&./auto-uid auto_uidv `head -9 conf-users | tail -1` \
&&./auto-gid auto_gidq `head -1 conf-groups` \
&&./auto-gid auto_gidn `head -2 conf-groups | tail -1` \
- &&./auto-gid auto_gidv `head -3 conf-groups | tail -1` \
) > auto_uids.c.tmp && mv auto_uids.c.tmp auto_uids.c
auto_uids.o: \
@@ -328,10 +322,6 @@
exit.h auto_spawn.h
./compile chkspawn.c
-chkuser.o: \
-compile chkuser.c chkuser.h chkuser_settings.h
- ./compile chkuser.c
-
clean: \
TARGETS
rm -f `grep -v '^#' TARGETS`
@@ -1716,17 +1706,15 @@
received.o date822fmt.o now.o qmail.o spf.o dns.o cdb.a fd.a wait.a \
datetime.a getln.a open.a sig.a case.a env.a stralloc.a alloc.a substdio.a \
error.a str.a fs.a auto_qmail.o base64.o socket.lib dns.lib lock.a policy.o \
-qmail-spp.o \
-$(SMTPD_CHKUSER_OBJ)
- ./load qmail-smtpd $(SMTPD_CHKUSER_OBJ) rcpthosts.o commands.o timeoutread.o \
- strerr.a wildmat.o qregex.o \
+qmail-spp.o dns.o
+ ./load qmail-smtpd rcpthosts.o commands.o timeoutread.o \
+ strerr.a wildmat.o qregex.o dns.o \
timeoutwrite.o ip.o ipme.o ipalloc.o strsalloc.o control.o \
tls.o ssl_timeoutio.o ndelay.a -lssl -lcrypto \
constmap.o received.o date822fmt.o now.o qmail.o spf.o cdb.a \
fd.a wait.a datetime.a getln.a open.a sig.a case.a env.a stralloc.a qmail-spp.o \
alloc.a substdio.a error.a strerr.a str.a fs.a auto_qmail.o base64.o policy.o \
- $(VPOPMAIL_LIBS) \
- `cat socket.lib`
+ `cat dns.lib` `cat socket.lib`
qmail-smtpd.0: \
qmail-smtpd.8
@@ -1738,7 +1726,7 @@
error.h ipme.h ip.h ipalloc.h strsalloc.h ip.h gen_alloc.h ip.h qmail.h qmail-spp.h \
substdio.h strerr.h str.h fmt.h scan.h byte.h case.h env.h now.h datetime.h \
exit.h rcpthosts.h timeoutread.h timeoutwrite.h commands.h spf.h dns.h base64.h \
-cdb.h chkuser.h
+cdb.h
./compile qmail-smtpd.c
qmail-start: \
@@ -2497,7 +2485,7 @@
update_tmprsadh: \
conf-qmail conf-users conf-groups update_tmprsadh.sh
@cat update_tmprsadh.sh\
- | sed s}UGQMAILD}"`head -9 conf-users|tail -1`:`head -3 conf-groups|tail -1`"}g \
+ | sed s}UGQMAILD}"`head -2 conf-users|tail -1`:`head -1 conf-groups|tail -1`"}g \
| sed s}QMAIL}"`head -1 conf-qmail`"}g \
> $@
chmod 755 update_tmprsadh
diff -ruN qmail/TARGETS qmail-no-chkuser-vpopmail/TARGETS
--- qmail/TARGETS 2024-02-06 14:01:02.305219003 +0100
+++ qmail-no-chkuser-vpopmail/TARGETS 2024-06-23 12:18:34.270042236 +0200
@@ -421,7 +421,6 @@
qmail-todo.o
qmail-todo
update_tmprsadh
-chkuser.o
qmail-dkim
qmail-dkim.o
libdkim.a
diff -ruN qmail/chkuser.c qmail-no-chkuser-vpopmail/chkuser.c
--- qmail/chkuser.c 2024-02-11 20:03:20.010324339 +0100
+++ qmail-no-chkuser-vpopmail/chkuser.c 1970-01-01 01:00:00.000000000 +0100
@@ -1,1309 +0,0 @@
-/*
- *
- * 'chkuser.c' v.2.0.9
- * for qmail/netqmail > 1.0.3 and vpopmail > 5.3.x
- *
- * Author: Antonio Nati tonix@interazioni.it
- * All rights on this software and
- * the identifying words chkusr and chkuser reserved by the author
- *
- * This software may be freely used, modified and distributed,
- * but this lines must be kept in every original or derived version.
- * Original author "Antonio Nati" and the web URL
- * "http://www.interazioni.it/opensource"
- * must be indicated in every related work or web page
- *
- */
-
-#include <pwd.h>
-
-/* required by vpopmail */
-#include <stdio.h>
-
-#include <ctype.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#include "case.h"
-#include "dns.h"
-#include "env.h"
-#include "ipme.h"
-#include "now.h"
-#include "str.h"
-#include "open.h"
-#include "subfd.h"
-#include "substdio.h"
-#include "stralloc.h"
-
-#include "vpopmail.h"
-#include "vauth.h"
-#include "vpopmail_config.h"
-
-#include "chkuser.h"
-#include "chkuser_settings.h"
-
-#if defined _exit
-#undef _exit
-#endif
-
-extern void flush();
-extern void out (char *s);
-extern int addrallowed();
-extern unsigned int byte_rchr();
-extern int vmaildir_readquota(const char *dir, const char *quota);
-
-extern char *remotehost;
-extern char *remoteip;
-extern char *remoteinfo;
-extern char *relayclient;
-extern char *fakehelo;
-
-extern void die_nomem();
-
-#define DIE_NOMEM() die_nomem()
-
-#if defined CHKUSER_DEBUG
-
-#if defined CHKUSER_DEBUG_STDERR
-
-#define CHKUSER_DBG(a) write (STDERR_FILENO, a, strlen (a))
-#define CHKUSER_DBG_INT(a) { int x; char str[30]; sprintf (str, "%d", a); write (STDERR_FILENO, str, strlen (str));}
-
-#else
-
-#define CHKUSER_DBG(a) write (STDOUT_FILENO, a, strlen (a))
-#define CHKUSER_DBG_INT(a) { int x; char str[30]; sprintf (str, "%d", a); write (STDOUT_FILENO, str, strlen (str));}
-
-#endif
-#else
-
-#define CHKUSER_DBG(a) /* DBG dummy */
-#define CHKUSER_DBG_INT(a) /* DBG dummy */
-
-#endif
-
-static int intrusion_threshold_reached = 0;
-static int first_time_init_flag = 1;
-
-static int recipients = 0;
-static int wrong_recipients = 0;
-
-static stralloc user = {0};
-static stralloc domain = {0};
-static stralloc domain_path = {0};
-static stralloc tmp_path = {0};
-static stralloc alias_path = {0};
-
-#if defined CHKUSER_IDENTIFY_REMOTE_VARIABLE
- static char *identify_remote;
-#endif
-
-#if defined CHKUSER_ENABLE_EXTENSIONS
-#define CHKUSER_ENABLE_USERS_EXTENSIONS
-#endif
-
-#if defined CHKUSER_ENABLE_LISTS
-#define CHKUSER_ENABLE_EZMLM_LISTS
-#endif
-
-#if defined CHKUSER_EXTENSION_DASH
-#define CHKUSER_USERS_DASH CHKUSER_EXTENSION_DASH
-#endif
-
-
-#if defined CHKUSER_ENABLE_VALIAS
-#error "chkuser setting error: CHKUSER_ENABLE_VALIAS has been substituted by VALIAS (within vpopmail includes); you don't need anymore this define"
-#endif
-
-#if defined CHKUSER_ENABLE_VAUTH_OPEN
-#error "chkuser setting error: CHKUSER_ENABLE_VAUTH_OPEN has been substituted by CHKUSER_ENABLE_VAUTH_OPEN_CALL; edit chkuser_settings.h and change your settings"
-#endif
-
-#if defined CHKUSER_ENABLE_VAUTH_OPEN_CALL
- static int db_already_open = 0;
-#endif
-
-#if defined CHKUSER_ALWAYS_ON && defined CHKUSER_STARTING_VARIABLE
-#error "chkuser setting error: CHKUSER_ALWAYS_ON and CHKUSER_STARTING_VARIABLE are mutually esclusive. Edit your chkuser_settings.h and disable one of them"
-#endif
-
- static int starting_value = 0;
-
-#if defined CHKUSER_STARTING_VARIABLE
- static char *starting_string = 0;
-#endif
-
-#if defined CHKUSER_EXTRA_MUSTAUTH_VARIABLE
- static int mustauth_value = 0;
-#endif
-
-
-#if defined CHKUSER_RCPT_LIMIT_VARIABLE
- static char *maxrcpt_string = 0;
- static int maxrcpt_limit = 0;
- static int maxrcpt_limit_reached = 0;
-#endif
-
-#if defined CHKUSER_DISABLE_VARIABLE
- static char *chkuser_disable_variable = 0;
-#endif
-
-#if defined CHKUSER_WRONGRCPT_LIMIT_VARIABLE
- static char *maxwrongrcpt_string = 0;
- static int maxwrongrcpt_limit = 0;
- static int maxwrongrcpt_limit_reached = 0;
-#endif
-
-#if defined CHKUSER_MBXQUOTA_VARIABLE
- static char *maxmbxquota_string = 0;
- static int maxmbxquota_limit = 0;
-#endif
-
- static unsigned int sender_nocheck = 0;
- static char *sender_nocheck_variable = 0;
-
-#if defined CHKUSER_SENDER_FORMAT || defined CHKUSER_SENDER_MX
-static stralloc sender_user = {0};
-static stralloc sender_domain = {0};
-#endif
-
-#if defined CHKUSER_ENABLE_DOUBLEBOUNCE_VARIABLE
-static unsigned int enable_doublebounce = 0;
-#endif