QMail - SPF-Patch

Becks · Tux's lil' helper Joined: 06 Dec 2002 Posts: 90

Due to spam several bigger companies are working on a solution of this. One meight be spf - sender permitted from (more info: google).

On heise.de someone posted a link of a patch for qmail smtpd:
http://www.saout.de/misc/qmail-spf-latest.patch

Alex

chtephan · Posted: Tue Feb 03, 2004 5:16 pm Post subject:

I've set up a web page:

http://www.saout.de/misc/spf/

If anyone needs a patch for gentoo qmail, feel free to ask.

(actually, I've go one here that combines spf + mfcheck on top of qmail-1.03-r15 *and* fixes the broken TLS_BEFORE_AUTH #ifdefs...)

The patch is fully functional and can be configured to do nothing or to just add headers. So it's safe for integration into an official package.
It's mentioned as one of the "official" qmail patches on the SPF download site.

Probably interesting with logging and statistics.

Please look at http://spf.pobox.com/ and the spf-discuss@v2.listbox.com list archive.

Meng Weng Wong wants to start the experimental phase where as much feedback should be gathered as possible.

chtephan · Posted: Tue Feb 03, 2004 5:23 pm Post subject:

Ok, I rediffed the patch:

http://www.saout.de/misc/spf/qmail-1.03-r15-spf-pre2.patch

applies on top of qmail-1.03-r15

and

http://www.saout.de/assets/qmail-1.03-r15-tlsbefore-fix.patch

makes USE=notlsbeforeauth actually work

(#ifdef TLS && TLS_BEFORE_AUTH doesn't work, but this does: #if defined(TLS) && defined(TLS_BEFORE_AUTH))

: It's the one that works now.

robbat2 · Developer Joined: 19 Feb 2003 Posts: 82

thanks guys. I'm the qmail maintainer, and these will definetly go in, i just traced the TLS_BEFORE_AUTH problem today, as I've been quite busy with schoolwork etc. lately.

does that qmail-1.03-r15-spf-pre1.patch you posted only have SPF and _not_ mfcheck or does it include the mfcheck that you mentioned?

also, would you mind if your URLs for the patches is placed directly into the SRC_URI (it will be mirrored on the gentoo mirrors, but we're trying to make sure things have clean external sources in case of data loss somewhere.)?

the #ifdef thing comes from a much older GCC, where it got treated as an expression and evaluted before the define check kicked in, so it worked there.

chtephan · Posted: Wed Feb 04, 2004 11:31 am Post subject:

I rediffed it without mfcheck, it's only SPF.

And sure, you can use the URL, I can let the files stay around.

: In case you want to have the patch elsewhere in the patch chain, just tell me so I can rediff it.

robbat2 · Developer Joined: 19 Feb 2003 Posts: 82

thanks.
it will probably go into -r16 on sunday or monday evening (got a few exams and assignments due before then).

chtephan · Posted: Wed Feb 04, 2004 12:20 pm Post subject:

Can I ask two more questions?

diff -Nur /var/qmail/supervise/qmail-pop3d/run supervise/qmail-pop3d/run
--- /var/qmail/supervise/qmail-pop3d/run 2004-01-31 22:57:14.000000000 +0100
+++ supervise/qmail-pop3d/run 2004-02-02 19:55:54.000000000 +0100
@@ -9,6 +9,7 @@
SERVICE=pop3
source /var/qmail/bin/qmail-config-system && \
exec /usr/bin/softlimit ${SOFTLIMIT_OPTS} \
+ ${QMAIL_TCPSERVER_PRE} \
/usr/bin/tcpserver ${TCPSERVER_OPTS} -x ${TCPSERVER_RULESCDB} \
-c ${MAXCONN} \
${TCPSERVER_HOST} ${TCPSERVER_PORT} \

Forgot this one?

diff -Nur /var/qmail/supervise/qmail-smtpd/run supervise/qmail-smtpd/run
--- /var/qmail/supervise/qmail-smtpd/run 2004-01-31 22:57:14.000000000 +0100
+++ supervise/qmail-smtpd/run 2004-02-02 19:55:54.000000000 +0100
@@ -8,7 +8,7 @@
# modification can be make possible via the configuration files
SERVICE=smtp
source /var/qmail/bin/qmail-config-system && \
-exec /usr/bin/softlimit ${SOFTLIMIT_OPTS} \
+eval exec /usr/bin/softlimit ${SOFTLIMIT_OPTS} \
${QMAIL_TCPSERVER_PRE} \
/usr/bin/tcpserver ${TCPSERVER_OPTS} -x ${TCPSERVER_RULESCDB} \
-c ${MAXCONN} -u ${QMAILDUID} -g ${NOFILESGID} \

I need this so that I can use brackets around arguments in QMAIL_SMTP_PRE, because I do this:

QMAIL_SMTP_PRE="${QMAIL_SMTP_PRE} rblsmtpd \
-a rbl.intern \
-b -r 'bl.spamcop.net:Spam blocked see: http://spamcop.net/bl.shtml?%IP%' \
-b -r 'relays.ordb.org:Blackholed by ORDB -- see http://ordb.org/lookup/?host=%IP%' \
"

Is there something that can be done about it?

robbat2 · Developer Joined: 19 Feb 2003 Posts: 82

yeah, i missed the first item there. my bad.

for the second item however, i'll look up a better solution than eval exec as that's not very clean.

teilo · Posted: Thu Feb 05, 2004 2:46 am Post subject:

Thank you, gentlemen.

USE=notlsbeforeauth now works for me.

This would be the first gentoo bug (40010) in which I had active, albeit minor, participation. Here's to many more.
_________________
Teilo who is called Teilo

chtephan · Posted: Thu Feb 05, 2004 7:16 pm Post subject:

Three minor updates:

http://www.saout.de/misc/spf/qmail-1.03-r15-spf-pre2.patch

Q · Posted: Thu Feb 05, 2004 8:07 pm Post subject:

I apologise for tacking this on to the end of a different subject but I seem to be in distinguished company.

I have qmail r13 running with courier-imap 2.12-r1. I only use the SSL service

I have had no success in setting up relay-ctrl.I have done as specified in the conf-smtpd. When I do I can no longer login to imap-ssl.

Any help greatly appreciated
_________________
AMD 64 3200
Shuttle SN85G4/NForce 3 Chipset

chtephan · Posted: Thu Feb 05, 2004 9:34 pm Post subject:

I need to apologize.

My first rediff for gentoo was broken... the -pre2 actually compiles.

chtephan · Posted: Fri Mar 12, 2004 4:39 pm Post subject:

Minor cleanups: http://www.saout.de/misc/spf/qmail-1.03-r15-spf-rc1.patch

BassHombre · n00b Joined: 11 Jan 2004 Posts: 9 Location: Denver, CO

What's the status of the -r16 qmail ebuild? Is this SPF patch still going in? I'd love to start checking SPF records on my mail server.

Hollow · Posted: Tue Jul 27, 2004 5:46 pm Post subject:

i changed the qmail ebuild to fit my needs, also includes the rc2 patch (i'm not able to rediff the rc3, cause i can't get failed hunks in qmail-smtp.c to work, you're welcome to help), and 3 new use flags for checkpassword, cmd5checkpw and dot-forward, for those who don't need this (virtual mail hosting etc)

tecknojunky · Posted: Fri Jul 30, 2004 10:52 pm Post subject:

This new paradigm is more tha welcome.

Setting up spf TXT was easy on zoneedit.com, so at least no one can forge mails on the bahalfs of my domains.

Thanks for the ebuild. I will most certainly try it on a test box which currently is an old mirror of my current mail server.

I'll keep you posted of any woes. No news = good news.
_________________
(7 of 9) Installing star-trek/species-8.4.7.2::talax.

Gaspode · n00b Joined: 02 Oct 2004 Posts: 36

What's the current status of SPF for Gentoo's qmail? Last time I checked (earlier today ;-)

), it was still not in qmail-1.03-r15 or r16... are there any plans to implement it, or has that idea silently died?

radulucian · Posted: Wed Oct 12, 2005 9:07 am Post subject: qmail spf in ebuild anyone ?

another 9 months have passed since the last question on this thread.

any news on being able to do sometime soon something like:

ito · n00b Joined: 22 Jul 2002 Posts: 27

magic919 · Posted: Sun Nov 06, 2005 6:06 pm Post subject:

I think the News page on http://www.openspf.org/news.html says it all. Nothing in 2005.

SPF has not died as an idea but suffers from a general lack of implementation. I see more use of sender callout in my SMTP logs than i used to.

hegga · Apprentice Joined: 04 Jun 2003 Posts: 210 Location: Norway

any news when the spf patch for qmail will be available in portage?
seems that this has taken some time...
_________________
hegga

puke · Tux's lil' helper Joined: 05 Oct 2002 Posts: 128

Has anyone looked at this opinion piece? It recommends domainkeys over SPF. I've tried to get domainkeys working but it seems like I can't get qmail-dk to compile properly. Anyone had any success with this?