Prevention of misuse of the mail relay scheme under QMail system (4)

Relay means that the server accepts the client's SMTP request and forwards the messages sent by the client to a third party. QMail control relay is very simple, as long as the client access to the SMTP process environment variable contains (relayclient= "") to allow relay, or reject. The implementation method is to set the IP relay (relayclient= "") that needs to be in the/ETC/TCP.SMTP, and then generate the rule table with Tcprules. Because this article is to implement the relay after SMTP authentication, do not need any IP to pre-set, so the default rule set to "relay only for this server." The/ETC/TCP.SMTP content should be:

127.0.0.1:allow,relayclient= ""
: Allow

To regenerate a new tcp.smtp.cdb file:

/usr/local/bin/tcprules/etc/tcp.smtp.cdb/etc/tcp.smtp.tmp </ETC/TCP.SMTP

5. Set the/HOME/VPOPMAIL/BIN/VCHKPW setuid and Setgid

This is important, otherwise the certification will not pass. This is because the SMTPD process is performed by Qmaild. The password validator was originally used only in the POP3 process, executed by root or vpopmail, to read the password in shadow or the database, and to remove the user's Mail directory. These operations qmaild do not have permission to do so. If the SMTP process wants to invoke the password validator, you must use Setuid and setgid. In fact, this can be assured, these two password authentication programs are with the source code, itself is very safe, just want to put in a safe directory can be set up other users, in addition to Qmaild executable do not have the right to execute; in fact, if there is no other shell account, it is not so troublesome.

chmod 4755/HOME/VPOPMAIL/BIN/VCHKPW

6. Modify SMTPD Start command line

#!/bin/sh
Qmailduid= ' Id-u qmaild '
Nofilesgid= ' Id-g qmaild '
Exec/usr/local/bin/softlimit-m 2000000
/usr/local/bin/tcpserver-v-p-x/etc/tcp.smtp.cdb
-U $QMAILDUID-G $NOFILESGID 0 smtp/var/qmail/bin/qmail-smtpd 2>&1

To

#!/bin/sh
Qmailduid=qmaild
Nofilesgid=nofiles
Exec/usr/local/bin/softlimit-m 2000000
/usr/local/bin/tcpserver-h-r-l 0-t 1-v-p-x/etc/tcp.smtp.cdb
-U $QMAILDUID-G $NOFILESGID 0 smtp/var/qmail/bin/qmail-smtpd
/home/vpopmail/bin/vchkpw/bin/true/bin/cmd5checkpw/bin/true 2>&1

7. Some other settings:

Set Vpopmail user directory until/directory can be read by any user;

8. Reboot QMail

/etc/rc.d/init.d/qmailstart stop
/etc/rc.d/init.d/qmailstart start

9. Client Testing

Use the outlookexpress and Netscape 4.6 version of the mail software on the client for testing.