hotmail sends bare LF that rejected by qmail

[YaserU]

I did everything. But i don't receive any e-mail from mailservers (hotmail, gmail, yahoo). I could not receive only from hotmail before fixcrio

any idea? sorry my english is terrible.

 

[jjjl]

It works. Thank you.

@jjjl --- you need to implement the TLS patch to fixcrio.

When your server communicates with another server using qmail it will use TLS, and fixcrio (without the TLS patch) breaks TLS.

Faris.

It works. Thank you.

 

[omerk]

it's not working for me. When I did these steps, my SMTP Server (QMail) is stopping and not working anymore. I remove fixcrio from smtp_psa and restart xinetd but smtp server qmail not working anymore.
Is there any other solution?

 

[realaaa@]

YaserU, omerk, I'm not sure what went wrong in your case. I can only advise to double-check everything and make sure that the compiled binary is OK and can be executed:

# ls -l fixcrio
-rwxr-xr-x 1 root root 13424 Oct 14 10:59 fixcrio

# file fixcrio
fixcrio: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU/Linux 2.2.5, dynamically linked (uses shared libs), stripped

# ldd ./fixcrio
libc.so.6 => /lib/tls/libc.so.6 (0x00230000)
/lib/ld-linux.so.2 (0x00216000)

# ./fixcrio
fixcrio: usage: fixcrio program [ arg ... ]

Also check permissions/ownership of the binary and if nothing helps - check your maillog, the error output should be there.

 

[trialotto]

TLS Compliance, TCP server and ownership

Attached is fixcrio.txt. This is a version of fixcrio.c but with the TLS patch applied.

Rename from fixcrio.txt to fixcrio.c and use this one instead of the fixcrio.c that you already have.

Compile it and install it like you did before, restart xinetd and all should be well.

Check your maillog for errors.


Faris.

The patch is for TLS.

Therefore, I have three small questions/remarks:

1 - TLS compliance
In the posts, only smtp_psa and submission_psa are mentioned. However, TLS compliance is suggested when applying the patch and compiling with the patch.

Does that imply that smtps_psa can changed, just as smpt_psa is changed?

I suppose so, but it seems to be to obvious.....

2 - Ownership of fixcrio
In the KB of parallels, the following article is discussing the same issue. Over there, the ownership of fixcrio is root:qmail, as a normal qmail configuration would require. In your posts and that of realaaa@, ownership is root:root.

It should not make a real difference.

However, i am curious why you use those ownership rights. Maybe that can also be the cause of problems for YaserU and omerk.

3 - Compiling of ucspi-tcp
In essence, we are compiling the tcp server that is propagated by the creator of qmail and that is the favorite of hard-core qmail users.

In plesk set-up, qmail is not running over tcpserver. In plesk, the associated helper program is xinetd.

The patch involving fixcrio is again hinting the preference for tcpserver and the associated packages.

Compiling the packages and installing them ascertains that at least fixcrio is installed. Nice, but also other programs are installed.

Most of these programs are double and can interfere with the qmail-programs that are installed by Plesk Qmail. Since Plesk is using a tweeked and customized program, differences are sure to be present and problems can be arising.

Hence: people confronted with problems when installing fixcrio should be analyzing whether their compilation of files does not interfere with already installed (qmail) files.

Therefore, a small question to faris and realaaa@: did you ascertain that no interference has been occurring ?

Another BIG question for Parallels should be this: why are these patches (such as fixcrio) not being offered as an update?

 

[trialotto]

Rejection of Hotmail by Qmail: LF versus other causes

Qmail can discard mail from hotmail domains for various reasons.

In this thread, an excellent solution is given for the problem of the sort:

"possible qmail-smtpd exited by timeout, reset connection or with "See http://pobox.com/~djb/docs/smtplf.html."

However, hotmail mail will also be rejected for other unclear reasons.

Problem: Not getting hotmail mail (from one or more hotmail servers) and not getting error of the kind above
Cause: DEFER status on the greylisting filter of qmail
Solution: just add hotmail.com as a trusted domain to the grey list, with the command:

/usr/local/psa/bin/grey_listing -u -domains-whitelist add:*hotmail.com

Note: from the perspective of spamming, this may be somewhat dangerous. You can be more specific by allowing specific hotmail adresses, fine-tuning spam filters, or even installing spamdyke.

Advice: do not compile and install fixcrio solution when you do not get the timeout problem mentioned above (even though fixcrio cannot do harm).

 

[Boreas]

Hi,

Is there a way or is it possible for plesk qmail to disable TLS ? fixcrio work great but even with the successful fixcrio.c TLS patch TLS_connection_failed errors remains. Thanks

 

[realaaa@]

Does that imply that smtps_psa can changed, just as smpt_psa is changed?

As I understand:

1) If you used regular fixcrio sources with no TLS patch you can only add it to smtp_psa and submission_psa
2) If you patched fixcrio sources with TLS patch then you can use it in smtp_psa, submission_psa AND smtps_psa

In the KB of parallels, the following article is discussing the same issue. Over there, the ownership of fixcrio is root:qmail, as a normal qmail configuration would require. In your posts and that of realaaa@, ownership is root:root.

Please check my post again - it should be root:qmail. Not sure if qmail group really matters though.

Compiling the packages and installing them ascertains that at least fixcrio is installed. Nice, but also other programs are installed.

Therefore, a small question to faris and realaaa@: did you ascertain that no interference has been occurring ?

And again - please check my post

I did not say anything about installing the entire ucspi-tcp package,did I? We only need fixcrio from it, nothing else.

So - we just compile and copy this binary to /var/qmail/bin/ and add it to smtp_psa, submission_psa (and possibly smtps_psa). No other parts of Plesk qmail installation are modified so that's about all the interference you get.

Sorry if it was not clear from my original post.

Another BIG question for Parallels should be this: why are these patches (such as fixcrio) not being offered as an update?

Of course I can't answer for Parallels, but let me try

The problem is actually on Hotmail side, so THEY should fix their servers and stop sending e-mails with bare LF. And I think it is not correct to patch Plesk qmail by default, this should be decided and implemented by server admin.

But it might be a good idea to have an option in Plesk CP to turn fixcrio on and off, I guess that would satisfy everybody.

 

[realaaa@]

Hi,

Is there a way or is it possible for plesk qmail to disable TLS ? fixcrio work great but even with the successful fixcrio.c TLS patch TLS_connection_failed errors remains. Thanks

If you really do not want to accept e-mails over TLS you can set "disable" to "yes" in smtps_psa or just move this file out from /etc/xinetd.d/

don't forget to restart xinetd afterwards

# cat /etc/xinetd.d/smtps_psa
service smtps
{
socket_type = stream
protocol = tcp
wait = no
disable = no
user = root
instances = UNLIMITED
env = SMTPAUTH=1
server = /var/qmail/bin/tcp-env
server_args = -Rt0 /var/qmail/bin/relaylock /var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/qmail/bin/true
}

 

[faris]

TLS ports:

qmail to qmail comms with TLS seems to occur on port 25: I only ever added fixiocr to smtp_psa and that in itself broke qmail to qmail comms (until I applied the patch).

I do't really know anything about TLS so I can't comment on the details of why/what/when.

Faris.

 

[Yulia Kostina]

Here is the article regarding this:

http://kb.odin.com/en/6763

 

[Tim Jakobi]

I am having the same problems with qmail.
I tried to install fixcrio but then get a compile error. It is not the same as mentioned above.

My server is a: openSUSE 11.0, incl. Plesk 9.0 x86-64, Hostname: h1630936.stratoserver.net, IP-Adress: 85.214.21.220, Plesk version: 9.2.3

I am getting the following error:

./load tcpserver rules.o remoteinfo.o timeoutconn.o cdb.a \
dns.a time.a unix.a byte.a `cat socket.lib`
/usr/lib64/gcc/x86_64-suse-linux/4.3/../../../../x86_64-suse-linux/bin/ld: errno: TLS definition in /lib64/libc.so.6 section .tbss mismatches non-TLS reference in tcpserver.o
/lib64/libc.so.6: could not read symbols: Bad value
collect2: ld returned 1 exit status
make: *** [tcpserver] Error 1

Who can give me suppot?
greets Tim

 

[trialotto]

Tim,

install the fixcrio WITH TLS patch.......that should do the trick (your error indicates that you use an unpatched variant of fixcrio). Patch is given at the kb.odin.com and in this thread.

 

[Tim Jakobi]

Hi trialotto,
I did it with the patched fixcrio.c version. I did it again, but the error output is the same. The ownerships are root:root, most file rights are 644 only: chkshsgr, choose, compile, load and makelib are 755. So it looks okay. What about my 64bit machine. Any known problems or differences between your tests?

here is my roadmap from site:

Step: 1.
Download the ucspi-tcp package. The latest published ucspi-tcp package is ucspi-tcp-0.88.tar.gz.
my document folder is:
/home
wget http://cr.yp.to/ucspi-tcp/ucspi-tcp-0.88.tar.gz

Step: 2.
Unpack the ucspi-tcp package:
tar -xf ucspi-tcp-0.88.tar
cd ucspi-tcp-0.88

Step: 3.
Compile the ucspi-tcp programs:
make

=> error occur !

P.S .I have to say, that I am a linux newbie. So if my questions sounds curious, I thanks for any detailed answers. Many greets Tim

 

[trialotto]

Tim,

It is not clear whether your error occurs on build (of fixcrio) or on running qmail.

If the error occurs on build: Did you follow the instructions on the kb of parallels? visit http://kb.odin.com/en/6763 to check....

In case you follow the steps on the kb and the error persists, mail me and I will send you the fixcrio compiled program by mail, so we can test that compiled program.

If the error occurs on running qmail, please send me a mail with a complete building log and a complete mail log (the latter being more important).

Kind regards....

 

[Justin Clarke]

Tim,

It is not clear whether your error occurs on build (of fixcrio) or on running qmail.

If the error occurs on build: Did you follow the instructions on the kb of parallels? visit http://kb.odin.com/en/6763 to check....

In case you follow the steps on the kb and the error persists, mail me and I will send you the fixcrio compiled program by mail, so we can test that compiled program.

If the error occurs on running qmail, please send me a mail with a complete building log and a complete mail log (the latter being more important).

Kind regards....

I am getting the same problem as Tim when compiling fixcrio. When I run a "make" it errors. This happens with or without replacing fixcrio.c with the patched version from the Parallels fix..

Any ideas or help appreciated. Thanks.

 

[Justin Clarke]

Right, fixed it!

If you get any error to do with "errno" when compiling then type:
grep -rs "extern int errno" *

This will show you any files which have an invalid line of code.

Next edit that file (it's called error.h in this instance) and delete the line:
extern int errno;

and replace it with:
#include <errno.h>

Then you should be able to run your "make" and "make setup".

 

[Justin Clarke]

Attached is fixcrio.txt. This is a version of fixcrio.c but with the TLS patch applied.

Rename from fixcrio.txt to fixcrio.c and use this one instead of the fixcrio.c that you already have.

Compile it and install it like you did before, restart xinetd and all should be well.

Check your maillog for errors.


Faris.

Can't get this patched version to work with TLS (even though it's supposed to be patched to work with TLS).

Anyone got a compiled fixcrio that does work with TLS that I can try?

This solution works fine for non-TLS, and works really well, just struggling with TLS.

Thanks.