Re: replacing tcpserver

On Tue, May 18, 2004 at 08:50:19PM +0000, Karim El Chenawi wrote:
> A possible solution is to enforce users to authorize themselves before
> allowing to relay like you suggest. But my ideal solution would be to
> have tcpsvd consult a mysql database relay table (updated by vpopmail
> vchkpw) instead of the tcp.smtp.cdb file. This is my current
> configuration with tcpserver + Matt Simerson's mysql patch. The reason
> I can't stick with tcpserver is that I'm starting to have real trouble
> with clients tying up all smtp connections leaving no room for
> legitimate users. I'll check your code to see if this is possible.

You didn't mention mysql in your first post.  I don't use it, and,
unfortunately, chances that patches dealing with mysql are accepted to
my projects are very low.

This is how I would set up a pop-before-smtp, or apop-before-ssh, or
imap-before-rsync, ...,  service.

Have the smtp service program run under tcpsvd, e.g.:
 #!/bin/sh
 exec 2>&1
 exec softlimit -m3000000 \
   env PATH="/var/qmail/bin:$PATH" \
     SMTPGREETING=smarden.org \
     MAILRULES=/var/qmail/smtp/mailrules \
   tcpsvd -vvh -i./peers -t180 -uqmaild \
     -c40 -C'10:421 per host concurrency limit reached\r\n' \
       0 25 smtpfront-qmail

Create a dot-file in the instructions directory that causes the
RELAYCLIENT variable to be set
 # echo '+RELAYCLIENT=' >/service/smtp/peers/.relayclient
 # chmod 644 /service/smtp/peers/.relayclient

Put all users allowed to use your pop service into a system group,
adjust permissions accordingly, and adjust the smtp service's ipsvd
instructions through the pop service, e.g.:
 #!/bin/sh
 exec softlimit -m 4000000 \
   tcpsvd -v 0 110 \
     /var/qmail/bin/qmail-popup `cat /var/qmail/control/me` \
       checkpw sh -c '
         echo "login: $USER $TCPREMOTEIP" >&7
         ln -s .relayclient /service/smtp/peers/"$TCPREMOTEIP"
         exec /var/qmail/bin/qmail-pop3d Maildir
       ' 2>&1 7>&1

Currently you need to cleanup older files in the instructions directory
separately, as tcpsvd only removes a file if it gets a connection
request from the corresponding ip address after the timeout is exceeded.

Alternatively you can use pop-before-dyndns or so, and use the ipsvd
``='' instructions for dyndns support.

Note that any service-before-service opens a time window, and is not a
real authentication; always subject to a race.

Regards, Gerrit.