qmail-local transport

[Ron Bickers]

Howdy all,

I'm in the process of considering migrating from qmail to Postfix, but the
biggest roadblock is the lack of dot-qmail behavior and the many ezmlm lists
my customers have. FYI, I have 7 years of experience with qmail, and about
1 week with Postfix, though I've managed to understand a good bit of how
Postfix works.

After reading all I could find on this subject, I toyed with using the
qmail-local program as a transport and I have what appears to be a working
solution without having to run any qmail daemons.

I have an unmodified mini-qmail installation per
http://cr.yp.to/qmail/mini.html with qmqpservers containing 127.0.0.1.

In Postfix, I've enabled qmtpd and set qmqpd_authorized_clients.

In master.cf I defined a qmail-local transport as follows:

qmail-local unix - n n - - pipe
user=postqml argv=/usr/bin/sudo -u $user -H
/usr/local/libexec/postqmail-local ${mailbox} ${extension}
${nexthop} ${sender}

That's one part I wish could be different, but I don't know any other way.
I don't know if/how I can run a transport under the recipient user, and I
can't run it as root with something like setuidgid, so I setup a user
(postqml) and allow him to sudo to any user and run postqmail-local. I
previously tried qmail-local as a mailbox_command so It would run as the
recipient user, but quickly found out that wouldn't fly due to the headers
added by the local transport.

/usr/local/libexec/postqmail-local contains the following:

#!/bin/sh
# $1 = $LOCAL
# $2 = $EXTENSION
# $3 = $DOMAIN
# $4 = $SENDER
/usr/local/bin/seekablepipe /var/qmail/bin/qmail-local -- "$USER" "$HOME"
"$1" "${2:+-}" "$2" "$3" "$4" ./Maildir/
e=$?
(($e == 111)) && exit 75
(($e == 100)) && exit 77
exit $e

It runs qmail-local and converts qmail-style exit codes to the Postfix
equivalents. I stole the codes from TMDA; I have zero knowledge of Postfix
exit codes, but this seems to do the job.

I defined transport_maps as a regexp table and selectively choose the
recipient addresses to use the qmail-local transport, though it appears that
I could set local_transport for a global effect. I'm mostly interested in
this as a migration tool, so I don't particularly want it global.

I'm running ezmlm-idx-0.53-40, without QMQP support enabled. It appears
that the mini-qmail setup (where qmail-queue is a symlink to qmail-qmqpc)
works just fine.

Based on my tests, everything works as I would expect, but I'd like some
feedback to see what might be wrong that I don't see and if it could be
improved.

Thanks!

[Magnus Bäck]

On Saturday, January 10, 2004 at 01:47 CET,

Post by Ron Bickers
I'm in the process of considering migrating from qmail to Postfix, but
the biggest roadblock is the lack of dot-qmail behavior and the many
ezmlm lists my customers have. FYI, I have 7 years of experience with
qmail, and about 1 week with Postfix, though I've managed to
understand a good bit of how Postfix works.

Out of curiosity -- why the switch?

[...]

Post by Ron Bickers
It runs qmail-local and converts qmail-style exit codes to the Postfix
equivalents. I stole the codes from TMDA; I have zero knowledge of
Postfix exit codes, but this seems to do the job.

Postfix uses the exit codes defined in sysexits.h. One wonders why qmail
doesn't adher to that standard.

[...]

--=20
Magnus B=E4ck
***@dsek.lth.se

[Ron Bickers]

Post by Magnus Bäck

Post by Ron Bickers
I'm in the process of considering migrating from qmail to Postfix,

Out of curiosity -- why the switch?

It just isn't meeting my needs anymore, and after more than 5 years with =
no
updates and no sign of a future, I don't see that changing. I'm
increasingly having to deal with half-baked solutions to SPAM as it simpl=
y
doesn't have the tools that other maintained MTAs have without patching l=
eft
and right.

--=20
Ron Bickers
Logic Etc, Inc.

[Wietse Venema]

Post by Ron Bickers
qmail-local unix - n n - - pipe
user=postqml argv=/usr/bin/sudo -u $user -H
/usr/local/libexec/postqmail-local ${mailbox} ${extension}
${nexthop} ${sender}
That's one part I wish could be different, but I don't know any other way.
I don't know if/how I can run a transport under the recipient user, and I
can't run it as root with something like setuidgid, so I setup a user
(postqml) and allow him to sudo to any user and run postqmail-local. I

To run a mail delivery program with the recipient's privileges,
invoke it from the recipient's .forward file (or specify it in
main.cf as a mailbox_command).

Post by Ron Bickers
previously tried qmail-local as a mailbox_command so It would run as the
recipient user, but quickly found out that wouldn't fly due to the headers
added by the local transport.

....

Post by Ron Bickers
equivalents. I stole the codes from TMDA; I have zero knowledge of Postfix
exit codes, but this seems to do the job.

See /usr/include/sysexits.h

Wietse

[Ron Bickers]

Post by Wietse Venema
To run a mail delivery program with the recipient's privileges,
invoke it from the recipient's .forward file (or specify it in
main.cf as a mailbox_command).

Right, but as I said ...

Post by Wietse Venema

I previously tried qmail-local as a mailbox_command so it would run as the
recipient user, but quickly found out that wouldn't fly due to the headers
added by the local transport.

The same would apply to a command run from a .forward file. If there were a
way to run a command without having those headers added, I'd be set.

[Wietse Venema]

Post by Ron Bickers

Post by Wietse Venema
To run a mail delivery program with the recipient's privileges,
invoke it from the recipient's .forward file (or specify it in
main.cf as a mailbox_command).

Right, but as I said ...

Post by Wietse Venema

I previously tried qmail-local as a mailbox_command so it would run as the
recipient user, but quickly found out that wouldn't fly due to the headers
added by the local transport.

Don't talk mysteries young man. What headers are getting in your way.

Wietse

[Ron Bickers]

Getting rid of the From_ line is a matter of "tail +2".

Nice. I'll give that a shot.

For the archives (or for comment):

I now have mailbox_command = /usr/local/libexec/postqmail-local and
postqmail-local looks like this (minus some mailer wrapping):

#!/bin/sh
export PATH=$PATH:/usr/local/bin:/var/qmail/bin
tail +2 | seekablepipe qmail-local -- \
"$USER" "$HOME" "$LOCAL" "${EXTENSION:+-}" "$EXTENSION"
"$DOMAIN""$SENDER" ./Maildir/
e=$?
(($e == 111)) && exit 75
(($e == 100)) && exit 77
exit $e

No more need for a qmail-local transport or sudo, and as I discovered with
my prior solution, 'aliases' weren't resolve when used in my 'virtual'
table, but they work fine this way.

I *really* like Postfix's "reject unknown local users" feature, BTW. It
will block thousands of messages per day that qmail would otherwise have had
to handle and bounce.

Thanks!