Back to the main page

cmail-smtpd

Accept incoming/originated mails via SMTP

This component provides the services that most accurately matches the common perception of a mail server. It accepts incoming mail via SMTP (usually on port 25) and allows new mail to be submitted for delivery (SMTP Submission, port 587) by authenticated users.

Building & Prerequisites

The following packages are required for building this module (Debian packages are listed) A build of only this specific module can be initiated by running make in cmail-smtpd/

Setup information

This module needs read and write access to the master database AS WELL AS the folder containing it. Recommended practice is creating a dedicated user and specifying that in the configuration in order to have the module drop its privileges after binding the ports.

Run the module without specifying a logfile in the configuration at first, in order to test its operation and track down any misconfigurations. Specifying a logfile allows the module to daemonize itself and detach from the starting shell.

Configuration file

The configuration file contains multiple lines, each specifying one of the following configuration directives. Lines are read from this file consecutively. Most directives become active the moment they are read. An example configuration file with sane defaults (save for the banner announce) can be found in the example-configs/ folder in the main repo.
Directive Parameters
Comments Verbatim
Description
verbosity Integer between 0 and 4 Set log output verbosity. Higher values include messages for lower values.
  • 0 - Errors & Warnings only (Default)
  • 1 - Informational messages
  • 2 - Currently not specified
  • 3 - Debug messages
  • 4 - All input and output
logfile Path to log file If not specified, cmail-smtpd will log to stderr and will not be able to detach from the calling shell
pidfile Path to pid file Write the PID of the daemonized process to the specified file. If not specified, no file is created. PID files are used by daemon supervisors such as systemd for stopping services.
user Username to switch to The module will change its executing user to the one specified. Only works when started as root. This is one of the few options not immediately taking effect.
group Group name to switch to The module will change its executing group to the on specified. Only works when started as root. This is one of the few options not immediately taking effect.
database Path to master database The executing user needs read AND write access to the master database file as well as the folder containing it
bind Address to bind to :: and * bind all interfaces for IPv6 and IPv4 respectively
Port to listen on The widely-known ports for SMTP are
  • 25 - SMTP
  • 465 - SSMTP (tls-only, nonstandard)
  • 587 - Submission
Privileged ports (Numbers smaller than 1024) usually need root privileges to bind to
(optional)
size= Maximum accepted mail size in bytes 		Default is 0, indicating no limit
(optional)
announce= Server name to announce to clients in the banner 		The announced name should preferrably have a valid DNS record pointing to the machine
(optional, not available when compiled with CMAIL_NO_TLS)
cert= TLS certificate file location 		Specifying both cert and key automatically enables opportunistic encryption via STARTTLS
(optional, not available when compiled with CMAIL_NO_TLS)
key= TLS key file location 		Specifying both cert and key automatically enables opportunistic encryption via STARTTLS
(optional, not available when compiled with CMAIL_NO_TLS)
ciphers= GnuTLS cipher priority listing 		This parameter can be used to disable or force specific ciphers or protocol versions
(optional, not available when compiled with CMAIL_NO_TLS)
dhparams= Diffie-Hellman parameter file location 		Use this parameter to read the Diffie-Hellman parameters from a file instead of generating new parameters upon starting (which is time consuming). The file is expected to be in PEM format.
(optional, not available when compiled with CMAIL_NO_TLS)
tlsonly 		Connections on this port are expected to immediately negotiate a TLS session, never exchanging plain text data
(optional)
auth
auth=strict,tlsonly,private
auth=fixed@ Name of user to automatically be authenticated on this port 		Enable SMTP authentication on this port. Authentication is required for sending mail to non-local addresses.
tlsonly requires the connection to be secured by TLS in order to be able to authenticate.
private suppresses the reverse name of the submitting host being printed into the Received: header.
strict requires authentication before allowing any mail-related commands to succeed (SMTP submission mode).
fixed@user can potentially be used to create an open relay. Be careful when using it.

Database configuration

Handling of incoming mail by the SMTP daemon can be configured with the cmail-admin-address utility.

Authentication against the SMTP daemon and the handling of outbound mail can be configured with cmail-admin-smtpd.

Debugging

Plugin API

Resources & Further reading