Qmail

Last updated
qmail
Original author(s) Daniel J. Bernstein
Final release
1.03 / June 15, 1998;25 years ago (1998-06-15)
Repository cr.yp.to/software/qmail-1.03.tar.gz
Written in C
Operating system Unix-like
Type Mail transfer agent
License public domain [1]
Website cr.yp.to/qmail.html
netqmail
Final release
1.06 / November 30, 2007;16 years ago (2007-11-30)
Repository netqmail.org/netqmail-1.06.tar.gz
Website netqmail.org
s/qmail
Stable release
4.2.29a / February 26, 2024;11 days ago (2024-02-26)
Website fehcom.de/sqmail/sqmail.html
notqmail [2]
Stable release
1.08 / May 20, 2020;3 years ago (2020-05-20)
Repository github.com/notqmail/notqmail
Website notqmail.org

qmail is a mail transfer agent (MTA) that runs on Unix. It was written, starting December 1995, by Daniel J. Bernstein as a more secure alternative to the popular Sendmail program. Originally license-free software, qmail's source code was later dedicated to the public domain by the author. [3]

Contents

Features

Security

When first published, qmail was the first security-aware mail transport agent; since then, other security-aware MTAs have been published. The most popular predecessor to qmail, Sendmail, was not designed with security as a goal, and as a result, has been a perennial target for attackers. In contrast to sendmail, qmail has a modular architecture composed of mutually untrusting components; for instance, the SMTP listener component of qmail runs with different credentials from the queue manager or the SMTP sender. qmail was also implemented with a security-aware replacement to the C standard library, and as a result, has not been vulnerable to stack and heap overflows, format string attacks, or temporary file race conditions.

Performance

When it was released, qmail was significantly faster than Sendmail, particularly for bulk mail tasks such as mailing list servers. qmail was originally designed as a way to manage large mailing lists.

Simplicity

At the time of qmail's introduction, Sendmail configuration was notoriously complex, while qmail was simple to configure and deploy.

Innovations

qmail encourages the use of several innovations in mail (some originated by Bernstein, others not):

Maildir
Bernstein invented the Maildir format for qmail, which splits individual email messages into separate files. Unlike the de facto standard mbox format, which stored all messages in a single file, Maildir avoids many locking and concurrency problems, and can safely be provisioned over NFS. qmail also delivers to mbox mailboxes.
Wildcard mailboxes
qmail introduced the concept of user-controlled wildcards. Out of the box, mail addressed to "user-wildcard" on qmail hosts is delivered to separate mailboxes, allowing users to publish multiple mail addresses for mailing lists and spam management.

qmail also introduces the Quick Mail Transport Protocol (QMTP), an e-mail transmission protocol that is designed to have better performance than Simple Mail Transfer Protocol (SMTP), the de facto standard; [4] and Quick Mail Queuing Protocol (QMQP), a network protocol designed to share e-mail queues between several hosts. [5]

Modularity

qmail is nearly a completely modular system in which each major function is separated from the other major functions. It is easy to replace any part of the qmail system with a different module as long as the new module retains the same interface as the original.

Controversy

Security reward and Georgi Guninski's vulnerability

In 1997, Bernstein offered a US$500 reward for the first person to publish a verifiable security hole in the latest software version. [6]

In 2005, security researcher Georgi Guninski found an integer overflow in qmail. On 64-bit platforms, in default configurations with sufficient virtual memory, the delivery of huge amounts of data to certain qmail components may allow remote code execution. Bernstein disputes that this is a practical attack, arguing that no real-world deployment of qmail would be susceptible. Configuration of resource limits for qmail components mitigates the vulnerability. [7]

On November 1, 2007, Bernstein raised the reward to US$1000. [1] At a slide presentation the following day, Bernstein stated that there were 4 "known bugs" in the ten-year-old qmail-1.03, none of which were "security holes". He characterized the bug found by Guninski as a "potential overflow of an unchecked counter". "Fortunately, counter growth was limited by memory and thus by configuration, but this was pure luck." [8]

On May 19, 2020, a working exploit for Guninski's vulnerability was published by Qualys [9] but exploit authors' state they were denied the reward because it contains additional environmental restrictions.

Frequency of updates

The core qmail package has not been updated for many years. [10] New features were initially provided by third-party patches, from which the most important at the time were brought together in a single meta-patch called netqmail. [11]

Standards compliance

qmail was not designed as a drop-in replacement for Sendmail, and does not behave exactly as Sendmail did in all situations. In some cases, these differences in behavior have become grounds for criticism. For instance, qmail's approach to bounce messages (a format called QSBMF) differs from the standard format of delivery status notifications specified by the IETF in RFC 1894, [12] meanwhile advanced to draft standard as RFC 3464, [13] and recommended in the SMTP specification.

Furthermore, some qmail features have been criticized for introducing mail forwarding complications; for instance, qmail's "wildcard" delivery mechanism and security design prevents it from rejecting messages from forged or nonexistent senders during SMTP transactions. [14] In the past, these differences may have made qmail behave differently when abused as a spam relay, though modern spam delivery techniques are less influenced by bounce behavior.

qmail was released to the public domain in November 2007. [15] Until November 2007, qmail was license-free software, with permission granted for distribution in source form or in pre-compiled form (a "var-qmail package") only if certain restrictions (primarily involving compatibility) were met. This unusual licensing arrangement made qmail non-free according to some guidelines (such as the DFSG) and was a cause of controversy.

qmail is the only broadly deployed public domain software message transfer agent (MTA).

See also

Related Research Articles

<span class="mw-page-title-main">Email</span> Mail sent using electronic means

Electronic mail is a method of transmitting and receiving messages using electronic devices. It was conceived in the late–20th century as the digital version of, or counterpart to, mail. Email is a ubiquitous and very widely used communication medium; in current use, an email address is often treated as a basic and necessary part of many processes in business, commerce, government, education, entertainment, and other spheres of daily life in most countries.

Within the Internet email system, a message transfer agent (MTA), mail transfer agent, or mail relay is software that transfers electronic mail messages from one computer to another using the Simple Mail Transfer Protocol. In some contexts, the alternative names mail server, mail exchanger, or MX host are used to describe an MTA.

The Simple Mail Transfer Protocol (SMTP) is an Internet standard communication protocol for electronic mail transmission. Mail servers and other message transfer agents use SMTP to send and receive mail messages. User-level email clients typically use SMTP only for sending messages to a mail server for relaying, and typically submit outgoing email to the mail server on port 587 or 465 per RFC 8314. For retrieving messages, IMAP is standard, but proprietary servers also often implement proprietary protocols, e.g., Exchange ActiveSync.

<span class="mw-page-title-main">Email client</span> Computer program used to access and manage a users email

An email client, email reader or, more formally, message user agent (MUA) or mail user agent is a computer program used to access and manage a user's email.

<span class="mw-page-title-main">Sendmail</span> Open-source mail transfer agent

Sendmail is a general purpose internetwork email routing facility that supports many kinds of mail-transfer and delivery methods, including the Simple Mail Transfer Protocol (SMTP) used for email transport over the Internet.

<span class="mw-page-title-main">Maildir</span> E-mail format

The Maildir e-mail format is a common way of storing email messages on a file system, rather than in a database. Each message is assigned a file with a unique name, and each mail folder is a file system directory containing these files. Maildir was designed by Daniel J. Bernstein circa 1995, with a major goal of eliminating the need for program code to handle file locking and unlocking through use of the local filesystem.

A mail exchanger record specifies the mail server responsible for accepting email messages on behalf of a domain name. It is a resource record in the Domain Name System (DNS). It is possible to configure several MX records, typically pointing to an array of mail servers for load balancing and redundancy.

<span class="mw-page-title-main">Exim</span> Mail transfer agent (written 1995)

Exim is a mail transfer agent (MTA) used on Unix-like operating systems. Exim is a free software distributed under the terms of the GNU General Public License, and it aims to be a general and flexible mailer with extensive facilities for checking incoming e-mail.

procmail is an email server software component — specifically, a message delivery agent (MDA). It was one of the earliest mail filter programs. It is typically used in Unix-like mail systems, using the mbox and Maildir storage formats.

An email address identifies an email box to which messages are delivered. While early messaging systems used a variety of formats for addressing, today, email addresses follow a set of specific rules originally standardized by the Internet Engineering Task Force (IETF) in the 1980s, and updated by RFC 5322 and 6854. The term email address in this article refers to just the addr-spec in Section 3.4 of RFC 5322. The RFC defines address more broadly as either a mailbox or group. A mailbox value can be either a name-addr, which contains a display-name and addr-spec, or the more common addr-spec alone.

Greylisting is a method of defending e-mail users against spam. A mail transfer agent (MTA) using greylisting will "temporarily reject" any email from a sender it does not recognize. If the mail is legitimate, the originating server will try again after a delay, and if sufficient time has elapsed, the email will be accepted.

<span class="mw-page-title-main">Postfix (software)</span> Mail transfer agent

Postfix is a free and open-source mail transfer agent (MTA) that routes and delivers electronic mail.

<span class="mw-page-title-main">Message submission agent</span>

A message submission agent (MSA), or mail submission agent, is a computer program or software agent that receives electronic mail messages from a mail user agent (MUA) and cooperates with a mail transfer agent (MTA) for delivery of the mail. It uses ESMTP, a variant of the Simple Mail Transfer Protocol (SMTP), as specified in RFC 6409.

The Sender Rewriting Scheme (SRS) is a scheme for bypassing the Sender Policy Framework's (SPF) methods of preventing forged sender addresses. Forging a sender address is also known as email spoofing.

The UW IMAP server was the reference server implementation of the Internet Message Access Protocol. It was developed at the University of Washington by Mark Crispin and others.

Email forwarding generically refers to the operation of re-sending a previously delivered email to an email address to one or more different email addresses.

The Courier Mail Server is a mail transfer agent (MTA) server that provides SMTP, IMAP, POP3, SMAP, webmail, and mailing list services with individual components. It is best known for its IMAP server component.

<span class="mw-page-title-main">Email agent (infrastructure)</span>

An e-mail agent is a program that is part of the e-mail infrastructure, from composition by sender, to transfer across the network, to viewing by recipient. The best-known are message user agents and message transfer agents, but finer divisions exist.

Maildrop is a Mail delivery agent used by the Courier Mail Server. The maildrop Mail Delivery Agent (MDA) also includes filtering functionality.

Amavis is an open-source content filter for electronic mail, implementing mail message transfer, decoding, some processing and checking, and interfacing with external content filters to provide protection against spam and viruses and other malware. It can be considered an interface between a mailer and one or more content filters.

References

  1. 1 2 "Some thoughts on security after ten years of qmail 1.0" (PDF). Retrieved 2007-12-01.
  2. ↑ Announcing notqmail
  3. ↑ "Information for distributors". I hereby place the qmail package (in particular, qmail-1.03.tar.gz, with MD5 checksum 622f65f982e380dbe86e6574f3abcb7c) into the public domain. You are free to modify the package, distribute modified versions, etc.
  4. ↑ "Quick Mail Transfer Protocol (QMTP)". February 1, 1997. Retrieved 6 May 2023.
  5. ↑ "QMQP: Quick Mail Queueing Protocol" . Retrieved 6 May 2023.
  6. ↑ "The qmail security guarantee" . Retrieved 2007-10-05.
  7. ↑ Georgi Guninski. "Georgi Guninski security advisory #74, 2005" . Retrieved 2007-10-05.
  8. ↑ "Some thoughts on security after ten years of qmail 1.0 [Slide presentation]" (PDF). Retrieved 2008-01-17.
  9. ↑ "'[oss-security] Remote Code Execution in qmail (CVE-2005-1513)' - MARC". marc.info. Retrieved 2021-03-03.
  10. ↑ "Life with qmail; History" . Retrieved 2007-12-01.
  11. ↑ "netqmail". netqmail.org. Retrieved 2021-03-03.
  12. ↑ Vaudreuil, Gregory M.; Moore, Keith (1996). "An Extensible Message Format for Delivery Status Notifications". tools.ietf.org. doi:10.17487/RFC1894 . Retrieved 2021-03-03.
  13. ↑ Vaudreuil, Gregory M.; Moore, Keith (2003). "An Extensible Message Format for Delivery Status Notifications". tools.ietf.org. doi:10.17487/RFC3464 . Retrieved 2021-03-03.
  14. ↑ Moen, Rick (October 2006). "On Qmail, Forged Mail, and SPF Records". Linux Gazette (131).
  15. ↑ "Bernstein releases code into the public domain" . Retrieved 2007-11-30.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.