up vote 0 down vote favorite
share [g+] share [fb]

How do you turn off STARTTLS in Qmail (running on RH)? I initially installed the forcetls patch, but have since needed to use fixcrio which doesn't work with TLS (plus I don't need TLS for my setup anyway). I've tried a few different things, such as:

echo 0 > /var/qmail/control/smtpforcetls

&

adding DENY_TLS=1; export DENY_TLS to my /var/qmail/supervise/qmail-smtpd/run file

and none of them have worked. Any help would be greatly appreciated.

link|improve this question
feedback

3 Answers

up vote 0 down vote

There are multiple TLS patches for QMAIL. If you are using this patch, you should be able to change UCSPITLS to 0 in /var/qmail/ssl/env.

The startup parameters for qmail-smtpd in your supervise files should help track down what options are enabling TLS. Check the run file for qmail-smtpd. If you have a wrapper, you may be able to simply remove the wrapper. If your environment is specified using a different file or within the run file, you can identify the source there and change the UCSPITLS variable in the appropriate location.

Ultimately, without more details, I am going to be unable to provide a definitive recommendation.

link|improve this answer
I did not originally set up this server, however it looks like the person used Qmailrocks for the install. The forcetls patch I see referenced is: echo echo "Applying Ryan Schlesinger's forcetls patch" sleep 2 patch < /downloads/qmailrocks/patches/qmail-1.03-forcetls-20040703.patch which does not have the UCSPITLS file you speak of. Also in supervise/qmail-smtpd/run I don't see a hole lot referenced. QMAILDUID NOFILESGID MAXSMTPD LOCAL DENY_TLS Then it goes into exec softlimit, tcpserver, tcp.smtp.cdb, recordio, and then the actual qmail-smtpd command. – user22492 Aug 25 '10 at 15:31
feedback
up vote 0 down vote

The forcetls patch does not have any impact on the TLS encryption at all. Its only purpose is to ...

prevent users from using AUTH without first issuing STARTTLS

... and nothing else. Enabling or disabling that patch doesn't do anything to the announcing and/or use of TLS in your connection.

If you're really using qmailrocks: That patch includes the combined patch of John Simpson, which in turn uses the common qmail-tls patch. A qmail setup patched that way will always announce STARTTLS support. John Simpson has released several versions of the patch. The "current" stable version of qmailrocks (which is about five years old) includes version 5 of Johns patch, which has no support for setting a DENY_TLS environment variable. That functionality has been in Johns patch version 5f.

Your possibilities are:

  1. You can get rid of SSL/TLS support at all by editing conf-cc in the qmail source directory: Remove the -DTLS=... component and recompile with make setup check. This is, however, not recommended. SSL/TLS is a good thing!

  2. Quoting John Simpson:

    Stop wasting your time with qmailrocks. Do yourself a favour. Take the time to learn how qmail actually works, and then build a server which you understand how to operate.

  3. Get rid of the outdated clients that once forced you to use fixcrio. They're violating the SMTP RFC. It's really bad practice to hurt your "good" users by disabling TLS while at the same time rewarding your "bad" users for sticking with clients doing SMTP wrong.

link|improve this answer
Thanks for the information. I tried taking out the DTLS to see if that would stop the starttls for now, until I get a chance to reload the server, but it's still showing tls when I telnet to port 25 of the qmail server. Here is my original conf-cc: "cc -O2 -DTLS -I/usr/local/ssl/include -I/usr/kerberos/include" I have tried taking out just the -DTLS, then everything but the cc -02 and then everything. They all have the same outcome. – user22492 Aug 25 '10 at 18:23
What about a make clean before make setup check? Does qmail-smtpd still advertise STARTTLS if you directly start the freshly compiled binary in the source directory with ./qmail-smtpd? (You can talk with it like via port 25.) If it doesn't advertise STARTTLS there, obviously only the /installation/ failed. – Jonas Aug 26 '10 at 12:22
The problem is, once I take out the -DTLS from the conf-cc, it then throws errors when it tries to create qmail-smtpd from qmail-smtpd.c. I get line errors on 371 and 941, which are: "if ( useauth && ( ssl || essl ) )" and "if (!( useauth && (ssl||essl) ))". If I try to start taking those out I just get in a huge mess of needing to take out a lot of other stuff then it doesn't work. – user22492 Aug 26 '10 at 14:42
A bit late perhaps, but you can fix that by simply removing the "ssl" on those lines, or you can add a "void *ssl = 0;" at the top, surrounded by #ifndef TLS ... #endif – Steven Don Jul 15 '11 at 22:11
feedback
up vote 0 down vote

If you are using (like many) Frederick Vermeulen's TLS patch, you can disable STARTTLS by removing the control/servercert.pem file in qmail's directory (usually that will be /var/qmail/control/servercert.pem).

If you're like me, you'll first try with a simple chmod 000 of that file, but that won't be enough. The code is actually checking for its existence and not for its readability when choosing whether to present the STARTTLS capability or not. You need to completely remove/rename that file.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard