smtpd-starttls-proxy
Software
skarnet.org

The qmail-smtpc program

qmail-smtpc is an SMTP client, meant to be used as a drop-in replacement to qmail-remote.

It is not meant to be invoked directly by the user; it only makes sense in the context of a qmail, netqmail or notqmail installation.

Interface

qmail-smtpc follows the exact same interface as qmail-remote. The binary can literally be renamed qmail-remote then dropped in /var/qmail/bin in place of the stock qmail-remote program. With some patches, it can also be used by setting the QMAILREMOTE environment variable to the path where qmail-smtpc is installed.

Differences with qmail-remote

• If the underlying OS and skalibs support IPv6, then qmail-smtpc does as well, and use IPv4 and IPv6 addresses indiscriminately when connecting to an MX.
• It speaks ESMTP and will use STARTTLS if the server supports it.

Control files

qmail-smtpc uses a few extra control files in /var/qmail/control:

trustanchors

Contains the path to the certificates for known trust anchors for X.509 certificate validation. If the path ends with a slash, like /etc/ssl/certs/, then it is interpreted as a directory containing hashes to the certificates. If it does not, like /etc/ssl/cert.pem, then it is interpreted as a big PEM file containing all the trust anchors. If the file is nonexistent or empty, or only contains a newline, then STARTTLS is not attempted.

clientcert

If this file exists and is nonempty, it must contain the path to a client certificate. This certificate will be sent to the server during a TLS negotiation. This is useful in certain setups requiring client authentication.

clientkey

This file must be used in conjunction with clientcert. It contains the path to the private key used to sign the client certificate. Note that access to the private key file should be as restricted as possible, but the qmailr user (or whatever user qmail-smtpc runs as) must be able to read it.