hMailServer 6.2.2: RFC 4013 SASLprep and a substantially upgraded Control Panel
-
The server binary is unchanged from the original 6.2.2. Everything new in this installer, apart from two pieces of authentication hardening, is a substantial upgrade to the Control Panel, the .NET 8 admin app.
Server
- Full RFC 4013 SASLprep for non-ASCII SASL credentials: RFC 3454 mapping, Unicode NFKC normalization, the complete prohibited-output tables (C.2.1/C.2.2, C.3 to C.9) and the RFC 3454 section 6 bidirectional check. NFKC is a no-op on ASCII, so existing credentials are unaffected.
- Automated RS256 public-key OAuth2 bearer-token regression coverage over POP3 and SMTP, including a tampered-signature rejection check.
Control Panel
- A new Advanced hardening page exposes previously hidden hMailServer.INI knobs: greylisting expiration, SpamAssassin and ClamAV scanner timeouts, DNS cache/server/DNSBL timing, authenticated-user IP replacement, the AUTH disable list, X-AuthUser and X-OriginalRcptTo headers, blocked-IP hold, envelope-from rewrite, and a password-hash-algorithm picker covering Argon2id, PBKDF2, SHA-256, MD5 and Blowfish.
- The anti-virus page gains live "Test ClamAV connection", "Test ClamWin scanner" and "Test custom scanner" checks, a preset picker for Microsoft Defender, Sophos, ESET, Bitdefender and Kaspersky, and ClamWin auto-detect. Event scripts get an "Insert template" picker with ready-made OnAcceptMessage handlers for an external AV/DLP scanner, a SIEM/Slack/Teams webhook and an external HTTP API verdict.
- Search and filter on the long list pages: Domains, Accounts, Rules, Delivery queue, TCP/IP ports, SSL certificates, IP ranges and Routes. Deleting aliases, distribution lists, list recipients and incoming relays now prompts for confirmation, and the Domain, Account and Route dialogs report bad numeric input instead of dropping it silently.
- Cached settings pages refresh on navigation, empty and error placeholders are standardised across the list and grid pages, and the overloaded Advanced group is split into Security, Network and Maintenance.
- Unhandled errors are logged to
%LOCALAPPDATA%\hMailServer\ControlPanelwith a restart offered. Screen-reader names on icon-only controls, search boxes and the navigation tree, and a stable AutomationId on every navigation node and data-driven settings editor, took the in-app UI-automation audit from grade F to grade A.
Builds clean at 0 warnings and 0 errors. The Control Panel requires the .NET 8 Desktop Runtime, which the installer bundles.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login