Roadmap

Roadmap

• SpamAssassin 4 done
• Continuous security and bug fix updates

Release History

See also Announcement forum

Proxmox Mail Gateway 8.1

Released 29. February 2024

• Based on Debian Bookworm (12.5)
• SpamAssassin 4.0.0 (with updated rulesets)
• ClamAV 1.0.3
• PostgreSQL 15.6
• Latest 6.5 Kernel as new stable default
• ZFS 2.2.2

Highlights

• Extend the rule system to allow selection of the match-if mode for entries in What/Who/When Objects, and multiple Objects in Rules, providing flexible control over whether all, any, none, or some but not all must match.

  See the enhancements in the rule system section for more details and examples.

• Optional DKIM signing based on the From header (also known as RFC5322.From), instead of the Envelope sender (also known as RFC5321.From) (issue 2971).

• Secure Boot support.

  Proxmox Mail Gateway now includes a signed shim bootloader trusted by most hardware's UEFI implementations. All necessary components of the boot chain are available in variants signed by Proxmox.

  The Proxmox Mail Gateway installer can now be run in environments where Secure Boot is required and enabled, and the resulting installation can boot in such environments.

  Existing Proxmox Mail Gateway installations can be switched over to Secure Boot without reinstallation by executing some manual steps, see the documentation for details.

  How to use custom secure boot keys has been documented in the Secure Boot Setup page in the Proxmox VE wiki. For using DKMS modules with secure boot see the reference documentation.

• Seamless upgrade from Proxmox Mail Gateway 7.3, see Upgrade from 7 to 8

Changelog Overview

Enhancements in the Rule System

• Make the rule system more flexible by introducing a match-if-mode for objects and groups. The match-if-mode of an object (or group) determines whether any, all, not all or none of its children must match for the whole object (or group) to match. This allows to implement complex rules, for example:
  • Exclude certain recipients from a rule, while still considering all later rules for them.
  • Treat emails differently if they contain particular attachments and are detected as spam or contain a virus.
  • Match attachments with a filename ending in .pdf, but being detected as executable by the content-type filter.
  • Matching a mail sent from one address and containing a phrase in the subject.
• Disclaimers can now be added on top of the message, instead of only at the bottom (issue 2606).
• The separator -- for disclaimers can now be optionally omitted (issue 2430).
• Adapt the number of parallel worker processes for the SMTP filter to increased memory requirements and availability.
• Make the timeout for processing a mail consistent between before- and after-queue filtering, and make it configurable.
• Prevent duplicate mail delivery when filtering runs into a timeout.
• Fix the synchronization of the user wants- and blocklists if the last address is removed for a user (issue 4392).
• Further improve input validation for regular expressions in the rule system (issue 4811).
• Fix an error in the collection of virus occurrence statistics.
• The spam report e-mails now correctly handle addresses with characters that need to be escaped for the API and GUI.
• Display the descriptions for rules from the advanced KAM ruleset in the spam info grid in the quarantine view.
• Improve the output of pmgdb dump used for gathering information about the ruleset:
  • Add information about the type of What Objects
  • Add optional --rules parameter to restrict output to rules that are active or inactive
  • Visually emphasize whether a rule is active
  • Remove unnecessary filler words from output

Enhancements in the Web Interface (GUI)

• Make it easier to manage large deployments by adding a filter- and search-box for (issue 4510):

  Relay Domains

  Transport

  Networks

  Objects in the rule system

• Add icons to the backup destination panel for improved UX.
• Fix an issue where the OK button would stay disabled when editing an ACME DNS challenge plugin (issue 4531).
• Fix TLS 1.3-only configuration for the API proxy server (issue 4859).
• Fix spelling errors in the GUI and improve gettext instances so that they can be better translated.
• Improved translations, among others:
  • Croatian (NEW!)
  • Georgian (NEW!)
  • Arabic
  • Catalan
  • German
  • Italian
  • Polish
  • Simplified Chinese
  • Spanish
  • Traditional Chinese
  • Ukrainian
  • The language code for Korean was corrected from kr to ko in alignment with ISO 639-1, while maintaining a symbolic link for backward compatibility for now.
  • Several remaining occurrences of the GiB unit in the GUI can now be translated (issue 4551).

Access Control

• Allow usernames shorter than 4 characters, in accordance with Proxmox VE and Proxmox Backup Server (issue 4818)

Notable bug fixes and general improvements

• Harden the Postfix configuration for the external port to address the SMTP Smuggling security issue, by implementing all recommendations from upstream.
• Switch the default time-stamp format expected by the Tracking Center to the RFC3339 based information in the logs in Proxmox Mail Gateway 8.0 and newer. While this was initially meant as a small clean-up a few issues around the switch between DST and regular time were fixed with the changes.
• Secure Boot support.

  Proxmox Mail Gateway now ships a shim bootloader signed by a CA trusted by most hardware's UEFI implementation. In addition, it ships variants of the GRUB bootloader, MOK utilities and kernel images signed by Proxmox and trusted by the shim bootloader.

  New installation will support Secure Boot out of the box if it is enabled.

  Existing installations can be adapted to Secure Boot by installing optional packages, and possibly reformatting and re-initializing the ESP(s), without the need for a complete reinstallation. See the wiki article for more details.

• Fix cluster setups recreated after restoring a backup with statistics (issue 5189).
• The kernel shipped by Proxmox is shared for all products. This is now reflected in the renaming from pve-kernel and pve-headers to proxmox-kernel and proxmox-headers respectively in all relevant packages.
• The new proxmox-default-kernel and proxmox-default-headers meta-packages will depend on the currently recommended kernel-series.
• Many edge-cases encountered during the upgrade from Proxmox Mail Gateway 7.3 to 8 by our user-base are now detected and warned about in the improved pmg7to8 checks:
  • Notify when a template was copied to /etc/pmg/templates without any modifications, to prevent missing important changes to config files.
  • Warn if DKMS modules are detected, as many of them do not upgrade smoothly to the newer kernel versions in Mail Gateway 8.
  • Warn if version 7 of the Mail Gateway system does not have the correct meta-package of grub installed. The correct meta-package is required to actually upgrade the installed bootloader to the newest version.
• Support for adding custom ACME enabled CA's which require authentication through External Account Binding (EAB) on the command line (issue 4497).
• Fix non-interactive use of the pmgsh utility (issue 4815).
• Improve the parsing of config and system files, used in many places of the code. This fixes an issue with displaying the network interfaces without a correct hostname entry in /etc/hosts and aims to prevent similar issues in the future.
• Prevent cluster synchronization from failing due to a change in fingerprint parsing in OpenSSL.
• Add support for having a Proxmox Backup Server remote on an alternate port (issue 4944).
• Reduce log severity for periodic informational messages from error to info.
• Changelogs for new package versions shown in the UI are now all gathered with apt changelog, as this is now supported by the Proxmox repositories.
• Add information about the configured domains for DKIM signing to the report generated for support cases.
• The documentation on firmware updates provided by the operating system has been extended and revised, helping administrators to identify if their setup is optimal.

Installation ISO

• The ISO is able to run on Secure Boot enabled machines.
• The text-based UI got significant improvement based on the feedback received from the first release in Proxmox Mail Gateway 8.0.
• The current link-state of each network interface is now displayed in the network configuration view, helping in identifying the correct NIC for the management interface (issue 4869).
• If provided by the DHCP server, the hostname field is already filled out with the information from the lease.
• The correct meta-package of grub is now installed based on the boot mode (grub-pc or grub-efi-amd64). This ensures that the bootloader on disk gets updated when there is an upgrade for the grub package.
• The text-based UI is now also available over a serial console, for headless systems with a serial port.
• The root dataset on ZFS installations now uses acltype=posixacl in line with upstream's recommendation.
• Kernel parameters passed on the command line during install are now also set in the target system (issue 4747).
• Fix the warning that is shown in case the address family (IPv4, IPv6) of the host IP and DNS server do not match.
• The text-based UI now sets the correct disk-size for the selected disk, instead of limiting the installation to the size of the first disk in the list (issue 4856).
• For better UX, the text-based UI now also displays a count-down before automatically rebooting.
• The screensaver in the graphical installer is now disabled.
• The graphical installer now displays the units used for disk-based options.
• The kernel command-line parameter vga788 is now set for both the graphical debug and all text-based UI installation options. This improves compatibility of the installer with certain hardware combinations.
• Remove the checksum-options of off and fletcher2 for ZFS, for being dangerous and deprecated respectively.
• Improve the layout in the graphical installer to ensure correct margins and alignment of widgets.
• Set a timeout for country detection, preventing the installer from hanging at that step (issue 4872).
• General improvements for running external commands in the installer backend in order to prevent lockups.
• Improve validation of hostname length and allowed characters set in the installer (issue 5230).

Known Issues & Breaking Changes

Kernel

• Some SAS2008 controllers need a workaround to get detected since kernel 6.2, see the forum thread for details.

• The TPM (Trusted Platform Module) hardware random number generator (RNG) is now disabled on all AMD systems equipped with a firmware-based TPM (fTPM) device. This change was implemented due to such RNGs causing stutters in many systems. Affected systems should switch the RNG source from /dev/hwrng to an alternative, like /dev/urandom.

Reference: kernel commit "tpm: Disable RNG for all AMD fTPMs"

• Some Dell models, which appear to include all those using a BCM5720 network card, have a compatibility issue with the tg3 driver in the kernel based on version 6.5.11.

  From our current understanding 14th Generation Dell Servers (T140, R240, R640,...) are affected, while others (e.g., R630, R620, R610,...) do not seem to be affected. We are currently investigating this issue. In the meantime, we recommend pinning the kernel to version 6.2 on affected hosts.

  Some users report that disabling the X2APIC option in the BIOS resolved this issue as a workaround.

Proxmox Mail Gateway 8.0

Released 29. June 2023

• Based on Debian Bookworm (12.0)
• Latest 6.2 Kernel as stable default
• ZFS 2.1.12
• SpamAssassin 4.0.0 (with updated rulesets)
• ClamAV 1.0.1
• PostgreSQL 15.3

Highlights

• New major release based on the great Debian Bookworm.

• Seamless upgrade from Proxmox Mail Gateway 7.3, see Upgrade from 7 to 8

  New pmg7to8 pre-flight checking script analyzing the system for common misconfigurations and missed steps during the upgrade

• Add new text-based UI mode for the installation ISO, written in Rust using the Cursive TUI (Text User Interface) library:

  You can use the new TUI mode to work around issues with launching the GTK based graphical installer, sometimes observed on both very new and rather old hardware.

  The new text mode executes the same code for the actual installation as the existing graphical mode.

Changelog Overview

Enhancements in the Rule System

• When adding a "Match Field" What object, check that the provided regular expression is a valid regular expression.
• Disable SpamAssassin's naive-Bayesian-style classifier and the auto-whitelisting plugin by default.

  Both features lead to worse detection rates in the Spam Filter in most setups.

  Bayes needs manual training and thorough consideration, as well as continuous maintenance.

  Existing setups are kept without change on upgrade.

  For new setups the old behavior can be enabled through the GUI.

Enhancements in the Web Interface (GUI)

• Improved Dark color theme:

  The Dark color theme, introduced in Proxmox Mail Gateway 7.3, received a lot of positive feedback from our community, which resulted in further improvements.

• Improved translations, among others:
  • Ukrainian (NEW)
  • Japanese
  • Simplified Chinese
  • Traditional Chinese
  • The size units (Bytes, KB, MiB,...) are now passed through the translation framework as well, allowing localized variants (e.g., for French).
  • The language selection is now localized and displayed in the currently selected language
• Disable advanced statistic filters by default, as their behavior may not be immediately clear without consulting the documentation first.
• HTML-encode rule names before rendering as additional hardening against XSS.
• The tracking center can now parse the new syslog format for dates that was introduced in Debian Bookworm.

  The logging format of rsyslog was changed to include Timezone information (RFC3339) in the logs, making the Tracking Center more robust across DST changes and year changes.

Access control

• Add TFA/TOTP lockout to protect against an attacker who has obtained the user password and attempts to guess the second factor:

  If TFA fails too many times in a row, this user account is locked out of TFA for an hour. If TOTP fails too many times in a row, TOTP is disabled for the user account. Using a recovery key will unlock a user account.

Installation ISO

• Add new text-based UI mode for the installation ISO, written in Rust using the Cursive TUI (Text User Interface) library:

  You can use the new TUI mode to work around issues with launching the GTK based graphical installer, sometimes observed on both very new and rather old hardware.

  The new text mode executes the same code for the actual installation as the existing graphical mode.

• The version of BusyBox shipped with the ISO was updated to version 1.36.1.
• Detection of unreasonable system time.

If the system time is older than the time the installer was created, the system notifies the user with a warning.

• ethtool is now shipped with the ISO and installed on all systems.
• systemd-boot is provided by its own package instead of systemd in Debian Bookworm and is installed with the new ISO.
• The installation ISO now ships the dependencies for extracting text from attachments using SpamAssassin 4, eliminating the need to install the packages manually.

Notable bugfixes and general improvements

• Add a pmg7to8 CLI tool to assist in upgrading from Proxmox Mail Gateway 7.3 to 8.
• Fix an issue where an invalid regular expression in a "Match Field" What object would cause pmg-smtp-filter to exit and restart, possibly leading to wrongly denied mails. Instead, pmg-smtp-filter now logs a warning if it encounters an invalid regular expression.
• During package installation or upgrade, ignore certain transient or obvious errors to avoid leaving the package in a broken state.
• Fix an issue where the Proxmox Mail Gateway system report would wrongly indicate a DNS misconfiguration.
• When authenticating via PAM, pass the PAM_RHOST item. With this, it is possible to manually configure PAM such that certain users (for example root@pam) can only log in from certain hosts.

Known Issues & Breaking Changes

• The advanced statistics filter is now disabled by default.

  To avoid changing the behavior of a Proxmox Mail Gateway 7.3 instance on upgrade, the upgrade process will set the advfilter option to 1 if no explicit value is set.

• SpamAssassin's naive-Bayesian-style classifier and the auto-whitelisting plugin are now disabled by default.

  To avoid changing the behavior of a Proxmox Mail Gateway 7.3 instance on upgrade, the upgrade process will set each of the use_awl/use_bayes options to 1 if no explicit value is set.

Proxmox Mail Gateway 7.3

Released 28. March 2023

• Based on Debian Bullseye (11.6)
• Latest 5.15 Kernel as stable default
• Newer 6.2 kernel as opt-in
• ZFS 2.1.9
• SpamAssassin 4.0.0 (new major version)
• PostgreSQL 13.10

Highlights

• Proxmox Mail Gateway now provides a dark theme for the administrative and quarantine web interfaces.
• SpamAssassin 4.0.0 was integrated, along with many of its new capabilities, like (optionally) scanning document contents (docx, pdf, images,...), or resolving URLs from url-shorteners.

Changelog Overview

Enhancements in the Rule System

• New major release SpamAssassin 4.0.0, with many new features:
  • Detection of spam inside of attachments. This is implemented for the file types .pdf, .odt, .docx, .doc, .rtf, as well as images (through OCR).

  Attachment scanning can be enabled using the Web UI (Spam Detector -> Options), which sets the extract_text option in the spam section of /etc/pmg/pmg.conf.

  The dependencies required for attachment scanning are marked as optional, but recommended dependency for the pmg-api package.

  This means that on systems that did not change the apt preference the new dependencies should be pulled in automatically on upgrade, otherwise you might need to manually install them.

  Note that attachment scanning, and OCR in particular, increases CPU time spent per mail. Depending on email volume and available CPU power, you may see a significant increase in load.

  • Follow and analyze URL-shortener links.
  • Improved support for using information from DMARC-policies.
  • Improved handling of internationalized (IDN) domain names.
• Adaptation of the SpamAssassin integration for version 4.0.0:

The SpamAssassin configuration files shipped with the pmg-api package were adapted to the new features.

extract_text was added as new option for the spam detector to disable content scanning, while most other new options are triggered with the use_rbl option.

On deployments with modified templates, the upgrade process will ask how changes should be merged. This provides an opportunity to re-evaluate which modifications are still needed.

• Support enforcing TLS-only connections for mails from certain domains:

It is now possible to enforce TLS encryption for inbound mail, complementing the already-present TLS policy functionality for outbound mail.

• Improved handling of SMTPUTF8:

Based on the user feedback on UTF-8 support for the rule system introduced in Proxmox Mail Gateway 7.2, it is now possible to disable SMTPUTF8 through the API and GUI.

The detection for SMTPUTF8 was aligned with the implementation in postfix.

• The What objects "Match Archive Filename" now also use the optional filename from the GZIP header for matching.
• Support trusted network entries with host bits set in the CIDR:

Quite a few deployments did use a CIDR with host-bits set, for example 192.0.2.5/24 instead of 192.0.2.0/24. This is now translated internally and handled correctly.

• Ordering of multiple rules with the same priority is now stable, despite not being a recommended setup.

Enhancements in the Web Interface (GUI)

• Add a fully-integrated "Proxmox Dark" color theme variant of the long-time Crisp light theme.

By default, the prefers-color-scheme media query from the Browser/OS will be used to decide the default color scheme.

Users can override the theme via a newly added Color Theme menu in the user menu.

• Add "Proxmox Dark" color theme to the Proxmox Mail Gateway reference documentation.

The prefers-color-scheme media query from the Browser/OS will be used to decide if the light or dark color scheme should be used.

The new dark theme is also available in the Proxmox Mail Gateway API Viewer.

• Task logs can now be downloaded directly as text files for further inspection.
• The language chooser now displays, for each available language, both its native name as well as its name translated to the currently active language.
• HTML-encode API results before rendering as additional hardening against XSS.
• Automatically redirect HTTP requests to HTTPS for convenience.

This avoids "Connection reset" browser errors that can be confusing, especially after setting up a Proxmox Mail Gateway host the first time.

• Invalid entries in advanced fields now cause the advanced panel to unfold, providing direct feedback.
• Improved translations, among others:
  • Arabic
  • French
  • German
  • Italian
  • Japanese
  • Russian
  • Slovenian
  • Simplified Chinese
  • Traditional Chinese

Notable General Improvements and Bug Fixes

• The documentation has now a chapter describing the statistics part of the GUI and API.
• Mail delivery from quarantine uses new code for sending locally generated mail, with the following improvements:
  • support for IPv6-only deployments and delivery status notifications.
  • Correct decoding of addresses containing UTF-8.
• The cleanup before restoring the configuration from a backup was improved, preventing issues when restoring without rebooting the system.
• Logging of errors when sending locally generated mail was improved.
• Errors in files related to TLS-policy are now also reported in the syslog.
• The output of pmgdb dump is now able to handle UTF-8 characters in rule names, object names, and comments.

Installation ISO

• the version of BusyBox shipped with the ISO was updated to version 1.36.0.
• The EFI System Partition (ESP) defaults to 1 GiB of size if the root disk partition (hdsize) is bigger than 100 GB.
• UTC can now be selected as timezone during installation.

Known Issues & Breaking Changes

• The ISO does not ship the optional dependencies for extracting text from attachments - If you installed from the ISO and want to use the feature, you can simply install them manually

apt install antiword docx2txt odt2txt poppler-utils tesseract-ocr unrtf

Proxmox Mail Gateway 7.2

Released 30. November 2022

• Based on Debian Bullseye (11.5)
• Latest 5.15 Kernel as stable default (5.15.74)
• Newer 5.19 kernel as opt-in
• ZFS 2.1.6
• SpamAssassin 3.4.6 (with updated rule-set)
• PostgreSQL 13.8

Changelog Overview

• Enhancements in the Rule system:
  • Improved handling of international emails
    • Support for UTF-8 characters in the rule system (e.g. matching non-ASCII subjects).
    • Better handling of SMTPUTF8 emails (the smtp-dialogue already contains non-ASCII data, the headers contain UTF-8 data without MIME encoding).
  • Proper encoding for template-variable information in the Notifications and Modify Field actions.
  • MatchField now matches all occurrences of a header - not only the first one - especially relevant for Received headers.
  • Deprecated the Attach, Counter and ReportSpam Actions.

  While they were present in the code of Proxmox Mail Gateway, they were never exposed in the GUI or API.

  All three have now been deprecated and will be removed with version 8.0.

• Improved Quarantine UX:
  • Quarantine interface for Administrators: many of the recent features for end-users in the Spam Quarantine have been ported to the administrator view:
    • Allow selection of multiple mails.
    • Context menu in the mail-listing.
    • Display the Receiver information in the Attachment and Virus quarantines and the Mail Info widget.
  • Augmented the information visualization in the Spam information grid.
    • The weight (number of points) and the type of impact (positive or negative) of SpamAssassin rules is now shown with colors and font-weights to make them easier to grasp.
    • The rule IDs and scores are using a monospaced font for better comparison of values.
  • Colorized Deliver and Delete actions improves intuitive handling of the common actions.
  • Display of attachments in the Spam and Virus quarantines (for a more complete overview of the mail).
  • Attachment and Virus quarantines can now optionally be filtered by Receiver - especially helpful in larger deployments.
  • Display of descriptions for locally defined SpamAssassin rules.
  • Fix displaying the quarantine interface on narrow screens: Part of the action buttons were cut off and not reachable through scrolling.

• Enhancements in the web interface (GUI):
  • The Postfix queue interface now displays the mail's headers in a decoded way - so that you see it as in your mail user agent.
  • The Statistic time selector now does not show non-existent day/month combinations (e.g. the 31. Day of February).
  • Better spacing of the Field labels in the rule object edit windows.
  • Improved translations, among others:
    • Dutch
    • German
    • Italian
    • Polish
    • Traditional Chinese
    • Turkish

• Support Proxmox Offline Mirroring & Subscription Handling
  • Proxmox Offline Mirror: The tool supports subscriptions and repository mirrors for air-gapped systems. The newly added proxmox-offline-mirror utility can now be used to keep Proxmox Mail Gateway hosts, without access to the public internet up-to-date and running with a valid subscription.

• Notable General Improvements and Bugfixes:
  • Add IP networks uniquely to template variables (postfix.mynetworks)

  If you had multiple entries in your transport directory, all pointing to the same host, they were added multiple times to the variable used in the configuration system.

  • Support for Proxmox Backup Server Namespaces.
  • Spam report emails now correctly display the From header, even if it contains a comma (e.g. "Lastname, Firstname" <firstname.lastname@domain.example>).
  • The left-over config file /etc/apt/apt.conf.d/75pmgconf was removed, enabling the automatic removal of obsolete kernel packages, which can take up significant amounts of space.
  • SpamAssassin updates now handle updates to multiple channels correctly on the first run.
  • Improved parsing of email attributes from LDAP profiles.
  • Changing the directory to '/' before running psql as postgresuser - preventing the printing of harmless but confusing warnings with various Proxmox Mail Gateway CLI utilities.
  • Support disabling TLS 1.2 and configuring TLS 1.3 ciphers for pmgproxy - following the change for pveproxy in Proxmox VE.

Upgrade from 6.4

See Upgrade from 6.x to 7.0

Proxmox Mail Gateway 7.1

Released 30. November 2021

• Based on Debian Bullseye (11.1)
• Kernel 5.13
• ZFS 2.1
• SpamAssassin 3.4.6 (with updated rule-set)
• PostgreSQL 13.5

Changelog Overview

• Enhancements in the web interface (GUI)
  • Improved configuration editing of LDAP backends: Changes can now be applied without having to specify a password.
  • The APT repository configuration, rather than being restricted to 'root', is now visible and editable by all users with 'Administrator' privileges.
  • Improved translations, among others:
    • Arabic
    • Basque
    • Brazilian Portuguese
    • French
    • German
    • Simplified Chinese
    • Traditional Chinese
    • Turkish

• Two-Factor Authentication
  • Two-factor authentication (TFA) for the web interface. Shares the TFA implementation from Proxmox Backup Server, written in rust.
  • Support for multiple types of second factors:
    • WebAuthn, which supports a wide range of security devices, like hardware keys or trusted platform modules.
    • Time-based One-Time Password (TOTP), a short code derived from a shared secret and the current time, it changes every 30 seconds.
    • Single use Recovery Keys.

• Backend and API
  • Improved support for setups using DHCP for their network configuration:

  While email still requires working DNS records, you can now manage and configure the IP of your Proxmox Mail Gateway in your DHCP configuration.

  • When adding a new entry to a Who object, a duplicate check is performed before saving.
  • Better handling of trailing dot in domain-names:

  Proxmox Mail Gateway uses the first search domain from /etc/resolv.conf as domain name - it can now handle entries with a trailing dot.

  • Delivery status notification (DSN, RFC 3461) support for outbound email with enabled before-queue filtering.

Upgrade from 6.4

See Upgrade from 6.x to 7.0

Proxmox Mail Gateway 7.0

Released 15. July 2021

• Based on Debian Bullseye (11)
• SpamAssassin 3.4.6 (with updated rule-set)
• Kernel 5.11
• PostgreSQL 13

Changelog Overview

• Enhancements in the web interface (GUI)
  • Make dashboard status panel more detailed, showing, among other things, uptime, kernel version, CPU info and a high level repository status overview.
  • New APT repository management panel in the Administration tab shows an in-depth status and a list of all configured repositories.

    Basic repository management, for example, activating or deactivating a repository, is also supported.

  • Updated ExtJS JavaScript framework to latest GPL release 7.0
  • Added advanced task-log filtering
  • Improved translations, including:
    • Arabic
    • French
    • German
    • Japanese
    • Polish
    • Turkish

• ACME/Let's Encrypt
  • Support the use of wildcard domains with the DNS plugins
  • API: nodeconfig: validate ACME config before writing

• API
  • pmgproxy: allow setting LISTEN_IP parameter
  • The "Authentication mode" setting of LDAP for the quarantine interface no longer contains the ticket-link in the report-mails - thus, quarantine users need to provide their LDAP credentials to access the quarantine.

• Installer:
  • Rework the installer environment to use switch_root instead of chroot, when transitioning from initrd to the actual installer.

    This improves module and firmware loading, and slightly reduces memory usage during installation.

  • Automatically detect HiDPI screens, and increase console font and GUI scaling accordingly. This improves UX for workstations with Proxmox VE (for example, for passthrough).
  • Improve ISO detection:
    • Support ISOs backed by devices using USB Attached SCSI (UAS), which modern USB3 flash drives often do.
    • Linearly increase the delay of subsequent scans for a device with an ISO image, bringing the total check time from 20s to 45s. This allows for the detection of very slow devices, while continuing faster in general.
  • Use zstd compression for the initrd image and the squashfs images.
  • Update to busybox 1.33.1 as the core-utils provider.

• libarchive-perl
  • The perl-bindings to libarchive have been updated to match libarchive version 3.4.3 (shipped in Debian Bullseye) - the library interface was kept backwards-compatible

• libxdgmime-perl
  • The perl-bindings to xdgmime have been updated to match current upstream - the library interface was kept backwards-compatible

Breaking Changes

• New default bind address for pmgproxy, unifying the default behavior with Proxmox VE and Proxmox Backup Server
  • In making the LISTEN_IP configurable, the daemon now binds to both wildcard addresses (IPv4 0.0.0.0:8006 and IPv6 [::]:8006) by default.

  Should you wish to prevent it from listening on IPv6, simply configure the IPv4 wildcard as LISTEN_IP in /etc/default/pmgproxy:

  LISTEN_IP="0.0.0.0"

  • Additionally, the logged IP address format changed for IPv4 in pmgproxy's access log (/var/log/pmgproxy/pmgproxy.log). They are now logged as IPv4-mapped IPv6 addresses. Instead of:

  192.0.2.1- root@pam [01/06/2021:01:19:03 +0200] "GET /api2/json/config/ruledb/digest HTTP/1.1" 200 51

  the line now looks like:

  ::ffff:192.0.2.1- root@pam [01/06/2021:01:19:03 +0200] "GET /api2/json/config/ruledb/digest HTTP/1.1" 200 51

  If you want to restore the old logging format, also set LISTEN_IP="0.0.0.0"

• ClamAV has deprecated the SafeBrowsing feature:
  • These options have been removed from the shipped freshclam.conf.in template.
  • The safebrowsing config key in /etc/pmg/pmg.conf is currently ignored and will be dropped at some point in the future.

• Changes to the database layout:
  • The host column of the cgreylist table, which has not been used since Proxmox Mailgateway 6.2, has been dropped from the schema and will be dropped from existing databases during the upgrade.

• API deprecations, moves and removals
  • The upgrade parameter of the /nodes/{node}/termproxy API method has been replaced by providing upgrade as cmd parameter.
  • The domain parameter of the /config/tlspolicy API method has been replaced by the destination parameter.
  • The /quarantine/whitelist/{address} and /quarantine/blacklist/{address} API methods, that take the address as part of the path, have been deprecated in favor of explicitly providing the parameter in the request to /quarantine/whitelist and /quarantine/blacklist respectively.
  • The API methods for detailed statistics per e-mail address, which take the address as part of the path (/statistics/contact/{contact}, /statistics/sender/{sender} and /statistics/receiver/{receiver} have been deprecated in favor of /statistics/detail, which takes the address as an explicit parameter.

Known Issues

• Network: Due to the updated systemd version, and for most upgrades, the newer kernel version (5.4 to 5.11), some network interfaces might change upon reboot:
  • Some may change their name. For example, due to newly supported functions, a change from enp33s0f0 to enp33s0f0np0 could occur.

    We observed such changes with high-speed Mellanox models.

  • Bridge MAC address selection has changed in Debian Bullseye - it is now generated based on the interface name and the machine-id (5) of the system.

    Note that by default, Proxmox Mail Gateway does not use a Linux Bridge for networking, so most setups are unaffected.

• Machine-id: Systems installed using the Proxmox Mail Gateway 5.0 to 5.4 ISO may have a non-unique machine-id. These systems will have their machine-id re-generated automatically on upgrade, to avoid a potentially duplicated bridge MAC and other issues.

If you do the upgrade remotely, make sure you have a backup method of connecting to the host (for example, IPMI/iKVM, tiny-pilot, another network accessible by a cluster node, or physical access), in case the network used for SSH access becomes unreachable, due to the network failing to come up after a reboot.

Upgrade from 6.4

See Upgrade from 6.x to 7.0

Proxmox Mail Gateway 6.4

Released 30. March 2021

• Based on Debian Buster (10.9)
• SpamAssassin 3.4.5 (with update ruleset)
• Kernel 5.4.106
• ACME integration
  • Proxmox Mail Gateway now offers full integration of the ACME protocol via the GUI, enabling administrators to create valid and trusted certificates for their domains with the Let's Encrypt certificate authority, in the same way as with Proxmox VE.
  • Full support for the http-01 and dns-01 challenges, with all plugins from acme.sh.
  • Easily configurable from the GUI.
• General Certificate Management via the GUI
  • It is now possible to upload custom certificates from the web interface, or set up a cluster-wide ACME account to automatically get and renew certificates from an ACME provider.
• Support for external SpamAssassin update channels (regular automated updates).
  • By providing a short configuration file containing a SpamAssassin rule channel's URL and GPG key, Proxmox Mail Gateway will now fetch verified updates from that channel, along with the updates from updates.spamassassin.org.
  • The KAM ruleset channel is now available, and a suitable configuration file is shipped with proxmox-spamassassin.
• Improved Quarantine Management
  • The admin view of the Spam Quarantine can now display quarantined mail of all users at once.
  • All Quarantine views (admin and user) allow you to filter for subject or sender.
  • The spam quarantine can now process huge amounts of mails at once (> 3200).
• TLS-logging improvements to the Tracking Center
  • The Tracking Center now shows when an outbound connection is established over TLS.
• Enhancements to the Integration of Proxmox Backup Server
  • It is now possible to get notified about the result of a scheduled backup to a configured Proxmox Backup Server Remote.
  • Inclusion of the (potentially large) statistics database is now configurable per Remote.
• Notable Bugfixes:
  • Support for '/' in the local part of an e-mail address (quarantine and statistics view).

Proxmox Mail Gateway 6.3

Released 19. November 2020

• Based on Debian Buster (10.6)
• Updated SpamAssassin rules
• Kernel 5.4.73
• Proxmox Backup Server Integration
  Proxmox Mail Gateway is fully supported by the new Proxmox Backup Server 1.0, released on November 11, 2020:
  • Backing up to multiple remote backup servers: You can define multiple remote instances of Proxmox Backup Server to store backups on. In case of a large-scale disaster, they can be quickly restored.
  • Scheduled Backups: You can schedule regular backups via the GUI, which will then be automatically triggered by a systemd-timer unit. This removes the need for manual backup creation and individual, scripted solutions.
• Quarantine Link via login-page
  Users can request mails containing a link to their quarantineview, if enabled by the Admin. This enables users to edit their individual blocklists, even if no mails are in their quarantine. Until now this was only possible for sites using LDAP.
• Improvements to the Tracking Center
  To further improve user experience in the tracking center, pmg-log-tracker handles certain cases better:
  • The case sensitivity has been removed from the search box.
  • In case the pmg-smtp-filter fails to process emails due to misconfiguration, they are now marked as rejected.
• Notable Bugfixes:
  • DKIM signing now uses the longest matching domain for the 'd=' tag.
  • Mails held in the Attachment Quarantine are assigned a new Message-ID - fixing interoperability with certain downstream servers (for example, MS Exchange), which silently discard messages with duplicate Message-IDs.

Proxmox Mail Gateway 6.2

Released 28. April 2020

• Based on Debian Buster (10.3)
  • Proxmox Mail Gateway is based on the latest stable release of Debian 10.3 (Buster).
• SpamAssassin 3.4.4
  • Proxmox ships the latest upstream release of Apache SpamAssassin with a updated and enhance ruleset (KAM rules added)
• Kernel 5.4
  • Proxmox Mail Gateway shares the kernel with Proxmox VE and is based on the 5.4 series from Ubuntu 20.04
• pmg-log-tracker in Rust
  • pmg-log-tracker has been extended and reimplemented in the Rust programming language. pmg-log-tracker is the binary at the core of the Message Tracking Center, providing live searchable and grouped logs in the GUI.
  • The new pmg-log-tracker has support for parsing and grouping logs in before-queue filtering mode.
  • The refresh of the code base of pmg-log-tracker provides an optimized performance and more stability.

• Support for before-queue filtering in the GUI
  • With the added support for displaying before-queue filtering logs in the GUI and fixing some minor glitches in that area, the before-queue filtering can now be comfortably enabled in the GUI.

• Improved IPv6 support
  • The Mail Proxy's SPF checker also verifies SPF records for those remote mail servers connecting via IPv6.
  • Greylisting support for IPv6 addresses (with variable netmask, defaulting to '/64') - needs to be explicitly enabled.
  • Who-objects containing IPv6 literal address work now.

• Customizable netmask length for greylist matching
  • Instead of fixing a greylist network to a '/24' the administrator can now configure which hosts should be considered as belonging to the same network by setting a larger (or smaller) prefix.
  • This can help with receiving mail from some cloud-providers, who send out one mail from different ip addresses within a large network, which usually leads to a rather long delay and sometimes even to a legitimate mail being rejected.
  • Due to the changed database layout partial upgrades of clusters will prevent nodes running the older version from syncing the greylist database until they are upgraded.

• Better UX for the User Spam Quarantine interface
  • If selected in the Quarantine view, the From header and the Subject are now displayed on top of the mail body.
  • It is now possible to delete mail addresses containing certain special characters (for example '/') from a users' black- or whitelist.
  • Users can set their preferred language directly in the quarantine interface instead of having to log out to change the setting.
  • Fixed a bug in the selection of multiple e-mails.

• Handling of changes to overridden templates with ucf
  • Starting with this release all service configuration templates, copied and modified in /etc/pmg/templates get registered with ucf. Should a overridden template change with a new package version the administrator is asked and can accept or reject the changes.
  • All users who have templates in /etc/pmg/templates will be asked about the current changes for the initial registration.

• New What Object: 'Match Archive Filename'
  • In addition to match files in archives (zip, tar.gz, rar,...) based on the file's content-type, it is also possible to look for particular filename patterns inside of archives.
  • This completes the feature matrix of matching files based on content-type or filename, as plain attachments, or inside archives.

• Support for downstream LMTP servers
  • In certain setups there is no advantage in having a dedicated SMTP server for receiving e-mails from Proxmox Mail Gateway, since all used functionality is provided by a MTA, which speaks IMAP and LMTP (e.g., Dovecot).
  • It is now possible to configure Proxmox Mail Gateway to send e-mails directly to a LMTP relay, both as default transport and only as transport for certain domains.

• Improvements to recently added features
  • Before-queue filtering and DKIM signing, both implemented with Proxmox Mail Gateway 6.1, have a better user experience and are considered stable now.
  • Some remaining glitches and bugs fixed for both.
  • DKIM selector handling can handle the existence of multiple selectors and in the GUI, users can comfortably switch between the active selector.

• TLS policy selection for internal downstream servers
  • It is now possible to specify a desired level of encryption and authentication for the opportunistic TLS-encryption (STARTTLS) for downstream servers entered in your transports.
  • This can help to ensure that your internal communication is not sent in the clear over the network. It can also be used to work around broken TLS implementations in legacy downstream servers.

• Improvements to general usability
  • The unbounded growth of the Quarantine disk usage for non-master nodes in clustered setups is fixed.
  • It's now possible to switch to incremental updates of the AV signatures for ClamAV via GUI, alleviating the problem that both methods fail in certain cases for some users.

Proxmox Mail Gateway 6.1

Released 27. November 2019

• Based on Debian Buster (10.2)
  • Proxmox Mail Gateway is based on the latest stable release of Debian 10.2 (Buster).
• Updated SpamAssassin rules
• Kernel 5.3
  • Proxmox Mail Gateway shares the kernel with Proxmox VE and is based on the 5.3 series from Ubuntu 19.10

• DKIM-Signing
  • Support for adding DomainKeys Identified Mail (DKIM) Signatures (RFC 6376) to outbound emails
  • Configuration via GUI
  • Signing happens after processing the email with the rule system, thus ensuring that it leaves the Proxmox Mail Gateway with a valid signature
  • Flexible control of which domains should get signed with sensible defaults (the relay domains)
  • Inside a cluster, one common selector minimizes the overhead for adding required DNS entries

• Attachment Quarantine
  • The Remove Attachments action can now optionally deliver the complete email to the Attachment Quarantine
  • The Attachment Quarantine offers a comfortable GUI for selectively downloading parts of the email for further analysis, or delivering the mail to the original recipient
  • Accessible only by the administrators, it offers safety from accidentally open malicious executables, doc-files, and other attachments infected with malware

• Adjustable SpamAssassin Rule Scores via GUI
  • Adapt the scores of individual SpamAssassin rules directly in the GUI
  • Enables you to adapt the scoring to your environment, thus achieving better ham/spam detection rates
  • Mostly for adding a bit of weight to rules, which are good indicators for Spam in your environment
  • Selectively disable Rules, which cause false positives for your environment

• Improved handling of Configuration and Rule changes in clustered environments
  • The Filtering Engine gets notified about a range of configuration changes which require a reload
  • The notification is propagated during the cluster sync
  • This reduces the situations where you had to manually restart pmg-smtp-filter

• Experimental Support for Before Queue filtering
  • Proxmox Mail Gateway can now optionally reject an email during the SMTP dialogue, instead of accepting it and silently discarding unwanted email
  • This is a requirement in certain situations
  • By answering with a permanent failure code (554), there is no need to generate a Non-Delivery Report, which could cause your system to get blacklisted, due to Backscatter
  • Currently incompatible with the Tracking Center, thus needs to be explicitly enabled in /etc/pmg/pmg.conf

• Improvements to general usability
  • Clarification of ambiguously used terms in the GUI and documentation
  • More detailed documentation of the Service Configuration Templates
  • Downloading of emails larger than 2 MB as eml from the Spam Quarantine now works
  • API-Viewer now usable from inside every running PMG installation at https://pmg.local:8006/api-viewer/index.html or just online via https://pmg.proxmox.com/pmg-docs/api-viewer/index.html

Proxmox Mail Gateway 6.0

Released 27. August 2019

• Proxmox Mail Gateway is based on the latest stable release of Debian 10.0 (Buster)
• This major version update provides an easy to follow step-by-step upgrade path - https://pmg.proxmox.com/wiki/index.php/Upgrade_from_5.x_to_6.0
• Rule name logging - each final action now logs the name of the rule which triggered it to the system log
• The system logs get displayed faster in the GUI because they now use the Proxmox `mini-journalreader` instead of `journalctl`
• ClamAV 0.101.4 (fix for https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934359)
• Postgres 11 (new major version backing the rule system)
• OpenSSL 1.1.1c with support for TLS 1.3
• Updated shipped SpamAssassin Ruleset
• Countless bugfixes and improvements in the GUI labels

Proxmox Mail Gateway 5.2

Released 20. March 2019

• Mobile Quarantine Interface
  • based on the small and modern framework7
  • Deliver/Delete/Whitelist/Blacklist mails in your Quarantine from your mobile device
• Improvements in the LDAP integration
  • allow the use of FQDNs instead of IPs in the WebUI
  • add support for certificate verification (and enable it for new deployments)
  • add support for LDAP+starttls
• PMG-Appliance template
  • Install PMG as a (unprivileged) Linux Container (e.g. in PVE)
  • Introduces the new 'proxmox-mailgateway-container' metapackage, which does not depend on a kernel, and results in a vastly reduced size (and fewer updates)
• Improvements in Logging
  • pmg-smtp-filter now logs each SA-Rules score in addition to the rule names - simplifying the analysis of the spam filter's performance without the need to access the mail's source
• Improvements in the WebUI's TLS configuration
• pmgproxy can now be configured via '/etc/default/pmgproxy' to disable/enable certain ciphers, compression, cipher selection preference.
• new command: `pmg-system-report`
  • Provides a overview of key characteristics of PMG's setup and performance
  • Improves the initial diagnosis for our Enterprise support
• .eml download from the (non-mobile) Quarantine Interface
  • Lets you download the complete source of a quarantined message in .eml format for further analysis
• Add support for custom checks
  • Enable users to integrate their own custom check logic by providing a defined interface, which can optionally be enabled, and runs a custom check before the mail gets handed to the virus scanner and rule system.
• Improvements of Blacklist/Whitelist handling in the Quarantine Interface
  • multiselect for removing multiple entries at once
• proxmox-spamassassin
  • Update the shipped rulesets
• PMG-Cluster: full IPv6 support
• ISO works on Citrix XenServer
• Documentation available via https://pmg.proxmox.com/pmg-docs
• Bugfixes

Proxmox Mail Gateway 5.1

Released 05. October 2018

• Allow to configure TLS policy via GUI
• New 'helpdesk' role
• Support SMTPUTF8 protocol feature
• GUI improvements
• Update Debian Stretch 9.5
• Update kernel to 4.15
• Bugfixes

Proxmox Mail Gateway 5.0

Released 23. January 2018

• Fully licensed under the open source license AGPL
• Based on Debian Stretch 9.3 with a 4.13.13 kernel
• ISO installer supports all ZFS raid levels
• ExtJS based user interface
• New API
• Integrated documentation
• Subscription-based enterprise support options (similar to the Proxmox VE support subscription model)
• Bug fixes

Old Releases

• Proxmox Mail Gateway 4.1
• Proxmox Mail Gateway 4.0
• Proxmox Mail Gateway 3.1
• Proxmox Mail Gateway 3.0
• Proxmox Mail Gateway 2.6
• Proxmox Mail Gateway 2.5
• Proxmox Mail Gateway 2.4
• Proxmox Mail Gateway 2.3
• Proxmox Mail Gateway 2.2
• Proxmox Mail Gateway 2.1
• Proxmox Mail Gateway 2.0
• Proxmox Mail Gateway 1.7
• Proxmox Mail Gateway 1.6
• Proxmox Mail Gateway 1.5
• Proxmox Mail Gateway 1.4
• Proxmox Mail Gateway 1.3
• Proxmox Mail Gateway 1.2
• Proxmox Mail Gateway 1.1
• Proxmox Mail Gateway 1.0 (April 2005)