This post describes the configuration of Sendmail to use SMTP-AUTH when connecting to a remote MTA to send messages. Such a configuration would be needed in case you have a dynamic ip and your ISP relays the messages for you, but they require authentication. This is not a post about how to set your mta to authenticate users and to relay for them. This will show you how to set it to authenticate itself to other mta that will relay messages for you.
Sendmail comes installed by default on a clean FreeBSD 6.2 system, but is has no support for SMTP authentication using SASL by default, so it needs to be recompiled.
Install Cyrus SASL
You can compile cyrus-sasl2 lib from ports (if you need to set some special options ) or install it as a package:
- cd /usr/ports/security/cyrus-sasl2
- make install clea
Or just install it from packages with:
- pkg_add -r cyrus-sasl2
First you need to make sure you set the compile flags so that Sendmail uses cyrus-sasl2:
- echo "
- SENDMAIL_CFLAGS=-I/usr/local/include -DSASL=2
- " >> /etc/make.conf
and then just recompile it and install:
- cd /usr/src/usr.sbin/sendmail
- make clean
- make depend
- make install
Make sure you have the right mc files. Go to /etc/mail and type: make all install . This will create a .mc file named [your_hostname].mc .
Edit that file, look for a line like “define(`SMART_HOST', `your.isp.....” and replace your.isp with the host that will relay messages for you. After that line add the following lines:
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl FEATURE(`authinfo',`hash /etc/mail/auth/client-info')dnl
Note: In case your ISP's MTA does not accept connections on port 25, but another port you can tell sendmail to connect on that port by using something like the following line:
define(`RELAY_MAILER_ARGS', `IPC $h 587')dnl
where 587 is the port where your ips accepts connections for smtp relay.
Now you have to regenerate the .cf file. Type make all install in /etc/mail and you should have everything set in sendmail.cf .
All that's left to do is to create the file that will hold the information about the username and password to use when authenticating to your ISP's MTA : /etc/mail/auth/client-info :
- mkdir /etc/mail/auth
- chmod 700 /etc/mail/auth
- cd /etc/mail/auth
- echo '
- AuthInfo:[YOUR.ISP.MTA.HOST] "U:root" "I:[YOUR_USERNAME]" "P:[YOUR_PASSWORD]"
- ' > client-info
- makemap hash client-info < client-info
Now you can start/restart sendmail and everything should be ok.