Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to set up my sendmail to authenticate against a relay (comcast). I'm not seeing any attempts to authenticate at all. I'm trying to just debug how authentication works, and can't connect all the pieces...

I have, in my .mc file:

define(`RELAY_MAILER_ARGS', `TCP $h 587')dnl
define(`SMART_HOST', `relay:smtp.comcast.net.')dnl
define(`confAUTH_MECHANISMS', `PLAIN')dnl
FEATURE(`authinfo',`hash /etc/mail/client-info')dnl

And in my /etc/mail/client-info:

AuthInfo:*.comcast.net "U:root" "I:comcast_user" "P:comcast_password"

Now, I know everything is fine with the u/p, as I could authenticate directly through SMTP, using telnet.

There are two things I don't understand.

  1. When AuthInfo records are searched for, they are matched by the target hostname. How? Does it it use the map key (something I would expect), or uses the so-called "Domain" ("R:" parameter that I don't set in my auth-info line)

  2. What is "U:", really? Sendmail README (http://www.sendmail.org/m4/smtp_auth.html) says it's "user(authoraztion id)", and "I:" is "authentication ID". That suggests that my username should be in "U:", actually, but http://www.sendmail.org/~ca/email/auth.html says that "I:" is your remote user name.

The session looks like this:

[root@manticore]/etc/mail# sendmail -qf -v
Warning: Option: AuthMechanisms requires SASL support (-DSASL)

Running /var/spool/mqueue/p97CgcWq023273 (sequence 1 of 399)
my@email.com... Connecting to smtp.comcast.net. port 587 via relay...
220 omta19.westchester.pa.mail.comcast.net comcast ESMTP server ready
>>> EHLO my.host.name
250-omta19.westchester.pa.mail.comcast.net hello [my.ip.add.res], pleased to meet you
250-HELP
250-AUTH LOGIN PLAIN
250-SIZE 15728640
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-STARTTLS
250 OK
>>> STARTTLS
220 2.0.0 Ready to start TLS
>>> EHLO my.host.name
250-omta19.westchester.pa.mail.comcast.net hello [my.ip.add.res], pleased to meet you
250-HELP
250-AUTH LOGIN PLAIN
250-SIZE 15728640
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 OK
>>> MAIL From:<> SIZE=2183
550 5.1.0 Authentication required
MAILER-DAEMON... aliased to postmaster
postmaster... aliased to root
root... aliased to my@email.com
postmaster... aliased to root
root... aliased to my@email.com
>>> RSET
250 2.0.0 OK


[root@manticore]/etc/mail# sendmail -d0.1
Version 8.14.3
 Compiled with: DNSMAP LOG MAP_REGEX MATCHGECOS MILTER MIME7TO8 MIME8TO7
                NAMED_BIND NETINET NETINET6 NETUNIX NEWDB NIS PIPELINING SCANF
                SOCKETMAP STARTTLS TCPWRAPPERS USERDB XDEBUG

Thanks, Pawel.

share|improve this question

2 Answers 2

if FEATURE(`authinfo') is used, then the hostname in the map entry must match exactly the hostname of the ISP mailserver

See at your SMART_HOST + client-info

What is "U:", really?

Well, SMTP Authentication states in pure English

U user (authorization) id

I authentication id

...

User or authentication id must exist as well as the password. All other entries have default values. If one of user or authentication id is missing, the existing value is used for the missing item.

share|improve this answer
    
In my .cf file, it says: DSsmtp.comcast.net, and in my client-info, it says AuthInfo:smtp.comcast.net "U:*" "I:username" "P:password" All of this is literally (except for credentials). I don't see even an attempt to authenticate. –  Pawel Veselov Oct 11 '11 at 2:23
    
makemap hash client-info < client-info - yes? /etc/init.d/sendmail restart - yes? And just for test, in client-info "P:username" –  Lazy Badger Oct 11 '11 at 3:31
    
Option: AuthMechanisms requires SASL support (-DSASL) –  Lazy Badger Oct 11 '11 at 3:32
    
I have Makefiles that build my hashmaps. And I don't restart sendmail, as I was running it from command line as with -q -v flags. –  Pawel Veselov Oct 11 '11 at 5:48
    
yes, the -DSASL was the problem. saw your comment after posting the answer. –  Pawel Veselov Oct 11 '11 at 5:48

My solution was very simple. Default OpenBSD sendmail doesn't have SASL flag set, and can not do any authentication, even plain text. I actually expected that SASL is only used for "advanced" authentication. My -d0.1 output clearly shows no SASL flag.

For those who have the same issue: this page (http://theory14.wordpress.com/2009/06/16/openbsd-smtp-authtls-imaps-proxy/) vaguely (it's not a step-by-step how-to-fix-OpenBSD-sendmail-for-SASL page) explains on the necessary steps to go through. Basically, -- download userland source, and rebuild sendmail with -DSASL flag.

P.S. I think, the "U:" is really the user that runs sendmail, where "I:" is the user to authenticate to the client.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.