How does dnf-automatic send emails without knowing a password?

Question

In the dnf-automatic config file automatic.conf I see the following lines under the email section.

[email]
# The address to send email messages from.
email_from = [email protected]

# List of addresses to send messages to.
email_to = [email protected]

# Name of the host to connect to to send email messages.
email_host = mail.mailServer.com

How does dnf-automatic send an email without knowing the password of the sender [email protected]?

I don't see a spot to put the password. I must be missing something but I don't know what.

Answer 1

In general, sending email via SMTP doesn't require authentication, and you can just spoof any From and Return-Path address (unless restricted). The email feature on DNF Automatic seems to rely on that.

DNF is supposed to be the next-generation replacement for YUM, but it doesn't have much options regarding sending mail. Although complained in 2016, it doesn't support STARTTLS for encrypting the mail, and it doesn't support SMTP authentication.

However, DNF Automatic supports dropping mail to Sendmail using emit_via = command_email. See the documentation for the [command_email] section. This way you can control the message before it leaves the server.