Can I send email unauthenticated to an internal SMTP server which then relays onto authenticated SMTP?

Question

I have a back-end system which only supports sending email to an UNauthenticated SMTP server, however, ultimately it needs to go via an authenticated SMTP server on the public internet.

My idea was to send it internally to a local SMTP server unauthenticated, and then have that middleman server relay to an authenticated public SMTP server (such as gmail) with the relevant credentials.

Can this be done, any recommended SMTP servers?

By the way, searching on Google with search terms "unauthenticated" and "authenticated" in the same query doesn't seem to get me far, it just gives me a load of results where people want to access SMTP servers without authentication. Nothing on relaying from unauth to auth with credentials intact. (Or something to that effect).

Cheers, Mike.

Answer 1

In case you're a Windows guy, the IIS virtual SMTP service can be installed on most versions of Windows Server, which can be configured to accept anonymous inbound connections and forward to an authenticated smarthost, in much the same way as Matt's Heraka option:

In the vSMTP service's properties, within IIS Manager:

• The Access tab has an Authenticaton button, from which you can tick Anonymous access -- this will allow unauthenticated inbound SMTP connections

• The Access tab also has Connection Control and Relay buttons, which I would probably use to limit access to the SMTP to known IPs (if you are running your service from the same server, you can limit these to 127.0.0.1, for example)

• The Delivery tab has an Advanced button, from which you can configure a Smart host, which is the hostname/IP of your authenticated SMTP server (I would turn off Attempt direct delivery here, so it always uses the smart host)

• The Delivery tab also has an Outbound Security button, where you can define the Basic authentication username/password/TLS settings supplied by your authenticated SMTP server's administrators.

By supplying the right combination to these settings, you should be able to achieve what you are looking for.

J.

Answer 2

You can set this up very easily with Haraka. Just configure the smtp_forward plugin to use authentication and it will all Just Work (tm).

To do this, in your config/smtp_forward.ini configuration file add the following:

host=your_outbound_server_or_IP
; could be 587
port=25

[auth]
type=plain
user=your_valid_username
pass=your_password

In config/plugins you will only need one line:

queue/smtp_forward

And then start Haraka using the instructions you can find all around the web. It should just work perfectly for your needs.

Answer 3

In Postfix, the following settings allow you to do this:

smtp_sender_dependent_authentication = yes
sender_dependent_relayhost_maps = hash:/etc/postfix/sender_relay
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_password
smtp_sasl_security_options = noanonymous

In my case, I had to use sender_dependent_relayhost_maps to redirect mails sent from gmail to point to an stunnel that would make the SSL/TLS wrapping for me:

[email protected]      [127.0.0.1]:23456

and stunnel would be configured appropriately:

[smtp-tls-wrapper-for-gmail]
accept = 23456
client = yes
connect = smtp.googlemail.com:smtps

then, the password maps would be at the /etc/postfix/sasl_password. It is a simple map:

[email protected]        [email protected]:my_gmail_password

See also postconf(5)

Be careful with the above settings: they allow any application on your computer to send e-mail authenticated as your gmail account. This is a solution that does what you asked for, it may not be the best solution to your exact use case.