From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from b-painless.mh.aa.net.uk ([81.187.30.52]) by ur; Thu Dec 1 15:29:04 EST 2016 Received: from 10.190.187.81.in-addr.arpa ([81.187.190.10] helo=quintile.net) by b-painless.mh.aa.net.uk with esmtp (Exim 4.84_2) (envelope-from ) id 1cCXyC-0004kS-6a for 9front@9front.org; Thu, 01 Dec 2016 20:28:40 +0000 Message-ID: <2b487c7961be5ff2ffb1c0c0165e4b97@quintile.net> From: "Steve Simon" Date: Fri, 29 May 2015 08:25:35 +0100 To: 9front@9front.org Subject: Re: [9front] using smtp port 587 In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit List-ID: <9front.9front.org> List-Help: X-Glyph: ➈ X-Bullshit: overflow-preventing property content-driven-aware CMS-scale manager I would modify /lib/mail/remotemail adding a line somthing like this: echo /bin/upas/smtp -d -h $fd $addr $sender $* > /mail/tmp/smtp.cli exec /bin/upas/smtp -d -h $fd $addr $sender $* >[2] /mail/tmp/smtp.err The important fact is that /mail/tmp exists in smtp(1)'s namespace. This way you can see exactly what is happening. There are two ways to implement tls on for smtp. Either a fully encrypted session, which plan9 does not support, or switching from a non-encrypted to an encrypted session if both ends agree (which plan9 does support). This is the HELO -v- EHLO greetingthe latter switches to TLS. you may need to ensure your plan9 supports tls1.2 if your smtp relays needs it, 9front has the fixes necessary. The labs distribution has the lines to confirm the TLS thumbprint of the relay commented out - it causes many problems in environments where the relay was implemenetd by several different servers. This may or may not be the case for your distro. the wiki has details of how to get and save the thumbprint. authentication of smtp is another issue, LOGIN and BASIC are very similar and quite insecure without TLS. NEGOIATE is a special microsoft protocol and is not supported, this leaves MD5 digest and machap which are chalange response and fairly secure. smtp tries to use tls but can be forced to talk insecurely by command line options. hope this helps, -Steve