Re: [OT]sendmail ssl authentication

[reader@newsguy.com]

David <de_bb@arcor.de> writes:

> reader@newsguy.com writes:
>> And it does appear there may be some hope since I see mention of
>> STARTTLS in the output of swaks:
>>   
>> reader > swaks --auth --tls-on-connect -p 465 -s smtp.comcast.net   
>> To: reader@jtan.com
>> Username: My-uid
>> Password: My-passwd
>> === Trying smtp.comcast.net:465...
>> === Connected to smtp.comcast.net.
>> === TLS started w/ cipher DHE-RSA-AES256-SHA
>> <~  220 OMTA02.emeryville.ca.mail.comcast.net comcast ESMTP server ready
>
> The "--tls-on-connect" initiates a ssmtp connection, i.e. the TLS
> session is started right away so that everything is already encrypted
> (even the server greeting).

> When I telnet to smtp.comcast.net on the SMTP standard port (25) I also
> see a "250-STARTTLS" after the EHLO handshake, so this server should
> support STARTTLS on the standard port, and that's the correct thing to
> do for SSL encrypted authentication. You can try it with

Odd, when I do it, which is what led to my posting here, It refuses to
connect at all:
  reader > telnet smtp.comcast.net 25
Trying 76.96.30.117...
  Finally times out and server closes.
So no EHLO is possible.

I wonder if they block their own customers or something..?

However I learned it did show STARTTLS on port 587 by telnetting there
so I configured sendmail to contact port 587 and all is well.

The server I get on 587:
  OMTA14.westchester.pa.mail.comcast.net

But trying the exact name on port 25 I still cannot connect.

> If this works, configure sendmail to do authentication with STARTTLS on
> the standard port 25 and don't use port 465. If it doesn't work, you
> might indeed have to set up stunnel if sendmail doesn't support ssmtp
> directly.

See above... but there is no real configuring to do.. at least not for
clientside.. modern sendmail, if it has STARTTLS compiled in, will do
the right thing if you have the password and uid in the necessary
places.

Thanks for your input... I like swaks.  Although telnet will tell you
enough to figure it out .. swaks is nice