On Thu, 30 Jul 2026 at 12:26:08 +0100, Richard Lewis wrote:
Simon McVittie <[email protected]> writes:
SMTP over TCP is the lowest-common-denominator email submission
protocol, but any protocol over TCP has the big disadvantage that it's
necessary to be able to authenticate the sender in some way, if you
want any access control beyond "every process on this machine can send
email, and the system can't tell which process/user was responsible".
(isnt the bit in quotes exactly what the current sendmail interface
provides, perhaps changing it should be left for another day?)
No, if you exec /usr/sbin/sendmail, the MTA infrastructure has the
option to log facts about that sendmail process, such as your uid (and
in theory other facts like process ID, whether you're in a container or
cgroup, AppArmor profile and so on), in mail.log or the message headers
or whatever place its implementor thinks is most appropriate. For
example:
% ssh people.debian.org
$ mail smcv
results in a mail that says:
Received: from smcv by paradis.debian.org with local (Exim 4.96) ...
because the exim service on p.d.o is in a position to know who I am (it
can get my uid from the sendmail process that I ran, and then my
username from /etc/passwd or other NSS mechanisms).
Unlike the envelope-from (which is under my control), this is
unforgeable, or at least, a MTA author can make it unforgeable - I don't
know for sure that the authors of Exim did, but I hope so.
But if I had done SMTP to TCP port 25 or 587 then either I would
have to authenticate (in practice with a username/password), or the mail
would have to just say something like:
Received: from localhost ([::1]:39364) by paradis.debian.org with smtp
(Exim 4.96) ...
because the MTA doesn't actually know who I am, and has to believe my
assertions about my identity (the envelope-from).
smcv
