Hello list, I'm trying to setup a sendmail config using tls to use gmail as a smart-host.
I made a copy of openbsd-proto.mc as follows: divert(-1) # # Default OpenBSD sendmail configuration for systems accepting mail # from the internet. # # Note that lines beginning with "dnl" below are comments. divert(0)dnl VERSIONID(`@(#)openbsd-proto.mc $Revision: 1.11 $')dnl OSTYPE(openbsd)dnl define(`SMART_HOST', `smtp.gmail.com')dnl define(`confPRIVACY_FLAGS', `authwarnings,needmailhelo,noexpn,novrfy,nobodyreturn')dnl define(`confCW_FILE', `-o MAIL_SETTINGS_DIR`'local-host-names')dnl define(`confCT_FILE', `-o MAIL_SETTINGS_DIR`'trusted-users')dnl FEATURE(nouucp, `reject')dnl FEATURE(`access_db', `hash -o -T<TMPF> /etc/mail/access')dnl FEATURE(`blacklist_recipients')dnl FEATURE(`use_cw_file')dnl FEATURE(`mailertable', `hash -o /etc/mail/mailertable')dnl FEATURE(`use_ct_file')dnl FEATURE(`virtusertable', `hash -o /etc/mail/virtusertable')dnl FEATURE(genericstable, `hash -o /etc/mail/genericstable')dnl FEATURE(always_add_domain)dnl FEATURE(redirect)dnl FEATURE(`no_default_msa')dnl DAEMON_OPTIONS(`Family=inet, Address=0.0.0.0, Name=MTA')dnl DAEMON_OPTIONS(`Family=inet6, Address=::, Name=MTA6, M=O')dnl DAEMON_OPTIONS(`Family=inet, Address=0.0.0.0, Port=587, Name=MSA, M=E')dnl DAEMON_OPTIONS(`Family=inet6, Address=::, Port=587, Name=MSA6, M=O, M=E')dnl CLIENT_OPTIONS(`Family=inet, Address=0.0.0.0')dnl CLIENT_OPTIONS(`Family=inet6, Address=::')dnl define(`confBIND_OPTS', `WorkAroundBrokenAAAA')dnl define(`CERT_DIR', `MAIL_SETTINGS_DIR`'certs')dnl define(`confCACERT_PATH', `CERT_DIR')dnl define(`confCACERT', `CERT_DIR/CAcert.pem')dnl define(`confSERVER_CERT', `CERT_DIR/localsendmailcert.pem')dnl define(`confSERVER_KEY', `CERT_DIR/localsendmailkey.pem')dnl define(`confCLIENT_CERT', `CERT_DIR/localsendmailcert.pem')dnl define(`confCLIENT_KEY', `CERT_DIR/localsendmailkey.pem')dnl MAILER(local)dnl MAILER(smtp)dnl LOCAL_RULESETS HMessage-Id: $>CheckMessageId SCheckMessageId R< $+ @ $+ > $@ OK R$* $#error $: 553 Header Error Followed by: # make mysendmail.cf rm -f mysendmail.cf ( cd /usr/share/sendmail/cf && /usr/bin/m4 /usr/share/sendmail/cf/../m4/cf.m4 mysendmail.mc > /usr/share/sendmail/cf/mysendmail.cf ) echo "### mysendmail.mc ###" >>mysendmail.cf sed -e 's/^/# /' /usr/share/sendmail/cf/mysendmail.mc >>mysendmail.cf chmod 444 mysendmail.cf Then I created the necessary certificates: $ sudo mkdir /etc/mail/certs $ sudo openssl dsaparam 1024 -out dsa1024.pem Generating DSA parameters, 1024 bit long prime This could take some time ................+..........+................+++++++++++++++++++++++++++++++++++++++++++++++++++* .........+..........+.......+.+.....+.+....+.+...+...+..............+.+...........+.+.+...............................+..........+.......+.........+++++++++++++++++++++++++++++++++++++++++++++++++++* $ sudo openssl req -x509 -nodes -days 365 -newkey dsa:dsa1024.pem -out /etc/mail/certs/localsendmailcert.pem -keyout /etc/mail/certs/localsendmailkey.pem Generating a 1024 bit DSA private key writing new private key to '/etc/mail/certs/localsendmailkey.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) []:FR State or Province Name (full name) []:Alsace Locality Name (eg, city) []:Strasbourg Organization Name (eg, company) []:Me Organizational Unit Name (eg, section) []:mail Common Name (eg, fully qualified host name) []:localhost Email Address []:[EMAIL PROTECTED] $ sudo ln -s /etc/mail/certs/localsendmailcert.pem /etc/mail/certs/CAcert.pem $ sudo rm dsa1024.pem $ sudo chmod -R go-rwx /etc/mail/certs Then I ran sendmail with -C/etc/mail/mysendmail.cf When I tried to send an email from mutt, I got the following log: Oct 6 22:53:04 castor sm-mta[29257]: starting daemon (8.13.4): [EMAIL PROTECTED]:30:00 Oct 6 22:53:06 castor sm-mta[20830]: STARTTLS=client, relay=smtp.gmail.com, version=TLSv1/SSLv3, verify=FAIL, cipher=DES-CBC3-SHA, bits=168/168 Oct 6 22:53:06 castor sm-mta[20830]: j95E6r6E009458: to=<[EMAIL PROTECTED]>, delay=1+06:46:13, xdelay=00:00:02, mailer=relay, pri=5611353, relay=smtp.gmail.com [72.14.205.109], dsn=5.0.0, stat=Service unavailable Oct 6 22:55:14 castor sendmail[17077]: j96KtEQB017077: from=ericd, size=561, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, [EMAIL PROTECTED] Oct 6 22:55:14 castor sendmail[17077]: STARTTLS=client, relay=[127.0.0.1], version=TLSv1/SSLv3, verify=FAIL, cipher=DHE-DSS-AES256-SHA, bits=256/256 Oct 6 22:55:14 castor sm-mta[721]: STARTTLS=server, [EMAIL PROTECTED] [127.0.0.1], version=TLSv1/SSLv3, verify=NO, cipher=DHE-DSS-AES256-SHA, bits=256/256 Oct 6 22:55:14 castor sm-mta[721]: j96KtEx1000721: from=<[EMAIL PROTECTED]>, size=719, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, [EMAIL PROTECTED] [127.0.0.1] Oct 6 22:55:14 castor sendmail[17077]: j96KtEQB017077: [EMAIL PROTECTED], ctladdr=ericd (1000/1000), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30561, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (j96KtEx1000721 Message accepted for delivery) Oct 6 22:55:16 castor sm-mta[19538]: STARTTLS=client, relay=smtp.gmail.com, version=TLSv1/SSLv3, verify=FAIL, cipher=DES-CBC3-SHA, bits=168/168 Oct 6 22:55:16 castor sm-mta[19538]: j96KtEx1000721: to=<[EMAIL PROTECTED]>, ctladdr=<[EMAIL PROTECTED]> (1000/1000), delay=00:00:02, xdelay=00:00:02, mailer=relay, pri=30719, relay=smtp.gmail.com [72.14.205.109], dsn=5.0.0, stat=Service unavailable After a wile, I got this mail: From: Mail Delivery Subsystem <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Returned mail: see transcript for details Date: Thu, 6 Oct 2005 23:05:18 +0200 (CEST) [-- Attachment #1 --] [-- Type: text/plain, Encoding: 7bit, Size: 0.5K --] The original message was received at Thu, 6 Oct 2005 22:55:14 +0200 (CEST) from [EMAIL PROTECTED] [127.0.0.1] ----- The following addresses had permanent fatal errors ----- <[EMAIL PROTECTED]> (reason: 530 5.7.0 Authentication Required e13sm1175575qbe) ----- Transcript of session follows ----- ... while talking to smtp.gmail.com: >>> MAIL From:<[EMAIL PROTECTED]> SIZE=719 <<< 530 5.7.0 Authentication Required e13sm1175575qbe 554 5.0.0 Service unavailable [-- Attachment #2 --] [-- Type: message/delivery-status, Encoding: 7bit, Size: 0.3K --] Reporting-MTA: dns; castor.workgroup Received-From-MTA: DNS; localhost Arrival-Date: Thu, 6 Oct 2005 22:55:14 +0200 (CEST) Final-Recipient: RFC822; [EMAIL PROTECTED] Action: failed Status: 5.7.0 Diagnostic-Code: SMTP; 530 5.7.0 Authentication Required e13sm1175575qbe Last-Attempt-Date: Thu, 6 Oct 2005 22:55:16 +0200 (CEST) [-- Attachment #3 --] [-- Type: text/rfc822-headers, Encoding: 8bit, Size: 0.8K --] Return-Path: <[EMAIL PROTECTED]> Received: from castor.workgroup ([EMAIL PROTECTED] [127.0.0.1]) by castor.workgroup (8.13.4/8.13.4) with ESMTP id j96KtEx1000721 (version=TLSv1/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=NO) for <[EMAIL PROTECTED]>; Thu, 6 Oct 2005 22:55:14 +0200 (CEST) Received: (from [EMAIL PROTECTED]) by castor.workgroup (8.13.4/8.13.4/Submit) id j96KtEQB017077 for [EMAIL PROTECTED]; Thu, 6 Oct 2005 22:55:14 +0200 (CEST) Date: Thu, 6 Oct 2005 22:55:14 +0200 From: Eric Dillenseger <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Test TLS Message-ID: <[EMAIL PROTECTED]> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-15:utf-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit User-Agent: Mutt/1.5.8i Now I see it successfully connected to gmail smtp, but didn't authenticate. My question is, how can I make it authenticate? -- "Any attempt to brew coffee with a teapot should result in the error code "418 I'm a teapot". The resulting entity body MAY be short and stout." -- HTCPCP Spec, RFC 2324