Client Authentication

[Erik Nørgaard]

On 24/03/2013 17:50, Waitman Gobble wrote:
> On Sun, Mar 24, 2013 at 1:25 AM, Doug Hardie <bc979 at lafn.org> wrote:
>
> One idea is to run a different server process on 25 which does not do SMTP
> AUTH,, then run SMTP AUTH on 465 or 587. I don't really see a reason to
> advertise SMTP AUTH on 25, for some reason all mail servers seem to do AUTH
> on all ports or none. Maybe there is a way to configure SMTP AUTH only on
> certain ports, one way I can think of is to run two processes with two
> configs.

Port 25 should be open for external connections and allow only local 
delivery. 465 is STMPS and should be configured as 25 but with SSL, this 
is really only useful if you have a certificate issued by a trusted CA 
as other servers will otherwise reject your certificate as untrusted.

Port 587 is for message submission, see RFC 2476, you can configure it 
with TLS (serverside) and it should only advertise STARTTLS. Here you 
can create your own CA as you control all clients who are authorized to 
connect and can install the CA certificate.

A simpler setup though is to have yor MTA listen on both port 25 and 587 
and announce all services required for local delivery plus STARTTLS. 
Then require TLS for authentication.

I understood you use dovecut as MDA? which is your MTA? With postfix the 
above is pretty simple to set up.

BR, Erik
-- 
M: +34 666 334 818
T: +34 915 211 157