Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

282

|

Chapter 9: Securing Internet Email

The client-server SMTP relay authentication scenario I’m describing here is applica-

ble mainly to non-Linux clients. Although this book is about Linux, such scenarios

are very common, even when the SMTP server itself runs Linux.

If your remote users do in fact use Linux, their outbound email should

probably be delivered not by their MUA but by their local sendmail

process (although some of the newer Linux MUAs such as GNOME’s

balsa do support SMTP). We’ve already covered how to configure

Sendmail as an SMTP AUTH client; the specifics are the same whether

this client runs Sendmail as a daemon (i.e., the client is a server itself)

or whether it runs Sendmail only as needed to deliver outbound mail.

On the client side, each user will need to configure his MUA with his username and

password from the Sendmail server; this is usually in a section entitled “SMTP server

settings,” “Sending,” etc.

But there’s one small problem with this (besides the fact that your public SMTP

server probably shouldn’t have ordinary user accounts, which is an architectural

problem): the

LOGIN and PLAIN methods send passwords over the network in

cleartext. That’s bad, right?

Right. For this reason, TLS encryption really should be used any time you use these

methods. Luckily, ...