26.10. SMTP Authentication
前一頁 | 章 26. 電子郵件 | 下一頁

## 26.10. SMTP Authentication

Written by James Gorham.

Having SMTP Authentication in place on your mail server has a number of benefits. SMTP Authentication can add another layer of security to sendmail, and has the benefit of giving mobile users who switch hosts the ability to use the same mail server without the need to reconfigure their mail client settings each time.

1. Install security/cyrus-sasl2 from the ports. You can find this port in security/cyrus-sasl2. The security/cyrus-sasl2 port supports a number of compile-time options. For the SMTP Authentication method we will be using here, make sure that the `LOGIN` option is not disabled.

2. After installing security/cyrus-sasl2, edit `/usr/local/lib/sasl2/Sendmail.conf` (or create it if it does not exist) and add the following line:

       pwcheck_method: saslauthd

3. Next, install security/cyrus-sasl2-saslauthd, edit `/etc/rc.conf` to add the following line:

       saslauthd_enable="YES"

   and finally start the saslauthd daemon:

       # /usr/local/etc/rc.d/saslauthd start

   This daemon serves as a broker for sendmail to authenticate against your FreeBSD `passwd` database. This saves the trouble of creating a new set of usernames and passwords for each user that needs to use SMTP authentication, and keeps the login and mail password the same.

4. Now edit `/etc/make.conf` and add the following lines:

       SENDMAIL_CFLAGS=-I/usr/local/include/sasl -DSASL
       SENDMAIL_LDFLAGS=-L/usr/local/lib
       SENDMAIL_LDADD=-lsasl2

   These lines will give sendmail the proper configuration options for linking to cyrus-sasl2 at compile time. Make sure that cyrus-sasl2 has been installed before recompiling sendmail.

5. Recompile sendmail by executing the following commands:

       # cd /usr/src/lib/libsmutil
       # make cleandir && make obj && make
       # cd /usr/src/lib/libsm
       # make cleandir && make obj && make
       # cd /usr/src/usr.sbin/sendmail
       # make cleandir && make obj && make && make install

   The compile of sendmail should not have any problems if `/usr/src` has not been changed extensively and the shared libraries it needs are available.

6. After sendmail has been compiled and reinstalled, edit your `/etc/mail/freebsd.mc` file (or whichever file you use as your `.mc` file. Many administrators choose to use the output from hostname(1) as the `.mc` file for uniqueness). Add these lines to it:

       dnl set SASL options
       TRUST_AUTH_MECH(`GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN')dnl
       define(`confAUTH_MECHANISMS', `GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN')dnl

   These options configure the different methods available to sendmail for authenticating users. If you would like to use a method other than pwcheck, please see the included documentation.

7. Finally, run make(1) while in `/etc/mail`. That will run your new `.mc` file and create a `.cf` file named `freebsd.cf` (or whatever name you have used for your `.mc` file). Then use the command `make install restart`, which will copy the file to `sendmail.cf`, and will properly restart sendmail. For more information about this process, you should refer to `/etc/mail/Makefile`.

If all has gone correctly, you should be able to enter your login information into the mail client and send a test message. For further investigation, set the `LogLevel` of sendmail to 13 and watch `/var/log/maillog` for any errors.

For more information, please see the sendmail page regarding SMTP authentication.

前一頁 | 上一層 | 下一頁
26.9. Using Mail with a Dialup Connection | 起始頁 | 26.11. Mail User Agents

All FreeBSD documents are available for download at http://ftp.FreeBSD.org/pub/FreeBSD/doc/

Questions that are not answered by the documentation may be sent to <freebsd-questions@FreeBSD.org>.
Send questions about this document to <freebsd-doc@FreeBSD.org>.