From Newsgroup: comp.mail.sendmail

I am in the process of replacining a tired old server running sendmail 8.15.2. Before I turn it off I want to make it send its remaining mail through the
new server (which isn't running sendmail but that shouldn't matter.)

I see the SMART_HOST macro, but I want to make it relay with ssl to port
465 or with STARTTLS to port 587 on the new server. I have looked through
the manual and if it's there, I don't see it.

TIA
--
Regards,
John Levine, johnl@taugh.com, Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly
--- Synchronet 3.21f-Linux NewsLink 1.2

From Newsgroup: comp.mail.sendmail

John Levine <johnl@taugh.com> wrote:

I am in the process of replacining a tired old server running sendmail 8.15.2.
Before I turn it off I want to make it send its remaining mail through the new server (which isn't running sendmail but that shouldn't matter.)

I see the SMART_HOST macro, but I want to make it relay with ssl to port
465 or with STARTTLS to port 587 on the new server. I have looked through the manual and if it's there, I don't see it.

I am not sure which one of these you need. I have set both
and my Sendmail connects to smart host's TCP port 587.

define(`ESMTP_MAILER_ARGS', `TCP $h 587')dnl
define(`RELAY_MAILER_ARGS', `TCP $h 587')dnl

Sendmail will use STARTTLS automatically as long as
your receiving server advertises to support it.

br,
KK
--- Synchronet 3.21f-Linux NewsLink 1.2

From Newsgroup: comp.mail.sendmail

John Levine <johnl@taugh.com> wrote:

I am in the process of replacining a tired old server running sendmail 8.15.2.
Before I turn it off I want to make it send its remaining mail through the new server (which isn't running sendmail but that shouldn't matter.)

I see the SMART_HOST macro, but I want to make it relay with ssl to port
465 or with STARTTLS to port 587 on the new server. I have looked through the manual and if it's there, I don't see it.

MSA variant is covered in sendmail FAQ:
"How do I send using an alternate port?" [A].
Replace port 2525 used in FAQ by MSA port (587).

[A] https://www.proofpoint.com/us/sendmail/faq#v8-39
--
[Andrew] Andrzej A. Filip
--- Synchronet 3.21f-Linux NewsLink 1.2

From Newsgroup: comp.mail.sendmail

According to Kalevi Kolttonen <kalevi@kolttonen.fi>:

I am not sure which one of these you need. I have set both
and my Sendmail connects to smart host's TCP port 587.

define(`ESMTP_MAILER_ARGS', `TCP $h 587')dnl
define(`RELAY_MAILER_ARGS', `TCP $h 587')dnl

Sendmail will use STARTTLS automatically as long as
your receiving server advertises to support it.

Thanks, that should do it. Just out of curiosity is
there a way to tell it to do immediate TLS on port 465?
--
Regards,
John Levine, johnl@taugh.com, Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly
--- Synchronet 3.21f-Linux NewsLink 1.2

From Newsgroup: comp.mail.sendmail

John Levine <johnl@taugh.com> wrote:

Thanks, that should do it. Just out of curiosity is
there a way to tell it to do immediate TLS on port 465?

I have no idea as I have never used port 465. I suppose
it is deprecated anyway, but I am not 100% sure.

From a performance point of view, issuing STARTTLS
ESMTP command on port 587 makes no practical difference
compared to the immediate TLS on port 465.

br,
KK
--- Synchronet 3.21f-Linux NewsLink 1.2

From Newsgroup: comp.mail.sendmail

It appears that Kalevi Kolttonen <kalevi@kolttonen.fi> said:

John Levine <johnl@taugh.com> wrote:

Thanks, that should do it. Just out of curiosity is
there a way to tell it to do immediate TLS on port 465?

I have no idea as I have never used port 465. I suppose
it is deprecated anyway, but I am not 100% sure.

It's not deprecated at all. Every MTA I know supports it. Even sendmail.

From a performance point of view, issuing STARTTLS
ESMTP command on port 587 makes no practical difference
compared to the immediate TLS on port 465.

Port 465 is considerably more resistant to man-in-the-middle and
downgrade attacks than 587 is. A naughty middlebox might edit the EHLO
response to remote STARTTLS, so the client goes ahead without it. On
465, if it can't do the handshake and get the certificate with the
expected name, the connection fails.
--
Regards,
John Levine, johnl@taugh.com, Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly
--- Synchronet 3.21f-Linux NewsLink 1.2

From Newsgroup: comp.mail.sendmail

John Levine <johnl@taugh.com> wrote:

It appears that Kalevi Kolttonen <kalevi@kolttonen.fi> said:

John Levine <johnl@taugh.com> wrote:

Thanks, that should do it. Just out of curiosity is
there a way to tell it to do immediate TLS on port 465?

I have no idea as I have never used port 465. I suppose
it is deprecated anyway, but I am not 100% sure.

It's not deprecated at all. Every MTA I know supports it. Even sendmail.

So it seems. It was obsoleted once, but reintroduced
in 2018 via RFC 8314. That's what Google tells me.

From a performance point of view, issuing STARTTLS
ESMTP command on port 587 makes no practical difference
compared to the immediate TLS on port 465.

Port 465 is considerably more resistant to man-in-the-middle and
downgrade attacks than 587 is. A naughty middlebox might edit the EHLO response to remote STARTTLS, so the client goes ahead without it. On
465, if it can't do the handshake and get the certificate with the
expected name, the connection fails.

I guess you are right.

br,
KK
--- Synchronet 3.21f-Linux NewsLink 1.2

From Newsgroup: comp.mail.sendmail

John Levine <johnl@taugh.com> wrote:

It appears that Kalevi Kolttonen <kalevi@kolttonen.fi> said:

John Levine <johnl@taugh.com> wrote:

Thanks, that should do it. Just out of curiosity is
there a way to tell it to do immediate TLS on port 465?

I have no idea as I have never used port 465. I suppose
it is deprecated anyway, but I am not 100% sure.

It's not deprecated at all. Every MTA I know supports it. Even sendmail.

How does sendmail supports it?

I know there is Flag=s in DaemonPortOptions to open a port and offer
SMTP over SSL.

But I see nothing on how sendmail connects via SMTP over SSL to
other servers in op.ps or cf/README.

Sendmail can do an automatic fallback to pure TLS?
--
Hugo Villeneuve-Lapointe
--- Synchronet 3.21f-Linux NewsLink 1.2

From Newsgroup: comp.mail.sendmail

According to Hugo Villeneuve-Lapointe <hugo_villap@email.invalid>:

John Levine <johnl@taugh.com> wrote:

It appears that Kalevi Kolttonen <kalevi@kolttonen.fi> said:

John Levine <johnl@taugh.com> wrote:

Thanks, that should do it. Just out of curiosity is
there a way to tell it to do immediate TLS on port 465?

I have no idea as I have never used port 465. I suppose
it is deprecated anyway, but I am not 100% sure.

It's not deprecated at all. Every MTA I know supports it. Even sendmail.

How does sendmail supports it?

I know there is Flag=s in DaemonPortOptions to open a port and offer
SMTP over SSL.

That's it. Ports 465 and 587 are for submission, from an MUA to an MSA.

In my application the old server is the submission cient and the new server
is the submission server.
--
Regards,
John Levine, johnl@taugh.com, Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly
--- Synchronet 3.21f-Linux NewsLink 1.2

From Newsgroup: comp.mail.sendmail

John Levine <johnl@taugh.com> wrote:

According to Hugo Villeneuve-Lapointe <hugo_villap@email.invalid>:

John Levine <johnl@taugh.com> wrote:

It appears that Kalevi Kolttonen <kalevi@kolttonen.fi> said:

John Levine <johnl@taugh.com> wrote:

Thanks, that should do it. Just out of curiosity is
there a way to tell it to do immediate TLS on port 465?

I have no idea as I have never used port 465. I suppose
it is deprecated anyway, but I am not 100% sure.

It's not deprecated at all. Every MTA I know supports it. Even sendmail. >>

How does sendmail supports it?

I know there is Flag=s in DaemonPortOptions to open a port and offer
SMTP over SSL.

That's it. Ports 465 and 587 are for submission, from an MUA to an MSA.

In my application the old server is the submission cient and the new server is the submission server.

I'm afraid I don't think it is possible to do SMTP over SSL (port
465) between 2 sendmail servers (or I don't know how to do that).

Why everyone mentions doing it over port 587 with STARTTLS.

STARTTLS should be used automaticaly but if you want to enforce it:

if you have FEATURE(`access_db') you can add to /etc/mail/access
(and recompile after):

# Sending to a mail server
TLS_Srv:relay.server.domain.name TEMP+ENCR:112
TLS_Srv:relay.server.ip TEMP+ENCR:112

# Sending to recipient email
# first match order: user@domain, user@, domain, ''
TLS_Rcpt:domain.name TEMP+ENCR:112
# or the dangerous never send an un-encrypted email again
#TLS_Rcpt: TEMP+ENCR:112

See the STARTTLS section in cf/README for details (it should be
provided in your sendmail package) or: https://fossies.org/linux/misc/sendmail.8.18.2.tar.gz/sendmail-8.18.2/cf/README?m=t
--
Hugo Villeneuve-Lapointe
--- Synchronet 3.21f-Linux NewsLink 1.2

From Newsgroup: comp.mail.sendmail

Hugo Villeneuve-Lapointe wrote:

I'm afraid I don't think it is possible to do SMTP over SSL (port
465) between 2 sendmail servers (or I don't know how to do that).

Look for _FFR_SMTPS_CLIENT in the code.
--- Synchronet 3.21f-Linux NewsLink 1.2

From Newsgroup: comp.mail.sendmail

Hugo Villeneuve-Lapointe <hugo_villap@email.invalid> writes:

John Levine <johnl@taugh.com> wrote:

That's it. Ports 465 and 587 are for submission, from an MUA to an MSA.

In my application the old server is the submission cient and the new server >> is the submission server.

I'm afraid I don't think it is possible to do SMTP over SSL (port
465) between 2 sendmail servers (or I don't know how to do that).

Well, there is the _FFR_SMTPS_CLIENT build time feature, enabling
underscore as a F= delivery agent flag:

#if _FFR_SMTPS_CLIENT
# define M_SMTPS_CLIENT '_' /* use SMTP over TLS (465/TCP) */
#endif

But you'll probably have to build your own sendmail binary for that.

I'd just go with STARTTLS if it was me...


Bj|+rn
--- Synchronet 3.21f-Linux NewsLink 1.2

From Newsgroup: comp.mail.sendmail

According to Bj|+rn Mork <bjorn@mork.no>:

Well, there is the _FFR_SMTPS_CLIENT build time feature, enabling
underscore as a F= delivery agent flag:

#if _FFR_SMTPS_CLIENT
# define M_SMTPS_CLIENT '_' /* use SMTP over TLS (465/TCP) */
#endif

But you'll probably have to build your own sendmail binary for that.

I'd just go with STARTTLS if it was me...

Yeah, this is a decade old server I'm trying to shut down. Thanks, all.
--
Regards,
John Levine, johnl@taugh.com, Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly
--- Synchronet 3.21f-Linux NewsLink 1.2

From Newsgroup: comp.mail.sendmail

Claus A|fmann <INVALID_NO_CC_REMOVE_IF_YOU_DO_NOT_POST_ml+sendmail(-no-copies-please)@esmtp.org> wrote:

Hugo Villeneuve-Lapointe wrote:

I'm afraid I don't think it is possible to do SMTP over SSL (port
465) between 2 sendmail servers (or I don't know how to do that).

Look for _FFR_SMTPS_CLIENT in the code.

Oh, missed that in my search. Thanks for the info.
--
Hugo Villeneuve-Lapointe
--- Synchronet 3.21f-Linux NewsLink 1.2