Can't seem to disable STARTTLS in Fedora sendmail

[Wayne Johnson]

We have a new Fedora system that is suppose to send it's mail (using
sendmail, no flames PLEASE!), to smtp.comcast.net.  When we attempt to
send it from a local account, we get an error back that the user is
invalid.  Strange, but it works find for mail being relayed from/for
other windows machines.  

The maillog shows:
Jan 26 22:35:18 heritage1 sendmail[31926]: STARTTLS=client,
relay=smtp.comcast.net., version=TLSv1/SSLv3, verify=FAIL,
cipher=RC4-SHA,
bits=128/128
Jan 26 22:35:18 heritage1 sendmail[31926]: i0R4ZH6U031924:
to=<wdtj(a)yahoo.com>, ctladdr=<root(a)heritage1.heritageweb.org> (0/0),
delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=30342,
relay=smtp.comcast.net. [63.240.76.27], dsn=5.1.1, stat=User unknown
Jan 26 22:35:18 heritage1 sendmail[31926]: i0R4ZH6U031924:
i0R4ZI6U031926:
DSN: User unknown

OK, so we're attempting to connect to comcast with TLS and we don't have
a
certificate.  I've tried to turn off TLS with several different methods
(Srv_Features: V in access, define(`confTLS_SRV_OPTIONS', `V') in
sendmail.mc, etc.), but sendmail continues to attempt TLS.

How do I turn TLS off!

TIA,


=====
---
Wayne Johnson,             | There are two kinds of people: Those 
3943 Penn Ave. N.          | who say to God, "Thy will be done," 
Minneapolis, MN 55412-1908 | and those to whom God says, "All right, 
[phone]             | then,  have it your way." --C.S. Lewis

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free web site building tool. Try it!
http://webhosting.yahoo.com/ps/sb/

[adam lanier]

On Fri, 30 Jan 2004 11:32:19 -0800 (PST), Wayne Johnson <wdtj(a)yahoo.com&gt; 
wrote:

>  We have a new Fedora system that is suppose to send it's mail
> (using
>  sendmail, no flames PLEASE!), to smtp.comcast.net.  When we attempt to
>  send it from a local account, we get an error back that the user is
>  invalid.  Strange, but it works find for mail being relayed from/for
>  other windows machines. 
[snip]
>  il.mc, etc.), but sendmail continues to attempt TLS.
>
>  How do I turn TLS off! 
This is probably a question better suited to a sendmail mailing 
list/newsgroup but...

The sendmail book lists the following mc file directives that relate to 
starttls:

define(`CERT_DIR', `/etc/mail/certs')
define(`confCACERT_PATH', `CERT_DIR')
define(`confCACERT', `CERT_DIR`'/cacert.pem')
define(`confSERVER_CERT', `CERT_DIR`'/client.cert.pem')
define(`confSERVER_KEY', `CERT_DIR`'/client.key.pem')
define(`confCLIENT_CERT', `CERT_DIR`'/client.cert.pem')
define(`confCLIENT_KEY', `CERT_DIR`'/client.key.pem')

If any of these are in your sendmail.mc, remove them (or rem them out), 
rebuild the sendmail.cf file (with the command: m4 sendmail.mc > 
sendmail.cf) and restart sendmail.

-- 
Adam Lanier
Bernard L. Madoff Investment Securities LLC

[Rick Stevens]

Adam Lanier wrote:
>  On Fri, 30 Jan 2004 11:32:19 -0800 (PST), Wayne Johnson
> <wdtj(a)yahoo.com&gt; 
>  wrote:
>  
> > We have a new Fedora system that is suppose to send it's mail (using
> > sendmail, no flames PLEASE!), to smtp.comcast.net.  When we attempt to
> > send it from a local account, we get an error back that the user is
> > invalid.  Strange, but it works find for mail being relayed from/for
> > other windows machines.
>  
>  [snip]
>  
> > il.mc, etc.), but sendmail continues to attempt TLS.
> >
> > How do I turn TLS off!
>  
>  
>  This is probably a question better suited to a sendmail mailing 
>  list/newsgroup but...
>  
>  The sendmail book lists the following mc file directives that relate to 
>  starttls:
>  
>  define(`CERT_DIR', `/etc/mail/certs')
>  define(`confCACERT_PATH', `CERT_DIR')
>  define(`confCACERT', `CERT_DIR`'/cacert.pem')
>  define(`confSERVER_CERT', `CERT_DIR`'/client.cert.pem')
>  define(`confSERVER_KEY', `CERT_DIR`'/client.key.pem')
>  define(`confCLIENT_CERT', `CERT_DIR`'/client.cert.pem')
>  define(`confCLIENT_KEY', `CERT_DIR`'/client.key.pem')
>  
>  If any of these are in your sendmail.mc, remove them (or rem them out), 
>  rebuild the sendmail.cf file (with the command: m4 sendmail.mc > 
>  sendmail.cf) and restart sendmail. 
Another way is to edit the current sendmail.cf file and make sure
this line is in it and uncommented:

	O TLSSrvOptions=V

This tells sendmail to NOT request the client's certificate.  Note that
this option is not safe and is only present in sendmail V8.12.x.
----------------------------------------------------------------------
- Rick Stevens, Senior Systems Engineer     rstevens(a)vitalstream.com -
- VitalStream, Inc.                       http://www.vitalstream.com -
-                                                                    -
-     Is that a buffer overflow or are you just happy to see me?     -
----------------------------------------------------------------------

[Alexander Dalloz]

Am Fr, den 30.01.2004 schrieb Rick Stevens um 21:40:
>  Adam Lanier wrote:
>  > On Fri, 30 Jan 2004 11:32:19 -0800 (PST), Wayne Johnson <wdtj(a)yahoo.com&gt; 
>  > wrote:
>  > 
>  >> We have a new Fedora system that is suppose to send it's mail (using
>  >> sendmail, no flames PLEASE!), to smtp.comcast.net.  When we attempt to
>  >> send it from a local account, we get an error back that the user is
>  >> invalid.  Strange, but it works find for mail being relayed from/for
>  >> other windows machines.
>  > 
>  > [snip]
>  > 
>  >> il.mc, etc.), but sendmail continues to attempt TLS.
>  >>
>  >> How do I turn TLS off!
>  > 
>  > 
>  > This is probably a question better suited to a sendmail mailing 
>  > list/newsgroup but...
>  > 
>  > The sendmail book lists the following mc file directives that relate to 
>  > starttls:
>  > 
>  > define(`CERT_DIR', `/etc/mail/certs')
>  > define(`confCACERT_PATH', `CERT_DIR')
>  > define(`confCACERT', `CERT_DIR`'/cacert.pem')
>  > define(`confSERVER_CERT', `CERT_DIR`'/client.cert.pem')
>  > define(`confSERVER_KEY', `CERT_DIR`'/client.key.pem')
>  > define(`confCLIENT_CERT', `CERT_DIR`'/client.cert.pem')
>  > define(`confCLIENT_KEY', `CERT_DIR`'/client.key.pem')
>  > 
>  > If any of these are in your sendmail.mc, remove them (or rem them out), 
>  > rebuild the sendmail.cf file (with the command: m4 sendmail.mc > 
>  > sendmail.cf) and restart sendmail.
>  
>  Another way is to edit the current sendmail.cf file and make sure
>  this line is in it and uncommented:
>  
>  	O TLSSrvOptions=V
>  
>  This tells sendmail to NOT request the client's certificate.  Note that
>  this option is not safe and is only present in sendmail V8.12.x. 
Really a bad idea to edit the sendmail.cf directly. Each service restart
will delete such a manual direct setting in the .cf file! And editing
the sendmai.cf directly often causes errors. Even the OP did set that
with define(`confTLS_SRV_OPTIONS', `V') in the sendmail.mc file.

Alexander


-- 
Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13
Fedora GNU/Linux Core 1 (Yarrow) on Athlon CPU kernel 2.4.22-1.2149.nptl
Sirendipity 21:54:35 up 4:10, 7 users, 0.02, 0.37, 1.05 
                   [ Γνωθι σ'αυτον - gnothi seauton ]

[Rick Stevens]

Alexander Dalloz wrote:
>  Am Fr, den 30.01.2004 schrieb Rick Stevens um 21:40:
>  
> >Adam Lanier wrote:
> >
> >>On Fri, 30 Jan 2004 11:32:19 -0800 (PST), Wayne Johnson <wdtj(a)yahoo.com&gt; 
> >>wrote:
> >>
> >>
> >>>We have a new Fedora system that is suppose to send it's mail (using
> >>>sendmail, no flames PLEASE!), to smtp.comcast.net.  When we attempt to
> >>>send it from a local account, we get an error back that the user is
> >>>invalid.  Strange, but it works find for mail being relayed from/for
> >>>other windows machines.
> >>
> >>[snip]
> >>
> >>
> >>>il.mc, etc.), but sendmail continues to attempt TLS.
> >>>
> >>>How do I turn TLS off!
> >>
> >>
> >>This is probably a question better suited to a sendmail mailing 
> >>list/newsgroup but...
> >>
> >>The sendmail book lists the following mc file directives that relate to 
> >>starttls:
> >>
> >>define(`CERT_DIR', `/etc/mail/certs')
> >>define(`confCACERT_PATH', `CERT_DIR')
> >>define(`confCACERT', `CERT_DIR`'/cacert.pem')
> >>define(`confSERVER_CERT', `CERT_DIR`'/client.cert.pem')
> >>define(`confSERVER_KEY', `CERT_DIR`'/client.key.pem')
> >>define(`confCLIENT_CERT', `CERT_DIR`'/client.cert.pem')
> >>define(`confCLIENT_KEY', `CERT_DIR`'/client.key.pem')
> >>
> >>If any of these are in your sendmail.mc, remove them (or rem them out), 
> >>rebuild the sendmail.cf file (with the command: m4 sendmail.mc > 
> >>sendmail.cf) and restart sendmail.
> >
> >Another way is to edit the current sendmail.cf file and make sure
> >this line is in it and uncommented:
> >
> >	O TLSSrvOptions=V
> >
> >This tells sendmail to NOT request the client's certificate.  Note that
> >this option is not safe and is only present in sendmail V8.12.x.
>  
>  
>  Really a bad idea to edit the sendmail.cf directly. Each service restart
>  will delete such a manual direct setting in the .cf file! And editing
>  the sendmai.cf directly often causes errors. Even the OP did set that
>  with define(`confTLS_SRV_OPTIONS', `V') in the sendmail.mc file. 
Yeah, you're right.  I hate that.  I've disabled it in my startups.  I
use many custom rules that aren't part of the standard m4 stuff and I
have no desire to learn m4 to put them in.
----------------------------------------------------------------------
- Rick Stevens, Senior Systems Engineer     rstevens(a)vitalstream.com -
- VitalStream, Inc.                       http://www.vitalstream.com -
-                                                                    -
-         C program run. C program crash. C programmer quit.         -
----------------------------------------------------------------------

[Wayne Johnson]

I was going to try sendmail next.

I looked at the cert variables, their all "removed" (the default). 

I'm beginning to think it's a bug, but I'm having a hard time convincing
myself that someone else hasn't seen this.  It's a pretty stock
configuration.  The only unusual part is the SMART_HOST to Comcast:
define(`SMART_HOST',`smtp.comcast.net')

Thanks.

--- Adam Lanier <adam(a)krusty.madoff.com&gt; wrote:
>  On Fri, 30 Jan 2004 11:32:19 -0800 (PST), Wayne Johnson
>  <wdtj(a)yahoo.com&gt; 
>  wrote:
>  
>  > We have a new Fedora system that is suppose to send it's mail (using
>  > sendmail, no flames PLEASE!), to smtp.comcast.net.  When we attempt
>  to
>  > send it from a local account, we get an error back that the user is
>  > invalid.  Strange, but it works find for mail being relayed from/for
>  > other windows machines.
>  [snip]
>  > il.mc, etc.), but sendmail continues to attempt TLS.
>  >
>  > How do I turn TLS off!
>  
>  This is probably a question better suited to a sendmail mailing 
>  list/newsgroup but...
>  
>  The sendmail book lists the following mc file directives that relate to
>  
>  starttls:
>  
>  define(`CERT_DIR', `/etc/mail/certs')
>  define(`confCACERT_PATH', `CERT_DIR')
>  define(`confCACERT', `CERT_DIR`'/cacert.pem')
>  define(`confSERVER_CERT', `CERT_DIR`'/client.cert.pem')
>  define(`confSERVER_KEY', `CERT_DIR`'/client.key.pem')
>  define(`confCLIENT_CERT', `CERT_DIR`'/client.cert.pem')
>  define(`confCLIENT_KEY', `CERT_DIR`'/client.key.pem')
>  
>  If any of these are in your sendmail.mc, remove them (or rem them out),
>  
>  rebuild the sendmail.cf file (with the command: m4 sendmail.mc > 
>  sendmail.cf) and restart sendmail.
>  
>  -- 
>  Adam Lanier
>  Bernard L. Madoff Investment Securities LLC
>  
>  
>  -- 
>  fedora-list mailing list
>  fedora-list(a)redhat.com
>  To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list 

=====
---
Wayne Johnson,             | There are two kinds of people: Those 
3943 Penn Ave. N.          | who say to God, "Thy will be done," 
Minneapolis, MN 55412-1908 | and those to whom God says, "All right, 
[phone]             | then,  have it your way." --C.S. Lewis

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free web site building tool. Try it!
http://webhosting.yahoo.com/ps/sb/

[Peter Draksler]

>  I'm beginning to think it's a bug, but I'm having a hard
> time convincing
>  myself that someone else hasn't seen this.   
You're not the only that has this problem...  I've noticed it for a
while and have googled for a solution but have come up empty.  I found
them worrisome at first but now they are more of an annoyance than
anything.  A solution would be nice, I'll try a few of the things
previously mentioned.

- peterd

[Mike Chambers]

On Fri, 2004-01-30 at 14:15, Adam Lanier wrote:

>  If any of these are in your sendmail.mc, remove them (or rem them
> out), 
>  rebuild the sendmail.cf file (with the command: m4 sendmail.mc > 
>  sendmail.cf) and restart sendmail. 
If using Fedora, or I guess even RH 9, then service sendmail restart is
enough, and it's Make -C /etc/mail not m4 (or there is another way).

--- 
Mike Chambers 
Madisonville, KY 

2.4.22-1.2166.nptl #1 Fri Jan 30 13:48:31 EST 2004 i686 GNU/Linux 
22:57:29 up 8 min, 2 users, load average: 0.06, 0.27, 0.17

[Alexander Dalloz]

Am Fr, den 30.01.2004 schrieb Wayne Johnson um 20:32:
>  We have a new Fedora system that is suppose to send it's mail
> (using
>  sendmail, no flames PLEASE!), to smtp.comcast.net.  When we attempt to
>  send it from a local account, we get an error back that the user is
>  invalid.  Strange, but it works find for mail being relayed from/for
>  other windows machines.  
>  
>  The maillog shows:
>  Jan 26 22:35:18 heritage1 sendmail[31926]: STARTTLS=client,
>  relay=smtp.comcast.net., version=TLSv1/SSLv3, verify=FAIL,
>  cipher=RC4-SHA,
>  bits=128/128
>  Jan 26 22:35:18 heritage1 sendmail[31926]: i0R4ZH6U031924:
>  to=<wdtj(a)yahoo.com>, ctladdr=<root(a)heritage1.heritageweb.org> (0/0),
>  delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=30342,
>  relay=smtp.comcast.net. [63.240.76.27], dsn=5.1.1, stat=User unknown
>  Jan 26 22:35:18 heritage1 sendmail[31926]: i0R4ZH6U031924:
>  i0R4ZI6U031926:
>  DSN: User unknown
>  
>  OK, so we're attempting to connect to comcast with TLS and we don't have
>  a
>  certificate.  I've tried to turn off TLS with several different methods
>  (Srv_Features: V in access, define(`confTLS_SRV_OPTIONS', `V') in
>  sendmail.mc, etc.), but sendmail continues to attempt TLS.
>  
>  How do I turn TLS off!
>  
>  TIA, 
It's no TLS issue! TLS handshaking between the MTA works and is used by
default. There is no problem with it and does not require a verified
certificate validation.

Your problem is, that you send mail as user root - which is an exposed
user! - from your sendmail host. This way it is not maqueraded as mail
is which is sent from relayed sender hosts.

Alexander


-- 
Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13
Fedora GNU/Linux Core 1 (Yarrow) on Athlon CPU kernel 2.4.22-1.2149.nptl
Sirendipity 21:32:53 up 3:48, 7 users, 3.75, 2.11, 0.86 
                   [ Γνωθι σ'αυτον - gnothi seauton ]

[Wayne Johnson]

Thanks for the response.

Unfortunately, this problem occurs on all local users, not just root, and
I don't believe their exposed.  It does not occur on our internal users
for whom we're acting as a relay.


--- Alexander Dalloz <alexander.dalloz(a)uni-bielefeld.de&gt; wrote:
>  Am Fr, den 30.01.2004 schrieb Wayne Johnson um 20:32:
>  > We have a new Fedora system that is suppose to send it's mail (using
>  > sendmail, no flames PLEASE!), to smtp.comcast.net.  When we attempt
>  to
>  > send it from a local account, we get an error back that the user is
>  > invalid.  Strange, but it works find for mail being relayed from/for
>  > other windows machines.  
>  > 
>  > The maillog shows:
>  > Jan 26 22:35:18 heritage1 sendmail[31926]: STARTTLS=client,
>  > relay=smtp.comcast.net., version=TLSv1/SSLv3, verify=FAIL,
>  > cipher=RC4-SHA,
>  > bits=128/128
>  > Jan 26 22:35:18 heritage1 sendmail[31926]: i0R4ZH6U031924:
>  > to=&lt;wdtj(a)yahoo.com&gt;, ctladdr=&lt;root(a)heritage1.heritageweb.org&gt; (0/0),
>  > delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=30342,
>  > relay=smtp.comcast.net. [63.240.76.27], dsn=5.1.1, stat=User unknown
>  > Jan 26 22:35:18 heritage1 sendmail[31926]: i0R4ZH6U031924:
>  > i0R4ZI6U031926:
>  > DSN: User unknown
>  > 
>  > OK, so we're attempting to connect to comcast with TLS and we don't
>  have
>  > a
>  > certificate.  I've tried to turn off TLS with several different
>  methods
>  > (Srv_Features: V in access, define(`confTLS_SRV_OPTIONS', `V') in
>  > sendmail.mc, etc.), but sendmail continues to attempt TLS.
>  > 
>  > How do I turn TLS off!
>  > 
>  > TIA,
>  
>  It's no TLS issue! TLS handshaking between the MTA works and is used by
>  default. There is no problem with it and does not require a verified
>  certificate validation.
>  
>  Your problem is, that you send mail as user root - which is an exposed
>  user! - from your sendmail host. This way it is not maqueraded as mail
>  is which is sent from relayed sender hosts.
>  
>  Alexander
>  
>   

=====
---
Wayne Johnson,             | There are two kinds of people: Those 
3943 Penn Ave. N.          | who say to God, "Thy will be done," 
Minneapolis, MN 55412-1908 | and those to whom God says, "All right, 
[phone]             | then,  have it your way." --C.S. Lewis

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free web site building tool. Try it!
http://webhosting.yahoo.com/ps/sb/

[Alexander Dalloz]

Am Fr, den 30.01.2004 schrieb Wayne Johnson um 22:19:
>  Thanks for the response.
>  
>  Unfortunately, this problem occurs on all local users, not just root, and
>  I don't believe their exposed.  It does not occur on our internal users
>  for whom we're acting as a relay. 
[ snip ]

Ok, if my other posting a few minute ago does not help you out, can you
please describe what comcast expect by you to be used as smart host? I
suspect you have to authenticate against smtp.comcast.net?

Please post your sendmail.mc and auth settings (certainly modify the
real user/pass data). If you like you can bypass this mailing list and
mail me directly. I am sure your problem is solvable. I am a little
curious as you have it already running for relayed mail. Is it possible
that comcast just rejects your mail from sendmail host sent directly
because it comes then with a hostname which is not resolvable? Is
heritage1.heritageweb.org your Sendmail's hostname? I think so. Then you
fail to use genericstable to map your users to @heritageweb.org mail
addresses. Or is your domain name a total different?

Alexander


-- 
Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13
Fedora GNU/Linux Core 1 (Yarrow) on Athlon CPU kernel 2.4.22-1.2149.nptl
Sirendipity 22:27:26 up 4:43, 7 users, 0.24, 0.24, 0.33 
                   [ Γνωθι σ'αυτον - gnothi seauton ]

[Alexander Dalloz]

Am Fr, den 30.01.2004 schrieb Wayne Johnson um 20:32:
>  We have a new Fedora system that is suppose to send it's mail
> (using
>  sendmail, no flames PLEASE!), to smtp.comcast.net.  When we attempt to
>  send it from a local account, we get an error back that the user is
>  invalid.  Strange, but it works find for mail being relayed from/for
>  other windows machines.   
[ snip ]

The following may help. MSGID
<pan.2003.12.09.20.06.13.406002(a)SPAMmindspring.com&gt; on
comp.mail.sendmail 9th December 2003

### quote ###

I'll be the first to admit I'm not even close to an expert on sendmail.
I've just spent hours and hours working on this, so I thought I'd share
my
solution. Hopefully it will save time and trouble for someone else.

My setup:
 sendmail 8.12.8, running on Red Hat Linux 8.0 This box is the outgoing
 mail server for my home network (which uses the fake domain name
 homenet.local).
My goal:
 Have my server forward all its outgoing mail to my ISP's SMTP server
(smtp.comcast.net), which requires a username and password.

 Below are my relevant configuration files, with some notes on each one.

Here are the active lines from my sendmail.mc:

divert(-1)dnl

include(`/usr/share/sendmail-cf/m4/cf.m4')dnl VERSIONID(`setup for Red
Hat
Linux')dnl OSTYPE(`linux')dnl

define(`SMART_HOST',`smtp.comcast.net') dnl #
define(`confDEF_USER_ID',``8:12'')dnl define(`confTRUSTED_USER',
`smmsp')dnl dnl define(`confAUTO_REBUILD')dnl
define(`confTO_CONNECT', `1m')dnl
define(`confTRY_NULL_MX_LIST',true)dnl
define(`confDONT_PROBE_INTERFACES',true)dnl
define(`PROCMAIL_MAILER_PATH',`/usr/bin/procmail')dnl
define(`ALIAS_FILE',
`/etc/aliases')dnl dnl define(`STATUS_FILE', `/etc/mail/statistics')dnl
define(`UUCP_MAILER_MAX', `2000000')dnl define(`confUSERDB_SPEC',
`/etc/mail/userdb.db')dnl define(`confPRIVACY_FLAGS',
`authwarnings,novrfy,noexpn,restrictqrun')dnl define(`confAUTH_OPTIONS',
`A')dnl

TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN
PLAIN')dnl FEATURE(`authinfo')dnl

define(`confCACERT_PATH',`/usr/share/ssl/certs')
define(`confCACERT',`/usr/share/ssl/certs/ca.crt')
define(`confSERVER_CERT',`/usr/share/ssl/certs/sendmail.pem')
define(`confSERVER_KEY',`/usr/share/ssl/certs/sendmail.pem')
define(`confCLIENT_CERT',`/usr/share/ssl/certs/user.crt')
define(`confCLIENT_KEY',`/usr/share/ssl/certs/user.key')

dnl define(`confDONT_BLAME_SENDMAIL',`groupreadablekeyfile')dnl

dnl define(`confTO_QUEUEWARN', `4h')dnl dnl define(`confTO_QUEUERETURN',
`5d')dnl dnl define(`confQUEUE_LA', `12')dnl
dnl define(`confREFUSE_LA', `18')dnl
define(`confTO_IDENT', `0')dnl
dnl FEATURE(delay_checks)dnl
FEATURE(`no_default_msa',`dnl')dnl
FEATURE(`smrsh',`/usr/sbin/smrsh')dnl FEATURE(`mailertable',`hash -o
/etc/mail/mailertable.db')dnl FEATURE(`virtusertable',`hash -o
/etc/mail/virtusertable.db')dnl FEATURE(redirect)dnl
FEATURE(always_add_domain)dnl
FEATURE(use_cw_file)dnl
FEATURE(use_ct_file)dnl

FEATURE(local_procmail,`',`procmail -t -Y -a $h -d $u')dnl
FEATURE(`relay_hosts_only')dnl
FEATURE(`access_db',`hash -T<TMPF> -o /etc/mail/access.db')dnl
FEATURE(`blacklist_recipients')dnl
EXPOSED_USER(`root')dnl
dnl #
DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl dnl #
dnl DAEMON_OPTIONS(`Port=submission, Name=MSA, M=Ea')dnl dnl #
dnl DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, M=s')dnl dnl #
dnl DAEMON_OPTIONS(`port=smtp,Addr=::1, Name=MTA-v6, Family=inet6')dnl
dnl
#
FEATURE(`accept_unresolvable_domains')dnl dnl #
dnl FEATURE(`relay_based_on_MX')dnl
dnl #
dnl # Also accept email sent to "localhost.localdomain" as local email.
dnl #
LOCAL_DOMAIN(`localhost.localdomain')dnl dnl #
dnl # The following example makes mail from this host and any additional
dnl # specified domains appear to be sent from mydomain.com dnl #
MASQUERADE_AS(`comcast.net')dnl
dnl #
dnl # masquerade not just the headers, but the envelope as well dnl #
FEATURE(masquerade_envelope)dnl
dnl #
dnl # masquerade not just @mydomainalias.com, but @*.mydomainalias.com
as
well dnl #
dnl FEATURE(masquerade_entire_domain)dnl dnl #
dnl MASQUERADE_DOMAIN(localhost)dnl
dnl MASQUERADE_DOMAIN(localhost.localdomain)dnl dnl
MASQUERADE_DOMAIN(homenet.local)dnl MAILER(smtp)dnl
MAILER(procmail)dnl

Note:
-After editing this file, run m4 sendmail.mc > sendmail.cf and then
/etc/rc.d/init.d/sendmail restart
-If the server doesn't need to accept incoming email, then change the
following line 
from..
DAEMON_OPTIONS(`Port=smtp, Name=MTA')dnl
to..
DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl


This is my authinfo file:

Authinfo:smtp.comcast.net "U:myusername" "I:myusername"
"P:mypa55word"
"R:"

Notes:
- This is a plaintext file, that contains the ISP's mailserver's
password,
so it shouldn't be world-readable.


Here's my access file:

# by default we allow relaying from localhost...
localhost.localdomain		RELAY
localhost			RELAY
127.0.0.1			RELAY
workstation1.homenet.local	RELAY
workstation2.homenet.local	RELAY

# Uncomment the line below to disable TLS
# Try_TLS:smtp.comcast.net    NO

Note:
 - After editing this file, run makemap hash access < access and then
/etc/rc.d/init.d/sendmail restart
 - I found disabling TLS was useful during troubleshooting, as I could
use
 ethereal (packet sniffer) to monitor exactly what the servers were
saying
 to each other.

Hope this helps,

 George Lane
 Atlanta

### quote end ###

Alexander


-- 
Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13
Fedora GNU/Linux Core 1 (Yarrow) on Athlon CPU kernel 2.4.22-1.2149.nptl
Sirendipity 22:15:54 up 4:31, 7 users, 0.28, 0.26, 0.41 
                   [ Γνωθι σ'αυτον - gnothi seauton ]

[Wayne Johnson]

Hmm.  I was unaware that Comcast was now requiring a userid/password. 
I'll try this.

Thanks.

--- Alexander Dalloz <alexander.dalloz(a)uni-bielefeld.de&gt; wrote:
>  Am Fr, den 30.01.2004 schrieb Wayne Johnson um 20:32:
>  > We have a new Fedora system that is suppose to send it's mail (using
>  > sendmail, no flames PLEASE!), to smtp.comcast.net.  When we attempt
>  to
>  > send it from a local account, we get an error back that the user is
>  > invalid.  Strange, but it works find for mail being relayed from/for
>  > other windows machines.  
>  
>  [ snip ]
>  
>  The following may help. MSGID
>  <pan.2003.12.09.20.06.13.406002(a)SPAMmindspring.com&gt; on
>  comp.mail.sendmail 9th December 2003
>  
>  ### quote ###
>  
>  I'll be the first to admit I'm not even close to an expert on sendmail.
>  I've just spent hours and hours working on this, so I thought I'd share
>  my
>  solution. Hopefully it will save time and trouble for someone else.
>  
>  My setup:
>   sendmail 8.12.8, running on Red Hat Linux 8.0 This box is the outgoing
>   mail server for my home network (which uses the fake domain name
>   homenet.local).
>  My goal:
>   Have my server forward all its outgoing mail to my ISP's SMTP server
>  (smtp.comcast.net), which requires a username and password.
>  
>   Below are my relevant configuration files, with some notes on each
>  one.
>  
>  Here are the active lines from my sendmail.mc:
>  
>  divert(-1)dnl
>  
>  include(`/usr/share/sendmail-cf/m4/cf.m4')dnl VERSIONID(`setup for Red
>  Hat
>  Linux')dnl OSTYPE(`linux')dnl
>  
>  define(`SMART_HOST',`smtp.comcast.net') dnl #
>  define(`confDEF_USER_ID',``8:12'')dnl define(`confTRUSTED_USER',
>  `smmsp')dnl dnl define(`confAUTO_REBUILD')dnl
>  define(`confTO_CONNECT', `1m')dnl
>  define(`confTRY_NULL_MX_LIST',true)dnl
>  define(`confDONT_PROBE_INTERFACES',true)dnl
>  define(`PROCMAIL_MAILER_PATH',`/usr/bin/procmail')dnl
>  define(`ALIAS_FILE',
>  `/etc/aliases')dnl dnl define(`STATUS_FILE', `/etc/mail/statistics')dnl
>  define(`UUCP_MAILER_MAX', `2000000')dnl define(`confUSERDB_SPEC',
>  `/etc/mail/userdb.db')dnl define(`confPRIVACY_FLAGS',
>  `authwarnings,novrfy,noexpn,restrictqrun')dnl
>  define(`confAUTH_OPTIONS',
>  `A')dnl
>  
>  TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
>  define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5
>  LOGIN
>  PLAIN')dnl FEATURE(`authinfo')dnl
>  
>  define(`confCACERT_PATH',`/usr/share/ssl/certs')
>  define(`confCACERT',`/usr/share/ssl/certs/ca.crt')
>  define(`confSERVER_CERT',`/usr/share/ssl/certs/sendmail.pem')
>  define(`confSERVER_KEY',`/usr/share/ssl/certs/sendmail.pem')
>  define(`confCLIENT_CERT',`/usr/share/ssl/certs/user.crt')
>  define(`confCLIENT_KEY',`/usr/share/ssl/certs/user.key')
>  
>  dnl define(`confDONT_BLAME_SENDMAIL',`groupreadablekeyfile')dnl
>  
>  dnl define(`confTO_QUEUEWARN', `4h')dnl dnl
>  define(`confTO_QUEUERETURN',
>  `5d')dnl dnl define(`confQUEUE_LA', `12')dnl
>  dnl define(`confREFUSE_LA', `18')dnl
>  define(`confTO_IDENT', `0')dnl
>  dnl FEATURE(delay_checks)dnl
>  FEATURE(`no_default_msa',`dnl')dnl
>  FEATURE(`smrsh',`/usr/sbin/smrsh')dnl FEATURE(`mailertable',`hash -o
>  /etc/mail/mailertable.db')dnl FEATURE(`virtusertable',`hash -o
>  /etc/mail/virtusertable.db')dnl FEATURE(redirect)dnl
>  FEATURE(always_add_domain)dnl
>  FEATURE(use_cw_file)dnl
>  FEATURE(use_ct_file)dnl
>  
>  FEATURE(local_procmail,`',`procmail -t -Y -a $h -d $u')dnl
>  FEATURE(`relay_hosts_only')dnl
>  FEATURE(`access_db',`hash -T<TMPF> -o /etc/mail/access.db')dnl
>  FEATURE(`blacklist_recipients')dnl
>  EXPOSED_USER(`root')dnl
>  dnl #
>  DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl dnl #
>  dnl DAEMON_OPTIONS(`Port=submission, Name=MSA, M=Ea')dnl dnl #
>  dnl DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, M=s')dnl dnl #
>  dnl DAEMON_OPTIONS(`port=smtp,Addr=::1, Name=MTA-v6, Family=inet6')dnl
>  dnl
>  #
>  FEATURE(`accept_unresolvable_domains')dnl dnl #
>  dnl FEATURE(`relay_based_on_MX')dnl
>  dnl #
>  dnl # Also accept email sent to "localhost.localdomain" as local email.
>  dnl #
>  LOCAL_DOMAIN(`localhost.localdomain')dnl dnl #
>  dnl # The following example makes mail from this host and any
>  additional
>  dnl # specified domains appear to be sent from mydomain.com dnl #
>  MASQUERADE_AS(`comcast.net')dnl
>  dnl #
>  dnl # masquerade not just the headers, but the envelope as well dnl #
>  FEATURE(masquerade_envelope)dnl
>  dnl #
>  dnl # masquerade not just @mydomainalias.com, but @*.mydomainalias.com
>  as
>  well dnl #
>  dnl FEATURE(masquerade_entire_domain)dnl dnl #
>  dnl MASQUERADE_DOMAIN(localhost)dnl
>  dnl MASQUERADE_DOMAIN(localhost.localdomain)dnl dnl
>  MASQUERADE_DOMAIN(homenet.local)dnl MAILER(smtp)dnl
>  MAILER(procmail)dnl
>  
>  Note:
>  -After editing this file, run m4 sendmail.mc > sendmail.cf and then
>  /etc/rc.d/init.d/sendmail restart
>  -If the server doesn't need to accept incoming email, then change the
>  following line 
>  from..
>  DAEMON_OPTIONS(`Port=smtp, Name=MTA')dnl
>  to..
>  DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl
>  
>  
>  This is my authinfo file:
>  
>  Authinfo:smtp.comcast.net "U:myusername" "I:myusername"
> "P:mypa55word"
>  "R:"
>  
>  Notes:
>  - This is a plaintext file, that contains the ISP's mailserver's
>  password,
>  so it shouldn't be world-readable.
>  
>  
>  Here's my access file:
>  
>  # by default we allow relaying from localhost...
>  localhost.localdomain		RELAY
>  localhost			RELAY
>  127.0.0.1			RELAY
>  workstation1.homenet.local	RELAY
>  workstation2.homenet.local	RELAY
>  
>  # Uncomment the line below to disable TLS
>  # Try_TLS:smtp.comcast.net    NO
>  
>  Note:
>   - After editing this file, run makemap hash access < access and then
>  /etc/rc.d/init.d/sendmail restart
>   - I found disabling TLS was useful during troubleshooting, as I could
>  use
>   ethereal (packet sniffer) to monitor exactly what the servers were
>  saying
>   to each other.
>  
>  Hope this helps,
>  
>   George Lane
>   Atlanta
>  
>  ### quote end ###
>  
>  Alexander
>  
>  
>  -- 
>  Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13
>  Fedora GNU/Linux Core 1 (Yarrow) on Athlon CPU kernel
>  2.4.22-1.2149.nptl
>  Sirendipity 22:15:54 up 4:31, 7 users, 0.28, 0.26, 0.41 
>                     [ ���������� ��'���������� - gnothi seauton ]
>  
>  
>  
>  -- 
>  fedora-list mailing list
>  fedora-list(a)redhat.com
>  To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list 

=====
---
Wayne Johnson,             | There are two kinds of people: Those 
3943 Penn Ave. N.          | who say to God, "Thy will be done," 
Minneapolis, MN 55412-1908 | and those to whom God says, "All right, 
[phone]             | then,  have it your way." --C.S. Lewis

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free web site building tool. Try it!
http://webhosting.yahoo.com/ps/sb/

[Gerry Doris]

On Fri, 2004-01-30 at 16:18, Alexander Dalloz wrote:
>  Am Fr, den 30.01.2004 schrieb Wayne Johnson um 20:32:
>  > We have a new Fedora system that is suppose to send it's mail (using
>  > sendmail, no flames PLEASE!), to smtp.comcast.net.  When we attempt to
>  > send it from a local account, we get an error back that the user is
>  > invalid.  Strange, but it works find for mail being relayed from/for
>  > other windows machines.  
>  
>  [ snip ]
>  
>  The following may help. MSGID
>  <pan.2003.12.09.20.06.13.406002(a)SPAMmindspring.com&gt; on
>  comp.mail.sendmail 9th December 2003
>  
>  ### quote ###
>  
>  I'll be the first to admit I'm not even close to an expert on sendmail.
>  I've just spent hours and hours working on this, so I thought I'd share
>  my
>  solution. Hopefully it will save time and trouble for someone else.
>  
>  My setup:
>   sendmail 8.12.8, running on Red Hat Linux 8.0 This box is the outgoing
>   mail server for my home network (which uses the fake domain name
>   homenet.local).
>  My goal:
>   Have my server forward all its outgoing mail to my ISP's SMTP server
>  (smtp.comcast.net), which requires a username and password.
>  
>   Below are my relevant configuration files, with some notes on each one.
>  
>  Here are the active lines from my sendmail.mc: 
snip...

>  This is my authinfo file:
>  
>  Authinfo:smtp.comcast.net "U:myusername" "I:myusername"
> "P:mypa55word"
>  "R:"
>  
>  Notes:
>  - This is a plaintext file, that contains the ISP's mailserver's
>  password,
>  so it shouldn't be world-readable.
>   
You don't really need to use a separate authinfo file.  This is a hold
over from prior versions.  Just put the authinfo line in your access
file and do the makemap command.

>  
>  Here's my access file:
>  
>  # by default we allow relaying from localhost...
>  localhost.localdomain		RELAY
>  localhost			RELAY
>  127.0.0.1			RELAY
>  workstation1.homenet.local	RELAY
>  workstation2.homenet.local	RELAY
>   
You just need to put in your domain name unless you want to restrict
relaying to just those two boxes.  If you're using authentication then
you don't need the domain name.

snip...

There is an excellent sendmail setup howto at 

http://www.simpaticus.com/linux/howto/html-multiple/Sendmail-SMTP-AUTH-HO...

-- 
Gerry Doris <gdoris(a)rogers.com&gt;