smtpauth

If you're in need of authenticating proxy for servers without SMTP AUTH, then smtpauth is the software you're looking for. It not only allows for SMTP AUTH support (PLAIN, LOGIN) on any SMTP server, but also provides clients the ability to authenticate over SSL port 465 or cleartext port 587 while fully logging authentication via syslog.

Compatible with JBMail, Pegasus Mail, Mozilla Thunderbird, MS Outlook, smtpauth is a temporary solution until MTA(s) support SSL/TLS and SMTP AUTH directly. Instead of patching MTA source, it's preferred to use external programs to provide this function, and smtpauth is ideal for many SMTP servers, including Postfix, sendmail, and others.

Installation is fairly straightforward. First, compile and install the binary, then copy 'smtpauth' to /usr/sbin, owned by root, and set mode 755. Next is the creation of the special user 'smtpauth' with its own group, ensuring no login is allowed. It's important to note that if invoked as root, smtpauth will immediately exit with an error, so it must be run from a low privilege account for security.

For SSL, port 465, configuring stunnel.conf is necessary. Simply make the changes below, substituting your own domain, and start up stunnel. This will create a server running as smtpauth on port smtps/465. When SMTP clients connect (SSL/TLS), the smtpauth program will provide authentication service through to 127.0.0.1:25 as a proxy:

setuid = smtpauth
setgid = smtpauth
debug = auth.notice
client = no

[smtps]
accept = 465
exec = /usr/sbin/smtpauth
execargs = smtpauth domain 127.0.0.1

Configure /etc/smtpauth.conf with single lines containing usernames and passwords separated by whitespace, ensuring it's only readable by the smtpauth user since it stores plain passwords. Blank lines and comment lines starting # are ignored.

For cleartext, port 587, configuring cleartext submission service in inetd is necessary. Because inetd supports wrapping (when started with -W), the smtpauth proxy can be run straight out of here, too. Change 'domain' for your site (e.g. mail.yoursite.tld):

submission stream tcp nowait smtpauth /usr/sbin/smtpauth smtpauth domain 127.0.0.1.

Although it may not be a permanent solution, for now, smtpauth provides the necessary authentication proxy for SMTP servers without SMTP AUTH support.