Mailman 3 January 2011 - Mailman-coders

[Bug 490044] Re: Implement SMTP AUTH in Mailman 3
by Patrick Ben Koetter 04 Jan '11

04 Jan '11

I emphasized a few bits: The SMTP server may require authentication. Mailman supports setting the SMTP user name and password. The actual authentication mechanism used is controlled by Python's `smtplib module`_, which tries the more secure `CRAM-MD5` first, followed by the less secure mechanisms `PLAIN` and `LOGIN`. When sending authentication data between Mailman and the MTA over an unsecured network, the submission (mail) server should offer `CRAM-MD5` as mechanism to have Python's `smtplib module` automatically choose the more secure mechanism. -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/490044 Title: Implement SMTP AUTH in Mailman 3

1 0

[Bug 490044] Re: Implement SMTP AUTH in Mailman 3
by Barry Warsaw 03 Jan '11

03 Jan '11

How's this (from src/mailman/mta/docs/authentication.txt) The SMTP server may require authentication. Mailman supports setting the SMTP user name and password. The actual authentication mechanism used is controlled by Python's `smtplib module`_, which tries `CRAM-MD5` first, followed by `PLAIN` and `LOGIN`. When sending authentication data between Mailman and the MTA over an unsecured network, the submission (mail) server should support `CRAM-MD5`. -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/490044 Title: Implement SMTP AUTH in Mailman 3

1 0

[Bug 490044] Re: Implement SMTP AUTH in Mailman 3
by Patrick Ben Koetter 03 Jan '11

03 Jan '11

Erhm, misunderstanding? I wasn't talking about STARTTLS, but the possibility to control which SMTP AUTH mechnanism will be used. I took a look at the library and it seems like the library tries to do "the right thing": # List of authentication methods we support: from preferred to # less preferred methods. Except for the purpose of testing the weaker # ones, we prefer stronger methods like CRAM-MD5: preferred_auths = [AUTH_CRAM_MD5, AUTH_PLAIN, AUTH_LOGIN] CRAM-MD5 is fine, because the identity sent for authentication goes encrypted over the network. Not so PLAIN or LOGIN. They will only encoded (base64) over the Net. We should at least mention in the docs that if MM3 sends authentication data over an unsecured network the submission server on the other end SHOULD support CRAM-MD5 or SMTP AUTH MAY be eavesdropped. However if it uses CRAM-MD5, smtplib will do the right (read: secure) thing. -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/490044 Title: Implement SMTP AUTH in Mailman 3

1 0

[Bug 490044] Re: Implement SMTP AUTH in Mailman 3
by Barry Warsaw 03 Jan '11

03 Jan '11

In all honesty, I don't know the details. Looking at the smtplib code in Python 2.6 though, it essentially delegates everything to the socket layer. If the pem/cert files are given, it wraps the socket in an ssl socket, though it only provides a subset of the options available to ssl.wrap_socket(). That's the extent of smtplib's support AFAICT. Mailman won't support anything the underlying smtplib module doesn't support, so if changes need to happen there, it's best to do that in the context of Python development (though even there, likely nothing will change until Python 3.3 which is a long way off). -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/490044 Title: Implement SMTP AUTH in Mailman 3

2 1

[Bug 490044] Re: Implement SMTP AUTH in Mailman 3
by Patrick Ben Koetter 03 Jan '11

03 Jan '11

Typo in my previous comment: Please replace "port" by "SASL mechanism". -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/490044 Title: Implement SMTP AUTH in Mailman 3

1 0

[Bug 490044] Re: Implement SMTP AUTH in Mailman 3
by Patrick Ben Koetter 03 Jan '11

03 Jan '11

How does choosing the SASL mechanism work? Does smtplib choose the best (read: most secure) port by itself? I think choosing the SASL mechanism on the client (smtplib) side should be configurable. -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/490044 Title: Implement SMTP AUTH in Mailman 3

1 0

[Bug 490044] Re: Implement SMTP AUTH in Mailman 3
by Barry Warsaw 03 Jan '11

03 Jan '11

r6972 adds smtp_user and smtp_pass. Please open another bug report if you really want TLS (perhaps with a patch? :). ** Changed in: mailman Status: In Progress => Fix Committed -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/490044 Title: Implement SMTP AUTH in Mailman 3

1 0

[Bug 490044] Re: Implement SMTP AUTH in Mailman 3
by Barry Warsaw 02 Jan '11

02 Jan '11

The port that Mailman connects to the upstream SMTP server is already configurable, so I don't think we need to do the probing and caching Ian describes. It looks fairly easy to add a username/password pair for the SMTP connection, and to call .login() if they're set. So I'll add those. It probably would not be difficult to add keyfile and certfile configuration variables and call SMTP_SSL() when those are given. I'll look at adding that too. ** Changed in: mailman Status: Triaged => In Progress ** Changed in: mailman Assignee: (unassigned) => Barry Warsaw (barry) -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/490044 Title: Implement SMTP AUTH in Mailman 3

1 0

[Bug 490044] Re: Implement SMTP AUTH in Mailman 3
by Barry Warsaw 02 Jan '11

02 Jan '11

** Changed in: mailman Milestone: 3.0.0a5 => 3.0.0a7 -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/490044 Title: Implement SMTP AUTH in Mailman 3

1 0