sendmail + stunnel through inetd

mcd · 07-26-2005, 05:15 PM

i'd like to get sendmail running through stunnel using inetd, but i'm having a little trouble. i'm running a pretty default setup in slackware at the moment. sendmail gets started by /etc/rc.d/rc.sendmail like this:

Code:

sendmail_start() {
  if [ -x /usr/bin/sendmail ]; then
    echo "Starting sendmail MTA daemon:  /usr/bin/sendmail -L sm-mta -bd -q25m"
    /usr/bin/sendmail -L sm-mta -bd -q25m
    echo "Starting sendmail MSP queue runner:  /usr/bin/sendmail -L sm-msp-queue -Ac 
-q25m"
    /usr/bin/sendmail -L sm-msp-queue -Ac -q25m
  fi
}

at the moment, here's what my /etc/inetd.conf looks like:

Code:

# IMAP with SSL through stunnel
imaps   stream  tcp     nowait  root    /usr/sbin/stunnel stunnel /etc/stunnel/imaps.conf

# Sendmail with SSL through stunnel
smtps  stream  tcp  nowait  root  /usr/sbin/stunnel stunnel /etc/stunnel/smtps.conf

the imaps entry works perfectly fine. i tried to copy what i did for that with the smtps entry, and create a separate config file with this in the global options (and all service-level options commented out):

Code:

exec = /usr/sbin/sendmail
execargs = sendmail -L sm-mta -bd -q25m

now, i tried just having "sendmail" in the execargs, but that didn't work. when i tried sending mail i immediately got an error saying either the machine i was trying to connect to wasn't an smtp server, or it was improperly configured (and yes, i have verified that port 465 is open and being forwarded to the server). with this new entry (notice it's taken from the rc.sendmail file) when i try sending mail it "thinks" for a minute or so before i get that same error. i'm wondering if i should create a third entry in /etc/inetd.conf with a third stunnel config file with exec args matching the sendmail MSP queue runner listed as the second command run by rc.sendmail.

oh, i stopped the rc.sendmail service before i did any of this, which is correct right? if i have inetd properly set up i shouldn't run sendmail manually, but let inetd start instances on demand right?

mpeg4codec · 07-26-2005, 08:07 PM

Why do you want/need to access sendmail securely? Surely SSH's port forwarding could do the trick.

mcd · 07-26-2005, 10:08 PM

as i understand it, sendmail sends and receives plain text, including the user name and password. i'd like to tunnel the entire session through ssl.

mpeg4codec · 07-29-2005, 08:27 AM

You can try running something like this:

ssh -L 25:localhost:25 user@your.server

When you go to send email from your email client, set your SMTP server to be localhost:25 . However, if you're worried about people sniffing your email on its way to your server, you should know that it traverses the internet between your server and the remote server in plaintext too.

Might I suggest GPG?