[GH-ISSUE #26] Issue warning if configured to require authentication but not TLS #9

New issue

Closed

opened 2026-02-26 18:32:56 +03:00 by kerem · 1 comment

kerem commented

2026-02-26 18:32:56 +03:00

Owner

Originally created by @JonathonReinhart on GitHub (Mar 31, 2021).
Original GitHub issue: https://github.com/decke/smtprelay/issues/26

smtpd only allows authentication if the session is operating with TLS:

	if session.server.Authenticator != nil && session.tls {
		extensions = append(extensions, "AUTH PLAIN LOGIN")
	}

This is probably a safe requirement.

However, the following configuration will never work:

$ ./smtprelay -listen ':2525' -allowed_users userlist.txt

If authentication is required (-allowed_users), then a -listen w/o tls:// or starttls:// should be forbidden.

Originally created by @JonathonReinhart on GitHub (Mar 31, 2021). Original GitHub issue: https://github.com/decke/smtprelay/issues/26 `smtpd` [only allows authentication if the session is operating with TLS](https://github.com/chrj/smtpd/blob/v0.3.0/smtpd.go#L415-L417): ```go if session.server.Authenticator != nil && session.tls { extensions = append(extensions, "AUTH PLAIN LOGIN") } ``` This is probably a safe requirement. However, the following configuration will never work: ``` $ ./smtprelay -listen ':2525' -allowed_users userlist.txt ``` If authentication is required (`-allowed_users`), then a `-listen` w/o `tls://` or `starttls://` should be forbidden.

kerem closed this issue

2026-02-26 18:32:56 +03:00

kerem commented

2026-02-26 18:32:56 +03:00

Author

Owner

@decke commented on GitHub (Mar 31, 2021):

Yeah that is true and it is to avoid sending authentication credentials over an unencrypted channel. So this combination does not make sense and we should make a small note in the config text that allowedUsers requires encrypted channel and error out early if this combination is used.

@decke commented on GitHub (Mar 31, 2021): Yeah that is true and it is to avoid sending authentication credentials over an unencrypted channel. So this combination does not make sense and we should make a small note in the config text that allowedUsers requires encrypted channel and error out early if this combination is used.

kerem referenced this issue

2026-02-26 18:33:11 +03:00

[PR #9] [MERGED] Expand allowedUsers email field to support comma-separated and domains #57

kerem referenced this issue

2026-02-26 18:33:12 +03:00

[PR #13] [CLOSED] Production-readiness modifications #60