smtp-auth verifiedcriticalWritten by the Hub
Login required to submit
smtp-auth: Where submitted credentials are checked; naming any scheme here makes a login mandatory for every client.
Values
- Values
hardcoded:// · ldap:// · radius:// · users:// · http:// · file:// · exec://- Default
· taken from the build- applying
restart required- where it can be set
in the config file · with a startup flag · as an environment variable
In detail
The value is a scheme and its parameters, and there are seven: hardcoded://user:pass (several pairs separated by commas), plus LDAP, RADIUS, system users, an HTTP endpoint, a file of hashed passwords, and an external program. Only the first is documented in most places, which sells the feature short — an installation with existing user accounts does not have to duplicate them. Two behaviours make or break this in practice, both established on the stand. AUTH is only offered over TLS: without smtp-certificate the server never advertises STARTTLS or AUTH at all, and the directive silently does nothing. And turning it on makes login mandatory for everyone: there is no "these addresses by IP, those by password" — a client in smtp-range that does not log in gets 554 Relay access denied at RCPT TO.