Demo
Demo

Knowledge base

PMTA knowledge base›Configuration block§ 3.3.8

<smtp-user>

An account for submitting mail
The right to hand in mail, tied to a name rather than an address

The block describes one user who is allowed to relay mail through the node — regardless of the address they submit from. The block name is the login.

Inside there are two parts that are mandatory in meaning: what confirms the login and what rights the logged-in user gets.

The login is confirmed with the authentication-method directive — by password (the default), by certificate, by a system login on Linux or via LDAP. Password authentication needs password, certificate authentication needs tls-certificate and, if the chain is verified, tls-ca-file with tls-certificate-san-or-cn.

Rights are given with a source reference to a named source block: its settings apply after login. A login without such a reference gets the reserved {auth} source, if it is declared.

Passwords sit here in plain text — the engine requires it, otherwise it could not support all SASL mechanisms. So the configuration file must be protected like a key file.

Example configuration
# password login and its own set of rights via a named source
<smtp-user shop-example-com>
    password 8xK2-qRt7-vD1s-mZ4w
    source {shop-example-com-auth}
</smtp-user>

# certificate login — no password needed at all
<smtp-user partner>
    authentication-method certificate
    tls-certificate /etc/pmta/partner.pem
    source {partner-auth}
</smtp-user>
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
Block directives: 6
TLS 3
tls-ca-fileTrusted authorities whose certificates will do for this logintls-certificateThe specific certificate that confirms this logintls-certificate-san-or-cnThe name that must appear in the submitter’s certificate
Access 2
authentication-methodWhat confirms a submission loginpasswordset by the HubThe submission login password
Mail submission 1
sourceset by the HubWhich named source applies to this login
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
⇄

Related entries

0 relations

Referenced from

Restrict who can reach the node at allThe right to relay is granted to an account, not an address. § 1.6.1allow-auth<source>Banning the command makes all declared logins worthless at once: there is no way to use them. § 3.3.8

◇

What else to read

3 articles

◇Accept, route, deliverA message’s path inside the node: accept, decide where, deliver — and all the settings live between these three steps.◇Four value types the whole config is written inBoolean, domain pattern, regular expression and time interval — defined once in § 3.2 and then used by all directives.◇Reloading settings versus restarting the serviceThe configuration is read at startup, and after that edits are picked up by the reload command — except for the directives the manual marks as requiring a restart.

In the Hub
Cost of a mistake
reversible: harms only while it is set
Scenarios
Configuration lifecycle