OpenBSD and smtpd

Published: 30 januari 2012 | Category: General, Hints, Security | Labels: , , | Short url » | Be the first to comment! »

Finally there is a secure and easy-to-configurate substitute for ”Sendmail”, ”OpenSMTPD”!

OpenSMTPD (smtpd) first appeared in OpenBSD 4.6 and will probably replace sendmail as the default mail daemon in OpenBSD 5.1. With this in mind, I replased sendmail with smtpd when I upgraded my OpenBSD (4.8 to 5.0) routers/gateways a few weeks ago. Since they only send ”cron” emails there are not much traffic to talk about but it still feels great to finally replace the old dusty Sendmail.

Here are the steps I went through to get started with smtpd. For a reference see the maual pages at OpenSMTPD.org.

smtpd is not enabled by default. In order to use it as the system
mailer, ensure the mail queue is empty, then stop sendmail(8):

# pkill sendmail

Modify the current mailwrapper(8) settings by editing /etc/mailer.conf:

# cat /etc/mailer.conf
sendmail /usr/sbin/smtpctl
send-mail /usr/sbin/smtpctl
mailq /usr/sbin/smtpctl
makemap /usr/libexec/smtpd/makemap
newaliases /usr/libexec/smtpd/makemap

Rebuild the aliases database, and enable the daemon to run at boot:

# newaliases

# echo ”sendmail_flags=NO” >> /etc/rc.conf.local
# echo ”smtpd_flags=” >> /etc/rc.conf.local

The above parts was all taken from the manuals so here comes the parts that differs depending on the purpose with smtpd. My purpose is to accept outgoing mail from localhost (lo0) only and relay them through my Loopia email account using TLS authentication on port 587. More examples and informations can be found at calomel.org.

# cat /etc/mail/smtpd.conf
listen on 127.0.0.1 port 25
expire 4h
hostname my.local.domain
map ”aliases” { source db ”/etc/mail/aliases.db” }
map ”secrets” { source db ”/etc/mail/secrets.db” }
accept from local for local alias aliases deliver to mbox
accept from local for all relay via mailcluster.loopia.se port 587 tls auth ”secrets”

Since the mailserver uses authentication the username and password is saved in a separate file with restricted permissions.

# cat /etc/mail/secrets
mailcluster.loopia.se LOOPIA_USERNAME@mydomain.tld:LOOPIA_PASSWORD

# chmod 640 /etc/mail/secrets
# chown root:_smtpd /etc/mail/secrets

# cd /etc/mail
# makemap /etc/mail/secrets

Check the config for errors and start smtpd in the background.

# smtpd -n
configuration OK

# smtpd

See so it is working by sending an email to a local user or root depending on your  /etc/mail/aliases setup.

# smtpctl show stats | grep ‘mta.sessions=’

# echo ”A test message” | mail -s ”Subject” root

# smtpctl show stats | grep ‘mta.sessions=’