How Do I Set Up SMTP AUTH for Injection?
To accept authenticated injection, implement the smtp_server_auth_plain event:
-- Use this to lookup and confirm a user/password credential
kumo.on('smtp_server_auth_plain', function(authz, authc, password, conn_meta)
-- This is just an example of how to populate the return value,
-- not a recommended way to handle passwords in production!
-- In particular, it is an absolutely terrible idea to hard code
-- a password here in plain text!
local password_database = {
['daniel'] = 'tiger',
}
if password == '' then
return false
end
return password_database[authc] == password
end)
Three things to watch for:
AUTH PLAIN only
KumoMTA implements AUTH PLAIN. AUTH LOGIN is deprecated and is not supported, and there is no Lua hook to add it. If a legacy client can only do AUTH LOGIN, front KumoMTA with another MTA (such as Postfix) that accepts AUTH LOGIN and relays onward.
TLS is required for AUTH
Authentication is only offered and accepted over a TLS-protected connection (after STARTTLS). KumoMTA will not accept AUTH PLAIN credentials over a cleartext connection, because they are only base64-encoded. If you see no auth attempts at all, confirm the client is negotiating STARTTLS first.
Trusted hosts skip authentication
The auth handler is not called for peers already permitted by trusted_hosts and relay_hosts. Do not add the IP of an authenticating client to relay_hosts — if you do, it is treated as trusted and never prompted to authenticate.
Note
require_authz binds a user to a tenant name, not to a sending domain. If you need to enforce that an authenticated user may only send from a particular domain, add that check in Lua at reception.