Update: You need to be careful if you are updating to the latest
Debian Exim (~4.67), since the Debian config file format has changed
slightly. I'm pretty sure this whole thing could be easier, so I have
filed #430057. Instructions below
updated slightly.
Sending secure mail seems to have two possible implementations; firstly
you can connect over an insecure channel and issue a command
(STARTTLS) which tells the SMTP server to start a secure channel.
The other option is where you use a secure channel to start with.
Usually this happens with an SSL (TLS) connection on port 465 which you
then probably have to authenticate over.
Exim doesn't support this second model, seemingly by design. Which is a
little annoying if that's all your ISP offers! You may like this on your
laptop, since by authenticating you should be able to send email from
anywhere through the ISP mail server.
What you need is a wrapper that provides the SSL connection between your
computer and the ISP. Then you have to fool exim into using it, and
direct it to send passwords unencrypted (though the underlying channel
is safely encrypted).
Firstly, install stunnel; I found stunnel4 didn't work that
well. Then create a script to start it and make a tunnel to your ISP.
Put the following a file /etc/init.d/ssmtp-tunnel (change to your
ISP's secure email server) and then run
update-rc.d ssmtp-tunnel defaults (and start it with
/etc/init.d/ssmtp-tunnel start).
#! /bin/sh -e
case "$1" in
start)
echo -n "Starting ssmtp tunnel "
start-stop-daemon --start --quiet --exec /usr/sbin/stunnel -- -c -d ssmtp -r securemail.internode.on.net:ssmtp
echo "stunnel."
;;
stop)
echo -n "Stopping ssmtp tunnel "
start-stop-daemon --stop --quiet --oknodo --retry 2 --exec /usr/sbin/stunnel
echo "stunnel."
;;
restart)
$0 stop
sleep 1
$0 start
;;
*)
echo "Usage: /etc/init.d/ssmtp-tunnel {start|stop|restart|reload|force-reload}"
exit 1
esac
exit 0
If you telnet localhost 465 and see a normal SMTP connection, which
is running over SSL, you have things working correctly.
Now you need to configure exim to use this to firstly authenticate, then
send the email onto the smarthost.
Make sure you're using the big config file option with
dpkg-reconfigure exim4-config. When it asks you what the smarthost
should be, tell it localhost.
Firstly create the file /etc/exim4/exim4.conf.localmacros (if it
doesn't already exist) and add a line
AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS = true. This forces using
authentication even though it looks like an unencrypted channel.
Then in /etc/exim4/exim4.conf.template, under the smarthost
router (i.e. the line that starts smarthost:) add
self = send. This allows what exim thinks is a router to an
external MTA to actually go back to the localhost.
In the same file change the remote_smtp_smarthost (i.e the line
that starts remote_smtp_smarthost:) transport to have:
- hosts_avoid_tls = localhost
- hosts_require_auth = localhost
- port = 465
(all on separate lines).
Add a line to /etc/exim4/passwd.client for localhost with
your ISP username/password (or just use * if this is the only
entry).
Finally, update the config file with update-exim4.conf and restart
exim /etc/init.d/exim4 restart. All going well, Exim will now get
the mail out wherever you are!