AUTHUP(8)

NAME
authup - offer SMTP or POP3 authentication

SYNOPSIS
authup [ -t tries ] protocol checkpassword prog

DESCRIPTION
authup speaks just enough SMTP (AUTH LOGIN or PLAIN) or POP3 (USER-PASS) to parse a username and password and pass them to checkpassword. authup is most commonly invoked as root so checkpassword can change to the UID of the authenticated user before running prog.

Common combinations of protocol and prog:

smtp
    and checknotroot fixsmtpio ofmipd

pop3
    and checknotroot qmail-pop3d

authup waits for checkpassword and prog to finish, and prints an error message if either of them crashes or exits nonzero.

OPTIONS

-t tries
    Disconnect after tries failed authentication attempts. Default: 5 for SMTP, 1 for POP3.

ENVIRONMENT VARIABLES
When running under sslserver -n or s6-ucspitlsd, authup can offer TLS. Set UCSPITLS to the special value ! to require that clients negotiate TLS before authenticating.

If DISABLETLS is set, the presence and value of UCSPITLS will be ignored.

If AUTHUP_SASL_BROKEN_CLIENTS is set, authup will additionally advertise AUTH support in a second, non-standard way to interoperate with Outlook Express 4, Exchange 5, and other SMTP clients that implement an obsolete version of the AUTH command.

If authentication succeeds, prog's environment will contain the username in AUTHUP_USER.

Since prog will run with the privileges of the authenticated user, so will any qmail-queue wrapper configured as QMAILQUEUE. This can be useful for user-controlled filtering.

CONTROL FILES

smtpgreeting / pop3greeting
    SMTP and POP3 greeting messages. Default: me, if that is supplied; otherwise authup will refuse to run. The first word of the greeting should be the current host's name.

smtpcapabilities / pop3capabilities
    SMTP and POP3 capabilities (one per line) to advertise in EHLO and CAPA, respectively. Default: none. Without the needed file, authup will refuse to run. Typical SMTP capabilities: PIPELINING, 8BITMIME. (Omit STARTTLS and AUTH.) Typical POP3 capabilities: TOP, UIDL. (Omit STLS and USER.) Correct values for your system depend on what prog offers. For instance, to inspect your installed qmail-smtpd: $ echo EHLO | qmail-smtpd \
         | sed -e '1,2d' -e 's|^....||' | egrep -v '^(STARTTLS|AUTH)' authup will automatically advertise TLS support when UCSPITLS has been enabled in the sslserver -n or s6-ucspitlsd environment.

timeoutsmtpd / timeoutpop3d
    Number of seconds authup will wait for each new buffer of data from the remote SMTP or POP3 client. Default: 1200.

COMPATIBILITY
While CRAM-MD5 is available in most SMTP AUTH patches, and APOP is available in qmail-popup, neither is currently supported by authup. Nor is authenticating with a client certificate. If you rely on any of these, please share your use case with the author.

EXAMPLES
See https://schmonz.com/qmail/acceptutils.

AUTHOR
Amitai Schleier <schmonz-web-acceptutils@schmonz.com>

SEE ALSO
checknotroot(8), fixsmtpio(8), sslserver(1), s6-ucspitlsd, ucspi-tls(2), qmail-qfilter-queue(8), ofmipd(8), qmail-smtpd(8), qmail-pop3d(8), qmail-popup(8).