updated April 10 2001.
Working support for configurable smtp accounts 
is now available in both xfmail and archimedes.

The archimedes gui for configuration is not done yet, but
the xfmail version is fisnished.

Until then, archimedes configuration is by a configuration file:
(config dir)/smtp_accts      (archimedes)
((config dir)/.xfmsmtp_accts  in xfmail)

In archimedes, you must at present create this file 
with your favorite  text editor.   

In XFmail, it is configurable in the config/misc/send dialog.
(use the "Configure SMTP Host accounts button).


Each smtp account is configured by three or four lines:
Accounts with invalid configurations are ignored
and will be ommitted
when the configuration files is saved at program exit.

--------account entry in (.xfm)smtp_accts--------------
@ <account name>
<flags>
<smtp hostname>  <(remote smtp) service/port>
<authentication data (depends on flags)>
--------------------------------------------------------

<Flags> is the integer sum of switches :
1   - disable account
2   - authentication required.
4   - take username and password from a (POP/IMAP) mail receive account.
8   - store password.

Only  <account name> <flags> and <hostname> are required
if switch 2 is "off" (authentication not required)

If switch 2 is "on", the <authentication data> line
is required, even if it is just ""   (quoted empty string)

If switch 4 is "on", the <authentication data> line should be the
name of a POP/IMAP receive mail account with the same username
and password.

If switch 4 is "off", the <authentication data> line should 
be a username, followed (optionally) by a password.
"" is acceptable in place of the username, in which case, a popup
box will ask for username and password when you connect to the
authenticated SMTP server.

---------example .xfmsmtp_accts file--------------
@ account1
10
mailhost.isp.com 25
my_username my_password
@ account2
6
mailhost.isp.com 25
pop_acct
@  account3
0
mailhost.isp.com 25
@ account4
11
mailhost.isp.com 25
my_username my_password
---------end example-----------------------------
here account1 is authenticated with the given username and password,
account2 is authenticated with a username and password taken from the
mail receive account "pop_acct", and account3 does not use
authentication; account4 has same settings as account1, but is
also disabled.




Host Entries in the "SMTP Host (Mail Gateway)" line
(Config/Misc/Send window) are now first checked  against
name and hostname of any configured (and not disabled) SMTP accounts.
If a match is found, the account is used.    

So, even if the SMTP gateway does not require authentication,
account names may be used to provide short synonyms for
hostnames.

If the remote SMTP port  requires  unencripted authentication,
you will need to set up an encrypted tunnel (e.g., using stunnel
from www.stunnel.org ) from localhost:localport to  smtphost:smtpport,
and should configure xfmail/archimedes so <hostname> = localhost, and
<service/port> = localport.

The authentication methods currently implemented (in smtp_auth.cpp)
are:
AUTH=LOGIN  (unencrypted)
PLAIN       (unencrypted)
CRAM-MD5    (encrypted)


===============================================================

------------------------------------------
Notes(Feb 1 , 2001):

I have built what appears to be a working infrastructure
for authenticated smtp, based on RFC 2554 
"SMTP Service Extension for Authentication"
(www.ietf.org)


What is done:  

A challenge-response dialog manager  smtp_authenticate()
is appended to smtp.c, and  uses functions in
smtp_auth.c, headers in smtp_auth.h.

Supported protocols (so far)
"undocumented, but common:
LOGIN  ("AUTH=LOGIN" base64-encoded Login: /Password: dialog)
SASL protocols:
PLAIN
CRAM-MD5

Note the LOGIN and PLAIN are only suitable for use
over an encrypted channel, like an SSL connection
(use stunnel for this). (e.g.,AT&T Woldnet uses AUTH=LOGIN
over an SSL connection.)

TO DO:

(a)
add support for stronger SASL authentication schemes such as
DIGEST-MD5,  etc.  Just add modules like e.g.
smtp_auth_DIGEST_MD5() in smtp_auth.c ...

(b)
Provide a hook to the gui to configure the SMTP username
and password..   These should be supplied by
get_smtp_username(), get_smtp_password()
which are appended to the bottom of smtp,c.
(At present they are just dummy routines that return
hard-coded values for username and password
defined in smtp_auth.h ....)


A common  scenario is that these should
be the same as the POP3 or IMAP account  username and
password, but should be configurable.   May the first thing
to do is to allow the Pop3 data to be used, without adding
the extra gui feature to the smpt config screen.

The gui for smtp configuration should have a checkbox
"smtp server require authentication", which brings up a box
allowing eithe the pop3/imap values to be used, or seperate
account details to be specified.

A "security" tab, where SASL/TLS protocols could be configured
for pop3/imap as well as smtp would be on an eventual wish list.
Fancier authentication mechanisms need extra configuration information.

Duncan Haldane
duncan_haldane@users.sourceforge.net
f.duncan.m.haldane@worldnet.att.net










