Aika saƙon SMTP da Python: STARTTLS a 587 ko TLS a 465?

Duk hanyoyin haɗi biyu suna ɗaukar saƙo ɗaya zuwa asusun relay ɗaya, kuma bambancin shine inda TLS ke farawa, ba abin da ake aikawa ba. Ɗaya yana buɗewa a cikin bayyanannen rubutu sannan yana haɓaka cikin hanyar; ɗayan an ɓoye shi tun daga farkon byte. Wannan bambanci ɗaya ne ke ƙayyade abin da tsattsauran manufar relay zai karɓa, abin da na'urar tsaka-tsaki za ta iya lura da shi, da wace saƙon kuskure za ka yi yini ɗaya kana karantawa. Ga yadda nake zaɓe tsakaninsu sa'ad da wata manhaja a cikin keɓaɓɓen cibiyar sadarwa ta miƙa saƙo ga hidimar aikawa ta ciki.

Inda hanyoyin biyu suke bambanta da gaske

Aikin ɗaya ne a duka lokuta biyu: tabbatar da kai a matsayin asusun da aka amince da shi, ambaci mai aikawa da aka yarda da shi, lissafa masu karɓa, da jira relay ya karɓi alhakin. Abin da ke canzawa shine tsarin ayyuka. Tashar 587 tana farawa a matsayin zaman SMTP na bayyanannen rubutu, tana sanar da STARTTLS a amsar EHLO, kuma tana haɓaka ne kawai idan abokin ciniki ya buƙaci. Tashar 465 tana tsammanin musayar hannu ta TLS kafin a faɗi kowace umarnin SMTP.

Aikawa da relay ayyuka ne daban-daban, shi ya sa lambobin tasha ba al'adu ne da za a iya musanya su ba. RFC 6409 yana bayyana aikawa da saƙo a matsayin hidima ta kanta, kuma RFC 8314 ya ƙunshi nau'in TLS ɓoyayye da yawancin relay na zamani suke bayarwa a 465. Idan relay ɗinka ya rubuta ɗaya daga cikin biyun, wannan takardar tana da fifiko bisa kowace zaɓi da ka samu daga ma'aikacin da ya gabata.

Abin da STARTTLS a 587 ke ba ka

Haɓakawa tana faruwa cikin tattaunawar SMTP, don haka relay na iya sanar da ita kuma abokin ciniki na iya ƙin ci gaba ba tare da ita ba. A cikin Python, starttls() yana jefa keɓewa lokacin da uwar garken ba ta bayar da ƙarin fasalin ba, wanda ke mai da ƙoƙarin rage matsayi zuwa gazawar bayyane maimakon shiga bayyanannen rubutu a shiru. Wannan ɗabi'ar ita ce babbar hujja ga hanyar, kuma ya dace a dogara da ita da gangan ba da haɗari ba.

Tagar fallasa ƙarama ce amma ta gaske: musayar EHLO ta farko ana iya karantawa, kuma babu abin da ke ɗauke da bayanan shiga kafin haɓakawa. A kan keɓaɓɓiyar hanya tsakanin ƙaramin cibiyar sadarwar manhaja da relay na ciki, wannan tagar yawanci ana karɓa. A kan hanyar da ba ka sarrafa, wannan shine dalilin da wasu ƙungiyoyi ke dagewa kan ɗayan hanyar.

Na'urar tsangwama da ke cire ikon STARTTLS tana haifar da gazawar aikawa, ba koma baya ba. Wannan shine sakamakon da kake so, kuma ita ce hanya mafi sauri ta gano cewa wani abu yana sake rubuta SMTP a kan hanya.

Abin da TLS ɓoyayye a 465 ke canzawa

Babu wani mataki na bayyanannen rubutu kwata-kwata. Abokin ciniki yana yin musayar hannu ta TLS da zarar an buɗe soket, yana tabbatar da takardar shaida da ma'ajiyar amincewarsa, sannan yana musayar EHLO, AUTH da saƙon. Babu abin da zai iya rage zaman saboda babu yanayin bayyanannen rubutu da za a yi shawarwari daga gare shi, kuma hakan yana kawar da dukan nau'in gazawar tsangwama.

Ciniki shine iya tantance cuta. Relay da ke amsa a 465 da SMTP na bayyanannen rubutu, ko mai daidaita nauyi da ke kawo ƙarshen TLS da sunan takardar shaida mara kyau, yana gazawa a musayar hannu kuma yana ba ka kuskuren SSL maimakon kuskuren wasiƙa. Lokacin da hakan ta faru, matsalar tana ƙasa da manhajar, kuma babu adadin gina saƙo da zai gyara ta.

Aikin aikawa ɗaya, hanyoyin jigila biyu

Lambar ba ta bambanta sosai tsakanin hanyoyin, shi ya sa ya kamata a yi zaɓin daga manufar relay maimakon sauƙin ɗakin karatu. Fara fitar da saitin, sannan ka gudanar da rubutun guda ɗaya wanda ke zaɓar jigilar daga tashar da aka saita.

export SMTP_HOST=smtp.relay.internal
export SMTP_PORT=587
export SMTP_USER=svc-notify
export [email protected]
export [email protected]
export SMTP_PASSWORD="$(cat /run/secrets/smtp_password)"

import os, smtplib, ssl
from email.message import EmailMessage

ctx = ssl.create_default_context()
msg = EmailMessage()
msg["From"] = os.environ["MAIL_FROM"]
msg["To"] = os.environ["MAIL_TEST_TO"]
msg["Subject"] = "relay submission test"
msg.set_content("One authorized test message from the app.")

host = os.environ["SMTP_HOST"]
port = int(os.environ.get("SMTP_PORT", "587"))

if port == 465:
    client = smtplib.SMTP_SSL(host, port, context=ctx, timeout=15)
else:
    client = smtplib.SMTP(host, port, timeout=15)
    client.ehlo()
    client.starttls(context=ctx)
    client.ehlo()

with client:
    client.login(os.environ["SMTP_USER"], os.environ["SMTP_PASSWORD"])
    refused = client.send_message(msg)

print("refused:", refused)

create_default_context() yana tabbatar da sarkar da sunan mai masauki, don haka dole a shigar da CA na sirri cikin ma'ajiyar amincewa maimakon a guje ta da mahallin da ba a tabbatar ba. send_message() yana mayar da ƙamus na masu karɓa da relay ya ƙi; ƙamus mara komai yana nufin ya karɓi duka. Ƙayyadaddun lokaci na daƙiƙa goma sha biyar mafari ne, ba ƙimar da aka daidaita don cibiyar sadarwarka ba.

Ka riƙe kalmar sirri a wajen hoton da wajen rajistan ayyuka. Sirrin da aka ɗora a lokacin aiki kuma aka karanta cikin muhalli yana da kyau; maimaita muhalli cikin layin rajista ba shi da kyau, haka ma alamar gyara na musayar AUTH.

Zaɓi bisa manufar relay da hanya, ba bisa al'ada ba

Sharuɗɗa uku suna warware shi. Na farko, abin da relay ke sanarwa da gaske: hidimar da ke saurare a 587 kawai da STARTTLS ba za a iya isa gare ta a 465 ba, duk yadda kake son TLS ɓoyayye. Na biyu, ko hanyar tsakanin manhaja da relay ta isa amincewa don karɓar musayar EHLO da ake iya karantawa. Na uku, ko wani abu a tsakiya yana sake rubuta SMTP ko yin proksi, domin hakan ne ke ƙayyade ko haɗarin rage matsayi na ka'ida ne ko na gaske.

Lokacin da relay ke bayar da duka biyu, nakan ɗauki 465 ga hidimar da ke gudana ba tare da kulawa ba da 587 ga wadda mutum ke kallon turawa ta farko, kawai domin saƙonnin gazawa suna nuni ga matakai daban-daban. Wannan zaɓi nawa ne kuma ba manufa ba ce.

Duk abin da ka zaɓa, rubuta tashar, kayan amincewa da yankin mai aikawa tare da turawar. Sannan ka aika saƙon gwaji guda ɗaya da aka ba da izini kuma ka tabbatar relay ya karɓe shi, tare da riƙe sakamakon aikawa da duk wani rahoton isarwa na baya a matsayin bayanan daban. Miƙawa cikin nasara ga relay shine ƙarshen alhakin manhajar, ba hujjar cewa saƙon ya isa akwatin saƙo ba.