Ukuthumela nge-SMTP kusetshenziswa i-Python: i-STARTTLS ku-587 noma i-TLS ku-465?

Zombili izindlela zokuxhumana zithwala umyalezo ofanayo ziwusa ku-akhawunti ye-relay efanayo, futhi umehluko usendaweni lapho i-TLS iqala khona, hhayi kokuthunyelwayo. Enye ivuleka ngombhalo ocacile bese inyukela ngaphakathi koxhumano; enye ishifriwe kusukela kubhayithi yokuqala. Lowo mehluko owodwa unquma ukuthi inqubomgomo eqinile ye-relay izokwamukela ini, ukuthi idivayisi ephakathi ingabona ini, nokuthi yimuphi umyalezo wephutha ozochitha intambama uwufunda. Nakhu engikhetha ngakho phakathi kwazo lapho uhlelo lokusebenza kwinethiwekhi yangasese luhambisa umyalezo enkonzweni yangaphakathi yokuthumela.

Lapho izindlela ezimbili zehluka khona ngempela

Umsebenzi uyafana kuzo zombili izimo: qinisekisa njenge-akhawunti egunyaziwe, shono umthumeli ovunyelwe, bhala abamukeli, bese ulinda ukuthi i-relay ithathe umthwalo wemfanelo. Okushintshayo ukulandelana kwemisebenzi. Iphothi 587 iqala njengesikhathi se-SMTP sombhalo ocacile, imemezela i-STARTTLS empendulweni ye-EHLO, futhi inyukela kuphela uma iklayenti licela. Iphothi 465 ilindela ukuxhawulana kwe-TLS ngaphambi kokuba kushiwo noma yimuphi umyalo we-SMTP.

Ukuthumela ne-relay kuyimisebenzi ehlukene, yingakho izinombolo zamaphothi zingezona izindlela ezingashintshana. I-RFC 6409 ichaza ukuthunyelwa kwemiyalezo njengenkonzo yayo, futhi i-RFC 8314 ihlanganisa uhlobo lwe-TLS efihliwe olunikezwa amaningi amarelsi esimanje ku-465. Uma i-relay yakho ibhala enye yalezi ezimbili, lowo mbhalo udlula noma yikuphi ukuthanda okuvela kumqashi wangaphambili.

I-STARTTLS ku-587 ikunikeza ini

Ukunyuka kwenzeka ngaphakathi kwengxoxo ye-SMTP, ngakho i-relay ingayimemezela futhi iklayenti lingenqaba ukuqhubeka ngaphandle kwayo. Ku-Python, i-starttls() iphonsa okuhlukile lapho iseva ingayinikezi leyonto yokunweba, okuguqula umzamo wokwehlisa izinga ube ukwehluleka okubonakalayo esikhundleni sokungena ngombhalo ocacile buthule. Lokho kuziphatha kuyisizathu esiyinhloko sale ndlela, futhi kufanelekile ukuthembela kukho ngamabomu hhayi ngengozi.

Iwindi lokuchayeka lincane kodwa lingokoqobo: ukushintshana kokuqala kwe-EHLO kuyafundeka, futhi akukho lutho ngaphambi kokunyuka oluthwala ubufakazi. Endleleni yangasese phakathi kwesubnet yohlelo lokusebenza ne-relay yangaphakathi, lelo windi livamise ukwamukeleka. Endleleni ongayilawuliyo, yikho kanye isizathu sokuthi amanye amaqembu aphikelele kwenye indlela.

Idivayisi yokuvimbela eqeda amandla e-STARTTLS ikhiqiza ukuthumela okwehlulekile, hhayi ukubuyela emuva. Lowo umphumela owufunayo, futhi iyona ndlela eshesha kakhulu yokuthola ukuthi kukhona okubhala kabusha i-SMTP endleleni.

I-TLS efihliwe ku-465 ishintsha ini

Asikho isigaba sombhalo ocacile nhlobo. Iklayenti yenza ukuxhawulana kwe-TLS ngokushesha lapho isokhethi ivuleka, iqinisekisa isitifiketi ngokumelene nesitoreji sayo sokuthembela, bese ishintshana nge-EHLO, i-AUTH nomyalezo. Akukho okungakwazi ukwehlisa izinga lesikhathi ngoba asikho isimo sombhalo ocacile okungaxoxiswana ngaso, futhi lokho kususa lonke ikilasi lokwehluleka kokuvimbela.

Okushintshwayo umandla wokuxilonga. I-relay ephendula ku-465 nge-SMTP yombhalo ocacile, noma isilinganisi somthwalo esiqeda i-TLS ngegama lesitifiketi elingalungile, siyahluleka ekuxhawulaneni futhi sikunikeza iphutha le-SSL esikhundleni sephutha le-imeyili. Lapho lokho kwenzeka, inkinga ingaphansi kohlelo lokusebenza, futhi akukho nani lokwakha umyalezo elizokulungisa.

Umsebenzi owodwa wokuthumela, izindlela ezimbili zokuthutha

Ikhodi ayihlukani kangako phakathi kwezindlela, ngakho ukukhetha kufanele kwenziwe kusukela kunqubomgomo ye-relay hhayi ekulungeleni kwelabhulali. Qala ukukhipha izilungiselelo, bese ugijima iskripthi esisodwa esikhetha ukuthutha ngokwephothi elilungisiwe.

export SMTP_HOST=smtp.relay.internal
export SMTP_PORT=587
export SMTP_USER=svc-notify
export [email protected]
export [email protected]
export SMTP_PASSWORD="$(cat /run/secrets/smtp_password)"

import os, smtplib, ssl
from email.message import EmailMessage

ctx = ssl.create_default_context()
msg = EmailMessage()
msg["From"] = os.environ["MAIL_FROM"]
msg["To"] = os.environ["MAIL_TEST_TO"]
msg["Subject"] = "relay submission test"
msg.set_content("One authorized test message from the app.")

host = os.environ["SMTP_HOST"]
port = int(os.environ.get("SMTP_PORT", "587"))

if port == 465:
    client = smtplib.SMTP_SSL(host, port, context=ctx, timeout=15)
else:
    client = smtplib.SMTP(host, port, timeout=15)
    client.ehlo()
    client.starttls(context=ctx)
    client.ehlo()

with client:
    client.login(os.environ["SMTP_USER"], os.environ["SMTP_PASSWORD"])
    refused = client.send_message(msg)

print("refused:", refused)

I-create_default_context() iqinisekisa uchungechunge kanye negama lomsingathi, ngakho i-CA yangasese kufanele ifakwe esitoreji sokuthembela esikhundleni sokwedlula ngomongo ongaqinisekisiwe. I-send_message() ibuyisela isichazamazwi sabamukeli i-relay eyenqabile; isichazamazwi esingenalutho sisho ukuthi yamukele bonke. Isikhathi sokulinda semizuzwana eyishumi nanhlanu siyisiqalo, hhayi inani elilungiselwe inethiwekhi yakho.

Gcina iphasiwedi ngaphandle kwesithombe nangaphandle kwamalogi. Imfihlo efakwa ngesikhathi sokusebenza futhi ifundwa endaweni ezungezile ilungile; ukuphinda indawo ezungezile emgqeni welogi akulungile, futhi nomkhondo wokulungisa ingxoxo ye-AUTH awulungile.

Khetha ngenqubomgomo ye-relay nangendlela, hhayi ngomkhuba

Izimo ezintathu zinquma. Okokuqala, lokho i-relay ekumemezelayo ngempela: inkambo elalela kuphela ku-587 nge-STARTTLS ayinakufinyeleleka ku-465, noma ngabe uthanda kangakanani i-TLS efihliwe. Okwesibili, ukuthi indlela phakathi kohlelo lokusebenza ne-relay ithembeke ngokwanele yini ukwamukela ukushintshana kwe-EHLO okufundekayo. Okwesithathu, ukuthi kukhona yini okubhala kabusha noma okwenza iproxy ye-SMTP phakathi, ngoba lokho kunquma ukuthi ingozi yokwehlisa izinga ingeyethiyori noma ingokoqobo.

Lapho i-relay inikela ngakho kokubili, ngithatha u-465 wenkonzo egijima ngaphandle kokugadwa kanye no-587 kwaleyo lapho umuntu ebuka ukusetshenziswa kokuqala, kungenxa yokuthi imiyalezo yokwehluleka ikhomba ezingabangeni ezihlukene. Lokho kuthanda kungokwami futhi akusona inqubomgomo.

Noma yini oyikhethayo, rekhoda iphothi, impahla yokuthembela kanye nesizinda somthumeli kanye nokusetshenziswa. Bese uthumela umyalezo wokuhlola ogunyaziwe futhi uqinisekise ukuthi i-relay iwamukele, ugcina umphumela wokuthumela kanye nanoma yimuphi umbiko wokulethwa wakamuva njengamarekhodi ahlukene. Ukunikelwa okuphumelelayo ku-relay ukuphela komthwalo wemfanelo wohlelo lokusebenza, hhayi ubufakazi bokuthi umyalezo ufike ebhokisini lokungenisa.