The AuthMechanisms option is used to declare the types of authentication you want to allow to be passed in the AUTH ESMTP extension (see RFC2554). You use this option by listing the mechanisms you wish to set as its value: O AuthMechanisms= mechanisms configuration file (V8.10 and later) -OAuthMechanisms= mechanisms configuration file (V8.10 and later) define(`confAUTH_MECHANISMS', ` mechanisms') mc configuration (V8.10 and later) When there is more than one preferred mechanism, each is separated from the others by space characters . For example: define(`confAUTH_MECHANISMS', `CRAM-MD5 KERBEROS_V4') Before the actual AUTH is generated, sendmail produces an intersection of the mechanisms you want and those supported by the SASL software you have installed. Only those that are specified by both this option and those supported by your software are listed by the issued AUTH command: 250-AUTH CRAM-MD5 Here, you wanted both CRAM-MD5 and KERBEROS_V4 offered as mechanisms. But if the SASL software installed on your machine, for example, supports only CRAM-MD5 and DIGEST-MD5, the common or intersecting mechanism will be CRAM-MD5, so that is all that will be advertised. When more than one mechanism is listed, the other side will negotiate them one at a time, until one succeeds. For example, the interplay of the offered mechanisms and the counters by the other side might look like this: 220 other.domain ESMTP Sendmail 8.12.7/8.12.7; Sat, 18 Dec 1999 09:17:09 -0800 (PST) EHLO host.your.domain 250-host.your.domain Hello you@host.your.domain [122.45.67.8], pleased to meet you 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-SIZE 250-DSN 250-ONEX 250-ETRN 250-AUTH CRAM-MD5 KERBEROS_V4 we support 250-XUSR 250 HELP AUTH CRAM-MD5 they first try this 334 authentication challenge here authentication reply here 504 5.7.0 Authentication failure that fails AUTH KERBEROS_V4 so they try this 334 authentication challenge here authentication reply here 235 2.0.0 OK Authenticated which succeeds The following mechanisms are the maximum set of those recognized by the cyrus-sasl-1.5.16 distribution. Not all will be compiled in, so not all will be supported.
The complete list of current mechanisms, and the RFC that describes each, can be found at http://www.iana.org/assignments/sasl-mechanisms/ and http://www.sendmail.org/~ca/email/mel/SASL_info.html. The AuthMechanisms option is available only if sendmail is compiled with SASL (SASL) defined. The AuthMechanisms option is not safe. If specified from the command line, it can cause sendmail to relinquish its special privileges. |