[9452] in athena10
Re: [Debathena] #1025: Nothing should recommend/depend msmtp-mta;
daemon@ATHENA.MIT.EDU (Debathena Trac)
Fri Jul 13 10:58:52 2012
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
From: "Debathena Trac" <debathena@MIT.EDU>
Cc: debathena@MIT.EDU
To: jdreed@MIT.EDU, kaduk@MIT.EDU, jweiss@MIT.EDU, andersk@MIT.EDU
Date: Fri, 13 Jul 2012 14:58:47 -0000
Reply-To:
Message-ID: <057.904b770e3c6a45debad09b19daab2cdd@mit.edu>
In-Reply-To: <042.ee75eeb8015458152c6c9d5ec2b47946@mit.edu>
Content-Transfer-Encoding: 8bit
#1025: Nothing should recommend/depend msmtp-mta; installer should deal
--------------------+-----------------------------
Reporter: jdreed | Owner:
Type: defect | Status: new
Priority: normal | Milestone: Precise Beta
Component: -- | Resolution:
Keywords: | Upstream bug:
--------------------+-----------------------------
Comment (by jweiss):
> - Back in the day (like, the 8.4 days -- Greg or someone should correct
me if my memory or inferences are wrong), we moved from Athena machines
doing direct delivery to all going through outgoing. I think was from a
desire not only to have mail take a known path, but also because a broken
sendmail config could easily cause stupid mail loops. If we move back to
encouraging direct delivery, we should make sure we've thought about this.
I have a vague recollection that something specific broke, and pushed us
in the direction of using outgoing for everything. However, it's possible
that I'm conflating this occasion with one of the several others where
some change to the mail system actively broke what Athena workstations
were doing at the time, and the reasons you mentioned were the only ones
that applied.
> - Keytabs are not obviously the wrong answer here for private machines,
and we should encourage their use.
> - Saving credentials on machines probably _is_ the wrong answer. Should
we support this anyway?
>
> I think my personal preference is for debathena-msmtp (and by extension,
-mta) to begin to fail if they can't do authenticated delivery. We can
add a setting that users can explicitly enable to allow a fallback to
unauth mail and explain that it might fail. We can also document how to
go install a real MTA if you want one, and the caveats that come with
that.
Right now, debathena-msmtp looks at $DEBATHENA_SENDMAIL_AUTH If it is set
to "yes" it sends authenticated mail or fails with and error. If it is
undefined (or empty) it tries to send auth'd mail, but falls back to
unauth'd if it can't find tickets. If it si set to anything else it sends
unauth'd mail. If you simply take the second case and make it behave like
the first case, I think you get what you want, tho I suppose you lose the
setting for auth if possible but unauth if needed (tho you could certainly
define a new value of this variable to check for).
I'll also note that I think this is pretty reasonable, tho I'd want the
error to stat mentioning "renew" and for us to consider whether we have
exactly the same behavior if we're running as root (since that's where I
expect automated mail to run without having tickets).
--
Ticket URL: <https://athena10.mit.edu/trac/ticket/1025#comment:6>
Debathena <http://debathena.mit.edu>
MIT Debathena Project
