+You can redirect all of your mail to some other site if you prefer to
+consolidate it: just write the destination mailbox to =~/.forward=.
+Everything else is left to you.
+
+
+* Sending mail
+
+** The =sendmail= program
+
+Exim provides a =/usr/sbin/sendmail= program with a plausible interface,
+and most traditional Unix programs will use this by default to send
+mail.
+
+** SMTP to =localhost=
+
+Another traditional way of submitting mail is by connecting to port 25
+on the loopback address 127.0.0.1 and speaking SMTP. This will work on
+most servers, and you will be authenticated automatically using the
+system's =identd=. NB: servers other than stratocaster won't
+understand unusual domains.
+
+** The Submission protocol
+
+The `modern' way to submit mail involves connecting to port 587 on the
+=mail.distorted.org.uk= (the `submission' service) and speaking SMTP.
+If you use this service, then (a) you must tell your client to send
+=STARTTLS=, and (b) you will have to provide a user name and password.
+
+As with IMAP, the SMTP server's certificate is signed by the
+=distorted.org.uk= CA; see above.
+
+** Sender authenticity
+
+It is my intention that it be very hard for one =distorted.org.uk= user
+to impersonate another to a third. To this end, the mail server is
+rather picky about envelope sender addresses.
+
+ + It won't accept an apparently local sender address from an external
+ mail server at all.
+
+ + It will check locally submitted mail against the submitter's user
+ name. The precise details vary according to the submission
+ mechanism: mail submitted through =sendmail= will have additional
+ headers added; mail submitted through SMTP will be rejected unless
+ the envelope sender is acceptable.
+
+If I see something like DKIM catching on then this will also provide
+external users with some kind of (probably fairly weak) sender
+authenticity.
+
+On the other hand, the mail server is aware of vanity domains, extension
+addresses, and so on, and should let you send mail apparently from an
+such an address that you control. If you think the mail server is being
+unnecessarily strict about something then I'm willing to discuss your
+requirements.
+
+If I'm hosting your mail domain for you then you get to decide the
+appropriate policy.
+
+
+* Chopwood, and passwords
+
+Users don't have login passwords on =distorted.org.uk= machines; but the
+SMTP and IMAP services require user names and passwords, which are
+managed using the `Chopwood' service (whose name is `chpwd' -- short for
+`change password' -- with some additional vowels).
+
+You can communicate with Chopwood in three different ways.
+
+ 1. Using Userv. On stratocaster, run =userv chpwd help= for a list
+ of commands.
+
+ 2. Using SSH. You will need to send me an SSH public key (or
+ several), which I'll install for you. Then you'll be able to run
+ =ssh chpwd@stratocaster.distorted.org.uk help= for a list of
+ commands, as for Userv. (This is mainly intended for people who
+ don't have login accounts.)
+
+ 3. Using the web interface. Point your browser at
+ =https://www.distorted.org.uk/chpwd/=. For this, you'll need a
+ user name and password for Chopwood itself: if you have a local
+ login, you can set this up yourself using Userv (say); otherwise
+ I'll generate a password for you and send it to you.
+
+If you're using Userv or SSH, you can list which password-using services
+you have accounts with the =list= command, and request new passwords
+with =reset=, which prints the new password to stdout; the =clear=
+command will disable a service's password, preventing you from logging
+in at all. There is a command =set= for setting a password that you
+choose, but that's disabled as a matter of local policy: it's possible
+that I can be persuaded to enable it, but not very likely. Note that
+you can reset several services' passwords with the same command, and
+this will use the same (freshly generated) password for all of them.
+For example,
+
+: userv chpwd reset smtp imap
+
+will generate a new password which will work both with the SMTP
+submission service and the IMAP server.
+
+Similar functionality is available through the web interface.
+
~mdw / exim-config / commitdiff