Session analysis
$ telnet smtp.example.com 25 S: 220 smtp.example.com ESMTP Sendmail 8.13.8/8.13.6; Thu, 27 Mar 2008 23:14:59 -0700
The session begins with me telnetting to an SMTP server using port 25, which is the default SMTP port. If you don't know the location of an SMTP server on your network, you'll need to talk to your local sysadmin or else your ISP.
The server issues a 220 reply code (indicating that the service is ready) and identifies itself as being an ESMTP (Extended SMTP) server.
C: EHLO wheelersoftware.com S: 250-smtp.example.com Hello wheelersoftware.com [204.13.10.15], pleased to meet you S: 250-ENHANCEDSTATUSCODES S: 250-PIPELINING S: 250-EXPN S: 250-VERB S: 250-8BITMIME S: 250-SIZE 20000000 S: 250-DSN S: 250-ETRN S: 250-AUTH LOGIN PLAIN S: 250-STARTTLS S: 250-DELIVERBY S: 250 HELP
SMTP has a HELO command that one uses to communicate
the client host to the SMTP server, but ESMTP servers support
EHLO (which stands for "Extended HELLO"), which returns a
list of extensions (commands and keywords) that the ESMTP server
supports. For example, the STARTTLS command allows the
client to start a TLS (Transport Layer Security) session with the
server so that the communication will be encrypted.
C: AUTH LOGIN S: 334 VXNlcm5hbWU6 C: d2lsbGll S: 334 UGFzc3dvcmQ6 C: ZnVuc210cA== S: 235 2.0.0 OK Authenticated
This is the SMTP-AUTH part. SMTP-AUTH adds to SMTP support for client authentication, and so now I tell the server that I want to log in. The server responds with the humorous (to me, anyway) response "VXNlcm5hbWU6", which is the base64 encoding of "Username:". (You can encode and decode these using this base64 encoder/decoder; now you can see why I said above that base64 doesn't provide you any real protection.) I provide the base64-encoded version of my username (willie → d2lsbGll). Then the server asks me for my password; "UGFzc3dvcmQ6" is the base64 encoding of "Password:". So I provide it (funsmtp → ZnVuc210cA==). Server checks the password and gives me the A-OK.
C: MAIL FROM:<darth.vader@deathstar.com> S: 250 2.1.0 <darth.vader@deathstar.com>... Sender ok C: RCPT TO:<willie@example.com> S: 250 2.1.5 <willie@example.com>... Recipient ok C: DATA S: 354 Enter mail, end with "." on a line by itself C: Date: Thu, 27 Mar 2008 23:12:49 -0700 (MST) C: From: darth.vader@deathstar.com C: To: willie@example.com C: Subject: Great article C: C: Hi Willie, C: I enjoyed your article on TCP/IP-based application protocols. C: Join me, and together we can rule the galaxy as father and son. C: Darth Vader C: . S: 250 2.0.0 m2S6ExD6029743 Message accepted for delivery
Here I'm just entering in the e-mail headers and body itself. When I'm done, I just enter . on a line by itself, and the server accepts the message for delivery.
C: QUIT S: 221 2.0.0 smtp.example.com closing connection
Finally I log out.
Conclusion
That's it! Nothing new or earth-shattering here, but it's definitely useful to know how the SMTP protocol works and what you can do with it. Happy e-mailing!
Resources
- SMTP - Wikipedia: Nice overview of SMTP, including a sample communications session over telnet.
- SMTP-AUTH - Wikipedia: Describes the SMTP-AUTH extension to SMTP, which adds client authentication to the SMTP protocol.
- Base64 Encoder and Decoder: Useful for running test SMTP-AUTH sessions over telnet, since the username and password are base64-encoded.
- Negotiating an SMTP AUTH Authentication Mechanism: Brief discussion of SMTP-AUTH.
- SMTP: Simple Mail Transfer Protocol
- The EHLO verb and SMTP extensions
- SMTP reply codes
Comments (5)
Post a comment
