Has anyone got sendmail working with smtp.office365.com ?

[XPEN-Paul]

Hi Guru's.

Firsty: Has anyone out there managed to get sendmail working out to smtp.office365.com (or any of it's other aliases) please?
 
Is there any sort of guide/notes/pointers available anywhere that might help me navigate my way through this absolute minefield?

I'm really struggling to try and get HP-UX 11.31 sendmail working, going from an on-premise server out to smtp.office365.com  

I have now got DNS configured on the customer's server, and working, so I can telnet smtp.office365.com 587 and get responses I expect (including "250-STARTTLS" when I do a EHLO mydomain.co.uk so I'm pretty sure the basic outward connection is being allowed okay.

I then fixed an error in the sendmail.cf and submit.cf, whereby I needed to specify O RandFile=egd:/dev/urandom as sendmail startup was complaining about it as part of STARTTLS

Currently I've got an issue with entry in mail.log saying a .pem certificate file is 'unsafe : Permission denied' - which I believed would be sorted by changing it from 600 to 400, so only owner (root) could read it - but having restarted sendmail then trying to send a simple mail, it throws the error about it being "unsafe: Permissoin denied"  [there's other later errors about "load verify locs" referencing the /etc/mail/certs folder, but I think this relates to the .pem file permissions.

Any guidance/pointers would be  VERY much appreciated.

Thanks
Paul

[Rikki hinn Ogurlegi]

Sadly, I don't have my HP-UX system up and running as this sounds like an interesting problem to tackle.  However, I'm not sure what TLS versions or encryption ago's HPE's sendmail supports.   Generally older versions are being phased out everywhere so maybe that is the issue.  If that is the case, HPE might have an updated version capable of modern encryption but I doubt they will give it to you.

But if all else fails, you could always use an existing modern linux server (or set up a new one) and use it as a smart host/relay for all outgoing email from the HP-UX system.

[XPEN-Paul]

Hi Rikki and many thanks for your response.

The TLS specified is 1.2 or later - which is supported by the software on the customer's server.  One key issue seems to be getting the initial SSL handshake with Microsoft to work - seemingly needing a very dark black-art and unique skillset to even get it near working.  I'm seeing lots of posts elsewhere via Google saying it's a non-starter and people proposing to try using Postfix instead, or, as you suggested - some sort of intermediate relay (not an option for this customer I'm afraid).

I'm going to keep slowly working on the issue as time permits, but will certainly plan to share my failures and any success on here for the benefit of others.

Kind regards
Paul 

[laurentmenase]

A new version of sendmail had been released, including some sasl mechanism library, and linked wiht openssl 3.0 which makes it a little easier to configure.
Now the problem woth office365 is that it doesn't allow plain or login auth mechanism anymore but only OAUTH2.
see https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online
So the only possibility which may still exist would be to port cyrus-sasl-xoauth2 on HPUX
Alternate method, use a linux as a relay server

[support_s]

Hello,

Let us know if you were able to resolve the issue.

If you are satisfied with the answers then kindly click the "Accept As Solution" button for the most helpful response so that it is beneficial to all community members.

Please click on "Thumbs Up/Kudo" icon to give a "Kudo".