Send emails over port 80 using Linux command line

Question

I have a server that is not allowed to send outgoing emails or have access to any name servers.

What it has is an http proxy that allows it to access the other servers and I am able to do wget requests by ip or hostname that I have added in the hosts file.

I tried to do a NAT rule to redirect all traffic destined to port 25 to port 80 but had no luck.

Is there any way to send emails over the command line in a situation like mine? I need it to have the server send automatic emails based on some cron jobs I have.

Answer 1

Yes and no.

It's certainly possible to make a MTA talk SMTP over a nonstandard port – but only if the server on the other end is expecting that. And you'll find that nobody, ever, listens for SMTP on port 80 – so your server would spend most of its time trying to talk with someone's Apache. For server-to-server mail exchange (MX), it's port 25, end of story.

So you cannot just change the port. Rather, instead of connecting directly to the recipients' mail servers (from MX records), your MTA would need to relay all mail through a specific server that's been configured to accept SMTP on port 80.

---

But doing that is relatively easy, as long as you have a second server that is allowed to send mail. Install a MTA there (e.g. OpenSMTPD or Postfix), configure it to listen on port 80 and to trust your "source" server's IP address for relaying. (Alternatively, instead of an IP whitelist, SMTP username/password authentication would even be better.)

Here's an (untested) OpenSMTPD example:

table relay-in-ip { "12.34.56.78" }
listen on 0.0.0.0 port 80 tls-require
listen on :: port 80 tls-require
accept from source <relay-in-ip> for any relay

Similarly, for authenticated SMTP:

table relay-in-auth { "someuser"="somepassword" }
listen on 0.0.0.0 port 80 tls-require auth <relay-in-auth> tag AUTHED
listen on :: port 80 tls-require auth <relay-in-auth> tag AUTHED
accept tagged AUTHED from any for any relay

(Make sure to actually test the relay server – it would be Bad™ if it allowed the whole internet to relay messages without authentication.

Once you have that set up, it usually takes just a single setting on the "source" server to relay all mail – depending on the MTA, the option might be named "relay host" or "smarthost", and it almost always accepts a host:port specification:

accept for any relay via "tls://relay.example.com:80"

If authentication is needed:

table relay-out-auth { "foo"="someuser:somepassword" }
accept for any relay via "tls+auth://[e-mail]:587" auth <relay-out-auth>