SMTP Authentication with Sendmail 8.12.10

These notes cover compiling Sendmail 8.12.10 with support for SMTP AUTH on a FreeBSD 4.4-RELEASE #0 system using version 1.5.28 of the Cyrus SASL library. I wrote them for my own reference, but they're here in case they help someone else with the same or a similar setup.

In retrospect, I probably could have avoided extra work (making the symbolic link to /usr/local/lib/sasl and including the /usr/local/* directories when compiling sendmail) by compiling Cyrus SASL with --prefix=/usr. Someone try it and let me know...

Some similar guides:

SMTP Authentication in the FreeBSD Handbook covers FreeBSD 5.1-RELEASE
OpenBSD Sendmail + SMTP Auth Mini-HowTo
How To Set Up SMTP AUTH, covers Sendmail 8.12.10 (or .9, but it should be the same anyway) on SuSE Linxy 7.3
How To Setup AUTH with Sendmail and Cyrus SASL, covers Sendmail 8.12.7 on Linux

Other helpful information :

Cyrus SASL info
See sendmail/README distributed with Sendmail 8.12.10
In the bat book (Costales' and Allman's sendmail, Third Edition), see 10.9 "Support SMTP AUTH" (pp. 406-415), 24.9.5 "AuthMechanisms" (pp. 947-949), and 24.9.6 "AuthOptions" (pp. 949-950), including the errata.
SMTP AUTH in sendmail 8.10-8.12 by Claus Assmann
Sendmail Security notes by Gregory Shapiro, covers Sendmail 8.12; see pp. 32-34
RFC 2554: SMTP Service Extension for Authentication

Installing Cyrus SASL

Download Cyrus SASL 1.5.28. (The 2.x libraries aren't officially supported under Sendmail 8.12.10.)
Extract into /usr/local/src and follow the directions in INSTALL. make with the --enable-login option if you want to support the non-standard LOGIN mechanism used by Outlook. make with --disable-krb4 and/or --disable-gssapi if you don't need support for kerberos.
ln -s /usr/local/lib/sasl /usr/lib/sasl
Create /usr/local/lib/sasl/Sendmail.conf, which might look like this:
pwcheck_method: sasldb
Create some users using /usr/local/sbin/saslpasswd (if using sasldb to check passwords).

Compiling Sendmail

Download sendmail 8.12.10.
Extract into /usr/local/src.
Add the following lines to devtools/Site/site.config.m4:
APPENDDEF(`confENVDEF', `-DSASL')
APPENDDEF(`confINCDIRS', `-I/usr/local/include')
APPENDDEF(`confLIBDIRS', `-L/usr/local/lib -L/usr/local/lib/sasl')
APPENDDEF(`conf_sendmail_LIBS', `-lsasl')
Add the following lines to cf/cf/sendmail.mc (you may want to include fewer or more mechanisms than those listed):
TRUST_AUTH_MECH(`DIGEST-MD5 CRAM-MD5 GSSAPI KERBEROS_V4')
define(`confAUTH_MECHANISMS', `DIGEST-MD5 CRAM-MD5 GSSAPI KERBEROS_V4')
If you're including PLAIN or LOGIN as mechanisms, you should probably add:
define(`confAUTH_OPTIONS', `p,y')
Complete any other configuration and ./Build

Test Before Installing

./obj.FreeBSD.4.4-RELEASE.i386/sendmail/sendmail -bs -Am -Ccf/cf/sendmail.cf -OLogLevel=13 and EHLO to test
You should get a line like this (maybe with more or fewer mechanisms listed):
250-AUTH DIGEST-MD5 CRAM-MD5

Configuring Authentication for Your Users

Stay tuned...