我想使用Python的smtplib发送带有Python脚本的电子邮件。
如果可以建立到服务器的加密连接，则脚本仅应发送电子邮件。
要加密到端口587的连接，我想使用STARTTLS。
使用一些示例，我编写了以下代码:
smtp_server = smtplib.SMTP(host, port=port)
context = ssl.create_default_context()
smtp_server.starttls(context)
smtp_server.login(user, password)
smtp_server.send_message(msg)
信息，主机，端口，用户，密码是我脚本中的变量。
我有两个问题:
[编辑]
@tintin解释说，
ssl.create_default_context()可能会导致不安全的连接。因此，我通过以下示例使用一些示例更改了代码:_DEFAULT_CIPHERS = (
'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:'
'DH+HIGH:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+HIGH:RSA+3DES:!aNULL:'
'!eNULL:!MD5')
smtp_server = smtplib.SMTP(host, port=port)
# only TLSv1 or higher
context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
context.options |= ssl.OP_NO_SSLv2
context.options |= ssl.OP_NO_SSLv3
context.set_ciphers(_DEFAULT_CIPHERS)
context.set_default_verify_paths()
context.verify_mode = ssl.CERT_REQUIRED
if smtp_server.starttls(context=context)[0] != 220:
return False # cancel if connection is not encrypted
smtp_server.login(user, password)
对于密码设置，我使用了
ssl.create_default_context()的最新版本的一些代码。这些设置合适吗？注意:在我原始问题的代码中是一个错误。这是有关行的正确版本:
smtp_server.starttls(context=context)
[\编辑]
最佳答案
长话短说:如果您不检查.starttls()的响应码，则可以从smtplib
.starttls()，从而剥离STARTTLS命令并伪造非220响应不会协商ssl，也不会引发异常，因此不会加密您的通信-ergo it 除非易受易碎ojit_r攻击您手动验证对.starttls()[0]==220或内部.sock的响应是否包含ssl包装。这是python 2.7.9 smtplib通信，与您的示例类似，该示例通过让服务器或MitM答复
999 NOSTARTTLS而不是200来协商starttls失败。没有显式检查客户端脚本中的200响应代码，由于starttls尝试失败而没有异常，因此邮件传输未加密:220 xx ESMTP
250-xx
250-SIZE 20480000
250-AUTH LOGIN
250-STARTTLS
250 HELP
STARTTLS
999 NOSTARTTLS
mail FROM:<[email protected]> size=686
250 OK
rcpt TO:<[email protected]>
250 OK
data
.starttls()(或者MitM从服务器响应中剥离此功能)将引发SMTPNotSupportedError。参见下面的代码。 ssl.create_default_context()创建的)。请注意，将SSLContext配置为允许进行身份验证但不加密的密码规范(如果由服务器和客户端共同提供/允许)是完全有效的。例如。 TLS_RSA_WITH_NULL_SHA256。NULL-SHA256 TLSv1.2 Kx = RSA Au = RSA Enc = None Mac = SHA256
.sendmail()，.send_message和.starttls()将隐式调用.ehlo_or_helo_if_needed()，因此无需再次显式调用它。这也是参见下面的source::smtplib::starttls (cpython, inofficial github):
def starttls(self, keyfile=None, certfile=None, context=None):
"""Puts the connection to the SMTP server into TLS mode.
If there has been no previous EHLO or HELO command this session, this
method tries ESMTP EHLO first.
If the server supports TLS, this will encrypt the rest of the SMTP
session. If you provide the keyfile and certfile parameters,
the identity of the SMTP server and client can be checked. This,
however, depends on whether the socket module really checks the
certificates.
This method may raise the following exceptions:
SMTPHeloError The server didn't reply properly to
the helo greeting.
"""
self.ehlo_or_helo_if_needed()
if not self.has_extn("starttls"):
raise SMTPNotSupportedError(
"STARTTLS extension not supported by server.")
(resp, reply) = self.docmd("STARTTLS")
if resp == 220:
if not _have_ssl:
raise RuntimeError("No SSL support included in this Python")
if context is not None and keyfile is not None:
raise ValueError("context and keyfile arguments are mutually "
"exclusive")
if context is not None and certfile is not None:
raise ValueError("context and certfile arguments are mutually "
"exclusive")
if context is None:
context = ssl._create_stdlib_context(certfile=certfile,
keyfile=keyfile)
self.sock = context.wrap_socket(self.sock,
server_hostname=self._host)
self.file = None
# RFC 3207:
# The client MUST discard any knowledge obtained from
# the server, such as the list of SMTP service extensions,
# which was not obtained from the TLS negotiation itself.
self.helo_resp = None
self.ehlo_resp = None
self.esmtp_features = {}
self.does_esmtp = 0
return (resp, reply)
关于python - 使用STARTTLS从Python发送电子邮件，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/33857698/