+-----------------------------------------------------------------------
| Running table-shadow on OpenBSD
+-----------------------------------------------------------------------

Configuration
=============

smtpd(8) resolves a table backend name to /usr/local/libexec/smtpd/
table-<name>, so the backend is named "shadow" in smtpd.conf(5). Do not
call the table itself "auth", which is a reserved keyword:

    table creds shadow
    listen on egress tls pki mail.example.com auth <creds>

Then restart the daemon -- smtpd has no reload, and lka forks the table
backends once, at startup, so a new binary takes effect at the next
start only:

    # rcctl restart smtpd

Accounts
========

An SMTP AUTH login succeeds for a local account holding a real password
hash. An account whose password field is "*" -- every account created
with a locked password, service accounts included -- is answered
not-found, and so is an unknown login.

Privilege
=========

The binary is installed _smtpd:_shadow, mode 2510: setgid _shadow for
getpwnam_shadow(3), executable by _smtpd alone, not setuid. Keep those
bits. World-executable, it dumps any local hash on stdin; putting the
_smtpd user in the _shadow group instead would give the whole lka
process that privilege.
