easiest way to configure STARTTLS and PAM/AUTH on debian sendmail?

[Jeff Wiegley <jeffw@cyte.com>]

I'm very tired of struggling with sendmail to get it to support STARTTLS
and SMTPAUTH under debian.

STARTTLS is a pretty easy single include line in the .mc files.

but AUTH is a real pain.

What is the easiest method (preferrably one that doesn't require sasl)
to get AUTH setup so that:
  1) non-STARTTLS connections do NOT offer PLAIN or LOGIN, and
  2) STARTTLS connections do honor PLAIN or LOGIN?

I'm 100% against sasl in general just for the simple fact that the
developers have chosen to store passwords and user credentials in
PLAINTEXT in a file on the filesystem. (add to that the need to
maintain and synchronize two different databases or username/password
information.)

Thanks,

- Jeff