SMTP AUTH and the SMTP MMP.

Messaging Server 6.0p1
We've run into a problem with the SMTP component of the MMP. Specifically with regards to SMTP authentication.
The messaging server is sending out AUTH=LOGIN and AUTH PLAIN LOGIN options to the client in the ESMTP negotiation even when the SMTP client is listed as INTERNAL in the mappings file.
Consider the 4 scenarios:
1. Connecting directly to the messaging server SMTP from outside of the Intranet.
external.hostname# telnet smtpserver.hostname 25
Trying 1.2.3.4...
Connected to smtpserver.hostname.
Escape character is '^]'.
220 smtpserver.hostname -- Server ESMTP (Sun ONE Messaging Server 6.0 Patch 1 (built Jan 28 2004))
EHLO external.hostname
250-smtpserver.hostname
250-8BITMIME
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-EXPN
250-HELP
250-XADR
250-XSTA
250-XCIR
250-XGEN
250-XLOOP 1CB2DE93C0A60C457A290686F164049E
250-AUTH PLAIN LOGIN
250-AUTH=LOGIN
250-ETRN
250 SIZE 0
AUTH PLAIN XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
235 2.7.0 PLAIN authentication successful.
QUIT
221 2.3.0 Bye received. Goodbye.
Connection to smtpserver.hostname closed by foreign host.
external.hostname#
As you can see, the messaging server responds with the AUTH PLAIN LOGIN and AUTH=LOGIN. The SMTP authentication is successful. This is the correct behavior.
2. Connecting to the MMP SMTP from outside of the Intranet.
external.hostname# telnet mmp.hostname 25
Trying 1.2.3.5...
Connected to mmp.hostname.
Escape character is '^]'.
220 ESMTP Messaging Multiplexor (Sun ONE Messaging Server 6.0 Patch 1 (built Jan 28 2004))
EHLO external.hostname
250-smtpserver.hostname
250-8BITMIME
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-EXPN
250-HELP
250-XLOOP 1CB2DE93C0A60C457A290686F164049E
250-AUTH PLAIN LOGIN
250-AUTH=LOGIN
250-ETRN
250 SIZE 0
AUTH PLAIN XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
235 2.7.0 PLAIN authentication successful.
QUIT
221 2.3.0 Bye received. Goodbye.
Connection to mmp.hostname closed by foreign host.
external.hostname#
Just as in example #1, the MMP responds with the AUTH PLAIN LOGIN and AUTH=LOGIN. Like example #1, the SMTP authentication is successful. This is the correct behavior.
3. Connecting directly to the messaging server SMTP from inside the Intranet.
internal.hostname# telnet smtpserver.hostname 25
Trying 1.2.3.4...
Connected to smtpserver.hostname.
Escape character is '^]'.
220 smtpserver.hostname -- Server ESMTP (Sun ONE Messaging Server 6.0 Patch 1 (built Jan 28 2004))
EHLO internal.hostname
250-smtpserver.hostname
250-8BITMIME
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-EXPN
250-HELP
250-XADR
250-XSTA
250-XCIR
250-XGEN
250-XLOOP 1CB2DE93C0A60C457A290686F164049E
250-ETRN
250 SIZE 0
AUTH PLAIN XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
533 5.7.1 AUTH command is not enabled.
QUIT
221 2.3.0 Bye received. Goodbye.
Connection to smtpserver.hostname closed by foreign host.
internal.hostname#
This time, because the client is on the intranet, the AUTH PLAIN LOGIN and AUTH=LOGIN ESMTP options are not presented to the client. The attempt to perform SMTP authentication fails. This appears to be the correct behavior, as the server didn't advertise as supporting SMTP authentication.
4. Connecting to the MMP SMTP from inside the Intranet.
internal.hostname# telnet mmp.hostname 25
Trying 1.2.3.5...
Connected to mmp.hostname.
Escape character is '^]'.
220 ESMTP Messaging Multiplexor (Sun ONE Messaging Server 6.0 Patch 1 (built Jan 28 2004))
EHLO internal.hostname
250-smtpserver.hostname
250-8BITMIME
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-EXPN
250-HELP
250-XLOOP 1CB2DE93C0A60C457A290686F164049E
250-AUTH PLAIN LOGIN
250-AUTH=LOGIN
250-ETRN
250 SIZE 0
AUTH PLAIN XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
533 5.7.1 AUTH command is not enabled.
QUIT
221 2.3.0 Bye received. Goodbye.
Connection to mmp.hostname closed by foreign host.
internal.hostname#
This time, even though the client is within the intranet, the AUTH PLAIN LOGIN and AUTH=LOGIN ESMTP options are presented to the client. Even though these options are presented to the client, the server refuses to honor authentication attempts. The attempt to perform SMTP authentication fails. THIS IS A BIG PROBLEM!
The implecation is that SMTP clients within the intranet that honor the SMTP authentication ESMTP options presented by the server ALWAYS fail to authenticate.
Netscape 4.x clients, when they see the AUTH=LOGIN and AUTH PLAIN LOGIN options force the user to authenticate. Netscape 7.x at least has a checkbox that gives the user the option to ignore these options and attempt to send anyway. It's now impossible for all of the Netscape 4.x mail clients within the intranet to send mail.
The correct behavior is that the AUTH PLAIN LOGIN and AUTH=LOGIN options should NOT be presented to the intranet clients. I have made every attempt to ensure that our configuration is correct. I believe this is a bug with the Messaging server but I'm posting here in hopes that someone knows what specific changes I can make to the mappings or imta.cnf files that will prevent the Messaging server to present these options to clients through the MMP.
Netscape 7.x clients within the intranet that have been configured to ignore the AUTH smtp ESMTP options can send mail to both local and remote recipients.

Before even looking at your data. . .
We've run into a problem with the SMTP component of the MMP
There is EXACTLY ONE reason to use the SMTP componant of MMP: POP before SMTP
If you have ANY other need for smtp, you should use the entire MTA. That's what it's for.
Actually, it looks like your scenario 3 isn't connecting to the correct MTA at all. The banner should be the same as you got for the other cases. You're sure you didn't start sendmail up by accident?

Similar Messages

TS3276 Inadvertently deleted Outgoing SMTP Mail Server. Entered correct Yahoo email SMTP info and now SMTP is "Offline". Can't SEND emails. Help!

Inadvertently deleted SMTP Outgoing Mail Server address. Re-entered correct mail service provider's address and now have '(Offline)' tagged on server name. Can't SEND any emails. When I try, message will not send but goes into Outbox and sits. How can I get this SMTP address 'Online'? Help!

For whatever reason Yahoo blocked access to their mail servers from Apple Mail in the past couple of days. I deleted my Yahoo account in Apple Mail and tried to add it back. NO JOY.
Today, Yahoo has reopened their servers so that I could add my Yahoo account to Apple Mail again successfully. Even w the second app password.
The problem was at Yahoo. Apple Mail people were either blocked or knocked off from their Yahoo servers for a time. This may happen again as it has in the past. I hope it doesn't become a frequent happening.

Pop before smtp and smtp auth

Hi Jay,
hope all is well with you.
what is pop before smtp and how to see if it is enabled?
what is smtp auth and how to see if it is enabled? Is it enabled by default on MS 6.x?
what happens if smtp auth is not enabled? Will my mail server be a relay?
Is there any additional configuration that should be done on messaging server to allow connection for dial-up users?
thanks,

Hi Jay,
hope all is well with you.
what is pop before smtp and how to see if it is
enabled?Pop before SMTP is a very old, and little used method for "authenticating" users. There is virtually no reason to turn this on, anymore.
It's done through the MMP, and is the only reason to actually use the SMTP proxy that's part of MMP.
I would not go there unless your environment requires it. Most do not. Most clients support SMTP authentication, which is much better, and is on by default.
>
what is smtp auth and how to see if it is enabled? Is
it enabled by default on MS 6.x?See above. Yes, smtp authentication is on by default.
>
what happens if smtp auth is not enabled? Will my
mail server be a relay?Totally different issue.
No.
If smtp auth is off, if you have external users, they likely will not be allowed to send to other external users..
>
Is there any additional configuration that should be
done on messaging server to allow connection for
dial-up users?If "dial-up users" means that they come from ip addresses outside your network, then smtp auth will allow them full access.
thanks,

AuthenticationFailedException when using JNDI and JavaMail with SMTP auth

Hi all - I've been banging my head on this one for awhile now - hopefully someone else has done this.
We are working in a servlet container (tomcat), and need obtain a mail session from JNDI. We do this as follows:
               Context initCtx = new InitialContext();
               Context envCtx = (Context) initCtx.lookup("java:comp/env");
               Session mailSession=(Session) envCtx.lookup("mailSession/trumpetinc");so far so good. The jndi entry for the mail session is configured in server.xml as follows:
          <Resource name="mailSession/trumpetinc" scope="Shareable" type="javax.mail.Session"/>
          <ResourceParams name="mailSession/trumpetinc">
            <parameter>
              <name>mail.smtp.host</name>
              <value>mail.server.com</value>
            </parameter>
            <parameter>
              <name>mail.smtp.password</name>
              <value>ABCDEFG</value>
            </parameter>
            <parameter>
              <name>mail.smtp.user</name>
              <value>trumpet_kevin</value>
            </parameter>
         <parameter>
           <name>mail.smtp.auth</name>
           <value>true</value>
         </parameter>
          </ResourceParams>With the above, whenever we hit Transport.send(msg), we got an AuthenticationFailedException thrown. I have run into this before with SMTP authentication, so I decided to try using the transport.sendMessage() method instead.
So, I get the transport:
Transport trans = mailSession.getTransport("smtp");
trans.connect();Then I send my message using:
msg.saveChanges();
trans.sendMessage(msg, msg.getAllRecipients());and finally, I close the transport:
trans.close();Unfortunately, I'm still getting the exception. Is it possible that my connect() method is not picking up the JNDI properties set in the server.xml file (this seems likely)? If so, what's the best way for me to get those properties so I can set them explicitly in the connect() method?
Thanks in advance,
- Kevin

Hi,
I have faced the same problem and after some googling and trying I have discovered what causes the AuthenticationFailedException exception. I just wanted to share the knowedge maybe it will be helpfull to others.
Here it is what the API says:
To use SMTP authentication you'll need to set the mail.smtp.auth property (see below) and provide the SMTP Transport with a username and password when connecting to the SMTP server. You can do this using one of the following approaches:
1.Provide an Authenticator object when creating your mail Session and provide the username and password information during the Authenticator callback.
Note that the mail.smtp.user property can be set to provide a default username for the callback, but the password will still need to be supplied explicitly.
This approach allows you to use the static Transport send method to send messages.
2.Call the Transport connect method explicitly with username and password arguments.
This approach requires you to explicitly manage a Transport object and use the Transport sendMessage method to send the message. The transport.java demo program demonstrates how to manage a Transport object. The following is roughly equivalent to the static Transport send method, but supplies the needed username and password:
Using the Transport.connect makes the JNDI not very helpfull for configuration.
It seems that using just the mail.smtp.user and mail.smtp.pass is not sufficient for the authentication.
so, the solution is :
just place these to lines in the JNDI configuration:
          username="test"
          password="test1"
so it should looks as follows:
          <Resource name="mail/Session" auth="Container"
          type="javax.mail.Session"
          username="test"
          password="test1"
          mail.transport.protocol="smtp"
          mail.smtp.auth="true"
          mail.smtp.host="localhost"
          mail.smtp.port="25"
          mail.smtp.user="test"
          mail.smtp.password="test1"
/>
where test and test1 are the user's credentials
Regards,
Kiril
Message was edited by:
Kireto
Message was edited by:
Kireto

SMTP-auth via mailx results in service unavailable

Why do my attempts to use mailx with Gandi SMTP fail with 'Service unavailable'?
I have the following ~/.mailrc file which is recognised by mailx:
set smtp=smtps://mail.gandi.net:465
set smtp-auth=login
set smtp-auth-user=harry@XXXXXXX
set smtp-auth-password=XXXXXXX
set from=harry@XXXXXXX
set ssl-verify=ignore
set nss-config-dir=/Users/neville/Thunderbird
The result is below.
From MAILER-DAEMON Thu Dec 20 15:41:47 2012
Return-Path: <>
X-Original-To: [email protected]
Delivered-To: [email protected]
Received: by G4-N-2.local (Postfix)
          id D4E2DA382D6; Thu, 20 Dec 2012 15:41:47 +0000 (GMT)
Date: Thu, 20 Dec 2012 15:41:47 +0000 (GMT)
From: [email protected] (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: [email protected]
Auto-Submitted: auto-replied
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
          boundary="78E73A382D4.1356018107/G4-N-2.local"
Message-Id: <[email protected]>
This is a MIME-encapsulated message.
--78E73A382D4.1356018107/G4-N-2.local
Content-Description: Notification
Content-Type: text/plain; charset=us-ascii
This is the mail system at host G4-N-2.local.
I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.
For further assistance, please send mail to postmaster.
If you do so, please include this problem report. You can
delete your own text from the attached returned message.
                   The mail system
<neville@XXXXXXX>: host spool.mail.gandi.net[217.70.184.6] said: 554 5.7.1
    Service unavailable; Client host [XXXXXXX] blocked using
    pbl.spamhaus.org; http://www.spamhaus.org/query/bl?ip=XXXXXXX (in
    reply to RCPT TO command)
--78E73A382D4.1356018107/G4-N-2.local
Content-Description: Delivery report
Content-Type: message/delivery-status
Reporting-MTA: dns; G4-N-2.local
X-Postfix-Queue-ID: 78E73A382D4
X-Postfix-Sender: rfc822; [email protected]
Arrival-Date: Thu, 20 Dec 2012 15:41:47 +0000 (GMT)
Final-Recipient: rfc822; neville@XXXXXXX
Action: failed
Status: 5.7.1
Remote-MTA: dns; spool.mail.gandi.net
Diagnostic-Code: smtp; 554 5.7.1 Service unavailable; Client host
    [XXXXXXX] blocked using pbl.spamhaus.org;
    http://www.spamhaus.org/query/bl?ip=XXXXXXX
--78E73A382D4.1356018107/G4-N-2.local
Content-Description: Undelivered Message
Content-Type: message/rfc822
Received: by G4-N-2.local (Postfix, from userid 501)
          id 78E73A382D4; Thu, 20 Dec 2012 15:41:47 +0000 (GMT)
To: neville@XXXXXXX
Subject: test
Message-Id: <[email protected]>
Date: Thu, 20 Dec 2012 15:41:47 +0000 (GMT)
From: [email protected] (Neville Hillyer)
test email
--78E73A382D4.1356018107/G4-N-2.local--

http://www.spamhaus.org says:
Mail servers only run spam filters such as Spamhaus PBL on port 25, so if you find you are being blocked by the PBL when you try to send mail to your mail server that means you are not communicating with the mail server on the 'authenticated' port 587 but you're still on port 25. This means your 'SMTP Authentication' is not working correctly.
http://wiki.gandi.net/en/mail/standard-settings#smtp-account says:
SMTP Account
Name server : mail.gandi.net
Port : 25, 465 (with SSL) or 587 (try one or the other)
TLS or SSL: yes
SMTP Authentication : yes, using the same settings as for the POP / IMAP account
I was trying to use the same settings I have used for several years with Thunderbird and Apple Mail, ie SSL on port 465.
Is there something wrong with my settings which could be preventing mailx from using port 465?
A few debug tips would be appreciated.
Your link causes me to ask: Does the mailx on Leopard support SMTP directly?

Server to server smtp auth

Hello,
I have a Messaging 6.x (JES 2005Q4 version) installation. All outbound email must go
through an external MTA so I added a smartrelay (daemon in tcp_local channel) and all works ok but the external MTA requires authentication so the question is:
how can I configure to send SMTP AUTH to the smartrelay?
I get the following when sending mail:
27-Jan-2006 18:42:00.44 tcp_local R 1 [email protected] rfc822;[email protected] [email protected] dns;outbound.relay.com (outbound.relay.com ESMTP Exim 4.51 Fri, 27 Jan 2006 19:41:57 -0500) smtp;550 You must authenticate to use this relay
I have set this up in a postfix installation and all works ok.
Thanks all in advance.

Hello,
I have a Messaging 6.x (JES 2005Q4 version)
installation. All outbound email must go
through an external MTA so I added a smartrelay
(daemon in tcp_local channel) and all works ok but
the external MTA requires authentication so the
question is:
how can I configure to send SMTP AUTH to the
smartrelay?Far as I know, you can't.
>
I get the following when sending mail:
27-Jan-2006 18:42:00.44 tcp_local R 1
[email protected] rfc822;[email protected]
[email protected] dns;outbound.relay.com
(outbound.relay.com ESMTP Exim 4.51 Fri, 27 Jan 2006
19:41:57 -0500) smtp;550 You must authenticate to use
this relay
I have set this up in a postfix installation and all
works ok.
Thanks all in advance.

Smtp auth - relay

Hi!
We are running GWIA novell-groupwise-gwia-12.0.1-103731.
Relaying is denied in the GWIA-settings.
We tested the GWIA behavior.
If we do an SMTP-Auth against the GWIA and the authentication is
successful, relaying is allowed.
In the GWIA "Access-Control Settings" -> "Default Class of service"
there is "Prevent outgoing messages" defined in the "SMTP Outgoing" section.
It seems, that it has no effect, what is defined in the Access Control
Settings; Gwia will always allow relaying, if the user is authenticated
against the GWIA.
Does this work as designed, or do we have a chance that we will allow
only specified users to relay, if they are authenticated?
thanks in advance
Wolfgang

On 06.11.2012 11:12, wpolster wrote:
> Hi!
>
> We are running GWIA novell-groupwise-gwia-12.0.1-103731.
> Relaying is denied in the GWIA-settings.
>
> We tested the GWIA behavior.
> If we do an SMTP-Auth against the GWIA and the authentication is
> successful, relaying is allowed.
> In the GWIA "Access-Control Settings" -> "Default Class of service"
> there is "Prevent outgoing messages" defined in the "SMTP Outgoing"
> section.
That's a bad idea, and should result in nobody using groupwise
internally being able to send email out. You can't remove restrictions
in the default class of service with more specific classes.
> It seems, that it has no effect, what is defined in the Access Control
> Settings; Gwia will always allow relaying, if the user is authenticated
> against the GWIA.
Correct. The class of service restrcitions only apply to *internal*
users, e.g everything that come from or goes to groupwise. relaying
happens totally on the SMTP side of GWIA only, and there's no restrictions.
> Does this work as designed, or do we have a chance that we will allow
> only specified users to relay, if they are authenticated?
Unfortunately not.
CU,
Massimo Rosen
Novell Knowledge Partner
No emails please!
http://www.cfc-it.de

External SMTP Auth

Hi folks.
My iPod is not happy. She (he?) can't send mail from outside. I have an IMAP account that I use on my LAN server for my domains. When I go out, I can't send mail.
Now, port 465 is apparently used for SSL SMTP, but that isn't open on the server. My router has SMTP Mail open.
What I want to do, I forget the name of. I think it's SMTP Auth, and using a port above what routers would normally close off. So I'd like to use port 3500 or something like that. How do I do that, while using Kerberos or MD5 for sending mail from outside?
Cheers

I'd confirm that your ISP is (or is not) blocking inbound port 25; if the server here is connected into the ISP via a residential-grade service tier, then port 25 and port 80 blocks in-bound are fairly common. That is, confirm whether the connectivity problems here are between the ISP and the server, or at the pub.
As for your own network perimeter, most consumer-grade routers are pretty weak, while those router-firewalls with VPN and port-forwarding aren't that much more expensive. And there are open-source firewalls around. And using a VPN into the firewall is a pretty good solution for many reasons.
Various organizations that offer wireless do block port 25 outbound and sometimes other specific outbound ports to reduce the spread of malware, or the network loading that can result from torrents. Few organizations block outbound VPNs or webmail (port 80 or port 443) connections.

SMTP auth error, but Cyrus OK

We're using WGM for email setup and admin. We have around 1,000 users, 700 of which are on our network and don't use SMTP auth, and 300 who are off our network and do use SMTP auth. All is well, except for one account. This account was set up to forward mail, and several months later they asked us to make it a login account. They can log in and get mail, but when they try to send, SMTP authentication fails. The line in the SMTP log is:
Aug 30 10:39:43 mailx postfix/smtpd[5919]: warning: AOD: Authentication failed for user user@domain. (Open Directroy error: -14090)
I've tried all the usual stuff (re-entering the password in Mail.app, etc), and went so far as to delete and re-create the account in WGM, but it still fails in the same way. Any ideas as to how to fix this, or how to further troubleshoot it? Thanks.

Which Auth types do you have enabled in Server
Admin?
SMTP: CRAM-MD5 + Login
IMAP & POP: everything but Kerberos
If you could, please paste unmodified output of
"postconf -n".
mailx:~ admin$ postconf -n
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
debugpeerlevel = 2
enableserveroptions = yes
html_directory = no
inet_interfaces = all
mail_owner = postfix
mailboxsizelimit = 0
mailbox_transport = cyrus
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
messagesizelimit = 26214400
mydestination = $myhostname,localhost.$mydomain,localhost,opendoor.com
mydomain = opendoor.com
mydomain_fallback = localhost
myhostname = mailx.opendoor.com
mynetworks = 127.0.0.1/32,66.241.64.0/19,207.55.236.0/22
mynetworks_style = host
newaliases_path = /usr/bin/newaliases
ownerrequestspecial = no
queue_directory = /private/var/spool/postfix
readme_directory = /usr/share/doc/postfix
recipient_delimiter = +
sample_directory = /usr/share/doc/postfix/examples
sendmail_path = /usr/sbin/sendmail
setgid_group = postdrop
smtpdclientrestrictions = hash:/etc/postfix/smtpdreject
smtpdpw_server_securityoptions = login,cram-md5
smtpdrecipientrestrictions = permitsasl_authenticated,permit_mynetworks,reject_unauthdestination,permit
smtpdsasl_authenable = yes
smtpdtls_keyfile =
smtpduse_pwserver = yes
unknownlocal_recipient_rejectcode = 550
virtualmailboxdomains = hash:/etc/postfix/virtual_domains
virtual_transport = lmtp:unix:/etc/mail/db/socket/lmtp
mailx:~ admin$

Mail 2.0 + SMTP auth + qmail

On our SMTP servers (running qmail), we're currently not requiring SMTP auth, but it does work with other clients...just not with Apple Mail.
If you connect to our SMTP server from another provider's network, there's a notification which tells the client that SMTP auth is required, so it works from another network.
On our own network, however, SMTP auth is not required, so Mail never receives the notification of SMTP auth being possible, so it just times out when trying to authenticate.
This is all on port 25, no SSL/TLS/etc., and all UNs/PWs are in cleartext.
We're going to be requiring SMTP auth in the near future, so I need to figure this out for our Mac users (and myself).
My feeling is that once we require SMTP auth, that notification will go to the client, and it will work, but I'm not sure, and I'm unable to get our admins to give me a test server to play with/test things out.
Any ideas/thoughts?
Thanks in advance...

Hello,
Mail, in all versions, has always timed out whenever a separate, "hard" authentication is not required, but attempted anyway. The difference has always appeared to me to relate to the fact that Mail will perform SMTP after POP3 authentication, WITHOUT having any authentication specified in the outgoing server settings. When the separate authentication is required, it should work fine.
The difference may be that other mail clients stop their authentication actions when connection is successful, without it, but Mail proceeds to do what it is told to do -- if Password authentication is selected, ask no questions, just do it.
In the Mail Setup Assistant now used in Mail 2.0, it is possible to select that the Outgoing Server requires authentication, but then NOT fill in the Password and Username if not needed. As far as I can tell, this does not seem different from specifying None in previous versions.
Ernie

SMTP Auth For Subset of Users

I think this is not possible but thought I should ask just in case...
Any ideas how to configure things to only allow a couple of users to smtp authenticate from WAN side of firewall?
I'm thinking of a different port number from 25, tied into some sort of lookup table...? (you can probably tell I'm scrabbling about here
-david

Thanks Jeff,
This is purely to get around a lack of secure passwords for LAN users (there are no passwords). At the moment there is no SMTP auth, only relay by LAN IP, and the firewall is closed except for SMTP & VPN. Problem is that the 2 bosses now want to send/receive email from WAN using their fancy mobile phones. However, they are not keen on now introducing secure passwords office wide so I was looking around for other possibilities before informing them that there was really no choice if they wanted to enable SMTP auth and open firewall for pop/imap (due to risk of dictionary hack).
oh, and yes, it's pop/imap too
(I have not looked at how these phones work exactly with pop/imap so not sure yet which protocol is preferred).
The VPN is using the OSX Server and does get used for email from home computer. Actually, I must check to see if the phone thingy can do VPN...
Appreciate any thoughts. I actually would like to tell them to introduce secure passwords throughout but just wanted to ensure I wasn't giving them wrong info on possible alternatives.
-david

SpamAssassin vs. SMTP-AUTH...thoughts?

Well, sorry to keep rapid-firing the questions here lately, but I've got another item to discuss.
Recently, I had SpamAssassin 3.3.0 +on my own server+ tagging my outgoing messages as "SPAMMY", due to the fact that I was sending from my girlfriend's house, which is on a Comcast IP that is in a PBL. I've configured Server Admin to allow traffic from that IP address, because using zen.spamhaus.org, it would normally refuse the connection. But even though I SMTP-AUTH and all that, SpamAssassin still gives me 3+ points for being in a PBL, which puts me into "SPAMMY" territory.
So, that begs the question: is there a way to prevent this? I tried implementing the solution detailed at the end of this thread:
https://www.virtualmin.com/node/8868
...but it only gets me that header on incoming messages, NOT outgoing. Furthermore, it "feels" like a pretty rough hack, and I'm wondering if there isn't a better way, so...
A more general question: Do you want amavis & SA running on outgoing messages that are being sent via an authenticated user? What's the conventional wisdom here?
Thx for your thoughts,
FT

pterobyte wrote:
This will make sure that authenticated users of yours bypass the content filter, while everybody else still gets scanned. Of course you will need to (and should) point your mail clients to port 587 for sending and must authenticate.
Hey Alex--
Thanks as usual for just the info I need! One thing I notice here, tho: sending from one of the 2 domains I'm hosting (one is a "proper" domain, one is DynDNS)-- the DynDNS one-- does not bypass the filter, while using mydomain.net does. Here's what the log shows:
DynDNS entry
Mar 17 01:58:59 myserver postfix/smtpd[59633]: 4797817968D: client=unknown{192.168.0.140}, sasl_method=PLAIN, sasl_username=fredo
Mar 17 01:58:59 myserver postfix/cleanup[59644]: 4797817968D: message-id=<[email protected]>
Mar 17 01:58:59 myserver postfix/qmgr[59576]: 4797817968D: from=<[email protected]>, size=605, nrcpt=1 (queue active)
Mar 17 01:58:59 myserver amavis[56541]: (56541-10) loaded policy bank "MYNETS"
...and from there starts to process w/ Amavis/SA.
"Proper" domain
Mar 17 02:00:50 myserver postfix/smtpd[59663]: 19EAA1796A8: client=unknown{192.168.0.140}, sasl_method=PLAIN, sasl_username=fred
Mar 17 02:00:50 myserver postfix/cleanup[59668]: 19EAA1796A8: message-id=<[email protected]>
Mar 17 02:00:50 myserver postfix/qmgr[59576]: 19EAA1796A8: from=<[email protected]>, size=584, nrcpt=1 (queue active)
Mar 17 02:00:50 myserver postfix/smtp[59669]: 19EAA1796A8: to=<[email protected]>, relay=xxx.xxx.xxx.xxx{xxx.xxx.xxx.xxx}:25, delay=0.37, delays=0.05/0.04/0.1/0.18, dsn=2.0.0, status=sent (250 2.0.0 o2H70npH1451216 Message accepted for delivery)
...and all goes according to plan, skipping the Amavis/SA processing.
Could this be due to settings w/in Postfix or Amavis specifying what "my domain" is? Or is it related to user authentication due to having more than one domain?
Also, if I have configured port 2525 for sending (to get around port 25 blocking), can I include it in this filtering omission? I have the following lines in master.cf:
smtp inet n - n - - smtpd
2525 inet n - n - - smtpd
submission inet n - n - - smtpd
-o content_filter=
-o smtpdrecipient_restrictions=permit_saslauthenticated,reject
Thanks!
Fred

Problem in setting the smtp in a apple mail account.

Can anyone help me resolve a problem in setting the mail preferrences? I have multiple email accounts and the smtp address is being deleted to a none smtp in an account then when I fix the problem in one account it deletes an smtp address in another email account. When I fix that account it deletd another smtp address and so on an so forth. Is this a virus or is there a fix for this problem?

Mail in IOS iPhone or OS X?
Anyway You select each account and assign or create new smtp.

Exchange 2003 - When I create a send connector do I need to restart the SMTP service?

When I create or update a send connector on Exchange 2003 do I need to restart the SMTP service and/or MS Exchange Routing Engine?

Hi Chad,
Collect some information for your reference:
You must restart the Microsoft Exchange Routing Engine service and the SMTP service for these changes to take effect.
More details in the following KB:
How to configure the SMTP connector in Exchange 200x
http://support.microsoft.com/kb/265293
Thanks
Mavis
Mavis Huang
TechNet Community Support

Smtp auth. fails for Mac mail but ok for netscpae mail ???

Hello all,
I am having some persistent problems with SMTP authentication to send mail from my Mac via my ISP onto the internet.
What DOES work:
1. sending and receiving mail from my current ISP account using Netscape mail.
2. receiving mail from my ISP account using Mac mail
What DOES NOT work:
3. sending mail via my ISP using Mac Mail. The error message is that the SMTP authentication failed.
Yes, I checked the mail port (25) and the smtp address (in plain text ascii)
Has anyone had a similar problem, where Mac mail failes, but another mail tool succeeds? Has anyone succeeded at getting it to work for Mac mail?
Thanks,
Ary
Powerbook G4 Mac OS X (10.3.9)

If your ISP requires POP before SMTP authentication which requires checking the account's incoming mail server for new mail before being able to send with the account's SMTP server (checking the account for new mail should be required once per session only), then authentication for the SMTP server should be set to None.
Go to Mail > Preferences > Accounts and under the account information tab for the account preferences at the SMTP server selection, select the Server Setting button below.
If Password is selected for SMTP authentication, change it to None and test if this resolves the problem.
If None is selected and your ISP requires password authentication for their SMTP server, select Password and enter the account's user name and password required for the authentication.

SMTP AUTH and the SMTP MMP.

Similar Messages

Maybe you are looking for