Smtp auth without hat access defined

Hello community!!!
We are configuring an appliance and came across a doubt that we would like to share to see if anyone can help us.
We first configured the appliance by setting up a RELAY policy wich included the networks that were allowed to send mail through our IronPort. Before we applied that configuration, there was no way of sending mail, perhaps there are other more efficient ways but we fail to see another one.
After this path was OK, we then configured the IronPort to use SMTP auth in a forwarding fashion to verify that clients we know are the only ones allowed to send mail. To do this we authenticate against our internal SMTP server, which contains the mailboxes of our users.
This configuration tested OK, without issues at all.
Now that we have this architecture working we would like to allow multiple IPs, not just the ones we defined to use our IronPort to send mail. In our scenario, we provide email services to serveral cilents that have dynamic IP. So we cannot guaranty that a given time, they will be able to send mails through our IronPort if their IP falls out of the range we defined.
So, within HAT policies, is there a way to allow "anyone" or "any IP" to access the IronPort to send mail? The security will be enforced though our SMTP auth policy which only allows authorized personnel to send mail.
Thank you in advanced for your thoughts and comments!!!
Best regards!!!
Miguel

Yes, you can do this where the connecting external IP or sender is not known in advance.
You would probably need to LDAP with either SMTP Auth enabled or External Authentication Queries enabled.
So as to not *bog* down your HAT Overview with smtp auth attempts, I think it would be helpful to find a range where the incoming connection would be, then try to assign it to a SMTP Authentication Sender Group and corresponding Mail Flow Policy where the SMTP was turned on.
I can see that this type of scenario would come into play in situations where you have traveling salespeople and you're not always sure what IP they're coming from, but they still need to relay via the IronPort. It's best to collect as much of the information about these external relayers as possible and the LDAP system, then contact Customer Support, presenting the information/facts that you have and how best to configure the IronPort HAT/LDAP/MAIL FLOW Policy section to get that working.
Good luck,
Kevin

Similar Messages

Hat access: permit access to anyone, restrict using stmp auth

Hello,
We have a question regarding who can send mail through the appliance. Is there a way to allow anyone to send mail through the appliance (not defining a specific network or IP in the Relay mail flow policy)? After this is done we would only allow users to send mail who succesfully authenticate in our smtp server by employing SMTP auth profile.
Thank you for your thoughts!!
Best Regards,
Miguel

Thank you Andrew,
We have already configured SMTP auth with forwarding profile and tested it OK. We first had a HAT policy, a Relay one that only allowed certain networks (our corporate networks) to send mail through the IronPort and this policy worked fine until our scenarios changed. On the other hand, we provide email services to several custumers that get their IP in a dynamic way so it is very difficult to know wich IP they will be getting any given day. Because of this scenario, when upgrading our email infrastructure to employ IronPort we thoght of only allowing our users to send mail previosly by checking their identity, thus allowing us to accept multiple ranges of dynamic IPs.
Another item regarding our design is that VIP users within our organization like to access their mail from home (through their MUAs configured not through a webmail-kind-of-service). This also gave us an inconvenience of allowing only our corporate network to be able to send mail through the appliance.
Again thank you for your comments,
Best regards
Miguel

Smtp auth access problems

All, I've got everything working and authenticating properly (i.e. pop/imap/http) except smtp auth.
I keep getting the following error after a valid transaction:
220 hoth -- Server ESMTP (iPlanet Messaging Server 5.2 (built Feb 21 2002)).
EHLO xxx.xxx.xxx.
250-hoth.
250-8BITMIME.
250-PIPELINING.
250-DSN.
250-XDFLG.
250-ENHANCEDSTATUSCODES.
250-EXPN.
250-HELP.
250-SAML.
250-SEND.
250-SOML.
250-TURN.
250-XADR.
250-XSTA.
250-XCIR.
250-XGEN.
250-XLOOP 18C258074D1B9D38536174313EC7E040.
250-AUTH LOGIN PLAIN.
250-AUTH=LOGIN.
250-ETRN.
250-RELAY.
250 SIZE 0.
AUTH PLAIN AG1tY211cnIAZnIwZ2wzZ3M=.
535 5.7.8 Authorization failure (Not authorized to login as specified user)..
Does anyone have any idea why or where authorization is set on a per user basis, or is there maybe a config key to allow all users from a specific domain?
Thanks in advance for your help.
--Mike

You never told us how you get it to work.
I am having the same authentication problem and am pulling my hair out. Could you explain how you figured it out?
Thanks

DIsable smtp auth only for an ip

Dear gurus,
I have sun messaging server 6 running perfectly alright and only new thing which I would like to incorporate is to disable smtp auth only for one ip address.I am new to this system and have gathered following information from sun messaging docs, the steps which I followed..
1) Create a table DISABLE_SMTPAUTH_IP similar to INTERNAL_IP mapping table in mapping file
INTERNAL_IP
10.18.18.19 $Y
10.18.18.38 $Y
10.18.18.30 $Y
127.0.0.1 $Y
* $N
! Added on 01092008 for disabling smtp_auth
DISABLE_SMTPAUTH_IP
external.ip.addres $Y
*$N
2) ALLOW PORT ACCESS
*PORT_ACCESS
*|*|*|*|* $C$|DISABLE_SMTPAUTH_IP;$3|$Y$E
*|*|*|*|* $C$|INTERNAL_IP;$3|$Y$E
3) Then right after the current rewrite rule in imta.cnf file Created new TCP CHANNEL
! Do mapping lookup for internal IP addresses
[] $E$R${INTERNAL_IP,$L}$U%[$L]@tcp_intranet-daemon
added a new rewrite rule:
! Do mapping lookup for "no smtp auth", non-internal IP addresses
[] $E$R${DISABLE_SMTPAUTH_IP,$L}$U%[$L]@tcp_nosmtpauth-daemon
! ttcp_nosmtpauth-daemon
tcp_nosmtpauth-daemon smtp mx single_sys subdirs 20 maxjobs 7 pool SMTP_POOL nosasl nosaslserver
tcp_nosmtpauth-daemon
! tcp_local
tcp_local smtp mx single_sys remotehost inner switchchannel subdirs 20 maxjobs 30 pool SMTP_POOL maytlsserver maysaslserver s
aslswitchchannel tcp_auth loopcheck threaddepth 32 blocklimit 5120 notices 1 2 backoff "pt5m" "pt1h" "pt2h" "pt4h" destinati
onspamfilter1optin spam
tcp-daemon mumbbmr1.dataone.in
! tcp_intranet
!tcp_intranet smtp mx single_sys subdirs 20 dequeue_removeroute maxjobs 7 pool SMTP_POOL maytlsserver allowswitchchannel sasl
switchchannel tcp_auth blocklimit 2500
!tcp_intranet smtp mx single_sys subdirs 20 dequeue_removeroute maxjobs 7 pool SMTP_POOL maytlsserver allowswitchchannel sasl
switchchannel
!tcp_intranet-daemon
run /opt/SUNWmsgr/sbin/imsimta refresh
alternatively tried imsimta cnbuild and imsimta restart
but still i get Mail rely denied when I try sending messages from the same trusted IP without doing AUTH.
I would like to know...
1) If there is something mising or wrong in above steps
2) HOw do i check if the messages from that IP(for which smtp auth is disabled) is passing from the tcp_nosmtpauth channel...
THanks for giving your valuable time...

thanks very much shane for giving time...
Please always provide the exact version of Messaging Server (./imsimta version).
mumxxxx1 # ./imsimta version
Sun Java(tm) System Messaging Server 6.2-6.01 (built Apr 3 2006)
libimta.so 6.2-6.01 (built 11:20:35, Apr 3 2006)
SunOS mumxxxx1-a-fixed 5.9 Generic_118558-28 sun4u sparc SUNW,Sun-Fire-V440
mumxxxx1#
Why would you want to disable SMTP Authentication? What are you attempting to achieve by doing this -- what is the problem you are trying to solve?
We are an ISP and therefore sometimes required to send bulk mail, for which we are currently using perl bulk mail module script and there we specify the users in text file to send message, everytime this module try sending it get Mail Relaying denied as it doesnot supply user and passwd required for smtp auth in base64.
Therefore I wanted to disable smtp auth for an ip address using which smtp auth is not reqauired and mails should be openly relayed.
Why are all of the above entries commented out? Did you intend to disable (break) the tcp_intranet channel?
no it is not commented in config files.
+./imsimta refresh is no longer a valid comment, you need to use ./imsimta cnbuild;./imsimta restart+
as per sun mesaging server 6 admin guide it is given to be working. Alterntively I tried ./imsimta cnbuild;./imsimta restart.
Please provide the mail.log_current line that matches the attempted email delivery which was rejected.
mumxxxx /opt/SUNWmsgsr/sbin # tail -f /mta/logs/imta/mail.log_current
08-Sep-2008 13:42:19.52 7079.0fca.710096 tcp_local J 0 [email protected] rfc822; [email protected] mailserv 530 5.7.1 Relaying not allowed: [email protected] SMTP
bash-3.00# telnet mumxxxx 25 Trying 10.18.18.19...
Connected to ::ffff:10.18.18.19.
Escape character is '^]'.
220 mumxxxx.datxxxx.in -- Server ESMTP (*)
ehlo mumxxxx.daxxxx.in
250-mumxxxx.daxxxxx.in
250-8BITMIME
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-HELP
250-XLOOP 82F58AB6E3453199924062C516F2E337
250-AUTH PLAIN LOGIN
250-AUTH=LOGIN
250-ETRN
250-NO-SOLICITING
250 SIZE 0
mail from: [email protected]
250 2.5.0 Address Ok.
rcpt to: [email protected]
530 5.7.1 Relaying not allowed: [email protected]
rcpt to: [email protected]
Also please clarify if you want to disable the ability to perform SMTP auth or whether you want to allow email to be sent without requiring SMTP auth -- these are two completely different objectives.
No I do not want to disable SMTP auth for everyone.DEfault is it should be forced to all except from one ip. ie disable smtp auth only for an ip address.
Regards
Pradeep

Smtp auth - relay

Hi!
We are running GWIA novell-groupwise-gwia-12.0.1-103731.
Relaying is denied in the GWIA-settings.
We tested the GWIA behavior.
If we do an SMTP-Auth against the GWIA and the authentication is
successful, relaying is allowed.
In the GWIA "Access-Control Settings" -> "Default Class of service"
there is "Prevent outgoing messages" defined in the "SMTP Outgoing" section.
It seems, that it has no effect, what is defined in the Access Control
Settings; Gwia will always allow relaying, if the user is authenticated
against the GWIA.
Does this work as designed, or do we have a chance that we will allow
only specified users to relay, if they are authenticated?
thanks in advance
Wolfgang

On 06.11.2012 11:12, wpolster wrote:
> Hi!
>
> We are running GWIA novell-groupwise-gwia-12.0.1-103731.
> Relaying is denied in the GWIA-settings.
>
> We tested the GWIA behavior.
> If we do an SMTP-Auth against the GWIA and the authentication is
> successful, relaying is allowed.
> In the GWIA "Access-Control Settings" -> "Default Class of service"
> there is "Prevent outgoing messages" defined in the "SMTP Outgoing"
> section.
That's a bad idea, and should result in nobody using groupwise
internally being able to send email out. You can't remove restrictions
in the default class of service with more specific classes.
> It seems, that it has no effect, what is defined in the Access Control
> Settings; Gwia will always allow relaying, if the user is authenticated
> against the GWIA.
Correct. The class of service restrcitions only apply to *internal*
users, e.g everything that come from or goes to groupwise. relaying
happens totally on the SMTP side of GWIA only, and there's no restrictions.
> Does this work as designed, or do we have a chance that we will allow
> only specified users to relay, if they are authenticated?
Unfortunately not.
CU,
Massimo Rosen
Novell Knowledge Partner
No emails please!
http://www.cfc-it.de

OS X's Mail app and SMTP auth

We're having a problem with OS X's Mail app connecting to Tiger Server's mail server. We have the server set up to not always require SMTP auth (all SMTP auth settings unchecked in Settings > Advanced > Security), and to allow relay from only a given set of networks (Settings > Relay). In theory, this means that if you're on one of the specified networks, you're not required to authenticate, otherwise you are. This according to Apple's documentation.
From a bit of packet sniffing, it looks like:
1. If a user on an allowed network tries to send mail through the server, the server does not return authorization as an option.
2. If the user has password authentication specified in Mail's SMTP Server settings, it refuses to send. If they set SMTP auth to None, the Mail app will send.
IOW, Mail doesn't send if Authorization is enabled in the Mail app, but not given as an option by the mail server. Has anyone else seen this? Is this a bug in Mail or Postfix?

If you have networks entered in
'Accept SMTP relay only from these hosts and
networks'
Clients on these networks don't need to authenticate
for local delivery or relay.
So it does what you are looking for.
Jeff
Well, goddarn it - so it does!
I was testing various permutation (10.3.4) just recently and it just wouldn't relay without auth if any of them was selected (honest!). That was with the trusted relay....
...but I just tried it again and it's fine!
I had put it down to just another 'glitch' in the documentation.
Oh well - glad you were there to point it out Jeff!
Whilst we are on the subject - do you know of any way to tie authentication (outwith trusted network) to specified users? I was thinking there might be a Postfix parameter for this (sorry, I should just look them all up but maybe someone knows it already)?
Thank, and sorry for any earlier confusion!
-david.

Pop before smtp and smtp auth

Hi Jay,
hope all is well with you.
what is pop before smtp and how to see if it is enabled?
what is smtp auth and how to see if it is enabled? Is it enabled by default on MS 6.x?
what happens if smtp auth is not enabled? Will my mail server be a relay?
Is there any additional configuration that should be done on messaging server to allow connection for dial-up users?
thanks,

Hi Jay,
hope all is well with you.
what is pop before smtp and how to see if it is
enabled?Pop before SMTP is a very old, and little used method for "authenticating" users. There is virtually no reason to turn this on, anymore.
It's done through the MMP, and is the only reason to actually use the SMTP proxy that's part of MMP.
I would not go there unless your environment requires it. Most do not. Most clients support SMTP authentication, which is much better, and is on by default.
>
what is smtp auth and how to see if it is enabled? Is
it enabled by default on MS 6.x?See above. Yes, smtp authentication is on by default.
>
what happens if smtp auth is not enabled? Will my
mail server be a relay?Totally different issue.
No.
If smtp auth is off, if you have external users, they likely will not be allowed to send to other external users..
>
Is there any additional configuration that should be
done on messaging server to allow connection for
dial-up users?If "dial-up users" means that they come from ip addresses outside your network, then smtp auth will allow them full access.
thanks,

SMTP Auth & Maildir

I have two seperate questions...
I found this quote here:
http://docs.info.apple.com/article.html?artnum=106763
"Whenever Authenticated SMTP is enabled, your email server is effectively a "send only" server, because mail servers from other domains are most likely not configured to authenticate with your server. This means your local email clients can only receive email from other local clients. Authenticated SMTP also requires each user's email client software to authenticate before it sends mail through your server."
I know this documentation is very old (10.1.3), but I need to know if this still true in Server 10.4.7? I have a LOT of traveling sales people that need to use either mail.app or outlook, and they are not going to be happy if I tell them they have to use webmail. I was planning on switching to OS X Server, but I need to know about this first.
My second question is, what format does 10.4.7 server store its mail in? mbox? mdir? I have found conflicting answers online..
Thanks,
Brian
Macbook Mac OS X (10.4.7)

Actually, that excerpt does not make sense to me either.
When Authenticated SMTP is enabled, only clients with the correct username and password may relay mail through your server. Any other client or server will not be able to relay mail through your server. The only mail your server will accept without authentication is those that are meant for the local accounts on the server. SMTP-AUTH just prevents unauthorized relays but not delivery.
So your travelling reps should be able to use Mail.app to connect to your server and send mail to outside clients through your server. AND their clients should be able to send mail to your reps.

Mail 2.0 + SMTP auth + qmail

On our SMTP servers (running qmail), we're currently not requiring SMTP auth, but it does work with other clients...just not with Apple Mail.
If you connect to our SMTP server from another provider's network, there's a notification which tells the client that SMTP auth is required, so it works from another network.
On our own network, however, SMTP auth is not required, so Mail never receives the notification of SMTP auth being possible, so it just times out when trying to authenticate.
This is all on port 25, no SSL/TLS/etc., and all UNs/PWs are in cleartext.
We're going to be requiring SMTP auth in the near future, so I need to figure this out for our Mac users (and myself).
My feeling is that once we require SMTP auth, that notification will go to the client, and it will work, but I'm not sure, and I'm unable to get our admins to give me a test server to play with/test things out.
Any ideas/thoughts?
Thanks in advance...

Hello,
Mail, in all versions, has always timed out whenever a separate, "hard" authentication is not required, but attempted anyway. The difference has always appeared to me to relate to the fact that Mail will perform SMTP after POP3 authentication, WITHOUT having any authentication specified in the outgoing server settings. When the separate authentication is required, it should work fine.
The difference may be that other mail clients stop their authentication actions when connection is successful, without it, but Mail proceeds to do what it is told to do -- if Password authentication is selected, ask no questions, just do it.
In the Mail Setup Assistant now used in Mail 2.0, it is possible to select that the Outgoing Server requires authentication, but then NOT fill in the Password and Username if not needed. As far as I can tell, this does not seem different from specifying None in previous versions.
Ernie

Mail and SMTP auth (RFC 1918 error) ?

I've an iMac and a Macbook (both with Mac OS X 10.5.3). Both connected to Internet using Airport via my WiFi router (with NAT activated on this router). This behavior is working fine since almost 2 years.
I was using (and I'm still using) Thunderbird (last version) to read and send my emails on the iMac, and Mac OS X Mail on the Macbook.
Everything was fine until yesterday. My provider has change is SMTP server so that authentification is now required when sending message.
So I've activated SMTP auth in Thunderbird and all is fine. And do the same under Mail (with password option). But it doesn't work with Mail, I've got a SMTP connexion error.
When I choose the diagnostic button, I find that SMTP connexion (EHLO) is fine, then saying my IP address (192.168.x.x) is private according to RFC 1918 and ending the connexion (QUIT).
I have the same error on my iMac, though it just work fine with Thunderbird.
So it seems to me Mail can't connect because of this behavior. But I don't understand why my IP address in Mail dialog with my provider SMTP server is not NATed by my router, like all other IP traffic.
And I don't know what to do to correct this problem.

Well, as SMTP authentification is only required to forward mail to another domain, I try to send an mail to my wife who is on the same domain as myself. It work fine with authentification disabled using Thunderbird but don't work with Mail.
As it use to work fine until I change the configuration, I try to delete my account informations and create a new one as it was 2 days ago (without SMTP auth) but it still doesn't work even if I've got no problem with Thunderbird.
Anyone as an idea about all this mess ? My only clue is the Mail connection diag which show connect, helo (with my private IP), server response 550 RFC 1918 and quit. Even if I found this behavior very strange, the result of the diag is the same with or without SMTP auth actived. So I suppose it was already the same before when it was working fine...

Trouble sending SMTP AUTH

I am having difficulty sending mail to an smtp server that requires authentication.
The mail messages are valid so I snipped only the connection code:
        boolean DEBUG = true;
        Properties p = new Properties();
        p.put("mail.smtp.host", "mail._myhost.com");
        javax.mail.Session s = javax.mail.Session.getDefaultInstance(p, null);
        s.setPasswordAuthentication(
                new URLName("mail._myhost.com"),
                new PasswordAuthentication("_myuser","_mypass")
        s.setDebug(DEBUG);
myhost, myuser, and _mypass are all valid.
The smtp server is James 2.1.2 from apache/jakarta and this option works without authentication on a test mail server. There is no option is changing authentication on the intended server (obviously).
The exception I get is:
javax.mail.SendFailedException: Sending failed; nested exception is: javax.mail.SendFailedException: Invalid Addresses; nested exception is:
javax.mail.SendFailedException: 530 Authentication Required
I would appreciate any help anyone may give me in correcting my code or pointing to where I may start looking for an answer.
Thank you in advance for your help if you have any experience that may aid me in finding a solution.
MB

Bump.
I can confirm AUTH working with perl libraries.
Is javamail as buggy as some are claiming? I have not had problems up to this point and I am stumped with smtp AUTH.
Thanks for your help.

HT201304 It would be tremendously helpful to be able to access, set restrictions, and make changes from the parents device to all devices under the same iTunes account, so that I could make changes to my kids devices without physical access.

Please help!
It would be tremendously helpful to be able to access, set restrictions, and make changes from the parents device, to all devices under the same iTunes account, so that I could make changes to my kids devices without physical access.
I understand that I can set up a different Apple ID for the kids devices, or take physical control of the device and make the changes myself. However, my teenage son is technically savvy enough to have a job in Silicon Valley, as are most young people these days. However, in order to access his devices the current way, I first have to bypass the four digit pass code. This starts a fight of why I need in the device and continues to escalate. The argument that I am the parent will gain access but the fight is simply exhausting, and quite frankly shouldn't have to happen at all. He is not yet an adult, he did not pay for his iPad or iPhone and I, as a parent, should have not only have the right to change options at will, and from anywhere, but look at history or current activity when I feel like it.
I currently have the settings where app and in-app purchases require my password to be put in, and he must come to me to type it in, but I need more control and would like, and should be able to access any of our six devices and make individual changes simply by logging in to my account, with my password.
If I can see all my devices on the "Lost My iPhone" app, this technology should be easy to make happen.
C'mon parents! I have a pretty good kid, given all things that they can get into, but I am not stupid. For everything I see has been done, there is much more I haven't seen. I want my children to be kept safe and be able to know what they are looking at or listening to. We parents are the only ones who know our beliefs and what our kids can handle and when.
Thanks for any support or information that I may be missing in order to fulfill my request.

There are mobile device management solutions that can do this, including in Apple's OS X Server system, but most parents generally find that setting this up is more work than it's worth. If you're interested, though, there are a couple that at least purport to be free (I don't know if there are any hidden "gotchas"):
http://www.unwireddevicelink.com/features/
https://meraki.cisco.com/products/systems-manager
and Apple's system:
http://www.apple.com/osx/server/features/#profile-manager
I don't think any, however, allow you to see current activity or browser history. iOS doesn't expose those to access from MDM solutions, to the best of my knowledge.
Regards.

Need to run fmsedge process without root access

1937396
On Linux, the fmsedge process needed to run without root access.

I see that in the release notes
new in this release:
1937396
On Linux, the fmsedge process needed to run without root access.
However I have not found any documentaion on how to do this?
I would love to run the fmsedge process run as non-root so tht root does not own the 1935 listening port.
fmsedge   26837 root   19u IPv4 4007676       TCP localhost:19350 (LISTEN)
fmsedge   26837 root   24u IPv4 4007679       TCP *:1935 (LISTEN)
fmsedge   26837 root   35u IPv4 4007717       TCP localhost:19350->localhost:59625 (ESTABLISHED)
fmsedge   26837 root   57u IPv4 26532589       TCP localhost:19350->localhost:58913 (ESTABLISHED)
This appear to not be the default setup.
Thanks in advance if anyone has tackled this!

Is there a way to "deauthorise" computers from your apple ID without having access to those computers?

Is there a way to "deauthorise" computers from your apple ID without having access to those computers?

Hi there ellou86!
I have an article here for you that can help you with this question:
iTunes Store: About authorization and deauthorization
http://support.apple.com/kb/HT1420
Specifically, it seems that this is the portion of the article that is most relevant to your question:
To deauthorize all computers associated with your Apple ID
If you need to authorize your new computer and are unable due to already having five authorized computers, you can deauthorize all computers by doing the following:
Click iTunes Store on the left side of iTunes.
If you're not signed in to the store, click the Account button, then enter your account name and password.
Click the Account button again (your Apple ID appears on the button), enter your password, and then click View Account.
In the Account Information window, click Deauthorize All.
Note: You may only use this feature once per year. The Deauthorize All button will not appear if you have fewer than two authorized computers. If you need assistance on using this feature, please contact iTunes Store support via email (http://www.apple.com/support/itunes/store/).
Thanks for using the Apple Support Communities!
Cheers,
Braden

HT4527 how can i transfer my purchases from one windows pc to another without having access to the pc with the music on as it is broken

how do i transfer my purchases from one windows pc to another without having access to the pc with the music on it , as it is broken ?

on new pc - open itunes. sign into your account. go to settings. authorise the pc you are now using. go to account in itunes store. download purchases. simples.

Smtp auth without hat access defined

Similar Messages

Maybe you are looking for