Re5: Solved: Help: my PO is open relay

["Glenn A. Bookout" <gblists@xxxxxxxxxxxxxxxxxxx>]

Anita:

   Thanks for your reply.

On Tuesday, Dec 9, 2003, at 17:44 US/Pacific, Anita Holmgren wrote:

> >    I have a number of clients that have to use POP-before-SMTP ( 
> > mainly due to the P.O restrictions on SMTP-Authentication needing a 
> > match between ID and address, which is not very workable when 
> > hosting multiple domains ),
>
> Glenn, what are these restrictions you're talking about?  As far as 
> I know, there are no restrictions on SMTP-Auth. There are, however, 
> restrictions on POP-before-SMTP that have to do with the POP login 
> name matching the email address.  Please explain this.
   Oops, my bad!  I got the two confused and reversed on attributes and usage.

   Sorry for the error, too much late-nitght mail reading.

   { snip }

> >    I looked in my logs and there doesn't seem to be any difference 
> > between the SMTP-Accept/SMTP-Deliver logging for an incoming or 
> > outgoing msg.
> >
> >    Also, I thought that POP-before-SMTP was based on an ID/IP 
> > address pair for successful sending, how can an "outsider" obtain 
> > that information in order to exploit the system?
>
> The current implementation is based on user account information, not 
> IP address.
   Makes sense.

   Does "current implementation" imply that the previous 
implementation used the IP address in some way?  That was my 
impression.

   Thanks for your clarification and help in these matters.

Glenn

---------
Tenon Intersystems' Post.Office Mailing List
To unsubscribe: send mailto:post_office-request@xxxxxxxxxxxxxxx
with the body only containing: unsubscribe
Find the searchable mailing list archives at:
http://postoffice.computeroil.com/