On 26/12/17 21:28, Sebastian Arcus via Exim-users wrote:
> What is the simplest and best way to disable any AUTH on port 25? Up
> until now I have the following working:
>
> 1. Only advertise TLS on port 587:
>
> auth_advertise_hosts = ${if eq{$tls_cipher}{}{}{*}}
I don't see a port number there. It does not do what you want.
>
> 2. Disable authenticated connections without TLS:
>
> acl_check_auth
>
> deny message = TLS required on authenticated connections
> ! encrypted = *
OK in its own right, but pointless given the above
>
>
> However, I just realised that this disables opportunistic TLS in the
> SMTP transport (server to server).
No, it does not.
> Could I use something like server_advertise_condition instead to only
> advertise AUTH on port 587 (and if yes, will that disallow AUTH on 25
> completely, not just not advertise it?
You could, and yes (because by default unadvertised-AUTH is not
permitted). It remains wise to advertise plaintext AUTH methods
only on encrypted connections.
--
Cheers,
Jeremy
--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
