Noel On Sun, 2002-06-23 at 05:56, Noel J. Bergman wrote: > Andrew, > > > I have disabled RemoteNotInNetwork so that users who are dialing in > > through unknown ISP's can provide a password to send email. > > Yes ... but how do you know in the processor which e-mail originated via > SMTP AUTH? FWIW, at the moment, we solve the general problem with ssh > tunneling.
This is a great solution with the more technically minded. We are unfortunately dealing with various skills of user. If I had to complicate their lives with SSH tunelling, they would probably revert to paper, quill and the pony express :-) > > > My second point is that I want to disable SMTP AUTH if the email comes > > from an ip within a specified network. > > Disable it, or not require it? Not require it. ie. Sender is local, allow him to send anywhere otherwise ask for AUTH if not sending to a local user. > > > If this can be implemented, the hole can be closed by checking that the > > MAIL FROM:<> mail originates within the network. > > RemoteAddr(Not)InNetwork should cover that aspect. This would need to be coupled with a match on Sender so that we can check if Sender == null && RemoteAddrNotInNetwork -> Error|Spam > > > Is there a valid reason to accept null senders through the SMTPHandler? > > No idea. Ask Serge. I haven't checked the SMTP RFC to see if a null sender > is legit. > > --- Noel > Andrew -- To unsubscribe, e-mail: <mailto:[EMAIL PROTECTED]> For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>
