On Mon, 28 Feb 2005 16:54:23 EST, Nils Ketelsen said: > An interesting theory. What is the substantial difference? For > me the security implications of "allowing the user to bypass our > mailsystem on port 25" and ""allowing the user to bypass our mailsystem on > port 587" are not as obvious as they maybe are to you.
The big difference is that if they connect on outbound 25, they're basically unauthenticated at the other end. Port 587 "should be" authenticated, which means that the machine making the connection out is presumably a legitimate user of the destination mail server. If you're managing a corporate network, then yes, the distinction isn't that obvious, as you're restricting your own users. If you're running an ISP, you're being paid to *connect* people to other places, and making it more difficult than necessary is.. well... a Randy Bush quote. ;)
pgpa6T1DY9Pcq.pgp
Description: PGP signature
