Re: [Declude.Virus] SMTP AUTH - Imail v6.06

2002-05-16 Thread Jack Taugher


- Original Message -
 (IMail v6.06 - SMTP AUTH)
 
 We need to enable SMTP AUTH for all of our clients -- we've found some
 device/person (IP) on the outside of our network spoofing emails to lists
by
 the few users who are authorized list posters.
 
 In order to do this, is it best that we just check No Mail Relay on the
 server and make all of our users go through the few steps to do SMTP
AUTH?

 However, I don't believe that will prevent people from sending mail to the
 list using forged return addresses, since SMTP AUTH only applies to
 outgoing (relayed) E-mail.
 -Scott

In reply, doesn't IMail (SMTP AUTH) not allow email to be relayed unless a
password is supplied during login?   If that is true -- then how could
someone forge a return address without having a password to send mail?

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.Virus] SMTP AUTH - Imail v6.06

2002-05-16 Thread R. Scott Perry


  We need to enable SMTP AUTH for all of our clients -- we've found some
  device/person (IP) on the outside of our network spoofing emails to lists
  by the few users who are authorized list posters.
 
  However, I don't believe that will prevent people from sending mail to the
  list using forged return addresses, since SMTP AUTH only applies to
  outgoing (relayed) E-mail.

In reply, doesn't IMail (SMTP AUTH) not allow email to be relayed unless a
password is supplied during login?   If that is true -- then how could
someone forge a return address without having a password to send mail?

If you require SMTP AUTH, then users have to supply a valid E-mail address 
and password.  However, that only applies to *relayed* mail (outgoing 
mail).  For incoming mail (such as to a mailing list), SMTP AUTH is not 
required (or else you wouldn't be able to receive any mail from anyone who 
didn't have an account on the server).
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.Virus] SMTP AUTH - Imail v6.06

2002-05-16 Thread Serge

If you require SMTP AUTH, then users have to supply a valid E-mail address
 and password

Do Imail compare this adress to the from adress you use ?



- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, May 16, 2002 3:36 PM
Subject: Re: [Declude.Virus] SMTP AUTH - Imail v6.06



   We need to enable SMTP AUTH for all of our clients -- we've found
some
   device/person (IP) on the outside of our network spoofing emails to
lists
   by the few users who are authorized list posters.
  
   However, I don't believe that will prevent people from sending mail to
the
   list using forged return addresses, since SMTP AUTH only applies to
   outgoing (relayed) E-mail.
 
 In reply, doesn't IMail (SMTP AUTH) not allow email to be relayed unless
a
 password is supplied during login?   If that is true -- then how could
 someone forge a return address without having a password to send mail?

 If you require SMTP AUTH, then users have to supply a valid E-mail address
 and password.  However, that only applies to *relayed* mail (outgoing
 mail).  For incoming mail (such as to a mailing list), SMTP AUTH is not
 required (or else you wouldn't be able to receive any mail from anyone who
 didn't have an account on the server).
  -Scott

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 This E-mail came from the Declude.Virus mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.  You can E-mail
 [EMAIL PROTECTED] for assistance.  You can visit our web
 site at http://www.declude.com .
 ---
 [This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.Virus] SMTP AUTH - Imail v6.06

2002-05-14 Thread R. Scott Perry


(IMail v6.06 - SMTP AUTH)

We need to enable SMTP AUTH for all of our clients -- we've found some
device/person (IP) on the outside of our network spoofing emails to lists by
the few users who are authorized list posters.

In order to do this, is it best that we just check No Mail Relay on the
server and make all of our users go through the few steps to do SMTP AUTH?

That's the best way to make sure that you are not an open relay (you could 
instead use Relay for Addresses, and enter some safe IP addresses, and 
have everyone not coming from those IPs use SMTP AUTH ).

However, I don't believe that will prevent people from sending mail to the 
list using forged return addresses, since SMTP AUTH only applies to 
outgoing (relayed) E-mail.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



RE: [Declude.Virus] SMTP AUTH - Imail v6.06

2002-05-14 Thread Lists - Declude Virus

Yes, your absolutely right.

You can include your internal addresses, if applicable, in the addresses
box to insure your own systems won't need auth if you wish.

Maintain,
Babul
 
(210) 696-1130, ext. 102
(210) 696-0572 [fax]
 
The Montopolis Group - www.montopolis.com 
Building stronger businesses... with Technology


-Original Message-
From: Jack Taugher [mailto:[EMAIL PROTECTED]] 
Posted At: Tuesday, May 14, 2002 12:16 PM
Posted To: Lists - Declude Virus
Conversation: [Declude.Virus] SMTP AUTH - Imail v6.06
Subject: [Declude.Virus] SMTP AUTH - Imail v6.06


(IMail v6.06 - SMTP AUTH)

We need to enable SMTP AUTH for all of our clients -- we've found some
device/person (IP) on the outside of our network spoofing emails to
lists by
the few users who are authorized list posters.

In order to do this, is it best that we just check No Mail Relay on
the
server and make all of our users go through the few steps to do SMTP
AUTH?




---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .