On Wed, 26 Feb 2003, Dan Brotsky wrote: > Yes, exactly, you understood quite clearly. > > Keep in mind that the "treat authenticated IPs as local hosts" setting > introduces only a very, very small security risk (especially if the > timing is set small, around 15 seconds). So there's not what I would > consider a pressing need to turn it off.
I think "security risk" would be a misnomer. The only possible negative result of this is that, once the user has logged in via POP (or APOP) they could relay mail through your box. If someone is able to sniff the password (impossible with APOP) they could relay mail through your box from anywhere (by first loggin in via POP). The legnth of the setting would not influence this much, as a spammer could cimply use a script to re-check via POP each time before sending. POP before relay is a common approach for many servers, and is not likely to cause much trouble. Just be sure your users have decent passwords (non dictionary words, at least one letter and one punctuation mark). This is much easier said than done, as every user wants their cat's name as their password... -- Joe Laffey | Want to convert subnet masks between different LAFFEY Computer Imaging | notations, or figure the number of IPs in a block? St. Louis, MO | Whatmask-It's FREE - www.laffeycomputer.com/wm.html ------------------------------------------------------------------------------ ############################################################# This message is sent to you because you are subscribed to the mailing list <[EMAIL PROTECTED]>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
